last executing test programs: 2.550147762s ago: executing program 3 (id=4): mkdir(&(0x7f0000000040)='./mount_sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./mount_sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000140)='./mount_dlm\x00', 0x1ff) mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./mount_dlm\x00', &(0x7f0000000200)='ocfs2_dlmfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000000240)='./mount_sys/fs/ocfs2/cluster_stack\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='user', 0x4) close(r0) mkdir(&(0x7f00000002c0)='./mount_config\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='none\x00', &(0x7f0000000340)='./mount_config\x00', &(0x7f0000000380)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f00000003c0)='./mount_config/dlm/ocfs2\x00', 0x1ff) r1 = open(&(0x7f0000000400)='./mount_config/dlm/ocfs2/recover_callbacks\x00', 0x1, 0x0) write(r1, &(0x7f0000000440)='1', 0x1) 2.3975369s ago: executing program 3 (id=11): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8001, 0xfffffff9, 0x57, 0x1bc4, 0x1, 0x4, 0x5, 0x400, 0x36}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4008094}, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd2f, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x3}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x8, 0x40, 0x5, 0x7, 0xffffffff}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x24008084}, 0x20000000) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r8) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r10, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf", 0x22}], 0x1}, 0x0) 1.590170526s ago: executing program 0 (id=16): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000100)={0x0, 0x2, 0x20}, 0xc) write$sndseq(r1, &(0x7f0000000700)=[{0x2, 0x7, 0x81, 0x3, @tick=0x1000, {0xf7, 0x2}, {0x8, 0x2b}, @quote={{0x2, 0x1}, 0x8}}, {0x8, 0x1, 0x2, 0x2, @tick=0x7, {0x7, 0x4}, {0x2, 0x7}, @ext={0x0, 0x0}}, {0xc, 0x9, 0x5, 0x6, @time={0x1, 0x1}, {0xd0, 0x1}, {0x1b, 0xcd}, @time=@time={0x1, 0x5}}, {0x7, 0xc, 0x73, 0x8, @time={0x0, 0x7f}, {0xb, 0xd6}, {0x8, 0x80}, @queue={0x6, {0x5}}}], 0x70) r2 = dup(r0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x48, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r3, 0x0, r0, 0x0, 0xffff, 0x2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x10001fc, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffb9, 0x1a}, 0x9c) 1.429363805s ago: executing program 1 (id=19): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='config\x00', &(0x7f00000000e0)='configfs\x00', 0x0, 0x0) chdir(&(0x7f00000000c0)='config\x00') r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000180)='usb_gadget/g1\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) openat(r1, &(0x7f00000004d0)='functions/uac2.usb0/c_chmask\x00', 0x2, 0x0) 1.379907453s ago: executing program 3 (id=21): r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='file0\x00', 0x42, 0x1ff) ftruncate(r1, 0x100000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) mkdir(&(0x7f00000000c0)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f00000001c0)='./config/cluster\x00', 0x1ff) mkdir(&(0x7f0000000200)='./config/cluster/ocfs2\x00', 0x1ff) mkdir(&(0x7f0000000240)='./config/cluster/ocfs2/node\x00', 0x1ff) mkdir(&(0x7f0000000280)='./config/cluster/ocfs2/node/node0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='127.0.0.1', 0x9) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='0\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/cluster/ocfs2/node/node0/local\x00', 0x1, 0x0) write(r5, &(0x7f0000000480)='1\x00', 0x2) close(r5) mkdir(&(0x7f00000004c0)='./config/cluster/ocfs2/heartbeat\x00', 0x1ff) mkdir(&(0x7f0000000500)='./config/cluster/ocfs2/heartbeat/region0\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/cluster/ocfs2/heartbeat/region0/block_bytes\x00', 0x1, 0x0) write(r6, &(0x7f0000000580)='512\x00', 0x4) close(r6) r7 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/cluster/ocfs2/heartbeat/region0/start_block\x00', 0x1, 0x0) write(r7, &(0x7f0000000600)='1\x00', 0x2) close(r7) r8 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/cluster/ocfs2/heartbeat/region0/blocks\x00', 0x1, 0x0) write(r8, &(0x7f0000000680)='2\x00', 0x2) close(r8) r9 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/cluster/ocfs2/heartbeat/region0/dev\x00', 0x1, 0x0) write(r9, &(0x7f0000000700)='3\x00', 0x2) close(r9) 1.379476958s ago: executing program 1 (id=22): mkdir(&(0x7f0000000040)='./sys_mount\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mount\x00', &(0x7f0000000100)='sysfs\x00', 0x0, &(0x7f0000000140)) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys_mount/block/nullb0/queue/scheduler\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='bfq\n\x00', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys_mount/block/nullb0/queue/rotational\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='1\n\x00', 0x2) syz_clone(0x10f00, &(0x7f00000002c0), 0x0, &(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380)) pread64(r0, &(0x7f00000003c0), 0x8, 0x0) pread64(r0, &(0x7f0000000440), 0x8, 0x2000) pread64(r0, &(0x7f0000000480), 0x8, 0x3000) pread64(r0, &(0x7f0000000500), 0x8, 0x5000) pread64(r0, &(0x7f0000000580), 0x8, 0x7000) pread64(r0, &(0x7f00000005c0), 0x8, 0x8000) pread64(r0, &(0x7f0000000640), 0x8, 0xa000) pread64(r0, &(0x7f0000000780), 0x8, 0xf000) pread64(r0, &(0x7f00000007c0), 0x8, 0x10000) pread64(r0, &(0x7f0000000800), 0x8, 0x20000) pread64(r0, &(0x7f0000000980), 0x8, 0x80000) pread64(r0, &(0x7f0000000a00), 0x8, 0xa0000) pread64(r0, &(0x7f0000000a40), 0x8, 0xb0000) pread64(r0, &(0x7f0000000a80), 0x8, 0xc0000) pread64(r0, &(0x7f0000000ac0), 0x8, 0xd0000) pread64(r0, &(0x7f0000000b00), 0x8, 0xe0000) pread64(r0, &(0x7f0000000b40), 0x8, 0xf0000) 1.379179322s ago: executing program 3 (id=24): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0xb, 0xfff3}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x5, 0x100002}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xd, 0x1, 0x6, 0x8}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4) 1.230262681s ago: executing program 1 (id=26): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000480)=""/74, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000400)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/185, &(0x7f0000000140)=""/92}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000001500)={@my=0x1}) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001"], 0x64}}, 0x40110) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/4092}) r2 = eventfd(0xf7b2) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000000040)={0x0, r2}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) 719.82832ms ago: executing program 0 (id=27): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/gser.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='Manufacturer\x00', 0xd) 719.627151ms ago: executing program 0 (id=28): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='0\x00', 0x1) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='100\x00', 0x3) close(r3) openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/self/fail-nth\x00', 0x1, 0x0) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000380)={0x1000}) 590.557978ms ago: executing program 0 (id=29): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8001, 0xfffffff9, 0x57, 0x1bc4, 0x1, 0x4, 0x5, 0x400, 0x36}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4008094}, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd2f, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x3}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x8, 0x40, 0x5, 0x7, 0xffffffff}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x24008084}, 0x20000000) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r8) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r10, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31", 0x24}], 0x1}, 0x0) 397.672651ms ago: executing program 1 (id=33): r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='file0\x00', 0x42, 0x1ff) ftruncate(r1, 0x100000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) mkdir(&(0x7f00000000c0)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f00000001c0)='./config/cluster\x00', 0x1ff) mkdir(&(0x7f0000000200)='./config/cluster/ocfs2\x00', 0x1ff) mkdir(&(0x7f0000000240)='./config/cluster/ocfs2/node\x00', 0x1ff) mkdir(&(0x7f0000000280)='./config/cluster/ocfs2/node/node0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='127.0.0.1', 0x9) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='0\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/cluster/ocfs2/node/node0/local\x00', 0x1, 0x0) write(r5, &(0x7f0000000480)='1\x00', 0x2) close(r5) mkdir(&(0x7f00000004c0)='./config/cluster/ocfs2/heartbeat\x00', 0x1ff) mkdir(&(0x7f0000000500)='./config/cluster/ocfs2/heartbeat/region0\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/cluster/ocfs2/heartbeat/region0/block_bytes\x00', 0x1, 0x0) write(r6, &(0x7f0000000580)='512\x00', 0x4) close(r6) r7 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/cluster/ocfs2/heartbeat/region0/start_block\x00', 0x1, 0x0) write(r7, &(0x7f0000000600)='1\x00', 0x2) close(r7) r8 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/cluster/ocfs2/heartbeat/region0/blocks\x00', 0x1, 0x0) write(r8, &(0x7f0000000680)='2\x00', 0x2) close(r8) r9 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/cluster/ocfs2/heartbeat/region0/dev\x00', 0x1, 0x0) write(r9, &(0x7f0000000700)='3\x00', 0x2) close(r9) 330.169289ms ago: executing program 1 (id=35): mkdir(0x0, 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, &(0x7f0000000400)='\x00') mkdir(&(0x7f0000000500)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000700)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ff) symlink(&(0x7f0000000900)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', &(0x7f0000000a00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlink(&(0x7f0000000b00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/ss/h\x00') mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ff) mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ff) mkdir(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ff) symlink(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') symlink(&(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001300)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') symlink(&(0x7f0000001400)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001500)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') symlink(&(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/ss/h\x00') symlink(&(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0\x00', &(0x7f0000001900)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000001b00)='dummy_udc.0\x00', 0xb) close(r0) 329.784092ms ago: executing program 1 (id=36): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000100)={0x0, 0x2, 0x20}, 0xc) write$sndseq(r1, &(0x7f0000000700)=[{0x2, 0x7, 0x81, 0x3, @tick=0x1000, {0xf7, 0x2}, {0x8, 0x2b}, @quote={{0x2, 0x1}, 0x8}}, {0x8, 0x1, 0x2, 0x2, @tick=0x7, {0x7, 0x4}, {0x2, 0x7}, @ext={0x0, 0x0}}, {0xc, 0x9, 0x5, 0x6, @time={0x1, 0x1}, {0xd0, 0x1}, {0x1b, 0xcd}, @time=@time={0x1, 0x5}}, {0x7, 0xc, 0x73, 0x8, @time={0x0, 0x7f}, {0xb, 0xd6}, {0x8, 0x80}, @queue={0x6, {0x5}}}], 0x70) r2 = dup(r0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x48, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r3, 0x0, r0, 0x0, 0xffff, 0x2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x10001fc, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffb9, 0x1a}, 0x9c) 208.278387ms ago: executing program 2 (id=37): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='0\x00', 0x1) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='100\x00', 0x3) close(r3) openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/self/fail-nth\x00', 0x1, 0x0) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000380)={0x1000}) 120.535605ms ago: executing program 2 (id=38): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='bic', 0xff3d) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x5) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 120.175997ms ago: executing program 2 (id=39): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/gser.usb0\x00', 0x1ff) symlink(&(0x7f0000000280)='./config/usb_gadget/g1/functions/gser.usb0\x00', &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1/gser.