last executing test programs: 9m21.04076237s ago: executing program 0 (id=151): r0 = syz_ublk_setup_io_uring(0x77b1, &(0x7f0000000680)={0x0, 0x75ab, 0x800, 0x3, 0x24d}, &(0x7f00000001c0), &(0x7f0000000200), &(0x7f00000002c0)) io_uring_register$IORING_REGISTER_BUFFERS2(r0, 0xf, &(0x7f0000002f40)={0x2, 0x0, 0x0, &(0x7f0000002e80)=[{&(0x7f0000000080)=""/182, 0xb6}, {0x0}], &(0x7f0000002ec0)=[0x8, 0x48d822aa]}, 0x20) 9m20.881390542s ago: executing program 0 (id=152): socket$kcm(0x10, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x2, 0x300) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8153, 0x2000, 0x800, 0x9, 0x3}, 0x20) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) bind$xdp(r0, &(0x7f00000003c0)={0x2c, 0x2, r2, 0x0, 0x0}, 0x10) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x80000000) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000040)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x8000000000000000}, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[], 0x18}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) 9m18.230139679s ago: executing program 0 (id=159): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={0x0, 0xe000, 0x1000, 0x80006, 0x6}, 0x20) 9m18.03180203s ago: executing program 0 (id=161): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0) mount$bind(&(0x7f0000000100)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x9a100a, 0x0) umount2(&(0x7f0000000140)='./file0/../file0\x00', 0x4) 9m17.809810462s ago: executing program 0 (id=162): mbind(&(0x7f0000000000/0x600000)=nil, 0x600006, 0x8003, &(0x7f0000000000)=0x6, 0x8, 0x0) 9m17.381094865s ago: executing program 0 (id=163): socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x2000c015}, 0x2404c8c0) socket(0x10, 0x3, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0xd, 0x20000000000000bb, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb714000008"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xe, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41100, 0x4a, '\x00', 0x0, @sk_skb=0x5, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x4, 0x200008, 0x8, 0x20001}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32=r0], 0x4c}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 9m17.380877225s ago: executing program 32 (id=163): socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x2000c015}, 0x2404c8c0) socket(0x10, 0x3, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0xd, 0x20000000000000bb, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb714000008"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xe, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41100, 0x4a, '\x00', 0x0, @sk_skb=0x5, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x4, 0x200008, 0x8, 0x20001}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32=r0], 0x4c}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 5.640238018s ago: executing program 2 (id=1692): r0 = syz_usb_connect$cdc_ncm(0x0, 0x7a, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000700)={0x44, 0x0, 0x0, 0x0, &(0x7f00000005c0)={0x20, 0x80, 0x1c, {0x8001, 0x4, 0x7fff, 0x9, 0x8001, 0x6, 0x40, 0x80, 0x0, 0xeba9, 0x200, 0x80}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 5.545329398s ago: executing program 2 (id=1693): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x3e, [0x9, 0x7, 0x2, 0x806, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x1, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x81, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x5, 0x8000c66, 0xa8a9, 0x0, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x1, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0x3, 0x6, 0x7, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x408, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x300, 0x2, 0x6, 0x7ffe, 0x8, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x20055, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140ee, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x20100, 0xd8ce, 0x7fffffff, 0x100009, 0x0, 0x32d, 0x3, 0x1ff, 0x2000805, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x0, 0xdab, 0x5, 0x3ff, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) pipe2(0x0, 0x80000) socketpair$nbd(0x1, 0x1, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4000000000000009, 0x0) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000440)) r1 = fsopen(0x0, 0x0) fsmount(r1, 0x0, 0x80) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f00000013c0)=0x80000000001, 0x4) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) dup3(r2, r3, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000080)=0x40) 5.417106959s ago: executing program 2 (id=1694): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000200000000000000010000000800010000000000040004800800020001000000100008800c"], 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 5.33685402s ago: executing program 2 (id=1695): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r3) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000280)=0x15) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, 0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x2042, 0x0) 4.482113446s ago: executing program 1 (id=1700): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) r3 = fcntl$dupfd(r2, 0x406, r2) read$FUSE(r3, &(0x7f00000040c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x29bb9) write$FUSE_ATTR(r3, &(0x7f0000000280)={0x78, 0xfffffffffffffff5, 0x0, {0x2, 0x3, 0xff010000, {0x0, 0x6, 0x400000000000000b, 0x0, 0x7ff, 0x2, 0x2, 0xd, 0x5, 0xa000, 0xa40, 0x0, r4, 0x3001, 0x2}}}, 0xffffff03) 2.491845621s ago: executing program 1 (id=1701): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000008c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x540, 0x3d8, 0x290, 0xf0, 0x3d8, 0x0, 0x538, 0x538, 0x538, 0x538, 0x538, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@dev={0xac, 0x14, 0x14, 0x3a}, @ipv6=@local, 0x1, 0x18, 0xac}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x93, 0x6}}}, {{@ipv6={@private0, @mcast1, [0x0, 0xffffffff, 0x0, 0xffffffff], [0xffffff00, 0xff000000, 0xff000000, 0xffffffff], 'pim6reg\x00', 'vlan1\x00', {0xff}, {}, 0x4, 0x0, 0x2, 0x5}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0xfff7, 0xfffd}}}, {{@ipv6={@mcast2, @private0={0xfc, 0x0, '\x00', 0x1}, [0x0, 0xffffff, 0xffffff00, 0xffffff00], [0xffffffff, 0xffffffff, 0xff000000, 0xff], 'vlan0\x00', 'ip6_vti0\x00', {0xff}, {0xff}, 0x5c, 0x2, 0x4, 0x3}, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@remote, @ipv6=@remote, 0x1f, 0x1e, 0x54}}}, {{@ipv6={@private1={0xfc, 0x1, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x24}, [0xffffff00, 0xffffffff, 0xffffff00, 0xff000000], [0x0, 0xff, 0xff, 0xffffffff], 'bond0\x00', 'veth0_to_batadv\x00', {}, {}, 0x84, 0x9, 0x2}, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@multicast2, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x1d, 0x22, 0xfffa}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5a0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r0, 0x400c4d01, &(0x7f0000000900)) 2.430919622s ago: executing program 1 (id=1702): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r6) r7 = socket$unix(0x1, 0x5, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000017c0)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r10, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xffff, 0xffff}, {0xffff, 0xfffc}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0x7, 0x8005, 0x5, 0xfffffdff, 0x4006}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x9, 0x9, 0x5, 0x96, 0xfff, 0xc}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240080c1}, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 2.012162925s ago: executing program 2 (id=1703): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) 1.999776215s ago: executing program 1 (id=1704): setns(0xc9, 0x0) socket$netlink(0x10, 0x3, 0xb) socket$unix(0x1, 0x1, 0x0) socket(0x400000000010, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, 0x0, {0xfffe}, {}, {0x5, 0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x62b9, 0x5, 0xfffffff7, 0x5, 0x3, 0xe1cb, 0x5, 0x1, 0x3, 0x0, 0x1, 0x2, 0x6, 0xacd, 0x0, 0x364, 0x1, 0x2, 0xffffff41, 0x3, 0x2, 0x8, 0x3, 0x9, 0xffffffc0, 0xf0000000, 0x688, 0xffff, 0x0, 0x2, 0x80000001, 0x0, 0xe, 0x5, 0xe018, 0x5, 0xffffadc0, 0x8001, 0xf, 0x4, 0x8d2a00, 0x8, 0xf, 0x4ba, 0x10001, 0x80, 0xffff, 0x1, 0xb, 0x0, 0x400, 0xe5, 0x93, 0x5, 0x45a5, 0x8, 0x6, 0x4, 0x0, 0x2, 0x3, 0x80, 0x0, 0x1, 0x9, 0x5, 0x403, 0x9, 0x3f32f5d7, 0x3, 0x4, 0x7f, 0x101, 0xde, 0x101, 0x7, 0x6, 0x7f, 0xfff, 0x6, 0x9, 0xf7, 0x5, 0x2, 0x81, 0x0, 0x6, 0x7, 0x1, 0x437, 0x6, 0x3, 0x2, 0x7000000, 0x5, 0x9, 0xeca, 0x6, 0x4, 0x8, 0x400, 0x7a5, 0x9, 0x9, 0x0, 0x9, 0x8, 0x40, 0x3, 0x7ff, 0x5, 0x6, 0x4, 0x7, 0x10, 0x4001d1da, 0x8, 0x5, 0x1, 0x7, 0x8001, 0xe3c8, 0xffffffff, 0xd, 0x8006, 0x4, 0x9, 0x7fffffff, 0x3, 0xb8b4, 0x723, 0x15, 0x9367, 0x81, 0x400000, 0x9, 0x6, 0x75, 0x1ff, 0xc695, 0x8, 0xf, 0x7, 0x3, 0x0, 0x3ff, 0x8000, 0x4, 0x8005, 0x0, 0x6496, 0x7f, 0x3, 0x0, 0xf528, 0x6, 0x80000000, 0x5, 0x157b, 0x7, 0x40, 0x1, 0x10001, 0x3, 0x9, 0x2, 0x5, 0x2450, 0x86d, 0x2, 0x7, 0x7, 0xfffffffa, 0x804, 0xfffffffc, 0x4, 0xb6, 0x5, 0x7fff, 0x9f4c, 0x1, 0x8, 0xe, 0x121, 0x7fff, 0x3, 0x8, 0x3, 0xa, 0x9, 0x9, 0x2, 0x4, 0x2, 0x8, 0x5, 0x5, 0x401, 0x9, 0x4b8, 0xa78, 0xec8, 0x1, 0xfffffffa, 0x80020003, 0x0, 0x0, 0x2, 0x8c1, 0x5, 0xfffffffa, 0x6, 0x175b, 0x7fffffff, 0x4, 0xb4, 0xffff8001, 0x8001, 0xffff, 0x5, 0x0, 0x401, 0x5, 0x10, 0x7fff, 0xffffff00, 0x3, 0x8, 0x9268, 0x80000003, 0x2, 0x7, 0x4, 0x3, 0x4, 0xced, 0x5, 0xa524, 0x7, 0x81f, 0x3, 0x10, 0x84, 0x1ff, 0x1109, 0x9, 0x1, 0x1, 0x2, 0x0, 0x8, 0x7f, 0x3, 0x6, 0x4]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x2004009c}, 0x0) r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x54, 0x0, 0x2, {0xfffd, 0x1}, {0x38, 0x2}}) write$char_usb(r0, &(0x7f0000000040)="e2", 0x2250) 1.891137396s ago: executing program 2 (id=1705): openat(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = msgget$private(0x0, 0x193) msgsnd(r1, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x8, 0x0) msgrcv(r1, &(0x7f0000001240)={0x0, ""/144}, 0x98, 0x3, 0x2000) msgrcv(r1, 0x0, 0x0, 0x3, 0x1000) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x80, 0x0) close(0xffffffffffffffff) mount$tmpfs(0x0, 0x0, 0x0, 0x86022, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) setns(0xc9, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_smc(0x2b, 0x1, 0x0) 1.890819016s ago: executing program 1 (id=1706): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg$sock(r0, &(0x7f0000007480), 0x29e15b2, 0x0) 0s ago: executing program 1 (id=1707): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r4 = socket$inet(0x2, 0x2, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000240)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x7, 0xfff2}, {0xa, 0xffff}, {0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_skbmod={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0xd7, 0xd782, 0x8, 0x704, 0x4}, 0x10}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4008040}, 0x4000000) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="000108"], 0x1c) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:33705' (ED25519) to the list of known hosts. syzkaller login: [ 75.040087][ T3369] cgroup: Unknown subsys name 'net' [ 75.259600][ T3369] cgroup: Unknown subsys name 'cpuset' [ 75.281049][ T3369] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 75.614333][ T3369] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 82.813838][ T3376] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.866278][ T3376] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.937710][ T3375] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.078327][ T3375] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.766611][ T3376] hsr_slave_0: entered promiscuous mode [ 83.770941][ T3376] hsr_slave_1: entered promiscuous mode [ 83.927355][ T3375] hsr_slave_0: entered promiscuous mode [ 83.931894][ T3375] hsr_slave_1: entered promiscuous mode [ 83.936721][ T3375] debugfs: 'hsr0' already exists in 'hsr' [ 83.938342][ T3375] Cannot create hsr debugfs directory [ 84.740971][ T3376] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 84.769499][ T3376] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.781501][ T3376] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 84.800258][ T3376] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.818556][ T3376] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 84.837555][ T3376] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.854430][ T3376] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 84.871402][ T3376] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.961551][ T3375] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 84.977080][ T3375] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.987193][ T3375] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 85.001208][ T3375] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 85.018990][ T3375] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 85.033518][ T3375] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 85.045276][ T3375] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 85.059839][ T3375] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 85.860831][ T3376] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.996352][ T3375] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.947428][ T3376] veth0_vlan: entered promiscuous mode [ 88.025800][ T3376] veth1_vlan: entered promiscuous mode [ 88.162979][ T3376] veth0_macvtap: entered promiscuous mode [ 88.203872][ T3376] veth1_macvtap: entered promiscuous mode [ 88.397672][ T1217] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.399681][ T1217] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.466980][ T1217] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.467333][ T1217] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.585316][ T3375] veth0_vlan: entered promiscuous mode [ 88.627683][ T3375] veth1_vlan: entered promiscuous mode [ 88.669226][ T3376] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 88.767523][ T3375] veth0_macvtap: entered promiscuous mode [ 88.781480][ T3375] veth1_macvtap: entered promiscuous mode [ 88.895405][ T51] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.895775][ T51] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.896053][ T51] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.896199][ T51] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.092082][ T3524] netlink: 'syz.1.2': attribute type 1 has an invalid length. [ 91.922784][ T3557] netlink: 28 bytes leftover after parsing attributes in process `syz.1.11'. [ 91.930846][ T3557] netlink: 28 bytes leftover after parsing attributes in process `syz.1.11'. [ 94.553628][ T3603] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 97.626297][ T3633] syzkaller0: entered promiscuous mode [ 97.635686][ T3633] syzkaller0: entered allmulticast mode [ 97.753785][ T3635] syz.0.32 uses obsolete (PF_INET,SOCK_PACKET) [ 99.209328][ T3663] netlink: 8 bytes leftover after parsing attributes in process `syz.1.40'. [ 99.719268][ T3677] netlink: 24 bytes leftover after parsing attributes in process `syz.0.44'. [ 99.730772][ T3677] netlink: 'syz.0.44': attribute type 9 has an invalid length. [ 99.732192][ T3677] netlink: 23 bytes leftover after parsing attributes in process `syz.0.44'. [ 102.337229][ T3736] netlink: 12 bytes leftover after parsing attributes in process `syz.0.61'. [ 103.922287][ T3771] netlink: 'syz.1.71': attribute type 1 has an invalid length. [ 105.251641][ T3802] netlink: 8 bytes leftover after parsing attributes in process `syz.0.79'. [ 106.751606][ T3824] netlink: 4 bytes leftover after parsing attributes in process `syz.1.86'. [ 107.930095][ T3840] netlink: 60 bytes leftover after parsing attributes in process `syz.1.91'. [ 107.934221][ T3840] netlink: 60 bytes leftover after parsing attributes in process `syz.1.91'. [ 107.941521][ T3840] netlink: 'syz.1.91': attribute type 32 has an invalid length. [ 107.943120][ T3840] netlink: 500 bytes leftover after parsing attributes in process `syz.1.91'. [ 108.270357][ T3847] netlink: 288 bytes leftover after parsing attributes in process `syz.0.93'. [ 108.565250][ T3852] syz_tun: entered allmulticast mode [ 108.628390][ T3851] syz_tun: left allmulticast mode [ 120.340785][ T3966] syzkaller0: entered promiscuous mode [ 120.342102][ T3966] syzkaller0: entered allmulticast mode [ 121.355849][ T802] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 121.377339][ T802] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 121.729032][ T3975] fido_id[3975]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 122.717633][ T3998] netlink: 80 bytes leftover after parsing attributes in process `syz.1.145'. [ 123.556454][ T3982] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 127.456717][ T1641] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.610517][ T1641] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.731361][ T1641] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.929877][ T1641] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.047626][ T1641] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 129.095992][ T1641] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 129.171310][ T1641] bond0 (unregistering): Released all slaves [ 129.357315][ T1641] hsr_slave_0: left promiscuous mode [ 129.369227][ T1641] hsr_slave_1: left promiscuous mode [ 129.410783][ T1641] veth1_macvtap: left promiscuous mode [ 129.412459][ T1641] veth0_macvtap: left promiscuous mode [ 129.414313][ T1641] veth1_vlan: left promiscuous mode [ 129.416092][ T1641] veth0_vlan: left promiscuous mode [ 130.468031][ T4059] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 131.032837][ T4057] 8021q: adding VLAN 0 to HW filter on device bond0 [ 131.251484][ T4057] veth1_vlan: left promiscuous mode [ 131.258483][ T4057] veth0_vlan: left promiscuous mode [ 131.268469][ T4057] veth0_vlan: entered promiscuous mode [ 131.287648][ T4057] veth1_vlan: entered promiscuous mode [ 131.342210][ T4057] veth1_macvtap: left promiscuous mode [ 131.349486][ T4057] veth0_macvtap: left promiscuous mode [ 131.359236][ T4057] veth0_macvtap: entered promiscuous mode [ 131.371432][ T4057] veth1_macvtap: entered promiscuous mode [ 131.409822][ T4057] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 131.420230][ T4057] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 131.430041][ T4057] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 131.439318][ T4057] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 132.547332][ T3221] 8021q: adding VLAN 0 to HW filter on device eth1 [ 133.302484][ T4038] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 133.323961][ T4038] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 133.560530][ T3221] 8021q: adding VLAN 0 to HW filter on device eth2 [ 134.489084][ T4038] hsr_slave_0: entered promiscuous mode [ 134.493946][ T4038] hsr_slave_1: entered promiscuous mode [ 134.501354][ T4038] debugfs: 'hsr0' already exists in 'hsr' [ 134.505683][ T4038] Cannot create hsr debugfs directory [ 134.834219][ T3221] 8021q: adding VLAN 0 to HW filter on device eth3 [ 135.224373][ T4038] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 135.253410][ T4038] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 135.259028][ T4038] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 135.287779][ T4038] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 135.293494][ T4038] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 135.314081][ T4038] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 135.321373][ T4038] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 135.341590][ T4038] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 136.110559][ T3221] 8021q: adding VLAN 0 to HW filter on device eth4 [ 136.171748][ T4038] 8021q: adding VLAN 0 to HW filter on device bond0 [ 138.839708][ T4038] veth0_vlan: entered promiscuous mode [ 138.887301][ T4038] veth1_vlan: entered promiscuous mode [ 139.007493][ T4038] veth0_macvtap: entered promiscuous mode [ 139.033468][ T4038] veth1_macvtap: entered promiscuous mode [ 139.207795][ T1225] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.209659][ T1225] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.225238][ T1217] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.308336][ T1225] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.520723][ T4177] syzkaller0: entered promiscuous mode [ 140.521054][ T4177] syzkaller0: entered allmulticast mode [ 143.300632][ T4184] syzkaller0: entered promiscuous mode [ 143.301045][ T4184] syzkaller0: entered allmulticast mode [ 143.654334][ T4194] veth1_macvtap: left promiscuous mode [ 143.681592][ T4192] netlink: 12 bytes leftover after parsing attributes in process `syz.2.180'. [ 145.580699][ T4229] xt_hashlimit: max too large, truncated to 1048576 [ 145.740949][ T3221] veth1_macvtap: entered promiscuous mode [ 145.800586][ T4231] Illegal XDP return value 4294965632 on prog (id 8) dev syz_tun, expect packet loss! [ 146.630864][ T4244] netlink: 28 bytes leftover after parsing attributes in process `syz.2.198'. [ 146.635778][ T4244] Zero length message leads to an empty skb [ 148.290277][ T4276] syzkaller0: entered promiscuous mode [ 148.290524][ T4276] syzkaller0: entered allmulticast mode [ 150.229163][ C0] vcan0: j1939_tp_rxtimer: 0x0000000035450ae5: rx timeout, send abort [ 150.729363][ C0] vcan0: j1939_tp_rxtimer: 0x00000000f5106af2: rx timeout, send abort [ 150.730105][ C0] vcan0: j1939_tp_rxtimer: 0x0000000035450ae5: abort rx timeout. Force session deactivation [ 151.230509][ C0] vcan0: j1939_tp_rxtimer: 0x00000000f5106af2: abort rx timeout. Force session deactivation [ 151.698077][ T4334] netlink: 'syz.1.225': attribute type 3 has an invalid length. [ 152.859604][ T4352] netlink: 'syz.2.232': attribute type 1 has an invalid length. [ 152.933155][ T4352] 8021q: adding VLAN 0 to HW filter on device bond1 [ 153.010967][ T4352] bond1: (slave veth3): Enslaving as an active interface with a down link [ 153.670174][ T1641] bond1: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 153.686039][ T1641] bond1: (slave veth3): making interface the new active one [ 153.692802][ T1641] bond1: active interface up! [ 153.901489][ T4357] netlink: 8 bytes leftover after parsing attributes in process `syz.2.233'. [ 153.902027][ T4357] netlink: 12 bytes leftover after parsing attributes in process `syz.2.233'. [ 153.908204][ T4357] tc_dump_action: action bad kind [ 154.381428][ T4363] netlink: 4 bytes leftover after parsing attributes in process `syz.2.236'. [ 158.306897][ T4428] netlink: 24 bytes leftover after parsing attributes in process `syz.2.256'. [ 159.350672][ T4444] netlink: 'syz.2.263': attribute type 4 has an invalid length. [ 162.535194][ T4489] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 166.903291][ T4533] syzkaller0: entered promiscuous mode [ 166.905665][ T4533] syzkaller0: entered allmulticast mode [ 167.169576][ T4535] syzkaller0: entered promiscuous mode [ 167.169824][ T4535] syzkaller0: entered allmulticast mode [ 167.175728][ T4535] TC_ACT_REPEAT abuse ? [ 167.561170][ T4539] netlink: 4 bytes leftover after parsing attributes in process `syz.2.306'. [ 167.650834][ T4542] ip_tables: iptables: counters copy to user failed while replacing table [ 167.999974][ T4548] syzkaller0: entered promiscuous mode [ 168.000125][ T4548] syzkaller0: entered allmulticast mode [ 168.496890][ T4558] netlink: 8 bytes leftover after parsing attributes in process `syz.2.314'. [ 168.497271][ T4558] netlink: 8 bytes leftover after parsing attributes in process `syz.2.314'. [ 169.194006][ T4562] netlink: 136 bytes leftover after parsing attributes in process `syz.2.315'. [ 169.195985][ T4562] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 169.451200][ T4572] netlink: 4 bytes leftover after parsing attributes in process `syz.2.317'. [ 172.707524][ T4599] netlink: 16 bytes leftover after parsing attributes in process `syz.1.328'. [ 175.493215][ T4610] netlink: 44 bytes leftover after parsing attributes in process `syz.1.332'. [ 176.820694][ T4627] syzkaller0: entered promiscuous mode [ 176.821616][ T4627] syzkaller0: entered allmulticast mode [ 177.622232][ T4635] syzkaller1: entered allmulticast mode [ 179.117378][ T4666] netlink: 12 bytes leftover after parsing attributes in process `syz.1.356'. [ 179.117647][ T4666] A link change request failed with some changes committed already. Interface macvtap0 may have been left with an inconsistent configuration, please check. [ 179.918253][ T4683] netlink: 12 bytes leftover after parsing attributes in process `syz.2.363'. [ 180.650857][ T4701] syzkaller0: entered promiscuous mode [ 180.651166][ T4701] syzkaller0: entered allmulticast mode [ 182.276228][ T4706] netlink: 224 bytes leftover after parsing attributes in process `syz.1.373'. [ 189.937537][ T4765] netlink: 4 bytes leftover after parsing attributes in process `syz.1.397'. [ 189.963184][ T4765] netlink: 4 bytes leftover after parsing attributes in process `syz.1.397'. [ 189.978802][ T1192] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 189.979246][ T1192] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 189.979391][ T1192] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 189.979524][ T1192] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 190.471058][ T4773] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 202.497924][ T4844] Dropped outbound packet type=88a8 [ 202.608757][ T4846] netlink: 'syz.1.432': attribute type 29 has an invalid length. [ 204.555555][ T4830] nci: __nci_request: wait_for_completion_interruptible_timeout failed 0 [ 205.738288][ T4863] syzkaller0: entered promiscuous mode [ 205.738680][ T4863] syzkaller0: entered allmulticast mode [ 210.435512][ T28] audit: type=1326 audit(210.350:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4958 comm="syz.2.486" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbcb782e8 code=0x7ffc0000 [ 210.437837][ T28] audit: type=1326 audit(210.360:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4958 comm="syz.2.486" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbcb782e8 code=0x7ffc0000 [ 210.447463][ T28] audit: type=1326 audit(210.370:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4958 comm="syz.2.486" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbcb782e8 code=0x7ffc0000 [ 210.451857][ T28] audit: type=1326 audit(210.370:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4958 comm="syz.2.486" exe="/syz-executor" sig=0 arch=c00000b7 syscall=77 compat=0 ip=0xffffbcb782e8 code=0x7ffc0000 [ 210.458506][ T28] audit: type=1326 audit(210.380:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4958 comm="syz.2.486" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbcb782e8 code=0x7ffc0000 [ 210.464494][ T28] audit: type=1326 audit(210.380:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4958 comm="syz.2.486" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbcb782e8 code=0x7ffc0000 [ 210.471846][ T28] audit: type=1326 audit(210.390:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4958 comm="syz.2.486" exe="/syz-executor" sig=0 arch=c00000b7 syscall=436 compat=0 ip=0xffffbcb782e8 code=0x7ffc0000 [ 210.485992][ T28] audit: type=1326 audit(210.390:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4958 comm="syz.2.486" exe="/syz-executor" sig=0 arch=c00000b7 syscall=94 compat=0 ip=0xffffbcb782e8 code=0x7ffc0000 [ 210.554359][ T4963] netlink: 4 bytes leftover after parsing attributes in process `syz.1.488'. [ 217.170791][ T4993] netlink: 104 bytes leftover after parsing attributes in process `syz.1.497'. [ 219.059777][ T5022] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.062160][ T5022] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 219.202316][ T5024] veth1_to_bond: entered allmulticast mode [ 219.204252][ T5024] veth1_to_bond: entered promiscuous mode [ 219.207763][ T5023] veth1_to_bond: left promiscuous mode [ 219.210512][ T5023] veth1_to_bond: left allmulticast mode [ 219.346069][ T5026] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.347726][ T5026] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 219.501426][ T5028] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.502626][ T5028] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.109114][ T5037] netlink: 8 bytes leftover after parsing attributes in process `syz.1.517'. [ 225.059349][ T5052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 225.097224][ T5052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 232.497587][ T5088] xt_hashlimit: size too large, truncated to 1048576 [ 232.930164][ T28] audit: type=1326 audit(232.850:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5094 comm="syz.1.541" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffb33782e8 code=0x7ffc0000 [ 232.934009][ T28] audit: type=1326 audit(232.850:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5094 comm="syz.1.541" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffb33782e8 code=0x7ffc0000 [ 232.943897][ T28] audit: type=1326 audit(232.860:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5094 comm="syz.1.541" exe="/syz-executor" sig=0 arch=c00000b7 syscall=198 compat=0 ip=0xffffb337a2d8 code=0x7ffc0000 [ 232.948364][ T28] audit: type=1326 audit(232.870:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5094 comm="syz.1.541" exe="/syz-executor" sig=0 arch=c00000b7 syscall=206 compat=0 ip=0xffffb335b1ac code=0x7ffc0000 [ 233.122868][ T28] audit: type=1326 audit(233.020:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5094 comm="syz.1.541" exe="/syz-executor" sig=0 arch=c00000b7 syscall=207 compat=0 ip=0xffffb335b1ac code=0x7ffc0000 [ 233.123501][ T28] audit: type=1326 audit(233.030:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5094 comm="syz.1.541" exe="/syz-executor" sig=0 arch=c00000b7 syscall=222 compat=0 ip=0xffffb3377fe0 code=0x7ffc0000 [ 233.123810][ T28] audit: type=1326 audit(233.030:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5094 comm="syz.1.541" exe="/syz-executor" sig=0 arch=c00000b7 syscall=215 compat=0 ip=0xffffb337808c code=0x7ffc0000 [ 233.127668][ T28] audit: type=1326 audit(233.050:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5094 comm="syz.1.541" exe="/syz-executor" sig=0 arch=c00000b7 syscall=215 compat=0 ip=0xffffb337808c code=0x7ffc0000 [ 233.129354][ T28] audit: type=1326 audit(233.050:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5094 comm="syz.1.541" exe="/syz-executor" sig=0 arch=c00000b7 syscall=226 compat=0 ip=0xffffb337804c code=0x7ffc0000 [ 233.138781][ T28] audit: type=1326 audit(233.050:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5094 comm="syz.1.541" exe="/syz-executor" sig=0 arch=c00000b7 syscall=57 compat=0 ip=0xffffb335b1ac code=0x7ffc0000 [ 235.598093][ T5138] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 235.600822][ T5138] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.671347][ T5140] syz.2.560 (5140): attempted to duplicate a private mapping with mremap. This is not supported. [ 237.626705][ T5149] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 237.629840][ T5149] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 245.721039][ T5195] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 245.727191][ T5195] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 245.810489][ T5199] xt_hashlimit: size too large, truncated to 1048576 [ 246.039619][ T5199] xt_hashlimit: size too large, truncated to 1048576 [ 251.660714][ T5227] netlink: 124 bytes leftover after parsing attributes in process `syz.2.591'. [ 251.769921][ T5229] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 251.771581][ T5229] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 253.169893][ T5252] FAULT_INJECTION: forcing a failure. [ 253.169893][ T5252] name failslab, interval 1, probability 0, space 0, times 1 [ 253.171830][ T5252] CPU: 0 UID: 0 PID: 5252 Comm: syz.1.601 Tainted: G W syzkaller #0 PREEMPT [ 253.172137][ T5252] Tainted: [W]=WARN [ 253.172213][ T5252] Hardware name: linux,dummy-virt (DT) [ 253.172619][ T5252] Call trace: [ 253.173002][ T5252] show_stack+0x18/0x24 (C) [ 253.173863][ T5252] dump_stack_lvl+0x60/0x80 [ 253.173974][ T5252] dump_stack+0x18/0x24 [ 253.174075][ T5252] should_fail_ex+0x1e0/0x238 [ 253.174163][ T5252] should_failslab+0x54/0x80 [ 253.174296][ T5252] kmem_cache_alloc_noprof+0x54/0x458 [ 253.174416][ T5252] fcntl_setlk+0x50/0x33c [ 253.174509][ T5252] do_fcntl+0x134/0x7b8 [ 253.174696][ T5252] __arm64_sys_fcntl+0x88/0xfc [ 253.174775][ T5252] invoke_syscall+0x54/0x10c [ 253.174845][ T5252] el0_svc_common.constprop.0+0x40/0xe0 [ 253.174990][ T5252] do_el0_svc+0x1c/0x34 [ 253.175099][ T5252] el0_svc+0x38/0x1fc [ 253.175181][ T5252] el0t_64_sync_handler+0xa0/0xe4 [ 253.175262][ T5252] el0t_64_sync+0x1a4/0x1a8 [ 253.295920][ T5254] FAULT_INJECTION: forcing a failure. [ 253.295920][ T5254] name failslab, interval 1, probability 0, space 0, times 0 [ 253.296173][ T5254] CPU: 0 UID: 0 PID: 5254 Comm: syz.1.602 Tainted: G W syzkaller #0 PREEMPT [ 253.296239][ T5254] Tainted: [W]=WARN [ 253.296257][ T5254] Hardware name: linux,dummy-virt (DT) [ 253.296286][ T5254] Call trace: [ 253.296304][ T5254] show_stack+0x18/0x24 (C) [ 253.296365][ T5254] dump_stack_lvl+0x60/0x80 [ 253.296413][ T5254] dump_stack+0x18/0x24 [ 253.296459][ T5254] should_fail_ex+0x1e0/0x238 [ 253.296550][ T5254] should_failslab+0x54/0x80 [ 253.296633][ T5254] kmem_cache_alloc_noprof+0x54/0x458 [ 253.296730][ T5254] security_inode_alloc+0x30/0x1a0 [ 253.296892][ T5254] inode_init_always_gfp+0x174/0x254 [ 253.297002][ T5254] alloc_inode+0x40/0xdc [ 253.297097][ T5254] new_inode+0x14/0x88 [ 253.297167][ T5254] __debugfs_create_file+0x60/0x198 [ 253.297259][ T5254] debugfs_create_file_full+0x1c/0x28 [ 253.297300][ T5254] ref_tracker_dir_debugfs+0xe0/0x160 [ 253.297338][ T5254] preinit_net+0xdc/0x160 [ 253.297399][ T5254] copy_net_ns+0xa0/0x354 [ 253.297490][ T5254] create_new_namespaces+0x114/0x370 [ 253.297612][ T5254] unshare_nsproxy_namespaces+0x70/0xbc [ 253.297651][ T5254] ksys_unshare+0x1cc/0x3b8 [ 253.297727][ T5254] __arm64_sys_unshare+0x14/0x24 [ 253.297765][ T5254] invoke_syscall+0x54/0x10c [ 253.297820][ T5254] el0_svc_common.constprop.0+0x40/0xe0 [ 253.297858][ T5254] do_el0_svc+0x1c/0x34 [ 253.297924][ T5254] el0_svc+0x38/0x1fc [ 253.298054][ T5254] el0t_64_sync_handler+0xa0/0xe4 [ 253.298134][ T5254] el0t_64_sync+0x1a4/0x1a8 [ 253.305331][ T5254] debugfs: out of free dentries, can not create file 'net_notrefcnt@000000004112b6ba' [ 254.366786][ T5279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 254.368654][ T5279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 254.506534][ T5282] binder: 5281:5282 ioctl c018620c 20000100 returned -1 [ 263.192210][ T5311] capability: warning: `syz.2.623' uses 32-bit capabilities (legacy support in use) [ 267.410122][ T5325] syzkaller0: entered promiscuous mode [ 267.413067][ T5325] syzkaller0: entered allmulticast mode [ 272.182871][ T5357] xt_hashlimit: size too large, truncated to 1048576 [ 273.536422][ T5369] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 273.540958][ T5369] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 275.001437][ T5376] netlink: 104 bytes leftover after parsing attributes in process `syz.1.651'. [ 275.547585][ T5380] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 275.550073][ T5380] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 277.492477][ T5416] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 277.493945][ T5416] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 277.517415][ T5417] netlink: 'syz.2.669': attribute type 5 has an invalid length. [ 284.022978][ T5436] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 284.024415][ T5436] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 284.309765][ T5433] binder: 5432:5433 BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active [ 284.311583][ T5433] binder: 5432:5433 ioctl c0306201 20000640 returned -22 [ 284.891113][ T5448] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 284.892555][ T5448] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 292.073598][ T5494] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 292.084043][ T5494] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 292.241181][ T5498] capability: warning: `syz.1.701' uses deprecated v2 capabilities in a way that may be insecure [ 292.329131][ T5500] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 292.343748][ T5500] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 292.557792][ T5504] binder: 5503:5504 ioctl 541b 0 returned -22 [ 292.838854][ T5493] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 292.841648][ T5493] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 293.288086][ T5509] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 293.301620][ T5509] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 293.667370][ T5514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 293.670291][ T5514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 293.985687][ T5512] batadv_slave_1: entered promiscuous mode [ 295.177228][ T5505] batadv_slave_1: left promiscuous mode [ 301.501995][ T5534] binder: 5533:5534 ERROR: BC_REGISTER_LOOPER called without request [ 301.503892][ T5534] binder: 5533:5534 ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER [ 302.043442][ T5543] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 302.048393][ T5543] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 302.320601][ T5553] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 302.321877][ T5553] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 306.300333][ T5566] xt_hashlimit: size too large, truncated to 1048576 [ 313.452010][ T5592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 313.453526][ T5592] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 313.903545][ T5598] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 313.907670][ T5598] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 324.329538][ T5652] netlink: 4 bytes leftover after parsing attributes in process `syz.1.761'. [ 325.009956][ T5658] xt_hashlimit: size too large, truncated to 1048576 [ 334.541241][ T5730] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 334.542791][ T5730] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 335.413237][ T5737] xt_CONNSECMARK: invalid mode: 0 [ 339.481760][ T5743] netlink: 'syz.1.796': attribute type 13 