last executing test programs: 22.371126319s ago: executing program 2 (id=2324): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newqdisc={0x34, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0x501, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0x2}, {0x1, 0x1}}}, 0x24}}, 0x0) 22.037448913s ago: executing program 2 (id=2329): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x2, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0xfff9, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r7, &(0x7f0000000940)=[{{0x0, 0x0, &(0x7f0000000900)}, 0x8}], 0x1, 0x100, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r6, {0x7, 0xd}, {}, {0x8, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x24048840}, 0x40004) 21.607190349s ago: executing program 2 (id=2332): pipe(&(0x7f0000002680)={0xffffffffffffffff, 0xffffffffffffffff}) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket(0x2, 0x805, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000007c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) syz_emit_vhci(&(0x7f0000004fc0)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x2, 0x0, 0xc}, @l2cap_cid_le_signaling={{0x8}, @l2cap_disconn_req={{0x6, 0x10, 0x4}, {0x3, 0x4}}}}, 0x11) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000000)={0x438, 0x1, 0x7, 0x5, r3}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv6_newroute={0x1c, 0x18, 0x401, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1}}, 0x1c}}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(0xffffffffffffffff, 0x0, 0x2) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f00000001c0)={r4, &(0x7f0000000080)='fd', 0x101c80, &(0x7f00000000c0)={@align=0xfffffffffffff800, {0x7960, 0x1, 0x0, 0x5}}, 0x6, &(0x7f0000000140), &(0x7f0000000180)=0x9}) connect$unix(r6, &(0x7f0000000240)=@file={0x1, './file0\x00'}, 0x6e) socket$inet6_mptcp(0xa, 0x1, 0x106) fchdir(r5) r7 = open(&(0x7f0000000000)='./file0\x00', 0x80442, 0x244) socket$unix(0x1, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040f5c9ba6a3fb"], 0x7) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r7, 0x9361, 0x0) 21.027754681s ago: executing program 2 (id=2340): getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)}, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e0c062f20"], 0xf) 20.498593227s ago: executing program 2 (id=2346): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20940, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mprotect(&(0x7f00002e0000/0x4000)=nil, 0x4000, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="cf042bbd7000ffdbdf2512000000080003003de3c4ca047fa4c6a74d247afd22c45385c4dfd15fb290c6983b9d10090000004606785b81d939fcf255de9536c48056c6486ea93e79f50ea77b05eb94b6a32533d807e62684a2521a51c2bb20975485522fe1867dacadc4468ae3b6217522082a9516bd79681dd21cf6101e501f332235b20cd31fb2762376ff4c9079fb8bb49323ec", @ANYRES32=r4, @ANYBLOB="0c0099000e0000006d00000005001900000000000800a40003000000"], 0x38}, 0x1, 0x0, 0x0, 0xc040}, 0x40000c4) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./proc\x00', 0x1ed) r6 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_INPUT(r7, &(0x7f0000010140)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e01272a22fc54078fd5e64475993668980a9f95aff96492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef4201dbc11d36a0a0db52e84461c6fbb4aad62cf3c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec080000002b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270b36ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a7986cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9aee540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b231f7ffc441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25afd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e5706000", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r7, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(r6, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}) mount(0x0, &(0x7f0000000900)='./proc\x00', &(0x7f0000000a00)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000b00)='./proc/fs/cifs/Stats\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f00000002c0)="2e660f38249275000f01c365660fc7768a0f20c06635200000000f22c0ba200066b80070000066ef0f20d86635080000000f22d8260fc7b2365cf30f7fc0660f3880130f784300", 0x47}], 0x1, 0x74, 0x0, 0x0) r8 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x4, 0x0) mq_notify(r8, 0x0) 20.239174622s ago: executing program 2 (id=2350): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1a7) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000ffd26f10cb060600eb9a0102030109022400010000000009040001020a16d1000905070000000000000905", @ANYRES32], 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x33) ioctl$KVM_CLEAR_DIRTY_LOG(r1, 0xc018aec0, &(0x7f0000000940)={0x3, 0x240, 0x280, &(0x7f0000000540)=[0x1ff, 0x3, 0x3, 0x9, 0xe4, 0x3, 0x800, 0x7, 0x8, 0x9, 0xf, 0x9, 0x2, 0xffffffffffffffd2, 0xe, 0x1, 0x6, 0x800, 0x3, 0x4, 0x4, 0x9, 0x1, 0x3, 0x91f, 0x2, 0x3, 0x8, 0xc, 0x2, 0xfff, 0x7f, 0x0, 0x4, 0x0, 0x51, 0xa7d, 0x80000000, 0x13d00000000, 0xffff, 0xbb, 0xa, 0x3, 0xc2af, 0x2, 0x4, 0x3, 0x10, 0x7, 0x6, 0x7fffffffffffffff, 0x40, 0x8b, 0x9, 0x1, 0xffffffffffff8f70, 0x100000000, 0x5, 0xe33afcb, 0x7fffffffffffffff, 0x4, 0x10001, 0x0, 0x7, 0x8, 0x200, 0x1, 0x8cdf, 0x9, 0x1, 0x9, 0x1, 0x3, 0xb, 0x9, 0x2, 0x800, 0x4314, 0x7, 0x4000009, 0x5, 0x0, 0x6, 0xee, 0xb, 0x7, 0x14cb, 0x7, 0xffff, 0x42a, 0x9, 0x9, 0x4071, 0x200, 0x8000000000000000, 0x7ffff7ffffffffff, 0x7, 0x19d5, 0xf, 0x7, 0xffff, 0x4, 0xffffffff80000000, 0x8, 0x9, 0x2, 0xdb2, 0xffffffffffffff73, 0x1c000000000000, 0x2, 0x88, 0x5, 0x7, 0x1ff, 0x4, 0xffffffffffffffbf, 0x0, 0x5, 0xffffffc000000000, 0x3, 0x8, 0x3, 0x8, 0x0, 0x2, 0x3, 0x7, 0x8001]}) syz_usb_control_io$printer(r0, 0x0, 0x0) mount(&(0x7f0000000500)=@md0, &(0x7f0000000240)='./cgroup\x00', &(0x7f0000000040)='jfs\x00', 0x2200010, 0x0) r2 = openat$mice(0xffffff9c, &(0x7f0000000140), 0x1ad100) r3 = userfaultfd(0x1) ioctl$UFFDIO_MOVE(r3, 0xc028aa05, &(0x7f0000000280)={&(0x7f0000458000/0x1000)=nil, &(0x7f0000427000/0x4000)=nil, 0x1000}) r4 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000080)=[{0x30, 0x9, 0xfe, 0xfff00004}, {0x16, 0x0, 0x3, 0xfffffffe}]}, 0x10) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x15d) write(r5, &(0x7f0000000080)='common_pid > 0', 0xe) write$cgroup_subtree(r5, 0x0, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000004c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_BSS(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r6, 0x1, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0x9}, @NL80211_ATTR_BSS_SHORT_PREAMBLE={0x5, 0x1d, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x800) pwrite64(r2, &(0x7f00000002c0)="3310f1c986b89dc4295b11fea69672bc6ea2fe5cecdb75fc98975b6b1f8313c1a5eb9191a1f4030c2d16a0da8644ac4873d3145adf7216cb80398c24ebea8e7d1ac0d7182bcbe7eee510cc089fc3133744e613c5bfe04a1bd908b9bbe252613a2953df62bdec100915a10a1fcd97cdc4c848c41433ed8a0a7cac9854d9f06fcdbc9baa7c483ac25353571edf80cd72e96c9c5e151cea85da7c6cb395ee28a6dba10065d8", 0xa4, 0xf) r8 = open$dir(&(0x7f0000000040)='./mnt\x00', 0x0, 0x2) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r8, 0xc0506617, &(0x7f00000003c0)={@id, 0x10, 0x0, '\x00', @d}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f00000009c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000980)={&(0x7f0000000440)={0x44, r6, 0x4, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x401, 0x33}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xf}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x30}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x7}], @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}]}, 0x44}, 0x1, 0x0, 0x0, 0x8080}, 0x0) 5.229880467s ago: executing program 32 (id=2350): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1a7) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000ffd26f10cb060600eb9a0102030109022400010000000009040001020a16d1000905070000000000000905", @ANYRES32], 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x33) ioctl$KVM_CLEAR_DIRTY_LOG(r1, 0xc018aec0, &(0x7f0000000940)={0x3, 0x240, 0x280, &(0x7f0000000540)=[0x1ff, 0x3, 0x3, 0x9, 0xe4, 0x3, 0x800, 0x7, 0x8, 0x9, 0xf, 0x9, 0x2, 0xffffffffffffffd2, 0xe, 0x1, 0x6, 0x800, 0x3, 0x4, 0x4, 0x9, 0x1, 0x3, 0x91f, 0x2, 0x3, 0x8, 0xc, 0x2, 0xfff, 0x7f, 0x0, 0x4, 0x0, 0x51, 0xa7d, 0x80000000, 0x13d00000000, 0xffff, 0xbb, 0xa, 0x3, 0xc2af, 0x2, 0x4, 0x3, 0x10, 0x7, 0x6, 0x7fffffffffffffff, 0x40, 0x8b, 0x9, 0x1, 0xffffffffffff8f70, 0x100000000, 0x5, 0xe33afcb, 0x7fffffffffffffff, 0x4, 0x10001, 0x0, 0x7, 0x8, 0x200, 0x1, 0x8cdf, 0x9, 0x1, 0x9, 0x1, 0x3, 0xb, 0x9, 0x2, 0x800, 0x4314, 0x7, 0x4000009, 0x5, 0x0, 0x6, 0xee, 0xb, 0x7, 0x14cb, 0x7, 0xffff, 0x42a, 0x9, 0x9, 0x4071, 0x200, 0x8000000000000000, 0x7ffff7ffffffffff, 0x7, 0x19d5, 0xf, 0x7, 0xffff, 0x4, 0xffffffff80000000, 0x8, 0x9, 0x2, 0xdb2, 0xffffffffffffff73, 0x1c000000000000, 0x2, 0x88, 0x5, 0x7, 0x1ff, 0x4, 0xffffffffffffffbf, 0x0, 0x5, 0xffffffc000000000, 0x3, 0x8, 0x3, 0x8, 0x0, 0x2, 0x3, 0x7, 0x8001]}) syz_usb_control_io$printer(r0, 0x0, 0x0) mount(&(0x7f0000000500)=@md0, &(0x7f0000000240)='./cgroup\x00', &(0x7f0000000040)='jfs\x00', 0x2200010, 0x0) r2 = openat$mice(0xffffff9c, &(0x7f0000000140), 0x1ad100) r3 = userfaultfd(0x1) ioctl$UFFDIO_MOVE(r3, 0xc028aa05, &(0x7f0000000280)={&(0x7f0000458000/0x1000)=nil, &(0x7f0000427000/0x4000)=nil, 0x1000}) r4 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000080)=[{0x30, 0x9, 0xfe, 0xfff00004}, {0x16, 0x0, 0x3, 0xfffffffe}]}, 0x10) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x15d) write(r5, &(0x7f0000000080)='common_pid > 0', 0xe) write$cgroup_subtree(r5, 0x0, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000004c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_BSS(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r6, 0x1, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0x9}, @NL80211_ATTR_BSS_SHORT_PREAMBLE={0x5, 0x1d, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x800) pwrite64(r2, &(0x7f00000002c0)="3310f1c986b89dc4295b11fea69672bc6ea2fe5cecdb75fc98975b6b1f8313c1a5eb9191a1f4030c2d16a0da8644ac4873d3145adf7216cb80398c24ebea8e7d1ac0d7182bcbe7eee510cc089fc3133744e613c5bfe04a1bd908b9bbe252613a2953df62bdec100915a10a1fcd97cdc4c848c41433ed8a0a7cac9854d9f06fcdbc9baa7c483ac25353571edf80cd72e96c9c5e151cea85da7c6cb395ee28a6dba10065d8", 0xa4, 0xf) r8 = open$dir(&(0x7f0000000040)='./mnt\x00', 0x0, 0x2) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r8, 0xc0506617, &(0x7f00000003c0)={@id, 0x10, 0x0, '\x00', @d}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f00000009c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000980)={&(0x7f0000000440)={0x44, r6, 0x4, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x401, 0x33}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xf}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x30}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x7}], @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}]}, 0x44}, 0x1, 0x0, 0x0, 0x8080}, 0x0) 4.268886779s ago: executing program 0 (id=2524): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) clock_adjtime(0x0, &(0x7f0000000000)={0x3fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) move_pages(0x0, 0x42, 0x0, 0x0, 0x0, 0x0) (async) move_pages(0x0, 0x42, 0x0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNGETFEATURES(r2, 0x800454cf, &(0x7f0000000000)) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = socket$inet6(0xa, 0x5, 0x0) syz_pidfd_open(r0, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r3, 0x29, 0x41, 0x0, 0x78) syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000002505a1a440000102030109025c0002010000000904000001a3f45747d649f9a30105240000000d240f8100000000000000000006241a0000000905810300000000000904010000020d00000904010102020d000009058202000000000009050302"], 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010c001ddf8208c007121522300000000109021b0001000000010904010001faf48d00090582"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r4 = openat2$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000140)={0x14801, 0x3f5c80bcf5603a7b, 0x4}, 0x1) openat(r4, &(0x7f0000000040)='./proc\x00', 0x131403, 0x108) (async) r5 = openat(r4, &(0x7f0000000040)='./proc\x00', 0x131403, 0x108) write(r5, &(0x7f0000000000)='7', 0x1) ftruncate(r1, 0xb) (async) ftruncate(r1, 0xb) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2}, 0xc) r6 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x20182) mount(&(0x7f0000000780)=@md0, &(0x7f00000007c0)='./proc\x00', &(0x7f0000000800)='overlay\x00', 0x0, 0x0) (async) mount(&(0x7f0000000780)=@md0, &(0x7f00000007c0)='./proc\x00', &(0x7f0000000800)='overlay\x00', 0x0, 0x0) r7 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_inet_SIOCGIFDSTADDR(r7, 0x8917, &(0x7f0000000180)={'vcan0\x00', {0x2, 0x0, @multicast1}}) listen(r1, 0x3ff) (async) listen(r1, 0x3ff) shutdown(r7, 0x1) syz_usb_connect$uac2(0x5, 0x10f, &(0x7f00000001c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x582, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfd, 0x3, 0x1, 0x2, 0x20, 0x44, {0x8, 0xb, 0x0, 0x1, 0x1, 0x2, 0x20, 0xff}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0xf, 0xa, 0x45, 0x3}, [@feature_unit={0x11, 0x24, 0x6, 0x5, 0x2, [0x4, 0x7, 0x5, 0x0, 0x3, 0x9]}, @sample_rate={0x13, 0x24, 0xd, 0x1, 0x3, 0x2, [0x0, 0x1, 0x1, 0x1, 0x1, 0x3]}, @output_terminal={0xc, 0x24, 0x3, 0x3, 0x3, 0xd, 0x6, 0x1, 0x3, 0x3}, @extension_unit={0xc, 0x24, 0x9, 0x5, 0xffff, 0xa, "c53ca33684"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@as_header={0x10, 0x24, 0x1, 0x10, 0x8, 0x2, 0x2, 0x9, 0x3, 0x8}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x5}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x9, 0x10, 0xaf, 0xf}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0x1}, @format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x8, 0x3, 0x81, 0x6, "7a6eca7a420e"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x2, 0x8001, 0x9, 0x9}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x81, 0x1, 0x0, {0x8, 0x25, 0x1, 0x2, 0xc, 0x40, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x9, 0xfffb, 0x80, 0x5}, @as_header={0x10, 0x24, 0x1, 0x6, 0x8, 0x2, 0x5, 0xcf, 0x2, 0x23}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x80, 0xf, 0x4, {0x8, 0x25, 0x1, 0x1, 0x3, 0x4, 0x4}}}}}}}}]}}, &(0x7f0000000700)={0xa, &(0x7f0000000300)={0xa, 0x6, 0x0, 0x1, 0xf9, 0x11, 0x20, 0x1}, 0x4f, &(0x7f0000000340)={0x5, 0xf, 0x4f, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0xd, 0x5, 0x97, 0xa5}, @ssp_cap={0x20, 0x10, 0xa, 0x8, 0x5, 0x7f, 0x0, 0x347, [0xf0, 0xff30, 0x0, 0xffa0, 0xf]}, @wireless={0xb, 0x10, 0x1, 0xc, 0xe3, 0xbe, 0x7, 0x3}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x6, 0x1, 0x3, 0xba7f}, @wireless={0xb, 0x10, 0x1, 0x4, 0x1, 0x8, 0x8, 0x9, 0xd}]}, 0x7, [{0x99, &(0x7f00000003c0)=ANY=[@ANYBLOB="9903998b5bde8aae6145035cef7fb39068fc81a93dc222f7ad7878052303b724acdfc954f71d2ed8c87bf056fd3bc327ab440f12dbbaa84702884eac7a4cafd35a380de7a13e8077b7555d2cc6feff96554153d5e4633a3a01830113e7004ef68f4436654344f2ae6631d17f91662fd9643f367030b9ae66c73d76386fd8a390e50799f2b85e0e1332000000000000000077e1000000000000"]}, {0x33, &(0x7f0000000480)=@string={0x33, 0x3, "46085cdc34a893a294f139dd469427c3802607ec30e18bbe7ca6fced01198904538c92c91f3f08fa75a998e59f2ac205b1"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x1407}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x4ff}}, {0xc, &(0x7f0000000540)=@string={0xc, 