last executing test programs: 3.414388038s ago: executing program 1 (id=1613): gettid() close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) io_setup(0xa, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r0, 0xfffffffc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r3, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xe}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) 3.25251397s ago: executing program 0 (id=1614): r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=0x0) syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000600)=@ublk_set_params_sqe={0x2e, 0x0, 0x0, r0, 0xc0207508, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x30, &(0x7f0000000680)={0x30, 0x1, {0x0, 0x9, 0xc, 0xc, 0x9, 0x8}}}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, &(0x7f0000000a00)=@buf_4k}}, &(0x7f0000000b00)) nanosleep(&(0x7f0000001a00)={0x5}, &(0x7f0000001a40)) r8 = getpid() syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000c00)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, r0, 0xc0207506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r5, 0xffff, 0x0, 0x0, r8}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) nanosleep(&(0x7f0000001a80)={0x5}, &(0x7f0000001ac0)) r9 = syz_open_dev$ublk_bdev(&(0x7f0000003000), r5, 0x0) pread64$ublk_bdev(r9, &(0x7f0000005000)=""/4096, 0x1000, 0x0) io_uring_enter(r1, 0x0, 0x1, 0x1, 0x0, 0x0) 2.261527314s ago: executing program 0 (id=1627): sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40400c0}, 0xd7983ab608da75d7) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x30, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x1c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @local}}}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x49, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000183, 0x2, 0x7, 0xf2, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x8000b, 0x7, 0xfffffffffffffff8, 0x9, 0x4], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.239376582s ago: executing program 2 (id=1628): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x20040014) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x14, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}}, 0x14}, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x49, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000183, 0x2, 0x7, 0xf2, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x8000b, 0x7, 0xfffffffffffffff8, 0x9, 0x4], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.216819304s ago: executing program 1 (id=1630): getsockopt$TIPC_SRC_DROPPABLE(0xffffffffffffffff, 0x10f, 0x80, 0x0, 0x0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, 0x0, 0x40) execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) r0 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, 0x0, 0x0) fchmodat(0xffffffffffffff9c, 0x0, 0x1ff) execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4, 0x0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000068e04d206f0e2c586831010203010902240001000000000904000002ff47d000090589e702008000040905", @ANYBLOB="0237"], 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 1.770602857s ago: executing program 0 (id=1635): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x13, r0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) prctl$PR_SET_IO_FLUSHER(0x39, 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) write(r1, &(0x7f00000002c0)='0', 0x1) syz_usb_connect(0x5, 0x62, 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000140)='nv', 0x2) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x714, 0x0, 0xfffffffffffffd25) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x121002, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000280)={0x1, 0x0, [{0x8f, 0x0, 0x6}]}) 1.69719585s ago: executing program 2 (id=1636): sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40400c0}, 0xd7983ab608da75d7) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x30, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x1c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @local}}}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x49, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000183, 0x2, 0x7, 0xf2, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x8000b, 0x7, 0xfffffffffffffff8, 0x9, 0x4], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ipvlan0\x00'}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.146079116s ago: executing program 2 (id=1640): socket$kcm(0x10, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x2, 0x300) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8153, 0x2000, 0x800, 0x9, 0x3}, 0x20) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) bind$xdp(r0, &(0x7f00000003c0)={0x2c, 0x2, r2, 0x0, 0x0}, 0x10) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x80000000) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000040)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x8000000000000000}, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) 1.066120736s ago: executing program 0 (id=1641): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4044080) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f00000007c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\f\n5', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x7, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104, 0xa01}, [@IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000fbdbdf250100000000000000014100000018001700000000000000006574683a7465616d300000006d6f0078c04fd4c083261d13cee6f340275d5a2653e6557331e204dc9edd9bd27064704508b16cd7870d9bdfeead7ae0db192c059d677813377314ceb81c6e671372acd10239962d46abffb525089abaa073e98265c3e09f9ca98af14f27380b59adc71127e5d96641c87c9afe79d9789027d852c1a449fd755d19c6cdfcedfc589a56a404a33fe23ef7615cef509eae2d12e3e9b2ea70d26a602cfbbfbbeea96f51bb7baade4bf5d7a7dbc8e9d002c7e721fe0135d27dd533a5887977d8f81bc78c96c297597ce3919cef2dfec7410924c404e70536d683f5bb45954b1436991a062fd8b9a21e055d2814b7f32adc1ca9b365365d365ca467"], 0x34}}, 0x20042000) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="200000001600d16f000000000000df251c7c00000c000180080001"], 0x20}, 0x1, 0x0, 0x0, 0x4048015}, 0x10) 899.8597ms ago: executing program 3 (id=1643): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000100)}) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000180), &(0x7f0000000440)=0x8) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001840)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c000000020605"], 0x2c}}, 0x20004890) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x58) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @local}, 0x1c) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x20048015) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0xb, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x402}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) 840.746934ms ago: executing program 0 (id=1644): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000002c0)=ANY=[], 0x60}, 0x1, 0x0, 0x0, 0x48854}, 0x800) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x49, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0x5, 0x101c0, 0x10d, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a00000709"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x84}, 0x1, 0x0, 0x0, 0x200280d0}, 0x40) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000183, 0x2, 0x7, 0xf2, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x8000b, 0x7, 0xfffffffffffffff8, 0x9, 0x4], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 834.595759ms ago: executing program 1 (id=1645): openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x129442, 0x0) socket$kcm(0x23, 0x5, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$kcm(0x2, 0xa, 0x2) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x1, @loopback}, {0x2, 0x4e23, @multicast1}, 0x118, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x1, 0x5, 0x4}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 810.815522ms ago: executing program 3 (id=1646): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x49, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000183, 0x2, 0x7, 0xf2, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x8000b, 0x7, 0xfffffffffffffff8, 0x9, 0x4], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ipvlan0\x00'}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 706.465555ms ago: executing program 3 (id=1647): socket$inet_udp(0x2, 0x2, 0x0) setns(0xc9, 0x0) ioctl$DVD_WRITE_STRUCT(0xffffffffffffffff, 0x5391, &(0x7f0000000880)=@bca={0x3, 0xbc, "be88e96a730cceb8b222e92b6d3a7b7f31b72553f0e581c88d5cfa00a5e226e2fb2bb32e05c43f0e0d435bc66ce851414aa547e2d5d76de3b459c8985b970fbb0b3eab20b9b87dfe352f8d867b80956fa6de3fa5c519b3880e03c623add2b04f362d5b9604506b41ddb47449a944f678c68706b525995e778979036264fad65c9bb146722815e27abe8edf3b098f69d62e4bd55fa7257f7ae5567e542b0867581e318d673322eb4adfc6da8a0f86b3e6f9ca1b0c99509ebc31b5b53d"}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000000)=0x1, 0x4) r0 = socket(0x8, 0x5, 0x5) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@newtaction={0xe68, 0x30, 0x871a15abc695fa3d, 0x70bd27, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{}, 0x93}, [{0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x1, 0x0, 0x0, 0x4000000, 0x7, 0x80000}, {0x8, 0x5, 0x0, 0xfffffffc, 0x5}, {}, {0x0, 0x0, 0x0, 0x0, 0x6}, {0x0, 0xc3}, {0x0, 0x5}, {0x5}, {}, {0x0, 0x10}, {0x0, 0x4, 0x0, 0x8000000}, {0x0, 0xffffffff, 0x0, 0x0, 0xfffffffd, 0x20}, {0x2, 0x0, 0x400000, 0x0, 0x6}, {0x0, 0x0, 0x0, 0x0, 0x1}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {0x0, 0x0, 0x0, 0x8000000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x20}, {}, {}, {0x0, 0x1, 0x0, 0xfffffffc, 0x2}, {}, {0x0, 0x0, 0x0, 0x9}, {0x0, 0x7, 0x0, 0x0, 0xffffffff}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x0, 0x5}, {0xffffffff}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0xffffffff, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x4}, {}, {0xffffffff, 0x0, 0x5}, {0xffffffff}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {0xa320, 0x9, 0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x0, 0x0, 0x1}, {0x80}, {0x0, 0x0, 0x0, 0x5}, {}, {0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x9}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, {0x0, 0x0, 0x0, 0x7}, {0x0, 0x15, 0x0, 0x48510}, {0x100, 0x8000000, 0xffffffff}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xd, 0xffffffff}, {}, {}, {0x0, 0xfffefffd, 0x0, 0xfffffffc}, {0x0, 0x0, 0x0, 0x1}, {}, {0x5}, {0x0, 0x0, 0x5, 0x0, 0x0, 0x9}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x400000}, {0x0, 0x0, 0x200}, {}, {}, {0x5}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfb4}, {0x101}, {0x0, 0x101, 0x0, 0x0, 0x0, 0xffffffff}, {}, {0x0, 0x0, 0x0, 0x1, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x4, 0x9}, {0xfffffffe}, {0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x2}, {}, {}, {}, {0x800000, 0xfffffffc, 0x0, 0x0, 0x0, 0x56}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, {0x0, 0x0, 0x6, 0x0, 0x4}, {}, {}, {0x0, 0xfffffffd}, {0x6}, {0x7f}, {}, {0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, {0x2, 0x0, 0x20000000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x292}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x101}, {0x0, 0x5, 0x0, 0x0, 0x1}, {0x0, 0x5, 0x0, 0x0, 0x1ff}, {0x0, 0x0, 0x0, 0x0, 0x80}, {0x10000000, 0x0, 0x0, 0x400, 0x4}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {0x3}, {0x1000, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x58000000}, {0xffffffff, 0x0, 0x0, 0x8}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x2}, {0xfffffffe, 0x0, 0x0, 0x0, 0x8000}, {0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {0x0, 0x8000}, {0x0, 0xe3, 0x10000}, {0x0, 0x80000000, 0x0, 0x7dff800, 0x7fff}], [{}, {}, {0x0, 0x1}, {}, {}, {0x3}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {0x5, 0x1}, {0x0, 0x1}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {0x1}, {}, {}, {}, {0x0, 0x1}, {}, {0x4}, {}, {0x5, 0x1}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x1}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x0, 0x1}, {}, {}, {}, {0x5}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {0x1}, {}, {0x5}, {}, {}, {}, {}, {}, {}, {}, {0x2, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {0x4}, {0x3}, {}, {0x4}, {0x0, 0x1}, {0x3}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}, 0x1, 0x0, 0x0, 0x801}, 0x0) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, 0x0, 0x0) bind$packet(r2, 0x0, 0x0) sendto$packet(r2, &(0x7f00000002c0)="fb57975e267951722b395d37bac8", 0xe, 0x0, 0x0, 0x0) recvmsg(r2, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x2000) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000240)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000280)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f00000012c0)={'ip6tnl0\x00', &(0x7f0000001240)={'syztnl0\x00', 0x0, 0x4, 0x6c, 0x2, 0x8, 0x12, @private1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8, 0x1, 0x5, 0xd}}) umount2(&(0x7f0000000340)='./file0\x00', 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000380)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x2}) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f00000002c0)={r3, 0x10, "9780fe6e8831c10403c8c92119ba1c0c"}, &(0x7f0000000300)=0x18) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="02c8"], 0x33) ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x400261f2, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x81009431, &(0x7f0000001300)) 692.567456ms ago: executing program 1 (id=1648): r0 = socket$nl_generic(0x10, 0x3, 0x10) mount(0x0, 0x0, &(0x7f0000000140)='openpromfs\x00', 0x804000, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f00000000c0)={'aio_iiro_16\x00', [0x100, 0x6, 0x2, 0x6, 0x13, 0x5, 0x7d, 0x3, 0x80008, 0x9, 0x2, 0x8, 0x7, 0x1, 0x1, 0xfd, 0xfffffffb, 0xdd, 0x3, 0x7fffffff, 0xffffffff, 0xca9f, 0x7f, 0x5, 0xfffffffb, 0xf39e, 0xffffffff, 0x8, 0x40, 0x0, 0xfffffff8]}) ioctl$COMEDI_SETWSUBD(r2, 0x6411) r3 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f0000000040)) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=ANY=[@ANYRES16=r3, @ANYBLOB="050000000000fddbdf2544000000080003", @ANYRES32=r4, @ANYBLOB="14202380060002"], 0x30}}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r6, 0x5, &(0x7f00000005c0)='fd', 0x0, r5) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x0, 0x2) connect$inet(r5, &(0x7f00000001c0)={0x2, 0x4e22, @rand_addr=0x64010102}, 0x10) fchdir(r7) open_tree(r7, &(0x7f0000000040)='./file1\x00', 0x80100) ioctl$DRM_IOCTL_GET_MAP(r7, 0xc0286404, &(0x7f0000000180)={&(0x7f00004b3000/0x2000)=nil}) 508.22103ms ago: executing program 3 (id=1649): sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40400c0}, 0xd7983ab608da75d7) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x5c, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x48, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @local}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x2a}}}}]}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x49, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a00"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000183, 0x2, 0x7, 0xf2, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x8000b, 0x7, 0xfffffffffffffff8, 0x9, 0x4], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ipvlan0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 438.570359ms ago: executing program 1 (id=1650): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x90}, 0x4000000) socket$xdp(0x2c, 0x3, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0x18, 0x2, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFCTH_TUPLE={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r6, &(0x7f0000000580)='inactive', 0x8) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) 438.2836ms ago: executing program 3 (id=1651): ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, 0x0) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000001240)={'wlan1\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000840)=ANY=[@ANYBLOB="58010000100013070000000000000000fc020000000000000000000000000001fe8000000000000000000000000000aa00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141417000000000000000000000000000004d533000000e000000100000000000000000000000003000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000000220000000000000000000000000000000200000000000000000000005c0014"], 