has an invalid length. [ 339.482186][ T5743] netlink: 'syz.1.796': attribute type 27 has an invalid length. [ 339.679789][ T5745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 339.701635][ T5745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 347.611970][ T5790] netlink: 'syz.2.814': attribute type 1 has an invalid length. [ 347.880162][ T5796] mmap: syz.1.817 (5796) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 353.549474][ T5819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 353.550354][ T5819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 355.292893][ T5852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 355.294453][ T5852] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 362.668150][ T5881] netlink: 48 bytes leftover after parsing attributes in process `syz.1.851'. [ 362.671769][ T5881] netlink: 4 bytes leftover after parsing attributes in process `syz.1.851'. [ 362.674055][ T5881] netlink: 96 bytes leftover after parsing attributes in process `syz.1.851'. [ 367.391348][ T5921] netlink: 72 bytes leftover after parsing attributes in process `syz.2.863'. [ 368.211824][ T5932] syzkaller0: entered promiscuous mode [ 368.212198][ T5932] syzkaller0: entered allmulticast mode [ 368.220428][ T5939] syz_tun: entered allmulticast mode [ 368.332388][ T5938] syz_tun: left allmulticast mode [ 368.479042][ T5943] syz_tun: entered allmulticast mode [ 368.612019][ T5942] syz_tun: left allmulticast mode [ 368.758854][ T5949] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 369.464123][ T5958] syzkaller0: entered promiscuous mode [ 369.464381][ T5958] syzkaller0: entered allmulticast mode [ 369.529054][ T5966] netlink: 4 bytes leftover after parsing attributes in process `syz.2.880'. [ 369.670477][ T1641] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 369.670898][ T1641] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 369.671315][ T1641] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 369.671514][ T1641] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 369.899888][ T5968] syzkaller0: entered promiscuous mode [ 369.901486][ T5968] syzkaller0: entered allmulticast mode [ 371.325505][ T5982] lo: entered allmulticast mode [ 371.356208][ T5981] nbd: must specify at least one socket [ 372.777885][ T6004] netlink: 8 bytes leftover after parsing attributes in process `syz.1.895'. [ 372.778231][ T6004] netlink: 'syz.1.895': attribute type 12 has an invalid length. [ 372.778431][ T6004] netlink: 4 bytes leftover after parsing attributes in process `syz.1.895'. [ 372.818357][ T6004] netlink: 8 bytes leftover after parsing attributes in process `syz.1.895'. [ 372.818853][ T6004] netlink: 'syz.1.895': attribute type 12 has an invalid length. [ 372.822993][ T6004] netlink: 4 bytes leftover after parsing attributes in process `syz.1.895'. [ 373.179290][ T6011] netlink: 'syz.1.897': attribute type 4 has an invalid length. [ 377.141270][ T6054] netlink: 220 bytes leftover after parsing attributes in process `syz.1.909'. [ 377.603507][ T6060] syzkaller0: entered promiscuous mode [ 377.603847][ T6060] syzkaller0: entered allmulticast mode [ 377.610835][ T6060] TC_ACT_REPEAT abuse ? [ 381.432218][ T6093] netlink: 'syz.2.922': attribute type 1 has an invalid length. [ 381.556418][ T6093] veth5: entered allmulticast mode [ 381.567566][ T6093] bond2: (slave veth5): Enslaving as an active interface with a down link [ 381.593963][ T6093] bond2: (slave veth0_to_bond): making interface the new active one [ 381.599165][ T6093] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 386.745567][ T6134] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 386.747291][ T6134] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 399.328792][ T6212] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 399.330357][ T6212] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 404.506542][ T6232] netlink: 'syz.2.962': attribute type 4 has an invalid length. [ 411.851548][ T6267] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 411.852959][ T6267] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 415.476764][ T6276] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 415.490144][ T6276] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 426.161886][ T6280] tunl0: entered allmulticast mode [ 426.168393][ T6280] gre0: entered allmulticast mode [ 426.176353][ T6280] gretap0: entered allmulticast mode [ 426.188090][ T6280] erspan0: entered allmulticast mode [ 426.193502][ T6280] ip_vti0: entered allmulticast mode [ 426.202036][ T6280] ip6_vti0: entered allmulticast mode [ 426.206094][ T6280] sit0: entered allmulticast mode [ 426.211457][ T6280] ip6tnl0: entered allmulticast mode [ 426.214129][ T6280] ip6gre0: entered allmulticast mode [ 426.220648][ T6280] syz_tun: entered allmulticast mode [ 426.223169][ T6280] ip6gretap0: entered allmulticast mode [ 426.241110][ T6280] vcan0: entered allmulticast mode [ 426.256468][ T6280] bond0: entered allmulticast mode [ 426.258982][ T6280] bond_slave_0: entered allmulticast mode [ 426.262723][ T6280] bond_slave_1: entered allmulticast mode [ 426.276974][ T6280] dummy0: entered allmulticast mode [ 426.285674][ T6280] nlmon0: entered allmulticast mode [ 426.290729][ T6280] vxcan0: entered allmulticast mode [ 426.298752][ T6280] vxcan1: entered allmulticast mode [ 426.303860][ T6280] veth0: entered allmulticast mode [ 426.311264][ T6280] veth1: entered allmulticast mode [ 426.318719][ T6280] wg0: entered allmulticast mode [ 426.323932][ T6280] wg1: entered allmulticast mode [ 426.331533][ T6280] wg2: entered allmulticast mode [ 426.337640][ T6280] veth0_to_bridge: entered allmulticast mode [ 426.349046][ T6280] bridge_slave_0: entered allmulticast mode [ 426.357806][ T6280] veth1_to_bridge: entered allmulticast mode [ 426.363027][ T6280] bridge_slave_1: entered allmulticast mode [ 426.369137][ T6280] veth0_to_bond: entered allmulticast mode [ 426.395370][ T6280] bond2: (slave veth0_to_bond): Releasing active interface [ 426.456883][ T6280] bond0: (slave bond_slave_0): Releasing backup interface [ 426.504438][ T6280] veth1_to_bond: entered allmulticast mode [ 426.519894][ T6280] bond0: (slave bond_slave_1): Releasing backup interface [ 426.557113][ T6280] veth0_to_team: entered allmulticast mode [ 426.562918][ T6280] team_slave_0: entered allmulticast mode [ 426.569630][ T6280] veth1_to_team: entered allmulticast mode [ 426.573289][ T6280] team_slave_1: entered allmulticast mode [ 426.578221][ T6280] veth0_to_batadv: entered allmulticast mode [ 426.581828][ T6280] batadv_slave_0: entered allmulticast mode [ 426.588729][ T6280] veth1_to_batadv: entered allmulticast mode [ 426.593312][ T6280] batadv_slave_1: entered allmulticast mode [ 426.613956][ T6280] xfrm0: entered allmulticast mode [ 426.623356][ T6280] veth0_to_hsr: entered allmulticast mode [ 426.649500][ T6280] hsr_slave_0: entered allmulticast mode [ 426.653924][ T6280] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 426.952688][ T6280] netlink: 4 bytes leftover after parsing attributes in process `syz.2.977'. [ 434.965188][ T6347] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1000'. [ 436.632542][ T6372] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1009'. [ 436.663400][ T6372] vlan2: entered promiscuous mode [ 436.663727][ T6372] gretap0: entered promiscuous mode [ 437.625747][ T6404] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1020'. [ 437.705500][ T6404] bond1: entered promiscuous mode [ 437.709061][ T6404] 8021q: adding VLAN 0 to HW filter on device bond1 [ 437.752393][ T6404] vlan2: entered allmulticast mode [ 437.752713][ T6404] bond1: entered allmulticast mode [ 440.106399][ T6440] pim6reg: entered allmulticast mode [ 440.108814][ T6440] pim6reg: left allmulticast mode [ 440.973418][ T6457] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1036'. [ 440.993735][ T6457] ipvlan2: entered allmulticast mode [ 440.994099][ T6457] syz_tun: entered allmulticast mode [ 441.248351][ T6465] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1039'. [ 441.417592][ T6467] syzkaller0: entered promiscuous mode [ 441.418895][ T6467] syzkaller0: entered allmulticast mode [ 443.598021][ T6485] erspan0: entered promiscuous mode [ 443.598293][ T6485] erspan0: left allmulticast mode [ 443.618455][ T6485] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1047'. [ 451.515852][ T6528] nci: __nci_request: wait_for_completion_interruptible_timeout failed 0 [ 451.830181][ T6544] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 451.830596][ T6544] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 451.968046][ T6544] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 451.969991][ T6544] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.083256][ T6544] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 452.088785][ T6544] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.231832][ T6544] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 452.234323][ T6544] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.432547][ C1] vcan0: j1939_tp_rxtimer: 0x000000003737f045: rx timeout, send abort [ 452.565562][ T6112] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 452.567438][ T6112] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.569118][ T6112] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 452.571980][ T6112] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.615695][ T6112] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 452.615999][ T6112] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.616609][ T6112] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 452.616759][ T6112] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.692619][ T6548] netlink: 388 bytes leftover after parsing attributes in process `syz.1.1066'. [ 452.933356][ C1] vcan0: j1939_tp_rxtimer: 0x0000000029fc9787: rx timeout, send abort [ 452.933874][ C1] vcan0: j1939_tp_rxtimer: 0x000000003737f045: abort rx timeout. Force session deactivation [ 453.432006][ T6553] x_tables: unsorted entry at hook 4 [ 453.434063][ C1] vcan0: j1939_tp_rxtimer: 0x0000000029fc9787: abort rx timeout. Force session deactivation [ 453.539588][ T6556] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1068'. [ 453.819495][ T6554] bond1: left promiscuous mode [ 453.846310][ T6554] 8021q: adding VLAN 0 to HW filter on device eth0 [ 453.866878][ T6554] 8021q: adding VLAN 0 to HW filter on device eth1 [ 453.886904][ T6554] 8021q: adding VLAN 0 to HW filter on device eth2 [ 453.902653][ T6554] 8021q: adding VLAN 0 to HW filter on device eth3 [ 453.916571][ T6554] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1066'. [ 453.917377][ T6554] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1066'. [ 453.980002][ T6556] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1068'. [ 454.142071][ T6556] netlink: 830 bytes leftover after parsing attributes in process `syz.2.1068'. [ 454.142899][ T6556] veth0_to_team: entered promiscuous mode [ 454.284431][ T6559] netlink: 220 bytes leftover after parsing attributes in process `syz.2.1069'. [ 456.859066][ T6619] netlink: 19 bytes leftover after parsing attributes in process `syz.2.1091'. [ 457.068944][ T6625] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1094'. [ 457.212408][ T6629] bridge_slave_1: entered promiscuous mode [ 457.778152][ T6643] syzkaller0: entered promiscuous mode [ 457.778611][ T6643] syzkaller0: entered allmulticast mode [ 457.829989][ T6645] v: renamed from veth0_vlan (while UP) [ 458.497688][ T6649] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1103'. [ 459.397800][ T6672] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1111'. [ 463.099376][ T6705] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1123'. [ 463.100146][ T6705] bond0: Unable to set down delay as MII monitoring is disabled [ 466.127964][ T6736] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 466.128267][ T6736] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 466.291404][ T6736] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 466.296785][ T6741] syz.2.1140: vmalloc error: size 8589938688, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset= [ 466.300707][ T6736] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 466.304925][ T6741] /,mems_allowed=0 [ 466.308958][ T6741] CPU: 1 UID: 0 PID: 6741 Comm: syz.2.1140 Tainted: G W syzkaller #0 PREEMPT [ 466.309234][ T6741] Tainted: [W]=WARN [ 466.309421][ T6741] Hardware name: linux,dummy-virt (DT) [ 466.309652][ T6741] Call trace: [ 466.309959][ T6741] show_stack+0x18/0x24 (C) [ 466.310568][ T6741] dump_stack_lvl+0x60/0x80 [ 466.310724][ T6741] dump_stack+0x18/0x24 [ 466.310872][ T6741] warn_alloc+0x134/0x154 [ 466.311029][ T6741] __vmalloc_node_range_noprof+0x8e8/0x8ec [ 466.311202][ T6741] xskq_create+0xf8/0x130 [ 466.311348][ T6741] xsk_setsockopt+0x248/0x370 [ 466.311475][ T6741] do_sock_setsockopt+0xa4/0x198 [ 466.311601][ T6741] __sys_setsockopt+0x7c/0x100 [ 466.311707][ T6741] __arm64_sys_setsockopt+0x24/0x40 [ 466.311796][ T6741] invoke_syscall+0x54/0x10c [ 466.311906][ T6741] el0_svc_common.constprop.0+0x40/0xe0 [ 466.312003][ T6741] do_el0_svc+0x1c/0x34 [ 466.312140][ T6741] el0_svc+0x38/0x1fc [ 466.312266][ T6741] el0t_64_sync_handler+0xa0/0xe4 [ 466.312372][ T6741] el0t_64_sync+0x1a4/0x1a8 [ 466.312895][ T6741] Mem-Info: [ 466.319387][ T6741] active_anon:32 inactive_anon:7269 isolated_anon:0 [ 466.319387][ T6741] active_file:1907 inactive_file:12999 isolated_file:0 [ 466.319387][ T6741] unevictable:768 dirty:18 writeback:0 [ 466.319387][ T6741] slab_reclaimable:3589 slab_unreclaimable:9705 [ 466.319387][ T6741] mapped:2779 shmem:3226 pagetables:609 [ 466.319387][ T6741] sec_pagetables:0 bounce:0 [ 466.319387][ T6741] kernel_misc_reclaimable:0 [ 466.319387][ T6741] free:449905 free_pcp:3706 free_cma:8128 [ 466.320402][ T6741] Node 0 active_anon:128kB inactive_anon:29076kB active_file:7628kB inactive_file:51996kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:11116kB dirty:72kB writeback:0kB shmem:12904kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:3504kB pagetables:2436kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 466.320907][ T6741] Node 0 DMA free:1799620kB boost:0kB min:22528kB low:28160kB high:33792kB reserved_highatomic:0KB free_highatomic:0KB active_anon:128kB inactive_anon:29076kB active_file:7628kB inactive_file:51996kB unevictable:3072kB writepending:72kB zspages:468kB present:2097152kB managed:1988404kB mlocked:0kB bounce:0kB free_pcp:14824kB local_pcp:14008kB free_cma:32512kB [ 466.321583][ T6741] lowmem_reserve[]: 0 0 0 0 0 [ 466.322259][ T6741] Node 0 DMA: 1097*4kB (UME) 182*8kB (ME) 147*16kB (ME) 156*32kB (UME) 121*64kB (UME) 94*128kB (UME) 43*256kB (UMEC) 21*512kB (UMEC) 18*1024kB (UMC) 13*2048kB (UMC) 415*4096kB (UMC) = 1799620kB [ 466.346004][ T6741] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 466.346179][ T6741] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=32768kB [ 466.346248][ T6741] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 466.346312][ T6741] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=64kB [ 466.346514][ T6741] 18136 total pagecache pages [ 466.346619][ T6741] 8 pages in swap cache [ 466.346689][ T6741] Free swap = 123760kB [ 466.346757][ T6741] Total swap = 124996kB [ 466.346968][ T6741] 524288 pages RAM [ 466.347056][ T6741] 0 pages HighMem/MovableOnly [ 466.347108][ T6741] 27187 pages reserved [ 466.347169][ T6741] 8192 pages cma reserved [ 466.347231][ T6741] 0 pages hwpoisoned [ 466.536609][ T6741] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1140'. [ 466.662834][ T6736] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 466.663281][ T6736] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 466.860431][ T6736] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 466.860952][ T6736] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.197671][ T6111] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 467.198239][ T6111] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.245551][ T6111] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 467.246111][ T6111] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.295524][ T6107] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 467.295917][ T6107] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.306782][ T6111] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 467.307430][ T6111] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.716425][ T6760] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1148'. [ 468.335248][ T6768] netlink: 'syz.2.1151': attribute type 3 has an invalid length. [ 468.335634][ T6768] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1151'. [ 468.758520][ T6775] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 469.071845][ T6775] vlan0: entered promiscuous mode [ 475.359394][ T6857] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1183'. [ 475.376828][ T6857] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1183'. [ 478.130482][ T6898] process 'syz.1.1199' launched './file0' with NULL argv: empty string added [ 487.567481][ T6960] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1222'. [ 487.606051][ T6961] FAULT_INJECTION: forcing a failure. [ 487.606051][ T6961] name failslab, interval 1, probability 0, space 0, times 0 [ 487.606464][ T6961] CPU: 1 UID: 0 PID: 6961 Comm: syz.1.1223 Tainted: G W syzkaller #0 PREEMPT [ 487.606590][ T6961] Tainted: [W]=WARN [ 487.606631][ T6961] Hardware name: linux,dummy-virt (DT) [ 487.606672][ T6961] Call trace: [ 487.606708][ T6961] show_stack+0x18/0x24 (C) [ 487.606815][ T6961] dump_stack_lvl+0x60/0x80 [ 487.606891][ T6961] dump_stack+0x18/0x24 [ 487.606964][ T6961] should_fail_ex+0x1e0/0x238 [ 487.607116][ T6961] should_failslab+0x54/0x80 [ 487.607190][ T6961] __kmalloc_noprof+0xac/0x520 [ 487.607312][ T6961] lsm_blob_alloc+0x40/0x64 [ 487.607394][ T6961] security_sk_alloc+0x30/0x210 [ 487.607472][ T6961] sk_prot_alloc+0x7c/0x140 [ 487.607627][ T6961] sk_alloc+0x3c/0x288 [ 487.607749][ T6961] inet6_create+0xf4/0x520 [ 487.607835][ T6961] __sock_create+0x130/0x260 [ 487.607914][ T6961] sock_create_kern+0x14/0x20 [ 487.608015][ T6961] mptcp_subflow_create_socket+0x54/0x280 [ 487.608103][ T6961] __mptcp_nmpc_sk.part.0+0x6c/0x1c8 [ 487.608177][ T6961] mptcp_listen+0x70/0x188 [ 487.608250][ T6961] __sys_listen+0xa4/0x100 [ 487.608364][ T6961] __arm64_sys_listen+0x18/0x28 [ 487.608441][ T6961] invoke_syscall+0x54/0x10c [ 487.608541][ T6961] el0_svc_common.constprop.0+0x40/0xe0 [ 487.608619][ T6961] do_el0_svc+0x1c/0x34 [ 487.608702][ T6961] el0_svc+0x38/0x1fc [ 487.608830][ T6961] el0t_64_sync_handler+0xa0/0xe4 [ 487.608951][ T6961] el0t_64_sync+0x1a4/0x1a8 [ 487.802009][ T6965] FAULT_INJECTION: forcing a failure. [ 487.802009][ T6965] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 487.802427][ T6965] CPU: 1 UID: 0 PID: 6965 Comm: syz.1.1224 Tainted: G W syzkaller #0 PREEMPT [ 487.802546][ T6965] Tainted: [W]=WARN [ 487.802582][ T6965] Hardware name: linux,dummy-virt (DT) [ 487.802621][ T6965] Call trace: [ 487.802654][ T6965] show_stack+0x18/0x24 (C) [ 487.802759][ T6965] dump_stack_lvl+0x60/0x80 [ 487.803130][ T6965] dump_stack+0x18/0x24 [ 487.803566][ T6965] should_fail_ex+0x1e0/0x238 [ 487.803782][ T6965] should_fail+0x14/0x40 [ 487.803950][ T6965] should_fail_usercopy+0x1c/0x40 [ 487.804119][ T6965] bpf_verifier_vlog+0x27c/0x3e8 [ 487.804239][ T6965] __btf_verifier_log+0x5c/0x90 [ 487.804373][ T6965] btf_new_fd+0x90c/0x167c [ 487.804483][ T6965] __sys_bpf+0xb28/0x1d1c [ 487.804757][ T6965] __arm64_sys_bpf+0x2c/0x40 [ 487.804897][ T6965] invoke_syscall+0x54/0x10c [ 487.805014][ T6965] el0_svc_common.constprop.0+0x40/0xe0 [ 487.805168][ T6965] do_el0_svc+0x1c/0x34 [ 487.805317][ T6965] el0_svc+0x38/0x1fc [ 487.805480][ T6965] el0t_64_sync_handler+0xa0/0xe4 [ 487.805667][ T6965] el0t_64_sync+0x1a4/0x1a8 [ 488.428064][ T6979] netlink: 'syz.2.1229': attribute type 10 has an invalid length. [ 488.429303][ T6979] vxcan0: left allmulticast mode [ 493.856390][ T28] kauditd_printk_skb: 46 callbacks suppressed [ 493.861031][ T6112] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 493.861422][ T6112] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.867978][ T28] audit: type=1326 audit(493.770:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7042 comm="syz.2.1251" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbcb782e8 code=0x7ffc0000 [ 493.876685][ T28] audit: type=1326 audit(493.780:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7042 comm="syz.2.1251" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbcb782e8 code=0x7ffc0000 [ 493.877128][ T28] audit: type=1326 audit(493.790:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7042 comm="syz.2.1251" exe="/syz-executor" sig=0 arch=c00000b7 syscall=26 compat=0 ip=0xffffbcb782e8 code=0x7ffc0000 [ 493.877277][ T28] audit: type=1326 audit(493.790:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7042 comm="syz.2.1251" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbcb782e8 code=0x7ffc0000 [ 493.984437][ T6112] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 493.986298][ T6112] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.990257][ T7047] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1252'. [ 494.064133][ T7047] bond3 (unregistering): Released all slaves [ 494.123230][ T6112] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 494.123634][ T6112] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.269124][ T6112] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 494.277891][ T6112] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 495.233355][ T6112] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 495.278636][ T6112] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 495.321782][ T6112] bond0 (unregistering): Released all slaves [ 495.362278][ T6112] bond1 (unregistering): Released all slaves [ 495.649254][ T6112] hsr_slave_0: left promiscuous mode [ 495.657136][ T6112] hsr_slave_1: left promiscuous mode [ 495.691431][ T6112] veth0_macvtap: left promiscuous mode [ 495.692932][ T6112] veth1_vlan: left promiscuous mode [ 495.697169][ T6112] veth0_vlan: left promiscuous mode [ 497.512828][ T3221] 8021q: adding VLAN 0 to HW filter on device eth5 [ 498.258321][ T7041] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 498.273825][ T7041] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 499.186969][ T3221] 8021q: adding VLAN 0 to HW filter on device eth6 [ 499.918370][ T7041] hsr_slave_0: entered promiscuous mode [ 499.923873][ T7041] hsr_slave_1: entered promiscuous mode [ 501.248121][ T7175] fuse: fd is not a fuse device [ 501.982596][ T7041] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 502.016094][ T7041] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 502.021500][ T7041] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 502.042433][ T7041] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 502.052015][ T7041] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 502.073955][ T7041] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 502.089868][ T7041] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 502.109479][ T7041] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 502.922860][ T7194] ======================================================= [ 502.922860][ T7194] WARNING: The mand mount option has been deprecated and [ 502.922860][ T7194] and is ignored by this kernel. Remove the mand [ 502.922860][ T7194] option from the mount to silence this warning. [ 502.922860][ T7194] ======================================================= [ 505.051950][ T7041] 8021q: adding VLAN 0 to HW filter on device bond0 [ 507.136335][ T7256] Injecting memory failure for pfn 0x5310f at process virtual address 0x20f0f000 [ 507.147375][ T7256] Memory failure: 0x5310f: unhandlable page. [ 507.149130][ T7256] Memory failure: 0x5310f: recovery action for get hwpoison page: Ignored [ 508.404348][ T7041] veth0_vlan: entered promiscuous mode [ 508.478247][ T7041] veth1_vlan: entered promiscuous mode [ 508.713063][ T7041] veth0_macvtap: entered promiscuous mode [ 508.758244][ T7041] veth1_macvtap: entered promiscuous mode [ 509.106035][ T6115] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 509.109563][ T6115] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 509.124433][ T6115] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 509.139064][ T6115] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 510.987761][ T6112] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 510.988176][ T6112] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.118538][ T6112] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 511.118941][ T6112] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.229221][ T6112] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 511.229538][ T6112] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.379457][ T6112] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 511.382479][ T6112] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.603415][ T6112] bond0 (unregistering): Released all slaves [ 512.644208][ T6112] bond1 (unregistering): (slave veth3): Releasing active interface [ 512.695073][ T6112] bond1 (unregistering): Released all slaves [ 512.721164][ T6112] bond2 (unregistering): (slave veth5): Releasing active interface [ 512.767129][ T6112] bond2 (unregistering): Released all slaves [ 512.969119][ T6112] hsr_slave_0: left promiscuous mode [ 512.983205][ T6112] hsr_slave_1: left promiscuous mode [ 513.013401][ T6112] veth1_macvtap: left promiscuous mode [ 513.013705][ T6112] veth0_macvtap: left promiscuous mode [ 513.014092][ T6112] veth1_vlan: left promiscuous mode [ 515.140955][ T3221] 8021q: adding VLAN 0 to HW