last executing test programs: 1.892225182s ago: executing program 2 (id=409): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0xbe, &(0x7f00000007c0)=ANY=[@ANYBLOB], 0x0) shmctl$IPC_RMID(0x0, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x29) pread64(0xffffffffffffffff, &(0x7f000001a240)=""/102400, 0x19000, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x7, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104, 0xa01}, [@IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) pread64(r4, 0x0, 0x0, 0x80) socket$packet(0x11, 0x2, 0x300) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000140)={0x34, r2, 0x1, 0x0, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x0, 0x0, @l2={'eth', 0x3a, 'team0\x00'}}}}}, 0x34}}, 0x20042000) (fail_nth: 3) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) syz_genetlink_get_family_id$tipc(0x0, r1) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000840}, 0x40) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001400)=[{{0x0, 0x0, 0x0}, 0x18}], 0x1, 0x1, 0x0) 1.621417792s ago: executing program 0 (id=413): r0 = socket$netlink(0x10, 0x3, 0x0) (async) socket$can_j1939(0x1d, 0x2, 0x7) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$COMEDI_BUFINFO(r1, 0xc02c640e, &(0x7f0000000100)={0x5, 0xffff, 0x7fffffff, 0x2, 0x7, 0x5, 0x2}) (async) sendmsg$nl_route_sched(r0, &(0x7f0000005c40)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0x90, 0x30, 0x9, 0x0, 0x0, {}, [{0x7c, 0x1, [@m_ctinfo={0x78, 0x3, 0x0, 0x0, {{0xb}, {0x4}, {0x49, 0x6, "e041a8ea1c52202e36652d4d535de9d39f52b6433f744273d3274b1e1ed7278d5b43906e43c1a171b1750f4b668fb6f4df835b580268215406d40cfa6af49eac265c08c7cb"}, {0xc}, {0xc}}}]}]}, 0x90}}, 0x0) 1.619011748s ago: executing program 0 (id=414): openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r0 = syz_open_dev$swradio(&(0x7f00000001c0), 0x0, 0x2) dup(r0) (async) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c00000015000103000000000000e7ff0b00000008000100", @ANYRES64=r1], 0x1c}, 0x1, 0x0, 0x0, 0x4044015}, 0x4000000) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x20000010}, 0x20044000) 1.618683519s ago: executing program 0 (id=415): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f0000000040)={0x3, 0x0, 0x3006, 0x8001, 0x7, 0x7fff, 0x56}) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000000c0)={0x990000, 0x6, 0x6, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x990a67, 0xfffffffe, '\x00', @ptr=0x80}}) close(r0) ioctl$VIDIOC_S_STD(r0, 0x40085618, &(0x7f0000000100)=0x80) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x210140) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r1, 0xc04c5349, &(0x7f0000000180)={0xffffffff, 0x3, 0xf}) close(r1) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000200)) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000002c0), 0x8100, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r1, 0xc0605345, &(0x7f0000000300)={0x5, 0x2, {0xffffffffffffffff, 0x1, 0x5cc, 0x3, 0xfffffffe}, 0x6}) r3 = accept4$x25(r2, 0x0, &(0x7f0000000380), 0x800) close(r3) ioctl$BLKCRYPTOPREPAREKEY(r2, 0xc040128b, &(0x7f0000000440)={&(0x7f00000003c0)="6c4abd1a7e9f9e943407edcf4601552a960cee73", 0x14, &(0x7f0000000400)=""/2, 0x2}) ioctl$SNDCTL_FM_4OP_ENABLE(r2, 0x4004510f, &(0x7f0000000480)=0x800) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000540)={'syztnl2\x00', &(0x7f00000004c0)={'sit0\x00', 0x0, 0x40, 0x20, 0x5748, 0xffffff88, {{0xa, 0x4, 0x3, 0x11, 0x28, 0x68, 0x0, 0x2, 0x29, 0x0, @multicast1, @broadcast, {[@generic={0x44, 0x12, "9b9bab92d677f786cdf25f93192c8530"}]}}}}}) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000580)={@mcast1, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x8, 0x5, 0x3ff, 0x100, 0x0, 0x40202, r4}) sendmsg$DCCPDIAG_GETSOCK(r2, &(0x7f0000000800)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000640)={0x174, 0x13, 0x8, 0x70bd26, 0x25dfdbff, {0x2c, 0x70, 0xfe, 0x40, {0x4e21, 0x4e23, [0x8, 0x10001, 0x7, 0x1000], [0x1, 0x2005, 0x800, 0x80], r4, [0x1b12, 0xe]}, 0x6, 0xfff}, [@INET_DIAG_REQ_BYTECODE={0x3a, 0x1, "5ee5a66d737164c971620638bfc6283fe385e3609032a4e7ccdfd94e0a6a16d9dbba8cdd83036ff4b46af18d3d3a50e85c178789ccfc"}, @INET_DIAG_REQ_BYTECODE={0xaf, 0x1, "d987fe33c127b01a47ad3891f8bac9543755e268f10a4802ef07c0370785e13630617db101696fe913a62cad286d80cc845ee18c5c7e3c76a547816edee3af9e3404a30ef7fef136dfecbad9bcd875f08d4f0fd43bdc68cb0cc221d41db7ade23d27a220587fc2cd9ba2b110a5c33c575dd1f788090b7e754e94e04d4542863efa6b2767badd996b6dcf95bc4076a9ff9f2d76f5922b43dc288d9d581c770547831b10827000f5181bef68"}, @INET_DIAG_REQ_BYTECODE={0x39, 0x1, "7abd3a64518e18dad3a448111aba345d212d51efe33bf88bbc37a77855b258d4a8319cac86a075783e96676ed7d03820c7751bbf42"}]}, 0x174}, 0x1, 0x0, 0x0, 0x40080}, 0x44894) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000880)={0x0, 0x1c, &(0x7f0000000840)=[@in6={0xa, 0x4e24, 0x0, @remote, 0x7}]}, &(0x7f00000008c0)=0x10) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000900)={r5, 0x1000}, 0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000940)={r5, 0x7fff}, 0x8) ioctl$BLKRASET(r2, 0x1262, &(0x7f0000000980)=0x6) timer_create(0x2, &(0x7f0000000a40)={0x0, 0x2c, 0x0, @thr={&(0x7f00000009c0)="757a8c9fce4f96364253c8dbada82ca552651edd4f3a2ce53b62e1e864a7a8b21a60e70aa15cbbc7919ec5ba71404ab9723dd1d8073dd0ef", &(0x7f0000000a00)="d75369b0d9a79b0c99d14f8898e67c27e6cc3e48394f66f6a43a661b43ecf88298fd4f59d7c06c345b8666fda395c73e"}}, &(0x7f0000000a80)=0x0) clock_gettime(0x0, &(0x7f0000000ac0)={0x0, 0x0}) timer_settime(r6, 0x1, &(0x7f0000000b00)={{0x0, 0x989680}, {r7, r8+10000000}}, 0x0) io_uring_register$IORING_REGISTER_CLONE_BUFFERS(r2, 0x1e, &(0x7f0000000b40)={r3, 0x3, 0x2, 0x7, 0x1}, 0x1) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000b80)={0x0, r1, 0x0, 0x8, 0x19d6, 0x3}) socket$unix(0x1, 0x5, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) copy_file_range(r1, &(0x7f0000000bc0)=0x800, r3, &(0x7f0000000c00)=0xe95, 0x5, 0x0) 1.617438057s ago: executing program 0 (id=417): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7050000000000006110440000000000dc0500002000000095000000000000009abb1723bf24203831c9545b21c751ee4024f479cbe4b89f9808837203000000000000c2d182c7a3221481f5009edaf5f5ac058299e10e790a198f42a715b99fb3d2a73dd025848710155ad1efd7d991408000000000000085a0db0401fa29e075b7ab0408a0d8cfceeb23465bb027ee1151c02af21d8f9aa57e673a6724441d08087aff070eda8abef22b3a806c8226f5a2886c93bd29b37252ba4a6e9cc5f69e75680c431aa855e487ae513abd6c4ee973fce29a26018ed5e0780f8778a602a3533a3dac7da4fe491edf3abfa7bf871c58848ac46ada6776bd9b85df01e626026a59ddfa7a9c879acbfb0bf426785dec7d8611dc850df49ed8633bdb83dd505fb20649f53841a0e200c91f5bf1bb186ed87efc7b6f8859d029c8376ca19265e281fea0a6fd2222f8850c8445758503ede0ce1b3f73ecd8989e8c53c5e679b13802bddf80f3b1d07d6d68bfa12ab34697d40ac1150a842f8bb381344b994c19642a10eb30845a993daaa8bd4aebc595475feb3475d8e802498382e73edb98fcf2df96ab3c870490c4"], &(0x7f00000002c0)='syzkaller\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x48) (async) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x4}, 0x50) (async) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) (async, rerun: 32) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000500)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x4}, 0x50) (rerun: 32) r2 = syz_usb_connect(0x5, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100000cb768405e0483020b9901e4020109021b000100000000090400fb015c291d00090509"], 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x3, 0x183a00) (async) syz_usb_disconnect(r2) (async) readv(0xffffffffffffffff, 0x0, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x3, 0x0) (async) close(r3) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0300000004000020040000000a0000000000000035", @ANYRES32, @ANYBLOB='\t\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000010000000500"/28], 0x50) r4 = epoll_create1(0x0) r5 = fcntl$dupfd(r4, 0x2, 0xffffffffffffffff) (async) epoll_create1(0x0) (async, rerun: 64) r6 = openat$cgroup_devices(r1, &(0x7f0000000200)='devices.deny\x00', 0x2, 0x0) (rerun: 64) r7 = fcntl$dupfd(r6, 0x2, 0xffffffffffffffff) bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000000140)={@cgroup=r5, r7, 0x11, 0x0, r5, @void, @value=r7}, 0x20) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="030900000000", @ANYRES32=r0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="05000000000010000500"/28], 0x50) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000680)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0xfffffffe, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x1, 0x4}, 0x50) (async) syz_open_dev$mouse(&(0x7f0000000700), 0xdcb4, 0x2000) (async) r8 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') (async) socket$inet_smc(0x2b, 0x1, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) (async) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000040), 0x10000, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r9, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async) syz_fuse_handle_req(r9, &(0x7f000000bb40)="de98ee653502c564abeb97fc678bde22efebcf99c2d89952950acc703a3c6268a54c8b1bd1ee165c82980cd315b55a070dc41deeb2d4c1842d936a0bcde5fd7ed6031fdd9cb58ebfe8261528f097f309813b5722c24a1af8e6bc6ddaef7e85d2659690154bc5e6ee73c3fe7176509ad7b30e1098fc9873db91d3c1816825e710374de8d40693578b598922d9c523cfff93a630f121251d17ad40bce021d7fd57945fe2a186618a40b5f3995a9f0ceaa3e22b57e4f68e53fffeb5474fb83afaf5cde6b0aaf5cf0313ede442ddf1df6c280921e43d80dddfd005969272e1719b37fd8f749fcde83f8201826b4cf5b1c1da394568aa7d8833dd11309f46422b0152ede5ab29b17bc1ae80147346155b20a98d6fc2650bec3fe73327c45cad1b38f7c983cd070556a8f8ed5d58e1052f6436fad905099d18fb3e62c2c36a1c2209a94c820e30e5234e77be3beb4cd183015d281e7bf39cdcf0f1e541211c75d64a49b55ba4c2c444bef36d98df66bea814bab91ed65386d6a491a6295c24dbaf752a5e7a856e0dfe46a6f9e718ca3919c6f8978b0fd65c9e389114e5afd8e9e2a575b854463b63f46d08795f0f1d0d48d6d610fd74e9238de32ee3fa2ffef550336341803c083ac1d749be6c5440bbe4bd3bc3015bcde2b4e2160ba266d281a9641f74d9348fb6fa8550d1e8a8362999452e40b75c412cfa77ab8e1aaf1a9e83c855ec9b7ada38690f0d2e59f67a1f3babbcda8011595ea720816c24726b833beaca0a9d11e7b99373601d27d18c9e29940503d3a12149fdc4fe0065c3d023d6e7712eb853df19f2b4b886e08d61629288ff16c2597d7fae5bfc8b41f92fc325ffe0f61683b1f661409bdd7c3d88a854f8393484f4669b5d9654fd3a0819a32110b9064539a7419c332629b3fc71da35b783ef7c693842ce83733a63f2e6af37989cfcb768ab8cea5d21b82a0e9f6fdcec26b0107708867dec54c4e739fe9b931b3c6da013bfae097c57f1e16ba54f9028e672511938a0ad9d681d7feebc65a2f5f588abd66261393f3ba02d7b2cf650a9f7c6a4ca55b4d41132908dc9c90e26f0da8e2259e3a2b63b2d9e27754e278827ab80438070698c690ec375a9aeb4193079a28a2a062961ba0e65af01644af063f3ebefda92c4986379f7b099b2fd3960929578736f09887fc5816cb1b982e5b121b79662d1674dd0c6e82627cf8c63e576e5c1eb0af9415ddc10ff880e8ae3ce8c4fb87b8f9d364974c2a1d8eba4e04bc2bc018bfabc435683b2551c0e4908570b930c4fd7c03ddb95e9ec1d1994e3df0305fdac4e5b914641ae25b0c469b194c0bb78ab04887cdc4262da468475b926a18254d23b4c44705aeca34ef8a7b04dd55a43f39996529a23804e054655c5ba8661f7c02737e7539650364928d62b9b8d80988232009acb54214f06640e9bc6614c0ce02e4a22dc8b91a0aad711e4fd01d7020b7c7185e41e27ce266b9f5aec682cbd4bba3240d6277b17b564937254f37afe580cba0b78c6b0cc81830eaf10d7cc1f7e918d49e935629fe6c24b4368a04af1b99f6981340ee031874f3d4b3a9ebc31719b3b775bfe1fdfa0460a3820bff6f61b49b11ac2ca00836a0c4a74aed92a619f34231196669b942e761538e64f965d23d4f7814256e876263fe5307985c4e6eb69c974f66276764e80ab1de3f5c55e7b2cfdb78dd183a85473e968918ad73f29a266c818b9bf9f62eed86df25b2577bb6d98e3996e94f5bdf119b869541a94eb3536c979c3d77cc0df7c0c48a902ca2f03f5ba5a8ef9431cf95f6fc89744e8440e1d5ebb837e30ef7541fbc27672c31566ac3676a173cb9e466a2d206ba1ebc2b985eddcd6ff937375fbc8415eba46f5ec68cfa9f3a669d41b078867dd9f5160ba45fa4719f32cf877d4b7a6d77c977533659f7c7ac22c68f5e93c1df6c2a3d45b55a4afd3355680aed864f6bbe13da2da28a4851f73c88e555f3bb1c34a21fc45ab6c28287902e8b5fcae6899c804f364cd878a8d1734462bb075cb7bc709cc2c5d7747c4c29a2fa9259752301c26b852b7993adf889d45dbe39094c9b7b168756e5b939ed10bb6df57b8f5e14352cfc7d8b03cda5b978b06cf2430af5db17177b1ef664bc4b00307f970c4fc606a6bab72125f62b0f59655c35b104da7af188a953cfc09b3aa0785abf330830fefedcc8bf9a11d5dc4b5642f679d45cb44fe61ab1d906345c1c345f6b8027bae9585580c20115d2504d9c83ab54ea2557b6d2dd3bc65fa29f091aa46a215e77621836154104e6969fa9107139a19f2e45cc6bf55422a0e1a6d037ad9e63df5f9cd2045e13ac2d6a15bc12008c4cd23782df7d41bfecc0037292d22c7b42f2cc1a22db7502332d9f4fa85f7640c8635b9469681adb6bcec2dfdf6926f1815156d80a835ae918527f549ea6df45f350f618dc1f3ca139759be28e35013034f8bbfd3fa1a8f302594213c18015305911f42e287f2d86f17d76f8a0ea03fb574c60c808669f9f4454fc2eaf0e93873f688e34bd3341f6874d5d8fe754172a751d6ab23dc1642220e7fb1071df0ee3c7e07c338915494a3b360bdc0b38ed221c2c2bc86b29744448b255802b3ddfe600c1d0f9acabb2185e4e9dae5e456d5825f516c857f63e72e4a5f3d45eaf11a0e3a5ad0ba30a0bf0f94cc99586fd202d6118bb6f9c272f6cbe39dd9b8b36ea7fa51dfe0bb87a633be11c16a14d1bce8492387696e195fa3c5f172690b4434aa2e91ce7d225d73b1983d2605ec725aae0ae402cd2f79fc202a307f1896f3dfcf8c0fd8b841dcfeda5d65bb7d76f7c2d2eb1b164c0368e9984f320a224d7d438bc5c699acbc18a587b7589e960af114afbc9f59243646557962fc2e0cb5b5bf160a313bcfd9ade3e140b808e9f19415808aa312ae9c9e8bcd5a47fc721eda59d10670088714984a71d5c0df8b68e675a8e31ec15a92ff6a04d17e0ef849c782b302d11f742efe6486ab904fd65c0aac4ec25c6d877b453dce80e894de703aa8b1e5d00701850f149fe437fd0944cb95e54a924a49bd86bb9a602cf2904fbd9e399f1cdcd0b45b6d8f872e285f9dfeaa26aa760074651393c6451b36c643dd0b7236ec7803d69cec1b09bf1b63fbb68ad7c01507f00083b184ff01a62096f386f4c8fdc85e93eecf3f4b384aec1c10ccc60d8109a6d887bd389c3406163f9600879f0e944443d783e8644f69344f6f44f7bbf1883cda7369c9b9904d991c01552135f158a0bbb7f40c354f292c034824d82c209ebc770f5b756768ae51d45f8875b59904a07090689e65b40625566eed5d209130db812f287b966ae21ba46a3a7a3a0360a4e284d8d91ba9ed9806ea063827c8dda0fa98f758cbfa523ac645421f444a40b95bb065a64256c19354b1ad5002bb7b2add9b5236ad64e9052734b9d263515683db121b5e4dc1eab244dd8fc0fc62d962834ba0b21aad872b127afc0a33c7869a3f213519aa2ef51bab9ab28ed18859fd8239841a6668fc614dedd099121ae6c220a143c119cb9bff9068f65d0554b4c12105e59a22e91203a08ab8c718ec62c42d7ebb7b495e9e1be8fb7e4aab2777025da37b48d9d7b97578841a73898a6eab994e250106e096390c77b0600537be881ab7d81e3cb468bf1fe318b1e804d8df9875e9b8da22e6244997317391cce608085a28b8d070d654a29afab324ba3eecf427b6dfd43501ec0db919f71a932897eb37fe3bd64ab5a34ec60011696298b74ddd7a3710d3e444cedcc5cdc357f9dd58e67dc0ed3fc8df6dad82b3c00b4290c3280c28f78df052ec9cdd9df025abe8834616eddd5bb93379c69092911cd60761e7d14b426a83e335bfc8bf67a14e01df7cefb6023f0c6556534b975ed889de0d96d968526372402ce3d21a2c5c64a449dc3ba4ee0b5ceabc2fa29679e225681c8e946dc94b48af024bb1633e1860c7d8c14500967f24e2f8f46db537232a4e9f4abf8408f53bb52b035bdb89917a6f2f4bd22403ad002c2d936b785ecd965177e9f6235787a185d0eca92532f1aab16756ae86ece13925ba4a1fd08125102ae08c428d073aa426c4e792b5a4acf618605df1707021ce1eed62da4ee87334e34edf43338a0076b8ec739e2c31071e10c6a853e19fbf25b8a356527a67c8f7696dc184e374f4641f4e5b0aa345f1e6c4bfeba3a392d9a994bc271717a051c98d6c5b1f3296caf4c01d80ffb75b6fbdd0a0583f9d4695a44a2878df0c09a85aaab14522320cc3d2611603a34e52da03677a60cc87cc3c689975e5b5366c82e040b6643b8865d8bea0c84cef9ff85245a8b4bc41af1a50775b29fe55e42ac4b29fe80ddaf02e8c9bd07cab823f3d9021ac88236525ec045688a2fc9c6df66f549b10720cebf09ead919524f071cd128fb7575c84190c698b420f89b3c11195b5d83022d1f7e48afc21203995caf8f9286dcd5bd51b65c1af1caadf5a1b3f12579066855ff851075adb959dc3e086a7fb4e9a27fe80e8f3c0959b042486310ae7b785b0612e0385e36f50d4cae3474dd000c3957955534b4907b9480e2e5d83dedbeb76cb78d893c5b64dd51e31abc8e8b4c56b96f67c4b6e43861d91681af3270aae1a8f50712bd97326ee46a2640285b2902f051071d5a3400e99b76459956ac6908688c314bd8e54365383a65b186a6386cc5218e41e0b386759de81bccf5aa68f8608831a9d33ad1af2bdbd8579c5921cd8c3dd2f3bf1f123c742e118c76e2f43618bb7885e44826b7417c9ca5a139d774c16fbf74c8969c038ba6a54f27bab46ecc94d6455188d8dc1edf1da715c8d9976226877096df4158eeecced2248c7b88de0dd11a076db1f06bae4adba8286dc39aa62a55233886e011622ae1cf97238914a55078a78908145295777dbbc4e0d34364e0f3daa9eba6fa54c085777b18c0523818ff8710dee4bfeb3db549c3f38dde73b99a7b1b219282407a4e0ab3794089e21f6f2045ab6254ac3703903edb302fb2f0f97e47cca7969ad6b5b6cf27314137a04d5f4f29c193cfc5540592ab1342a1a9cbd514a7b4d6b23f724a5d7bfa6ffe8e3d9de29b8661139f179a0fafecf234f19bee75c25faffc765e02377d83e0ad0a0029c08f5c71595bc1b2fe88f0fe958f3f1f8ba6821ab834cab9bc902b2d47bd4b5ed52b5b0d7b3bc999b2f68879be39ddcb0428ce3a617b68c11459b746651f413d9e9a098cd2b5c0fcfd0ea1db2cde1672818d7bc73b053015692f9e9259a0153e3c9ac5e73e3343dd350cfbcaa57be93cc881a35063aec2db4ed71df2b1bd90b5ecbd84f399d4530c5450d622188423e151cec49673dc633e503c497d53843f4824750dc09abae9f2f465e92888715b6879f5edbab7bcd58f0899e1430ffb5f3063450945cb0fb3b5c3088ed6966c54dddae3aab489a80341b45a17cac02ae62749f209a7e16ecdfd86b43569c7b34511c65474acf2b2c18834e158e20957bf2320e4a6b9d63caea93b3a7dd4f7ba54443aba1ac2b6f2b27e1bf6f17d3fd1582462e0debc7069bb70e219654cbb99adfed54ab94329382163f2ab6710bb581d189cb3449a02c917c1f2d1d5f51958ce605fdb0e37ae5f3cb3f123276d43b2c26ea948dee863e0b679ecddf0fe41ce78bbca30167c9c7d6b0e9193c98090facd7205a490727e1ac49bb4d639348a32546007459c61c27bf8df87dd2ed3f3228b8193422a72d15f848bac13c6ffa7b8a767cf04866feb7c7a81267d7a8e890128d4709e4873223578aa7febdd562403c6092c0a3f6e0650772ede935ab6ef95e375bcbfa395e23ef1d73532388b845a95f158dc845a123f798176c73e177926d39abd38a910d40653006375110be2f2c5f6efc87b31908be36dd07c8ba5853519a37dfc4dea981af855293f49a3270bb67cdc17b780fbf2a418fcec8953dae927909a6bbbdce230d23113efad9c02474682dafc63311050cb4f3f86c282ff29728eefac5c678360122b4ce221bcec82d24e053b63972d2e9a631a180b48bb8d2d4de7254d91a856071df51a1d87ca7eb5d19ac3def1fdd6ebd8f57c2c9e43cb6ff2fa00d27f279368f5ee29a84ba219a51d1f0f1965781164edbb3aa6209fbce6d40284fbb4a33f59bf9e1248100a623de16613eebc11f510b7718dde9f13b4c9b2b6a10dd932696cdb7fa4b5733b0377453471462762457d42038ebf8c0fb392ca7656ad1f050c326de75fffc698c48f5d809ae360ddb9856b9a54b811073233294bf91e46414441b6665f432201da12e49718b0d7929b6cbcbf310a09ce0d22f07ee5cfa8ffb9f03acd224641171ffafdf50f18be8fa3c907226cc1a6f3b16a776781a6396dbf09f689ad6bba4d537dad490a6f036a45ee3e224e6f519e44b7352ee3e7d3f0d89f8c7c8f54b6d2698c0298a07866c9d9ca09c96c2ac8efd7974294df6dd1bb0598debadb6135e7123bbfddf84870de54476a291586fc0e64784e65fdf78d462e8b51cbac38e7ff1878b11418f188220e3deb5367a2d90ad7d44395f6965cc6d680c59daac268c16814d1085302d0453b48e4a8ae78b8a5b6951a875ef42776f6d11955da7e5734a72b61cefcc6889b8f8d58db51ee78d7b1a8ffebd90e15a64654054767aaec24dd3b5f338b572496c8731049c10622b7f54fdfa43aaea316946291fee7bc9e64640e8bccf33fd1e8693b67020b49cf77faaaa8269e2fecc4e2b43c8c3378a4a9b9b85a4fe2c346c5512cda631542e0ff5706eba996f4f72e629b076d6be1966d44b1835ce664e3c6a4f18c68f5e32f900a0a167e547d5aa79c0aede966f83d00366a623ef8107e328654c8558d5e606f69a12b6c2a6fcbe0e08f945c4ad2738ed0b28d79c98514abe0819569c6e4f4751c665fd651aaa9ee392c330560ef6d57c0a97f0764f88433b2bf7641ba391634316b0ee1dac23a63be21270e50ea1ac24ac3b429a0b46c38dbd48c540bfb1e141b8b3df6caa179c7e54f2b770711e8eb05a30f13da95200ab70dc58325f6bea0ee9fe1f04154998df393f2b4ff4431363f3a7450fa5210e883d67620ae63cc41f72e74e26a0244de1ac722b6f1c1d293f7483b331a0efda65a4e4e9144547fe6dce2f4535e29048b07079329b63754bb124b9e046a6e97929b1f4a387765bf93804530791c9f649db6efbebebf46fa4f9af7ff2587130d0e70a32d4aab1dfbee6aadd1f3e5317e3d4c8cde75b1479bc3dd16ea35db3dca11cf1eb1d2bbac60b83605e171619d85fd4b6d0e24be8db76df12efef05eb87473b832e59f3039df44ef034e5e7546b399cc817a41b2f020286ff139072a5b909ebb185a3c955cf88f4a9929b2112e0a9ab43da0288ce3ea268ccc9f46f852d387f5d0a2831dfc8cb0bf593905ba376c069b8c9b70558ec826c5bf9835031199c4c6d84c913da7e9e7db49c1d34511d917b9ad3c40af0598737d58fd61b8f2adc46b73a284957a99943cf73414412fa5440a5f85b63c20794d122c267fba72bfcd0e2741642fd8ff5a0ae1ffd8b30d852c053d0e31f505ca13a21c0223a8ee77cdd92de1b9f87ebee4ea332e9d4573d7efb2ad3f50c35fb7a596c4edb4b72bf6df5a16ffe3c8a236f2cab8c0712ac26c2cbcc68c1dc45209b579c952c7d645642aeed7d60407ee2dc168179d536da950108e962c5c976d3a05bf5142466ee38939ee94e707a0135f99c99b5d6376f63c711e4f64950f08dbc931c812f34735d9eb1c5997770d8159068cdca2e0f192311ca438d613728b544d6a3e50ae0e4e6b1eb611ce55a96bb2f991d49173073d8547f5ede69d8b587a34bb8f637297a15ab4fc45f1384bbd19b3feab5fb81322ba831386eeb6067e55af374c1b1eb9613a6c41dfe2bbbcfad157dd042c67c44400b350f0dc40a8611f2e947f32ea3ac3f609027b5dbc95b157c13216fe7c35edcc82950bd4e38bcb02b63d2576489c331a222e013e73b5333694889b184bedbbb6fdd6fd40a62b1d5d494e68cd2aefc264f74bf70ef38373e599faaa326f574ae32b1aad86854af22db8c9673d14666aa7c0c3bbe0d76a835ba4b391552777ed20c5c6cd0aa84f3be73ca0a3c128914107fb8fc02220317fb111cf13398480cd3325582a7e55f4c4ef5a258bcd01a97615e95f89c8064d41d04340b88cd5f4b1d827a030637145d98422facadbbbce97dc3060402a7bfa73d7b4dde53184a0923c0ee29c6e8e2c35e396808df2481af6aab053b619fcb2833f14f87051c5461567c5f8dd40383a7521971775493f896e18c78bad8219f88258ea686652780c03ebafb63ecbfcb23e24d52a2f88a77ed3b2280637807a5e155f4fad7149b76841772471a3b77aa42e8058c0af1ac2be9d88b5152851708f1a77582b3e31702864ee6a244a38f3f95d9797a60cddeb5ddf08cc48fc677f03f9e717ebe7f472883e5a6a7df31ca4272228f26991460c537ebc8aecb6a0c34a763eb1f57124fbfafd6db4c21bedf6723b252aeb21eb1fd9f4f811fd3e2e764422964761b2ef3aaaf986a48f7be66f6387578f9492feebc97dfbc6bc97380394a5635dbe582e52a1fb18ea8fc4e53974c63d198cf0d878ba8a8d58688a037c0f753c7073337ef3da4c134ef939c98c8806d09943591e6013a1342de7c722f993fd7eb36ba8e8407d1ea60eb5724b0d6262c70469dbd8ea1956b8d7f5a77707a9cbe2137079e7abda3966c5bee4fd86e8a3c4969bc88ff328a2adc8f4546f647575866d5ced16df06bf40d9a5f178f9d19e490bd76e187c441e7de0e571f6cea5512ec9bea48903d91a519dc82defe34a06b0244d623090b5a250786bbc66c1e76db6b18d81ed33c81a7c93782d5cdbe0a7cf7d1ab29c04be6ff4a9bbc10f716a67d52fd52d91425abd2002cf83c3797861db5fbeaec745a552ca4a50604340f2cf2c1b10e9ba76c8ea43b283c73f774f8be213f17f70cf93b9f6a8bab1f516a935e80c3cc6756945edafd572e6e00840eedf61fc40351869f03562d8c13006de585a1141c02f1311fbc8e45e4b3878c32810698e4764a6e8495f165eefee35714a1794f9ab50897c5565ab745425933d9d6272a172c1f2a274f9ca7bc8e1b01a27b8bd06fd9dc61880789696348c99e9a70c9dd2a62ca04d1f86dc87380b618c2a78b16229d614702fce242fa17ea90cda2648f9375bf7e78b4267d558983e08a9566d95871998d23cc6d22c23370ae067b677609844abc140df81cbd9addbf657fffaab5c22c479acca18f3e4b508cf01ff7b2ca308ff116389790f26f2c7635f89c747a5bc66f61de575653069349a89fd7e3dd785266b7bccf16eb8b4a8a86751de60d33e17d64f6e4e0f9d13a16d243ad7364114db7ad011f094c4debf20a39e35e7eeb440bbe8811db2857b965edd1e2675ceb1bc9a1691f123dedb341962fbbe539485d2241b0409adce2587d035187a0dd5a62076ac4eb5c3e2f4455569b6eac0fc16155da1774cbe505dc92e2087585a7846bae699bef32e3c5ec2356dd4433ed29d4b03ff7b38f7b3cb96b92874eefda6c2e0e326214e40f14cc2ef80e1cd3fe226257a423b8ff5bb368b87ac7066c5136487775b5b122a858334c37f6a3f53d758c3c866e2e79daf9aeab36a59eddbae2fa5b6d20973014196ef0a4cde1373c7297833e6f1e46828f4a42eebd829dd4f17999abe285218ed5dc6007b21bceb588a213b29dbb1ab1a79b41a12df26fe35f0cf6a310c9e50cf10d71ad5960626e4efec211032ec4ae52512001362ba4108d86eb774d2d4d0364cbb1dae68f03a774e328c2dc09899ee80c05ac2a8e3ba905b0b3b7a08a3df20b505901123e7dc0a15db48d09c84189ca4345c23c2010c12cc35287fad30211cab9631e148a7c1e8bfab61ced30e098d1c3cf7b6a7fbd8288dfdc48044d0d47c17f129f6b5d751af1984d395ab1b08ccca3e7309a89a8a36dfc3fb82d2a4269bffc32571438d04a7b98137b46ae1fea1bd9ea64f99e2f0c5f12ed84886b10bbd511993b0447036c4e57b9dae6d5bdad6aa3f2d12e62471194e43111613b8b6944c2baf1f539ea14dd76c356bfef7e3d4b6fb91f6d321a796a4bce5a4c6a5caaf0f3eccd914dea21ae909be7ba486075ff6139e7e351fdd7e98013ba51ff0248852398c734f245ffd7fde8cacfa4805496ad7350b1c96d7bf9da9be492f2f414e973937ac9109b6e8b8315aa9b81840f2c21239caf85a28f0e590bb6ad12148e75bd4d7ea69a9ffb053781db98d5fb5aca30a734017be7683a559c203c006ecd4b135afe3650b906e0aa208c889f2af09f3f8263260c3bd07cf8021124b6f0e0d021f9839e47996905c3d7562df810484552de3bcc9ae054b62a01af6a7991e4d63f30c7a92d8b58e01052e53818e64d7540a3208af321709a5d891ceecae5d27a999b00ed01616a73ec8854ca61973ed1fd3d82f8628b215c55eb7908e297d77098a7b0c362709005a7d13c89c54556589b2a926c6e08cc1c0afebc7eeb5d7ae4ef0507c91b8e706e6dbf83d898819192c812554ad1c6377871a8ca50f1325630f7b5266b807ef61d0c8d399fada49cb02a14c16d39f4fa7b81272573808e761c9dce7cfd12f4f18dd06b0ee471c166e095bf84aa4aaa2d82f1afcf09e5d960257c0a8dc404225b4b62187829c59e57da50bf848d72fabfb69362c117c6913541f84095a2a4ccdd2d30860cd96640bb2315e435a4af08c62c584ad129300adb02a871f3c548b96c4f6c47efdf4a1163a8a5ba9b4766b01437bc5957324660a8cd87df0f7e000d1309e896e3ce9f57b17562c9368a95a4cf66b3a5b57f0cca563b045452bbc8ad07b96fd0322728ccb3b05bfda14ef36ecfa2f32c5aa899811a67f2d62ed970db5723d6e4e4913c98c81ed6c03469112c23549f7e20be6401c6544db9078f34e6a4ad3cc868bace2e7ec6ea17225986f9e941ec67d9a3fc57958f9df8a60f585aa38b1769e26ed3f68dd85685b2cefae9dd72a18abc0de6b94689785df377ef4a812a6abc7f738a396f0e99ccbc5731801c36e746ab6b1dda88ca6ecb899528e18543cb3dfd439cd5be566594f01a4533da3638e6331fedf5b67870938ad044aa0dfdae33e3a6258ad40baadd726eacb1f3c1eb8d83ef4e185d7603a4f1eb006d90bf5849e2f65d37ffe750eb061bbad08a0c0cfabb9abf7f27d36ee5687d23feaa923e09d2ae905410a9193f21ed9b1d6331bb1f3babb90da2f2e023a6ceda4b4fe0f5d864738ee7f65a0b136021fbe076b4adf2d3af760e1361bad7ae35cb7ca010ddf4488255a2d3c492d0b26a1a5643f998b5d04a52a59f176d9bda85c916ff901329f09fe953b030b92f6415172476ad89d3e8cdcb4eda7dde5d4fcd5d6a584a312563558e784b0f9bcea7c53d26c3f2d3350c70a5e06a67c4c0373dd6279e29c320e6580fba8ab2df3039c289235c066af1b07dd112f25b25e292020f36c1aba246cba4e054d64b38f53ed57a712dffad7d3dc97f86af511638a2779107fc55da63b6498ea5f3ae36883163e5bf2324211a61a9889278f828e58daae797fdba9218d322da7aa23db7a48a00", 