0x3, "eb7700acb76a4f0b4ff5"}}, {0xb1, &(0x7f0000000580)=ANY=[@ANYBLOB="b103900ac3480b69983e3d3318bda6d6a3524650ba28985bd399f15a8c59516eb3ca608bf4d22d4a8480ec2e939d90c0cfcfd6d015ec2eebd128022fad5d5163288a2e41f3b2777482c191d33fb56fbd70a24ee446d52dff9a068a7c4ff01d95e3603961f4e033cb235c49e2f2464ecb7d7dcccf6206b6e785b22540b3273ef7bdbfec1e18eb469c96582afe75e9a9b8831a273e7c6c7cb1dca5cbee7be7815019ffde4f5058ddbe3288c9d588"]}, {0x85, &(0x7f0000000640)=@string={0x85, 0x3, "33d40421d83d890dfc5be251d4fd8edab48620672e99c848d01600937ecb534459afe417601ee7893df05c4083e465031c67cffef64533640553e3203d5012964f277425c428e35a0888c3bc36ca79d668e7fea9e383592cc3e8977138ed1d1b8c63b715f324c0dfcce6729c5dde0d7fd6ff840c4e33e68a18ced425223d1cf75f716d"}}]}) ioctl$USBDEVFS_ALLOW_SUSPEND(r6, 0x5522) ioctl$USBDEVFS_BULK(r6, 0x5523, 0x0) (async) ioctl$USBDEVFS_BULK(r6, 0x5523, 0x0) syz_usb_disconnect(0xffffffffffffffff) (async) syz_usb_disconnect(0xffffffffffffffff) 2.17818858s ago: executing program 0 (id=2538): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x2000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x400000f1, 0x0, 0x400006}]}) 2.178020056s ago: executing program 0 (id=2539): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$uinput_user_dev(r3, &(0x7f0000000f80)={'syz0\x00', {0x5, 0xfff7, 0x4, 0x8}, 0x50, [0x800006, 0x9, 0x0, 0x1, 0x8, 0x80ea45, 0x800000e, 0x1, 0x63, 0xffffffff, 0x7f, 0xc, 0x4, 0x9, 0x1, 0x4, 0x8001080, 0x80000002, 0x1, 0x200008, 0x40, 0xa4d, 0x3ff, 0x40000005, 0x6, 0x10001, 0xffff, 0x0, 0x4, 0x6, 0x401, 0x100, 0x9, 0x4, 0x2, 0x0, 0x2, 0x4, 0x1, 0x4, 0xa, 0x6, 0x3, 0x5ff, 0x804d7f, 0x2, 0x8c00, 0x6, 0x939, 0x5, 0x9, 0x2, 0x2, 0x8, 0xfffffff7, 0x7fff, 0x6, 0x5, 0x80000001, 0xd77, 0x5, 0x2a, 0x1, 0x23], [0x8, 0x401, 0x9, 0x9, 0x8, 0x12, 0x7fc, 0xc, 0x0, 0x2729, 0xfd8, 0x3, 0x7, 0x7, 0x0, 0xd8, 0x2, 0xfffffff7, 0x2, 0x3, 0x5, 0x4009, 0x401, 0xb, 0xfffffff8, 0x9, 0xa1, 0x10000, 0xffffffff, 0x5, 0x10004, 0x9e, 0x2, 0xae3, 0x6, 0x7, 0xfffffffd, 0x9, 0xffff3f16, 0xa, 0x0, 0x9, 0xa, 0x5, 0xfffffeff, 0x9, 0x800, 0x5, 0xc5, 0x3, 0x1, 0x9, 0x8, 0x3, 0xfffe7ff7, 0x3, 0x24c, 0x1ff, 0x2a0, 0x8, 0x6, 0x6, 0x200007, 0x8], [0x2, 0x9, 0x1a9e1bfa, 0xfffffffc, 0x3, 0xc, 0x2, 0x5, 0x7aae, 0x80000000, 0x2, 0x7ffffff7, 0x7ffe, 0x1, 0x1, 0x5, 0x400, 0x80000002, 0x2b0, 0xfffffff4, 0x97f82544, 0x8, 0xfffffffd, 0x0, 0x1, 0x5, 0x4, 0x9, 0xc90, 0xffffff3c, 0xd, 0x13, 0x4, 0x8, 0x1, 0x4, 0x2, 0x1000000c, 0x0, 0x2, 0x3, 0x8007c12, 0x5, 0x1, 0x17, 0x8000, 0xe, 0xf3, 0x4, 0x8, 0x1, 0xffffff00, 0x100, 0x1fff80, 0x5, 0x0, 0xc, 0xdd, 0x1, 0x1400, 0xc3, 0x20ffff, 0x79c], [0x9, 0x3a8e, 0xffff9a7f, 0x200, 0x6, 0x2001, 0x6, 0xfffffff3, 0xd077, 0x2, 0xf, 0x21, 0x200, 0xa, 0x6, 0x2, 0x1ff, 0xfe, 0x2, 0x66608000, 0x5e82, 0x7fb, 0x6, 0x0, 0x3, 0x5, 0x80000001, 0xffff, 0xd, 0x40, 0xfffffffd, 0x3, 0x10001, 0x8000, 0x10, 0x1002, 0xc, 0x104, 0x8, 0x20000000, 0x8, 0x9, 0xb32a, 0xec000000, 0x8001, 0x1900, 0x4, 0xc, 0x40, 0x7ff, 0x280, 0x5, 0xffffffff, 0x7, 0x6e79, 0x0, 0xc, 0x9371, 0x4f89, 0x7, 0xf, 0x2d1, 0x83, 0x8]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, 0x0, 0x3, 0xffffffffffffffff, 0x0, 0x0, 'syz0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x70fd27, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, 0x29, 0x400}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_DOWNDELAY={0x8, 0x1f, 0x4}]}}}]}, 0x3c}}, 0x0) 2.040489758s ago: executing program 0 (id=2540): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='aio\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./tracing/uprobe_events\x00', 0x401, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') memfd_create(&(0x7f0000000580)='D\xa3\xd5Wj\x00\x00x0\xc1\xac*`\xeb\xc7,\x1f\xe9B\x92\x06]\x16\x9d\x02\x1a\vG\xa9~vB\xbc\t\x00\x00\x00VoA\xaa\xbc\xee[\xe1\xa2\xe0\xff\x04\x00\x00\x00\\i\xcf\t\xb0\xa9 +H/\x1a\xe7\x95\xce\"\"\xbd\xf9\xd0\xc0\xa9\b\x98\xfc:\x1b\xc4\x80!\xfd\xa4\xcaN\x84\xadS\x8bqE\x99\x01t\xb1\x1f|\x99PL\x92\x8f\xc2\xf9\xcd\x8cj\x03X\x05\x17mwI\xf0\x01\xe5z\xcdJ)\xc7\xfa)\xaa}\xef\xbb\xf5\a\x00o5\x18\xd6\v\x85q\x98\x9bB\xb9\xea\xe7\xff\x7f\x00\x00T\xc0\xd2\t?\bpBl\xf4*8\xc6\xe5\x06P\xc11\f^\x7f\x8e\xc1\xd1Wra\x19)\xe3\x8f\xd9\x9f\x15\x1e\xf2\x18\r\xad\b\xe0\x96NH\x85\r+\xfc\xb3\xdd\xddhg \x03\xa7\x92\xff\x00+h\xb7@#K\x9cMY\xd3\x9b\b-G\xb1\xdaS\x81\xb2\x93\xb83\x8a\x94*\x8d\\\b\xff/\xa1\xc0\xf9&\xd3M\xf6\n\xff\x83k\xe6\rDa\x16\xbd\x00\x02\xdfi\x00\xd5)\xa4\x80\xad\x97\'\x1b\xfd}\x96&\xd2\x0eGp\x8e\x1a\x19o\xf1\x14\xe2]J\xf2\xb5h\x9bt*\xd2\xfbT\x01ci\x87\x18\xc9\x13=\x1b\xadl;}\x9d\xbe\x9a\xee\x1a\xfc\x96 \x93\x12@\x19|f\x98\xdc,\x82SlA\t\xcb\xfe\xccSKO}\xb2U\xd6\xc5\xa7=\xf8s\x1dp\xe0\x14\xe5\x92\xfd)\bB\xcd\xc2`OE\x8e\xf0\xf9\xd2!KZ%\xad\xa1\x92b\x1e%\x9f!\xd8mV$\x1d?\xc2\f\xcc\xc5x\x9fJ#\xce\x90\xc5\x82\xfb\x97\xd2\xb7\xb5\xed\xb5\'J\xfc\xf4Z.\rS\x88\f\xd0zK\xc7\x81\xbe\xd5\xc2\xce\x89\xbc\x1e\xb78\xf6Z\xd5\x1b\xf1\x9bMD\f\xf6\xc5V\xe1\x12j\xdfW\x87\xf09\n\x1e\x1b\f\xe5p\xab\x9e\xe5}\x96\x9b\xea\x86\x0f\xca\xcf\x16\x96\x0e6\x8d\x11\xd2&\"eKKV\x8b?]<\xa7]\x93\xad\x1d\xfe\x13\xee\xca\xdc\x97\xa9\a\b\xac\xdd\xa0\xfe\x97\xa1?\xa2F\xae\xb7f\x85\xda', 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) fsopen(&(0x7f0000000000)='autofs\x00', 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @multicast2}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfffb, 0x0, 0x4, 0x6, 0x800}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 1.96543821s ago: executing program 0 (id=2541): syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) futex(&(0x7f0000000040)=0x1, 0x8, 0x1, 0x0, 0x0, 0x1) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000), 0x70040, 0x0) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f00000001c0)) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) dup(r0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x2000000, 0x0) rmdir(&(0x7f00000001c0)='./config/usb_gadget/g1\x00') 1.690660746s ago: executing program 0 (id=2542): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SNDCTL_SYNTH_ID(r0, 0xc08c5114, &(0x7f0000000140)={"0160bd8f41a34066c329e5c9e7e0b93c4cdc2139bb1c026b2b7398bbddbc"}) r1 = socket$netlink(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000002100), 0x280449c, &(0x7f0000000080)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r2, &(0x7f00000093c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000004200)={0x50, 0x0, r3, {0x7, 0x1f, 0x0, 0xffffffff97422012, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x3}}, 0x50) syz_fuse_handle_req(r2, &(0x7f0000006380)="000000000000000000000000000000000000000000000000000000000000000090c400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000542d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ea8286a2fba5234400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b60dd7710000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000633956a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007d6ab715107fa1820000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f6ffffffffffffff0000000000000e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ffffff00000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000286071480000000000b13bc1e6d970884f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000048636662867d08f50000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3ffffffffffffff00", 0x2000, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x20, 0x0, 0x80000000000000, {0x0, 0x1d}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x160) ioctl$PTP_EXTTS_REQUEST2(r4, 0x40806685, 0x0) r5 = syz_open_dev$sndctrl(&(0x7f0000000240), 0x0, 0x22802) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r5, 0x80dc5521, &(0x7f0000000b40)=""/4096) r6 = socket(0x10, 0x803, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000000)={@broadcast, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x89, 0x0, @dev, @local, {[@noop, @generic={0x86, 0x2}, @timestamp_prespec={0x44, 0xc, 0x0, 0x3, 0x0, [{@loopback}]}, @ssrr={0x89, 0x3}, @timestamp_addr={0x44, 0x2c, 0x0, 0x1, 