filter on device eth5 [ 515.820784][ T7282] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 515.844108][ T7282] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 516.330637][ T3221] 8021q: adding VLAN 0 to HW filter on device eth6 [ 517.131707][ T7282] hsr_slave_0: entered promiscuous mode [ 517.138882][ T7282] hsr_slave_1: entered promiscuous mode [ 517.142729][ T7282] debugfs: 'hsr0' already exists in 'hsr' [ 517.145138][ T7282] Cannot create hsr debugfs directory [ 517.519606][ T3221] 8021q: adding VLAN 0 to HW filter on device eth7 [ 518.906181][ T7282] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 518.926219][ T7282] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 518.931087][ T7282] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 518.951125][ T7282] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 518.959766][ T7282] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 518.980082][ T7282] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 518.984355][ T7282] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 519.000583][ T7282] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 519.479577][ T7401] team_slave_0: entered allmulticast mode [ 520.229840][ T7282] 8021q: adding VLAN 0 to HW filter on device bond0 [ 525.599217][ T7282] veth0_vlan: entered promiscuous mode [ 525.632245][ T7282] veth1_vlan: entered promiscuous mode [ 525.756523][ T7282] veth0_macvtap: entered promiscuous mode [ 525.778196][ T7282] veth1_macvtap: entered promiscuous mode [ 525.905666][ T6112] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.906136][ T6112] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.906466][ T6112] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.976117][ T6111] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 526.343127][ T7474] 8021q: adding VLAN 0 to HW filter on device bond1 [ 526.356381][ T7474] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1294'. [ 526.358141][ T7474] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1294'. [ 526.383136][ T7474] 8021q: adding VLAN 0 to HW filter on device bond0 [ 526.397186][ T7474] bond1: (slave bond0): making interface the new active one [ 526.410574][ T7474] bond1: (slave bond0): Enslaving as an active interface with an up link [ 526.444036][ T7474] bond1 (unregistering): (slave bond0): Releasing active interface [ 526.499216][ T7474] bond1 (unregistering): Released all slaves [ 530.972765][ T7497] smc: net device lo applied user defined pnetid SYZ0 [ 531.423239][ T7510] gadgetfs: bound to dummy_udc driver [ 539.236523][ T7564] FAULT_INJECTION: forcing a failure. [ 539.236523][ T7564] name failslab, interval 1, probability 0, space 0, times 0 [ 539.236946][ T7564] CPU: 1 UID: 0 PID: 7564 Comm: syz.2.1352 Tainted: G W L syzkaller #0 PREEMPT [ 539.237076][ T7564] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 539.237117][ T7564] Hardware name: linux,dummy-virt (DT) [ 539.237156][ T7564] Call trace: [ 539.237220][ T7564] show_stack+0x18/0x24 (C) [ 539.237351][ T7564] dump_stack_lvl+0x60/0x80 [ 539.237466][ T7564] dump_stack+0x18/0x24 [ 539.237594][ T7564] should_fail_ex+0x1e0/0x238 [ 539.237677][ T7564] should_failslab+0x54/0x80 [ 539.237770][ T7564] kmem_cache_alloc_noprof+0x54/0x458 [ 539.237868][ T7564] alloc_empty_file+0x60/0x130 [ 539.237943][ T7564] path_openat+0x48/0x960 [ 539.238016][ T7564] do_file_open+0xb0/0x168 [ 539.238105][ T7564] do_sys_openat2+0x84/0x104 [ 539.238187][ T7564] __arm64_sys_openat+0x64/0xc0 [ 539.238263][ T7564] invoke_syscall+0x54/0x10c [ 539.238337][ T7564] el0_svc_common.constprop.0+0x40/0xe0 [ 539.238437][ T7564] do_el0_svc+0x1c/0x34 [ 539.238515][ T7564] el0_svc+0x38/0x1fc [ 539.238623][ T7564] el0t_64_sync_handler+0xa0/0xe4 [ 539.238869][ T7564] el0t_64_sync+0x1a4/0x1a8 [ 540.103706][ T7575] netlink: 'syz.2.1355': attribute type 4 has an invalid length. [ 548.165688][ T7615] syzkaller0: entered promiscuous mode [ 548.165942][ T7615] syzkaller0: entered allmulticast mode [ 552.019522][ T7638] FAULT_INJECTION: forcing a failure. [ 552.019522][ T7638] name failslab, interval 1, probability 0, space 0, times 0 [ 552.025834][ T7638] CPU: 1 UID: 0 PID: 7638 Comm: syz.1.1376 Tainted: G W L syzkaller #0 PREEMPT [ 552.026045][ T7638] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 552.026091][ T7638] Hardware name: linux,dummy-virt (DT) [ 552.026137][ T7638] Call trace: [ 552.026175][ T7638] show_stack+0x18/0x24 (C) [ 552.026303][ T7638] dump_stack_lvl+0x60/0x80 [ 552.026384][ T7638] dump_stack+0x18/0x24 [ 552.026462][ T7638] should_fail_ex+0x1e0/0x238 [ 552.026561][ T7638] should_failslab+0x54/0x80 [ 552.026639][ T7638] __kmalloc_noprof+0xac/0x520 [ 552.026720][ T7638] __rds_conn_create+0x338/0x8e0 [ 552.026835][ T7638] rds_conn_create_outgoing+0x24/0x30 [ 552.026914][ T7638] rds_sendmsg+0x580/0xeb4 [ 552.027029][ T7638] __sock_sendmsg+0x54/0x60 [ 552.027121][ T7638] ____sys_sendmsg+0x250/0x2a8 [ 552.027193][ T7638] ___sys_sendmsg+0xb0/0x108 [ 552.027265][ T7638] __sys_sendmsg+0x9c/0x100 [ 552.027339][ T7638] __arm64_sys_sendmsg+0x20/0x38 [ 552.027418][ T7638] invoke_syscall+0x54/0x10c [ 552.027497][ T7638] el0_svc_common.constprop.0+0x40/0xe0 [ 552.027584][ T7638] do_el0_svc+0x1c/0x34 [ 552.027656][ T7638] el0_svc+0x38/0x1fc [ 552.027743][ T7638] el0t_64_sync_handler+0xa0/0xe4 [ 552.027832][ T7638] el0t_64_sync+0x1a4/0x1a8 [ 552.283257][ T7642] FAULT_INJECTION: forcing a failure. [ 552.283257][ T7642] name failslab, interval 1, probability 0, space 0, times 0 [ 552.283502][ T7642] CPU: 1 UID: 0 PID: 7642 Comm: syz.1.1379 Tainted: G W L syzkaller #0 PREEMPT [ 552.283635][ T7642] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 552.283677][ T7642] Hardware name: linux,dummy-virt (DT) [ 552.283714][ T7642] Call trace: [ 552.283748][ T7642] show_stack+0x18/0x24 (C) [ 552.284391][ T7642] dump_stack_lvl+0x60/0x80 [ 552.284489][ T7642] dump_stack+0x18/0x24 [ 552.284641][ T7642] should_fail_ex+0x1e0/0x238 [ 552.285069][ T7642] should_failslab+0x54/0x80 [ 552.285148][ T7642] kmem_cache_alloc_noprof+0x54/0x458 [ 552.285225][ T7642] alloc_empty_file+0x60/0x130 [ 552.285298][ T7642] alloc_file_pseudo+0xb0/0x160 [ 552.285371][ T7642] anon_inode_getfile+0x70/0xf0 [ 552.285451][ T7642] sync_file_alloc+0x48/0x9c [ 552.286938][ T7642] sync_file_create+0x18/0x98 [ 552.287702][ T7642] sw_sync_ioctl+0x450/0x700 [ 552.288555][ T7642] __arm64_sys_ioctl+0xa8/0x100 [ 552.289195][ T7642] invoke_syscall+0x54/0x10c [ 552.289292][ T7642] el0_svc_common.constprop.0+0x40/0xe0 [ 552.289381][ T7642] do_el0_svc+0x1c/0x34 [ 552.289504][ T7642] el0_svc+0x38/0x1fc [ 552.289616][ T7642] el0t_64_sync_handler+0xa0/0xe4 [ 552.289709][ T7642] el0t_64_sync+0x1a4/0x1a8 [ 553.175409][ T7650] FAULT_INJECTION: forcing a failure. [ 553.175409][ T7650] name failslab, interval 1, probability 0, space 0, times 0 [ 553.177532][ T7650] CPU: 0 UID: 0 PID: 7650 Comm: syz.1.1382 Tainted: G W L syzkaller #0 PREEMPT [ 553.177692][ T7650] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 553.177734][ T7650] Hardware name: linux,dummy-virt (DT) [ 553.177776][ T7650] Call trace: [ 553.177809][ T7650] show_stack+0x18/0x24 (C) [ 553.177916][ T7650] dump_stack_lvl+0x60/0x80 [ 553.177998][ T7650] dump_stack+0x18/0x24 [ 553.178068][ T7650] should_fail_ex+0x1e0/0x238 [ 553.178143][ T7650] should_failslab+0x54/0x80 [ 553.178218][ T7650] kmem_cache_alloc_noprof+0x54/0x458 [ 553.178298][ T7650] __mpol_dup+0x38/0x110 [ 553.178371][ T7650] sp_alloc+0x50/0xa0 [ 553.178445][ T7650] mpol_set_shared_policy+0x38/0x280 [ 553.178521][ T7650] shmem_set_policy+0x24/0x34 [ 553.178603][ T7650] mbind_range+0xd4/0x134 [ 553.178678][ T7650] do_mbind+0x2e0/0x4b0 [ 553.178751][ T7650] __arm64_sys_mbind+0xdc/0xf0 [ 553.178823][ T7650] invoke_syscall+0x54/0x10c [ 553.178897][ T7650] el0_svc_common.constprop.0+0x40/0xe0 [ 553.178979][ T7650] do_el0_svc+0x1c/0x34 [ 553.179075][ T7650] el0_svc+0x38/0x1fc [ 553.179158][ T7650] el0t_64_sync_handler+0xa0/0xe4 [ 553.179233][ T7650] el0t_64_sync+0x1a4/0x1a8 [ 557.841579][ T7669] FAULT_INJECTION: forcing a failure. [ 557.841579][ T7669] name failslab, interval 1, probability 0, space 0, times 0 [ 557.841973][ T7669] CPU: 1 UID: 0 PID: 7669 Comm: syz.1.1390 Tainted: G W L syzkaller #0 PREEMPT [ 557.842107][ T7669] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 557.842144][ T7669] Hardware name: linux,dummy-virt (DT) [ 557.842182][ T7669] Call trace: [ 557.842213][ T7669] show_stack+0x18/0x24 (C) [ 557.842313][ T7669] dump_stack_lvl+0x60/0x80 [ 557.842384][ T7669] dump_stack+0x18/0x24 [ 557.842452][ T7669] should_fail_ex+0x1e0/0x238 [ 557.842525][ T7669] should_failslab+0x54/0x80 [ 557.842594][ T7669] __kmalloc_cache_noprof+0x58/0x470 [ 557.842669][ T7669] qdisc_get_rtab+0x74/0x240 [ 557.842741][ T7669] tcf_police_init+0x498/0x5d0 [ 557.842824][ T7669] tcf_action_init_1+0x1d8/0x26c [ 557.842896][ T7669] tcf_action_init+0x1b0/0x374 [ 557.842968][ T7669] tcf_action_add+0xa8/0x254 [ 557.843093][ T7669] tc_ctl_action+0xdc/0x17c [ 557.843170][ T7669] rtnetlink_rcv_msg+0x114/0x3a0 [ 557.843241][ T7669] netlink_rcv_skb+0x60/0x134 [ 557.843318][ T7669] rtnetlink_rcv+0x18/0x30 [ 557.843383][ T7669] netlink_unicast+0x328/0x3ac [ 557.843458][ T7669] netlink_sendmsg+0x194/0x410 [ 557.843533][ T7669] __sock_sendmsg+0x54/0x60 [ 557.843604][ T7669] ____sys_sendmsg+0x250/0x2a8 [ 557.843670][ T7669] ___sys_sendmsg+0xb0/0x108 [ 557.843736][ T7669] __sys_sendmsg+0x9c/0x100 [ 557.843804][ T7669] __arm64_sys_sendmsg+0x20/0x38 [ 557.843871][ T7669] invoke_syscall+0x54/0x10c [ 557.843938][ T7669] el0_svc_common.constprop.0+0x40/0xe0 [ 557.844009][ T7669] do_el0_svc+0x1c/0x34 [ 557.844073][ T7669] el0_svc+0x38/0x1fc [ 557.844146][ T7669] el0t_64_sync_handler+0xa0/0xe4 [ 557.844216][ T7669] el0t_64_sync+0x1a4/0x1a8 [ 560.302603][ T7681] syz_tun: entered allmulticast mode [ 560.347367][ T7681] pim6reg: entered allmulticast mode [ 563.348386][ T7697] FAULT_INJECTION: forcing a failure. [ 563.348386][ T7697] name fail_futex, interval 1, probability 0, space 0, times 1 [ 563.348768][ T7697] CPU: 1 UID: 0 PID: 7697 Comm: syz.1.1400 Tainted: G W L syzkaller #0 PREEMPT [ 563.348888][ T7697] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 563.348977][ T7697] Hardware name: linux,dummy-virt (DT) [ 563.349036][ T7697] Call trace: [ 563.349085][ T7697] show_stack+0x18/0x24 (C) [ 563.349211][ T7697] dump_stack_lvl+0x60/0x80 [ 563.349293][ T7697] dump_stack+0x18/0x24 [ 563.349378][ T7697] should_fail_ex+0x1e0/0x238 [ 563.349461][ T7697] should_fail+0x14/0x40 [ 563.349534][ T7697] get_futex_key+0xdc/0x620 [ 563.349609][ T7697] futex_wake+0x68/0x240 [ 563.349681][ T7697] do_futex+0x178/0x210 [ 563.349751][ T7697] __arm64_sys_futex+0x100/0x1a0 [ 563.349822][ T7697] invoke_syscall+0x54/0x10c [ 563.349894][ T7697] el0_svc_common.constprop.0+0x40/0xe0 [ 563.349967][ T7697] do_el0_svc+0x1c/0x34 [ 563.350044][ T7697] el0_svc+0x38/0x1fc [ 563.350128][ T7697] el0t_64_sync_handler+0xa0/0xe4 [ 563.350204][ T7697] el0t_64_sync+0x1a4/0x1a8 [ 570.365042][ T28] audit: type=1326 audit(570.270:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7741 comm="syz.2.1416" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad782e8 code=0x7ffc0000 [ 570.365841][ T28] audit: type=1326 audit(570.270:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7741 comm="syz.2.1416" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad782e8 code=0x7ffc0000 [ 570.366348][ T28] audit: type=1326 audit(570.270:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7741 comm="syz.2.1416" exe="/syz-executor" sig=0 arch=c00000b7 syscall=263 compat=0 ip=0xffff8ad782e8 code=0x7ffc0000 [ 570.366558][ T28] audit: type=1326 audit(570.270:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7741 comm="syz.2.1416" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad782e8 code=0x7ffc0000 [ 570.366745][ T28] audit: type=1326 audit(570.270:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7741 comm="syz.2.1416" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad782e8 code=0x7ffc0000 [ 570.367024][ T28] audit: type=1326 audit(570.270:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7741 comm="syz.2.1416" exe="/syz-executor" sig=0 arch=c00000b7 syscall=233 compat=0 ip=0xffff8ad782e8 code=0x7ffc0000 [ 570.894434][ T28] audit: type=1326 audit(570.770:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7741 comm="syz.2.1416" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad782e8 code=0x7ffc0000 [ 570.895272][ T28] audit: type=1326 audit(570.770:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7741 comm="syz.2.1416" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad782e8 code=0x7ffc0000 [ 570.895659][ T28] audit: type=1326 audit(570.770:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7741 comm="syz.2.1416" exe="/syz-executor" sig=0 arch=c00000b7 syscall=284 compat=0 