0x158}}, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x4c004}, 0x800) getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000390400"/20, @ANYRES32=r4, @ANYBLOB, @ANYRES32=r4, @ANYBLOB], 0x44}}, 0x0) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000001a00)={'rti800\x00', [0x100, 0x0, 0x4, 0x20000001, 0x25, 0x0, 0x400, 0x20002, 0x54c6cff3, 0xfd, 0x2, 0x3, 0xfffffff7, 0x400001, 0x6, 0x8, 0xfffffffc, 0x7f, 0x3, 0x2, 0x200089, 0x2, 0x4, 0x30001e5b, 0x3, 0x7, 0x3, 0x6, 0x4006, 0x0, 0x3]}) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) 333.075592ms ago: executing program 0 (id=1652): sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40400c0}, 0xd7983ab608da75d7) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x30, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x1c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @local}}}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x49, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a01"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000183, 0x2, 0x7, 0xf2, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x8000b, 0x7, 0xfffffffffffffff8, 0x9, 0x4], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ipvlan0\x00'}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 329.159352ms ago: executing program 3 (id=1653): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={0x0, 0x0, 0x5f, 0x0, 0x1, 0x205b93f3}, 0x28) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000c80)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0xe93be89, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x2}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000200)='hybla', 0x5) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) socket$can_raw(0x1d, 0x3, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, 0x0) writev(r3, &(0x7f0000000240), 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0x3, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x6, 0x6b7, 0x80, 0x0, 0x1, 0x91b1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000400}, 0x24000000) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000340)) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) syz_open_dev$dri(&(0x7f0000000080), 0xa, 0x0) 276.686039ms ago: executing program 2 (id=1654): syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) 181.421203ms ago: executing program 2 (id=1655): syz_open_procfs(0xffffffffffffffff, 0x0) setxattr$incfs_id(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080), &(0x7f00000000c0)={'0000000000000000000000000000000', 0x32}, 0x20, 0x3) mount$9p_virtio(&(0x7f0000000000), 0x0, &(0x7f0000001b00), 0x10000, &(0x7f0000000640)=ANY=[@ANYBLOB='trans=virtio,p']) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x9}]}}]}, 0x38}}, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, 0x0, 0x0) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, 0x0, 0x0) sendto$inet(r6, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r6, &(0x7f0000002900)=[{{0x0, 0x0, &(0x7f00000028c0)=[{&(0x7f00000017c0)="e1ac665e90a180d7fdf636adfba04aac1bea5089bb98574992e01123c069cc0c7ab4e5f42d4abc622b1e6a27d5db6e095223c00b69892d0ac1c045ee4a60e2519424f42dd4d941d23187da8fc3b4959944b2b2fb7ecec8929950fd93ac0c93de8fccc0448bbf7cb0df59dca60c819b8ee28b40d7c8faeb97bd3a318cb6264023997a9cf199621ade72815124f126ce30d23211a68045bf0769991783cb4d8bd18b992bfa8363da842d07b80ddbb0053be49567fb380e97d1634d5ae284969f3bdfbb72f3b6", 0xc5}], 0x1}}], 0x1, 0x4000840) connect$inet(r5, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x12, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0xd, 0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_BUCKETS_LOG={0x8, 0x8, 0x1}]}}]}, 0x38}}, 0x0) 114.510366ms ago: executing program 2 (id=1656): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x5c, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x48, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @local}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x2a}}}}]}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x49, [0x9, 0x7, 0x2, 0x4, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x79, 0x7, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x110000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x9b54, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a0101"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) syz_emit_ethernet(0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000183, 0x2, 0x7, 0xf2, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x8000b, 0x7, 0xfffffffffffffff8, 0x9, 0x4], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ipvlan0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 0s ago: executing program 1 (id=1657): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x6, 0x4, 0x8, 0x8}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="1b0000000000"], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000700)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) symlink(0x0, 0x0) symlink(&(0x7f0000000b00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x0) setresgid(0xffffffffffffffff, 0xee00, 0xffffffffffffffff) r0 = add_key$fscrypt_provisioning(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$chown(0x4, r0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ff) syz_emit_ethernet(0x0, 0x0, 0x0) mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ff) mkdir(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_script(r1, 0x0, 0x0) symlink(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') kernel console output (not intermixed with test programs): ig 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 91.402676][ T2321] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.409013][ T2321] usb 6-1: config 0 descriptor?? [ 91.440460][ T2321] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 91.730495][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 91.730635][ T5883] usb 7-1: new low-speed USB device number 4 using dummy_hcd [ 91.881513][ T5883] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 91.882490][ T5883] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 91.882513][ T5883] usb 7-1: config 0 has no interface number 0 [ 91.882543][ T5883] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 91.882561][ T5883] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 91.882579][ T5883] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 91.882597][ T5883] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 91.882616][ T5883] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 91.882636][ T5883] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 91.882668][ T5883] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.884859][ T5883] usb 7-1: config 0 descriptor?? [ 91.885792][ T7306] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 91.885931][ T7306] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 91.889128][ T5883] ldusb 7-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 92.117207][ T7308] program syz.0.596 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 92.257074][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 92.760436][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 92.762458][ T7337] netlink: 20 bytes leftover after parsing attributes in process `syz.3.610'. [ 92.765598][ T7337] netlink: 20 bytes leftover after parsing attributes in process `syz.3.610'. [ 93.270515][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 93.686353][ T5882] usb 6-1: USB disconnect, device number 2 [ 93.686490][ C0] ldusb 6-1:0.55: usb_submit_urb failed (-19) [ 93.688547][ T7371] netlink: 4 bytes leftover after parsing attributes in process `syz.0.627'. [ 93.695630][ T9] usb 7-1: USB disconnect, device number 4 [ 93.704341][ T5882] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 93.743839][ T9] ldusb 7-1:0.55: LD USB Device #1 now disconnected [ 93.780884][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 94.290795][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 94.308227][ T7405] openvswitch: netlink: Missing key (keys=40, expected=100) [ 94.439774][ T45] kauditd_printk_skb: 10 callbacks suppressed [ 94.439797][ T45] audit: type=1400 audit(1789265596.341:504): avc: denied { bind } for pid=7416 comm="syz.1.650" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 94.632497][ T7435] netlink: 8 bytes leftover after parsing attributes in process `syz.0.656'. [ 95.016748][ T7467] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 95.016791][ T7467] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 95.192275][ T7481] Invalid source name [ 95.311865][ T13] net_ratelimit: 2 callbacks suppressed [ 95.311884][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 95.511245][ T45] audit: type=1400 audit(1789265597.421:505): avc: denied { read } for pid=7496 comm="syz.3.685" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 95.657558][ T45] audit: type=1400 audit(1789265597.561:506): avc: denied { write } for pid=7504 comm="syz.0.688" name="ppp" dev="devtmpfs" ino=729 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 95.740800][ T7509] ucma_write: process 334 (syz.1.690) changed security contexts after opening file descriptor, this is not allowed. [ 95.821274][ T7515] __nla_validate_parse: 1 callbacks suppressed [ 95.821294][ T7515] netlink: 20 bytes leftover after parsing attributes in process `syz.3.693'. [ 95.825831][ T7515] netlink: 20 bytes leftover after parsing attributes in process `syz.3.693'. [ 95.834036][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 96.198963][ T7546] netlink: 40 bytes leftover after parsing attributes in process `syz.0.705'. [ 96.234083][ T7548] netlink: 16 bytes leftover after parsing attributes in process `syz.1.706'. [ 96.270992][ T7551] overlayfs: conflicting lowerdir path [ 96.340417][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 96.436133][ T7564] netlink: 12 bytes leftover after parsing attributes in process `syz.3.713'. [ 96.575495][ T45] audit: type=1400 audit(1789265598.481:507): avc: denied { write } for pid=7575 comm="syz.0.718" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 96.651091][ T45] audit: type=1400 audit(1789265598.561:508): avc: denied { write } for pid=7580 comm="syz.3.720" path="socket:[18066]" dev="sockfs" ino=18066 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 96.692856][ T7583] netlink: 8 bytes leftover after parsing attributes in process `syz.0.721'. [ 96.695927][ T45] audit: type=1400 audit(1789265598.611:509): avc: denied { mounton } for pid=7584 comm="syz.2.722" path="/160/file0" dev="tmpfs" ino=863 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 96.696082][ T7585] fuse: Bad value for 'user_id' [ 96.696096][ T7585] fuse: Bad value for 'user_id' [ 96.860403][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 96.936175][ T45] audit: type=1400 audit(1789265598.841:510): avc: denied { getopt } for pid=7602 comm="syz.0.731" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 97.077892][ T7612] netlink: 'syz.0.734': attribute type 3 has an invalid length. [ 97.374103][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 97.387019][ T45] audit: type=1400 audit(1789265599.291:511): avc: denied { read } for pid=7628 comm="syz.1.741" lport=46680 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 97.660006][ T7655] No buffer was provided with the request [ 97.898603][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 97.914454][ T45] audit: type=1400 audit(1789265599.821:512): avc: denied { read } for pid=7671 comm="syz.3.761" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 98.050793][ T7676] netlink: 4 bytes leftover after parsing attributes in process `syz.0.762'. [ 98.294733][ T7705] netlink: 20 bytes leftover after parsing attributes in process `syz.3.776'. [ 98.316131][ T7705] netlink: 20 bytes leftover after parsing attributes in process `syz.3.776'. [ 98.387288][ T7714] ubi: bad wear-leveling threshold 271430727 [ 98.411399][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 98.576093][ T5746] Bluetooth: hci1: Invalid connection link type handle 0x00c8 [ 98.577031][ T7730] netlink: Invalid conntrack timeout [ 98.577056][ T7730] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 98.825638][ T7757] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 98.825653][ T7757] overlayfs: missing 'lowerdir' [ 98.843339][ T7748] netlink: 4 bytes leftover after parsing attributes in process `syz.1.795'. [ 98.845266][ T45] audit: type=1400 audit(1789265600.761:513): avc: denied { write } for pid=7758 comm="syz.2.799" name="ptype" dev="proc" ino=4026533043 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 98.920492][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 99.127887][ T7777] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 99.240577][ T2321] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 99.400414][ T2321] usb 7-1: Using ep0 maxpacket: 32 [ 99.403105][ T2321] usb 7-1: unable to get BOS descriptor or descriptor too short [ 99.403139][ T2321] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 99.407448][ T2321] usb 7-1: string descriptor 0 read error: -22 [ 99.407548][ T2321] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.446800][ T2321] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 99.446838][ T2321] dw2102: su3000_power_ctrl: 1, initialized 0 [ 99.446859][ T2321] dvb-usb: bulk message failed: -22 (2/0) [ 99.480987][ T2321] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 99.481725][ T2321] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 99.481764][ T2321] usb 7-1: media controller created [ 99.481784][ T2321] dvb-usb: bulk message failed: -22 (6/0) [ 99.481794][ T2321] dw2102: i2c transfer failed. [ 99.481804][ T2321] dvb-usb: bulk message failed: -22 (6/0) [ 99.481814][ T2321] dw2102: i2c transfer failed. [ 99.481823][ T2321] dvb-usb: bulk message failed: -22 (6/0) [ 99.481833][ T2321] dw2102: i2c transfer failed. [ 99.481843][ T2321] dvb-usb: bulk message failed: -22 (6/0) [ 99.481853][ T2321] dw2102: i2c transfer failed. [ 99.481862][ T2321] dvb-usb: bulk message failed: -22 (6/0) [ 99.481872][ T2321] dw2102: i2c transfer failed. [ 99.481881][ T2321] dvb-usb: bulk message failed: -22 (6/0) [ 99.481899][ T2321] dw2102: i2c transfer failed. [ 99.481905][ T2321] dvb-usb: MAC address: 02:02:02:02:02:02 [ 99.572692][ T2321] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 99.614990][ T2321] dvb-usb: bulk message failed: -22 (3/0) [ 99.615008][ T2321] dw2102: command 0x0e transfer failed. [ 99.615014][ T2321] dvb-usb: bulk message failed: -22 (3/0) [ 99.615024][ T2321] dw2102: command 0x0e transfer failed. [ 99.791086][ T45] audit: type=1400 audit(1789265601.691:514): avc: denied { mounton } for pid=7804 comm="syz.1.819" path=2F3137332FE91F7189591E9233614B dev="tmpfs" ino=919 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 99.904654][ T45] audit: type=1400 audit(1789265601.811:515): avc: denied { ioctl } for pid=7808 comm="syz.1.821" path="/dev/fb0" dev="devtmpfs" ino=638 ioctlcmd=0x4605 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 99.920414][ T2321] dvb-usb: bulk message failed: -22 (3/0) [ 99.920435][ T2321] dw2102: command 0x0e transfer failed. [ 99.920442][ T2321] dvb-usb: bulk message failed: -22 (3/0) [ 99.920452][ T2321] dw2102: command 0x0e transfer failed. [ 99.920458][ T2321] dvb-usb: bulk message failed: -22 (1/0) [ 99.920468][ T2321] dw2102: command 0x51 transfer failed. [ 99.923916][ T7767] dw2102: i2c wr: len=66 is too big! [ 99.923916][ T7767] [ 99.968268][ T2321] DVB: Unable to find symbol ds3000_attach() [ 99.968283][ T2321] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 100.080423][ T2321] rc_core: IR keymap rc-su3000 not found [ 100.080439][ T2321] Registered IR keymap rc-empty [ 100.081325][ T2321] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0 [ 100.088907][ T2321] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0/input9 [ 100.129791][ T2321] dvb-usb: schedule remote query interval to 150 msecs. [ 100.129813][ T2321] dw2102: su3000_power_ctrl: 0, initialized 1 [ 100.129824][ T2321] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 100.134310][ T2321] usb 7-1: USB disconnect, device number 5 [ 100.218136][ T2321] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 100.490476][ T13] net_ratelimit: 508 callbacks suppressed [ 100.490495][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 