0x0, [{}, {@private}, {@loopback}, {@remote}, {@broadcast}]}]}}}}}}}, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r7 = openat$audio1(0xffffffffffffff9c, &(0x7f00000000c0), 0x400000, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x20002000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SOUND_PCM_READ_RATE(r7, 0x80045002, &(0x7f0000000140)) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r8, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r6], 0x3c}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'team0\x00'}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x3c}}, 0x8000) syz_usbip_server_init(0x0) 1.411173286s ago: executing program 1 (id=2547): r0 = socket$kcm(0x10, 0x5, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$sock_int(r1, 0x1, 0x2f, 0x0, &(0x7f0000000040)=0x700) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="2e00000010008188e6b62aa73f72dc9f0ba1f8483a0000005e1206021f1f00000e000a0010000000028000001294", 0x2e}], 0x1}, 0x4840) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f0000000000)) socket$kcm(0x10, 0x5, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) getsockopt$sock_int(r1, 0x1, 0x2f, 0x0, &(0x7f0000000040)=0x700) (async) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="2e00000010008188e6b62aa73f72dc9f0ba1f8483a0000005e1206021f1f00000e000a0010000000028000001294", 0x2e}], 0x1}, 0x4840) (async) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f0000000000)) (async) 1.410916937s ago: executing program 1 (id=2548): socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYRES32=r0], 0xffffffffffffff3b}, 0x4004000) recvmmsg(r0, &(0x7f0000001900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=""/71, 0x47}, 0x4}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000003040)=""/243, 0xf3}, 0x1}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000032c0)=""/71, 0x47}, 0x7f}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000018c0)=""/26, 0x1a}, 0x9}], 0x4, 0x40000002, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a7c000000060a010400000000000000000a0000013c000480380001800a0001006d617463680000002800028010000300709c897c82b1095a67232d630800024000000001090001006d61726b000000000900020073797a32000000000900010073797a31000000001400058008000140000000110000014000000011080200000b0a0104000000000000000000000002e80109804c0002802c0001800800014000007fff080001400000000697fe014000000008080001400000000908000140000000061c000180080001400000000308000140000000f0080001400000000908000140fffffffb800102803400018008000140000000a5080001400000009a0800014000000001080001400000ffff0800014000000007080001400000000f540001800800014000000009080001400080010108000140000000020800014000000007080001400000000708000140000002e3080001400000000708000140000000c2080001400000000008000140000000084400018008000140000000020800014000000008080001400000000508000140fffffffa0800014000008000080001400000000508000140000000000800014000000003140001800800014000000000080001400000000824000180080001400000800108000140000010400800014000007a9c08000140000008004400018008000140000000050800014000000007080001400000000508000140000000060800014000000001080001400000000308000140000001ff080001400000000434000180080001400000000308000140000000090800014000000002080001407fffffff080001400000000008000140000000020800014000000000080001400000000a0c000b40000000000000a490f8000000140a030000000000000000000a00000a7a000800e7cc93bb8b5bf8a301f8d26b1963fdc8b39457efcc04ecca6f340c56ae24ceaff287f21e4a728646497f59316c46f1f667c95c303bc67ddc900dfc005efc8f6f636a139d2d999ea2d30272ef0a9cc96489302f75afdfe55d53123aac0e4ede34f6046fa75d35300fe36913a40d883cdd5b6f463250b20000080003400000000608000340000000080c0006400000000000000001080003"], 0x41c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000980)=ANY=[@ANYBLOB="d80000000001010400000000000000000a0000003c0001802c000180140003000000000000000000000000000000000014000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c0002800500010000000000080007400000000008000840000000013c000e802c0001801400"], 0xd8}}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x901800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="7b87f20f", @ANYRES64=r5], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r6 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x60, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r6, 0x2219, 0x7721, 0x16, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x6, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 911.056535ms ago: executing program 3 (id=2555): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='aio\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./tracing/uprobe_events\x00', 0x401, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') memfd_create(&(0x7f0000000580)='D\xa3\xd5Wj\x00\x00x0\xc1\xac*`\xeb\xc7,\x1f\xe9B\x92\x06]\x16\x9d\x02\x1a\vG\xa9~vB\xbc\t\x00\x00\x00VoA\xaa\xbc\xee[\xe1\xa2\xe0\xff\x04\x00\x00\x00\\i\xcf\t\xb0\xa9 +H/\x1a\xe7\x95\xce\"\"\xbd\xf9\xd0\xc0\xa9\b\x98\xfc:\x1b\xc4\x80!\xfd\xa4\xcaN\x84\xadS\x8bqE\x99\x01t\xb1\x1f|\x99PL\x92\x8f\xc2\xf9\xcd\x8cj\x03X\x05\x17mwI\xf0\x01\xe5z\xcdJ)\xc7\xfa)\xaa}\xef\xbb\xf5\a\x00o5\x18\xd6\v\x85q\x98\x9bB\xb9\xea\xe7\xff\x7f\x00\x00T\xc0\xd2\t?\bpBl\xf4*8\xc6\xe5\x06P\xc11\f^\x7f\x8e\xc1\xd1Wra\x19)\xe3\x8f\xd9\x9f\x15\x1e\xf2\x18\r\xad\b\xe0\x96NH\x85\r+\xfc\xb3\xdd\xddhg \x03\xa7\x92\xff\x00+h\xb7@#K\x9cMY\xd3\x9b\b-G\xb1\xdaS\x81\xb2\x93\xb83\x8a\x94*\x8d\\\b\xff/\xa1\xc0\xf9&\xd3M\xf6\n\xff\x83k\xe6\rDa\x16\xbd\x00\x02\xdfi\x00\xd5)\xa4\x80\xad\x97\'\x1b\xfd}\x96&\xd2\x0eGp\x8e\x1a\x19o\xf1\x14\xe2]J\xf2\xb5h\x9bt*\xd2\xfbT\x01ci\x87\x18\xc9\x13=\x1b\xadl;}\x9d\xbe\x9a\xee\x1a\xfc\x96 \x93\x12@\x19|f\x98\xdc,\x82SlA\t\xcb\xfe\xccSKO}\xb2U\xd6\xc5\xa7=\xf8s\x1dp\xe0\x14\xe5\x92\xfd)\bB\xcd\xc2`OE\x8e\xf0\xf9\xd2!KZ%\xad\xa1\x92b\x1e%\x9f!\xd8mV$\x1d?\xc2\f\xcc\xc5x\x9fJ#\xce\x90\xc5\x82\xfb\x97\xd2\xb7\xb5\xed\xb5\'J\xfc\xf4Z.\rS\x88\f\xd0zK\xc7\x81\xbe\xd5\xc2\xce\x89\xbc\x1e\xb78\xf6Z\xd5\x1b\xf1\x9bMD\f\xf6\xc5V\xe1\x12j\xdfW\x87\xf09\n\x1e\x1b\f\xe5p\xab\x9e\xe5}\x96\x9b\xea\x86\x0f\xca\xcf\x16\x96\x0e6\x8d\x11\xd2&\"eKKV\x8b?]<\xa7]\x93\xad\x1d\xfe\x13\xee\xca\xdc\x97\xa9\a\b\xac\xdd\xa0\xfe\x97\xa1?\xa2F\xae\xb7f\x85\xda', 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) fsopen(&(0x7f0000000000)='autofs\x00', 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @multicast2}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfffb, 0x0, 0x4, 0x6, 0x800}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 857.337421ms ago: executing program 3 (id=2556): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./dev/mtdblock0\x00', 0x42, 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x110000) (fail_nth: 25) 856.976096ms ago: executing program 3 (id=2558): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000fefffe7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000c9be17044171e1d3d7b1efd036d7af273bce36015779c4cef58fa35d17c668a4b63e069efb29797573b8538e31ec24925095a163b9d4e76be2661f2a395e41f7e31a8021e00b00104e0801d4de36e5fdc6c42a7b3ff13f2360a6e231fd223bc33091dd61258a1fda45991fbdce6793c8a4785ee8b60092659b941bbd694dff0f0000000000003a45404b04bf97c4fea679c032b363956cd8bac9626b5db1b07a0bd7cc85e961506a35a04617dc0200379e731d3a8d8feac94a4ee293001f6ce7d5b40bf2a7f9be8173a9639a79fae885d05afe042c0e7821d406c967379e7521292d24d6c8034f2fc7c855a8945e9bce678ee9a015abc9daac8876623db56346916674ceb55f60b493f2f4d736acb2f206fc538450a676d71c01175b8454eb92567e8f8a707b590d7219288e23ee0800000000000010a49fc8f4ff0300000000000000000000cb947d6017ad27714772ad790af252e648ef8c313c604324f5b306000000000000cf327a00000000000000080a70162bba30ad7804fa4140f1a754ffff000000ab744d306619dfb3a37d897662bee00189f43da46a908a235c84cbad335fd1d2f2ef93a6a70c8b8ece0e243eab05a34ab0a7e7e497065e5e282e284f8d5e8852a265d528075214af000000000070d42182d8f3a347d48289a8b29b911ac473c5fa02bb0e24e5b7b238e27263a23c0b865f75331d888c72df1da4b290582f00024227f03204add786a87b23ceb17c25810e769fe2d6a7bd8e504843b66b1a8c7b364bd2194ba9c8f60ac0c9b18d8c1b9e1a736825c91b4dff0000c1c5dcffa295c2930000000000235d84b0193a5ea7c77cdb7de9ce1a59ab4158097b4dd13ebfaf4425c6855530b56a3320d85c8fe85f667998b1a7e589f486c107761108e4e230419fd27b6ad9c10b25c6b6ed84badbb970dcf133279dd355e41de944564bdab99c5c712a9fbc8e9691c775bb94f746505e1e748cf1710d52468b4b1625ce21612ed5e807dfb5f19f3267e5366b2c0b2a0be49ae476263c9407ac6c596bf3cf66204984f5aebf93d1caa220ea6969cea852fe9a7d1eee13f1f48722a69ad9fb850bd093a302b9250245900ad5c8e5f20ddf77ee3d5a168964fad1aa7347d36c502d02b1d96d753ef6fc354fc126070060c65c147651fca62c0a06939f40c90ebc3042e753fe91b5770b24f25c558736dd7e1e9fb214cbb04c5c6ee4c970b320ba6fb6ef4615f4092de54c519f4622e1224153463ea80248a45a95a189958f586d606dcaa9aac656cf95a2d35225cfb0e6f47486d5cbb04a590116d4de92e203e107d68728a189b0d537d2442beab2f8ce7b2dd357200dcd139e47267012fc2a2b6bad79be429d1ddaccbe0139f16ca1b9bc1103000000ed1ece54cfdbe04670bee9b42fe3dc42033997e2e700b6edb2b49b5f2f6001ee0a9e5d1bee199ce9124a5cb479040000000000000049ead5b02d5ea1dcf6cdcf332fe94b3c1932d8d391754774a32c9b7e6ca4023bce2c7281d27a2cb62383ab3a3bb535650fbfb96c89936855eb7a485698f0d20c3eedd6123ef8f218d52ea2c346f80acb8b9a71856d2f2d1a7c6f45ee127b6a1d1ac1e243ed02e49e8aafe835919564af915965a050c37ceff855bd2dec3452c7c38f5dbf1ff1ff00020000000000006a1a029ea6540b40b2f797813af2c7d4ed235c2dc5f1dbbfcc52b2f55fd3f9f100c4891d0cb4c10ed01489bf235c45822594d7a6edc9d1270a7819fc0c597fdfb4d7842da1b411346297a40bbf221bbf63ad3822575dcc01a3c34b5aa4e3750400000000000000fc0fd9c746cf0ed4b0343d00a154e6a869346256ffbd666a34414ab0f40bec45b1c24f02ac9bc20e69201968537dd4dc61323c8b6d3643183631664eeca616696fb30fe89c8bdb15037c801fca4a9c220fec5d14582a00b62548ddf2599e5ffc5330cefb8903d276eae21b0b4b20100ead8256636c7e754185e815dd21445cc965a0526da38021a3e540949494ef3041cfa5067f556a0af5c19d27ff4f61fa7762d7963c96853709e773f14c47eef784cb145ae9d6d37fc7b5d83e05ac773fcc429eae6826a9d207d4c39df8eed9cc2ae3f68df1c6495a82d02939b448bf8038521057714e6e6405000000be9e0b0025d16b7eff573f78364ed70a62a7b1e55311dc0193d47f9ecc8c7ad268dc6e2e75f8cc83315411bd6c6b88e1850ee757ac2f9e4d6ac510003717d5847a19e750db92d33d6bdc434d0b52b2eb4b1790459e35122f46b205120a54bf657da9fd55d43a89e333481de468f5984a69509e9eac7a5b39c004396e8cb3ab037fd62fa43f259f13ebc4b590e9ea07ea37689049c799cd444d45dabe3e3cf086768daa6816c37793d17a284d2828f5eab2d3d0bedd5334b7bb4c983fa9cd4bd86f0ad227901e83ef4871695380d25bea2929fa66382af6ddb89917ab100046151bd08fce74247955247daa1ea75139b9ce3771526503c7db3a4b3ff39301986c1fd9b5c42d39e768946c9a7ee8dd081bfb6ea5fa132ebdbe72d02ce9f2000000006f63ae8311afc4943c963d39e42c54a3f52d121bfb425fe268892f654febdaee43e95b5ae6749275e1ad8b8b279e1ae296e03a8d9386d8e199dc1f00000008000000000000000026c43493c622f041b47d329b248e8ccd92e9b17007ba2578eefcb59f50343722e6cba3be72fd037eb5fa243a395b5c83376a14414b32c2e8a33de8000000003927da2bec76f4e15c8bf3715c5bfe7b3617d0fcf9b5861554b5b76b8ae69c644a48931306a16cff8a38ea95553867e2c5fb1e99b1802e616345871b4611627874cfbe30fa5793c873ae6f75427f3eeda690147b9615b096d967c2d7f5ddf725f0544f8750a5ed04d6ca0f223506fec5d5e65b467c59459f6113cf41c174a63a17fc79d0b777a0c903c0d2e7f79b6f9ce68a3b72315407040f6a09cadc25e87b7c6b4a3079c7989b4cf04b2581b555fa9a2d74392939b4dbaa9e620e22ab975ac3a5a329157762c1f29075fbdd39451a56b97c90e4fde6782a7c78e7fbe8400054dcafcd51e9eef2d2ea10a3f2636ac2239cef5d8505060de55f472aa89cb8e0188f2ee96cb1ae8dee3c03d0a942c6289cbc4499cea402bd0550520f4aae98c436f18a667ae4efeb5e6a4b1b3f53536145a87578ead8ec76b17acd9d9629449714ed1302714c3519fdd8529b5a86ce2fabb7f285fe73730000000000000000000000000000000073b6f8e9255567374cb2cc80be58fca5b1dc50d85342e56beda632edb7f0a4abcabae102fadfbffecc6b1549315dda8e09d18a7fe5e1574e4fad426b6ca211da39a16dffdd661a20b20c390e00004b002cd83b754c3d32819c823027b3cf8f8da6e63d099712be370bb2aa06debff931ea0a2e7aa0390000000000000045b6720d74c470d49e1e97d1668bb75ad994089d723c2eeaad3f857937fa3df615121a1841ed452dd395788e1a82efda18b41c06c948ef44af8500fbe1ee0828a3b047afb80435935b0f99b381dcf101e9a1593bdaab3bc88c70bf56995a4790a339e1b62516356644ed7df6db419d0976a5169e68e8bd4712552c5ec03f2818c17c4a5bf1e5ecd9bb40074a63c66b61f4779226a99dc5ff9c442e93991570797493569e6f9ccd6d73bcbce41022e2731fc61b6bf0188c74a21471332a546ffe8e9dd738aa2ca782ff5a547a1ad7c348c59ff99d1496404eafcd0333df8f2801d39ad0c82735af24b819efc2fd67c6a53835f0af6a51d1b9123f4b9af7fa2ee2ebf4bc2973cf04380b41aa7577e35bcd28446bfcea19aa85440fe0fdce12e53da7b8842b7527a34d1bcb16fcdc84f2c46a78c01c2ff463cdd0d65267b0822e899e893514a02acd8c21583d181224175d08ff75223da84d53656eb7ab46ad442d70c67a6010029329924b8b39e6dc4b2077a4b9645d8e0a445ae2c7be53d66007d491ab0f6851a2cc1cffeed15f586a035c1a2888c56f43"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe80, 0xfffffffffffffd85, &(0x7f00000000c0)="b9ff03030018698cb89e40f086dd6000000e00001100630677", 0x0, 0x100, 0x2000000, 0x0, 0x0, &(0x7f0000000440)}, 0x28) 750.827044ms ago: executing program 4 (id=2559): r0 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) close(r0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) fcntl$setstatus(r0, 0x4, 0x2c00) ppoll(&(0x7f0000000340)=[{r1, 0x1210}], 0x1, &(0x7f00000003c0), 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1ff, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000080)="c4417d290ddada01ca48b8a9884315c2c245040f23c00f21f835000002000f23f8c4a2e0f3db0f07d2c74424001e09000000442402e4000000654c0fc72ef3410fc777d365420fc7700066b8502466ef", 0x6e}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x72, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 750.699059ms ago: executing program 3 (id=2560): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newqdisc={0x34, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0x501, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0x2}, {0x1, 0x1}}}, 0x24}}, 0x0) (fail_nth: 4) 660.616388ms ago: executing program 3 (id=2561): r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x18, 0x4, 0x2, 0x0, 0x201, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xffffffff, 0xffffffff}, 0x50) r3 = socket(0x10, 0x803, 0x0) r4 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fchdir(r4) creat(&(0x7f0000000080)='./cgroup\x00', 0x0) sendmsg$nl_route(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000056000100000000f70000000007020000", @ANYRES32, @ANYBLOB="200001"], 0x38}}, 0x0) write(r2, &(0x7f0000000000)='3', 0x4e) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r2, 0x4) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f0000000400)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x7}) 500.622795ms ago: executing program 4 (id=2562): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@deltfilter={0x24, 0x2d, 0x300, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x9, 0xe}, {0x8, 0xffe0}}}, 0x24}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x108, 0x0, 0x65dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xffe0}, {0xffff, 0x7ff8}, {0xfff2}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_BYTEMODE={0x8}, @TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0xffffff22}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r3 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) r4 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x3, 0xc, @loopback, 0x9}, 0x1c) sendmsg(r4, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x584}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c0001800600010058c6000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x23f, 0x0, 0x0, {0xa}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) 500.411166ms ago: executing program 3 (id=2563): r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000600)=@ublk_set_params_sqe={0x2e, 0x0, 0x0, r0, 0xc0207508, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0x0, 0xffff, 0x30, &(0x7f0000000680)={0x30, 0x1, {0x0, 0x9, 0xc, 0xc, 