ip=0xffff8ad782e8 code=0x7ffc0000 [ 570.895857][ T28] audit: type=1326 audit(570.780:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7741 comm="syz.2.1416" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8ad782e8 code=0x7ffc0000 [ 573.400616][ T7754] tc action pedit unable to extract header offset for header type (0x5) [ 573.401346][ T7754] tc action pedit unable to extract header offset for header type (0x5) [ 573.401597][ T7754] tc action pedit unable to extract header offset for header type (0x5) [ 573.401700][ T7754] tc action pedit unable to extract header offset for header type (0x5) [ 573.401786][ T7754] tc action pedit unable to extract header offset for header type (0x5) [ 573.401871][ T7754] tc action pedit unable to extract header offset for header type (0x5) [ 573.401956][ T7754] tc action pedit unable to extract header offset for header type (0x5) [ 573.402040][ T7754] tc action pedit unable to extract header offset for header type (0x5) [ 573.402127][ T7754] tc action pedit unable to extract header offset for header type (0x5) [ 573.402210][ T7754] tc action pedit unable to extract header offset for header type (0x5) [ 573.402409][ T7754] 0: reclassify loop, rule prio 0, protocol 800 [ 577.306365][ T7770] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1426'. [ 577.307395][ T7770] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1426'. [ 580.057636][ T28] kauditd_printk_skb: 31 callbacks suppressed [ 580.058084][ T28] audit: type=1326 audit(579.970:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7793 comm="syz.1.1437" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff98d782e8 code=0x7ffc0000 [ 580.058365][ T28] audit: type=1326 audit(579.970:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7793 comm="syz.1.1437" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff98d782e8 code=0x7ffc0000 [ 580.058575][ T28] audit: type=1326 audit(579.970:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7793 comm="syz.1.1437" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff98d782e8 code=0x7ffc0000 [ 580.058764][ T28] audit: type=1326 audit(579.970:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7793 comm="syz.1.1437" exe="/syz-executor" sig=0 arch=c00000b7 syscall=199 compat=0 ip=0xffff98d782e8 code=0x7ffc0000 [ 580.058972][ T28] audit: type=1326 audit(579.970:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7793 comm="syz.1.1437" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff98d782e8 code=0x7ffc0000 [ 580.085531][ T28] audit: type=1326 audit(579.980:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7793 comm="syz.1.1437" exe="/syz-executor" sig=0 arch=c00000b7 syscall=436 compat=0 ip=0xffff98d782e8 code=0x7ffc0000 [ 580.086092][ T28] audit: type=1326 audit(579.980:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7793 comm="syz.1.1437" exe="/syz-executor" sig=0 arch=c00000b7 syscall=94 compat=0 ip=0xffff98d782e8 code=0x7ffc0000 [ 580.086520][ T28] audit: type=1326 audit(579.980:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7793 comm="syz.1.1437" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff98d782e8 code=0x7ffc0000 [ 581.650799][ T7810] binder: 7809:7810 tried to acquire reference to desc 0, got 1 instead [ 581.657374][ T7810] binder: 7809:7810 got transaction with unaligned buffers size, 31 [ 581.662610][ T7810] binder: 7809:7810 transaction async to 7809:0 failed 7/29201/-22, code 0 size 0-24 line 3464 [ 581.670682][ T9] binder: undelivered TRANSACTION_ERROR: 29201 [ 587.219102][ T7830] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 587.231571][ T7830] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 591.957780][ T7861] lo: entered allmulticast mode [ 591.961701][ T7861] tunl0: entered allmulticast mode [ 591.989375][ T7861] gre0: entered allmulticast mode [ 591.994411][ T7861] gretap0: entered allmulticast mode [ 592.001718][ T7861] erspan0: entered allmulticast mode [ 592.008643][ T7861] ip_vti0: entered allmulticast mode [ 592.013430][ T7861] ip6_vti0: entered allmulticast mode [ 592.019831][ T7861] sit0: entered allmulticast mode [ 592.027561][ T7861] ip6tnl0: entered allmulticast mode [ 592.032156][ T7861] ip6gre0: entered allmulticast mode [ 592.043685][ T7861] ip6gretap0: entered allmulticast mode [ 592.050403][ T7861] vcan0: entered allmulticast mode [ 592.058864][ T7861] bond0: entered allmulticast mode [ 592.061566][ T7861] bond_slave_0: entered allmulticast mode [ 592.063050][ T7861] bond_slave_1: entered allmulticast mode [ 592.070651][ T7861] dummy0: entered allmulticast mode [ 592.080865][ T7861] nlmon0: entered allmulticast mode [ 592.086540][ T7861] vxcan0: entered allmulticast mode [ 592.091120][ T7861] vxcan1: entered allmulticast mode [ 592.098721][ T7861] veth0: entered allmulticast mode [ 592.104266][ T7861] veth1: entered allmulticast mode [ 592.110968][ T7861] wg0: entered allmulticast mode [ 592.117607][ T7861] wg1: entered allmulticast mode [ 592.123420][ T7861] wg2: entered allmulticast mode [ 592.128789][ T7861] veth0_to_bridge: entered allmulticast mode [ 592.131853][ T7861] bridge_slave_0: entered allmulticast mode [ 592.136769][ T7861] veth1_to_bridge: entered allmulticast mode [ 592.141173][ T7861] bridge_slave_1: entered allmulticast mode [ 592.144364][ T7861] veth0_to_bond: entered allmulticast mode [ 592.153647][ T7861] bond0: (slave bond_slave_0): Releasing backup interface [ 592.199370][ T7861] veth1_to_bond: entered allmulticast mode [ 592.268111][ T7861] bond0: (slave bond_slave_1): Releasing backup interface [ 592.320214][ T7861] veth0_to_team: entered allmulticast mode [ 592.342002][ T7861] veth1_to_team: entered allmulticast mode [ 592.354024][ T7861] team_slave_1: entered allmulticast mode [ 592.368750][ T7861] veth0_to_batadv: entered allmulticast mode [ 592.379148][ T7861] batadv_slave_0: entered allmulticast mode [ 592.387404][ T7861] veth1_to_batadv: entered allmulticast mode [ 592.398828][ T7861] batadv_slave_1: entered allmulticast mode [ 592.422095][ T7861] xfrm0: entered allmulticast mode [ 592.430401][ T7861] veth0_to_hsr: entered allmulticast mode [ 592.450271][ T7861] hsr_slave_0: entered allmulticast mode [ 592.457431][ T7861] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 592.593273][ T7861] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1461'. [ 595.529640][ T7876] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1467'. [ 595.531535][ T7876] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1467'. [ 610.318687][ T7978] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 610.320182][ T7978] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 612.544137][ T7986] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 612.557564][ T7986] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 615.887552][ T7998] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 617.650948][ T8020] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1516'. [ 617.652155][ T8020] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1516'. [ 618.177081][ T8030] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 618.183957][ T8030] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 618.765363][ T8034] ptrace attach of "/syz-executor exec"[7282] was attempted by " [ 624.181810][ T8077] geneve0: entered promiscuous mode [ 624.201977][ T8077] geneve0: entered allmulticast mode [ 624.418929][ T8079] UDC core: g1: couldn't find an available UDC or it's busy [ 626.480660][ T8105] printk: legacy console [ttyGS0] disabled [ 626.618348][ T8105] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 626.620092][ T8105] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 626.816567][ T6114] netdevsim netdevsim0 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.817005][ T6114] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.817136][ T6114] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.828093][ T6114] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 629.506489][ T8124] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1553'. [ 629.508220][ T8124] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1553'. [ 629.708455][ T8128] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 629.710129][ T8128] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 633.303750][ T8158] netlink: 'syz.1.1564': attribute type 10 has an invalid length. [ 634.705762][ T8167] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 634.707421][ T8167] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 634.783089][ T8170] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1569'. [ 637.007654][ T8183] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 637.010120][ T8183] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 637.597084][ T8187] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1576'. [ 642.895201][ T8225] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 642.897678][ T8225] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 643.249148][ T8232] FAULT_INJECTION: forcing a failure. [ 643.249148][ T8232] name failslab, interval 1, probability 0, space 0, times 0 [ 643.251946][ T8232] CPU: 0 UID: 0 PID: 8232 Comm: syz.1.1589 Tainted: G W L syzkaller #0 PREEMPT [ 643.252051][ T8232] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 643.252074][ T8232] Hardware name: linux,dummy-virt (DT) [ 643.252097][ T8232] Call trace: [ 643.252115][ T8232] show_stack+0x18/0x24 (C) [ 643.252180][ T8232] dump_stack_lvl+0x60/0x80 [ 643.252222][ T8232] dump_stack+0x18/0x24 [ 643.252262][ T8232] should_fail_ex+0x1e0/0x238 [ 643.252306][ T8232] should_failslab+0x54/0x80 [ 643.252346][ T8232] __kmalloc_cache_noprof+0x58/0x470 [ 643.252391][ T8232] proc_self_get_link+0x58/0xe0 [ 643.252433][ T8232] pick_link+0x318/0x404 [ 643.252472][ T8232] step_into_slowpath+0x1cc/0x2e0 [ 643.252520][ T8232] link_path_walk+0x434/0x688 [ 643.252559][ T8232] path_openat+0x88/0x960 [ 643.252600][ T8232] do_file_open+0xb0/0x168 [ 643.252641][ T8232] do_sys_openat2+0x84/0x104 [ 643.252685][ T8232] __arm64_sys_openat+0x64/0xc0 [ 643.252726][ T8232] invoke_syscall+0x54/0x10c [ 643.252797][ T8232] el0_svc_common.constprop.0+0x40/0xe0 [ 643.252843][ T8232] do_el0_svc+0x1c/0x34 [ 643.252879][ T8232] el0_svc+0x38/0x1fc [ 643.252923][ T8232] el0t_64_sync_handler+0xa0/0xe4 [ 643.252964][ T8232] el0t_64_sync+0x1a4/0x1a8 [ 646.464318][ T8243] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 646.466267][ T8243] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 646.798259][ T802] binder: undelivered death notification, 0000000000000000 [ 646.916729][ T8256] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 646.918213][ T8256] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 647.043154][ T8258] FAULT_INJECTION: forcing a failure. [ 647.043154][ T8258] name failslab, interval 1, probability 0, space 0, times 0 [ 647.044640][ T8258] CPU: 1 UID: 0 PID: 8258 Comm: syz.2.1598 Tainted: G W L syzkaller #0 PREEMPT [ 647.044807][ T8258] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 647.044877][ T8258] Hardware name: linux,dummy-virt (DT) [ 647.044926][ T8258] Call trace: [ 647.044975][ T8258] show_stack+0x18/0x24 (C) [ 647.045091][ T8258] dump_stack_lvl+0x60/0x80 [ 647.045170][ T8258] dump_stack+0x18/0x24 [ 647.045243][ T8258] should_fail_ex+0x1e0/0x238 [ 647.045324][ T8258] should_failslab+0x54/0x80 [ 647.045446][ T8258] kmem_cache_alloc_noprof+0x54/0x458 [ 647.045748][ T8258] sk_prot_alloc+0x38/0x140 [ 647.046002][ T8258] sk_alloc+0x3c/0x288 [ 647.046204][ T8258] inet6_create+0xf4/0x520 [ 647.046489][ T8258] __sock_create+0x130/0x260 [ 647.046838][ T8258] __sys_socket+0xa0/0x140 [ 647.047258][ T8258] __arm64_sys_socket+0x1c/0x38 [ 647.047568][ T8258] invoke_syscall+0x54/0x10c [ 647.047696][ T8258] el0_svc_common.constprop.0+0x40/0xe0 [ 647.047830][ T8258] do_el0_svc+0x1c/0x34 [ 647.048006][ T8258] el0_svc+0x38/0x1fc [ 647.048124][ T8258] el0t_64_sync_handler+0xa0/0xe4 [ 647.048216][ T8258] el0t_64_sync+0x1a4/0x1a8 [ 647.559741][ T8271] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 647.561240][ T8271] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 647.782576][ T8271] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 647.784198][ T8271] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 649.852721][ T8289] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 649.853886][ T8289] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 652.123023][ T8298] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1613'. [ 653.252290][ T8300] FAULT_INJECTION: forcing a failure. [ 653.252290][ T8300] name failslab, interval 1, probability 0, space 0, times 0 [ 653.254353][ T8300] CPU: 0 UID: 0 PID: 8300 Comm: syz.2.1614 Tainted: G W L syzkaller #0 PREEMPT [ 653.254560][ T8300] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 653.254616][ T8300] Hardware name: linux,dummy-virt (DT) [ 653.254677][ T8300] Call