100.917978][ T45] audit: type=1400 audit(1789265602.821:516): avc: denied { read write } for pid=7856 comm="syz.2.841" name="autofs" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 100.918024][ T45] audit: type=1400 audit(1789265602.821:517): avc: denied { open } for pid=7856 comm="syz.2.841" path="/dev/autofs" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 100.921835][ T45] audit: type=1400 audit(1789265602.831:518): avc: denied { ioctl } for pid=7856 comm="syz.2.841" path="/dev/autofs" dev="devtmpfs" ino=104 ioctlcmd=0x9376 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 101.010916][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 101.098105][ T7874] __nla_validate_parse: 3 callbacks suppressed [ 101.098129][ T7874] netlink: 20 bytes leftover after parsing attributes in process `syz.2.846'. [ 101.100050][ T7874] netlink: 20 bytes leftover after parsing attributes in process `syz.2.846'. [ 101.191235][ T7883] netlink: 8 bytes leftover after parsing attributes in process `syz.3.849'. [ 101.485798][ T7902] mmap: syz.3.851 (7902) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 101.520513][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 101.930112][ T45] audit: type=1400 audit(1789265603.831:519): avc: denied { listen } for pid=7923 comm="syz.2.864" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 102.038799][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 102.141095][ T7944] netlink: 484 bytes leftover after parsing attributes in process `syz.2.872'. [ 102.317331][ T7960] netlink: 20 bytes leftover after parsing attributes in process `syz.2.880'. [ 102.318891][ T7960] netlink: 20 bytes leftover after parsing attributes in process `syz.2.880'. [ 102.373115][ T7966] 9pnet_fd: Insufficient options for proto=fd [ 102.437808][ T7975] tipc: Enabling not permitted [ 102.437831][ T7975] tipc: Enabling of bearer rejected, failed to enable media [ 102.450140][ T7971] netlink: 4 bytes leftover after parsing attributes in process `syz.3.882'. [ 102.550573][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 102.632861][ T7989] netlink: 20 bytes leftover after parsing attributes in process `syz.2.892'. [ 102.634448][ T7989] netlink: 20 bytes leftover after parsing attributes in process `syz.2.892'. [ 102.684958][ T45] audit: type=1400 audit(1789265604.591:520): avc: denied { read } for pid=7993 comm="syz.2.894" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 102.784257][ T45] audit: type=1400 audit(1789265604.691:521): avc: denied { append } for pid=8000 comm="syz.0.897" name="ppp" dev="devtmpfs" ino=729 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 102.979190][ T45] audit: type=1400 audit(1789265604.891:522): avc: denied { create } for pid=8016 comm="syz.3.905" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 102.981102][ T45] audit: type=1400 audit(1789265604.891:523): avc: denied { ioctl } for pid=8016 comm="syz.3.905" path="socket:[21674]" dev="sockfs" ino=21674 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 103.050746][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 103.232208][ T8037] atomic_op ffff888059c761e0 conn xmit_atomic 0000000000000000 [ 103.499506][ T8052] netlink: 44 bytes leftover after parsing attributes in process `syz.3.921'. [ 103.546026][ T8058] tipc: Enabling of bearer rejected, failed to enable media [ 103.572432][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 103.604075][ T8062] capability: warning: `syz.3.926' uses 32-bit capabilities (legacy support in use) [ 104.080219][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 104.301088][ T8111] i2c i2c-1: Frontend requested software zigzag, but didn't set the frequency step size [ 104.494551][ T8143] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 104.580642][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 105.100469][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 105.236075][ T2321] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 105.380608][ T2321] usb 7-1: Using ep0 maxpacket: 32 [ 105.382685][ T2321] usb 7-1: unable to get BOS descriptor or descriptor too short [ 105.382726][ T2321] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 105.402437][ T2321] usb 7-1: string descriptor 0 read error: -22 [ 105.402541][ T2321] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.422481][ T2321] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 105.422520][ T2321] dw2102: su3000_power_ctrl: 1, initialized 0 [ 105.422536][ T2321] dvb-usb: bulk message failed: -22 (2/0) [ 105.431350][ T2321] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 105.432045][ T2321] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 105.432084][ T2321] usb 7-1: media controller created [ 105.432104][ T2321] dvb-usb: bulk message failed: -22 (6/0) [ 105.432114][ T2321] dw2102: i2c transfer failed. [ 105.432125][ T2321] dvb-usb: bulk message failed: -22 (6/0) [ 105.432134][ T2321] dw2102: i2c transfer failed. [ 105.432186][ T2321] dvb-usb: bulk message failed: -22 (6/0) [ 105.432204][ T2321] dw2102: i2c transfer failed. [ 105.432219][ T2321] dvb-usb: bulk message failed: -22 (6/0) [ 105.432228][ T2321] dw2102: i2c transfer failed. [ 105.432237][ T2321] dvb-usb: bulk message failed: -22 (6/0) [ 105.432246][ T2321] dw2102: i2c transfer failed. [ 105.432254][ T2321] dvb-usb: bulk message failed: -22 (6/0) [ 105.432264][ T2321] dw2102: i2c transfer failed. [ 105.432270][ T2321] dvb-usb: MAC address: 02:02:02:02:02:02 [ 105.445771][ T2321] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 105.465796][ T8229] ip6t_hbh: Not strict - not implemented [ 105.494938][ T2321] dvb-usb: bulk message failed: -22 (3/0) [ 105.494959][ T2321] dw2102: command 0x0e transfer failed. [ 105.494965][ T2321] dvb-usb: bulk message failed: -22 (3/0) [ 105.494975][ T2321] dw2102: command 0x0e transfer failed. [ 105.611126][ T13] net_ratelimit: 1 callbacks suppressed [ 105.611145][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 105.695045][ T45] kauditd_printk_skb: 8 callbacks suppressed [ 105.695065][ T45] audit: type=1400 audit(1789265607.601:532): avc: denied { getopt } for pid=8246 comm="syz.1.1011" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 105.769787][ T8253] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 105.769805][ T8253] overlayfs: missing 'lowerdir' [ 105.812764][ T2321] dvb-usb: bulk message failed: -22 (3/0) [ 105.812786][ T2321] dw2102: command 0x0e transfer failed. [ 105.812793][ T2321] dvb-usb: bulk message failed: -22 (3/0) [ 105.812805][ T2321] dw2102: command 0x0e transfer failed. [ 105.812812][ T2321] dvb-usb: bulk message failed: -22 (1/0) [ 105.812822][ T2321] dw2102: command 0x51 transfer failed. [ 105.814382][ T8192] dvb-usb: bulk message failed: -22 (18/0) [ 105.814402][ T8192] dw2102: i2c transfer failed. [ 105.882693][ T2321] DVB: Unable to find symbol ds3000_attach() [ 105.882712][ T2321] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 105.960402][ T2321] rc_core: IR keymap rc-su3000 not found [ 105.960424][ T2321] Registered IR keymap rc-empty [ 105.969442][ T2321] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0 [ 105.974953][ T2321] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0/input10 [ 105.980874][ T2321] dvb-usb: schedule remote query interval to 150 msecs. [ 105.980893][ T2321] dw2102: su3000_power_ctrl: 0, initialized 1 [ 105.980902][ T2321] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 105.985198][ T2321] usb 7-1: USB disconnect, device number 6 [ 106.121827][ T2321] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 106.136075][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 106.398757][ T8295] __nla_validate_parse: 8 callbacks suppressed [ 106.398772][ T8295] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1033'. [ 106.592046][ T8313] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1039'. [ 106.643554][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 106.654932][ T8319] jffs2: notice: (8319) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 106.859464][ T8338] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1050'. [ 106.863495][ T8338] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1050'. [ 106.975486][ T8342] openvswitch: netlink: Encap mask attribute is set for non-VLAN frame. [ 107.034447][ T45] audit: type=1400 audit(1789265608.941:533): avc: denied { write } for pid=8347 comm="syz.2.1056" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 107.084363][ T8352] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1055'. [ 107.103914][ T5882] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 107.150444][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 107.276174][ T5882] usb 5-1: New USB device found, idVendor=0552, idProduct=5510, bcdDevice= 0.00 [ 107.279168][ T5882] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 107.279192][ T5882] usb 5-1: Product: syz [ 107.279202][ T5882] usb 5-1: Manufacturer: syz [ 107.391400][ T8367] netlink: 'syz.2.1063': attribute type 6 has an invalid length. [ 107.579936][ T8377] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1068'. [ 107.579959][ T8377] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1068'. [ 107.660946][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 107.719809][ T8385] tipc: Started in network mode [ 107.719826][ T8385] tipc: Node identity , cluster identity 4711 [ 107.719839][ T8385] tipc: Failed to obtain node identity [ 107.719860][ T8385] tipc: Enabling of bearer rejected, failed to enable media [ 107.769954][ T8391] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1075'. [ 107.771629][ T8391] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1075'. [ 107.895469][ T5882] scsi host6: uas [ 107.914118][ C0] usb 5-1: stat urb: no pending cmd for uas-tag 78 [ 107.967769][ T8405] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1080'. [ 107.967794][ T8405] tipc: Invalid UDP bearer configuration [ 107.967830][ T8405] tipc: Enabling of bearer rejected, failed to enable media [ 108.116412][ C0] usb 5-1: cmd cmplt err -71 [ 108.128410][ T5832] usb 5-1: USB disconnect, device number 4 [ 108.137707][ T5832] scsi 6:0:0:0: tag#20 uas_zap_pending 0 uas-tag 1 inflight: CMD [ 108.137794][ T5832] scsi 6:0:0:0: tag#20 CDB: Inquiry 12 00 00 00 24 00 [ 108.170606][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 108.265538][ T8423] ip_tables: iptables: counters copy to user failed while replacing table [ 108.692738][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 108.931486][ T5832] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 109.100423][ T5832] usb 5-1: Using ep0 maxpacket: 8 [ 109.101146][ T5832] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 109.102570][ T5832] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 109.102589][ T5832] usb 5-1: config 0 has no interface number 0 [ 109.102618][ T5832] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 109.102636][ T5832] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 109.102656][ T5832] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 109.102676][ T5832] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 109.102730][ T5832] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.108280][ T5832] usb 5-1: config 0 descriptor?? [ 109.155975][ T5832] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 109.200986][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 109.326206][ T5882] usb 5-1: USB disconnect, device number 5 [ 109.348058][ T5882] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 109.398749][ T8448] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 109.398769][ T8448] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 109.399836][ T8448] vhci_hcd vhci_hcd.0: Device attached [ 109.403836][ T8450] vhci_hcd: cannot find a urb of seqnum 0 max seqnum 0 [ 109.404804][ T5810] vhci_hcd vhci_hcd.1: stop threads [ 109.404823][ T5810] vhci_hcd vhci_hcd.1: release socket [ 109.404835][ T5810] vhci_hcd vhci_hcd.1: disconnect device [ 109.671620][ T8470] fuse: fd is not a fuse device [ 109.886158][ T45] audit: type=1400 audit(1789265611.801:534): avc: denied { cmd } for pid=8479 comm="iou-wrk-8480" path="/dev/ublk-control" dev="devtmpfs" ino=706 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 110.005766][ T45] audit: type=1400 audit(1789265611.911:535): avc: denied { mount } for pid=8492 comm="syz.2.1119" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 110.007440][ T45] audit: type=1400 audit(1789265611.911:536): avc: denied { search } for pid=8492 comm="syz.2.1119" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 110.007729][ T45] audit: type=1400 audit(1789265611.911:537): avc: denied { write } for pid=8492 comm="syz.2.1119" name="versions" dev="nfsd" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 110.008088][ T45] audit: type=1400 audit(1789265611.911:538): avc: denied { open } for pid=8492 comm="syz.2.1119" path="/253/nfsd/versions" dev="nfsd" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 110.033299][ T45] audit: type=1400 audit(1789265611.931:539): avc: denied { unmount } for pid=5734 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 110.205088][ T8504] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 110.224038][ T1178] Bluetooth: hci4: Frame reassembly failed (-84) [ 110.233054][ T1178] Bluetooth: hci4: Frame reassembly failed (-84) [ 110.338610][ T8516] fuse: fd is not a fuse device [ 110.495319][ T45] audit: type=1400 audit(1789265612.401:540): avc: denied { read } for pid=8523 comm="syz.1.1133" path="socket:[23057]" dev="sockfs" ino=23057 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 110.730602][ T13] net_ratelimit: 3 callbacks suppressed [ 110.730624][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 110.806932][ T8543] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 110.964933][ T8554] loop7: detected capacity change from 0 to 7 [ 110.968996][ T5736] Buffer I/O error on dev loop7, logical block 0, async page read [ 110.969481][ T5736] Buffer I/O error on dev loop7, logical block 0, async page read [ 110.969901][ T5736] Buffer I/O error on dev loop7, logical block 0, async page read [ 110.971170][ T5736] Buffer I/O error on dev loop7, logical block 0, async page read [ 110.971586][ T5736] Buffer I/O error on dev loop7, logical block 0, async page read [ 111.240520][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 111.442528][ T5882] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 111.591168][ T5882] usb 7-1: New USB device found, idVendor=047e, idProduct=ffff, bcdDevice= 0.00 [ 111.591819][ T5882] usb 7-1: config 0 has no interfaces? [ 111.591846][ T5882] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.594760][ T5882] usb 7-1: config 0 descriptor?? [ 111.750653][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 111.800565][ T5882] usb 7-1: USB disconnect, device number 7 [ 112.250460][ T5748] Bluetooth: hci4: command 0x1003 tx timeout [ 112.252466][ T5746] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 112.260432][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 112.350939][ T45] audit: type=1400 audit(1789265614.251:541): avc: denied { read append } for pid=8565 comm="syz.2.1153" name="snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 112.354315][ T45] audit: type=1400 audit(1789265614.261:542): avc: denied { open } for pid=8565 comm="syz.2.1153" path="/dev/snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 112.580440][ T5847] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 112.629415][ T8580] __nla_validate_parse: 1 callbacks suppressed [ 112.629433][ T8580] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1158'. [ 112.631573][ T8580] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1158'. [ 112.731494][ T5847] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 112.732472][ T5847] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 112.732494][ T5847] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 112.732511][ T5847] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 112.735444][ T5847] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.735463][ T5847] usb 6-1: Product: syz [ 112.735478][ T5847] usb 6-1: Manufacturer: syz [ 112.735489][ T5847] usb 6-1: SerialNumber: syz [ 112.744674][ T5847] hub 6-1:1.0: bad descriptor, ignoring hub [ 112.744696][ T5847] hub 6-1:1.0: probe with driver hub failed with error -5 [ 