0x2000, &(0x7f0000007a80)={&(0x7f0000006400)={0x50, 0x0, 0x1ff, {0x7, 0x29, 0x1, 0xa748a1016cff1f1b, 0xdd1, 0x7, 0xb, 0x800, 0x600, 0x0, 0x182, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) openat$binfmt(0xffffffffffffff9c, r8, 0x42, 0x1ff) (async, rerun: 32) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x18, 0xf, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x105, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000001c0)='syzkaller\x00', 0xea1, 0x78, &(0x7f0000000400)=""/120, 0x40f00, 0x60, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000480)={0xa, 0x4}, 0x8, 0x10, &(0x7f00000004c0)={0x400003, 0x1, 0xc, 0xfbf9}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000740), &(0x7f0000000780)=[{0x2, 0x2, 0x8, 0x4}], 0x10, 0x6}, 0x94) (rerun: 32) 1.601908352s ago: executing program 3 (id=419): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='stack\x00') read$FUSE(r0, &(0x7f0000002780)={0x2020}, 0x5ecfb203) r1 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) r2 = socket$igmp(0x2, 0x3, 0x2) ioctl$XFS_IOC_RTGROUP_GEOMETRY(r1, 0xc0805841, &(0x7f0000000000)={0x22d, 0x81, 0xfffffd0f, 0x7, 0x769}) setsockopt$MRT_DONE(r2, 0x0, 0xc9, 0x0, 0x0) ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000001080)={0x8, 0xf6a, 0x4, {0xd, @win={{0x7, 0xdc, 0x40009}, 0x7, 0x9, 0x0, 0x5, 0x0, 0x6}}, 0x7}) 1.512784257s ago: executing program 3 (id=420): bind$netlink(0xffffffffffffffff, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x100000000) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000004c0), 0x0) r3 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098", 0x38}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f", 0xfffffffffffffd80}], 0x3, &(0x7f0000000380)}], 0x1, 0x40800) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000280)="0f060f01c465f2ac0fc7abb7b7602e0f20a4b882008ee0f0839200006b660ff33966f2f086771c", 0x27}], 0x1, 0x68, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000002c0)={0x0, &(0x7f00000001c0)=[@set_irq_handler={0xc8, 0x20, {0x7e}}, @nested_amd_stgi={0x17e, 0x10}, @nested_load_code={0x12e, 0x57, {0x3, "642e66460fe74c37e6460f79c166baf80cb82430c284ef66bafc0cb8ec000000ef450f2ea600000000400fbe78002ecd2f400f01cfc441c1d80ef3af4724fc"}}], 0x87}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="660f388173ab0fc76fb4360fc9bb25cc00007666ba6b41b000f303c70fae6e2fc0c00f0f2367260f01ca660f38817700c4c2459d78ad", 0x36}], 0x1, 0x51, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0xe501, 0x3, 0x208, 0xb8, 0xa, 0x1000000, 0x0, 0x0, 0x170, 0x230, 0x230, 0x170, 0x223, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3b9, 'syz0\x00'}}}, {{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3c0, 'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x268) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r10, 0x4008ae93, &(0x7f0000000040)=0x4) ioctl$KVM_SET_REGS(r10, 0x4090ae82, &(0x7f0000000440)={[0x3ff, 0x2, 0x3, 0x7fffffffffffffff, 0x58f24868, 0x3, 0x7f, 0x80000001, 0x1, 0x0, 0x4, 0x1000, 0x3ff, 0x8, 0x7, 0x8001], 0x54000, 0x100204}) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x4, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c71b95a9847d2bdede66c6e3184c386faf938fd6db888e73a5c0dcc69c3de7458e68ed33226a8d1c8e17", 0x0, 0xb2}) 1.191333419s ago: executing program 1 (id=422): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000100), 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x22, &(0x7f0000000000)=ANY=[], 0x0) io_uring_enter(0xffffffffffffffff, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r3) getsockname$packet(r3, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c000000100037040100"/20, @ANYRES32=r4, @ANYBLOB="83000500012c00001c0012800e00010069703665727370616e000000080002800400"], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x40850) sendmmsg$inet(r2, &(0x7f00000018c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1=0xe0000306}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) 1.190805727s ago: executing program 1 (id=423): bind$netlink(0xffffffffffffffff, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000004c0), 0x0) r3 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098", 0x38}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f", 0xcd}], 0x3, &(0x7f0000000380)}], 0x1, 0x40800) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000280)="0f060f01c465f2ac0fc7abb7b7602e0f20a4b882008ee0f0839200006b660ff33966f2f086771c", 0x27}], 0x1, 0x68, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="660f388173ab0fc76fb4360fc9bb25cc00007666ba6b41b000f303c70fae6e2fc0c00f0f2367260f01ca660f38817700c4c2459d78ad", 0x36}], 0x1, 0x51, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x9) r8 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0x723502, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x88002, 0x0) ioctl$CDROM_LAST_WRITTEN(r8, 0x5395, 0x0) 1.013286339s ago: executing program 2 (id=424): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000447995993c9f1c000000ccf90000000000000000"], 0x50) (async) close(0x3) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$inet(0x2, 0xe, 0xfffffffd) sendmsg$inet(r1, &(0x7f00000000c0)={&(0x7f0000000040)={0x2, 0xfffd, @loopback}, 0x10, &(0x7f000000c540)=[{&(0x7f0000000280)='\b\x00', 0x2}, {&(0x7f000000b540)="920ca227df65", 0x6}], 0x2, &(0x7f000000b440)=ANY=[@ANYBLOB="1c000000000000000000000007"], 0x20}, 0x20000890) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYRES8], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r2, r2}, 0x4) (async) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="30000000020901040000000000000000010000010800053fffffee2008000340000001000900010073797a3000000000"], 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000640)=@framed={{}, [@map_fd={0x18, 0x0, 0x2, 0x0, r0}, @ldst={0x1, 0x3, 0x3}]}, &(0x7f0000000d40)='syzkaller\x00'}, 0x90) 1.012833421s ago: executing program 2 (id=425): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@ipv6_getaddr={0x34, 0x16, 0x11, 0x70bd2c, 0x25dfdbfe, {0xa, 0x0, 0x40, 0xff, r2}, [@IFA_ADDRESS={0x14, 0x1, @mcast2}, @IFA_TARGET_NETNSID={0x8}]}, 0x34}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r6 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r6, 0x40106f52, &(0x7f0000000040)={0x3b, &(0x7f0000001940)=[{0x1c, '\x00', @data=0x6, 0xd}]}) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@newtfilter={0x54, 0x2c, 0xd3f, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0x2, 0x4}, {0x0, 0x9}, {0x6, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8848}, @TCA_FLOWER_KEY_MPLS_OPTS={0x18, 0x63, 0x0, 0x1, @TCA_FLOWER_KEY_MPLS_OPTS_LSE={0x14, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_MPLS_OPT_LSE_LABEL={0x8, 0x5, {0x20000, 0x0, 0x1}}, @TCA_FLOWER_KEY_MPLS_OPT_LSE_DEPTH={0x5, 0x1, 0x7}]}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x20040054) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r4) sendmsg$NL80211_CMD_CONNECT(r4, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0xac, r7, 0x200, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x7, 0x7e}}}}, [@NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x1c20, 0x0, 0x6, 0x0, {0x80, 0x5, 0x0, 0x8, 0x0, 0x0, 0x1, 0x3}, 0x400, 0x7, 0x2}}, @NL80211_ATTR_BSS_SELECT={0x30, 0xe3, 0x0, 0x1, {0x2c, 0x0, [@NL80211_BSS_SELECT_ATTR_RSSI={0x4}, @NL80211_BSS_SELECT_ATTR_RSSI_ADJUST={0x6, 0x3, {0xa, 0x9}}, @NL80211_BSS_SELECT_ATTR_RSSI_ADJUST={0x6, 0x3, {0x8, 0x80}}, @NL80211_BSS_SELECT_ATTR_RSSI_ADJUST={0x6, 0x3, {0x4, 0x10}}, @NL80211_BSS_SELECT_ATTR_RSSI={0x4}, @NL80211_BSS_SELECT_ATTR_RSSI_ADJUST={0x6, 0x3, {0x8, 0x8}}]}}, @NL80211_ATTR_BSS_SELECT={0x24, 0xe3, 0x0, 0x1, {0x20, 0x0, [@NL80211_BSS_SELECT_ATTR_RSSI={0x4}, @NL80211_BSS_SELECT_ATTR_RSSI_ADJUST={0x6}, @NL80211_BSS_SELECT_ATTR_RSSI_ADJUST={0x6, 0x3, {0xa, 0x6}}, @NL80211_BSS_SELECT_ATTR_BAND_PREF={0x8, 0x2, 0x468}]}}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x6}], @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x9}]}, 0xac}, 0x1, 0x0, 0x0, 0x50}, 0x24000004) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f00000002c0)={0x0, 0x9, 0x3}, &(0x7f0000000340)=0x8) r9 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r10, @ANYBLOB="0000000003120100500012800b0001006272696467650000400002800800050001000000060027"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0xe, 0xb, 0x0, 0x0}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$nl_route_sched(r9, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0xc048094) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r4, 0x84, 0x23, &(0x7f0000000380)={r8}, 0x8) 932.26401ms ago: executing program 0 (id=426): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0xbe, &(0x7f00000007c0)=ANY=[@ANYBLOB], 0x0) shmctl$IPC_RMID(0x0, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x29) pread64(0xffffffffffffffff, &(0x7f000001a240)=""/102400, 0x19000, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x4c, 0x10, 0x100, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104, 0xa01}, [@IFLA_MASTER={0x8, 0xa, r5}, @IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}, @IFLA_GSO_MAX_SEGS={0x8, 0x28, 0x74c9}, @IFLA_EXT_MASK={0x8, 0x1d, 0x9}]}, 0x4c}, 0x1, 0x0, 0x0, 0x22004000}, 0x0) pread64(r4, 0x0, 0x0, 0x80) socket$packet(0x11, 0x2, 0x300) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000140)={0x34, r2, 0x1, 0x0, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x0, 0x0, @l2={'eth', 0x3a, 'team0\x00'}}}}}, 0x34}}, 0x20042000) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) syz_genetlink_get_family_id$tipc(0x0, r1) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000840}, 0x40) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001400)=[{{0x0, 0x0, 0x0}, 0x18}], 0x1, 0x1, 0x0) 931.636813ms ago: executing program 3 (id=427): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000000), 0x18200, 0x0) ioctl$CDROM_GET_MCN(r2, 0x5311, &(0x7f0000000080)) syz_emit_ethernet(0x3e, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000108004500003000000020fc0190781c10fb4de00003000306907800fa000945f4fff600650005010400030a0101027f000001"], 0x0) 823.067291ms ago: executing program 3 (id=428): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/ipv6/conf/syzkaller0/use_tempaddr\x00', 0x1, 0x0) write(r4, &(0x7f0000000300)='2', 0x1) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@ipv6_newaddr={0x34, 0x14, 0x1, 0x8, 0x0, {0xa, 0x40, 0x0, 0x0, r3}, [@IFA_LOCAL={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @IFA_FLAGS={0x8, 0x8, 0x100}]}, 0x34}}, 0x20080044) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x94, 0x7fff0000}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2210088, &(0x7f0000000580)=ANY=[@ANYBLOB="74f5026e733d76697274696f2c70726976706f72742c646972656374696f2c63616368653d6c6f6f73652c6d73697a653d307830303030303030303030303031303030"]) chdir(&(0x7f0000000100)='./file0\x00') r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='blkio.throttle.io_service_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r7, 0x0) ftruncate(r7, 0x800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000000), 0xfea7) close_range(r6, 0xffffffffffffffff, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0e00010002"], 0x8) 752.287251ms ago: executing program 2 (id=429): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x4bd1bfda, 0x0, 0x6}, 0x1c) socket$kcm(0x10, 0x2, 0x4) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000080)='9p\x00', 0x1215811, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=@newtaction={0x68, 0x30, 0x829, 0x0, 0x0, {}, [{0x54, 0x1, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x0, 0x0, 0xe4}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x2}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@remote, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e26, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d8, 0x6c}, @in=@loopback, {0x1, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffc0, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0x7}, 0x70bd2a, 0x3504, 0xa, 0x2, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000040)={0x30, r4, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0x14, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HWMP_ROOT_INTERVAL={0x6, 0x18, 0x5}, @NL80211_MESHCONF_HOLDING_TIMEOUT={0x6, 0x3, 0xa6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4044815}, 0x20004004) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001080)=ANY=[@ANYBLOB="140000001800010324bd7002fadb030013000000"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$NL80211_CMD_ADD_TX_TS(r6, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, 0x0, 0x100, 0x70bd2b, 0xb0, {{}, {@void, @void}}, [@NL80211_ATTR_TSID={0x5, 0xd2, 0x2}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x28}, 0x1, 0x0, 0x0, 0x14}, 0x80) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) mkdir(&(0x7f0000000000)='./cgroup\x00', 0xc0) 693.086396ms ago: executing program 2 (id=430): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$nfs4(&(0x7f0000000300)='127.0.0.1:/\x00', &(0x7f0000000200)='./file0\x00', &(0x7f0000000400), 0x0, 0x0) close(0x3) 692.587061ms ago: executing program 3 (id=431): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000100), 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x22, &(0x7f0000000000)=ANY=[], 0x0) io_uring_enter(0xffffffffffffffff, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r3) getsockname$packet(r3, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c000000100037040100"/20, @ANYRES32=r4, @ANYBLOB="83000500012c00001c0012800e00010069703665727370616e000000080002800400"], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x40850) sendmmsg$inet(r2, &(0x7f00000018c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1=0xe0000306}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) 686.698502ms ago: executing program 2 (id=432): bind$netlink(0xffffffffffffffff, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000004c0), 0x0) r3 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098", 0x38}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f", 0xcd}], 0x3, &(0x7f0000000380)}], 0x1, 0x40800) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000280)="0f060f01c465f2ac0fc7abb7b7602e0f20a4b882008ee0f0839200006b660ff33966f2f086771c", 0x27}], 0x1, 0x68, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) (fail_nth: 3) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="660f388173ab0fc76fb4360fc9bb25cc00007666ba6b41b000f303c70fae6e2fc0c00f0f2367260f01ca660f38817700c4c2459d78ad", 0x36}], 0x1, 0x51, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x9) r8 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0x723502, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x88002, 0x0) ioctl$CDROM_LAST_WRITTEN(r8, 0x5395, 0x0) 346.291892ms ago: executing program 3 (id=433): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0xbe, &(0x7f00000007c0)=ANY=[@ANYBLOB], 0x0) shmctl$IPC_RMID(0x0, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x29) pread64(0xffffffffffffffff, &(0x7f000001a240)=""/102400, 0x19000, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x7, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104, 0xa01}, [@IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) pread64(r4, 0x0, 0x0, 0x80) socket$packet(0x11, 0x2, 0x300) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000140)={0x34, r2, 0x1, 0x0, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x0, 0x0, @l2={'eth', 0x3a, 'team0\x00'}}}}}, 0x34}}, 0x20042000) (fail_nth: 4) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) syz_genetlink_get_family_id$tipc(0x0, r1) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000840}, 0x40) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001400)=[{{0x0, 0x0, 0x0}, 0x18}], 0x1, 0x1, 0x0) 193.765755ms ago: executing program 1 (id=434): sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f001000000010104200000000000000002000000240001801400018008000100e000000108000200000000000c0002800500010000000000240002800c00028005000100000000001400018008000100e000000108000200ac1e00010800074000000000080008400000000280000d8014"], 0x1f0}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) getpeername(r0, &(0x7f0000000300)=@x25={0x9, @remote}, &(0x7f0000000380)=0x80) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000100001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r1, 0x0, 0x33, &(0x7f0000000040)=0x80000003, 0x4) listen(r1, 0x2) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r2, 0x0, 0xf, &(0x7f0000000040)=0x80000003, 0x4) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreq(r3, 0x0, 0x20, &(0x7f0000000000)={@multicast2, @empty}, 0x8) listen(r2, 0xd) r4 = socket(0x10, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES8=r2, @ANYBLOB="0200000000008000800012000800010076746936740002"], 0xa0}}, 0x0) 166.115937ms ago: executing program 1 (id=435): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@newsa={0x1a0, 0x10, 0x1, 0x70bd2d, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64}, {@in, 0x0, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x2c}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x8000000, 0x200}, {0x0, 0x0, 0x2}, 0x0, 0x0, 0xa, 0x1, 0x0, 0xcd}, [@algo_crypt={0x48, 0x2, {{'cbc(aes)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x80ff, 0x70bd25, 0x0, 0x0, 0x70bd28, 0xeaa}}, @algo_auth_trunc={0x4c, 0x14, {{'cmac(aes)\x00'}, 0x0, 0x18}}]}, 0x1a0}}, 0x0) socket(0x2b, 0x3, 0x0) 72.460771ms ago: executing program 1 (id=436): socket$nl_generic(0x10, 0x3, 0x10) r0 = epoll_create1(0x0) (async, rerun: 64) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) (rerun: 64) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) (async, rerun: 64) write$sndseq(r1, &(0x7f0000000080)=[{0xe, 0x0, 0x0, 0x73, @tick, {}, {0xe}, @result}], 0x1c) (async, rerun: 64) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r2, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) (async) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_UIE_ON(r3, 0x7003) (async, rerun: 64) ioctl$RTC_SET_TIME(r3, 0x4024700a, &(0x7f0000000000)={0x29, 0x19, 0x5, 0x13, 0x0, 0x80, 0x2, 0x6e}) (rerun: 64) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0xc000001d}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) (async, rerun: 64) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) (async) r7 = dup3(r6, r5, 0x0) (async) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) (async) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x7) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x800, 0x2}) (async) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r5, 0x10000000000) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000004a40)={0x4c, 0x0, &(0x7f0000002100)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x54, 0x0, &(0x7f0000000ac0)="f0a75915c3415afdb48f193d1a39cf97f35348c775196262c72d44d6feb667daa257a3283a26087753e1d3ad2c1ad86bea37b02acf73a9feaef681ae543f92be04ec63d3fe774f306a6b13d00878affbc182d455"}) (async) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a0bfc0000000000000000020000000900010073797a30000000000900020073797a320000000014000000110001"], 0x54}}, 0x0) 71.931542ms ago: executing program 0 (id=437): r0 = socket$alg(0x26, 0x5, 0x0) accept4(r0, &(0x7f0000000280), &(0x7f0000000240)=0xc, 0x80800) (async) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-vaes-avx512\x00'}, 0x58) (async) syz_emit_ethernet(0x6a, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c20000000180c200000100004500005c000000000011907800000000e00000014e2517c100489078030000000200000062b9d705aa3b572cab9e4565145b574ad6d3761751672cccdb8ca1cbebfda570f2cfeada7bbd8bd6f8864257d91a249bc2dfb32bfb8b524b"], 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) getsockopt$sock_buf(r1, 0x1, 0x3d, 0x0, &(0x7f0000000100)) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100)="00112233445566778899aabbccddeeff", 0x10) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) (async) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x2) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f00000000c0)=@n={0x1, 0x3, @SEQ_NOTEON=@note=0x75, 0x24}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000003c0), 