trace: [ 653.254712][ T8300] show_stack+0x18/0x24 (C) [ 653.254859][ T8300] dump_stack_lvl+0x60/0x80 [ 653.254982][ T8300] dump_stack+0x18/0x24 [ 653.255109][ T8300] should_fail_ex+0x1e0/0x238 [ 653.255182][ T8300] should_failslab+0x54/0x80 [ 653.255255][ T8300] __kmalloc_cache_noprof+0x58/0x470 [ 653.255325][ T8300] blkcg_css_alloc+0x40/0x210 [ 653.255402][ T8300] cgroup_apply_control_enable+0x14c/0x32c [ 653.255475][ T8300] cgroup_mkdir+0x114/0x520 [ 653.255543][ T8300] kernfs_iop_mkdir+0x6c/0xc0 [ 653.255619][ T8300] vfs_mkdir+0xc4/0x210 [ 653.255682][ T8300] filename_mkdirat+0x1dc/0x218 [ 653.255753][ T8300] __arm64_sys_mkdirat+0x40/0x64 [ 653.255819][ T8300] invoke_syscall+0x54/0x10c [ 653.255889][ T8300] el0_svc_common.constprop.0+0x40/0xe0 [ 653.255955][ T8300] do_el0_svc+0x1c/0x34 [ 653.256019][ T8300] el0_svc+0x38/0x1fc [ 653.256090][ T8300] el0t_64_sync_handler+0xa0/0xe4 [ 653.256159][ T8300] el0t_64_sync+0x1a4/0x1a8 [ 653.435149][ T8302] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 653.436544][ T8302] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 653.761201][ T8307] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 653.762649][ T8307] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 653.901822][ T8311] FAULT_INJECTION: forcing a failure. [ 653.901822][ T8311] name failslab, interval 1, probability 0, space 0, times 0 [ 653.904248][ T8311] CPU: 0 UID: 0 PID: 8311 Comm: syz.2.1618 Tainted: G W L syzkaller #0 PREEMPT [ 653.904400][ T8311] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 653.904439][ T8311] Hardware name: linux,dummy-virt (DT) [ 653.904482][ T8311] Call trace: [ 653.904519][ T8311] show_stack+0x18/0x24 (C) [ 653.904741][ T8311] dump_stack_lvl+0x60/0x80 [ 653.904845][ T8311] dump_stack+0x18/0x24 [ 653.904918][ T8311] should_fail_ex+0x1e0/0x238 [ 653.904996][ T8311] should_failslab+0x54/0x80 [ 653.905069][ T8311] kmem_cache_alloc_lru_noprof+0x58/0x458 [ 653.905152][ T8311] sock_alloc_inode+0x24/0x94 [ 653.905225][ T8311] alloc_inode+0x28/0xdc [ 653.905298][ T8311] sock_alloc+0x20/0xa0 [ 653.905368][ T8311] __sock_create+0xa4/0x260 [ 653.905435][ T8311] __sys_socket+0xa0/0x140 [ 653.905504][ T8311] __arm64_sys_socket+0x1c/0x38 [ 653.905574][ T8311] invoke_syscall+0x54/0x10c [ 653.905651][ T8311] el0_svc_common.constprop.0+0x40/0xe0 [ 653.905727][ T8311] do_el0_svc+0x1c/0x34 [ 653.905801][ T8311] el0_svc+0x38/0x1fc [ 653.905898][ T8311] el0t_64_sync_handler+0xa0/0xe4 [ 653.905982][ T8311] el0t_64_sync+0x1a4/0x1a8 [ 653.915598][ T8311] socket: no more sockets [ 654.154217][ T8318] binder: 8317:8318 tried to acquire reference to desc 0, got 1 instead [ 654.160602][ T8318] binder: 8317:8318 got reply transaction with bad transaction stack, transaction 14 has target 8317:0 [ 654.164186][ T8318] binder: 8317:8318 transaction reply to 0:0 failed 15/29201/-71, code 0 size 0-0 line 3170 [ 654.171925][ T7927] binder: release 8317:8318 transaction 14 out, still active [ 654.172437][ T7927] binder: undelivered TRANSACTION_COMPLETE [ 654.172603][ T7927] binder: undelivered TRANSACTION_ERROR: 29201 [ 654.178764][ T3439] binder: send failed reply for transaction 14, target dead [ 654.223747][ T8320] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 654.227657][ T8320] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 654.483970][ T8327] syzkaller0: entered promiscuous mode [ 654.485855][ T8327] syzkaller0: entered allmulticast mode [ 655.222101][ T8330] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 655.225978][ T8330] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 659.236234][ T8357] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 659.238066][ T8357] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 659.391177][ T8360] FAULT_INJECTION: forcing a failure. [ 659.391177][ T8360] name failslab, interval 1, probability 0, space 0, times 0 [ 659.391553][ T8360] CPU: 1 UID: 0 PID: 8360 Comm: syz.1.1638 Tainted: G W L syzkaller #0 PREEMPT [ 659.391684][ T8360] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 659.391724][ T8360] Hardware name: linux,dummy-virt (DT) [ 659.391762][ T8360] Call trace: [ 659.391799][ T8360] show_stack+0x18/0x24 (C) [ 659.392042][ T8360] dump_stack_lvl+0x60/0x80 [ 659.392156][ T8360] dump_stack+0x18/0x24 [ 659.392281][ T8360] should_fail_ex+0x1e0/0x238 [ 659.392410][ T8360] should_failslab+0x54/0x80 [ 659.392534][ T8360] kmem_cache_alloc_lru_noprof+0x58/0x458 [ 659.392702][ T8360] sock_alloc_inode+0x24/0x94 [ 659.392814][ T8360] alloc_inode+0x28/0xdc [ 659.392932][ T8360] sock_alloc+0x20/0xa0 [ 659.393032][ T8360] __sock_create+0xa4/0x260 [ 659.393349][ T8360] __sys_socket+0xa0/0x140 [ 659.393492][ T8360] __arm64_sys_socket+0x1c/0x38 [ 659.393622][ T8360] invoke_syscall+0x54/0x10c [ 659.393795][ T8360] el0_svc_common.constprop.0+0x40/0xe0 [ 659.394027][ T8360] do_el0_svc+0x1c/0x34 [ 659.394141][ T8360] el0_svc+0x38/0x1fc [ 659.394264][ T8360] el0t_64_sync_handler+0xa0/0xe4 [ 659.394452][ T8360] el0t_64_sync+0x1a4/0x1a8 [ 659.416594][ T8360] socket: no more sockets [ 663.521789][ T8382] ALSA: mixer_oss: invalid OSS volume 'W' [ 666.003483][ T8408] af_packet: tpacket_rcv: packet too big, clamped from 32820 to 3944. macoff=96 [ 670.479767][ T8446] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 670.481344][ T8446] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 673.970201][ T8482] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1683'. [ 676.086696][ T8493] FAULT_INJECTION: forcing a failure. [ 676.086696][ T8493] name failslab, interval 1, probability 0, space 0, times 0 [ 676.087152][ T8493] CPU: 1 UID: 0 PID: 8493 Comm: syz.1.1688 Tainted: G W L syzkaller #0 PREEMPT [ 676.087288][ T8493] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 676.087330][ T8493] Hardware name: linux,dummy-virt (DT) [ 676.087371][ T8493] Call trace: [ 676.087404][ T8493] show_stack+0x18/0x24 (C) [ 676.087523][ T8493] dump_stack_lvl+0x60/0x80 [ 676.087602][ T8493] dump_stack+0x18/0x24 [ 676.087681][ T8493] should_fail_ex+0x1e0/0x238 [ 676.087758][ T8493] should_failslab+0x54/0x80 [ 676.087831][ T8493] __kmalloc_node_noprof+0xb4/0x524 [ 676.087908][ T8493] crypto_create_tfm_node+0x44/0x12c [ 676.087983][ T8493] crypto_alloc_tfm_node+0x6c/0x100 [ 676.088065][ T8493] crypto_alloc_sig+0x28/0x38 [ 676.088143][ T8493] public_key_verify_signature+0x100/0x258 [ 676.088224][ T8493] x509_check_for_self_signed+0xa8/0xf4 [ 676.088297][ T8493] x509_cert_parse+0x160/0x214 [ 676.088367][ T8493] x509_key_preparse+0x20/0x1e0 [ 676.088443][ T8493] asymmetric_key_preparse+0x64/0xa4 [ 676.088526][ T8493] __key_create_or_update+0x1b8/0x4f0 [ 676.088604][ T8493] key_create_or_update+0x14/0x20 [ 676.088682][ T8493] __arm64_sys_add_key+0x128/0x21c [ 676.088755][ T8493] invoke_syscall+0x54/0x10c [ 676.088835][ T8493] el0_svc_common.constprop.0+0x40/0xe0 [ 676.088908][ T8493] do_el0_svc+0x1c/0x34 [ 676.088986][ T8493] el0_svc+0x38/0x1fc [ 676.089078][ T8493] el0t_64_sync_handler+0xa0/0xe4 [ 676.089154][ T8493] el0t_64_sync+0x1a4/0x1a8 [ 679.055940][ T8506] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 679.059380][ T8506] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 679.321012][ T8509] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 679.322564][ T8509] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 680.388671][ T8524] FAULT_INJECTION: forcing a failure. [ 680.388671][ T8524] name failslab, interval 1, probability 0, space 0, times 0 [ 680.388995][ T8524] CPU: 1 UID: 0 PID: 8524 Comm: syz.1.1699 Tainted: G W L syzkaller #0 PREEMPT [ 680.389140][ T8524] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 680.389184][ T8524] Hardware name: linux,dummy-virt (DT) [ 680.389226][ T8524] Call trace: [ 680.389299][ T8524] show_stack+0x18/0x24 (C) [ 680.389417][ T8524] dump_stack_lvl+0x60/0x80 [ 680.389502][ T8524] dump_stack+0x18/0x24 [ 680.389580][ T8524] should_fail_ex+0x1e0/0x238 [ 680.389664][ T8524] should_failslab+0x54/0x80 [ 680.389752][ T8524] kmem_cache_alloc_noprof+0x54/0x458 [ 680.389838][ T8524] alloc_empty_file+0x60/0x130 [ 680.389943][ T8524] alloc_file_pseudo+0xb0/0x160 [ 680.390059][ T8524] sock_alloc_file+0x40/0xd8 [ 680.390147][ T8524] __sys_socketpair+0x1c4/0x2c0 [ 680.390235][ T8524] __arm64_sys_socketpair+0x20/0x30 [ 680.390311][ T8524] invoke_syscall+0x54/0x10c [ 680.390388][ T8524] el0_svc_common.constprop.0+0x40/0xe0 [ 680.390463][ T8524] do_el0_svc+0x1c/0x34 [ 680.390561][ T8524] el0_svc+0x38/0x1fc [ 680.390665][ T8524] el0t_64_sync_handler+0xa0/0xe4 [ 680.390754][ T8524] el0t_64_sync+0x1a4/0x1a8 [ 682.573494][ T8535] syzkaller0: entered promiscuous mode [ 682.573831][ T8535] syzkaller0: entered allmulticast mode [ 685.103713][ T8550] ------------[ cut here ]------------ [ 685.107547][ T8550] WARNING: ./include/linux/skbuff.h:3243 at tcf_skbmod_act+0x4b0/0x4e0, CPU#1: syz.1.1707/8550 [ 685.114160][ T8550] Modules linked in: [ 685.116303][ T8550] CPU: 1 UID: 0 PID: 8550 Comm: syz.1.1707 Tainted: G W L syzkaller #0 PREEMPT [ 685.117054][ T8550] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 685.117308][ T8550] Hardware name: linux,dummy-virt (DT) [ 685.117790][ T8550] pstate: 61402009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 685.118230][ T8550] pc : tcf_skbmod_act+0x4b0/0x4e0 [ 685.118502][ T8550] lr : tcf_action_exec+0xb0/0x1d4 [ 685.118754][ T8550] sp : ffff80008351b850 [ 685.118986][ T8550] x29: ffff80008351b850 x28: fbf000000b6f7d08 x27: fbf000000b6f7d00 [ 685.119700][ T8550] x26: 0000000000000001 x25: 0000000020000000 x24: 0000000010000000 [ 685.120261][ T8550] x23: 0000000000000000 x22: 0000000000000010 x21: fbf0000008b17fc0 [ 685.120719][ T8550] x20: fcf000000b6f7400 x19: f7f0000007853000 x18: 0000000000000000 [ 685.121146][ T8550] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000020000304 [ 685.121537][ T8550] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 685.121959][ T8550] x11: 0000000000000001 x10: 0000000100000080 x9 : 0000000000000000 [ 685.122408][ T8550] x8 : 0000004800000000 x7 : 0000000000000000 x6 : fff07ffffcd20000 [ 685.122826][ T8550] x5 : 0000000000000000 x4 : 0000000000000001 x3 : f3f0000006ad92c0 [ 685.123266][ T8550] x2 : ffffc1ffbf7fe4b0 x1 : 000000000000ffff x0 : 000000000000ffff [ 685.123849][ T8550] Call trace: [ 685.124355][ T8550] tcf_skbmod_act+0x4b0/0x4e0 (P) [ 685.125270][ T8550] tcf_action_exec+0xb0/0x1d4 [ 685.125583][ T8550] basic_classify+0x80/0xc4 [ 685.125813][ T8550] tcf_classify+0x1dc/0x410 [ 685.126070][ T8550] tc_run+0x108/0x1e0 [ 685.126327][ T8550] __netif_receive_skb_core.constprop.0+0x4d8/0xc40 [ 685.126653][ T8550] __netif_receive_skb_one_core+0x40/0x8c [ 685.126946][ T8550] __netif_receive_skb+0x18/0x60 [ 685.127232][ T8550] netif_receive_skb+0x3c/0xd8 [ 685.127475][ T8550] tun_get_user+0xbbc/0xf70 [ 685.127713][ T8550] tun_chr_write_iter+0x5c/0xf0 [ 685.127944][ T8550] vfs_write+0x244/0x36c [ 685.128240][ T8550] ksys_write+0x70/0x108 [ 685.128544][ T8550] __arm64_sys_write+0x18/0x24 [ 685.128868][ T8550] invoke_syscall+0x54/0x10c [ 685.129129][ T8550] el0_svc_common.constprop.0+0x40/0xe0 [ 685.129411][ T8550] do_el0_svc+0x1c/0x34 [ 685.129643][ T8550] el0_svc+0x38/0x1fc [ 685.129872][ T8550] el0t_64_sync_handler+0xa0/0xe4 [ 685.130138][ T8550] el0t_64_sync+0x1a4/0x1a8 [ 685.130661][ T8550] ---[ end trace 0000000000000000 ]--- SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 685.689900][ T6109] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 685.859839][ T6109] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 685.989315][ T6109] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 686.108707][ T6109] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 686.777307][ T6109] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 686.809565][ T6109] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 686.840595][ T6109] bond0 (unregistering): Released all slaves [ 686.896279][ T6114] netdevsim netdevsim2 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.906273][ T6114] netdevsim netdevsim2 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.906781][ T6114] netdevsim netdevsim2 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.906966][ T6114] netdevsim netdevsim2 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.961928][ T6109] hsr_slave_0: left promiscuous mode [ 686.967344][ T6109] hsr_slave_1: left promiscuous mode [ 686.981865][ T6109] veth1_macvtap: left promiscuous mode [ 686.982215][ T6109] veth0_macvtap: left promiscuous mode [ 686.982798][ T6109] veth1_vlan: left promiscuous mode [ 686.983115][ T6109] veth0_vlan: left promiscuous mode [ 688.441120][ T3221] 8021q: adding VLAN 0 to HW filter on device eth6 [ 689.337167][ T3221] 8021q: adding VLAN 0 to HW filter on device eth5 [ 690.090575][ T3221] 8021q: adding VLAN 0 to HW filter on device eth7 [ 690.843718][ T3221] 8021q: adding VLAN 0 to HW filter on device eth8