112.783546][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 112.955005][ T5847] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 113.273213][ T5847] usb 6-1: USB disconnect, device number 3 [ 113.277187][ T5847] usblp0: removed [ 113.300569][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 113.534341][ T8610] netlink: 236 bytes leftover after parsing attributes in process `syz.3.1172'. [ 113.534365][ T8610] netlink: 236 bytes leftover after parsing attributes in process `syz.3.1172'. [ 113.810513][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 113.902181][ T8619] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1175'. [ 113.962050][ T45] audit: type=1400 audit(1789265615.861:543): avc: denied { write } for pid=8620 comm="syz.1.1176" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 114.320647][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 114.480477][ T8566] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 114.480525][ T5746] Bluetooth: hci1: command 0x0c1a tx timeout [ 114.831148][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 115.340644][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 115.350617][ T8566] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 115.380192][ T8566] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 115.384850][ T8566] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 115.384909][ T8566] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 115.389636][ T8566] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 115.398048][ T8566] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 115.398132][ T8566] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 115.401723][ T8566] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 115.464400][ T45] audit: type=1400 audit(1789265617.371:544): avc: denied { name_bind } for pid=8658 comm="syz.2.1194" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 115.650735][ T58] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 115.725901][ T8665] kAFS: No cell specified [ 115.814750][ T58] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 115.815706][ T58] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 115.815730][ T58] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 115.815744][ T58] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 115.815775][ T58] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 115.815794][ T58] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 115.817222][ T58] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 115.817242][ T58] usb 6-1: Product: syz [ 115.817254][ T58] usb 6-1: Manufacturer: syz [ 115.825438][ T8667] md: array md0 already initialised! [ 115.828912][ T58] cdc_wdm 6-1:1.0: skipping garbage [ 115.828929][ T58] cdc_wdm 6-1:1.0: skipping garbage [ 115.842994][ T58] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 115.843015][ T58] cdc_wdm 6-1:1.0: Unknown control protocol [ 115.853933][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 115.860532][ T5882] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 115.879644][ T8667] md: md0 stopped. [ 116.035695][ T45] audit: type=1400 audit(1789265617.941:545): avc: denied { read write } for pid=8655 comm="syz.1.1193" name="cdc-wdm0" dev="devtmpfs" ino=2940 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 116.036092][ T45] audit: type=1400 audit(1789265617.941:546): avc: denied { open } for pid=8655 comm="syz.1.1193" path="/dev/cdc-wdm0" dev="devtmpfs" ino=2940 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 116.039980][ T5882] usb 7-1: Using ep0 maxpacket: 32 [ 116.040981][ T5882] usb 7-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 116.051536][ T5882] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 116.051561][ T5882] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 116.051577][ T5882] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 116.051605][ T5882] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.055086][ T5882] usb 7-1: config 0 descriptor?? [ 116.102056][ C2] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 116.102132][ C2] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 116.102345][ C2] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 116.102362][ C2] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 116.102540][ T7374] usb 6-1: USB disconnect, device number 4 [ 116.102569][ C2] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 116.102586][ C2] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 116.102601][ C2] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 116.150071][ T45] audit: type=1400 audit(1789265618.051:547): avc: denied { cmd } for pid=8676 comm="iou-wrk-8677" path="socket:[22152]" dev="sockfs" ino=22152 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 116.360515][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 116.486892][ T5882] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/0003:0458:5011.0002/input/input11 [ 116.560916][ T5746] Bluetooth: hci1: command 0x0c1a tx timeout [ 116.584246][ T5882] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/0003:0458:5011.0002/input/input12 [ 116.675858][ T5882] kye 0003:0458:5011.0002: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.2-1/input0 [ 116.697336][ T45] audit: type=1400 audit(1789265618.591:548): avc: denied { mount } for pid=8685 comm="syz.3.1204" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 116.880505][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 116.886770][ T8693] binder: 8692:8693 ioctl c0306201 0 returned -14 [ 116.958047][ T45] audit: type=1400 audit(1789265618.861:549): avc: denied { remount } for pid=8699 comm="syz.1.1210" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 116.996762][ T8700] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 117.129634][ T8711] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1214'. [ 117.391539][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 117.442147][ T5746] Bluetooth: hci2: command 0x0c1a tx timeout [ 117.455016][ T5746] Bluetooth: hci3: command 0x0c1a tx timeout [ 117.503638][ C2] kye 0003:0458:5011.0002: usb_submit_urb(ctrl) failed: -1 [ 117.518002][ T45] audit: type=1400 audit(1789265619.421:550): avc: denied { module_request } for pid=8720 comm="syz.1.1218" kmod="crypto-xts(serpent)" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 117.910410][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 118.351826][ T45] audit: type=1400 audit(1789265620.261:551): avc: denied { mounton } for pid=8762 comm="syz.0.1232" path="/proc/572/task" dev="proc" ino=22348 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 118.421911][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 118.468957][ T8776] gre1: entered promiscuous mode [ 118.468978][ T8776] gre1: entered allmulticast mode [ 118.500490][ T9] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 118.582217][ T58] usb 7-1: reset high-speed USB device number 8 using dummy_hcd [ 118.586094][ T58] usb 7-1: device reset changed ep0 maxpacket size! [ 118.604959][ T5882] usb 7-1: USB disconnect, device number 8 [ 118.641022][ T5746] Bluetooth: hci1: command 0x0c1a tx timeout [ 118.652166][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 118.665493][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 118.665539][ T9] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 118.666635][ T9] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 118.666658][ T9] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 118.666677][ T9] usb 6-1: config 14 has no interface number 0 [ 118.666694][ T9] usb 6-1: config 14 has no interface number 1 [ 118.666744][ T9] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 118.666766][ T9] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 118.666791][ T9] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 118.666814][ T9] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 118.666840][ T9] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 118.666863][ T9] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 118.666894][ T9] usb 6-1: config 14 interface 57 has no altsetting 0 [ 118.666911][ T9] usb 6-1: config 14 interface 228 has no altsetting 0 [ 118.673621][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.673645][ T9] usb 6-1: Product: syz [ 118.673657][ T9] usb 6-1: Manufacturer: syz [ 118.673669][ T9] usb 6-1: SerialNumber: syz [ 118.892908][ T5882] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 118.934764][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 119.043035][ T5882] usb 7-1: Using ep0 maxpacket: 8 [ 119.048805][ T5882] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 119.057414][ T5882] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 119.057521][ T5882] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.071975][ T5882] usb 7-1: config 0 descriptor?? [ 119.103306][ T9] legousbtower 6-1:14.57: interrupt endpoints not found [ 119.291737][ T5882] iowarrior 7-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 119.320952][ T9] legousbtower 6-1:14.228: get version request failed: -71 [ 119.321084][ T9] legousbtower 6-1:14.228: probe with driver legousbtower failed with error -71 [ 119.328257][ T9] usb 6-1: USB disconnect, device number 5 [ 119.440894][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 119.522007][ T5746] Bluetooth: hci3: command 0x0c1a tx timeout [ 119.522044][ T5746] Bluetooth: hci2: command 0x0c1a tx timeout [ 119.623059][ T8796] netlink: 'syz.3.1247': attribute type 10 has an invalid length. [ 119.642081][ T58] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 119.746713][ T5883] usb 7-1: USB disconnect, device number 9 [ 119.801070][ T58] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 119.801998][ T58] usb 5-1: config index 0 descriptor too short (expected 64906, got 45) [ 119.803719][ T58] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.803738][ T58] usb 5-1: Product: syz [ 119.803749][ T58] usb 5-1: Manufacturer: syz [ 119.803759][ T58] usb 5-1: SerialNumber: syz [ 119.919177][ T45] audit: type=1400 audit(1789265621.831:552): avc: denied { unmount } for pid=5740 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 119.960872][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 120.024566][ T58] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 120.024612][ T58] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 120.024628][ T58] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 120.038469][ T58] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 120.043269][ T58] usb 5-1: USB disconnect, device number 7 [ 120.133089][ T8815] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2 sclass=netlink_route_socket pid=8815 comm=syz.3.1255 [ 120.478049][ T8834] FAULT_INJECTION: forcing a failure. [ 120.478049][ T8834] name failslab, interval 1, probability 0, space 0, times 0 [ 120.478085][ T8834] CPU: 3 UID: 0 PID: 8834 Comm: syz.1.1263 Not tainted syzkaller #0 PREEMPT(full) [ 120.478108][ T8834] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 120.478118][ T8834] Call Trace: [ 120.478126][ T8834] [ 120.478134][ T8834] dump_stack_lvl+0x100/0x190 [ 120.478181][ T8834] should_fail_ex.cold+0x5/0xa [ 120.478215][ T8834] ? __pfx_mqueue_fill_super+0x10/0x10 [ 120.478249][ T8834] should_failslab+0xc2/0x120 [ 120.478274][ T8834] ? __pfx_mqueue_fill_super+0x10/0x10 [ 120.478303][ T8834] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 120.478325][ T8834] ? do_raw_spin_unlock+0x145/0x1e0 [ 120.478351][ T8834] ? __d_alloc+0x35/0xa50 [ 120.478383][ T8834] ? __pfx_mqueue_fill_super+0x10/0x10 [ 120.478430][ T8834] __d_alloc+0x35/0xa50 [ 120.478459][ T8834] ? __pfx_mqueue_fill_super+0x10/0x10 [ 120.478487][ T8834] d_make_root+0x3e/0x90 [ 120.478517][ T8834] mqueue_fill_super+0x16d/0x250 [ 120.478546][ T8834] get_tree_nodev+0xdd/0x190 [ 120.478571][ T8834] mqueue_get_tree+0xf1/0x130 [ 120.478597][ T8834] vfs_get_tree+0x92/0x320 [ 120.478626][ T8834] fc_mount_longterm+0x1a/0x270 [ 120.478648][ T8834] mq_init_ns+0x482/0x820 [ 120.478668][ T8834] copy_ipcs+0x3dd/0x7e0 [ 120.478689][ T8834] create_new_namespaces+0x20a/0xac0 [ 120.478711][ T8834] ? security_capable+0x80/0x260 [ 120.478743][ T8834] unshare_nsproxy_namespaces+0xf2/0x220 [ 120.478767][ T8834] ksys_unshare+0x4a2/0xa70 [ 120.478792][ T8834] ? __pfx_ksys_unshare+0x10/0x10 [ 120.478824][ T8834] __x64_sys_unshare+0x31/0x40 [ 120.478846][ T8834] do_syscall_64+0x123/0x790 [ 120.478881][ T8834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.478902][ T8834] RIP: 0033:0x7fd3bbd9e159 [ 120.478921][ T8834] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.478940][ T8834] RSP: 002b:00007fd3bcd42028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 120.478960][ T8834] RAX: ffffffffffffffda RBX: 00007fd3bc025fa0 RCX: 00007fd3bbd9e159 [ 120.478972][ T8834] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000004a000200 [ 120.478984][ T8834] RBP: 00007fd3bbe3503b R08: 0000000000000000 R09: 0000000000000000 [ 120.478996][ T8834] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 120.479007][ T8834] R13: 00007fd3bc026038 R14: 00007fd3bc025fa0 R15: 00007fffaa6b0c08 [ 120.479034][ T8834] [ 120.542393][ T8840] fuse: fd is not a fuse device [ 120.635839][ T8843] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 120.911522][ T8856] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1271'. [ 120.982922][ T5810] net_ratelimit: 1 callbacks suppressed [ 120.982943][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 121.074987][ T8867] input: syz0 as /devices/virtual/input/input13 [ 121.183562][ T45] audit: type=1400 audit(1789265623.091:553): avc: denied { write } for pid=8869 comm="syz.1.1275" name="/" dev="9p" ino=73941781 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 121.184612][ T45] audit: type=1400 audit(1789265623.091:554): avc: denied { add_name } for pid=8869 comm="syz.1.1275" name="blkio.bfq.io_merged_recursive" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 121.185158][ T45] audit: type=1400 audit(1789265623.091:555): avc: denied { create } for pid=8869 comm="syz.1.1275" name="blkio.bfq.io_merged_recursive" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 121.185452][ T45] audit: type=1400 audit(1789265623.091:556): avc: denied { associate } for pid=8869 comm="syz.1.1275" name="blkio.bfq.io_merged_recursive" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 121.232507][ T45] audit: type=1400 audit(1789265623.141:557): avc: denied { read append open } for pid=8869 comm="syz.1.1275" path="/287/file0/blkio.bfq.io_merged_recursive" dev="9p" ino=73941823 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 121.490613][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 121.600498][ T5746] Bluetooth: hci3: command 0x0c1a tx timeout [ 121.600550][ T5748] Bluetooth: hci2: command 0x0c1a tx timeout [ 121.668742][ T45] audit: type=1400 audit(1789265623.561:558): avc: denied { getopt } for pid=8886 comm="syz.1.1282" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 121.760852][ T45] audit: type=1800 audit(1789265623.671:559): pid=8890 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.1281" name=08 dev="sda1" ino=2038 res=0 errno=0 [ 121.842273][ T8897] CIFS: Attempting to mount //127.0.0.1/share [ 122.000459][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 122.148922][ T8913] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1291'. [ 122.169509][ T8913] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1291'. [ 122.180608][ T13] netdevsim netdevsim14 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 122.180654][ T13] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 122.180683][ T13] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 122.180713][ T13] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 122.180741][ T13] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. [ 122.510530][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 122.647574][ T8918] kvm_intel: kvm [8916]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x1d9) = 0xa5ef [ 122.666983][ T8897] CIFS: VFS: \\127.0.0.1 failed to create a new SMB session with Unknown: -11 [ 122.667185][ T8918] kvm_pr_unimpl_wrmsr: 44 callbacks suppressed [ 122.667200][ T8918] kvm [8916]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x187) = 0xb318 [ 122.667389][ T8918] kvm [8916]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x186) = 0xb3b9 [ 122.668746][ T8897] CIFS: VFS: cifs_mount failed