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc058534f, &(0x7f0000000400)={{0x0, 0x1}, 0x0, 0xfffffffe}) r3 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000080)="00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x20}], 0x1, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000000000017010000030000000000000000000000000000000000000017010000020000000c0000000011220c545566778899aabb000000000000eeff16010000040000001000000000000000109670c62fcc4093b7f5734d942e40e116da19d29e37b362f47002ff209d6410659e5deceabeccffaa1035d7aae81ab64a1328344aa73fae05d1d53ef831c8296a719136cb760df144d2844b2f6e24895a28fd90732f752ac90f467fedfc"]}, 0x0) (async, rerun: 64) read$alg(r3, &(0x7f0000000600), 0x20) (rerun: 64) unshare(0x6a040000) syz_usb_disconnect(0xffffffffffffffff) (async, rerun: 32) mlock(&(0x7f0000ff8000/0x2000)=nil, 0x2000) (rerun: 32) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0xffffffff, @private0, 0xfffffffe}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000080)={r5}, &(0x7f0000000180)=0x8) (async, rerun: 64) socket$kcm(0x10, 0x2, 0x10) (async, rerun: 64) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000000)=@req3={0x410000, 0x100000001, 0x210000, 0x1, 0xa, 0x0, 0xffffffff}, 0x1c) (async) r6 = add_key$user(&(0x7f0000002100), &(0x7f0000002180)={'syz', 0x1}, &(0x7f00000021c0)='b', 0x1, 0xfffffffffffffffe) r7 = add_key$user(&(0x7f0000000040), &(0x7f0000002340)={'syz', 0x3}, &(0x7f0000000100)="370c099069effa43de3e1404db09b4ce1ef77bde4b371532dd16447c1b13403656c86711f6e750026f23029a50d44299c7bf5c78dc5efae2d041016160e8bef7b30c05e298aa9572540dd950307987eef2115e1bcf512bea3410ca5a9e9f827e4b13490dbbd4fc5a45e0738b959acafd2c12863045265bcbc2c9426ac3f614746b436fe86a72dc642dd67d970604a69b4f22cd0076beedc18056ab4bea4c825b69a7a77adcd5488684872b1bb9eb84586549e11b080468668e8fd0e52ce0705a", 0xc0, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000400)={r6, r7, r6}, &(0x7f0000000440)=""/183, 0xb7, &(0x7f00000003c0)={&(0x7f0000000340)={'rmd160-generic\x00'}}) (async) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r8, 0xc08c5332, &(0x7f00000002c0)={0x0, 0x0, 0x0, 'queue1\x00', 0x8}) (async) write$sndseq(r8, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) (async) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r8, 0x4040534e, &(0x7f0000000140)={0x1e6, @tick=0x9}) 0s ago: executing program 1 (id=438): r0 = syz_open_dev$swradio(&(0x7f00000046c0), 0x1, 0x2) preadv(r0, &(0x7f0000001300)=[{&(0x7f0000000100)=""/200, 0xc8}], 0x1, 0x1000, 0x3f2f0fde) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r1, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x48d, 0x0, 0xfffffff7}]}) r5 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r5, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="013deadd902100008e92074e530040000000060000000800007157635703171cae8cb249499fab4c5c1232c526e23b6dcbc45af99af334713508142c17050f6fe3f75e2862d371543ce14662ef5e9bb5e8621ecce2a8f5ca30936952db50fb70281912b82633f55998", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r6}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$KVM_REINJECT_CONTROL(r5, 0xae71, &(0x7f0000000140)={0xb}) kernel console output (not intermixed with test programs): sim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.272692][ T5732] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 51.285566][ T5733] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 51.337145][ T89] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.340619][ T89] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.363868][ T117] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.369433][ T117] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.370559][ T5733] veth0_vlan: entered promiscuous mode [ 51.380200][ T5732] veth0_vlan: entered promiscuous mode [ 51.388883][ T5732] veth1_vlan: entered promiscuous mode [ 51.392507][ T5733] veth1_vlan: entered promiscuous mode [ 51.414506][ T5736] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 51.415035][ T5738] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 51.438430][ T5732] veth0_macvtap: entered promiscuous mode [ 51.442758][ T5733] veth0_macvtap: entered promiscuous mode [ 51.446707][ T5732] veth1_macvtap: entered promiscuous mode [ 51.456266][ T5733] veth1_macvtap: entered promiscuous mode [ 51.494315][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 51.507771][ T5732] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 51.512002][ T5738] veth0_vlan: entered promiscuous mode [ 51.520046][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.525886][ T5732] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.538725][ T5738] veth1_vlan: entered promiscuous mode [ 51.543206][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.551261][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.561932][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.564924][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.581550][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.585143][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.595189][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.598854][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.658000][ T5738] veth0_macvtap: entered promiscuous mode [ 51.667768][ T89] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.669458][ T5738] veth1_macvtap: entered promiscuous mode [ 51.670844][ T89] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.695477][ T117] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.699108][ T117] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.721202][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 51.730550][ T5881] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.733525][ T89] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.734080][ T5881] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.736425][ T89] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.765834][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.790917][ T5811] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.795406][ T117] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.795504][ T5811] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.799206][ T117] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.809725][ T5811] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.812591][ T5811] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.906448][ T1167] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.911994][ T1167] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.956667][ T1167] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.959991][ T1167] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 52.070120][ T5892] netlink: 'syz.1.5': attribute type 1 has an invalid length. [ 52.190929][ T5898] netlink: 'syz.1.5': attribute type 10 has an invalid length. [ 52.192363][ T5894] warning: `syz.0.1' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 52.198005][ T5898] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5'. [ 52.211266][ T5898] dummy0: entered promiscuous mode [ 52.256522][ T5900] xt_cluster: node mask cannot exceed total number of nodes [ 52.276711][ T5900] netlink: 160 bytes leftover after parsing attributes in process `syz.0.6'. [ 52.295890][ T5900] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=6 sclass=netlink_route_socket pid=5900 comm=syz.0.6 [ 52.604499][ T5903] bridge_slave_0: left allmulticast mode [ 52.606781][ T5903] bridge_slave_0: left promiscuous mode [ 52.657873][ T41] usb 7-1: new low-speed USB device number 2 using dummy_hcd [ 52.663267][ T5903] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.669868][ T5903] bridge_slave_1: left allmulticast mode [ 52.671728][ T5903] bridge_slave_1: left promiscuous mode [ 52.673682][ T5903] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.684744][ T5903] bond0: (slave bond_slave_0): Releasing backup interface [ 52.698836][ T5903] bond0: (slave bond_slave_1): Releasing backup interface [ 52.706362][ T5903] team0: Port device team_slave_0 removed [ 52.713055][ T5903] team0: Port device team_slave_1 removed [ 52.715229][ T5903] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 52.724340][ T5903] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 52.730272][ T5903] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 52.733663][ T5903] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 52.739475][ T5093] Bluetooth: hci1: command tx timeout [ 52.739503][ T5741] Bluetooth: hci2: command tx timeout [ 52.739523][ T64] Bluetooth: hci3: command tx timeout [ 52.739550][ T64] Bluetooth: hci0: command tx timeout [ 52.741677][ T5903] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 52.761447][ T5906] team0: Port device xfrm0 added [ 52.763468][ T5909] tipc: Started in network mode [ 52.766024][ T5909] tipc: Node identity ae6f9a277b72, cluster identity 4711 [ 52.780072][ T5890] syz.3.4 (5890): drop_caches: 2 [ 52.782216][ T5909] tipc: Enabled bearer , priority 0 [ 52.951033][ T5918] gfs2: Unknown parameter '¶€' [ 53.406994][ T50] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 53.417398][ T5931] scsi_dev_info_list_add_str: bad dev info string 'end' '' '' [ 53.435904][ T42] kauditd_printk_skb: 57 callbacks suppressed [ 53.436386][ T42] audit: type=1400 audit(1785375377.428:228): avc: denied { unmount } for pid=5736 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 53.482855][ T42] audit: type=1400 audit(1785375377.478:229): avc: denied { read write } for pid=5933 comm="syz.2.15" name="fuse" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 53.492872][ T5930] capability: warning: `syz.1.13' uses deprecated v2 capabilities in a way that may be insecure [ 53.495043][ T42] audit: type=1400 audit(1785375377.478:230): avc: denied { open } for pid=5933 comm="syz.2.15" path="/dev/fuse" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 53.501608][ T5930] 9pnet_fd: p9_fd_create_tcp (5930): problem connecting socket to 127.0.0.1 [ 53.511031][ T42] audit: type=1400 audit(1785375377.508:231): avc: denied { create } for pid=5933 comm="syz.2.15" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 53.518939][ T42] audit: type=1400 audit(1785375377.508:232): avc: denied { ioctl } for pid=5928 comm="syz.1.13" path="/dev/vhost-net" dev="devtmpfs" ino=1299 ioctlcmd=0xaf00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 53.537071][ T50] usb 8-1: device descriptor read/64, error -71 [ 53.664214][ T42] audit: type=1400 audit(1785375377.658:233): avc: denied { create } for pid=5937 comm="syz.2.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 53.668801][ T5938] binder: Bad value for 'max' [ 53.672277][ T42] audit: type=1400 audit(1785375377.658:234): avc: denied { ioctl } for pid=5937 comm="syz.2.16" path="socket:[8068]" dev="sockfs" ino=8068 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 53.683263][ T42] audit: type=1400 audit(1785375377.658:235): avc: denied { write } for pid=5937 comm="syz.2.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 53.691139][ T42] audit: type=1400 audit(1785375377.658:236): avc: denied { read } for pid=5937 comm="syz.2.16" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 53.701984][ T42] audit: type=1400 audit(1785375377.658:237): avc: denied { open } for pid=5937 comm="syz.2.16" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 53.719845][ T5940] netlink: 'syz.2.17': attribute type 2 has an invalid length. [ 53.730894][ T5940] : entered promiscuous mode [ 53.777108][ T50] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 53.778717][ T5824] tipc: Node number set to 3575487015 [ 53.813797][ T5948] ntfs3: Unknown parameter 'discard' [ 53.873877][ T5953] FAULT_INJECTION: forcing a failure. [ 53.873877][ T5953] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 53.880485][ T5953] CPU: 1 UID: 0 PID: 5953 Comm: syz.2.23 Not tainted syzkaller #0 PREEMPT(full) [ 53.880509][ T5953] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 53.880530][ T5953] Call Trace: [ 53.880537][ T5953] [ 53.880544][ T5953] dump_stack_lvl+0x100/0x190 [ 53.880605][ T5953] should_fail_ex.cold+0x5/0xa [ 53.880636][ T5953] _copy_from_user+0x2e/0xd0 [ 53.880668][ T5953] copy_msghdr_from_user+0x9f/0x4c0 [ 53.880730][ T5953] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 53.880768][ T5953] ___sys_sendmsg+0x106/0x1e0 [ 53.880795][ T5953] ? __pfx____sys_sendmsg+0x10/0x10 [ 53.880821][ T5953] ? __lock_acquire+0x49f/0x1a40 [ 53.880855][ T5953] ? get_pid_task+0x106/0x250 [ 53.880917][ T5953] __sys_sendmsg+0x160/0x210 [ 53.880940][ T5953] ? __pfx___sys_sendmsg+0x10/0x10 [ 53.880973][ T5953] do_syscall_64+0x115/0x870 [ 53.881033][ T5953] ? clear_bhb_loop+0x40/0x90 [ 53.881056][ T5953] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 53.881075][ T5953] RIP: 0033:0x7f1e1639df99 [ 53.881090][ T5953] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 53.881106][ T5953] RSP: 002b:00007f1e17183028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 53.881125][ T5953] RAX: ffffffffffffffda RBX: 00007f1e16625fa0 RCX: 00007f1e1639df99 [ 53.881136][ T5953] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 53.881146][ T5953] RBP: 00007f1e17183090 R08: 0000000000000000 R09: 0000000000000000 [ 53.881157][ T5953] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 53.881167][ T5953] R13: 00007f1e16626038 R14: 00007f1e16625fa0 R15: 00007ffe4303c8b8 [ 53.881189][ T5953] [ 53.884221][ T5955] bond0: entered promiscuous mode [ 53.941765][ T50] usb 8-1: device descriptor read/64, error -71 [ 53.943747][ T5955] bond_slave_0: entered promiscuous mode [ 53.945680][ T5955] bond_slave_1: entered promiscuous mode [ 53.949533][ T5955] batadv0: entered promiscuous mode [ 53.953954][ T5955] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 53.959508][ T5955] bond0: left promiscuous mode [ 53.961342][ T5955] bond_slave_0: left promiscuous mode [ 53.963187][ T5955] bond_slave_1: left promiscuous mode [ 53.969256][ T5955] batadv0: left promiscuous mode [ 54.029328][ T5961] ======================================================= [ 54.029328][ T5961] WARNING: The mand mount option has been deprecated and [ 54.029328][ T5961] and is ignored by this kernel. Remove the mand [ 54.029328][ T5961] option from the mount to silence this warning. [ 54.029328][ T5961] ======================================================= [ 54.047283][ T50] usb usb8-port1: attempt power cycle [ 54.139040][ T5969] netlink: 'syz.2.29': attribute type 1 has an invalid length. [ 54.142693][ T5969] netlink: 232 bytes leftover after parsing attributes in process `syz.2.29'. [ 54.146371][ T5969] netlink: 'syz.2.29': attribute type 1 has an invalid length. [ 54.188870][ T5975] process 'syz.2.32' launched './file2' with NULL argv: empty string added [ 54.220944][ T5978] loop2: detected capacity change from 0 to 3 [ 54.226644][ T5978] ldm_validate_privheads(): Disk read failed. [ 54.230092][ T5978] Dev loop2: unable to read RDB block 3 [ 54.232019][ T5978] loop2: unable to read partition table [ 54.234027][ T5978] loop2: partition table beyond EOD, truncated [ 54.237016][ T5978] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 54.304476][ T5987] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=51 sclass=netlink_route_socket pid=5987 comm=syz.0.36 [ 54.312342][ T5991] xt_hashlimit: size too large, truncated to 1048576 [ 54.313961][ T5989] bond0: entered promiscuous mode [ 54.316445][ T5989] bond_slave_0: entered promiscuous mode [ 54.319017][ T5989] bond_slave_1: entered promiscuous mode [ 54.322971][ T5989] batadv0: entered promiscuous mode [ 54.327001][ T5989] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 54.330496][ T5989] bond0: left promiscuous mode [ 54.332108][ T5989] bond_slave_0: left promiscuous mode [ 54.333999][ T5989] bond_slave_1: left promiscuous mode [ 54.336415][ T5989] batadv0: left promiscuous mode [ 54.363838][ T5993] Zero length message leads to an empty skb [ 54.387033][ T50] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 54.407590][ T50] usb 8-1: device descriptor read/8, error -71 [ 54.424983][ T6001] netlink: 'syz.2.40': attribute type 1 has an invalid length. [ 54.427875][ T6001] netlink: 232 bytes leftover after parsing attributes in process `syz.2.40'. [ 54.430606][ T6001] netlink: 'syz.2.40': attribute type 1 has an invalid length. [ 54.556617][ T6009] netlink: 36 bytes leftover after parsing attributes in process `syz.2.44'. [ 54.617499][ T6014] netlink: 8 bytes leftover after parsing attributes in process `syz.2.45'. [ 54.629225][ T6014] netlink: 24 bytes leftover after parsing attributes in process `syz.2.45'. [ 54.646959][ T50] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 54.667605][ T50] usb 8-1: device descriptor read/8, error -71 [ 54.726502][ T6018] bridge_slave_0: left allmulticast mode [ 54.728968][ T6018] bridge_slave_0: left promiscuous mode [ 54.731599][ T6018] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.736350][ T6018] bridge_slave_1: left allmulticast mode [ 54.738582][ T6018] bridge_slave_1: left promiscuous mode [ 54.741563][ T6018] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.749266][ T6018] bond0: (slave bond_slave_0): Releasing backup interface [ 54.754207][ T6018] bond0: (slave bond_slave_1): Releasing backup interface [ 54.762775][ T6018] team0: Port device team_slave_0 removed [ 54.768082][ T6018] team0: Port device team_slave_1 removed [ 54.770452][ T6018] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 54.772857][ T6018] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 54.776037][ T6018] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 54.777697][ T50] usb usb8-port1: unable to enumerate USB device [ 54.782095][ T6018] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 54.786237][ T6018] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 54.799333][ T6019] team0: Port device xfrm0 added [ 54.809130][ T6018] tipc: Started in network mode [ 54.810880][ T6018] tipc: Node identity 067608cb968f, cluster identity 4711 [ 54.813255][ T6018] tipc: Enabled bearer , priority 0 [ 54.817714][ T5741] Bluetooth: hci1: command tx timeout [ 54.827064][ T5741] Bluetooth: hci2: command tx timeout [ 54.827670][ T5093] Bluetooth: hci0: command tx timeout [ 54.827691][ T5745] Bluetooth: hci3: command tx timeout [ 55.378591][ T6029] bond0: entered promiscuous mode [ 55.382849][ T6029] batadv0: entered promiscuous mode [ 55.385495][ T6029] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 55.389672][ T6029] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 55.393638][ T6029] bond0: left promiscuous mode [ 55.396105][ T6029] batadv0: left promiscuous mode [ 55.498435][ T6031] netlink: 'syz.0.51': attribute type 1 has an invalid length. [ 55.501089][ T6031] netlink: 232 bytes leftover after parsing attributes in process `syz.0.51'. [ 55.504645][ T6031] netlink: 'syz.0.51': attribute type 1 has an invalid length. [ 55.671140][ T6035] netlink: 'syz.0.53': attribute type 3 has an invalid length. [ 55.717585][ T6040] syz_tun: entered allmulticast mode [ 55.722523][ T6039] syz_tun: left allmulticast mode [ 55.827130][ T6043] netlink: 40 bytes leftover after parsing attributes in process `syz.2.56'. [ 55.836714][ T6043] dummy0: entered promiscuous mode [ 55.893450][ T6051] bond0: entered promiscuous mode [ 55.895914][ T6051] batadv0: entered promiscuous mode [ 55.899074][ T6051] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 55.903737][ T6051] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 55.908455][ T6051] bond0: left promiscuous mode [ 55.911271][ T6051] batadv0: left promiscuous mode [ 55.928389][ T1486] tipc: Node number set to 2432239819 [ 55.974900][ T6053] ntfs3: Unknown parameter 'discard' [ 55.981631][ T6003] netlink: 8 bytes leftover after parsing attributes in process `syz.1.41'. [ 56.016534][ T6057] overlayfs: missing 'workdir' [ 56.084658][ T6063] syz_tun: entered allmulticast mode [ 56.087794][ T6062] syz_tun: left allmulticast mode [ 56.120469][ T6064] binder: 6060:6064 ioctl c0306201 200000000040 returned -14 [ 56.124588][ T6064] binder: 6060:6064 ioctl c0306201 200000000640 returned -22 [ 56.155403][ T6066] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=57370 sclass=netlink_xfrm_socket pid=6066 comm=syz.0.65 [ 56.187167][ T6066] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 56.190484][ T6066] team0: Device netdevsim1 is of different type [ 56.298695][ T6081] bond0: entered promiscuous mode [ 56.302382][ T6081] bond_slave_0: entered promiscuous mode [ 56.304351][ T6081] bond_slave_1: entered promiscuous mode [ 56.309153][ T6081] batadv0: entered promiscuous mode [ 56.312229][ T6081] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 56.316220][ T6081] bond0: left promiscuous mode [ 56.319201][ T6081] bond_slave_0: left promiscuous mode [ 56.321067][ T6081] bond_slave_1: left promiscuous mode [ 56.324269][ T6081] batadv0: left promiscuous mode [ 56.386235][ T6088] ntfs3: Unknown parameter 'discard' [ 56.467674][ T6094] syz_tun: entered allmulticast mode [ 56.471522][ T6093] syz_tun: left allmulticast mode [ 56.824709][ T6124] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 56.839435][ T6126] bond0: entered promiscuous mode [ 56.841186][ T6126] bond_slave_0: entered promiscuous mode [ 56.843255][ T6126] bond_slave_1: entered promiscuous mode [ 56.846252][ T6126] batadv0: entered promiscuous mode [ 56.848968][ T847] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 56.852078][ T6126] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 56.856448][ T6126] bond0: left promiscuous mode [ 56.859839][ T6126] bond_slave_0: left promiscuous mode [ 56.862309][ T6126] bond_slave_1: left promiscuous mode [ 56.865584][ T6126] batadv0: left promiscuous mode [ 56.898118][ T5093] Bluetooth: hci2: command tx timeout [ 56.899472][ T5741] Bluetooth: hci3: command tx timeout [ 56.900482][ T5745] Bluetooth: hci1: command tx timeout [ 56.907306][ T5745] Bluetooth: hci0: command tx timeout [ 57.007069][ T847] usb 5-1: Using ep0 maxpacket: 32 [ 57.014222][ T847] usb 5-1: config 0 has an invalid interface number: 119 but max is 0 [ 57.016968][ T847] usb 5-1: config 0 has no interface number 0 [ 57.021356][ T847] usb 5-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 57.025930][ T847] usb 5-1: config 0 interface 119 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 57.029883][ T847] usb 5-1: config 0 interface 119 altsetting 0 endpoint 0x83 has invalid maxpacket 11621, setting to 1024 [ 57.037197][ T847] usb 5-1: config 0 interface 119 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 57.040555][ T847] usb 5-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 57.047186][ T847] usb 5-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 57.050139][ T847] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 57.052712][ T847] usb 5-1: Product: syz [ 57.054079][ T847] usb 5-1: Manufacturer: syz [ 57.055639][ T847] usb 5-1: SerialNumber: syz [ 57.062819][ T847] usb 5-1: config 0 descriptor?? [ 57.066471][ T6104] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 57.103649][ T847] input: bcm5974 as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.119/input/input10 [ 57.113145][ T5128] usb 5-1: BOGUS urb xfer, pipe 1 != type 3 [ 57.121843][ C0] bcm5974 5-1:0.119: trackpad urb failed: -1 [ 57.189252][ T6136] syz_tun: entered allmulticast mode [ 57.192392][ T6135] syz_tun: left allmulticast mode [ 57.251727][ T6140] xt_CT: You must specify a L4 protocol and not use inversions on it [ 57.274057][ T6143] validate_nla: 5 callbacks suppressed [ 57.274081][ T6143] netlink: 'syz.1.89': attribute type 25 has an invalid length. [ 57.275009][ T847] usb 5-1: USB disconnect, device number 2 [ 57.404754][ T6156] bond0: entered promiscuous mode [ 57.408464][ T6156] batadv0: entered promiscuous mode [ 57.411037][ T6156] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 57.414730][ T6156] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 57.419014][ T6156] bond0: left promiscuous mode [ 57.422333][ T6156] batadv0: left promiscuous mode [ 57.565187][ T6162] futex_wake_op: syz.2.96 tries to shift op by 144; fix this program [ 57.569329][ T6164] syz_tun: entered allmulticast mode [ 57.569823][ T6162] futex_wake_op: syz.2.96 tries to shift op by 144; fix this program [ 57.578174][ T6161] syz_tun: left allmulticast mode [ 57.711441][ T6177] Illegal XDP return value 4294967294 on prog (id 10) dev N/A, expect packet loss! [ 57.737128][ T6180] fuse: Unknown parameter 'Z±ÖªSìV©“d©Vƒ"?O¥¬[bt‰ßa™iÞ? ýÁ\ ɉaîòˆ½xÑ´ù;“«œdD?