0x9, 0x8}}}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) r5 = syz_open_dev$ublk_chdev(0x0, 0x0, 0x2) syz_ublk_setup_queues(r5, 0x0, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r5, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, &(0x7f0000000a00)=@buf_4k}}, &(0x7f0000000b00)) nanosleep(&(0x7f0000001a00)={0x5}, &(0x7f0000001a40)) r6 = getpid() syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000000c00)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, r0, 0xc0207506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0x0, 0xffff, 0x0, 0x0, r6}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) 500.08218ms ago: executing program 1 (id=2564): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x63) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_X86_SET_MCE(r2, 0x4040ae9e, 0x0) syz_open_dev$dvb_frontend(0x0, 0x0, 0x2) prctl$PR_SET_IO_FLUSHER(0x39, 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write(r3, &(0x7f0000000080)='4', 0x1) (fail_nth: 3) 340.571304ms ago: executing program 4 (id=2565): r0 = request_key(&(0x7f0000000080)='id_resolver\x00', 0x0, &(0x7f0000000140)='cifs.spnego\x00', 0x0) add_key(0x0, 0x0, 0x0, 0x0, r0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vxcan1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000200)={'ip6_vti0\x00', &(0x7f0000000180)={'syztnl2\x00', 0x0, 0x4, 0x40, 0x3, 0x2, 0x40, @private2, @private1, 0x8000, 0x8, 0x5}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000300)={'gretap0\x00', &(0x7f0000000240)={'tunl0\x00', 0x0, 0x80, 0x7, 0x1, 0x4, {{0x23, 0x4, 0x0, 0x3, 0x8c, 0x65, 0x0, 0x3, 0x2f, 0x0, @multicast2, @loopback, {[@generic={0x89, 0xe, "147a6d39f8e9a49429f8cc0f"}, @cipso={0x86, 0x29, 0x2, [{0x7, 0x6, "83ec86d4"}, {0x1, 0x5, "e92a66"}, {0xd98e974907155591, 0xc, "efaa3dddbc0c607745f5"}, {0x6, 0xc, "3667e99e6a68faac9005"}]}, @noop, @timestamp={0x44, 0x10, 0x85, 0x0, 0x3, [0x2, 0xffffffff, 0x81]}, @ssrr={0x89, 0x7, 0x93, [@local]}, @timestamp={0x44, 0xc, 0x37, 0x0, 0x8, [0xfffffff8, 0xa]}, @noop, @timestamp_prespec={0x44, 0x1c, 0x5d, 0x3, 0x9, [{@remote, 0x800}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xbde}, {@broadcast, 0x7}]}]}}}}}) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@bridge_delneigh={0x3c, 0x1c, 0xc07, 0x2000, 0x0, {0x2, 0x0, 0x0, r7, 0x8, 0x10}, [@NDA_DST_IPV6={0x14, 0x1, @empty}, @NDA_LLADDR={0xa, 0x2, @random="44328a67ad89"}]}, 0x3c}}, 0x20024090) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000740)=ANY=[@ANYBLOB="3c00000010000500"/20, @ANYRES32=0x0, @ANYBLOB="01000000010000001400030073797a6b616c6c65723000000000000008000a00", @ANYRES32=r10], 0x3c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000400)={'syztnl0\x00', &(0x7f0000000380)={'ip_vti0\x00', 0x0, 0x0, 0x20, 0x29d2, 0x2, {{0x18, 0x4, 0x1, 0x22, 0x60, 0x68, 0x0, 0x0, 0x29, 0x0, @broadcast, @multicast2, {[@timestamp_addr={0x44, 0x3c, 0x3d, 0x1, 0xc, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x39}, {@remote, 0x9}, {@private=0xa010101, 0x3}, {@multicast1, 0x8}, {@remote, 0x5}, {@multicast2, 0x7}, {@local, 0x8}]}, @generic={0x83, 0xc, "07dc9ab3149f6d457aab"}, @noop]}}}}}) r13 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_SET_MP_STATE(r13, 0x4004ae99, &(0x7f0000000640)=0x3) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000005c0)={&(0x7f0000000440)={0x17c, r2, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7c78d7b784d141b3}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nicvf0\x00'}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}, @HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20000000}, 0xa010) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x1, 0x3}, 0x4) r14 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000440), 0x723, 0x2000000022, &(0x7f0000000480)={0x77359400}) setsockopt$sock_int(r14, 0x1, 0x1d, &(0x7f0000000040)=0x80000004, 0x4) sendmsg$key(r14, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) r15 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_RUN(r15, 0xae80, 0x0) getsockopt$packet_int(r1, 0x107, 0x15, 0x0, &(0x7f0000001600)) 280.793723ms ago: executing program 4 (id=2566): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000ac0)=ANY=[], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x2d1, 0xfffffffffffffd85, &(0x7f00000000c0)="b9ff03030018698cb89e40f086dd6000000e00001100630677", 0x0, 0x100, 0x2000000, 0x0, 0x0, &(0x7f0000000440)}, 0x28) 280.593663ms ago: executing program 4 (id=2567): ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x0, 0x100000000, 0x0, 0x81, 0x100000, 0x0, 0x2004c8, 0x100000001, 0x0, 0x0, 0x7, 0x0, 0x5, 0xfffffffffffffffc, 0x2, 0xffffffffffffffff], 0x0, 0x200}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)=[@code={0x1, 0x81, {"0f22e5c744240060420000c744240233d8cecbc7442406000000000f011c24668f38896810c4027958b20000000064449966baf80cb83284af80ef66bafc0c66ed66baf80cb8cc07ff8aef66bafc0cb8d4000000ef48b8f8000000000000000f23c00f2135030009000f23f8450f2244"}}], 0x81}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) setns(0xc9, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0x3, @empty, 0x3}], 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x85, &(0x7f00000012c0)={0x0, @in={{0x2, 0x4c24, @empty}}, 0x6, 0x6}, 0x90) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f00000001c0)={'bond_slave_1\x00', &(0x7f0000000080)=@ethtool_wolinfo={0x6, 0xf, 0x400, "bf0cfa2232bc"}}) sendmsg$inet6(r3, &(0x7f0000000540)={&(0x7f00000000c0)={0xa, 0x4e24, 0x8004, @loopback, 0x7fff}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000100)="f0", 0x1}], 0x1}, 0x400d4) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e1e, @empty}}, 0xffffff01, 0x67, 0xa4f, 0xc0, 0x15, 0xffffff86, 0xa9}, 0x9c) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xe45, 0x9, 0xfffffffffffffffd, 0x10000000, 0x10000, 0x3, 0x4002004c2, 0x7ff, 0x1, 0x0, 0x400, 0x80, 0x88, 0x0, 0x8, 0x8d], 0xeeee8000, 0x240046}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 190.838517ms ago: executing program 1 (id=2568): r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc4910700004f78d4c1a0731cccff"], 0x1c}}, 0x0) recvmmsg$unix(r0, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000001380)=""/4096, 0xec0}], 0x1, 0x0, 0x300, 0x1000000}}], 0x14, 0x100000000000000, 0x0) 120.479099ms ago: executing program 1 (id=2569): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, 0x0) 56.363871ms ago: executing program 4 (id=2570): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x20842, 0x63) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_X86_SET_MCE(r3, 0x4040ae9e, 0x0) syz_open_dev$dvb_frontend(0x0, 0x0, 0x2) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x1a) prctl$PR_SET_IO_FLUSHER(0x39, 0x1) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x129642, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r6, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)={0x90, r6, 0x5, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x51, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @val={0x5, 0x3, {0x7, 0xc7, 0x6}}, @void, @void, @void, @val={0x2d, 0x1a, {0x300, 0x1, 0x7, 0x0, {0xa600000000000000, 0x2, 0x0, 0x3fe, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x9, 0x3}}, @val={0x72, 0x6}, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x90}}, 0x20000014) socketpair$unix(0x1, 0x2, 0x0, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r8, &(0x7f0000001080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc0}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r10) sendmsg$IEEE802154_LLSEC_SETPARAMS(r10, 0x0, 0x4c440) 0s ago: executing program 1 (id=2571): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000001c0)={0x9}, 0x10) getsockname$packet(r0, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000300)=0x14) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @sched_cls=0x2f, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000040), 