w/return code = -11 [ 122.744622][ T45] kauditd_printk_skb: 3 callbacks suppressed [ 122.744640][ T45] audit: type=1400 audit(1789265624.651:563): avc: denied { bind } for pid=8934 comm="syz.2.1298" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 122.849688][ T8939] syzkaller1: entered promiscuous mode [ 122.849704][ T8939] syzkaller1: entered allmulticast mode [ 123.030460][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 123.492500][ T45] audit: type=1400 audit(1789265625.401:564): avc: denied { listen } for pid=8962 comm="syz.1.1308" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 123.545198][ T45] audit: type=1400 audit(1789265625.451:565): avc: denied { mount } for pid=8968 comm="syz.1.1310" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 123.551023][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 123.561996][ T45] audit: type=1400 audit(1789265625.461:566): avc: denied { unmount } for pid=5740 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 123.610051][ T45] audit: type=1400 audit(1789265625.511:567): avc: denied { bpf } for pid=8966 comm="syz.3.1309" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 123.615161][ T45] audit: type=1400 audit(1789265625.521:568): avc: denied { perfmon } for pid=8966 comm="syz.3.1309" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 123.656925][ T8975] FAULT_INJECTION: forcing a failure. [ 123.656925][ T8975] name failslab, interval 1, probability 0, space 0, times 0 [ 123.656954][ T8975] CPU: 3 UID: 0 PID: 8975 Comm: syz.2.1311 Not tainted syzkaller #0 PREEMPT(full) [ 123.656975][ T8975] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 123.656984][ T8975] Call Trace: [ 123.656991][ T8975] [ 123.657000][ T8975] dump_stack_lvl+0x100/0x190 [ 123.657043][ T8975] should_fail_ex.cold+0x5/0xa [ 123.657071][ T8975] should_failslab+0xc2/0x120 [ 123.657099][ T8975] __kmalloc_noprof+0xfc/0x840 [ 123.657120][ T8975] ? __vb2_queue_alloc+0x23e/0x1160 [ 123.657147][ T8975] __vb2_queue_alloc+0x23e/0x1160 [ 123.657179][ T8975] vb2_core_reqbufs+0x899/0xf30 [ 123.657204][ T8975] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 123.657229][ T8975] ? trace_contention_end+0x126/0x160 [ 123.657250][ T8975] ? __mutex_lock+0x26c/0x1bd0 [ 123.657281][ T8975] ? __video_do_ioctl+0x50f/0xdf0 [ 123.657310][ T8975] vb2_ioctl_reqbufs+0x291/0x450 [ 123.657338][ T8975] ? __pfx_vb2_ioctl_reqbufs+0x10/0x10 [ 123.657400][ T8975] vidioc_reqbufs+0x86/0x100 [ 123.657425][ T8975] v4l_reqbufs+0x175/0x1d0 [ 123.657450][ T8975] __video_do_ioctl+0xb2a/0xdf0 [ 123.657480][ T8975] ? __might_fault+0xc5/0x140 [ 123.657507][ T8975] ? __pfx___video_do_ioctl+0x10/0x10 [ 123.657543][ T8975] video_usercopy+0x47a/0x1730 [ 123.657568][ T8975] ? __pfx___video_do_ioctl+0x10/0x10 [ 123.657595][ T8975] ? __pfx_video_usercopy+0x10/0x10 [ 123.657636][ T8975] v4l2_ioctl+0x1bd/0x250 [ 123.657661][ T8975] ? __pfx_v4l2_ioctl+0x10/0x10 [ 123.657687][ T8975] __x64_sys_ioctl+0x18e/0x210 [ 123.657708][ T8975] do_syscall_64+0x123/0x790 [ 123.657734][ T8975] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.657752][ T8975] RIP: 0033:0x7f0e6b39e159 [ 123.657768][ T8975] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.657785][ T8975] RSP: 002b:00007f0e6c285028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 123.657805][ T8975] RAX: ffffffffffffffda RBX: 00007f0e6b625fa0 RCX: 00007f0e6b39e159 [ 123.657817][ T8975] RDX: 0000200000000100 RSI: 00000000c0145608 RDI: 0000000000000004 [ 123.657827][ T8975] RBP: 00007f0e6b43503b R08: 0000000000000000 R09: 0000000000000000 [ 123.657839][ T8975] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 123.657853][ T8975] R13: 00007f0e6b626038 R14: 00007f0e6b625fa0 R15: 00007ffe6c97a348 [ 123.657880][ T8975] [ 124.058744][ T8994] overlayfs: failed to clone upperpath [ 124.061461][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 124.168259][ T9002] FAULT_INJECTION: forcing a failure. [ 124.168259][ T9002] name failslab, interval 1, probability 0, space 0, times 0 [ 124.168292][ T9002] CPU: 0 UID: 0 PID: 9002 Comm: syz.2.1324 Not tainted syzkaller #0 PREEMPT(full) [ 124.168316][ T9002] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 124.168328][ T9002] Call Trace: [ 124.168335][ T9002] [ 124.168344][ T9002] dump_stack_lvl+0x100/0x190 [ 124.168378][ T9002] should_fail_ex.cold+0x5/0xa [ 124.168407][ T9002] should_failslab+0xc2/0x120 [ 124.168432][ T9002] kmem_cache_alloc_noprof+0x92/0x6a0 [ 124.168450][ T9002] ? __pfx_map_id_range_down+0x10/0x10 [ 124.168471][ T9002] ? security_inode_alloc+0x3b/0x2c0 [ 124.168496][ T9002] security_inode_alloc+0x3b/0x2c0 [ 124.168516][ T9002] inode_init_always_gfp+0xc6f/0xfb0 [ 124.168541][ T9002] alloc_inode+0x8e/0x250 [ 124.168558][ T9002] new_inode+0x22/0x1c0 [ 124.168576][ T9002] debugfs_create_dir+0x9d/0x420 [ 124.168606][ T9002] kvm_dev_ioctl+0x1286/0x1b50 [ 124.168638][ T9002] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 124.168666][ T9002] ? selinux_file_ioctl+0x13b/0x290 [ 124.168695][ T9002] ? selinux_file_ioctl+0xb6/0x290 [ 124.168720][ T9002] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 124.168746][ T9002] __x64_sys_ioctl+0x18e/0x210 [ 124.168771][ T9002] do_syscall_64+0x123/0x790 [ 124.168801][ T9002] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.168821][ T9002] RIP: 0033:0x7f0e6b39e159 [ 124.168839][ T9002] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.168857][ T9002] RSP: 002b:00007f0e6c285028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 124.168876][ T9002] RAX: ffffffffffffffda RBX: 00007f0e6b625fa0 RCX: 00007f0e6b39e159 [ 124.168889][ T9002] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000004 [ 124.168900][ T9002] RBP: 00007f0e6b43503b R08: 0000000000000000 R09: 0000000000000000 [ 124.168912][ T9002] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.168923][ T9002] R13: 00007f0e6b626038 R14: 00007f0e6b625fa0 R15: 00007ffe6c97a348 [ 124.168951][ T9002] [ 124.168974][ T9002] debugfs: out of free dentries, can not create directory '9002-5' [ 124.171322][ T9001] netlink: 'syz.3.1325': attribute type 1 has an invalid length. [ 124.212613][ T9001] ifb0: entered promiscuous mode [ 124.239867][ T9001] netlink: 'syz.3.1325': attribute type 1 has an invalid length. [ 124.447647][ T9014] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 124.523540][ T45] audit: type=1400 audit(1789265626.431:569): avc: denied { write } for pid=9019 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 124.580529][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 124.613846][ T45] audit: type=1400 audit(1789265626.521:570): avc: denied { write } for pid=9025 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 124.906233][ T9036] kvm: vcpu 0: requested 148514 ns lapic timer period limited to 200000 ns [ 124.906476][ T9036] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 124.942310][ T45] audit: type=1400 audit(1789265626.851:571): avc: denied { write } for pid=9037 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 125.019514][ T45] audit: type=1400 audit(1789265626.921:572): avc: denied { write } for pid=9041 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 125.036806][ T9043] fuse: fd is not a fuse device [ 125.090607][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 125.610500][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 126.120464][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 126.165415][ T9063] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1341'. [ 126.299765][ T9065] overlayfs: failed to clone upperpath [ 126.630513][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 126.910554][ T9084] input: syz1 as /devices/virtual/input/input14 [ 127.141423][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 127.324418][ T9099] FAULT_INJECTION: forcing a failure. [ 127.324418][ T9099] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 127.324454][ T9099] CPU: 1 UID: 0 PID: 9099 Comm: syz.0.1355 Not tainted syzkaller #0 PREEMPT(full) [ 127.324480][ T9099] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 127.324493][ T9099] Call Trace: [ 127.324501][ T9099] [ 127.324510][ T9099] dump_stack_lvl+0x100/0x190 [ 127.324558][ T9099] should_fail_ex.cold+0x5/0xa [ 127.324585][ T9099] ? prepare_alloc_pages+0x16d/0x5b0 [ 127.324619][ T9099] should_fail_alloc_page+0xeb/0x140 [ 127.324646][ T9099] prepare_alloc_pages+0x1f0/0x5b0 [ 127.324673][ T9099] ? __lock_acquire+0x5c0/0x1f40 [ 127.324697][ T9099] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 127.324743][ T9099] ? lock_acquire+0x1d1/0x380 [ 127.324766][ T9099] ? do_raw_spin_lock+0x128/0x260 [ 127.324797][ T9099] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 127.324831][ T9099] ? _raw_spin_unlock_irq+0x2e/0x50 [ 127.324878][ T9099] ? snd_seq_timer_open+0x438/0x5c0 [ 127.324911][ T9099] ? __pfx_snd_seq_timer_open+0x10/0x10 [ 127.324941][ T9099] ? do_raw_spin_lock+0x128/0x260 [ 127.324967][ T9099] ? find_held_lock+0x2b/0x80 [ 127.325000][ T9099] ? mark_held_locks+0x40/0x70 [ 127.325021][ T9099] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 127.325044][ T9099] ? lockdep_hardirqs_on+0x7d/0x110 [ 127.325071][ T9099] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 127.325095][ T9099] ? snd_seq_queue_alloc+0x3c8/0x540 [ 127.325122][ T9099] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 127.325147][ T9099] ? policy_nodemask+0xed/0x4f0 [ 127.325176][ T9099] alloc_pages_mpol+0x201/0x550 [ 127.325204][ T9099] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 127.325231][ T9099] ? alloc_seq_queue+0x121/0x180 [ 127.325260][ T9099] ___kmalloc_large_node+0xe8/0x130 [ 127.325288][ T9099] __kmalloc_large_node_noprof+0x1c/0x70 [ 127.325316][ T9099] __kmalloc_noprof+0x5a8/0x840 [ 127.325338][ T9099] ? find_held_lock+0x2b/0x80 [ 127.325363][ T9099] ? snd_seq_oss_readq_new+0x70/0x210 [ 127.325390][ T9099] snd_seq_oss_readq_new+0x70/0x210 [ 127.325411][ T9099] snd_seq_oss_open+0x476/0xa10 [ 127.325441][ T9099] odev_open+0x6f/0x90 [ 127.325463][ T9099] ? __pfx_odev_open+0x10/0x10 [ 127.325486][ T9099] soundcore_open+0x2e3/0x5a0 [ 127.325513][ T9099] ? __pfx_soundcore_open+0x10/0x10 [ 127.325536][ T9099] chrdev_open+0x234/0x6a0 [ 127.325563][ T9099] ? __pfx_chrdev_open+0x10/0x10 [ 127.325611][ T9099] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 127.325651][ T9099] do_dentry_open+0x6ab/0x14d0 [ 127.325673][ T9099] ? __pfx_chrdev_open+0x10/0x10 [ 127.325704][ T9099] vfs_open+0x82/0x3f0 [ 127.325743][ T9099] path_openat+0x19fa/0x2440 [ 127.325773][ T9099] ? __pfx_path_openat+0x10/0x10 [ 127.325808][ T9099] do_file_open+0x20e/0x430 [ 127.325837][ T9099] ? __pfx_do_file_open+0x10/0x10 [ 127.325883][ T9099] ? _raw_spin_unlock+0x28/0x50 [ 127.325907][ T9099] ? alloc_fd+0x471/0x7a0 [ 127.325940][ T9099] do_sys_openat2+0x10f/0x1e0 [ 127.325967][ T9099] ? __pfx_do_sys_openat2+0x10/0x10 [ 127.326003][ T9099] __x64_sys_openat+0x12d/0x210 [ 127.326030][ T9099] ? __pfx___x64_sys_openat+0x10/0x10 [ 127.326068][ T9099] do_syscall_64+0x123/0x790 [ 127.326100][ T9099] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.326123][ T9099] RIP: 0033:0x7fd19779e159 [ 127.326142][ T9099] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 127.326162][ T9099] RSP: 002b:00007fd198684028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 127.326185][ T9099] RAX: ffffffffffffffda RBX: 00007fd197a25fa0 RCX: 00007fd19779e159 [ 127.326200][ T9099] RDX: 0000000000060042 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 127.326214][ T9099] RBP: 00007fd19783503b R08: 0000000000000000 R09: 0000000000000000 [ 127.326227][ T9099] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.326240][ T9099] R13: 00007fd197a26038 R14: 00007fd197a25fa0 R15: 00007ffd940e6708 [ 127.326269][ T9099] [ 127.650604][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 127.692589][ T9109] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1357'. [ 128.100867][ T9125] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1364'. [ 128.165156][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 128.341429][ T9129] syzkaller0: entered promiscuous mode [ 128.341459][ T9129] syzkaller0: entered allmulticast mode [ 128.680633][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 128.776120][ T9141] FAULT_INJECTION: forcing a failure. [ 128.776120][ T9141] name failslab, interval 1, probability 0, space 0, times 0 [ 128.776158][ T9141] CPU: 3 UID: 0 PID: 9141 Comm: syz.1.1369 Not tainted syzkaller #0 PREEMPT(full) [ 128.776186][ T9141] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 128.776201][ T9141] Call Trace: [ 128.776209][ T9141] [ 128.776218][ T9141] dump_stack_lvl+0x100/0x190 [ 128.776266][ T9141] should_fail_ex.cold+0x5/0xa [ 128.776301][ T9141] should_failslab+0xc2/0x120 [ 128.776330][ T9141] __kvmalloc_node_noprof+0x113/0x9b0 [ 128.776354][ T9141] ? do_raw_spin_lock+0x128/0x260 [ 128.776382][ T9141] ? find_held_lock+0x2b/0x80 [ 128.776412][ T9141] ? simple_xattr_alloc+0x6c/0xd0 [ 128.776438][ T9141] simple_xattr_alloc+0x6c/0xd0 [ 128.776460][ T9141] shmem_initxattrs+0x16a/0x650 [ 128.776490][ T9141] security_inode_init_security+0x242/0x370 [ 128.776525][ T9141] ? __pfx_shmem_initxattrs+0x10/0x10 [ 128.776550][ T9141] ? __pfx_security_inode_init_security+0x10/0x10 [ 128.776584][ T9141] ? do_raw_spin_unlock+0x145/0x1e0 [ 128.776612][ T9141] ? _raw_spin_unlock+0x28/0x50 [ 128.776643][ T9141] shmem_mknod+0x2ce/0x480 [ 128.776673][ T9141] ? __pfx_shmem_mknod+0x10/0x10 [ 128.776696][ T9141] ? bpf_lsm_inode_create+0x9/0x10 [ 128.776729][ T9141] ? __pfx_shmem_create+0x10/0x10 [ 128.776752][ T9141] lookup_open+0x1255/0x1990 [ 128.776786][ T9141] path_openat+0xa2c/0x2440 [ 128.776814][ T9141] ? __pfx_path_openat+0x10/0x10 [ 128.776847][ T9141] do_file_open+0x20e/0x430 [ 128.776872][ T9141] ? __pfx_do_file_open+0x10/0x10 [ 128.776920][ T9141] ? _raw_spin_unlock+0x28/0x50 [ 128.776944][ T9141] ? alloc_fd+0x471/0x7a0 [ 128.776977][ T9141] do_sys_openat2+0x10f/0x1e0 [ 128.777005][ T9141] ? __pfx_do_sys_openat2+0x10/0x10 [ 128.777053][ T9141] __x64_sys_openat+0x12d/0x210 [ 128.777084][ T9141] ? __pfx___x64_sys_openat+0x10/0x10 [ 128.777124][ T9141] do_syscall_64+0x123/0x790 [ 128.777156][ T9141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.777178][ T9141] RIP: 0033:0x7fd3bbd9e159 [ 128.777197][ T9141] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.777217][ T9141] RSP: 002b:00007fd3bcd42028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 128.777248][ T9141] RAX: ffffffffffffffda RBX: 00007fd3bc025fa0 RCX: 00007fd3bbd9e159 [ 128.777262][ T9141] RDX: 00000000000026e1 RSI: 0000200000000200 RDI: ffffffffffffff9c [ 128.777276][ T9141] RBP: 00007fd3bbe3503b R08: 0000000000000000 R09: 0000000000000000 [ 128.777290][ T9141] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 128.777303][ T9141] R13: 00007fd3bc026038 R14: 00007fd3bc025fa0 R15: 00007fffaa6b0c08 [ 128.777332][ T9141] [ 129.048574][ T45] audit: type=1800 audit(1789265630.951:573): pid=9143 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.1370" name=08 dev="sda1" ino=2038 res=0 errno=0 [ 129.192768][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 129.281827][ T9154] FAULT_INJECTION: forcing a failure. [ 129.281827][ T9154] name failslab, interval 1, probability 0, space 0, times 0 [ 129.281866][ T9154] CPU: 2 UID: 0 PID: 9154 Comm: syz.2.1374 Not tainted syzkaller #0 PREEMPT(full) [ 129.281891][ T9154] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 129.281905][ T9154] Call Trace: [ 129.281912][ T9154] [ 129.281920][ T9154] dump_stack_lvl+0x100/0x190 [ 129.281959][ T9154] should_fail_ex.cold+0x5/0xa [ 129.281988][ T9154] should_failslab+0xc2/0x120 [ 129.282017][ T9154] __kvmalloc_node_noprof+0x113/0x9b0 [ 129.282042][ T9154] ? bucket_table_alloc.isra.0+0x88/0x460 [ 129.282078][ T9154] ? bucket_table_alloc.isra.0+0x88/0x460 [ 129.282116][ T9154] bucket_table_alloc.isra.0+0x88/0x460 [ 129.282150][ T9154] __rhashtable_init_noprof+0x43a/0x890 [ 129.282186][ T9154] ipc_init_ids+0x99/0x280 [ 129.282210][ T9154] copy_ipcs+0x5c0/0x7e0 [ 129.282234][ T9154] create_new_namespaces+0x20a/0xac0 [ 129.282259][ T9154] ? security_capable+0x80/0x260 [ 129.282295][ T9154] unshare_nsproxy_namespaces+0xf2/0x220 [ 129.282323][ T9154] ksys_unshare+0x4a2/0xa70 [ 129.282349][ T9154] ? __pfx_ksys_unshare+0x10/0x10 [ 129.282382][ T9154] __x64_sys_unshare+0x31/0x40 [ 129.282405][ T9154] do_syscall_64+0x123/0x790 [ 