é;üÓw5ð~50#W%ºÔÈ õšñBö¶m6FLÒ‚™žíóÇ3Qô%ºÓð[‡â2P5~ 2Ñ2OÂ^0yØ)[Á’užåÓ:xŸ0ã±wqð9¯òsÔ' [ 57.744006][ T6181] evm: overlay not supported [ 57.750832][ T6180] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 57.760610][ T6180] gfs2: error -5 reading superblock [ 57.840868][ T6185] __nla_validate_parse: 2 callbacks suppressed [ 57.841716][ T6185] netlink: 32 bytes leftover after parsing attributes in process `syz.0.103'. [ 57.849322][ T6186] netlink: 32 bytes leftover after parsing attributes in process `syz.0.103'. [ 57.903857][ T6191] bond0: entered promiscuous mode [ 57.906251][ T6191] batadv0: entered promiscuous mode [ 57.909107][ T6191] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 57.912567][ T6191] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 57.938819][ T6189] tipc: Can't bind to reserved service type 0 [ 57.994496][ T6192] netlink: 14 bytes leftover after parsing attributes in process `syz.2.102'. [ 58.477799][ T6191] bond0: left promiscuous mode [ 58.520674][ T6191] batadv0: left promiscuous mode [ 58.654662][ T6198] syz_tun: entered allmulticast mode [ 58.657749][ T6197] syz_tun: left allmulticast mode [ 58.732739][ T6204] fuse: Unknown parameter 'uB™2/B÷' [ 58.733035][ T6201] team0: Port device xfrm0 removed [ 58.737974][ T6201] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 58.744468][ T1168] tipc: Resetting bearer [ 58.756498][ T6201] team0: Port device xfrm0 added [ 58.759623][ T6201] tipc: Enabling of bearer rejected, already enabled [ 58.883757][ T6220] tmpfs: Bad value for 'mpol' [ 58.886669][ T6220] openvswitch: netlink: Missing key (keys=c0, expected=480) [ 58.894158][ T6222] bond0: entered promiscuous mode [ 58.896089][ T6222] bond_slave_0: entered promiscuous mode [ 58.898484][ T6222] bond_slave_1: entered promiscuous mode [ 58.901991][ T6222] batadv0: entered promiscuous mode [ 58.906551][ T6222] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 58.910842][ T6222] bond0: left promiscuous mode [ 58.912961][ T6222] bond_slave_0: left promiscuous mode [ 58.915429][ T6222] bond_slave_1: left promiscuous mode [ 58.922602][ T6222] batadv0: left promiscuous mode [ 58.935020][ T6220] netlink: 4 bytes leftover after parsing attributes in process `syz.2.113'. [ 58.935135][ T6224] syz_tun: entered allmulticast mode [ 58.955591][ T6223] syz_tun: left allmulticast mode [ 59.062066][ T42] kauditd_printk_skb: 124 callbacks suppressed [ 59.062086][ T42] audit: type=1400 audit(1785375383.058:362): avc: denied { read write } for pid=6232 comm="syz.2.119" name="nullb0" dev="devtmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 59.063140][ T6233] netlink: 36 bytes leftover after parsing attributes in process `syz.2.119'. [ 59.064807][ T42] audit: type=1400 audit(1785375383.058:363): avc: denied { open } for pid=6232 comm="syz.2.119" path="/dev/nullb0" dev="devtmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 59.086278][ T42] audit: type=1400 audit(1785375383.068:364): avc: denied { map } for pid=6232 comm="syz.2.119" path="/dev/nullb0" dev="devtmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 59.236951][ T10] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 59.360689][ T42] audit: type=1400 audit(1785375383.358:365): avc: denied { setopt } for pid=6243 comm="syz.1.122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 59.397279][ T10] usb 8-1: Using ep0 maxpacket: 8 [ 59.401176][ T10] usb 8-1: config 1 interface 0 altsetting 9 endpoint 0x2 has an invalid bInterval 179, changing to 11 [ 59.405628][ T10] usb 8-1: config 1 interface 0 has no altsetting 0 [ 59.412749][ T10] usb 8-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.40 [ 59.414661][ T42] audit: type=1400 audit(1785375383.408:366): avc: denied { mount } for pid=6246 comm="syz.1.123" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 59.414820][ T6239] pci 0000:00:01.0: [1af4:1050] type 00 class 0x030000 conventional PCI endpoint [ 59.415748][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 59.415765][ T10] usb 8-1: Product: syz [ 59.416593][ T6247] overlay: Unknown parameter 'default_permissions:/' [ 59.459079][ T6239] pci 0000:00:01.0: BAR 0 [mem 0xfe000000-0xfe7fffff pref] [ 59.460098][ T10] usb 8-1: Manufacturer: syz [ 59.463524][ T10] usb 8-1: SerialNumber: syz [ 59.464800][ T6239] pci 0000:00:01.0: BAR 2 [mem 0x380800000000-0x380800003fff 64bit pref] [ 59.471657][ T6239] pci 0000:00:01.0: BAR 4 [mem 0xfeaf4000-0xfeaf4fff] [ 59.474585][ T6239] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 59.478679][ T6239] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 59.493644][ T6239] pci 0000:00:01.0: Adding to iommu group 1 [ 59.499771][ T6239] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 59.502147][ T6239] pci 0000:00:01.0: vgaarb: bridge control possible [ 59.504244][ T6239] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 59.513665][ T6239] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x807fffff pref]: assigned [ 59.525927][ T6239] pci 0000:00:01.0: BAR 2 [mem 0x380800000000-0x380800003fff 64bit pref]: assigned [ 59.534383][ T6239] pci 0000:00:01.0: BAR 4 [mem 0x80800000-0x80800fff]: assigned [ 59.580929][ T6239] [drm] pci: virtio-vga detected at 0000:00:01.0 [ 59.583868][ T6239] virtio-pci 0000:00:01.0: vgaarb: deactivate vga console [ 59.588125][ T6239] [drm] features: -virgl +edid -resource_blob -host_visible [ 59.588142][ T6239] [drm] features: -context_init -blob_alignment [ 59.602262][ T6239] [drm] number of scanouts: 1 [ 59.603912][ T6239] [drm] number of cap sets: 0 [ 59.624587][ T6239] [drm] Initialized virtio_gpu 0.1.0 for 0000:00:01.0 on minor 2 [ 59.633183][ T6249] syz_tun: entered allmulticast mode [ 59.636637][ T6248] syz_tun: left allmulticast mode [ 59.671674][ T6252] sctp: [Deprecated]: syz.0.125 (pid 6252) Use of int in max_burst socket option deprecated. [ 59.671674][ T6252] Use struct sctp_assoc_value instead [ 59.681695][ T6239] virtio-pci 0000:00:01.0: [drm] fb1: virtio_gpudrmfb frame buffer device [ 59.696988][ T29] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 59.716015][ T6254] syz_tun: entered allmulticast mode [ 59.723328][ T42] audit: type=1400 audit(1785375383.718:367): avc: denied { create } for pid=6253 comm="syz.0.126" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 59.731746][ T6253] syz_tun: left allmulticast mode [ 59.734064][ T42] audit: type=1400 audit(1785375383.718:368): avc: denied { ioctl } for pid=6253 comm="syz.0.126" path="socket:[11175]" dev="sockfs" ino=11175 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 59.747458][ T42] audit: type=1400 audit(1785375383.718:369): avc: denied { write } for pid=6253 comm="syz.0.126" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 59.755674][ T42] audit: type=1400 audit(1785375383.718:370): avc: denied { getopt } for pid=6253 comm="syz.0.126" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 59.813241][ T42] audit: type=1400 audit(1785375383.808:371): avc: denied { setopt } for pid=6259 comm="syz.2.128" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 59.838849][ T6257] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 59.840659][ T6261] input: syz0 as /devices/virtual/input/input17 [ 59.852089][ T29] usb 6-1: unable to get BOS descriptor or descriptor too short [ 59.856037][ T29] usb 6-1: not running at top speed; connect to a high speed hub [ 59.862530][ T29] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 59.871574][ T29] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 59.875086][ T29] usb 6-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 59.879727][ T29] usb 6-1: config 14 has no interface number 0 [ 59.882544][ T29] usb 6-1: config 14 has no interface number 1 [ 59.885143][ T29] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 59.890697][ T29] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 59.895584][ T29] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 59.900967][ T29] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 59.905135][ T29] usb 6-1: config 14 interface 57 has no altsetting 0 [ 59.908266][ T10] usbhid 8-1:1.0: can't add hid device: -71 [ 59.909234][ T29] usb 6-1: config 14 interface 228 has no altsetting 0 [ 59.913825][ T10] usbhid 8-1:1.0: probe with driver usbhid failed with error -71 [ 59.915722][ T29] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 59.918890][ T10] usb 8-1: USB disconnect, device number 6 [ 59.921102][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 59.925415][ T29] usb 6-1: Product: syz [ 59.927263][ T29] usb 6-1: Manufacturer: syz [ 59.929259][ T29] usb 6-1: SerialNumber: syz [ 60.344716][ T29] legousbtower 6-1:14.57: interrupt endpoints not found [ 60.716972][ T1486] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 60.747351][ T29] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 60.779395][ T29] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 60.878824][ T1486] usb 8-1: unable to get BOS descriptor or descriptor too short [ 60.882709][ T1486] usb 8-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 60.886632][ T1486] usb 8-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 60.893333][ T1486] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 60.897105][ T1486] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 60.900253][ T1486] usb 8-1: Product: syz [ 60.901821][ T1486] usb 8-1: Manufacturer: syz [ 60.903637][ T1486] usb 8-1: SerialNumber: syz [ 60.961157][ T6274] netlink: 'syz.2.132': attribute type 1 has an invalid length. [ 60.992324][ T6274] 8021q: adding VLAN 0 to HW filter on device bond1 [ 61.028434][ T6274] bond1: (slave veth3): Enslaving as an active interface with a down link [ 61.036194][ T6274] netlink: 'syz.2.132': attribute type 10 has an invalid length. [ 61.039798][ T6274] netlink: 40 bytes leftover after parsing attributes in process `syz.2.132'. [ 61.088740][ T6279] syz_tun: entered allmulticast mode [ 61.091502][ T6279] FAULT_INJECTION: forcing a failure. [ 61.091502][ T6279] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 61.096170][ T6279] CPU: 2 UID: 0 PID: 6279 Comm: syz.2.133 Not tainted syzkaller #0 PREEMPT(full) [ 61.096185][ T6279] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 61.096198][ T6279] Call Trace: [ 61.096203][ T6279] [ 61.096208][ T6279] dump_stack_lvl+0x100/0x190 [ 61.096299][ T6279] should_fail_ex.cold+0x5/0xa [ 61.096320][ T6279] _copy_from_iter+0x1f4/0x1690 [ 61.096359][ T6279] ? __pfx__copy_from_iter+0x10/0x10 [ 61.096376][ T6279] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 61.096405][ T6279] copy_page_from_iter+0x238/0x300 [ 61.096423][ T6279] tun_build_skb.constprop.0+0x2ea/0x18f0 [ 61.096457][ T6279] ? __pfx_tun_build_skb.constprop.0+0x10/0x10 [ 61.096469][ T6279] ? unwind_get_return_address+0x59/0xa0 [ 61.096487][ T6279] ? arch_stack_walk+0xa6/0xf0 [ 61.096517][ T6279] ? _kstrtoull+0x13c/0x1f0 [ 61.096528][ T6279] ? __pfx__kstrtoull+0x10/0x10 [ 61.096540][ T6279] tun_get_user+0x16d6/0x3c20 [ 61.096557][ T6279] ? __pfx_tun_get_user+0x10/0x10 [ 61.096568][ T6279] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 61.096590][ T6279] ? find_held_lock+0x2b/0x80 [ 61.096614][ T6279] ? tun_get+0x191/0x370 [ 61.096631][ T6279] ? tun_get+0x191/0x370 [ 61.096651][ T6279] tun_chr_write_iter+0xdc/0x200 [ 61.096663][ T6279] vfs_write+0x6ac/0x1050 [ 61.096688][ T6279] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 61.096700][ T6279] ? __pfx_vfs_write+0x10/0x10 [ 61.096717][ T6279] ? find_held_lock+0x2b/0x80 [ 61.096742][ T6279] ksys_write+0x12a/0x250 [ 61.096759][ T6279] ? __pfx_ksys_write+0x10/0x10 [ 61.096781][ T6279] do_syscall_64+0x115/0x870 [ 61.096842][ T6279] ? clear_bhb_loop+0x40/0x90 [ 61.096862][ T6279] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.096874][ T6279] RIP: 0033:0x7f1e1635e7ce [ 61.096891][ T6279] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 61.096901][ T6279] RSP: 002b:00007f1e17182fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 61.096912][ T6279] RAX: ffffffffffffffda RBX: 00007f1e171836c0 RCX: 00007f1e1635e7ce [ 61.096919][ T6279] RDX: 000000000000003e RSI: 0000200000000040 RDI: 00000000000000c8 [ 61.096926][ T6279] RBP: 00007f1e17183090 R08: 0000000000000000 R09: 0000000000000000 [ 61.096932][ T6279] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 61.096938][ T6279] R13: 00007f1e16626038 R14: 00007f1e16625fa0 R15: 00007ffe4303c8b8 [ 61.096952][ T6279] [ 61.178878][ T6278] syz_tun: left allmulticast mode [ 61.210224][ T6283] syz_tun: entered allmulticast mode [ 61.213085][ T6281] syz_tun: left allmulticast mode [ 61.245471][ T6285] syz_tun: entered allmulticast mode [ 61.250561][ T6284] syz_tun: left allmulticast mode [ 61.355026][ T6294] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2048 sclass=netlink_route_socket pid=6294 comm=syz.2.137 [ 61.391621][ T6296] tmpfs: Unknown parameter 'inode64l' [ 61.550374][ T6303] SELinux: syz.0.141 (6303) wrote to checkreqprot. This is no longer supported. [ 61.605366][ T6310] syz_tun: entered allmulticast mode [ 61.609513][ T6309] syz_tun: left allmulticast mode [ 61.686205][ T6312] binder: binder_mmap: 6311 200000000000-200000200000 bad vm_flags failed -1 [ 62.028646][ T6247] usb 6-1: LEGO USB Tower reset control request failed [ 62.035549][ T50] usb 6-1: USB disconnect, device number 2 [ 62.048714][ T50] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 62.281872][ T6342] syz_tun: entered allmulticast mode [ 62.285233][ T6342] FAULT_INJECTION: forcing a failure. [ 62.285233][ T6342] name failslab, interval 1, probability 0, space 0, times 0 [ 62.291476][ T6342] CPU: 1 UID: 0 PID: 6342 Comm: syz.2.152 Tainted: G L syzkaller #0 PREEMPT(full) [ 62.291503][ T6342] Tainted: [L]=SOFTLOCKUP [ 62.291510][ T6342] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 62.291550][ T6342] Call Trace: [ 62.291558][ T6342] [ 62.291565][ T6342] dump_stack_lvl+0x100/0x190 [ 62.291628][ T6342] should_fail_ex.cold+0x5/0xa [ 62.291669][ T6342] should_failslab+0xc2/0x120 [ 62.291702][ T6342] kmem_cache_alloc_noprof+0x91/0x6a0 [ 62.291735][ T6342] ? inet_lookup_ifaddr_rcu+0x105/0x160 [ 62.291786][ T6342] ? dst_alloc+0x99/0x1a0 [ 62.291820][ T6342] dst_alloc+0x99/0x1a0 [ 62.291842][ T6342] rt_dst_alloc+0x35/0x3a0 [ 62.291872][ T6342] ip_route_input_rcu.part.0+0x5e0/0xe20 [ 62.291900][ T6342] ? __pfx_ip_route_input_rcu.part.0+0x10/0x10 [ 62.291933][ T6342] ip_route_input_noref+0x1c3/0x2e0 [ 62.291958][ T6342] ? __pfx_ip_route_input_noref+0x10/0x10 [ 62.291986][ T6342] ? __pfx_ip_rcv_finish+0x10/0x10 [ 62.292015][ T6342] ? __pfx_nf_hook.constprop.0+0x10/0x10 [ 62.292044][ T6342] ip_rcv_finish_core+0x459/0x2c30 [ 62.292077][ T6342] ip_rcv+0x1c0/0x3c0 [ 62.292104][ T6342] ? __pfx_ip_rcv+0x10/0x10 [ 62.292128][ T6342] __netif_receive_skb_one_core+0x197/0x1e0 [ 62.292147][ T6342] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 62.292168][ T6342] ? lock_acquire+0x1b9/0x370 [ 62.292206][ T6342] __netif_receive_skb+0x1f/0x120 [ 62.292226][ T6342] netif_receive_skb+0x139/0x7d0 [ 62.292245][ T6342] ? __pfx_netif_receive_skb+0x10/0x10 [ 62.292272][ T6342] tun_rx_batched.isra.0+0x3f6/0x750 [ 62.292325][ T6342] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 62.292359][ T6342] ? tun_get_user+0x1cc8/0x3c20 [ 62.292389][ T6342] tun_get_user+0x1e31/0x3c20 [ 62.292418][ T6342] ? __pfx_tun_get_user+0x10/0x10 [ 62.292436][ T6342] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 62.292467][ T6342] ? find_held_lock+0x2b/0x80 [ 62.292494][ T6342] ? tun_get+0x191/0x370 [ 62.292520][ T6342] ? tun_get+0x191/0x370 [ 62.292554][ T6342] tun_chr_write_iter+0xdc/0x200 [ 62.292574][ T6342] vfs_write+0x6ac/0x1050 [ 62.292612][ T6342] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 62.292634][ T6342] ? __pfx_vfs_write+0x10/0x10 [ 62.292660][ T6342] ? find_held_lock+0x2b/0x80 [ 62.292704][ T6342] ksys_write+0x12a/0x250 [ 62.292730][ T6342] ? __pfx_ksys_write+0x10/0x10 [ 62.292761][ T6342] do_syscall_64+0x115/0x870 [ 62.292823][ T6342] ? clear_bhb_loop+0x40/0x90 [ 62.292847][ T6342] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 62.292865][ T6342] RIP: 0033:0x7f1e1635e7ce [ 62.292881][ T6342] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 62.292900][ T6342] RSP: 002b:00007f1e17182fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 62.292921][ T6342] RAX: ffffffffffffffda RBX: 00007f1e171836c0 RCX: 00007f1e1635e7ce [ 62.292932][ T6342] RDX: 000000000000003e RSI: 0000200000000040 RDI: 00000000000000c8 [ 62.292944][ T6342] RBP: 00007f1e17183090 R08: 0000000000000000 R09: 0000000000000000 [ 62.292953][ T6342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 62.292964][ T6342] R13: 00007f1e16626038 R14: 00007f1e16625fa0 R15: 00007ffe4303c8b8 [ 62.292984][ T6342] [ 62.293815][ T6341] syz_tun: left allmulticast mode [ 62.486271][ T6345] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 62.497167][ T6345] CIFS: Unable to determine destination address [ 62.579669][ T6350] netlink: 'syz.1.155': attribute type 1 has an invalid length. [ 62.594107][ T6348] netlink: 24 bytes leftover after parsing attributes in process `syz.2.154'. [ 62.599195][ T6350] 8021q: adding VLAN 0 to HW filter on device bond1 [ 62.602478][ T6348] netlink: 24 bytes leftover after parsing attributes in process `syz.2.154'. [ 62.623128][ T6350] veth3: entered promiscuous mode [ 62.628374][ T6350] bond1: (slave veth3): Enslaving as an active interface with a down link [ 62.794352][ T6366] team0: Port device xfrm0 removed [ 62.797940][ T6366] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 62.807091][ T1167] tipc: Resetting bearer [ 62.810093][ T6370] syz_tun: entered allmulticast mode [ 62.813030][ T6370] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 62.819114][ T6366] team0: Port device xfrm0 added [ 62.821652][ T6369] syz_tun: left allmulticast mode [ 62.824228][ T6366] tipc: Enabling of bearer rejected, already enabled [ 63.137057][ T56] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 63.289829][ T56] usb 6-1: unable to get BOS descriptor or descriptor too short [ 63.293918][ T56] usb 6-1: config 4 has an invalid interface number: 13 but max is 0 [ 63.297456][ T56] usb 6-1: config 4 has no interface number 0 [ 63.300032][ T56] usb 6-1: config 4 interface 13 has no altsetting 0 [ 63.304953][ T56] usb 6-1: New USB device found, idVendor=0bda, idProduct=0184, bcdDevice=6f.98 [ 63.308711][ T56] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 63.311860][ T56] usb 6-1: Product: syz [ 63.313456][ T56] usb 6-1: Manufacturer: syz [ 63.315297][ T56] usb 6-1: SerialNumber: syz [ 63.488483][ T1486] cdc_ncm 8-1:1.0: bind() failure [ 63.498837][ T1486] cdc_ncm 8-1:1.1: CDC Union missing and no IAD found [ 63.501132][ T1486] cdc_ncm 8-1:1.1: bind() failure [ 63.508163][ T1486] usb 8-1: USB disconnect, device number 7 [ 63.539826][ T56] ums-realtek 6-1:4.13: USB Mass Storage device detected [ 63.618170][ T56] usb 6-1: USB disconnect, device number 3 [ 63.624205][ T5746] udevd[5746]: setting mode of /dev/bus/usb/006/003 to 020664 failed: No such file or directory [ 63.636449][ T5746] udevd[5746]: setting owner of /dev/bus/usb/006/003 to uid=0, gid=0 failed: No such file or directory [ 63.676329][ T6391] netlink: 'syz.0.167': attribute type 1 has an invalid length. [ 63.711280][ T6391] 8021q: adding VLAN 0 to HW filter on device bond1 [ 63.751751][ T6391] bond1: (slave veth3): Enslaving as an active interface with a down link [ 63.773937][ T6391] bond1: (slave dummy0): making interface the new active one [ 63.778859][ T6391] dummy0: entered promiscuous mode [ 63.781596][ T6391] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 63.787247][ T6391] netlink: 'syz.0.167': attribute type 10 has an invalid length. [ 63.790468][ T6391] netlink: 40 bytes leftover after parsing attributes in process `syz.0.167'. [ 63.795769][ T6391] bond1: (slave dummy0): Releasing active interface [ 63.863984][ T6405] syz_tun: entered allmulticast mode [ 63.867961][ T6405] FAULT_INJECTION: forcing a failure. [ 63.867961][ T6405] name failslab, interval 1, probability 0, space 0, times 0 [ 63.873999][ T6405] CPU: 1 UID: 0 PID: 6405 Comm: syz.3.172 Tainted: G L syzkaller #0 PREEMPT(full) [ 63.874025][ T6405] Tainted: [L]=SOFTLOCKUP [ 63.874031][ T6405] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 63.874050][ T6405] Call Trace: [ 63.874058][ T6405] [ 63.874063][ T6405] dump_stack_lvl+0x100/0x190 [ 63.874121][ T6405] should_fail_ex.cold+0x5/0xa [ 63.874146][ T6405] should_failslab+0xc2/0x120 [ 63.874174][ T6405] kmem_cache_alloc_noprof+0x91/0x6a0 [ 63.874203][ T6405] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 63.874238][ T6405] ? ipmr_cache_unresolved+0x420/0x9e0 [ 63.874300][ T6405] ipmr_cache_unresolved+0x420/0x9e0 [ 63.874334][ T6405] ip_mr_input+0xa1b/0xf40 [ 63.874354][ T6405] ? __pfx_ip_mr_input+0x10/0x10 [ 63.874369][ T6405] ? ip_rcv_finish_core+0x7ec/0x2c30 [ 63.874407][ T6405] ? __pfx_ip_mr_input+0x10/0x10 [ 63.874425][ T6405] ip_rcv+0x34e/0x3c0 [ 63.874451][ T6405] ? __pfx_ip_rcv+0x10/0x10 [ 63.874470][ T6405] __netif_receive_skb_one_core+0x197/0x1e0 [ 63.874499][ T6405] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 63.874520][ T6405] ? lock_acquire+0x1b9/0x370 [ 63.874542][ T6405] __netif_receive_skb+0x1f/0x120 [ 63.874563][ T6405] netif_receive_skb+0x139/0x7d0 [ 63.874581][ T6405] ? __pfx_netif_receive_skb+0x10/0x10 [ 63.874607][ T6405] tun_rx_batched.isra.0+0x3f6/0x750 [ 63.874674][ T6405] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 63.874714][ T6405] ? tun_get_user+0x1cc8/0x3c20 [ 63.874737][ T6405] tun_get_user+0x1e31/0x3c20 [ 63.874764][ T6405] ? __pfx_tun_get_user+0x10/0x10 [ 63.874785][ T6405] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 63.874821][ T6405] ? find_held_lock+0x2b/0x80 [ 63.874849][ T6405] ? tun_get+0x191/0x370 [ 63.874873][ T6405] ? tun_get+0x191/0x370 [ 63.874907][ T6405] tun_chr_write_iter+0xdc/0x200 [ 63.874925][ T6405] vfs_write+0x6ac/0x1050 [ 63.874958][ T6405] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 63.874980][ T6405] ? __pfx_vfs_write+0x10/0x10 [ 63.875006][ T6405] ? find_held_lock+0x2b/0x80 [ 63.875047][ T6405] ksys_write+0x12a/0x250 [ 63.875074][ T6405] ? __pfx_ksys_write+0x10/0x10 [ 63.875107][ T6405] do_syscall_64+0x115/0x870 [ 63.875163][ T6405] ? clear_bhb_loop+0x40/0x90 [ 63.875188][ T6405] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.875207][ T6405] RIP: 0033:0x7fc76975e7ce [ 63.875220][ T6405] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 63.875235][ T6405] RSP: 002b:00007fc76a731fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 63.875253][ T6405] RAX: ffffffffffffffda RBX: 00007fc76a7326c0 RCX: 00007fc76975e7ce [ 63.875266][ T6405] RDX: 000000000000003e RSI: 0000200000000040 RDI: 00000000000000c8 [ 63.875276][ T6405] RBP: 00007fc76a732090 R08: 0000000000000000 R09: 0000000000000000 [ 63.875288][ T6405] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 63.875298][ T6405] R13: 00007fc769a26038 R14: 00007fc769a25fa0 R15: 00007ffdc9a9f958 [ 63.875323][ T6405] [ 63.875646][ T6403] syz_tun: left allmulticast mode [ 64.041844][ T6413] team0: Port device xfrm0 removed [ 64.052544][ T6413] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 64.072510][ T6414] team0: Port device xfrm0 added [ 64.075406][ T6413] tipc: Enabling of bearer rejected, already enabled [ 64.098351][ T6423] netlink: 'syz.2.178': attribute type 1 has an invalid length. [ 64.120956][ T6423] 8021q: adding VLAN 0 to HW filter on device bond2 [ 64.147632][ T6423] bond2: (slave veth5): Enslaving as an active interface with a down link [ 64.155990][ T6423] netlink: 'syz.2.178': attribute type 10 has an invalid length. [ 64.159171][ T6423] netlink: 40 bytes leftover after parsing attributes in process `syz.2.178'. [ 64.196218][ T6426] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 64.204178][ T6426] iommufd_mock iommufd_mock1: Adding to iommu group 10 [ 64.316932][ T56] usb 8-1: new full-speed USB device number 8 using dummy_hcd [ 64.348744][ T50] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 64.489038][ T56] usb 8-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 64.493631][ T56] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 64.498557][ T56] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 10 [ 64.503044][ T56] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 255, setting to 64 [ 64.507629][ T56] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 64.515022][ T56] usb 8-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 64.519383][ T56] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 64.519633][ T50] usb 6-1: config index 0 descriptor too short (expected 39, got 27) [ 64.522695][ T56] usb 8-1: Product: syz [ 64.527041][ T50] usb 6-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 64.527977][ T56] usb 8-1: Manufacturer: syz [ 64.527994][ T56] usb 8-1: SerialNumber: syz [ 64.530666][ T56] usb 8-1: config 0 descriptor?? [ 64.532043][ T50] usb 6-1: config 0 interface 0 has no altsetting 0 [ 64.535631][ T6419] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 64.538009][ T50] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 64.546427][ T50] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 64.546670][ T56] input: KB Gear Tablet as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/input/input25 [ 64.549760][ T50] usb 6-1: Product: syz [ 64.554463][ T50] usb 6-1: Manufacturer: syz [ 64.556355][ T50] usb 6-1: SerialNumber: syz [ 64.558594][ C1] kbtab 8-1:0.0: kbtab_irq - usb_submit_urb failed with result -1 [ 64.564724][ T50] usb 6-1: config 0 descriptor?? [ 64.570057][ C0] kbtab 8-1:0.0: kbtab_irq - usb_submit_urb failed with result -1 [ 64.578671][ T50] hub 6-1:0.0: bad descriptor, ignoring hub [ 64.582253][ T50] hub 6-1:0.0: probe with driver hub failed with error -5 [ 64.593576][ T50] usb 6-1: selecting invalid altsetting 0 [ 64.748598][ T42] kauditd_printk_skb: 40 callbacks suppressed [ 64.748631][ T42] audit: type=1400 audit(1785375388.748:412): avc: denied { read append } for pid=6418 comm="syz.3.176" name="mice" dev="devtmpfs" ino=940 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 64.761119][ T42] audit: type=1400 audit(1785375388.748:413): avc: denied { open } for pid=6418 comm="syz.3.176" path="/dev/input/mice" dev="devtmpfs" ino=940 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 64.778627][ T6421] netlink: 'syz.1.177': attribute type 1 has an invalid length. [ 64.781883][ T6421] netlink: 232 bytes leftover after parsing attributes in process `syz.1.177'. [ 64.785741][ T6421] netlink: 'syz.1.177': attribute type 1 has an invalid length. [ 64.833008][ T6419] netlink: 8 bytes leftover after parsing attributes in process `syz.3.176'. [ 64.845036][ T10] usb 8-1: USB disconnect, device number 8 [ 64.900312][ T41] usb 6-1: USB disconnect, device number 4 [ 65.208386][ T6444] syz_tun: entered allmulticast mode [ 65.211667][ T6444] FAULT_INJECTION: forcing a failure. [ 65.211667][ T6444] name failslab, interval 1, probability 0, space 0, times 0 [ 65.216800][ T6444] CPU: 3 UID: 0 PID: 6444 Comm: syz.2.184 Tainted: G L syzkaller #0 PREEMPT(full) [ 65.216828][ T6444] Tainted: [L]=SOFTLOCKUP [ 65.216835][ T6444] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 65.216859][ T6444] Call Trace: [ 65.216866][ T6444] [ 65.216873][ T6444] dump_stack_lvl+0x100/0x190 [ 65.216903][ T6444] should_fail_ex.cold+0x5/0xa [ 65.216926][ T6444] should_failslab+0xc2/0x120 [ 65.216951][ T6444] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 65.216977][ T6444] ? __alloc_skb+0x140/0x710 [ 65.217004][ T6444] __alloc_skb+0x140/0x710 [ 65.217024][ T6444] ? __alloc_skb+0x5b7/0x710 [ 65.217045][ T6444] ? __pfx___alloc_skb+0x10/0x10 [ 65.217071][ T6444] ipmr_cache_report+0x19d/0x13e0 [ 65.217105][ T6444] ? __pfx_ipmr_cache_report+0x10/0x10 [ 65.217130][ T6444] ? kmem_cache_alloc_noprof+0x2d7/0x6a0 [ 65.217152][ T6444] ? lockdep_init_map_type+0x5c/0x250 [ 65.217178][ T6444] ipmr_cache_unresolved+0x637/0x9e0 [ 65.217210][ T6444] ip_mr_input+0xa1b/0xf40 [ 65.217232][ T6444] ? __pfx_ip_mr_input+0x10/0x10 [ 65.217249][ T6444] ? ip_rcv_finish_core+0x7ec/0x2c30 [ 65.217281][ T6444] ? __pfx_ip_mr_input+0x10/0x10 [ 65.217301][ T6444] ip_rcv+0x34e/0x3c0 [ 65.217334][ T6444] ? __pfx_ip_rcv+0x10/0x10 [ 65.217359][ T6444] __netif_receive_skb_one_core+0x197/0x1e0 [ 65.217380][ T6444] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 65.217413][ T6444] ? lock_acquire+0x1b9/0x370 [ 65.217441][ T6444] __netif_receive_skb+0x1f/0x120 [ 65.217462][ T6444] netif_receive_skb+0x139/0x7d0 [ 65.217482][ T6444] ? __pfx_netif_receive_skb+0x10/0x10 [ 65.217509][ T6444] tun_rx_batched.isra.0+0x3f6/0x750 [ 65.217541][ T6444] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 65.217575][ T6444] ? tun_get_user+0x1cc8/0x3c20 [ 65.217595][ T6444] tun_get_user+0x1e31/0x3c20 [ 65.217625][ T6444] ? __pfx_tun_get_user+0x10/0x10 [ 65.217644][ T6444] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 65.217676][ T6444] ? find_held_lock+0x2b/0x80 [ 65.217703][ T6444] ? tun_get+0x191/0x370 [ 65.217727][ T6444] ? tun_get+0x191/0x370 [ 65.217759][ T6444] tun_chr_write_iter+0xdc/0x200 [ 65.217777][ T6444] vfs_write+0x6ac/0x1050 [ 65.217807][ T6444] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 65.217827][ T6444] ? __pfx_vfs_write+0x10/0x10 [ 65.217851][ T6444] ? find_held_lock+0x2b/0x80 [ 65.217892][ T6444] ksys_write+0x12a/0x250 [ 65.217919][ T6444] ? __pfx_ksys_write+0x10/0x10 [ 65.217949][ T6444] do_syscall_64+0x115/0x870 [ 65.217972][ T6444] ? clear_bhb_loop+0x40/0x90 [ 65.217994][ T6444] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 65.218013][ T6444] RIP: 0033:0x7f1e1635e7ce [ 65.218027][ T6444] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 65.218043][ T6444] RSP: 002b:00007f1e17182fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 65.218062][ T6444] RAX: ffffffffffffffda RBX: 00007f1e171836c0 RCX: 00007f1e1635e7ce [ 65.218072][ T6444] RDX: 000000000000003e RSI: 0000200000000040 RDI: 00000000000000c8 [ 65.218083][ T6444] RBP: 00007f1e17183090 R08: 0000000000000000 R09: 0000000000000000 [ 65.218093][ T6444] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 65.218103][ T6444] R13: 00007f1e16626038 R14: 00007f1e16625fa0 R15: 00007ffe4303c8b8 [ 65.218124][ T6444] [ 65.337536][ T6443] syz_tun: left allmulticast mode [ 65.419563][ T42] audit: type=1400 audit(1785375389.418:414): avc: denied { ioctl } for pid=6448 comm="syz.2.186" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=13369 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 65.430035][ T42] audit: type=1400 audit(1785375389.418:415): avc: denied { ioctl } for pid=6448 comm="syz.2.186" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=13369 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 65.450301][ T42] audit: type=1400 audit(1785375389.448:416): avc: denied { name_connect } for pid=6448 comm="syz.2.186" dest=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 65.470668][ T6446] netlink: 8 bytes leftover after parsing attributes in process `syz.1.185'. [ 65.473562][ T42] audit: type=1400 audit(1785375389.468:417): avc: denied { read write } for pid=6456 comm="syz.3.187" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 65.474801][ T6446] netlink: 28 bytes leftover after parsing attributes in process `syz.1.185'. [ 65.484283][ T42] audit: type=1400 audit(1785375389.468:418): avc: denied { open } for pid=6456 comm="syz.3.187" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 65.494154][ T42] audit: type=1400 audit(1785375389.488:419): avc: denied { sqpoll } for pid=6448 comm="syz.2.186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 65.499215][ T6446] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6446 comm=syz.1.185 [ 65.519451][ T6460] netlink: 'syz.3.188': attribute type 1 has an invalid length. [ 65.552869][ T6460] 8021q: adding VLAN 0 to HW filter on device bond1 [ 65.555838][ T6463] /dev/sr0: Can't open blockdev [ 65.564492][ T6463] netlink: 'syz.1.189': attribute type 1 has an invalid length. [ 65.580987][ T6460] bond1: (slave veth3): Enslaving as an active interface with a down link [ 65.593095][ T6463] erspan1: entered allmulticast mode [ 65.605497][ T6460] bond1: (slave dummy0): making interface the new active one [ 65.608730][ T6460] dummy0: entered promiscuous mode [ 65.611128][ T6460] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 65.616551][ T6460] netlink: 'syz.3.188': attribute type 10 has an invalid length. [ 65.620640][ T6460] netlink: 40 bytes leftover after parsing attributes in process `syz.3.188'. [ 65.625956][ T6460] bond1: (slave dummy0): Releasing active interface [ 65.719368][ T6471] 9pnet_virtio: no channels available for device syz [ 65.829589][ T42] audit: type=1400 audit(1785375389.818:420): avc: denied { read write } for pid=6477 comm="syz.3.195" name="uinput" dev="devtmpfs" ino=944 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 65.839734][ T42] audit: type=1400 audit(1785375389.838:421): avc: denied { open } for pid=6477 comm="syz.3.195" path="/dev/uinput" dev="devtmpfs" ino=944 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 65.852567][ T6478] syz_tun: entered allmulticast mode [ 65.855926][ T6477] syz_tun: left allmulticast mode [ 66.002693][ T6486] netlink: 232 bytes leftover after parsing attributes in process `syz.0.194'. [ 66.031041][ T6489] syz_tun: entered allmulticast mode [ 66.033701][ T6488] syz_tun: left allmulticast mode [ 66.144126][ T6500] pim6reg: entered allmulticast mode [ 66.151941][ T6500] cgroup: fork rejected by pids controller in /syz0 [ 66.174651][ T6498] pim6reg: left allmulticast mode [ 66.376568][ T6514] syz_tun: entered allmulticast mode [ 66.398786][ T6513] syz_tun: left allmulticast mode [ 66.600059][ T5886] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.727116][ T6521] netlink: 20 bytes leftover after parsing attributes in process `syz.3.210'. [ 66.752959][ T5886] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.806164][ T5093] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 66.820225][ T5093] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 66.824330][ T5093] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 66.825445][ T5886] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.832336][ T5093] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 66.837134][ T5093] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 66.910264][ T6534] bond0: entered promiscuous mode [ 66.911067][ T6529] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 66.913693][ T6534] batadv0: entered promiscuous mode [ 66.918279][ T6534] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 66.922935][ T6534] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 66.928079][ T6534] bond0: left promiscuous mode [ 66.930856][ T6534] batadv0: left promiscuous mode [ 66.961171][ T5886] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.162122][ T6547] syz_tun: entered allmulticast mode [ 67.165955][ T6545] syz_tun: left allmulticast mode [ 67.201404][ T6548] 8021q: adding VLAN 0 to HW filter on device bond3 [ 67.242496][ T6556] PKCS7: Unknown OID: [4] 2.19.13055.1334505.0.0.0.0 [ 67.246525][ T6556] PKCS7: Only support pkcs7_signedData type [ 67.303861][ T1367] IPVS: starting estimator thread 0... [ 67.316757][ T6566] netlink: 40 bytes leftover after parsing attributes in process `syz.2.216'. [ 67.344777][ T5886] team0: Port device xfrm0 removed [ 67.356496][ T6567] gadgetfs: bound to dummy_udc driver [ 67.407031][ T6565] IPVS: using max 43 ests per chain, 103200 per kthread [ 67.426175][ T5886] bond0 (unregistering): Released all slaves [ 67.436523][ T5886] bond1 (unregistering): (slave veth3): Releasing active interface [ 67.443658][ T5886] bond1 (unregistering): Released all slaves [ 67.479330][ T6548] bond3: (slave veth7): Enslaving as an active interface with a down link [ 67.488661][ T1166] tipc: Resetting bearer [ 67.496463][ T5445] 8021q: adding VLAN 0 to HW filter on device eth2 [ 67.510167][ T6564] : entered promiscuous mode [ 67.563235][ T5886] tipc: Disabling bearer [ 67.567799][ T5886] tipc: Left network mode [ 67.925605][ T5445] 8021q: adding VLAN 0 to HW filter on device eth3 [ 67.961101][ T5886] hsr_slave_0: left promiscuous mode [ 67.964635][ T5886] hsr_slave_1: left promiscuous mode [ 67.979071][ T5886] veth1_macvtap: left promiscuous mode [ 67.982063][ T5886] veth0_macvtap: left promiscuous mode [ 67.984509][ T5886] veth1_vlan: left promiscuous mode [ 67.986759][ T5886] veth0_vlan: left promiscuous mode [ 68.273541][ T6592] bond0: entered promiscuous mode [ 68.275219][ T6592] bond_slave_0: entered promiscuous mode [ 68.277730][ T6592] bond_slave_1: entered promiscuous mode [ 68.282388][ T6592] batadv0: entered promiscuous mode [ 68.286352][ T6592] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 68.290591][ T6592] bond0: left promiscuous mode [ 68.292640][ T6592] bond_slave_0: left promiscuous mode [ 68.294832][ T6592] bond_slave_1: left promiscuous mode [ 68.298008][ T6592] batadv0: left promiscuous mode [ 68.360927][ T6524] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.363208][ T6524] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.365704][ T6524] bridge_slave_0: entered allmulticast mode [ 68.369019][ T6524] bridge_slave_0: entered promiscuous mode [ 68.372285][ T6524] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.374627][ T6524] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.377001][ T6524] bridge_slave_1: entered allmulticast mode [ 68.379741][ T6524] bridge_slave_1: entered promiscuous mode [ 68.415917][ T6524] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.420526][ T6524] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.457737][ T6524] team0: Port device team_slave_0 added [ 68.461096][ T6524] team0: Port device team_slave_1 added [ 68.473495][ T6606] syz_tun: entered allmulticast mode [ 68.477847][ T6606] FAULT_INJECTION: forcing a failure. [ 68.477847][ T6606] name failslab, interval 1, probability 0, space 0, times 0 [ 68.481954][ T6606] CPU: 2 UID: 0 PID: 6606 Comm: syz.3.227 Tainted: G L syzkaller #0 PREEMPT(full) [ 68.481972][ T6606] Tainted: [L]=SOFTLOCKUP [ 68.481976][ T6606] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 68.481988][ T6606] Call Trace: [ 68.481993][ T6606] [ 68.481998][ T6606] dump_stack_lvl+0x100/0x190 [ 68.482043][ T6606] should_fail_ex.cold+0x5/0xa [ 68.482072][ T6606] should_failslab+0xc2/0x120 [ 68.482096][ T6606] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 68.482118][ T6606] ? __alloc_skb+0x140/0x710 [ 68.482160][ T6606] __alloc_skb+0x140/0x710 [ 68.482172][ T6606] ? __alloc_skb+0x5b7/0x710 [ 68.482185][ T6606] ? __pfx___alloc_skb+0x10/0x10 [ 68.482199][ T6606] ? kmem_cache_alloc_noprof+0x2b1/0x6a0 [ 68.482214][ T6606] mroute_netlink_event+0x9d/0x160 [ 68.482240][ T6606] ipmr_cache_unresolved+0x7cb/0x9e0 [ 68.482261][ T6606] ip_mr_input+0xa1b/0xf40 [ 68.482274][ T6606] ? __pfx_ip_mr_input+0x10/0x10 [ 68.482287][ T6606] ? ip_rcv_finish_core+0x7ec/0x2c30 [ 68.482313][ T6606] ? __pfx_ip_mr_input+0x10/0x10 [ 68.482324][ T6606] ip_rcv+0x34e/0x3c0 [ 68.482341][ T6606] ? __pfx_ip_rcv+0x10/0x10 [ 68.482357][ T6606] __netif_receive_skb_one_core+0x197/0x1e0 [ 68.482371][ T6606] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 68.482384][ T6606] ? lock_acquire+0x1b9/0x370 [ 68.482408][ T6606] __netif_receive_skb+0x1f/0x120 [ 68.482420][ T6606] netif_receive_skb+0x139/0x7d0 [ 68.482432][ T6606] ? __pfx_netif_receive_skb+0x10/0x10 [ 68.482448][ T6606] tun_rx_batched.isra.0+0x3f6/0x750 [ 68.482484][ T6606] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 68.482505][ T6606] ? tun_get_user+0x1cc8/0x3c20 [ 68.482519][ T6606] tun_get_user+0x1e31/0x3c20 [ 68.482536][ T6606] ? __pfx_tun_get_user+0x10/0x10 [ 68.482547][ T6606] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 68.482569][ T6606] ? find_held_lock+0x2b/0x80 [ 68.482587][ T6606] ? tun_get+0x191/0x370 [ 68.482603][ T6606] ? tun_get+0x191/0x370 [ 68.482624][ T6606] tun_chr_write_iter+0xdc/0x200 [ 68.482636][ T6606] vfs_write+0x6ac/0x1050 [ 68.482661][ T6606] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 68.482673][ T6606] ? __pfx_vfs_write+0x10/0x10 [ 68.482690][ T6606] ? find_held_lock+0x2b/0x80 [ 68.482715][ T6606] ksys_write+0x12a/0x250 [ 68.482733][ T6606] ? __pfx_ksys_write+0x10/0x10 [ 68.482754][ T6606] do_syscall_64+0x115/0x870 [ 68.482799][ T6606] ? clear_bhb_loop+0x40/0x90 [ 68.482813][ T6606] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.482824][ T6606] RIP: 0033:0x7fc76975e7ce [ 68.482835][ T6606] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 68.482845][ T6606] RSP: 002b:00007fc76a731fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 68.482856][ T6606] RAX: ffffffffffffffda RBX: 00007fc76a7326c0 RCX: 00007fc76975e7ce [ 68.482863][ T6606] RDX: 000000000000003e RSI: 0000200000000040 RDI: 00000000000000c8 [ 68.482869][ T6606] RBP: 00007fc76a732090 R08: 0000000000000000 R09: 0000000000000000 [ 68.482875][ T6606] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 68.482881][ T6606] R13: 00007fc769a26038 R14: 00007fc769a25fa0 R15: 00007ffdc9a9f958 [ 68.482895][ T6606] [ 68.489342][ T6524] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.610685][ T6524] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.622094][ T6524] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.628686][ T6605] syz_tun: left allmulticast mode [ 68.634680][ T5445] 8021q: adding VLAN 0 to HW filter on device eth4 [ 68.641504][ T6524] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.645785][ T6524] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.656829][ T6524] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.737793][ T6524] hsr_slave_0: entered promiscuous mode [ 68.740176][ T6524] hsr_slave_1: entered promiscuous mode [ 68.743301][ T6524] debugfs: 'hsr0' already exists in 'hsr' [ 68.745162][ T6524] Cannot create hsr debugfs directory [ 68.772373][ T6634] lo speed is unknown, defaulting to 1000 [ 68.796325][ T6634] lo speed is unknown, defaulting to 1000 [ 68.832746][ T6634] lo speed is unknown, defaulting to 1000 [ 68.880911][ T6644] validate_nla: 5 callbacks suppressed [ 68.880924][ T6644] netlink: 'syz.1.233': attribute type 1 has an invalid length. [ 68.886986][ T6644] __nla_validate_parse: 3 callbacks suppressed [ 68.887051][ T6644] netlink: 232 bytes leftover after parsing attributes in process `syz.1.233'. [ 68.895331][ T6644] netlink: 'syz.1.233': attribute type 1 has an invalid length. [ 68.898930][ T5745] Bluetooth: hci3: command tx timeout [ 68.960508][ T5445] 8021q: adding VLAN 0 to HW filter on device eth5 [ 68.974698][ T6650] e1000 0000:00:06.0 eth0: Unsupported Speed/Duplex configuration [ 69.023762][ T6653] overlayfs: failed to get inode (-116) [ 69.026625][ T6653] overlayfs: failed to get inode (-116) [ 69.030811][ T6654] overlayfs: failed to get inode (-116) [ 69.073762][ T6634] infiniband syz1: set active [ 69.078153][ T56] lo speed is unknown, defaulting to 1000 [ 69.082109][ T6634] infiniband syz1: added lo [ 69.087420][ T6661] syz_tun: entered allmulticast mode [ 69.089847][ T6660] syz_tun: left allmulticast mode [ 69.106137][ T6634] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 69.117555][ T6634] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 69.137140][ T6634] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 69.173116][ T6634] RDS/IB: syz1: added [ 69.177268][ T6634] smc: adding ib device syz1 with port count 1 [ 69.179829][ T6634] smc: ib device syz1 port 1 has no pnetid [ 69.184672][ T34] lo speed is unknown, defaulting to 1000 [ 69.191582][ T6634] lo speed is unknown, defaulting to 1000 [ 69.384159][ T6634] lo speed is unknown, defaulting to 1000 [ 69.524748][ T6524] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 69.531123][ T6524] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 69.535031][ T6524] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 69.545009][ T6524] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 69.548208][ T6524] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 69.552273][ T6524] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 69.555101][ T6524] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 69.560916][ T6524] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 69.659746][ T6524] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.678175][ T6524] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.686595][ T1166] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.689481][ T1166] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.701531][ T6634] lo speed is unknown, defaulting to 1000 [ 69.701925][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.706123][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.813467][ T42] kauditd_printk_skb: 55 callbacks suppressed [ 69.813491][ T42] audit: type=1400 audit(1785375393.808:477): avc: denied { write } for pid=6707 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 69.829888][ T6634] lo speed is unknown, defaulting to 1000 [ 69.896274][ T42] audit: type=1400 audit(1785375393.888:478): avc: denied { write } for pid=6713 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 69.956643][ T6701] pci 0000:00:01.0: [1af4:1050] type 00 class 0x030000 conventional PCI endpoint [ 69.999001][ T6701] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x807fffff pref] [ 70.006931][ T6701] pci 0000:00:01.0: BAR 2 [mem 0x380800000000-0x380800003fff 64bit pref] [ 70.013740][ T42] audit: type=1400 audit(1785375394.008:479): avc: denied { watch } for pid=6721 comm="syz.2.243" path="/76/bus" dev="tmpfs" ino=445 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 70.015379][ T6701] pci 0000:00:01.0: BAR 4 [mem 0x80800000-0x80800fff] [ 70.022194][ T42] audit: type=1400 audit(1785375394.018:480): avc: denied { watch_sb watch_reads } for pid=6721 comm="syz.2.243" path="/76/bus" dev="tmpfs" ino=445 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 70.031899][ T6701] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 70.036555][ T6701] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 70.038973][ T6524] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.057119][ T6701] pci 0000:00:01.0: Adding to iommu group 1 [ 70.076657][ T6701] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 70.078716][ T6524] veth0_vlan: entered promiscuous mode [ 70.079565][ T6701] pci 0000:00:01.0: vgaarb: bridge control possible [ 70.079591][ T6701] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 70.085577][ T6524] veth1_vlan: entered promiscuous mode [ 70.099772][ T6701] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x807fffff pref]: assigned [ 70.104022][ T6701] pci 0000:00:01.0: BAR 2 [mem 0x380800000000-0x380800003fff 64bit pref]: assigned [ 70.121039][ T6701] pci 0000:00:01.0: BAR 4 [mem 0x80800000-0x80800fff]: assigned [ 70.125264][ T6524] veth0_macvtap: entered promiscuous mode [ 70.132475][ T6524] veth1_macvtap: entered promiscuous mode [ 70.141822][ T6524] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.149684][ T6524] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.158869][ T6648] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.162497][ T6648] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.167096][ T6648] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.171274][ T6648] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.175407][ T6701] [drm] pci: virtio-vga detected at 0000:00:01.0 [ 70.178547][ T6701] virtio-pci 0000:00:01.0: vgaarb: deactivate vga console [ 70.183731][ T6701] [drm] features: -virgl +edid -resource_blob -host_visible [ 70.183743][ T6701] [drm] features: -context_init -blob_alignment [ 70.196633][ T6701] [drm] number of scanouts: 1 [ 70.199479][ T6701] [drm] number of cap sets: 0 [ 70.232515][ T6701] [drm] Initialized virtio_gpu 0.1.0 for 0000:00:01.0 on minor 2 [ 70.245334][ T6623] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.251055][ T6623] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.276233][ T6701] virtio-pci 0000:00:01.0: [drm] fb1: virtio_gpudrmfb frame buffer device [ 70.278009][ T6623] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.281758][ T6623] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.282108][ T42] audit: type=1400 audit(1785375394.278:481): avc: denied { create } for pid=6728 comm="syz.3.245" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 70.295040][ T42] audit: type=1400 audit(1785375394.278:482): avc: denied { connect } for pid=6728 comm="syz.3.245" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 70.303798][ T42] audit: type=1400 audit(1785375394.278:483): avc: denied { write } for pid=6728 comm="syz.3.245" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 70.311061][ T42] audit: type=1400 audit(1785375394.278:484): avc: denied { getopt } for pid=6728 comm="syz.3.245" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 70.317640][ T42] audit: type=1400 audit(1785375394.288:485): avc: denied { setopt } for pid=6728 comm="syz.3.245" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 70.327779][ T6731] syz_tun: entered allmulticast mode [ 70.331006][ T6730] syz_tun: left allmulticast mode [ 70.358666][ T6736] syz_tun: entered allmulticast mode [ 70.362952][ T6733] syz_tun: left allmulticast mode [ 70.384953][ T6737] loop2: detected capacity change from 0 to 7 [ 70.390471][ T6737] Dev loop2: unable to read RDB block 7 [ 70.394876][ T6737] loop2: AHDI p1 p2 p3 [ 70.396391][ T6737] loop2: partition table partially beyond EOD, truncated [ 70.400230][ T6737] loop2: p1 start 1601398130 is beyond EOD, truncated [ 70.402721][ T6737] loop2: p2 start 1702059890 is beyond EOD, truncated [ 70.405951][ T6741] netlink: 4 bytes leftover after parsing attributes in process `syz.0.250'. [ 70.409793][ T6741] hsr_slave_0: left promiscuous mode [ 70.415187][ T42] audit: type=1400 audit(1785375394.408:486): avc: denied { bind } for pid=6735 comm="syz.2.248" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 70.422272][ T6741] hsr_slave_1: left promiscuous mode [ 70.750594][ T6755] netlink: 8 bytes leftover after parsing attributes in process `syz.3.254'. [ 70.771985][ T6755] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.775186][ T6755] netlink: 256 bytes leftover after parsing attributes in process `syz.3.254'. [ 70.779703][ T6755] unsupported nlmsg_type 40 [ 70.870288][ T6757] SQUASHFS error: Failed to read block 0x0: -5 [ 70.872548][ T6757] unable to read squashfs_super_block [ 70.977243][ T5745] Bluetooth: hci3: command tx timeout [ 71.107971][ T6765] syz_tun: entered allmulticast mode [ 71.111542][ T6764] syz_tun: left allmulticast mode [ 71.147546][ T6762] CIFS mount error: No usable UNC path provided in device string! [ 71.147546][ T6762] [ 71.151545][ T6762] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 71.228624][ T6776] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 71.342901][ T6785] bridge_slave_0: left allmulticast mode [ 71.345165][ T6785] bridge_slave_0: left promiscuous mode [ 71.348028][ T6785] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.353427][ T6785] bridge_slave_1: left allmulticast mode [ 71.355837][ T6785] bridge_slave_1: left promiscuous mode [ 71.358538][ T6785] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.370061][ T6785] bond0: (slave bond_slave_0): Releasing backup interface [ 71.376558][ T6785] bond0: (slave bond_slave_1): Releasing backup interface [ 71.380071][ T1444] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.382736][ T1444] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.387916][ T6785] team0: Port device team_slave_0 removed [ 71.392399][ T6785] team0: Port device team_slave_1 removed [ 71.394779][ T6785] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 71.398044][ T6785] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 71.401393][ T6785] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 71.403869][ T6785] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 71.408666][ T6785] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 71.423308][ T6789] team0: Port device xfrm0 added [ 71.434405][ T6785] tipc: Started in network mode [ 71.436390][ T6785] tipc: Node identity 924dd45334a4, cluster identity 4711 [ 71.440408][ T6785] tipc: Enabled bearer , priority 0 [ 71.505598][ T6798] netlink: 'syz.2.266': attribute type 1 has an invalid length. [ 71.538867][ T1166] Bluetooth: hci4: Frame reassembly failed (-84) [ 71.540817][ T6798] 8021q: adding VLAN 0 to HW filter on device bond4 [ 71.543128][ T1166] Bluetooth: hci4: Frame reassembly failed (-84) [ 71.572524][ T6798] bond4: (slave veth9): Enslaving as an active interface with a down link [ 71.583658][ T6798] netlink: 'syz.2.266': attribute type 10 has an invalid length. [ 71.586199][ T6798] netlink: 40 bytes leftover after parsing attributes in process `syz.2.266'. [ 71.619047][ T6805] xt_l2tp: missing protocol rule (udp|l2tpip) [ 71.667987][ T6808] syz_tun: entered allmulticast mode [ 71.671371][ T6807] syz_tun: left allmulticast mode [ 72.239060][ T6815] netlink: 12 bytes leftover after parsing attributes in process `syz.0.271'. [ 72.243219][ T6815] netlink: 12 bytes leftover after parsing attributes in process `syz.0.271'. [ 72.246937][ T6815] netlink: 'syz.0.271': attribute type 21 has an invalid length. [ 72.307603][ T6821] netlink: 'syz.0.274': attribute type 1 has an invalid length. [ 72.310893][ T6821] netlink: 232 bytes leftover after parsing attributes in process `syz.0.274'. [ 72.314687][ T6821] netlink: 'syz.0.274': attribute type 1 has an invalid length. [ 72.366658][ T6823] fuse: Unknown parameter '0x00000000000000060x0000000000000006' [ 72.421083][ T6830] netlink: 'syz.2.277': attribute type 1 has an invalid length. [ 72.445334][ T6830] 8021q: adding VLAN 0 to HW filter on device bond5 [ 72.450035][ T1367] tipc: Node number set to 2800342099 [ 72.490027][ T6830] bond5: (slave veth11): Enslaving as an active interface with a down link [ 72.491042][ T6831] sctp: [Deprecated]: syz.0.275 (pid 6831) Use of struct sctp_assoc_value in delayed_ack socket option. [ 72.491042][ T6831] Use struct sctp_sack_info instead [ 72.497475][ T34] usb 6-1: new low-speed USB device number 5 using dummy_hcd [ 72.498978][ T6830] netlink: 'syz.2.277': attribute type 10 has an invalid length. [ 72.498996][ T6830] netlink: 40 bytes leftover after parsing attributes in process `syz.2.277'. [ 72.540236][ T6837] bond0: entered promiscuous mode [ 72.543553][ T6837] batadv0: entered promiscuous mode [ 72.548176][ T6837] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 72.551799][ T6837] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 72.554798][ T6837] bond0: left promiscuous mode [ 72.559864][ T6837] batadv0: left promiscuous mode [ 72.658692][ T6841] netlink: 60 bytes leftover after parsing attributes in process `syz.2.280'. [ 72.660993][ T34] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 72.665397][ T34] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 72.669872][ T34] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 72.674537][ T34] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 72.679525][ T34] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 72.685292][ T34] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 72.688614][ T34] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 72.693098][ T34] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 72.698534][ T34] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 72.702934][ T34] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 72.709475][ T34] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 72.712600][ T34] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 72.716832][ T34] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 72.721927][ T34] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 72.726191][ T34] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 72.734665][ T34] usb 6-1: string descriptor 0 read error: -22 [ 72.736482][ T6839] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.737726][ T34] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 72.740257][ T6839] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.743623][ T34] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.765402][ T34] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 72.802282][ T6839] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 72.810158][ T6839] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 72.894738][ T6845] syz_tun: entered allmulticast mode [ 72.897538][ T5811] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.901234][ T5811] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.905822][ T5811] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.911179][ T6842] syz_tun: left allmulticast mode [ 72.924530][ T5811] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.960080][ T6819] netlink: 'syz.1.273': attribute type 1 has an invalid length. [ 72.971835][ T29] usb 6-1: USB disconnect, device number 5 [ 72.999090][ T6819] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 73.008491][ T6819] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 73.016241][ T6819] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 73.056957][ T5093] Bluetooth: hci3: command tx timeout [ 73.538374][ T5093] Bluetooth: hci4: command 0xfc11 tx timeout [ 73.539383][ T5745] Bluetooth: hci4: Entering manufacturer mode failed (-110) [ 73.720919][ T6870] team0: Port device xfrm0 removed [ 73.724131][ T6870] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 73.733118][ T29] lo speed is unknown, defaulting to 1000 [ 73.733475][ T6621] tipc: Resetting bearer [ 73.746829][ T6870] team0: Port device xfrm0 added [ 73.755141][ T6873] input: syz0 as /devices/virtual/input/input38 [ 73.758292][ T6873] input: failed to attach handler leds to device input38, error: -6 [ 73.775712][ T6870] tipc: Enabling of bearer rejected, already enabled [ 73.834532][ T6877] syz_tun: entered allmulticast mode [ 73.839173][ T6876] syz_tun: left allmulticast mode [ 73.945242][ T6882] __nla_validate_parse: 2 callbacks suppressed [ 73.945263][ T6882] netlink: 28 bytes leftover after parsing attributes in process `syz.2.293'. [ 73.995594][ T6889] validate_nla: 2 callbacks suppressed [ 73.995614][ T6889] netlink: 'syz.0.296': attribute type 1 has an invalid length. [ 74.007790][ T6885] nvme_fabrics: missing parameter 'transport=%s' [ 74.011214][ T6885] nvme_fabrics: missing parameter 'nqn=%s' [ 74.114417][ T6899] Bluetooth: MGMT ver 1.23 [ 74.126694][ T6899] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 74.148845][ T6905] netlink: 'syz.3.301': attribute type 1 has an invalid length. [ 74.189762][ T6905] 8021q: adding VLAN 0 to HW filter on device bond2 [ 74.203854][ T6905] bond2: (slave geneve2): making interface the new active one [ 74.207610][ T6905] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 74.273569][ T6917] netlink: 28 bytes leftover after parsing attributes in process `syz.3.305'. [ 74.363499][ T6924] syz_tun: entered allmulticast mode [ 74.366601][ T6923] syz_tun: left allmulticast mode [ 74.382809][ T6928] overlayfs: missing 'lowerdir' [ 74.446059][ T6934] MTRR 1 not used [ 74.759962][ T6967] netlink: 8 bytes leftover after parsing attributes in process `syz.1.317'. [ 74.763321][ T6967] netlink: 12 bytes leftover after parsing attributes in process `syz.1.317'. [ 74.766730][ T6967] netlink: 'syz.1.317': attribute type 12 has an invalid length. [ 74.827752][ T6967] netlink: 8 bytes leftover after parsing attributes in process `syz.1.317'. [ 74.830923][ T5886] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 74.836224][ T6967] netlink: 12 bytes leftover after parsing attributes in process `syz.1.317'. [ 74.839430][ T5886] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 74.840447][ T6967] netlink: 'syz.1.317': attribute type 12 has an invalid length. [ 74.846801][ T5886] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 74.854176][ T5886] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 74.872529][ T42] kauditd_printk_skb: 50 callbacks suppressed [ 74.872554][ T42] audit: type=1400 audit(1785375398.868:537): avc: denied { getopt } for pid=6977 comm="syz.2.320" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 74.894546][ T6976] netlink: 872 bytes leftover after parsing attributes in process `syz.0.319'. [ 74.898966][ T6976] netlink: 872 bytes leftover after parsing attributes in process `syz.0.319'. [ 74.923846][ T6984] bond0: entered promiscuous mode [ 74.933124][ T6984] batadv0: entered promiscuous mode [ 74.940384][ T6984] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 74.945519][ T6984] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 74.957828][ T6984] bond0: left promiscuous mode [ 74.962527][ T6984] batadv0: left promiscuous mode [ 75.005225][ T6994] netlink: 28 bytes leftover after parsing attributes in process `syz.2.324'. [ 75.081555][ T7005] syz_tun: entered allmulticast mode [ 75.085108][ T7005] netlink: 8 bytes leftover after parsing attributes in process `syz.1.327'. [ 75.106919][ T7004] syz_tun: left allmulticast mode [ 75.147035][ T5745] Bluetooth: hci3: command tx timeout [ 75.266049][ T7021] netlink: 'syz.2.330': attribute type 1 has an invalid length. [ 75.293256][ T7021] 8021q: adding VLAN 0 to HW filter on device bond6 [ 75.336702][ T7021] bond6: (slave veth13): Enslaving as an active interface with a down link [ 75.345563][ T7021] netlink: 'syz.2.330': attribute type 10 has an invalid length. [ 75.459855][ T7040] team0: Port device xfrm0 removed [ 75.466358][ T7040] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 75.491418][ T1166] tipc: Resetting bearer [ 75.500853][ T7042] sock: sock_set_timeout: `syz.0.329' (pid 7042) tries to set negative timeout [ 75.507102][ T7040] team0: Port device xfrm0 added [ 75.509571][ T42] audit: type=1400 audit(1785375399.508:538): avc: denied { read } for pid=7041 comm="syz.0.329" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 75.525321][ T7040] tipc: Enabling of bearer rejected, already enabled [ 75.542847][ T7048] syz_tun: entered allmulticast mode [ 75.548646][ T7047] syz_tun: left allmulticast mode [ 75.632233][ T7054] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 75.745780][ T7070] syz_tun: entered allmulticast mode [ 75.751314][ T7069] syz_tun: left allmulticast mode [ 75.852769][ T7079] bridge_slave_0: left allmulticast mode [ 75.855018][ T7079] bridge_slave_0: left promiscuous mode [ 75.859830][ T7079] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.866279][ T7079] bridge_slave_1: left allmulticast mode [ 75.869062][ T7079] bridge_slave_1: left promiscuous mode [ 75.871549][ T7079] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.881746][ T7079] bond0: (slave bond_slave_0): Releasing backup interface [ 75.892871][ T7079] bond0: (slave bond_slave_1): Releasing backup interface [ 75.918321][ T7079] team0: Port device team_slave_0 removed [ 75.924342][ T7079] team0: Port device team_slave_1 removed [ 75.927788][ T7079] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 75.930917][ T7079] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 75.934755][ T7079] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 75.938751][ T7079] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 75.943011][ T7079] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 75.963323][ T7085] team0: Port device xfrm0 added [ 75.965246][ T7090] tipc: Started in network mode [ 75.967195][ T7090] tipc: Node identity 26b06458c63b, cluster identity 4711 [ 75.970574][ T7090] tipc: Enabled bearer , priority 0 [ 76.116249][ T7101] Bluetooth: hci4: Frame reassembly failed (-84) [ 76.127080][ T1166] Bluetooth: hci4: Frame reassembly failed (-84) [ 76.139138][ T7101] loop6: detected capacity change from 0 to 8 [ 76.209203][ T7101] loop6: detected capacity change from 8 to 7 [ 76.281081][ C3] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 76.285319][ C3] Buffer I/O error on dev loop6, logical block 0, async page read [ 76.290512][ C3] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 76.294486][ C3] Buffer I/O error on dev loop6, logical block 0, async page read [ 76.299002][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 76.302879][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 76.309903][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 76.313901][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 76.318495][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 76.322553][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 76.339262][ C3] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 76.343292][ C3] Buffer I/O error on dev loop6, logical block 0, async page read [ 76.347750][ C3] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 76.351753][ C3] Buffer I/O error on dev loop6, logical block 0, async page read [ 76.354684][ T7101] ldm_validate_partition_table(): Disk read failed. [ 76.360401][ C3] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 76.364476][ C3] Buffer I/O error on dev loop6, logical block 0, async page read [ 76.368492][ C3] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 76.372547][ C3] Buffer I/O error on dev loop6, logical block 0, async page read [ 76.376124][ C3] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 76.380362][ C3] Buffer I/O error on dev loop6, logical block 0, async page read [ 76.384468][ T7101] Dev loop6: unable to read RDB block 0 [ 76.387943][ T7101] loop6: unable to read partition table [ 76.392422][ T7101] loop6: partition table beyond EOD, truncated [ 76.395499][ T7101] loop_reread_partitions: partition scan of loop6 (°´[{BÑ·¶žMܾ`*ÎîZ´Å5š]z(¿Ťî4pX) failed (rc=-5) [ 76.772722][ T7133] qnx4: no qnx4 filesystem (no root dir). [ 76.795725][ T42] audit: type=1400 audit(1785375400.788:539): avc: denied { create } for pid=7135 comm="syz.1.358" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 76.915157][ T5886] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 76.918661][ T5886] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 76.921565][ T5886] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 76.924336][ T5886] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 76.934218][ T7144] vlan2: entered promiscuous mode [ 76.935979][ T7144] bridge0: entered promiscuous mode [ 76.966092][ T7149] openvswitch: netlink: IP tunnel dst address not specified [ 76.967039][ T5824] tipc: Node number set to 3767231576 [ 76.983247][ T7150] netlink: 'syz.0.357': attribute type 4 has an invalid length. [ 77.025503][ T7152] team0: Port device xfrm0 removed [ 77.029146][ T7152] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 77.036344][ T1169] tipc: Resetting bearer [ 77.051916][ T7152] team0: Port device xfrm0 added [ 77.061943][ T7152] tipc: Enabling of bearer rejected, already enabled [ 77.105922][ T7156] bridge_slave_0: left allmulticast mode [ 77.108916][ T7156] bridge_slave_0: left promiscuous mode [ 77.111261][ T7156] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.116630][ T7156] bridge_slave_1: left allmulticast mode [ 77.119741][ T7156] bridge_slave_1: left promiscuous mode [ 77.121973][ T7156] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.132865][ T7156] bond0: (slave bond_slave_0): Releasing backup interface [ 77.145666][ T7156] bond0: (slave bond_slave_1): Releasing backup interface [ 77.153904][ T7156] team0: Port device team_slave_0 removed [ 77.156798][ T42] audit: type=1400 audit(1785375401.148:540): avc: denied { read append } for pid=7157 comm="syz.1.366" name="snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 77.164305][ T42] audit: type=1400 audit(1785375401.158:541): avc: denied { open } for pid=7157 comm="syz.1.366" path="/dev/snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 77.164656][ T7156] team0: Port device team_slave_1 removed [ 77.175106][ T7156] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 77.178728][ T7156] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 77.188540][ T7159] team0: Port device xfrm0 added [ 77.190946][ T7156] FAULT_INJECTION: forcing a failure. [ 77.190946][ T7156] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 77.195738][ T7156] CPU: 2 UID: 0 PID: 7156 Comm: syz.0.365 Tainted: G L syzkaller #0 PREEMPT(full) [ 77.195761][ T7156] Tainted: [L]=SOFTLOCKUP [ 77.195766][ T7156] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.195783][ T7156] Call Trace: [ 77.195790][ T7156] [ 77.195797][ T7156] dump_stack_lvl+0x100/0x190 [ 77.195849][ T7156] should_fail_ex.cold+0x5/0xa [ 77.195876][ T7156] _copy_from_user+0x2e/0xd0 [ 77.195944][ T7156] copy_msghdr_from_user+0x9f/0x4c0 [ 77.196028][ T7156] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 77.196067][ T7156] ___sys_sendmsg+0x106/0x1e0 [ 77.196095][ T7156] ? __pfx____sys_sendmsg+0x10/0x10 [ 77.196120][ T7156] ? __lock_acquire+0x49f/0x1a40 [ 77.196151][ T7156] ? get_pid_task+0x106/0x250 [ 77.196210][ T7156] __sys_sendmsg+0x160/0x210 [ 77.196231][ T7156] ? __pfx___sys_sendmsg+0x10/0x10 [ 77.196262][ T7156] do_syscall_64+0x115/0x870 [ 77.196322][ T7156] ? clear_bhb_loop+0x40/0x90 [ 77.196345][ T7156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.196364][ T7156] RIP: 0033:0x7fcaba99df99 [ 77.196381][ T7156] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.196397][ T7156] RSP: 002b:00007fcab8bf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 77.196415][ T7156] RAX: ffffffffffffffda RBX: 00007fcabac25fa0 RCX: 00007fcaba99df99 [ 77.196428][ T7156] RDX: 0000000020042000 RSI: 0000200000000440 RDI: 0000000000000004 [ 77.196438][ T7156] RBP: 00007fcab8bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 77.196449][ T7156] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.196459][ T7156] R13: 00007fcabac26038 R14: 00007fcabac25fa0 R15: 00007ffecdeae3a8 [ 77.196482][ T7156] [ 77.207214][ T42] audit: type=1400 audit(1785375401.208:542): avc: denied { write } for pid=7157 comm="syz.1.366" name="card1" dev="devtmpfs" ino=636 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 77.224160][ T7160] overlayfs: failed to resolve './file2': -2 [ 77.278521][ T7158] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 77.281217][ T7158] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 77.293271][ T7158] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 77.297359][ T7158] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 77.300213][ T7158] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 77.309346][ T7158] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 77.313753][ T7158] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 77.315780][ T7158] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 77.320677][ T7158] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 77.324523][ T7158] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 77.326473][ T7158] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 77.331471][ T7158] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 77.419593][ T7162] team0: Port device xfrm0 removed [ 77.422937][ T7162] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 77.430540][ T6614] tipc: Resetting bearer [ 77.444546][ T7162] team0: Port device xfrm0 added [ 77.450685][ T7162] tipc: Enabling of bearer rejected, already enabled [ 77.776068][ T7169] sctp: [Deprecated]: syz.1.370 (pid 7169) Use of int in max_burst socket option. [ 77.776068][ T7169] Use struct sctp_assoc_value instead [ 77.783273][ T42] audit: type=1400 audit(1785375401.778:543): avc: denied { mount } for pid=7168 comm="syz.1.370" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 77.785546][ T7169] vhci_hcd vhci_hcd.0: remove, state 4 [ 77.795149][ T7169] usb usb38: USB disconnect, device number 1 [ 77.837606][ T6648] vhci_hcd vhci_hcd.0: stop threads [ 77.839670][ T6648] vhci_hcd vhci_hcd.0: release socket [ 77.843007][ T6648] vhci_hcd vhci_hcd.0: disconnect device [ 77.848963][ T6648] vhci_hcd vhci_hcd.0: stop threads [ 77.851074][ T6648] vhci_hcd vhci_hcd.0: release socket [ 77.853262][ T6648] vhci_hcd vhci_hcd.0: disconnect device [ 77.860607][ T5597] vhci_hcd vhci_hcd.0: stop threads [ 77.862764][ T5597] vhci_hcd vhci_hcd.0: release socket [ 77.868357][ T5597] vhci_hcd vhci_hcd.0: disconnect device [ 77.871827][ T5597] vhci_hcd vhci_hcd.0: stop threads [ 77.874314][ T5597] vhci_hcd vhci_hcd.0: release socket [ 77.875027][ T7173] syz.3.371 uses obsolete (PF_INET,SOCK_PACKET) [ 77.877159][ T5597] vhci_hcd vhci_hcd.0: disconnect device [ 77.884583][ T5597] vhci_hcd vhci_hcd.0: stop threads [ 77.888255][ T5597] vhci_hcd vhci_hcd.0: release socket [ 77.890467][ T5597] vhci_hcd vhci_hcd.0: disconnect device [ 77.892536][ T5597] vhci_hcd vhci_hcd.0: stop threads [ 77.894780][ T5597] vhci_hcd vhci_hcd.0: release socket [ 77.896831][ T5597] vhci_hcd vhci_hcd.0: disconnect device [ 77.903075][ T5597] vhci_hcd vhci_hcd.0: stop threads [ 77.906271][ T5597] vhci_hcd vhci_hcd.0: release socket [ 77.908921][ T5597] vhci_hcd vhci_hcd.0: disconnect device [ 77.914550][ T5597] vhci_hcd vhci_hcd.0: stop threads [ 77.917959][ T5597] vhci_hcd vhci_hcd.0: release socket [ 77.920488][ T5597] vhci_hcd vhci_hcd.0: disconnect device [ 77.927172][ T7169] vhci_hcd vhci_hcd.0: USB bus 38 deregistered [ 77.935516][ T7169] vhci_hcd vhci_hcd.0: remove, state 4 [ 77.937673][ T7169] usb usb37: USB disconnect, device number 1 [ 77.953680][ T6648] vhci_hcd vhci_hcd.0: stop threads [ 77.955443][ T6648] vhci_hcd vhci_hcd.0: release socket [ 77.957581][ T6648] vhci_hcd vhci_hcd.0: disconnect device [ 77.961645][ T6648] vhci_hcd vhci_hcd.0: stop threads [ 77.963862][ T6648] vhci_hcd vhci_hcd.0: release socket [ 77.966051][ T6648] vhci_hcd vhci_hcd.0: disconnect device [ 77.968483][ T6648] vhci_hcd vhci_hcd.0: stop threads [ 77.970760][ T6648] vhci_hcd vhci_hcd.0: release socket [ 77.973738][ T6648] vhci_hcd vhci_hcd.0: disconnect device [ 77.975970][ T6648] vhci_hcd vhci_hcd.0: stop threads [ 77.978482][ T6648] vhci_hcd vhci_hcd.0: release socket [ 77.980308][ T6648] vhci_hcd vhci_hcd.0: disconnect device [ 77.982241][ T6648] vhci_hcd vhci_hcd.0: stop threads [ 77.983966][ T6648] vhci_hcd vhci_hcd.0: release socket [ 77.985723][ T6648] vhci_hcd vhci_hcd.0: disconnect device [ 77.988044][ T6648] vhci_hcd vhci_hcd.0: stop threads [ 77.989791][ T6648] vhci_hcd vhci_hcd.0: release socket [ 77.991536][ T6648] vhci_hcd vhci_hcd.0: disconnect device [ 77.993450][ T6648] vhci_hcd vhci_hcd.0: stop threads [ 77.995155][ T6648] vhci_hcd vhci_hcd.0: release socket [ 77.996991][ T6648] vhci_hcd vhci_hcd.0: disconnect device [ 77.999072][ T6648] vhci_hcd vhci_hcd.0: stop threads [ 78.000914][ T6648] vhci_hcd vhci_hcd.0: release socket [ 78.002787][ T6648] vhci_hcd vhci_hcd.0: disconnect device [ 78.004676][ T7169] vhci_hcd vhci_hcd.0: USB bus 37 deregistered [ 78.016306][ T7171] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller [ 78.024040][ T7171] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 37 [ 78.027855][ T7171] vhci_hcd vhci_hcd.0: created sysfs vhci_hcd.0 [ 78.032637][ T7171] usb usb37: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 78.035841][ T7171] usb usb37: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 78.038490][ T7171] usb usb37: Product: USB/IP Virtual Host Controller [ 78.040630][ T7171] usb usb37: Manufacturer: Linux syzkaller vhci_hcd [ 78.043395][ T7171] usb usb37: SerialNumber: vhci_hcd.0 [ 78.054387][ T7171] hub 37-0:1.0: USB hub found [ 78.058156][ T7171] hub 37-0:1.0: 8 ports detected [ 78.084076][ T7171] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller [ 78.093531][ T7171] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 38 [ 78.095035][ T42] audit: type=1400 audit(1785375402.088:544): avc: denied { create } for pid=7184 comm="syz.0.375" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 78.096487][ T7171] usb usb38: We don't know the algorithms for LPM for this host, disabling LPM. [ 78.107556][ T42] audit: type=1400 audit(1785375402.108:545): avc: denied { unlink } for pid=7184 comm="syz.0.375" name="file0" dev="tmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 78.108450][ T7171] usb usb38: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 7.02 [ 78.119641][ T7171] usb usb38: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 78.122401][ T7171] usb usb38: Product: USB/IP Virtual Host Controller [ 78.124658][ T7171] usb usb38: Manufacturer: Linux syzkaller vhci_hcd [ 78.126784][ T7171] usb usb38: SerialNumber: vhci_hcd.0 [ 78.136281][ T7171] hub 38-0:1.0: USB hub found [ 78.138451][ T7171] hub 38-0:1.0: 8 ports detected [ 78.168246][ T7188] netlink: 'syz.0.376': attribute type 1 has an invalid length. [ 78.175317][ T42] audit: type=1400 audit(1785375402.168:546): avc: denied { unmount } for pid=5732 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 78.187105][ T5745] Bluetooth: hci4: Entering manufacturer mode failed (-110) [ 78.187791][ T5093] Bluetooth: hci4: command 0xfc11 tx timeout [ 78.224271][ T7188] 8021q: adding VLAN 0 to HW filter on device bond1 [ 78.231423][ T7193] bond0: entered promiscuous mode [ 78.234548][ T7193] batadv0: entered promiscuous mode [ 78.238229][ T7193] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 78.242690][ T7193] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 78.249471][ T7193] bond0: left promiscuous mode [ 78.260398][ T7193] batadv0: left promiscuous mode [ 78.307505][ T7194] bond1: (slave veth3): Enslaving as an active interface with a down link [ 78.315025][ T7188] bond1: (slave dummy0): making interface the new active one [ 78.323536][ T7188] dummy0: entered promiscuous mode [ 78.325862][ T7188] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 78.332754][ T7188] netlink: 'syz.0.376': attribute type 10 has an invalid length. [ 78.337511][ T7188] bond1: (slave dummy0): Releasing active interface [ 78.372722][ T7200] netlink: 'syz.1.380': attribute type 4 has an invalid length. [ 78.373318][ T7198] VFS: Lookup of 'file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' in fuse fuse would have caused loop [ 78.403222][ T7202] team0: Port device xfrm0 removed [ 78.410859][ T7202] bond1: (slave veth3): Releasing active interface [ 78.464118][ T7208] team0: Port device xfrm0 removed [ 78.473130][ T7208] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 78.490840][ T7202] team0: Port device xfrm0 added [ 78.497302][ T6621] tipc: Resetting bearer [ 78.504315][ T7208] team0: Port device xfrm0 added [ 78.509597][ T7202] tipc: Started in network mode [ 78.511993][ T7202] tipc: Node identity 5eb4655f14f5, cluster identity 4711 [ 78.515264][ T7202] tipc: Enabled bearer , priority 0 [ 78.763139][ T7226] 8021q: adding VLAN 0 to HW filter on device bond7 [ 78.802882][ T7226] bond7: (slave veth15): Enslaving as an active interface with a down link [ 78.855237][ T7229] .`: renamed from bond0 (while UP) [ 79.155742][ T7242] trusted_key: encrypted_key: insufficient parameters specified [ 79.218516][ T7245] trusted_key: encrypted_key: insufficient parameters specified [ 79.290797][ T7249] usb usb8: usbfs: process 7249 (syz.1.399) did not claim interface 0 before use [ 79.299190][ T5745] Bluetooth: hci0: command 0x0c1a tx timeout [ 79.371759][ T7254] cgroup2: Unknown parameter 'smackfsroot' [ 79.373893][ T7254] overlay: Bad value for 'workdir' [ 79.377188][ T5745] Bluetooth: hci3: command 0x0c1a tx timeout [ 79.377214][ T5093] Bluetooth: hci2: command 0x0c1a tx timeout [ 79.380861][ T5741] Bluetooth: hci1: command 0x0c1a tx timeout [ 79.423805][ T7260] overlayfs: failed to decode file handle (len=8, type=8192, flags=0, err=-22) [ 79.432111][ T7260] overlayfs: workdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 79.490099][ T7263] validate_nla: 3 callbacks suppressed [ 79.490118][ T7263] netlink: 'syz.2.402': attribute type 1 has an invalid length. [ 79.512331][ T7263] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.539407][ T7263] bond0: (slave veth17): Enslaving as an active interface with a down link [ 79.547980][ T7263] netlink: 'syz.2.402': attribute type 10 has an invalid length. [ 79.550410][ T7263] __nla_validate_parse: 20 callbacks suppressed [ 79.550419][ T7263] netlink: 40 bytes leftover after parsing attributes in process `syz.2.402'. [ 79.567167][ T1486] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 79.582169][ T7266] netlink: 'syz.2.403': attribute type 1 has an invalid length. [ 79.584690][ T7266] netlink: 756 bytes leftover after parsing attributes in process `syz.2.403'. [ 79.616299][ T7268] netlink: 4 bytes leftover after parsing attributes in process `syz.2.404'. [ 79.623585][ T7268] netlink: 4 bytes leftover after parsing attributes in process `syz.2.404'. [ 79.627530][ T7268] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2049 sclass=netlink_route_socket pid=7268 comm=syz.2.404 [ 79.637906][ T5735] tipc: Node number set to 1245799775 [ 79.726950][ T1486] usb 6-1: Using ep0 maxpacket: 8 [ 79.732659][ T1486] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 79.736138][ T1486] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 79.739877][ T1486] usb 6-1: config 0 interface 0 has no altsetting 0 [ 79.742003][ T1486] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 79.745079][ T1486] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.751865][ T1486] usb 6-1: config 0 descriptor?? [ 79.902203][ T7280] team0: Port device xfrm0 removed [ 79.905407][ T7280] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 79.915401][ T6621] tipc: Resetting bearer [ 79.925097][ T7280] team0: Port device xfrm0 added [ 79.933377][ T7280] tipc: Enabling of bearer rejected, already enabled [ 80.378089][ T7251] team0: Port device xfrm0 removed [ 80.380562][ T7251] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 80.387280][ T6614] tipc: Resetting bearer [ 80.396672][ T7251] team0: Port device xfrm0 added [ 80.399958][ T7251] tipc: Enabling of bearer rejected, failed to enable media [ 80.411815][ T1486] usbhid 6-1:0.0: can't add hid device: -71 [ 80.413947][ T1486] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 80.420654][ T1486] usb 6-1: USB disconnect, device number 6 [ 80.636001][ T7277] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 80.638761][ T7277] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 80.641514][ T7277] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 80.644249][ T7277] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 80.723884][ T7284] team0: Port device xfrm0 removed [ 80.727341][ T7284] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 80.734359][ T1166] tipc: Resetting bearer [ 80.746496][ T7284] team0: Port device xfrm0 added [ 80.801583][ T7288] netlink: 'syz.3.411': attribute type 1 has an invalid length. [ 80.824186][ T7288] 8021q: adding VLAN 0 to HW filter on device bond3 [ 80.903092][ T7288] bond3: (slave veth5): Enslaving as an active interface with a down link [ 80.908563][ T7302] dummy0: left promiscuous mode [ 80.915155][ T7302] bond3: (slave dummy0): making interface the new active one [ 80.920610][ T7302] dummy0: entered promiscuous mode [ 80.923846][ T7302] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 80.936554][ T7288] netlink: 'syz.3.411': attribute type 10 has an invalid length. [ 80.943981][ T7288] netlink: 40 bytes leftover after parsing attributes in process `syz.3.411'. [ 80.959502][ T7288] bond3: (slave dummy0): Releasing active interface [ 80.981045][ T7310] dvmrp0: entered allmulticast mode [ 80.988875][ T42] kauditd_printk_skb: 12 callbacks suppressed [ 80.988892][ T42] audit: type=1400 audit(1785375404.988:559): avc: denied { map } for pid=7309 comm="syz.1.416" path="/dev/video0" dev="devtmpfs" ino=956 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 81.197725][ T5735] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 81.243718][ T42] audit: type=1400 audit(1785375405.238:560): avc: denied { setopt } for pid=7319 comm="syz.1.421" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 81.368603][ T5735] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 81.372569][ T5735] usb 5-1: config 0 interface 0 has no altsetting 0 [ 81.377245][ T5735] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 81.381062][ T5735] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 81.384409][ T5735] usb 5-1: Product: syz [ 81.386189][ T5735] usb 5-1: Manufacturer: syz [ 81.388552][ T5735] usb 5-1: SerialNumber: syz [ 81.394155][ T5735] usb 5-1: config 0 descriptor?? [ 81.401890][ T5735] usb 5-1: selecting invalid altsetting 0 [ 81.616762][ T5735] usb 5-1: USB disconnect, device number 3 [ 81.626570][ T7337] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 81.632846][ T7337] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7337 comm=syz.2.425 [ 81.634104][ T1046] cfg80211: failed to load regulatory.db [ 81.638349][ T7337] netlink: 44 bytes leftover after parsing attributes in process `syz.2.425'. [ 81.663589][ T7337] netlink: 32 bytes leftover after parsing attributes in process `syz.2.425'. [ 81.676763][ T7340] team0: Port device xfrm0 removed [ 81.719722][ T7340] tipc: Enabling of bearer rejected, already enabled [ 81.723724][ T7342] syz_tun: entered allmulticast mode [ 81.726178][ T7341] syz_tun: left allmulticast mode qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. [ 81.770971][ T42] audit: type=1400 audit(1785375405.768:561): avc: denied { write } for pid=7343 comm="syz.3.428" name="/" dev="9p" ino=77617135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 81.793201][ T42] audit: type=1400 audit(1785375405.788:562): avc: denied { map } for pid=7343 comm="syz.3.428" path="/94/file0/blkio.throttle.io_service_bytes" dev="9p" ino=77617141 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 81.813383][ T42] audit: type=1400 audit(1785375405.808:563): avc: denied { write } for pid=7343 comm="syz.3.428" name="/" dev="9p" ino=77617135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 81.937669][ T5741] Bluetooth: hci0: command 0x0c1a tx timeout [ 81.969885][ T7351] FAULT_INJECTION: forcing a failure. [ 81.969885][ T7351] name failslab, interval 1, probability 0, space 0, times 0 [ 81.976511][ T7351] CPU: 0 UID: 0 PID: 7351 Comm: syz.2.432 Tainted: G L syzkaller #0 PREEMPT(full) [ 81.976540][ T7351] Tainted: [L]=SOFTLOCKUP [ 81.976547][ T7351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 81.976559][ T7351] Call Trace: [ 81.976567][ T7351] [ 81.976575][ T7351] dump_stack_lvl+0x100/0x190 [ 81.976606][ T7351] should_fail_ex.cold+0x5/0xa [ 81.976631][ T7351] should_failslab+0xc2/0x120 [ 81.976668][ T7351] __kmalloc_cache_noprof+0x91/0x6c0 [ 81.976705][ T7351] ? rcu_is_watching+0x12/0xc0 [ 81.976741][ T7351] ? vhost_task_create+0xee/0x370 [ 81.976774][ T7351] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 81.976819][ T7351] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 81.976862][ T7351] vhost_task_create+0xee/0x370 [ 81.976885][ T7351] ? __pfx_vhost_task_create+0x10/0x10 [ 81.976915][ T7351] ? __pfx_vhost_task_fn+0x10/0x10 [ 81.976939][ T7351] ? __pfx___mutex_lock+0x10/0x10 [ 81.976977][ T7351] ? kasan_quarantine_put+0x104/0x240 [ 81.977006][ T7351] kvm_mmu_post_init_vm+0x1b3/0x360 [ 81.977035][ T7351] kvm_arch_vcpu_ioctl_run+0x66/0x1960 [ 81.977063][ T7351] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 81.977098][ T7351] kvm_vcpu_ioctl+0x730/0x1700 [ 81.977122][ T7351] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 81.977144][ T7351] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 81.977181][ T7351] ? do_vfs_ioctl+0x226/0x13e0 [ 81.977208][ T7351] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 81.977235][ T7351] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 81.977272][ T7351] ? __fget_files+0x215/0x3d0 [ 81.977290][ T7351] ? hook_file_ioctl_common+0x140/0x440 [ 81.977317][ T7351] ? selinux_file_ioctl+0x13b/0x290 [ 81.977352][ T7351] ? selinux_file_ioctl+0xb6/0x290 [ 81.977381][ T7351] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 81.977404][ T7351] __x64_sys_ioctl+0x18e/0x210 [ 81.977432][ T7351] do_syscall_64+0x115/0x870 [ 81.977452][ T7351] ? clear_bhb_loop+0x40/0x90 [ 81.977475][ T7351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.977494][ T7351] RIP: 0033:0x7f1e1639df99 [ 81.977512][ T7351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 81.977529][ T7351] RSP: 002b:00007f1e17183028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 81.977549][ T7351] RAX: ffffffffffffffda RBX: 00007f1e16625fa0 RCX: 00007f1e1639df99 [ 81.977560][ T7351] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 81.977572][ T7351] RBP: 00007f1e17183090 R08: 0000000000000000 R09: 0000000000000000 [ 81.977583][ T7351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 81.977594][ T7351] R13: 00007f1e16626038 R14: 00007f1e16625fa0 R15: 00007ffe4303c8b8 [ 81.977620][ T7351] [ 82.294921][ T7357] team0: Port device xfrm0 removed [ 82.297384][ T7357] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 82.303314][ T1166] tipc: Resetting bearer [ 82.314513][ T7357] team0: Port device xfrm0 added [ 82.318093][ T7357] FAULT_INJECTION: forcing a failure. [ 82.318093][ T7357] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 82.320405][ T7359] netlink: 128 bytes leftover after parsing attributes in process `syz.1.434'. [ 82.324435][ T7357] CPU: 3 UID: 0 PID: 7357 Comm: syz.3.433 Tainted: G L syzkaller #0 PREEMPT(full) [ 82.324463][ T7357] Tainted: [L]=SOFTLOCKUP [ 82.324469][ T7357] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 82.324488][ T7357] Call Trace: [ 