0x10}, 0x94) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x40000, 0x20) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000500), 0x40000, 0x0) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f00000003c0), 0x80000, 0x0) ioctl$RTC_UIE_ON(r4, 0x7003) ioctl$RTC_WKALM_SET(r4, 0x4028700f, &(0x7f0000000000)={0x1, 0x2, {0x4, 0x39, 0x11, 0xd, 0x4, 0xe80, 0x5, 0x40, 0x1}}) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000100)={0x19, 0x2b, 0x6, 0x19, 0x1, 0x0, 0x0, 0x165}) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r5, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r3, 0x3b89, &(0x7f0000000240)={0x28, 0x1, r6, r5, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl(r3, 0x3b90, &(0x7f0000000200)="2800000000000000efbeadde0300000005") close_range(r2, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x5, 0x200) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="2800000071000002269d7000fcdbdf2507000000a161b54256ba55ea3108f5778c05e073aee37cac9c4661f4a8449e4981dbceaefb01b727e23df0f3949a8acec39e8b7f53d9c5ff94f78c2cc45fd89e2c3153727ec5eb744dc56e4a1b4059fea70a600fe3b8739f744d84b35d2ae6cee1804f90b6836cf578beea93ca8d8729", @ANYRES32=r1, @ANYBLOB="100001800c0004800800010009000000"], 0x28}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r7, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x40, 0x1, 0x1, 0x301, 0x0, 0x0, {0x4, 0x0, 0x3}, [@CTA_NAT_SRC={0x2c, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @loopback}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @local}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x20000800) getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f0000000280)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@redirect_dir_nofollow}, {@nfs_export_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r8 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000580)='./tracefs/instances/foo\x00', &(0x7f0000000540)={0x0, 0x114, 0x2}, 0x18) mkdirat(r8, &(0x7f00000000c0)='./bus\x00', 0x0) mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) kernel console output (not intermixed with test programs): und at 0x00017024: 0x168f instead [ 188.488779][T12050] jffs2: Further such events for this erase block will not be printed [ 188.489123][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018000: 0xf40e instead [ 188.489140][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018004: 0xebbc instead [ 188.489154][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018008: 0x6d64 instead [ 188.489169][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001800c: 0xee97 instead [ 188.489182][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018010: 0xa12a instead [ 188.489198][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018014: 0x24f4 instead [ 188.489213][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018018: 0xc73b instead [ 188.489227][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001801c: 0x00f2 instead [ 188.489242][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018020: 0xeedf instead [ 188.489255][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018024: 0x25b2 instead [ 188.489269][T12050] jffs2: Further such events for this erase block will not be printed [ 188.489784][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019000: 0x16c1 instead [ 188.489801][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019004: 0xdf46 instead [ 188.489815][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019008: 0xab0f instead [ 188.489830][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001900c: 0xf5df instead [ 188.489844][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019010: 0x5dd3 instead [ 188.489861][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019014: 0x2e0e instead [ 188.489876][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019018: 0x80ec instead [ 188.489890][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001901c: 0x161f instead [ 188.489905][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019020: 0x748a instead [ 188.489919][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019024: 0x43af instead [ 188.489933][T12050] jffs2: Further such events for this erase block will not be printed [ 188.490275][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a000: 0x42c1 instead [ 188.490293][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a004: 0x7297 instead [ 188.490313][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a008: 0x295c instead [ 188.490328][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a00c: 0x4ef5 instead [ 188.490340][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a010: 0x450b instead [ 188.490356][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a014: 0x797f instead [ 188.490371][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a018: 0xca90 instead [ 188.490386][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a01c: 0xb55c instead [ 188.490400][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a020: 0x6dee instead [ 188.490414][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a024: 0x3f22 instead [ 188.490428][T12050] jffs2: Further such events for this erase block will not be printed [ 188.490994][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b000: 0x14f2 instead [ 188.491012][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b004: 0x383d instead [ 188.491024][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b008: 0x4d61 instead [ 188.491040][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b00c: 0x26da instead [ 188.491053][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b010: 0x06c5 instead [ 188.491066][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b014: 0x7690 instead [ 188.491081][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b018: 0x4098 instead [ 188.491095][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b01c: 0x98ed instead [ 188.491122][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b020: 0x8cba instead [ 188.491136][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b024: 0xfc4c instead [ 188.491151][T12050] jffs2: Further such events for this erase block will not be printed [ 188.491500][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c000: 0xcd2e instead [ 188.491516][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c004: 0x4081 instead [ 188.491531][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c008: 0xd83d instead [ 188.491545][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c00c: 0xe0fb instead [ 188.491559][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c010: 0x4785 instead [ 188.491599][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c014: 0x75ea instead [ 188.491614][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c018: 0xbb15 instead [ 188.491626][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c01c: 0x3f02 instead [ 188.491642][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c020: 0x80c0 instead [ 188.491657][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c024: 0xfa05 instead [ 188.491672][T12050] jffs2: Further such events for this erase block will not be printed [ 188.492124][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d000: 0xf64e instead [ 188.492142][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d004: 0x9850 instead [ 188.492158][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d008: 0x2bf6 instead [ 188.492172][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d00c: 0xb08e instead [ 188.492188][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d010: 0x143a instead [ 188.492203][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d014: 0x1f70 instead [ 188.492217][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d018: 0x0b4a instead [ 