129.282434][ T9154] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.282454][ T9154] RIP: 0033:0x7f0e6b39e159 [ 129.282471][ T9154] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.282490][ T9154] RSP: 002b:00007f0e6c285028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 129.282513][ T9154] RAX: ffffffffffffffda RBX: 00007f0e6b625fa0 RCX: 00007f0e6b39e159 [ 129.282527][ T9154] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000004a000200 [ 129.282540][ T9154] RBP: 00007f0e6b43503b R08: 0000000000000000 R09: 0000000000000000 [ 129.282553][ T9154] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 129.282564][ T9154] R13: 00007f0e6b626038 R14: 00007f0e6b625fa0 R15: 00007ffe6c97a348 [ 129.282593][ T9154] [ 129.708359][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 129.961124][ T45] audit: type=1400 audit(1789265631.871:574): avc: denied { watch watch_reads } for pid=9157 comm="syz.3.1375" path="/481" dev="tmpfs" ino=2548 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 129.996679][ T9158] overlayfs: failed to clone upperpath [ 130.211453][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 130.733026][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 131.240539][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 131.751475][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 131.817265][ T9178] orangefs_devreq_open: device cannot be opened in blocking mode [ 131.819764][ T45] audit: type=1400 audit(1789265633.731:575): avc: denied { read } for pid=9175 comm="syz.0.1380" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 131.819823][ T45] audit: type=1400 audit(1789265633.731:576): avc: denied { open } for pid=9175 comm="syz.0.1380" path="/288/file0/file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 132.080723][ C1] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:17 [ 132.126701][ T9192] input: syz1 as /devices/virtual/input/input15 [ 132.244498][ T9194] fuse: fd is not a fuse device [ 132.250189][ T45] audit: type=1400 audit(1789265634.151:577): avc: denied { mmap_zero } for pid=9193 comm="syz.3.1387" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 132.264831][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 132.333477][ T45] audit: type=1400 audit(1789265634.241:578): avc: denied { read } for pid=9199 comm="syz.0.1388" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 132.333812][ T45] audit: type=1400 audit(1789265634.241:579): avc: denied { open } for pid=9199 comm="syz.0.1388" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 132.424779][ T45] audit: type=1326 audit(1789265634.331:580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9202 comm="syz.3.1390" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb0a2f9e159 code=0x7ffc0000 [ 132.424865][ T45] audit: type=1326 audit(1789265634.331:581): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9202 comm="syz.3.1390" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb0a2f9e159 code=0x7ffc0000 [ 132.425042][ T45] audit: type=1326 audit(1789265634.331:582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9202 comm="syz.3.1390" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb0a2f9e159 code=0x7ffc0000 [ 132.511397][ T9208] overlayfs: failed to resolve './cgroup': -2 [ 132.631117][ T9214] overlayfs: upper fs does not support file handles, falling back to index=off. [ 132.770575][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 132.974092][ T9229] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 132.983302][ T9229] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 133.258213][ T9231] VFS: Mount too revealing [ 133.283764][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 133.364529][ T1442] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.364579][ T1442] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.653450][ T123] IPVS: starting estimator thread 0... [ 133.743918][ T9245] IPVS: using max 40 ests per chain, 96000 per kthread [ 133.793109][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 134.062761][ T45] kauditd_printk_skb: 13 callbacks suppressed [ 134.062782][ T45] audit: type=1400 audit(1789265635.971:596): avc: denied { write } for pid=9250 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 134.140864][ T45] audit: type=1400 audit(1789265636.051:597): avc: denied { write } for pid=9253 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 134.300504][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 134.810946][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 134.940200][ T9276] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 134.940220][ T9276] syzkaller0: Linktype set failed because interface is up [ 135.330502][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 135.377721][ T9292] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1424'. [ 135.672188][ T45] audit: type=1400 audit(1789265637.581:598): avc: denied { write } for pid=9305 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 135.731800][ T45] audit: type=1400 audit(1789265637.641:599): avc: denied { write } for pid=9310 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 135.773649][ T9315] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 135.935219][ T9325] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1433'. [ 135.983381][ T9283] nvme nvme0: failed to connect socket: -512 [ 136.149291][ T45] audit: type=1400 audit(1789265638.051:600): avc: denied { relabelfrom } for pid=9336 comm="syz.1.1438" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 136.149511][ T45] audit: type=1400 audit(1789265638.051:601): avc: denied { relabelto } for pid=9336 comm="syz.1.1438" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 136.211243][ T9337] syzkaller0: create flow: hash 1930008922 index 1 [ 136.251108][ T9336] syzkaller0: delete flow: hash 1930008922 index 1 [ 136.352095][ T13] net_ratelimit: 1 callbacks suppressed [ 136.352116][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 136.860465][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 137.010682][ T9350] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1443'. [ 137.099113][ T9355] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1444'. [ 137.151053][ T9356] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1444'. [ 137.374857][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 137.886099][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 138.390614][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 138.455001][ T45] audit: type=1400 audit(1789265640.361:602): avc: denied { write } for pid=9358 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 138.509513][ T9366] fuse: fd is not a fuse device [ 138.527909][ T9364] tipc: Enabled bearer , priority 0 [ 138.555579][ T45] audit: type=1400 audit(1789265640.461:603): avc: denied { write } for pid=9367 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 138.579850][ T9364] syzkaller0: entered promiscuous mode [ 138.579950][ T9364] syzkaller0: entered allmulticast mode [ 138.580511][ T9364] tipc: Resetting bearer [ 138.588202][ T9372] fuse: fd is not a fuse device [ 138.662220][ T9363] tipc: Resetting bearer [ 138.717699][ T45] audit: type=1400 audit(1789265640.621:604): avc: denied { write } for pid=9381 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 138.792255][ T45] audit: type=1400 audit(1789265640.691:605): avc: denied { write } for pid=9386 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 138.900600][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 139.045316][ T2321] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 139.117597][ T9400] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1455'. [ 139.203815][ T2321] usb 7-1: Using ep0 maxpacket: 16 [ 139.204689][ T2321] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 139.206146][ T2321] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 139.208354][ T2321] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.208374][ T2321] usb 7-1: Product: syz [ 139.208386][ T2321] usb 7-1: Manufacturer: syz [ 139.208397][ T2321] usb 7-1: SerialNumber: syz [ 139.211001][ T2321] usb 7-1: config 0 descriptor?? [ 139.225912][ T2321] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 139.225937][ T2321] em28xx 7-1:0.0: DVB interface 0 found: bulk [ 139.410898][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 139.828340][ T2321] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 139.920627][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 140.287555][ T2321] em28xx 7-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 140.300972][ T2321] em28xx 7-1:0.0: board has no eeprom [ 140.440379][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 140.882456][ T9363] tipc: Disabling bearer [ 140.899532][ T9375] syzkaller1: entered promiscuous mode [ 140.899606][ T9375] syzkaller1: entered allmulticast mode [ 140.957095][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 140.988393][ T9] tipc: Node number set to 65535 [ 141.217065][ T45] audit: type=1400 audit(1789265643.101:606): avc: denied { write } for pid=9411 comm="syz.1.1459" name="/" dev="9p" ino=73941781 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 141.365861][ T9389] em28xx 7-1:0.0: reading from i2c device at 0x0 failed (error=-5) [ 141.424132][ T2321] em28xx 7-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 141.424162][ T2321] em28xx 7-1:0.0: dvb set to bulk mode. [ 141.425255][ T35] em28xx 7-1:0.0: Binding DVB extension [ 141.452332][ T2321] usb 7-1: USB disconnect, device number 10 [ 141.453949][ T2321] em28xx 7-1:0.0: Disconnecting em28xx [ 141.460835][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 141.489230][ T35] em28xx 7-1:0.0: Registering input extension [ 141.489624][ T2321] em28xx 7-1:0.0: Closing input extension [ 141.547049][ T2321] em28xx: Freeing device [ 141.970536][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 142.083785][ T9437] warning: `syz.0.1469' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 142.351343][ T9452] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1475'. [ 142.461397][ T9457] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=9457 comm=syz.3.1475 [ 142.471862][ T9451] FAULT_INJECTION: forcing a failure. [ 142.471862][ T9451] name failslab, interval 1, probability 0, space 0, times 0 [ 142.471893][ T9451] CPU: 3 UID: 0 PID: 9451 Comm: syz.2.1474 Not tainted syzkaller #0 PREEMPT(full) [ 142.471913][ T9451] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 142.471924][ T9451] Call Trace: [ 142.471954][ T9451] [ 142.471963][ T9451] dump_stack_lvl+0x100/0x190 [ 142.472008][ T9451] should_fail_ex.cold+0x5/0xa [ 142.472037][ T9451] should_failslab+0xc2/0x120 [ 142.472065][ T9451] __kmalloc_noprof+0xfc/0x840 [ 142.472084][ T9451] ? tcf_idr_create+0x62/0x880 [ 142.472113][ T9451] tcf_idr_create+0x62/0x880 [ 142.472131][ T9451] ? tcf_idr_check_alloc+0xb1/0x7a0 [ 142.472150][ T9451] ? tcf_gate_init+0xe1/0x2d10 [ 142.472172][ T9451] tcf_idr_create_from_flags+0x4f/0x70 [ 142.472193][ T9451] tcf_gate_init+0x4b8/0x2d10 [ 142.472222][ T9451] ? __pfx_tcf_gate_init+0x10/0x10 [ 142.472248][ T9451] ? __pfx___nla_validate_parse+0x10/0x10 [ 142.472282][ T9451] ? __nla_parse+0x40/0x60 [ 142.472307][ T9451] tcf_action_init_1+0x466/0x6c0 [ 142.472330][ T9451] ? __pfx_tcf_action_init_1+0x10/0x10 [ 142.472347][ T9451] ? tc_action_load_ops+0x1f5/0x3e0 [ 142.472366][ T9451] ? __pfx_tc_action_load_ops+0x10/0x10 [ 142.472395][ T9451] ? __nla_parse+0x40/0x60 [ 142.472420][ T9451] tcf_action_init+0x43f/0xa60 [ 142.472447][ T9451] ? __pfx_tcf_action_init+0x10/0x10 [ 142.472507][ T9451] ? __lock_acquire+0x5c0/0x1f40 [ 142.472529][ T9451] tcf_action_add+0xed/0x5c0 [ 142.472557][ T9451] ? __pfx_tcf_action_add+0x10/0x10 [ 142.472621][ T9451] ? __nla_parse+0x40/0x60 [ 142.472660][ T9451] tc_ctl_action+0x2e3/0x470 [ 142.472689][ T9451] ? __pfx_tc_ctl_action+0x10/0x10 [ 142.472730][ T9451] ? __pfx_tc_ctl_action+0x10/0x10 [ 142.472759][ T9451] rtnetlink_rcv_msg+0x3c9/0xe90 [ 142.472794][ T9451] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 142.472835][ T9451] ? ref_tracker_free+0x37e/0x6c0 [ 142.472869][ T9451] netlink_rcv_skb+0x159/0x420 [ 142.472893][ T9451] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 142.472928][ T9451] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 142.472954][ T9451] ? netlink_deliver_tap+0x1ae/0xcc0 [ 142.472976][ T9451] netlink_unicast+0x585/0x850 [ 142.472998][ T9451] ? __pfx_netlink_unicast+0x10/0x10 [ 142.473022][ T9451] netlink_sendmsg+0x8b0/0xda0 [ 142.473054][ T9451] ? __pfx_netlink_sendmsg+0x10/0x10 [ 142.473075][ T9451] ? selinux_socket_sendmsg+0x198/0x2f0 [ 142.473098][ T9451] ____sys_sendmsg+0xa4d/0xbe0 [ 142.473120][ T9451] ? __pfx_netlink_sendmsg+0x10/0x10 [ 142.473140][ T9451] ? __pfx_____sys_sendmsg+0x10/0x10 [ 142.473179][ T9451] ___sys_sendmsg+0x190/0x1e0 [ 142.473206][ T9451] ? __pfx____sys_sendmsg+0x10/0x10 [ 142.473229][ T9451] ? futex_wait+0x11e/0x370 [ 142.473252][ T9451] ? find_held_lock+0x2b/0x80 [ 142.473286][ T9451] __sys_sendmsg+0x160/0x210 [ 142.473304][ T9451] ? __pfx___sys_sendmsg+0x10/0x10 [ 142.473337][ T9451] do_syscall_64+0x123/0x790 [ 142.473370][ T9451] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.473388][ T9451] RIP: 0033:0x7f0e6b39e159 [ 142.473403][ T9451] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 142.473419][ T9451] RSP: 002b:00007f0e6c285028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 142.473437][ T9451] RAX: ffffffffffffffda RBX: 00007f0e6b625fa0 RCX: 00007f0e6b39e159 [ 142.473448][ T9451] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 142.473457][ T9451] RBP: 00007f0e6b43503b R08: 0000000000000000 R09: 0000000000000000 [ 142.473466][ T9451] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 142.473475][ T9451] R13: 00007f0e6b626038 R14: 00007f0e6b625fa0 R15: 00007ffe6c97a348 [ 142.473498][ T9451] [ 142.490467][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 142.894934][ T9469] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.012137][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 143.039962][ T9476] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1482'. [ 143.094765][ T9469] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 143.112999][ T9469] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 143.149286][ T9481] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1482'. [ 143.393643][ T9469] gre1: left promiscuous mode [ 143.393667][ T9469] gre1: left allmulticast mode [ 143.445174][ T5547] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.445272][ T12] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.460361][ T12] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.561261][ T12] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.563321][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 143.641066][ T555] IPVS: starting estimator thread 0... [ 143.661385][ T9496] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 143.743791][ T9498] IPVS: using max 39 ests per chain, 93600 per kthread [ 143.864869][ T45] audit: type=1400 audit(1789265645.771:607): avc: denied { watch } for pid=9504 comm="syz.3.1488" path="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 143.865101][ T45] audit: type=1400 audit(1789265645.771:608): avc: denied { watch_sb watch_reads } for pid=9504 comm="syz.3.1488" path="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 144.070485][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 144.590964][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 144.892598][ T9532] Illegal XDP return value 4294967274 on prog (id 94) dev syzkaller1, expect packet loss! [ 144.973715][ T9526] i2c i2c-0: new_device: Instantiated device rt1719 at 0x04 [ 145.093843][ T9536] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1498'. [ 145.110007][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 145.176041][ T9539] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1498'. [ 145.610493][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 145.992880][ T9541] EXT4-fs warning (device sda1): ext4_group_extend:1869: need to use ext2online to resize further [ 146.657460][ T5547] net_ratelimit: 1 callbacks suppressed [ 146.657478][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 146.822749][ T9553] syzkaller0: entered promiscuous mode [ 146.822772][ T9553] syzkaller0: entered allmulticast mode [ 146.832229][ T9553] tipc: Started in network mode [ 146.832258][ T9553] tipc: Node identity ba79b9328a34, cluster identity 4711 [ 146.832450][ T9553] tipc: Enabled bearer , priority 0 [ 146.833916][ T9552] tipc: Resetting bearer [ 146.887516][ T9552] tipc: Disabling bearer [ 147.160618][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 147.403638][ T9561] syzkaller1: entered promiscuous mode [ 147.403663][ T9561] syzkaller1: entered allmulticast mode [ 147.454662][ T9561] 0: reclassify loop, rule prio 0, protocol 03 [ 147.670487][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 147.686913][ T45] audit: type=1400 audit(1789265649.591:609): avc: denied { name_bind } for pid=9564 comm="syz.3.1510" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 148.169972][ T45] audit: type=1400 audit(1789265650.071:610): avc: denied { name_bind } for pid=9578 comm="syz.3.1514" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 148.180911][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 148.410408][ T5812] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 148.508804][ T45] audit: type=1800 audit(1789265650.411:611): pid=9587 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.1516" name="syzkaller0" dev="sda1" ino=2041 res=0 errno=0 [ 148.570896][ T5812] usb 5-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 148.571894][ T5812] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 148.571920][ T5812] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 148.571958][ T5812] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 148.616167][ T5812] idmouse 5-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 148.691008][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 148.778575][ T9595] fuse: fd is not a fuse device [ 148.964478][ T9600] netlink: 'syz.3.1523': attribute type 39 has an invalid length. [ 149.200444][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 149.523168][ T45] audit: type=1400 audit(1789265651.431:612): avc: denied { read write } for pid=9576 comm="syz.0.1513" name="idmouse0" dev="devtmpfs" ino=2994 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 149.523438][ T45] audit: type=1400 audit(1789265651.431:613): avc: denied { open } for pid=9576 comm="syz.0.1513" path="/dev/idmouse0" dev="devtmpfs" ino=2994 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 149.711209][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 150.220430][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 150.421818][ T35] usb 5-1: USB disconnect, device number 8 [ 150.424341][ T35] idmouse 5-1:1.0: disconnected [ 150.658605][ T45] audit: type=1400 audit(1789265652.561:614): avc: denied { bind } for pid=9622 comm="syz.1.1530" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 150.676589][ T45] audit: type=1400 audit(1789265652.581:615): avc: denied { accept } for pid=9622 comm="syz.1.1530" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 150.749374][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 151.333102][ T9638] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 151.391939][ T9638] kvm: pic: non byte read [ 151.395709][ T9638] kvm: pic: level sensitive irq not supported [ 151.396330][ T9638] kvm: pic: non byte read [ 151.398924][ T9638] kvm: pic: level sensitive irq not supported [ 151.400099][ T9638] kvm: pic: non byte read [ 151.674488][ T45] audit: type=1400 audit(1789265653.581:616): avc: denied { write } for pid=9645 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 151.746607][ T45] audit: type=1400 audit(1789265653.651:617): avc: denied { write } for pid=9652 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 151.783695][ T5547] net_ratelimit: 1 callbacks suppressed [ 151.783713][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 151.905835][ T45] audit: type=1400 audit(1789265653.811:618): avc: denied { write } for pid=9656 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 152.291385][ T9670] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 152.306034][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 152.423706][ T9677] binder: BINDER_SET_CONTEXT_MGR already set [ 152.423719][ T9677] binder: 9675:9677 ioctl 4018620d 200000004a80 returned -16 [ 152.786388][ T9691] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1552'. [ 152.786426][ T9691] netlink: 'syz.0.1552': attribute type 7 has an invalid length. [ 152.786438][ T9691] netlink: 'syz.0.1552': attribute type 8 has an invalid length. [ 152.786449][ T9691] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1552'. [ 152.793268][ T9691] syz_tun: entered promiscuous mode [ 152.809480][ T9691] syz_tun: left promiscuous mode [ 152.814586][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 153.321152][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 153.356858][ T9702] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 153.356886][ T9702] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 153.358384][ T9702] vhci_hcd vhci_hcd.0: Device attached [ 153.521035][ T5832] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 153.580355][ T5832] usb 39-1: new high-speed USB device number 2 using vhci_hcd [ 153.610362][ T9485] usb 6-1: new low-speed USB device number 6 using dummy_hcd [ 153.757184][ T9710] jffs2: notice: (9710) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 153.771081][ T9485] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 153.771630][ T9485] usb 6-1: config 0 has no interfaces? [ 153.771653][ T9485] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 153.773280][ T9485] usb 6-1: config 0 descriptor?? [ 153.830574][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 153.985455][ T9703] usb 39-1: recv xbuf, 0 [ 153.989177][ T12] vhci_hcd vhci_hcd.1: stop threads [ 153.989198][ T12] vhci_hcd vhci_hcd.1: release socket [ 153.994557][ T9485] usb 6-1: USB disconnect, device number 6 [ 154.002457][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 154.068325][ T5832] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 154.193460][ T9731] FAULT_INJECTION: forcing a failure. [ 154.193460][ T9731] name failslab, interval 1, probability 0, space 0, times 0 [ 154.195703][ T9731] CPU: 1 UID: 0 PID: 9731 Comm: syz.2.1563 Not tainted syzkaller #0 PREEMPT(full) [ 154.195726][ T9731] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 154.195736][ T9731] Call Trace: [ 154.195743][ T9731] [ 154.195751][ T9731] dump_stack_lvl+0x100/0x190 [ 154.195795][ T9731] should_fail_ex.cold+0x5/0xa [ 154.195820][ T9731] should_failslab+0xc2/0x120 [ 154.195849][ T9731] __kmalloc_cache_noprof+0x91/0x6d0 [ 154.195875][ T9731] ? lockdep_init_map_type+0x5c/0x250 [ 154.195896][ T9731] ? nci_hci_allocate+0x45/0x330 [ 154.195930][ T9731] nci_hci_allocate+0x45/0x330 [ 154.195953][ T9731] nci_allocate_device+0x26f/0x410 [ 154.195974][ T9731] virtual_ncidev_open+0x6f/0x220 [ 154.196001][ T9731] ? __pfx_virtual_ncidev_open+0x10/0x10 [ 154.196026][ T9731] misc_open+0x26d/0x450 [ 154.196044][ T9731] ? __pfx_misc_open+0x10/0x10 [ 154.196060][ T9731] chrdev_open+0x234/0x6a0 [ 154.196084][ T9731] ? __pfx_chrdev_open+0x10/0x10 [ 154.196107][ T9731] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 154.196138][ T9731] do_dentry_open+0x6ab/0x14d0 [ 154.196156][ T9731] ? __pfx_chrdev_open+0x10/0x10 [ 154.196190][ T9731] vfs_open+0x82/0x3f0 [ 154.196218][ T9731] path_openat+0x19fa/0x2440 [ 154.196244][ T9731] ? __pfx_path_openat+0x10/0x10 [ 154.196272][ T9731] do_file_open+0x20e/0x430 [ 154.196293][ T9731] ? __pfx_do_file_open+0x10/0x10 [ 154.196331][ T9731] ? _raw_spin_unlock+0x28/0x50 [ 154.196353][ T9731] ? alloc_fd+0x471/0x7a0 [ 154.196543][ T9731] do_sys_openat2+0x10f/0x1e0 [ 154.196577][ T9731] ? __pfx_do_sys_openat2+0x10/0x10 [ 154.196609][ T9731] __x64_sys_openat+0x12d/0x210 [ 154.196633][ T9731] ? __pfx___x64_sys_openat+0x10/0x10 [ 154.196656][ T9731] ? selinux_file_ioctl+0xb6/0x290 [ 154.196683][ T9731] do_syscall_64+0x123/0x790 [ 154.196709][ T9731] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.196728][ T9731] RIP: 0033:0x7f0e6b39e159 [ 154.196743][ T9731] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 154.196761][ T9731] RSP: 002b:00007f0e6c285028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 154.196780][ T9731] RAX: ffffffffffffffda RBX: 00007f0e6b625fa0 RCX: 00007f0e6b39e159 [ 154.196792][ T9731] RDX: 0000000000000002 RSI: 0000200000000240 RDI: ffffffffffffff9c [ 154.196803][ T9731] RBP: 00007f0e6b43503b R08: 0000000000000000 R09: 0000000000000000 [ 154.196813][ T9731] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 154.196823][ T9731] R13: 00007f0e6b626038 R14: 00007f0e6b625fa0 R15: 00007ffe6c97a348 [ 154.196848][ T9731] [ 154.356981][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 154.459326][ T45] kauditd_printk_skb: 1 callbacks suppressed [ 154.459345][ T45] audit: type=1400 audit(1789265656.371:620): avc: denied { append } for pid=9739 comm="syz.0.1566" name="random" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 154.698784][ T9755] syzkaller0: entered promiscuous mode [ 154.698806][ T9755] syzkaller0: entered allmulticast mode [ 154.871207][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 155.380442][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 155.736902][ T9766] syzkaller0: entered promiscuous mode [ 155.736921][ T9766] syzkaller0: entered allmulticast mode [ 155.902746][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 156.383969][ T9779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 156.395220][ T9779] 8021q: adding VLAN 0 to HW filter on device team0 [ 156.421777][ T5547] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 156.431084][ T9779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 156.716409][ T9779] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 156.716437][ T9779] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 156.735842][ T9779] veth1_vlan: left promiscuous mode [ 156.738365][ T9779] veth0_vlan: left promiscuous mode [ 156.745879][ T9779] veth0_vlan: entered promiscuous mode [ 156.751048][ T9779] veth1_vlan: entered promiscuous mode [ 156.762703][ T9779] veth1_macvtap: left promiscuous mode [ 156.798615][ T9779] veth0_macvtap: left promiscuous mode [ 156.799825][ T9779] veth0_macvtap: entered promiscuous mode [ 156.805221][ T9779] veth1_macvtap: entered promiscuous mode [ 156.831691][ T9779] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 156.844812][ T9779] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 156.846291][ T9779] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 156.847657][ T9779] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 156.879940][ T9785] syz.3.1582 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 156.941113][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 157.008715][ T5810] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.008757][ T5810] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.008787][ T5810] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.008816][ T5810] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.450549][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 157.971235][ T5810] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 158.090425][ T35] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 158.260524][ T35] usb 5-1: Using ep0 maxpacket: 16 [ 158.261279][ T35] usb 5-1: New USB device found, idVendor=0644, idProduct=8021, bcdDevice= 0.40 [ 158.261814][ T35] usb 5-1: config 0 has no interfaces? [ 158.263854][ T35] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.263874][ T35] usb 5-1: Product: syz [ 158.263888][ T35] usb 5-1: Manufacturer: syz [ 158.263899][ T35] usb 5-1: SerialNumber: syz [ 158.271576][ T35] usb 5-1: config 0 descriptor?? [ 158.358792][ T9792] syz.2.1585 (9792): drop_caches: 2 [ 158.500852][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 158.746045][ T9807] kvm: pic: single mode not supported [ 158.746060][ T9807] kvm: pic: level sensitive irq not supported [ 158.747469][ T9807] kvm: pic: single mode not supported [ 158.747482][ T9807] kvm: pic: level sensitive irq not supported [ 158.748900][ T9807] kvm: pic: single mode not supported [ 158.748912][ T9807] kvm: pic: level sensitive irq not supported [ 158.754940][ T9807] kvm: pic: single mode not supported [ 158.754975][ T9807] kvm: pic: level sensitive irq not supported [ 158.759772][ T9807] kvm: pic: single mode not supported [ 158.762659][ T9807] kvm: pic: level sensitive irq not supported [ 158.763094][ T9807] kvm: pic: level sensitive irq not supported [ 158.965737][ T9] usb 5-1: USB disconnect, device number 9 [ 159.010403][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 159.027123][ T9813] syzkaller0: entered promiscuous mode [ 159.027143][ T9813] syzkaller0: entered allmulticast mode [ 159.073016][ T9817] zram: Cannot change disksize for initialized device [ 159.076319][ T9817] block2mtd: error: cannot open device /dev/zram0 [ 159.076797][ T45] audit: type=1400 audit(1789265660.981:621): avc: denied { read write } for pid=9816 comm="syz.1.1593" name="mtd1" dev="devtmpfs" ino=2855 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 159.077245][ T45] audit: type=1400 audit(1789265660.981:622): avc: denied { open } for pid=9816 comm="syz.1.1593" path="/dev/mtd1" dev="devtmpfs" ino=2855 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 159.129373][ T45] audit: type=1400 audit(1789265661.031:623): avc: denied { ioctl } for pid=9816 comm="syz.1.1593" path="/dev/mtd1" dev="devtmpfs" ino=2855 ioctlcmd=0x4d14 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 159.520538][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 159.947823][ T9827] syzkaller0: entered promiscuous mode [ 159.947851][ T9827] syzkaller0: entered allmulticast mode [ 160.030384][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 160.778765][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 161.102582][ T9853] FAULT_INJECTION: forcing a failure. [ 161.102582][ T9853] name failslab, interval 1, probability 0, space 0, times 0 [ 161.102621][ T9853] CPU: 0 UID: 0 PID: 9853 Comm: syz.1.1600 Not tainted syzkaller #0 PREEMPT(full) [ 161.102648][ T9853] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 161.102661][ T9853] Call Trace: [ 161.102670][ T9853] [ 161.102680][ T9853] dump_stack_lvl+0x100/0x190 [ 161.102718][ T9853] should_fail_ex.cold+0x5/0xa [ 161.102753][ T9853] should_failslab+0xc2/0x120 [ 161.102783][ T9853] __kmalloc_noprof+0xfc/0x840 [ 161.102811][ T9853] ? bpf_prepare_filter+0x77c/0x11e0 [ 161.102864][ T9853] bpf_prepare_filter+0x77c/0x11e0 [ 161.102904][ T9853] ? __pfx_bpf_prepare_filter+0x10/0x10 [ 161.102937][ T9853] ? __asan_memcpy+0x3c/0x60 [ 161.102959][ T9853] ? kmemdup_noprof+0x49/0x60 [ 161.102998][ T9853] __get_filter+0x1ff/0x2c0 [ 161.103032][ T9853] sk_attach_filter+0x1c/0x150 [ 161.103064][ T9853] sk_setsockopt+0x3a9b/0x5d80 [ 161.103110][ T9853] ? __pfx_sk_setsockopt+0x10/0x10 [ 161.103143][ T9853] ? selinux_netlbl_socket_setsockopt+0x134/0x470 [ 161.103176][ T9853] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 161.103216][ T9853] ? find_held_lock+0x2b/0x80 [ 161.103277][ T9853] ? selinux_socket_setsockopt+0x6a/0x80 [ 161.103310][ T9853] do_sock_setsockopt+0x193/0x1d0 [ 161.103348][ T9853] __sys_setsockopt+0x195/0x220 [ 161.103380][ T9853] __x64_sys_setsockopt+0xbd/0x160 [ 161.103433][ T9853] ? do_syscall_64+0xae/0x790 [ 161.103471][ T9853] ? lockdep_hardirqs_on+0x7d/0x110 [ 161.103503][ T9853] do_syscall_64+0x123/0x790 [ 161.103536][ T9853] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.103561][ T9853] RIP: 0033:0x7fd3bbd9e159 [ 161.103582][ T9853] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 161.103603][ T9853] RSP: 002b:00007fd3bcd21028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 161.103627][ T9853] RAX: ffffffffffffffda RBX: 00007fd3bc026090 RCX: 00007fd3bbd9e159 [ 161.103641][ T9853] RDX: 000000000000001a RSI: 0000000000000001 RDI: 0000000000000004 [ 161.103655][ T9853] RBP: 00007fd3bbe3503b R08: 0000000000000010 R09: 0000000000000000 [ 161.103669][ T9853] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 161.103682][ T9853] R13: 00007fd3bc026128 R14: 00007fd3bc026090 R15: 00007fffaa6b0c08 [ 161.103713][ T9853] [ 161.292004][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 161.810553][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 162.191914][ T45] audit: type=1400 audit(1789265664.101:624): avc: denied { setopt } for pid=9862 comm="syz.1.1603" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 