82.324503][ T7357] [ 82.324511][ T7357] dump_stack_lvl+0x100/0x190 [ 82.324568][ T7357] should_fail_ex.cold+0x5/0xa [ 82.324607][ T7357] _copy_from_iter+0x1f4/0x1690 [ 82.324641][ T7357] ? __asan_memset+0x23/0x50 [ 82.324667][ T7357] ? __pfx__copy_from_iter+0x10/0x10 [ 82.324690][ T7357] ? __pfx___alloc_skb+0x10/0x10 [ 82.324754][ T7357] netlink_sendmsg+0x808/0xda0 [ 82.324791][ T7357] ? __pfx_netlink_sendmsg+0x10/0x10 [ 82.324812][ T7357] ? selinux_socket_sendmsg+0x198/0x2f0 [ 82.324843][ T7357] ____sys_sendmsg+0xa4d/0xbe0 [ 82.324869][ T7357] ? __pfx_netlink_sendmsg+0x10/0x10 [ 82.324889][ T7357] ? __pfx_____sys_sendmsg+0x10/0x10 [ 82.324927][ T7357] ___sys_sendmsg+0x190/0x1e0 [ 82.324956][ T7357] ? __pfx____sys_sendmsg+0x10/0x10 [ 82.324982][ T7357] ? __lock_acquire+0x49f/0x1a40 [ 82.325013][ T7357] ? get_pid_task+0x106/0x250 [ 82.325075][ T7357] __sys_sendmsg+0x160/0x210 [ 82.325099][ T7357] ? __pfx___sys_sendmsg+0x10/0x10 [ 82.325139][ T7357] do_syscall_64+0x115/0x870 [ 82.325197][ T7357] ? clear_bhb_loop+0x40/0x90 [ 82.325221][ T7357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.325239][ T7357] RIP: 0033:0x7fc76979df99 [ 82.325256][ T7357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 82.325272][ T7357] RSP: 002b:00007fc76a732028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 82.325292][ T7357] RAX: ffffffffffffffda RBX: 00007fc769a25fa0 RCX: 00007fc76979df99 [ 82.325304][ T7357] RDX: 0000000020042000 RSI: 0000200000000440 RDI: 0000000000000004 [ 82.325315][ T7357] RBP: 00007fc76a732090 R08: 0000000000000000 R09: 0000000000000000 [ 82.325325][ T7357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 82.325336][ T7357] R13: 00007fc769a26038 R14: 00007fc769a25fa0 R15: 00007ffdc9a9f958 [ 82.325360][ T7357] [ 82.607389][ T7367] lo speed is unknown, defaulting to 1000 [ 82.657331][ T5741] Bluetooth: hci3: command 0x0c1a tx timeout [ 82.657389][ T5745] Bluetooth: hci2: command 0x0c1a tx timeout [ 82.657430][ T5745] Bluetooth: hci1: command 0x0c1a tx timeout [ 82.678977][ T7373] vhci_hcd vhci_hcd.0: remove, state 4 [ 82.681282][ T7373] usb usb38: USB disconnect, device number 1 [ 82.715805][ T5811] vhci_hcd vhci_hcd.0: stop threads [ 82.717705][ T5811] vhci_hcd vhci_hcd.0: release socket [ 82.719461][ T5811] vhci_hcd vhci_hcd.0: disconnect device [ 82.721481][ T5811] vhci_hcd vhci_hcd.0: stop threads [ 82.723192][ T5811] vhci_hcd vhci_hcd.0: release socket [ 82.724995][ T5811] vhci_hcd vhci_hcd.0: disconnect device [ 82.727385][ T5811] vhci_hcd vhci_hcd.0: stop threads [ 82.729093][ T5811] vhci_hcd vhci_hcd.0: release socket [ 82.730090][ T7373] vhci_hcd vhci_hcd.0: USB bus 38 deregistered [ 82.730992][ T5811] vhci_hcd vhci_hcd.0: disconnect device [ 82.735492][ T5811] vhci_hcd vhci_hcd.0: stop threads [ 82.737395][ T5811] vhci_hcd vhci_hcd.0: release socket [ 82.739090][ T7373] vhci_hcd vhci_hcd.0: remove, state 4 [ 82.739121][ T7373] usb usb37: USB disconnect, device number 1 [ 82.740922][ T5811] ================================================================== [ 82.740938][ T5811] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x44/0x456 [ 82.748762][ T5811] Read of size 4 at addr ffff88803d638b40 by task kworker/u32:3/5811 [ 82.753062][ T5811] [ 82.754277][ T5811] CPU: 3 UID: 0 PID: 5811 Comm: kworker/u32:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 82.754304][ T5811] Tainted: [L]=SOFTLOCKUP [ 82.754311][ T5811] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 82.754341][ T5811] Workqueue: usbip_event event_handler [ 82.754369][ T5811] Call Trace: [ 82.754374][ T5811] [ 82.754378][ T5811] dump_stack_lvl+0x100/0x190 [ 82.754395][ T5811] print_report+0x13d/0x4b0 [ 82.754418][ T5811] ? __virt_addr_valid+0x239/0x430 [ 82.754441][ T5811] ? vhci_cleanup_unlink_list+0x44/0x456 [ 82.754460][ T5811] kasan_report+0xdf/0x1c0 [ 82.754476][ T5811] ? vhci_cleanup_unlink_list+0x44/0x456 [ 82.754495][ T5811] vhci_cleanup_unlink_list+0x44/0x456 [ 82.754514][ T5811] vhci_shutdown_connection.cold+0x165/0x37c [ 82.754534][ T5811] event_handler+0x216/0x570 [ 82.754545][ T5811] process_one_work+0xa23/0x1940 [ 82.754560][ T5811] ? __pfx_process_one_work+0x10/0x10 [ 82.754574][ T5811] ? __pfx_event_handler+0x10/0x10 [ 82.754585][ T5811] worker_thread+0x5ef/0xe50 [ 82.754599][ T5811] ? kthread+0x13a/0x450 [ 82.754615][ T5811] ? __pfx_worker_thread+0x10/0x10 [ 82.754626][ T5811] kthread+0x370/0x450 [ 82.754637][ T5811] ? __pfx_kthread+0x10/0x10 [ 82.754648][ T5811] ret_from_fork+0x72b/0xd50 [ 82.754670][ T5811] ? __pfx_ret_from_fork+0x10/0x10 [ 82.754686][ T5811] ? __switch_to+0x800/0x10f0 [ 82.754698][ T5811] ? __pfx_kthread+0x10/0x10 [ 82.754712][ T5811] ret_from_fork_asm+0x1a/0x30 [ 82.754732][ T5811] [ 82.754736][ T5811] [ 82.802142][ T5811] Allocated by task 7171: [ 82.803543][ T5811] kasan_save_stack+0x30/0x50 [ 82.805044][ T5811] kasan_save_track+0x14/0x30 [ 82.805444][ T7373] vhci_hcd vhci_hcd.0: USB bus 37 deregistered [ 82.806550][ T5811] __kasan_kmalloc+0xaa/0xb0 [ 82.806565][ T5811] __kmalloc_noprof+0x322/0x820 [ 82.806586][ T5811] __usb_create_hcd+0x5e/0xac0 [ 82.813635][ T5811] vhci_hcd_probe+0x1a5/0x4e0 [ 82.815129][ T5811] platform_probe+0x106/0x1d0 [ 82.816634][ T5811] really_probe+0x241/0xa60 [ 82.818105][ T5811] __driver_probe_device+0x20e/0x450 [ 82.819802][ T5811] device_driver_attach+0xd1/0x220 [ 82.821408][ T5811] bind_store+0xf4/0x190 [ 82.822766][ T5811] drv_attr_store+0x74/0xb0 [ 82.824183][ T5811] sysfs_kf_write+0xf2/0x150 [ 82.825671][ T5811] kernfs_fop_write_iter+0x3e0/0x5f0 [ 82.827603][ T5811] vfs_write+0x6ac/0x1050 [ 82.829118][ T5811] ksys_write+0x12a/0x250 [ 82.830846][ T5811] do_syscall_64+0x115/0x870 [ 82.832382][ T5811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.834238][ T5811] [ 82.835003][ T5811] Freed by task 7373: [ 82.836434][ T5811] kasan_save_stack+0x30/0x50 [ 82.837925][ T5811] kasan_save_track+0x14/0x30 [ 82.839416][ T5811] kasan_save_free_info+0x3b/0x70 [ 82.841030][ T5811] __kasan_slab_free+0x5f/0x80 [ 82.842565][ T5811] kfree+0x22b/0x6c0 [ 82.843829][ T5811] usb_put_hcd+0x149/0x1f0 [ 82.845232][ T5811] vhci_hcd_remove+0xb5/0x1b0 [ 82.846736][ T5811] platform_remove+0x5f/0x80 [ 82.848296][ T5811] device_remove+0xcb/0x180 [ 82.849726][ T5811] device_release_driver_internal+0x44e/0x620 [ 82.851616][ T5811] unbind_store+0xf8/0x110 [ 82.853047][ T5811] drv_attr_store+0x74/0xb0 [ 82.854472][ T5811] sysfs_kf_write+0xf2/0x150 [ 82.856039][ T5811] kernfs_fop_write_iter+0x3e0/0x5f0 [ 82.858065][ T5811] vfs_write+0x6ac/0x1050 [ 82.859765][ T5811] ksys_write+0x12a/0x250 [ 82.861393][ T5811] do_syscall_64+0x115/0x870 [ 82.863148][ T5811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.865348][ T5811] [ 82.866143][ T5811] Last potentially related work creation: [ 82.867970][ T5811] kasan_save_stack+0x30/0x50 [ 82.869446][ T5811] kasan_record_aux_stack+0xa7/0xc0 [ 82.871073][ T5811] insert_work+0x36/0x230 [ 82.872493][ T5811] __queue_work+0x9bc/0x12b0 [ 82.873951][ T5811] queue_work_on+0x1a9/0x1e0 [ 82.875397][ T5811] usb_hcd_giveback_urb+0x330/0x4a0 [ 82.877055][ T5811] unlink1+0x418/0x510 [ 82.878401][ T5811] usb_hcd_unlink_urb+0x131/0x210 [ 82.879983][ T5811] usb_kill_urb+0x121/0x320 [ 82.881431][ T5811] hub_quiesce+0x1e9/0x320 [ 82.882856][ T5811] hub_suspend+0x4ab/0x9e0 [ 82.884264][ T5811] usb_suspend_both+0x288/0x950 [ 82.885992][ T5811] usb_runtime_suspend+0x49/0x120 [ 82.887712][ T5811] __rpm_callback+0xc8/0x620 [ 82.889451][ T5811] rpm_callback+0x16a/0x1b0 [ 82.891111][ T5811] rpm_suspend+0x2f4/0x11a0 [ 82.892597][ T5811] __pm_runtime_suspend+0xba/0x1a0 [ 82.894202][ T5811] usb_new_device.cold+0xd61/0x115c [ 82.895874][ T5811] register_root_hub+0x4e6/0x639 [ 82.897438][ T5811] usb_add_hcd.cold+0xccd/0x1158 [ 82.899040][ T5811] vhci_hcd_probe+0x1c2/0x4e0 [ 82.900583][ T5811] platform_probe+0x106/0x1d0 [ 82.902093][ T5811] really_probe+0x241/0xa60 [ 82.903526][ T5811] __driver_probe_device+0x20e/0x450 [ 82.905169][ T5811] device_driver_attach+0xd1/0x220 [ 82.906818][ T5811] bind_store+0xf4/0x190 [ 82.908165][ T5811] drv_attr_store+0x74/0xb0 [ 82.909635][ T5811] sysfs_kf_write+0xf2/0x150 [ 82.911089][ T5811] kernfs_fop_write_iter+0x3e0/0x5f0 [ 82.912771][ T5811] vfs_write+0x6ac/0x1050 [ 82.914131][ T5811] ksys_write+0x12a/0x250 [ 82.915528][ T5811] do_syscall_64+0x115/0x870 [ 82.917012][ T5811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.918963][ T5811] [ 82.919746][ T5811] Second to last potentially related work creation: [ 82.921795][ T5811] kasan_save_stack+0x30/0x50 [ 82.923332][ T5811] kasan_record_aux_stack+0xa7/0xc0 [ 82.924990][ T5811] insert_work+0x36/0x230 [ 82.926403][ T5811] __queue_work+0x9bc/0x12b0 [ 82.927860][ T5811] queue_work_on+0x1a9/0x1e0 [ 82.929356][ T5811] usb_hcd_giveback_urb+0x3b8/0x4a0 [ 82.931019][ T5811] usb_hcd_submit_urb+0xab7/0x2150 [ 82.932667][ T5811] usb_submit_urb+0x827/0x19b0 [ 82.934175][ T5811] usb_start_wait_urb+0x10e/0x580 [ 82.935807][ T5811] usb_control_msg+0x328/0x4b0 [ 82.937798][ T5811] hub_suspend+0x826/0x9e0 [ 82.939620][ T5811] usb_suspend_both+0x288/0x950 [ 82.941585][ T5811] usb_runtime_suspend+0x49/0x120 [ 82.943698][ T5811] __rpm_callback+0xc8/0x620 [ 82.945545][ T5811] rpm_callback+0x16a/0x1b0 [ 82.947359][ T5811] rpm_suspend+0x2f4/0x11a0 [ 82.949168][ T5811] __pm_runtime_suspend+0xba/0x1a0 [ 82.951197][ T5811] usb_new_device.cold+0xd61/0x115c [ 82.953300][ T5811] register_root_hub+0x4e6/0x639 [ 82.955270][ T5811] usb_add_hcd.cold+0xccd/0x1158 [ 82.957290][ T5811] vhci_hcd_probe+0x1c2/0x4e0 [ 82.959161][ T5811] platform_probe+0x106/0x1d0 [ 82.961057][ T5811] really_probe+0x241/0xa60 [ 82.962874][ T5811] __driver_probe_device+0x20e/0x450 [ 82.964950][ T5811] device_driver_attach+0xd1/0x220 [ 82.966957][ T5811] bind_store+0xf4/0x190 [ 82.968651][ T5811] drv_attr_store+0x74/0xb0 [ 82.970449][ T5811] sysfs_kf_write+0xf2/0x150 [ 82.972325][ T5811] kernfs_fop_write_iter+0x3e0/0x5f0 [ 82.974409][ T5811] vfs_write+0x6ac/0x1050 [ 82.976170][ T5811] ksys_write+0x12a/0x250 [ 82.977952][ T5811] do_syscall_64+0x115/0x870 [ 82.979799][ T5811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.982128][ T5811] [ 82.983099][ T5811] The buggy address belongs to the object at ffff88803d638000 [ 82.983099][ T5811] which belongs to the cache kmalloc-8k of size 8192 [ 82.988504][ T5811] The buggy address is located 2880 bytes inside of [ 82.988504][ T5811] freed 8192-byte region [ffff88803d638000, ffff88803d63a000) [ 82.993958][ T5811] [ 82.994919][ T5811] The buggy address belongs to the physical page: [ 82.997384][ T5811] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3d638 [ 83.000788][ T5811] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 83.004100][ T5811] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 83.007054][ T5811] page_type: f5(slab) [ 83.008686][ T5811] raw: 00fff00000000040 ffff88801bc43180 dead000000000100 dead000000000122 [ 83.012153][ T5811] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 83.015545][ T5811] head: 00fff00000000040 ffff88801bc43180 dead000000000100 dead000000000122 [ 83.018934][ T5811] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 83.022309][ T5811] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 83.025701][ T5811] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 83.029150][ T5811] page dumped because: kasan: bad access detected [ 83.031680][ T5811] page_owner tracks the page as allocated [ 83.034064][ T5811] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 6177, tgid 6172 (syz.1.98), ts 57702011724, free_ts 57656189964 [ 83.043535][ T5811] post_alloc_hook+0xfd/0x120 [ 83.045448][ T5811] get_page_from_freelist+0xf48/0x3530 [ 83.047656][ T5811] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 83.049973][ T5811] new_slab+0xa2/0x640 [ 83.051593][ T5811] refill_objects+0xe3/0x410 [ 83.053438][ T5811] __pcs_replace_empty_main+0x376/0x680 [ 83.055608][ T5811] __kmalloc_noprof+0x66d/0x820 [ 83.057583][ T5811] bpf_test_init.isra.0+0x88/0x100 [ 83.059646][ T5811] bpf_prog_test_run_xdp+0x57e/0x1670 [ 83.061796][ T5811] __sys_bpf+0x2a12/0x4e80 [ 83.063616][ T5811] __x64_sys_bpf+0xce/0x140 [ 83.065413][ T5811] do_syscall_64+0x115/0x870 [ 83.067239][ T5811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.069557][ T5811] page last free pid 1486 tgid 1486 stack trace: [ 83.072041][ T5811] __free_frozen_pages+0x79f/0x1090 [ 83.074099][ T5811] kasan_depopulate_vmalloc_pte+0x5d/0x80 [ 83.076352][ T5811] __apply_to_page_range+0xb1d/0x1520 [ 83.078419][ T5811] __kasan_release_vmalloc+0xd7/0xe0 [ 83.080076][ T5811] purge_vmap_node+0x210/0xb40 [ 83.081569][ T5811] process_one_work+0xa23/0x1940 [ 83.083525][ T5811] worker_thread+0x5ef/0xe50 [ 83.085390][ T5811] kthread+0x370/0x450 [ 83.087099][ T5811] ret_from_fork+0x72b/0xd50 [ 83.088770][ T5811] ret_from_fork_asm+0x1a/0x30 [ 83.090298][ T5811] [ 83.091060][ T5811] Memory state around the buggy address: [ 83.092842][ T5811] ffff88803d638a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 83.096099][ T5811] ffff88803d638a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 83.099310][ T5811] >ffff88803d638b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 83.102512][ T5811] ^ [ 83.105040][ T5811] ffff88803d638b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 83.108273][ T5811] ffff88803d638c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 83.111479][ T5811] ================================================================== [ 83.116943][ T5811] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 83.119954][ T5811] CPU: 3 UID: 0 PID: 5811 Comm: kworker/u32:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 83.124364][ T5811] Tainted: [L]=SOFTLOCKUP [ 83.126135][ T5811] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 83.130084][ T5811] Workqueue: usbip_event event_handler [ 83.132279][ T5811] Call Trace: [ 83.133666][ T5811] [ 83.134917][ T5811] dump_stack_lvl+0x100/0x190 [ 83.136890][ T5811] vpanic+0x552/0x970 [ 83.138537][ T5811] ? __pfx_vpanic+0x10/0x10 [ 83.140416][ T5811] ? mark_held_locks+0x40/0x70 [ 83.142369][ T5811] ? vhci_cleanup_unlink_list+0x44/0x456 [ 83.144371][ T5811] panic+0xd1/0xe0 [ 83.145551][ T5811] ? __pfx_panic+0x10/0x10 [ 83.147177][ T5811] ? vhci_cleanup_unlink_list+0x44/0x456 [ 83.149084][ T5811] ? preempt_schedule_common+0x42/0xc0 [ 83.150920][ T5811] ? check_panic_on_warn+0x1f/0x90 [ 83.152880][ T5811] check_panic_on_warn.cold+0x19/0x34 [ 83.154572][ T5811] end_report.part.0+0x3a/0x90 [ 83.156489][ T5811] kasan_report.cold+0xe/0x18 [ 83.158044][ T5811] ? vhci_cleanup_unlink_list+0x44/0x456 [ 83.159929][ T5811] vhci_cleanup_unlink_list+0x44/0x456 [ 83.161964][ T5811] vhci_shutdown_connection.cold+0x165/0x37c [ 83.164028][ T5811] event_handler+0x216/0x570 [ 83.165497][ T5811] process_one_work+0xa23/0x1940 [ 83.167319][ T5811] ? __pfx_process_one_work+0x10/0x10 [ 83.169264][ T5811] ? __pfx_event_handler+0x10/0x10 [ 83.171305][ T5811] worker_thread+0x5ef/0xe50 [ 83.173113][ T5811] ? kthread+0x13a/0x450 [ 83.174520][ T5811] ? __pfx_worker_thread+0x10/0x10 [ 83.176401][ T5811] kthread+0x370/0x450 [ 83.177762][ T5811] ? __pfx_kthread+0x10/0x10 [ 83.179229][ T5811] ret_from_fork+0x72b/0xd50 [ 83.180805][ T5811] ? __pfx_ret_from_fork+0x10/0x10 [ 83.182831][ T5811] ? __switch_to+0x800/0x10f0 [ 83.184376][ T5811] ? __pfx_kthread+0x10/0x10 [ 83.186161][ T5811] ret_from_fork_asm+0x1a/0x30 [ 83.188202][ T5811] [ 83.190081][ T5811] Kernel Offset: disabled [ 83.191615][ T5811] Rebooting in 86400 seconds.. VM DIAGNOSIS: 01:36:46 Registers: info registers vcpu 0 CPU#0 RAX=ffff88802b6c2bd8 RBX=ffff88802b6c2bd8 RCX=ffffffff81c7f9a1 RDX=1ffff110056d857b RSI=ffffffff81c7f9ae RDI=ffff88802b6c2540 RBP=ffffffff8eaa5880 RSP=ffffc90004b979f0 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000000 R12=ffff88802b6c2be8 R13=ffff88802b6c2540 R14=dffffc0000000000 R15=ffffc90004b97550 RIP=ffffffff820a6040 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d5ddc000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007fcaba9eb680 CR3=00000000362a0000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=000000000000003f Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f1e1715d560 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe4303cda6 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe4303cda6 00007ffe4303cdac ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f1e164354a7 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f1e164354e7 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f1e1643564b ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f1e164354d9 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 ad789d45c2c40077 81380f66ca010f26 67230f0fc0c02f6e ae0fc703f300b041 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000700080006 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f1e165f15f8 00007f1e165f15c8 00007f1e165f1600 00007f1e165f15e0 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0f0685a0e2454c67 f43e349ebf471824 487b6de2ce1145ef 463f3fe6a2bdee66 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3e9dd1ba3d2ff028 c9fdd35a045af03a 1921e725ed582e71 36c4fc0aaf33b270 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 40c3968bdad20417 80cf464ff7666b75 138b56c1941f5021 9a6b76934b2fef03 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 812a7dadc6e943c4 58f1802c9692e8c5 5376150bcd3815cf b1ba5934ad9ece1e ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=000000000000001e RBX=0000000000000009 RCX=000000000000001e RDX=0000000000000008 RSI=ffff888034385698 RDI=ffff888034384a80 RBP=ffffc90003687340 RSP=ffffc900036872a0 R8 =0000000000000000 R9 =0000000000000001 R10=0000000000000000 R11=0000000000000003 R12=ffff888034385698 R13=ffff888034384a80 R14=0000000000000200 R15=0000000000000003 RIP=ffffffff81e5cb92 RFL=00000007 [-----PC] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d5edc000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f5415a7dd58 CR3=00000000362a0000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000fefffc00 Opmask01=000000000000ffff Opmask02=00000000000000ff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f78f07f1e80 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f78f07f1e80 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000003bf12 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055557f4bc098 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000001ffffff ffffffffffdf080e e0030008000ed803 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 040fa0030008000f 98030108000f9003 2008000f88030008 000f800300000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 d0030fffffffffff ff040fc003000800 0fb8030008000fb0 030fffffffffffff ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffff040f f0030008000fe803 0008000fe0030008 000fd8030008000f ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0105800405b9e208 000100000a080606 01209c0000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001ffffffffff ffffffc108058203 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 16020005800302a8 10000e80040a1000 060102e000080010 a003000800109803 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0008001090030fff ffffffffff041080 030fffffffffffff 040ff0030008000f ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6d206873756c666c 6320363365737020 74617020766f6d63 2061636d20656770 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6e206c6c61637379 7320746820737320 3265737320657373 207273786620786d ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6373745f746e6174 736e6f63206d6c20 7063737464722062 6731657064702078 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 203a09746e656d6e 67696c615f656863 61630a3436203a09 657a697320687375 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6973796870207374 6962203634203a09 73657a6973207373 65726464610a3436 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 67616e616d207265 776f700a6c617574 7269762073746962 203834202c6c6163 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000060000006f 666e697570632f63 6f72702f0000000d 0a0a3a746e656d65 info registers vcpu 2 CPU#2 RAX=0000000000000001 RBX=00007fc769a27da0 RCX=00005555806c2808 RDX=0000000000000000 RSI=00007ffdc9a9faa0 RDI=0000000000000001 RBP=00007fc769a27da0 RSP=00007ffdc9a9fa98 R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000246 R12=0000000000014434 R13=00007fc769a25fac R14=000000000001415d R15=00007ffdc9a9fbc0 RIP=00007fc769796d30 RFL=00000206 [-----P-] CPL=3 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c01300 CS =0033 0000000000000000 ffffffff 00a0fb00 DPL=3 CS64 [-RA] SS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 00005555806c2500 ffffffff 00c00000 GS =0000 0000000000000000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f5414c08658 CR3=00000000288d3000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=00000000000000ff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffdc9a9fe46 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffdc9a9fe46 00007ffdc9a9fe4c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc7698354a7 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc7698354e7 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc76983564b ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc7698354d9 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc7699f1600 00007fc7699f15e0 00007fc7699f15e8 00007fc7699f1618 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0004000b000c0008 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc7699f15f8 00007fc7699f15c8 00007fc7699f1600 00007fc7699f15e0 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000000054 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85a38b65 RDI=ffffffff9ba07b40 RBP=ffffffff9ba07b00 RSP=ffffc90003cc7560 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=0000000031383554 R12=0000000000000000 R13=0000000000000054 R14=ffffffff9b6fa1f0 R15=ffffffff85a38b00 RIP=ffffffff85a38b8f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d60dc000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000000000000 CR3=000000004a949000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000001000000 Opmask01=0000000001000001 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 317a79732f74656e 2f70756f7267637a ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fff5b6a55d6 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fff5b6a55d6 00007fff5b6a55dc ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5414c354a7 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5414c354e7 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5414c3564b ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5414c354d9 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000058 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000058 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000