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='Manufacturer\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x1, 0x0) write(r1, &(0x7f0000000440)='Conf 1\x00', 0x7) 120.005745ms ago: executing program 2 (id=40): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='config\x00', &(0x7f00000000e0)='configfs\x00', 0x0, 0x0) chdir(&(0x7f00000000c0)='config\x00') r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) r1 = openat(r0, 0x0, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000004e1)='48000\n', 0x6) openat(r1, &(0x7f00000004f4)='functions/uac2.usb0/p_ssize\x00', 0x2, 0x0) 59.72715ms ago: executing program 3 (id=41): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000480)=""/74, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000400)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/185, &(0x7f0000000140)=""/92}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000001500)={@my=0x1}) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001"], 0x64}}, 0x40110) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/4092}) r2 = eventfd(0xf7b2) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000000040)={0x0, r2}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) 59.479889ms ago: executing program 0 (id=42): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='config\x00', &(0x7f00000000e0)='configfs\x00', 0x0, 0x0) chdir(&(0x7f00000000c0)='config\x00') r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000180)='usb_gadget/g1\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000280), 0x0) openat(r1, &(0x7f00000004d0)='functions/uac2.usb0/c_chmask\x00', 0x2, 0x0) 59.238709ms ago: executing program 2 (id=43): r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='file0\x00', 0x42, 0x1ff) ftruncate(r1, 0x100000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) mkdir(&(0x7f00000000c0)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f00000001c0)='./config/cluster\x00', 0x1ff) mkdir(&(0x7f0000000200)='./config/cluster/ocfs2\x00', 0x1ff) mkdir(&(0x7f0000000240)='./config/cluster/ocfs2/node\x00', 0x1ff) mkdir(&(0x7f0000000280)='./config/cluster/ocfs2/node/node0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='127.0.0.1', 0x9) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0) write(r3, &(0x7f0000000380), 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='0\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/cluster/ocfs2/node/node0/local\x00', 0x1, 0x0) write(r5, &(0x7f0000000480)='1\x00', 0x2) close(r5) mkdir(&(0x7f00000004c0)='./config/cluster/ocfs2/heartbeat\x00', 0x1ff) mkdir(&(0x7f0000000500)='./config/cluster/ocfs2/heartbeat/region0\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/cluster/ocfs2/heartbeat/region0/block_bytes\x00', 0x1, 0x0) write(r6, &(0x7f0000000580)='512\x00', 0x4) close(r6) r7 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/cluster/ocfs2/heartbeat/region0/start_block\x00', 0x1, 0x0) write(r7, &(0x7f0000000600)='1\x00', 0x2) close(r7) r8 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/cluster/ocfs2/heartbeat/region0/blocks\x00', 0x1, 0x0) write(r8, &(0x7f0000000680)='2\x00', 0x2) close(r8) r9 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/cluster/ocfs2/heartbeat/region0/dev\x00', 0x1, 0x0) write(r9, &(0x7f0000000700)='3\x00', 0x2) close(r9) 250.594µs ago: executing program 0 (id=44): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='Manufacturer\x00', 0xd) 0s ago: executing program 2 (id=45): mkdir(&(0x7f0000000040)='./sys_mount\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys_mount\x00', &(0x7f0000000100)='sysfs\x00', 0x0, &(0x7f0000000140)) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys_mount/block/nullb0/queue/scheduler\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='bfq\n\x00', 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys_mount/block/nullb0/queue/rotational\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='1\n\x00', 0x2) pread64(r0, &(0x7f00000003c0), 0x8, 0x0) pread64(r0, &(0x7f0000000400), 0x8, 0x1000) pread64(r0, &(0x7f0000000440), 0x8, 0x2000) pread64(r0, &(0x7f0000000480), 0x8, 0x3000) pread64(r0, &(0x7f0000000500), 0x8, 0x5000) pread64(r0, &(0x7f0000000580), 0x8, 0x7000) pread64(r0, &(0x7f00000005c0), 0x8, 0x8000) pread64(r0, &(0x7f0000000640), 0x8, 0xa000) pread64(r0, &(0x7f0000000780), 0x8, 0xf000) pread64(r0, &(0x7f00000007c0), 0x8, 0x10000) pread64(r0, &(0x7f0000000800), 0x8, 0x20000) pread64(r0, &(0x7f0000000980), 0x8, 0x80000) pread64(r0, &(0x7f0000000a00), 0x8, 0xa0000) pread64(r0, &(0x7f0000000a40), 0x8, 0xb0000) pread64(r0, &(0x7f0000000a80), 0x8, 0xc0000) pread64(r0, &(0x7f0000000ac0), 0x8, 0xd0000) pread64(r0, &(0x7f0000000b00), 0x8, 0xe0000) pread64(r0, &(0x7f0000000b40), 0x8, 0xf0000) 0s ago: executing program 0 (id=46): mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, &(0x7f0000000400)='\x00') mkdir(&(0x7f0000000500)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000700)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ff) symlink(&(0x7f0000000900)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', &(0x7f0000000a00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlink(&(0x7f0000000b00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/ss/h\x00') mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ff) mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ff) mkdir(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ff) symlink(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') symlink(&(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001300)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') symlink(&(0x7f0000001400)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001500)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') symlink(&(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/ss/h\x00') symlink(&(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0\x00', &(0x7f0000001900)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000001b00)='dummy_udc.0\x00', 0xb) close(r0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:29462' (ED25519) to the list of known hosts. [ 38.878781][ T42] audit: type=1400 audit(1785407507.260:116): avc: denied { name_bind } for pid=5651 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 38.922826][ T42] audit: type=1400 audit(1785407507.300:117): avc: denied { execute } for pid=5652 comm="sh" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 38.929390][ T42] audit: type=1400 audit(1785407507.300:118): avc: denied { execute_no_trans } for pid=5652 comm="sh" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 39.004805][ T42] audit: type=1400 audit(1785407507.380:119): avc: denied { write } for pid=5653 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 39.041387][ T42] audit: type=1400 audit(1785407507.420:120): avc: denied { write } for pid=5656 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.415016][ T5652] cgroup: Unknown subsys name 'net' [ 41.589926][ T5652] cgroup: Unknown subsys name 'cpuset' [ 41.593999][ T5652] cgroup: Unknown subsys name 'rlimit' [ 41.863052][ T5726] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 42.614491][ T5652] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 46.228569][ T42] kauditd_printk_skb: 40 callbacks suppressed [ 46.228581][ T42] audit: type=1400 audit(1785407514.600:161): avc: denied { execmem } for pid=5734 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 46.411742][ T42] audit: type=1400 audit(1785407514.790:162): avc: denied { create } for pid=5738 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 46.430972][ T42] audit: type=1400 audit(1785407514.790:163): avc: denied { read write } for pid=5738 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 46.432186][ T5740] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 46.441753][ T5740] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 46.444072][ T42] audit: type=1400 audit(1785407514.790:164): avc: denied { open } for pid=5738 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 46.444098][ T42] audit: type=1400 audit(1785407514.800:165): avc: denied { ioctl } for pid=5738 comm="syz-executor" path="socket:[3895]" dev="sockfs" ino=3895 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 46.444289][ T5749] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 46.452552][ T5751] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 46.463807][ T5748] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 46.464278][ T5749] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 46.466207][ T5751] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 46.466788][ T5749] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 46.469355][ T5751] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 46.473631][ T5753] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 46.473681][ T5749] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 46.475175][ T5751] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 46.476714][ T5749] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 46.477902][ T5753] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 46.478363][ T5753] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 46.478629][ T5751] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 46.479263][ T5748] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 46.482936][ T5743] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 46.484279][ T42] audit: type=1400 audit(1785407514.860:166): avc: denied { read } for pid=5745 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 46.485287][ T5749] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 46.487255][ T5749] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 46.489896][ T42] audit: type=1400 audit(1785407514.860:167): avc: denied { open } for pid=5745 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 46.516094][ T42] audit: type=1400 audit(1785407514.860:168): avc: denied { mounton } for pid=5745 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 46.522756][ T42] audit: type=1400 audit(1785407514.870:169): avc: denied { module_request } for pid=5745 comm="syz-executor" kmod="netdev-nr3" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 46.529412][ T42] audit: type=1400 audit(1785407514.890:170): avc: denied { sys_module } for pid=5745 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 47.051879][ T5739] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.055733][ T5739] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.060941][ T5739] bridge_slave_0: entered allmulticast mode [ 47.065550][ T5739] bridge_slave_0: entered promiscuous mode [ 47.091723][ T5739] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.095425][ T5739] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.098858][ T5739] bridge_slave_1: entered allmulticast mode [ 47.102979][ T5739] bridge_slave_1: entered promiscuous mode [ 47.118050][ T5738] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.120199][ T5738] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.122422][ T5738] bridge_slave_0: entered allmulticast mode [ 47.124906][ T5738] bridge_slave_0: entered promiscuous mode [ 47.149151][ T5738] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.152307][ T5738] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.155226][ T5738] bridge_slave_1: entered allmulticast mode [ 47.158944][ T5738] bridge_slave_1: entered promiscuous mode [ 47.201190][ T5752] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.204762][ T5752] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.207800][ T5752] bridge_slave_0: entered allmulticast mode [ 47.210401][ T5752] bridge_slave_0: entered promiscuous mode [ 47.222452][ T5745] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.226165][ T5745] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.229021][ T5745] bridge_slave_0: entered allmulticast mode [ 47.232464][ T5745] bridge_slave_0: entered promiscuous mode [ 47.239553][ T5739] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.243004][ T5752] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.246448][ T5752] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.249245][ T5752] bridge_slave_1: entered allmulticast mode [ 47.251873][ T5752] bridge_slave_1: entered promiscuous mode [ 47.261962][ T5738] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.266810][ T5738] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.270056][ T5745] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.272215][ T5745] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.274961][ T5745] bridge_slave_1: entered allmulticast mode [ 47.277956][ T5745] bridge_slave_1: entered promiscuous mode [ 47.282777][ T5739] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.313618][ T5752] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.339463][ T5745] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.343338][ T5752] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.347618][ T5738] team0: Port device team_slave_0 added [ 47.350745][ T5738] team0: Port device team_slave_1 added [ 47.353362][ T5739] team0: Port device team_slave_0 added [ 47.357409][ T5745] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.373769][ T5739] team0: Port device team_slave_1 added [ 47.422404][ T5752] team0: Port device team_slave_0 added [ 47.424828][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.427085][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.434420][ T5738] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.439493][ T5745] team0: Port device team_slave_0 added [ 47.441538][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.443797][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.451408][ T5739] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.455770][ T5752] team0: Port device team_slave_1 added [ 47.458341][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.460530][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.469596][ T5738] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.475412][ T5745] team0: Port device team_slave_1 added [ 47.478386][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.480907][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.490184][ T5739] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.547030][ T5752] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.549483][ T5752] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.558414][ T5752] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.563849][ T5745] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.566670][ T5745] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.576978][ T5745] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.587034][ T5745] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.589239][ T5745] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.596563][ T5745] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.610882][ T5752] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.613747][ T5752] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.622410][ T5752] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.640653][ T5738] hsr_slave_0: entered promiscuous mode [ 47.642959][ T5738] hsr_slave_1: entered promiscuous mode [ 47.648127][ T5739] hsr_slave_0: entered promiscuous mode [ 47.650602][ T5739] hsr_slave_1: entered promiscuous mode [ 47.652758][ T5739] debugfs: 'hsr0' already exists in 'hsr' [ 47.654737][ T5739] Cannot create hsr debugfs directory [ 47.760248][ T5745] hsr_slave_0: entered promiscuous mode [ 47.763414][ T5745] hsr_slave_1: entered promiscuous mode [ 47.766282][ T5745] debugfs: 'hsr0' already exists in 'hsr' [ 47.769550][ T5745] Cannot create hsr debugfs directory [ 47.793766][ T5752] hsr_slave_0: entered promiscuous mode [ 47.796952][ T5752] hsr_slave_1: entered promiscuous mode [ 47.799888][ T5752] debugfs: 'hsr0' already exists in 'hsr' [ 47.801886][ T5752] Cannot create hsr debugfs directory [ 48.109961][ T5739] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 48.121268][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.126516][ T5739] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 48.131485][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.144364][ T5739] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 48.150829][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.154381][ T5739] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 48.161107][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.209178][ T5738] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 48.215652][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.219759][ T5738] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 48.225966][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.229692][ T5738] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 48.235714][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.242199][ T5738] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 48.248388][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.310495][ T5745] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 48.314662][ T5745] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.318242][ T5745] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 48.323268][ T5745] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.326773][ T5745] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 48.331215][ T5745] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.334156][ T5745] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 48.340608][ T5745] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.409606][ T5752] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 48.415821][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.419668][ T5752] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 48.423987][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.427791][ T5752] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 48.432019][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.434828][ T5752] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 48.440748][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.482685][ T5739] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.520147][ T5739] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.532253][ T5738] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.543060][ T117] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.545640][ T117] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.566585][ T117] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.568878][ T117] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.571697][ T5748] Bluetooth: hci0: command tx timeout [ 48.577179][ T5740] Bluetooth: hci3: command tx timeout [ 48.577289][ T5743] Bluetooth: hci2: command tx timeout [ 48.580310][ T5748] Bluetooth: hci1: command tx timeout [ 48.585189][ T5738] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.596095][ T5745] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.614789][ T117] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.617804][ T117] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.635837][ T117] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.638826][ T117] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.660943][ T5752] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.672933][ T5745] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.689485][ T117] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.692627][ T117] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.707752][ T117] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.710184][ T117] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.734058][ T5752] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.744579][ T75] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.746990][ T75] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.764619][ T75] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.767025][ T75] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.966790][ T5739] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 48.981855][ T5738] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.025160][ T5739] veth0_vlan: entered promiscuous mode [ 49.033988][ T5739] veth1_vlan: entered promiscuous mode [ 49.039804][ T5745] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.043470][ T5738] veth0_vlan: entered promiscuous mode [ 49.058001][ T5752] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.061179][ T5738] veth1_vlan: entered promiscuous mode [ 49.093546][ T5739] veth0_macvtap: entered promiscuous mode [ 49.103294][ T5739] veth1_macvtap: entered promiscuous mode [ 49.118504][ T5738] veth0_macvtap: entered promiscuous mode [ 49.124978][ T5738] veth1_macvtap: entered promiscuous mode [ 49.139285][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.149798][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.153670][ T5752] veth0_vlan: entered promiscuous mode [ 49.155748][ T5745] veth0_vlan: entered promiscuous mode [ 49.161740][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.170388][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.179863][ T5791] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.184171][ T5791] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.190359][ T5745] veth1_vlan: entered promiscuous mode [ 49.193959][ T5791] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.198167][ T5791] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.207678][ T5791] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.210842][ T5791] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.216333][ T5752] veth1_vlan: entered promiscuous mode [ 49.223997][ T5791] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.231907][ T5791] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.289049][ T5745] veth0_macvtap: entered promiscuous mode [ 49.309727][ T5745] veth1_macvtap: entered promiscuous mode [ 49.311182][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.314524][ T5752] veth0_macvtap: entered promiscuous mode [ 49.314826][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.344840][ T5752] veth1_macvtap: entered promiscuous mode [ 49.348204][ T1167] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.354214][ T1167] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.367528][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.368868][ T5745] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.370546][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.403327][ T5745] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.408764][ T5752] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.413956][ T5752] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.421031][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.422900][ T5817] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.424317][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.425358][ T5738] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 49.435561][ T5817] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.438434][ T5817] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.453317][ T5817] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.457307][ T5817] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.473326][ T5817] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.476968][ T5817] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.493337][ T5817] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.556090][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.559267][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.580355][ T63] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.582863][ T63] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.598218][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.600874][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.636455][ T75] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.643715][ T75] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.733385][ T5901] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 49.829592][ T5912] loop0: detected capacity change from 0 to 2048 [ 49.837039][ T5913] syzkaller0: entered promiscuous mode [ 49.839847][ T5913] syzkaller0: entered allmulticast mode [ 49.899969][ T5918] syzkaller0: entered promiscuous mode [ 49.902231][ T5918] syzkaller0: entered allmulticast mode [ 50.647826][ T5740] Bluetooth: hci0: command tx timeout [ 50.648425][ T5748] Bluetooth: hci3: command tx timeout [ 50.648513][ T5743] Bluetooth: hci1: command tx timeout [ 50.657826][ T5748] Bluetooth: hci2: command tx timeout [ 50.859503][ T5938] loop0: detected capacity change from 0 to 2048 [ 50.906637][ T5944] syzkaller0: entered promiscuous mode [ 50.909773][ T5944] syzkaller0: entered allmulticast mode [ 51.641812][ T5958] syzkaller0: entered promiscuous mode [ 51.643481][ T5958] syzkaller0: entered allmulticast mode [ 51.855625][ T5966] loop0: detected capacity change from 0 to 2048 [ 52.211100][ T5989] loop0: detected capacity change from 0 to 2048 [ 52.284358][ T42] kauditd_printk_skb: 111 callbacks suppressed [ 52.284372][ T42] audit: type=1400 audit(1785407520.660:282): avc: denied { write } for pid=5995 comm="syz.0.46" name="functions" dev="configfs" ino=8564 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 52.292358][ T5996] [ 52.293985][ T42] audit: type=1400 audit(1785407520.660:283): avc: denied { write } for pid=5995 comm="syz.0.46" name="header" dev="configfs" ino=9712 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 52.294145][ T5996] ====================================================== [ 52.301310][ T42] audit: type=1400 audit(1785407520.660:284): avc: denied { write } for pid=5995 comm="syz.0.46" name="fs" dev="configfs" ino=8173 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 52.304031][ T5996] WARNING: possible circular locking dependency detected [ 52.304044][ T5996] syzkaller #0 Not tainted [ 52.304054][ T5996] ------------------------------------------------------ [ 52.304061][ T5996] syz.0.46/5996 is trying to acquire lock: [ 52.312014][ T42] audit: type=1400 audit(1785407520.660:285): avc: denied { write } for pid=5995 comm="syz.0.46" name="fs" dev="configfs" ino=8173 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 52.313923][ T5996] ffffffff901d0908 [ 52.315596][ T42] audit: type=1400 audit(1785407520.660:286): avc: denied { write } for pid=5995 comm="syz.0.46" name="ss" dev="configfs" ino=8174 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 52.317772][ T5996] (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_streaming_header_allow_link+0x7c/0x650 [ 52.317807][ T5996] [ 52.317807][ T5996] but task is already holding lock: [ 52.317810][ T5996] ffff88805912e040 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x3c0/0x11f0 [ 52.317842][ T5996] [ 52.317842][ T5996] which lock already depends on the new lock. [ 52.317842][ T5996] [ 52.317846][ T5996] [ 52.317846][ T5996] the existing dependency chain (in reverse order) is: [ 52.319924][ T42] audit: type=1400 audit(1785407520.660:287): avc: denied { write } for pid=5995 comm="syz.0.46" name="ss" dev="configfs" ino=8174 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 52.326959][ T5996] [ 52.326959][ T5996] -> #2 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 52.327000][ T5996] lock_acquire+0x1b9/0x370 [ 52.327027][ T5996] down_write+0x8b/0x1f0 [ 52.327046][ T5996] configfs_depend_item_unlocked+0xf3/0x6a0 [ 52.327067][ T5996] usbg_make_tpg+0x261/0x620 [ 52.328426][ T42] audit: type=1400 audit(1785407520.660:288): avc: denied { write } for pid=5995 comm="syz.0.46" name="uncompressed" dev="configfs" ino=8178 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 52.336824][ T5996] target_fabric_make_tpg+0xab/0x8c0 [ 52.336861][ T5996] configfs_mkdir+0x51e/0xb70 [ 52.336884][ T5996] vfs_mkdir+0x361/0x850 [ 52.336906][ T5996] filename_mkdirat+0x48b/0x5e0 [ 52.336924][ T5996] __x64_sys_mkdir+0x6b/0x90 [ 52.336942][ T5996] do_syscall_64+0x115/0x870 [ 52.336961][ T5996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 52.336980][ T5996] [ 52.336980][ T5996] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 52.337010][ T5996] lock_acquire+0x1b9/0x370 [ 52.337030][ T5996] __mutex_lock+0x1a4/0x1bd0 [ 52.337049][ T5996] tcm_set_name+0x29/0xb0 [ 52.337064][ T5996] function_make+0x21c/0x3f0 [ 52.337086][ T5996] configfs_mkdir+0x51e/0xb70 [ 52.341032][ T42] audit: type=1400 audit(1785407520.660:289): avc: denied { write } for pid=5995 comm="syz.0.46" name="u" dev="configfs" ino=8190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 52.343853][ T5996] vfs_mkdir+0x361/0x850 [ 52.343886][ T5996] filename_mkdirat+0x48b/0x5e0 [ 52.348070][ T42] audit: type=1400 audit(1785407520.660:290): avc: denied { write } for pid=5995 comm="syz.0.46" name="header" dev="configfs" ino=8177 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 52.351544][ T5996] __x64_sys_mkdir+0x6b/0x90 [ 52.354300][ T42] audit: type=1400 audit(1785407520.660:291): avc: denied { write } for pid=5995 comm="syz.0.46" name="h" dev="configfs" ino=8192 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 52.361159][ T5996] do_syscall_64+0x115/0x870 [ 52.361195][ T5996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 52.361214][ T5996] [ 52.361214][ T5996] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 52.361247][ T5996] check_prev_add+0xeb/0xe60 [ 52.387544][ T5997] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 52.388879][ T5996] __lock_acquire+0x136c/0x1a40 [ 52.388901][ T5996] lock_acquire+0x1b9/0x370 [ 52.388913][ T5996] __mutex_lock+0x1a4/0x1bd0 [ 52.388926][ T5996] uvcg_streaming_header_allow_link+0x7c/0x650 [ 52.388940][ T5996] configfs_symlink+0x540/0x11f0 [ 52.391341][ T5997] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 52.393571][ T5996] vfs_symlink+0x178/0x4d0 [ 52.393600][ T5996] filename_symlinkat+0x2a6/0x560 [ 52.393617][ T5996] __x64_sys_symlink+0x79/0xb0 [ 52.393629][ T5996] do_syscall_64+0x115/0x870 [ 52.395927][ T5997] udc dummy_udc.0: failed to start g1: -22 [ 52.397367][ T5996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 52.397382][ T5996] [ 52.397382][ T5996] other info that might help us debug this: [ 52.397382][ T5996] [ 52.397386][ T5996] Chain exists of: [ 52.397386][ T5996] gadget_subsys.su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#24 [ 52.397386][ T5996] [ 52.397410][ T5996] Possible unsafe locking scenario: [ 52.397410][ T5996] [ 52.397413][ T5996] CPU0 CPU1 [ 52.397416][ T5996] ---- ---- [ 52.397419][ T5996] lock(&sb->s_type->i_mutex_key#24); [ 52.397430][ T5996] lock(&opts->dep_lock); [ 52.397438][ T5996] lock(&sb->s_type->i_mutex_key#24); [ 52.397449][ T5996] lock(gadget_subsys.su_mutex); [ 52.397456][ T5996] [ 52.397456][ T5996] *** DEADLOCK *** [ 52.397456][ T5996] [ 52.400585][ T5997] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 52.400961][ T5996] 2 locks held by syz.0.46/5996: [ 52.400973][ T5996] #0: ffff8880235a2450 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 52.403852][ T5997] UDC core: g1: couldn't find an available UDC or it's busy [ 52.409448][ T5996] #1: ffff88805912e040 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x3c0/0x11f0 [ 52.409491][ T5996] [ 52.409491][ T5996] stack backtrace: [ 52.409510][ T5996] CPU: 0 UID: 0 PID: 5996 Comm: syz.0.46 Not tainted syzkaller #0 PREEMPT(full) [ 52.409523][ T5996] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 52.409530][ T5996] Call Trace: [ 52.409535][ T5996] [ 52.409539][ T5996] dump_stack_lvl+0x100/0x190 [ 52.409554][ T5996] print_circular_bug.cold+0x178/0x1c7 [ 52.409573][ T5996] check_noncircular+0x146/0x160 [ 52.409586][ T5996] ? audit_log_end+0x24/0x30 [ 52.409605][ T5996] check_prev_add+0xeb/0xe60 [ 52.409619][ T5996] __lock_acquire+0x136c/0x1a40 [ 52.409634][ T5996] lock_acquire+0x1b9/0x370 [ 52.409647][ T5996] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 52.409662][ T5996] ? __pfx___might_resched+0x10/0x10 [ 52.409676][ T5996] ? audit_inode_permission+0x1ea/0x2a0 [ 52.409690][ T5996] __mutex_lock+0x1a4/0x1bd0 [ 52.409704][ T5996] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 52.409717][ T5996] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 52.409731][ T5996] ? __lock_acquire+0x49f/0x1a40 [ 52.409744][ T5996] ? __pfx___mutex_lock+0x10/0x10 [ 52.409757][ T5996] ? selinux_inode_permission+0x14a/0x1130 [ 52.409771][ T5996] ? __pfx___might_resched+0x10/0x10 [ 52.409784][ T5996] ? make_vfsgid+0xf1/0x140 [ 52.409801][ T5996] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 52.409814][ T5996] ? security_inode_permission+0xbf/0x250 [ 52.409831][ T5996] uvcg_streaming_header_allow_link+0x7c/0x650 [ 52.409845][ T5996] ? inode_permission+0x374/0x620 [ 52.409860][ T5996] ? mntput_no_expire+0xe7/0x220 [ 52.409871][ T5996] configfs_symlink+0x540/0x11f0 [ 52.409888][ T5996] ? __pfx_configfs_symlink+0x10/0x10 [ 52.409904][ T5996] vfs_symlink+0x178/0x4d0 [ 52.409920][ T5996] filename_symlinkat+0x2a6/0x560 [ 52.409933][ T5996] ? __pfx_filename_symlinkat+0x10/0x10 [ 52.409946][ T5996] ? strncpy_from_user+0x19d/0x2d0 [ 52.409961][ T5996] ? do_getname+0x191/0x390 [ 52.409975][ T5996] __x64_sys_symlink+0x79/0xb0 [ 52.409988][ T5996] do_syscall_64+0x115/0x870 [ 52.410000][ T5996] ? clear_bhb_loop+0x40/0x90 [ 52.410012][ T5996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 52.410024][ T5996] RIP: 0033:0x7f215a79df99 [ 52.410034][ T5996] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 52.410045][ T5996] RSP: 002b:00007f215b690028 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 52.410055][ T5996] RAX: ffffffffffffffda RBX: 00007f215aa25fa0 RCX: 00007f215a79df99 [ 52.410062][ T5996] RDX: 0000000000000000 RSI: 0000200000001100 RDI: 0000200000001000 [ 52.410069][ T5996] RBP: 00007f215a834ec4 R08: 0000000000000000 R09: 0000000000000000 [ 52.410075][ T5996] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 52.410081][ T5996] R13: 00007f215aa26038 R14: 00007f215aa25fa0 R15: 00007ffe0ee3b418 [ 52.410090][ T5996] [ 52.727030][ T5740] Bluetooth: hci2: command tx timeout [ 52.727070][ T5743] Bluetooth: hci3: command tx timeout [ 52.728378][ T5748] Bluetooth: hci0: command tx timeout [ 52.736940][ T5743] Bluetooth: hci1: command tx timeout [ 54.807346][ T5743] Bluetooth: hci0: command tx timeout [ 54.807998][ T5740] Bluetooth: hci1: command tx timeout [ 54.808048][ T5748] Bluetooth: hci3: command tx timeout [ 54.808066][ T5748] Bluetooth: hci2: command tx timeout