162.228204][ T9863] FAULT_INJECTION: forcing a failure. [ 162.228204][ T9863] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 162.228314][ T9863] CPU: 0 UID: 0 PID: 9863 Comm: syz.1.1603 Not tainted syzkaller #0 PREEMPT(full) [ 162.228341][ T9863] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 162.228354][ T9863] Call Trace: [ 162.228362][ T9863] [ 162.228370][ T9863] dump_stack_lvl+0x100/0x190 [ 162.228427][ T9863] should_fail_ex.cold+0x5/0xa [ 162.228453][ T9863] _copy_to_user+0x32/0xd0 [ 162.228475][ T9863] dma_heap_ioctl+0x458/0x6d0 [ 162.228502][ T9863] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 162.228532][ T9863] ? selinux_file_ioctl+0x13b/0x290 [ 162.228554][ T9863] ? selinux_file_ioctl+0xb6/0x290 [ 162.228578][ T9863] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 162.228617][ T9863] __x64_sys_ioctl+0x18e/0x210 [ 162.228646][ T9863] do_syscall_64+0x123/0x790 [ 162.228677][ T9863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.228699][ T9863] RIP: 0033:0x7fd3bbd9e159 [ 162.228716][ T9863] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 162.228736][ T9863] RSP: 002b:00007fd3bcd42028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 162.228756][ T9863] RAX: ffffffffffffffda RBX: 00007fd3bc025fa0 RCX: 00007fd3bbd9e159 [ 162.228768][ T9863] RDX: 0000200000000100 RSI: 00000000c0184800 RDI: 0000000000000004 [ 162.228780][ T9863] RBP: 00007fd3bbe3503b R08: 0000000000000000 R09: 0000000000000000 [ 162.228791][ T9863] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 162.228802][ T9863] R13: 00007fd3bc026038 R14: 00007fd3bc025fa0 R15: 00007fffaa6b0c08 [ 162.228828][ T9863] [ 162.323735][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 162.840474][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 163.357305][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 163.872002][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 164.390782][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 164.900632][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 165.282419][ T45] audit: type=1400 audit(1789265667.191:625): avc: denied { bind } for pid=9892 comm="syz.0.1608" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 165.282958][ T45] audit: type=1400 audit(1789265667.191:626): avc: denied { name_bind } for pid=9892 comm="syz.0.1608" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 165.283227][ T45] audit: type=1400 audit(1789265667.191:627): avc: denied { node_bind } for pid=9892 comm="syz.0.1608" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 165.378795][ T45] audit: type=1400 audit(1789265667.281:628): avc: denied { write } for pid=9896 comm="syz.2.1610" name="target" dev="configfs" ino=6211 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 165.394783][ T45] audit: type=1400 audit(1789265667.291:629): avc: denied { write } for pid=9896 comm="syz.2.1610" name="usb_gadget" dev="configfs" ino=31271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 165.397523][ T45] audit: type=1400 audit(1789265667.301:630): avc: denied { write } for pid=9896 comm="syz.2.1610" name="naa.1234567890abcdef" dev="configfs" ino=31273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 165.416858][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 165.736952][ T45] audit: type=1400 audit(1789265667.641:631): avc: denied { map } for pid=9904 comm="syz.0.1614" path="/dev/ublkc0" dev="devtmpfs" ino=3002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 165.917413][ T9912] syzkaller0: entered promiscuous mode [ 165.917435][ T9912] syzkaller0: entered allmulticast mode [ 165.921218][ T9912] 0: reclassify loop, rule prio 0, protocol 700 [ 165.943066][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 166.440741][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 166.584601][ T45] audit: type=1400 audit(1789265668.491:632): avc: denied { ioctl } for pid=9944 comm="syz.3.1626" path="socket:[32611]" dev="sockfs" ino=32611 ioctlcmd=0x8904 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 166.809294][ T9951] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1629'. [ 167.071579][ T9] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 167.220785][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 167.221521][ T9] usb 6-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 167.223271][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 128, changing to 11 [ 167.223299][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 167.223322][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 167.226005][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.226029][ T9] usb 6-1: Product: syz [ 167.226041][ T9] usb 6-1: Manufacturer: syz [ 167.226054][ T9] usb 6-1: SerialNumber: syz [ 167.259629][ T9] usb 6-1: config 0 descriptor?? [ 167.305717][ T9] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.0/input/input17 [ 167.324420][ T5127] xpad 6-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 167.426709][ T5127] xpad 6-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 167.439048][ T5127] xpad 6-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 167.461411][ T13] net_ratelimit: 1 callbacks suppressed [ 167.461431][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 167.478291][ T58] usb 6-1: USB disconnect, device number 7 [ 167.945782][ T9994] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 167.967931][ T9994] xfrm0: left allmulticast mode [ 167.974882][ T9994] xfrm0: entered allmulticast mode [ 167.976310][ T9994] team0: Port device xfrm0 added [ 167.980946][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 167.985881][ T9994] tipc: Enabled bearer , priority 0 [ 168.272873][ T45] audit: type=1400 audit(1789265670.181:633): avc: denied { getopt } for pid=10008 comm="syz.3.1647" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 168.282884][ T45] audit: type=1400 audit(1789265670.191:634): avc: denied { ioctl } for pid=10008 comm="syz.3.1647" path="socket:[30417]" dev="sockfs" ino=30417 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 168.490846][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 168.543241][T10019] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1651'. [ 168.544116][T10019] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1651'. [ 168.942724][ T45] audit: type=1400 audit(1789265670.851:635): avc: denied { write } for pid=10038 comm="syz.1.1657" name="functions" dev="configfs" ino=13541 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 168.979522][ T45] audit: type=1400 audit(1789265670.871:636): avc: denied { write } for pid=10038 comm="syz.1.1657" name="uncompressed" dev="configfs" ino=32898 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 168.994342][ T45] audit: type=1400 audit(1789265670.901:637): avc: denied { write } for pid=10038 comm="syz.1.1657" name="u" dev="configfs" ino=33935 scontext=root:sysa ** replaying previous printk message ** [ 168.994342][ T45] audit: type=1400 audit(1789265670.901:637): avc: denied { write } for pid=10038 comm="syz.1.1657" name="u" dev="configfs" ino=33935 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 168.996156][ T45] audit: type=1400 audit(1789265670.901:638): avc: denied { write } for pid=10038 comm="syz.1.1657" name="header" dev="configfs" ino=32897 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 168.998854][ T45] audit: type=1400 audit(1789265670.901:639): avc: denied { write } for pid=10038 comm="syz.1.1657" name="h" dev="configfs" ino=33937 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 168.999292][ T45] audit: type=1400 audit(1789265670.901:640): avc: denied { create } for pid=10038 comm="syz.1.1657" name="u" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 169.007635][ T45] audit: type=1400 audit(1789265670.911:641): avc: denied { write } for pid=10038 comm="syz.1.1657" name="h" dev="configfs" ino=33937 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 169.007635][T10039] [ 169.060366][T10039] ====================================================== [ 169.061500][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 169.069435][T10039] WARNING: possible circular locking dependency detected [ 169.072931][T10039] syzkaller #0 Not tainted [ 169.075824][T10039] ------------------------------------------------------ [ 169.079114][T10039] syz.1.1657/10039 is trying to acquire lock: [ 169.081922][T10039] ffffffff903fc9e8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_streaming_header_allow_link+0x7c/0x650 [ 169.086811][T10039] [ 169.086811][T10039] but task is already holding lock: [ 169.090150][T10039] ffff88803b99b580 (&sb->s_type->i_mutex_key#30){+.+.}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 169.096487][T10039] [ 169.096487][T10039] which lock already depends on the new lock. [ 169.096487][T10039] [ 169.102062][T10039] [ 169.102062][T10039] the existing dependency chain (in reverse order) is: [ 169.106030][T10039] [ 169.106030][T10039] -> #3 (&sb->s_type->i_mutex_key#30){+.+.}-{4:4}: [ 169.109718][T10039] lock_acquire+0x1d1/0x380 [ 169.111903][T10039] down_write+0x8b/0x1f0 [ 169.114131][T10039] configfs_depend_item_unlocked+0xf3/0x6a0 [ 169.117107][T10039] usbg_make_tpg+0x251/0x610 [ 169.119393][T10039] target_fabric_make_tpg+0xab/0x8c0 [ 169.122361][T10039] configfs_mkdir+0x525/0xd40 [ 169.125368][T10039] vfs_mkdir+0x364/0x850 [ 169.127837][T10039] filename_mkdirat+0x48b/0x5e0 [ 169.130163][T10039] __x64_sys_mkdir+0x6b/0x90 [ 169.132460][T10039] do_syscall_64+0x123/0x790 [ 169.134644][T10039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 169.137559][T10039] [ 169.137559][T10039] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 169.141112][T10039] lock_acquire+0x1d1/0x380 [ 169.143125][T10039] __mutex_lock+0x1a4/0x1bd0 [ 169.145642][T10039] tcm_alloc_inst+0x5f/0x1e0 [ 169.148481][T10039] try_get_usb_function_instance+0x136/0x1f0 [ 169.151547][T10039] usb_get_function_instance+0x16/0x70 [ 169.154185][T10039] function_make+0x18c/0x3f0 [ 169.156991][T10039] configfs_mkdir+0x525/0xd40 [ 169.160213][T10039] vfs_mkdir+0x364/0x850 [ 169.162420][T10039] filename_mkdirat+0x48b/0x5e0 [ 169.164866][T10039] __x64_sys_mkdir+0x6b/0x90 [ 169.167196][T10039] do_syscall_64+0x123/0x790 [ 169.169463][T10039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 169.172276][T10039] [ 169.172276][T10039] -> #1 (func_lock){+.+.}-{4:4}: [ 169.175429][T10039] lock_acquire+0x1d1/0x380 [ 169.177938][T10039] __mutex_lock+0x1a4/0x1bd0 [ 169.180911][T10039] try_get_usb_function_instance+0x26/0x1f0 [ 169.183938][T10039] usb_get_function_instance+0x16/0x70 [ 169.186760][T10039] function_make+0x18c/0x3f0 [ 169.188952][T10039] configfs_mkdir+0x525/0xd40 [ 169.191252][T10039] vfs_mkdir+0x364/0x850 [ 169.193272][T10039] filename_mkdirat+0x48b/0x5e0 [ 169.195422][T10039] __x64_sys_mkdir+0x6b/0x90 [ 169.197808][T10039] do_syscall_64+0x123/0x790 [ 169.200293][T10039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 169.203033][T10039] [ 169.203033][T10039] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 169.206169][T10039] check_prev_add+0xeb/0xe60 [ 169.209008][T10039] __lock_acquire+0x1528/0x1f40 [ 169.213803][T10039] lock_acquire+0x1d1/0x380 [ 169.216490][T10039] __mutex_lock+0x1a4/0x1bd0 [ 169.218689][T10039] uvcg_streaming_header_allow_link+0x7c/0x650 [ 169.222376][T10039] configfs_symlink+0x695/0x1340 [ 169.225951][T10039] vfs_symlink+0x178/0x4d0 [ 169.228829][T10039] filename_symlinkat+0x2a6/0x560 [ 169.232195][T10039] __x64_sys_symlink+0x79/0xb0 [ 169.234877][T10039] do_syscall_64+0x123/0x790 [ 169.238178][T10039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 169.242007][T10039] [ 169.242007][T10039] other info that might help us debug this: [ 169.242007][T10039] [ 169.247047][T10039] Chain exists of: [ 169.247047][T10039] gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#30 [ 169.247047][T10039] [ 169.255354][T10039] Possible unsafe locking scenario: [ 169.255354][T10039] [ 169.260139][T10039] CPU0 CPU1 [ 169.263239][T10039] ---- ---- [ 169.266298][T10039] lock(&sb->s_type->i_mutex_key#30); [ 169.268806][T10039] lock(tpg_instances_lock); [ 169.271612][T10039] lock(&sb->s_type->i_mutex_key#30); [ 169.274835][T10039] lock(gadget_subsys.su_mutex); [ 169.277188][T10039] [ 169.277188][T10039] *** DEADLOCK *** [ 169.277188][T10039] [ 169.281089][T10039] locks held by syz.1.1657/10039: 2, last CPU#0: [ 169.284007][T10039] #0: ffff8880241b0460 (sb_writers#18){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 169.289310][T10039] #1: ffff88803b99b580 (&sb->s_type->i_mutex_key#30){+.+.}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 169.295773][T10039] [ 169.295773][T10039] stack backtrace: [ 169.299484][T10039] CPU: 0 UID: 0 PID: 10039 Comm: syz.1.1657 Not tainted syzkaller #0 PREEMPT(full) [ 169.305659][T10039] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 169.310179][T10039] Call Trace: [ 169.311588][T10039] [ 169.312826][T10039] dump_stack_lvl+0x100/0x190 [ 169.314940][T10039] print_circular_bug.cold+0x178/0x1be [ 169.317838][T10039] check_noncircular+0x146/0x160 [ 169.320695][T10039] check_prev_add+0xeb/0xe60 [ 169.323008][T10039] __lock_acquire+0x1528/0x1f40 [ 169.325413][T10039] lock_acquire+0x1d1/0x380 [ 169.328075][T10039] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 169.330620][T10039] ? __pfx___might_resched+0x10/0x10 [ 169.332715][T10039] __mutex_lock+0x1a4/0x1bd0 [ 169.334974][T10039] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 169.339594][T10039] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 169.344088][T10039] ? __pfx___mutex_lock+0x10/0x10 [ 169.348176][T10039] ? __pfx___might_resched+0x10/0x10 [ 169.352555][T10039] ? make_vfsgid+0xf1/0x140 [ 169.354890][T10039] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 169.360276][T10039] uvcg_streaming_header_allow_link+0x7c/0x650 [ 169.364592][T10039] ? inode_permission+0x374/0x620 [ 169.367475][T10039] ? mntput_no_expire+0xe7/0x220 [ 169.370692][T10039] configfs_symlink+0x695/0x1340 [ 169.373421][T10039] ? __pfx_configfs_symlink+0x10/0x10 [ 169.377925][T10039] vfs_symlink+0x178/0x4d0 [ 169.382044][T10039] filename_symlinkat+0x2a6/0x560 [ 169.384463][T10039] ? __pfx_filename_symlinkat+0x10/0x10 [ 169.387485][T10039] ? strncpy_from_user+0x19d/0x2d0 [ 169.389894][T10039] ? do_getname+0x191/0x390 [ 169.392418][T10039] __x64_sys_symlink+0x79/0xb0 [ 169.395365][T10039] do_syscall_64+0x123/0x790 [ 169.400237][T10039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 169.403388][T10039] RIP: 0033:0x7fd3bbd9e159 [ 169.406872][T10039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 169.421125][T10039] RSP: 002b:00007fd3bcd42028 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 169.426782][T10039] RAX: ffffffffffffffda RBX: 00007fd3bc025fa0 RCX: 00007fd3bbd9e159 [ 169.430525][T10039] RDX: 0000000000000000 RSI: 0000200000001100 RDI: 0000200000001000 [ 169.434006][T10039] RBP: 00007fd3bbe3503b R08: 0000000000000000 R09: 0000000000000000 [ 169.437431][T10039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 169.441290][T10039] R13: 00007fd3bc026038 R14: 00007fd3bc025fa0 R15: 00007fffaa6b0c08 [ 169.445126][T10039] [ 169.570552][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 170.084171][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 170.590571][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 171.100426][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 171.610500][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 172.632629][ T13] net_ratelimit: 1 callbacks suppressed [ 172.632651][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 173.140534][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 173.650515][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 174.160765][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 174.673702][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 175.180476][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 175.690464][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 176.210433][ T13] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 176.721297][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 177.230548][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 177.740492][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 178.250469][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 178.760537][ T9495] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01