188.492231][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d01c: 0xa1d4 instead [ 188.492246][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d020: 0xa136 instead [ 188.492260][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d024: 0x8196 instead [ 188.492275][T12050] jffs2: Further such events for this erase block will not be printed [ 188.492622][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e000: 0xf2b2 instead [ 188.492638][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e004: 0x87b4 instead [ 188.492653][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e008: 0x0fce instead [ 188.492669][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e00c: 0xda39 instead [ 188.492684][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e010: 0x997e instead [ 188.492700][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e014: 0x9b6a instead [ 188.492714][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e018: 0xf886 instead [ 188.492727][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e01c: 0xbe27 instead [ 188.492743][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e020: 0x6e51 instead [ 188.492756][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e024: 0xbdfc instead [ 188.492771][T12050] jffs2: Further such events for this erase block will not be printed [ 188.493262][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4fb7 instead [ 188.493281][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x3f01 instead [ 188.493297][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f008: 0xf4d3 instead [ 188.493316][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f00c: 0x4efe instead [ 188.493332][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f010: 0x9b6a instead [ 188.493347][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f014: 0x8cbe instead [ 188.493361][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0x247a instead [ 188.493377][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f01c: 0x6db1 instead [ 188.493392][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f020: 0x2c5f instead [ 188.493407][T12050] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f024: 0x598d instead [ 188.493421][T12050] jffs2: Further such events for this erase block will not be printed [ 188.493748][T12050] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 188.493757][T12050] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 188.661133][ T5734] Bluetooth: hci1: command 0x0c1a tx timeout [ 188.800121][T12068] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2301'. [ 188.806261][ T43] audit: type=1400 audit(1791071212.547:816): avc: denied { write } for pid=12059 comm="syz.2.2301" name="usb_gadget" dev="configfs" ino=754 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 188.808992][ T43] audit: type=1400 audit(1791071212.547:817): avc: denied { remove_name } for pid=12059 comm="syz.2.2301" name="g1" dev="configfs" ino=13535 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 188.809267][ T43] audit: type=1400 audit(1791071212.547:818): avc: denied { rmdir } for pid=12059 comm="syz.2.2301" name="g1" dev="configfs" ino=13535 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 188.862255][T12067] tipc: Enabling of bearer rejected, already enabled [ 188.873710][T12070] netlink: Unknown conntrack attr (0) [ 188.873738][T12070] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 188.913943][T12072] FAULT_INJECTION: forcing a failure. [ 188.913943][T12072] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 188.913964][T12072] CPU: 1 UID: 0 PID: 12072 Comm: syz.2.2304 Tainted: G L syzkaller #0 PREEMPT(full) [ 188.913980][T12072] Tainted: [L]=SOFTLOCKUP [ 188.913984][T12072] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 188.913991][T12072] Call Trace: [ 188.913995][T12072] [ 188.913999][T12072] dump_stack_lvl+0x100/0x190 [ 188.914019][T12072] should_fail_ex.cold+0x5/0xa [ 188.914036][T12072] _copy_from_user+0x2e/0xd0 [ 188.914050][T12072] mtdchar_ioctl+0xf8b/0x1fd0 [ 188.914065][T12072] ? __pfx_mtdchar_ioctl+0x10/0x10 [ 188.914078][T12072] ? lock_acquire+0x1d1/0x380 [ 188.914090][T12072] ? mtdchar_unlocked_ioctl+0xa2/0xf0 [ 188.914105][T12072] ? rcu_is_watching+0x13/0xc0 [ 188.914122][T12072] ? trace_contention_end+0x126/0x160 [ 188.914137][T12072] ? mtdchar_unlocked_ioctl+0xa2/0xf0 [ 188.914150][T12072] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 188.914162][T12072] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 188.914180][T12072] ? __pfx___mutex_lock+0x10/0x10 [ 188.914194][T12072] ? __fget_files+0x34/0x3d0 [ 188.914217][T12072] mtdchar_unlocked_ioctl+0xb0/0xf0 [ 188.914229][T12072] ? __pfx_mtdchar_unlocked_ioctl+0x10/0x10 [ 188.914242][T12072] __x64_sys_ioctl+0x18e/0x210 [ 188.914256][T12072] do_syscall_64+0x123/0x790 [ 188.914269][T12072] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 188.914281][T12072] RIP: 0033:0x7fe99bd9e159 [ 188.914291][T12072] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 188.914301][T12072] RSP: 002b:00007fe99cbb5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 188.914313][T12072] RAX: ffffffffffffffda RBX: 00007fe99c025fa0 RCX: 00007fe99bd9e159 [ 188.914320][T12072] RDX: 0000200000000140 RSI: 00000000c0184d16 RDI: 0000000000000003 [ 188.914327][T12072] RBP: 00007fe99cbb5090 R08: 0000000000000000 R09: 0000000000000000 [ 188.914333][T12072] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 188.914345][T12072] R13: 00007fe99c026038 R14: 00007fe99c025fa0 R15: 00007ffc6c4666f8 [ 188.914359][T12072] [ 189.000208][T12078] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2307'. [ 189.001354][T12078] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2307'. [ 189.075402][T12083] overlayfs: overlapping lowerdir path [ 189.109503][T12086] FAULT_INJECTION: forcing a failure. [ 189.109503][T12086] name failslab, interval 1, probability 0, space 0, times 0 [ 189.109524][T12086] CPU: 2 UID: 0 PID: 12086 Comm: syz.2.2311 Tainted: G L syzkaller #0 PREEMPT(full) [ 189.109539][T12086] Tainted: [L]=SOFTLOCKUP [ 189.109543][T12086] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 189.109550][T12086] Call Trace: [ 189.109554][T12086] [ 189.109558][T12086] dump_stack_lvl+0x100/0x190 [ 189.109591][T12086] should_fail_ex.cold+0x5/0xa [ 189.109608][T12086] should_failslab+0xc2/0x120 [ 189.109624][T12086] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 189.109638][T12086] ? __d_alloc+0x35/0xa50 [ 189.109658][T12086] __d_alloc+0x35/0xa50 [ 189.109680][T12086] d_alloc_parallel+0x105/0x14c0 [ 189.109696][T12086] ? lock_acquire+0x1d1/0x380 [ 189.109709][T12086] ? __d_lookup+0x73/0x4a0 [ 189.109722][T12086] ? __pfx_d_alloc_parallel+0x10/0x10 [ 189.109736][T12086] ? __d_lookup+0x25c/0x4a0 [ 189.109751][T12086] ? __d_lookup+0x266/0x4a0 [ 189.109767][T12086] lookup_open+0x6bb/0x1990 [ 189.109785][T12086] path_openat+0xa2c/0x2440 [ 189.109803][T12086] ? __pfx_path_openat+0x10/0x10 [ 189.109823][T12086] do_file_open+0x20e/0x430 [ 189.109844][T12086] ? __pfx_do_file_open+0x10/0x10 [ 189.109875][T12086] ? __pfx_kfree_link+0x10/0x10 [ 189.109903][T12086] ? _raw_spin_unlock+0x28/0x50 [ 189.109928][T12086] ? alloc_fd+0x471/0x7a0 [ 189.109958][T12086] do_sys_openat2+0x10f/0x1e0 [ 189.109984][T12086] ? __pfx_do_sys_openat2+0x10/0x10 [ 189.110018][T12086] __x64_sys_openat+0x12d/0x210 [ 189.110043][T12086] ? __pfx___x64_sys_openat+0x10/0x10 [ 189.110077][T12086] do_syscall_64+0x123/0x790 [ 189.110098][T12086] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 189.110115][T12086] RIP: 0033:0x7fe99bd5e98e [ 189.110129][T12086] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 189.110160][T12086] RSP: 002b:00007fe99cbb4f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 189.110176][T12086] RAX: ffffffffffffffda RBX: 00007fe99cbb56c0 RCX: 00007fe99bd5e98e [ 189.110188][T12086] RDX: 0000000000000002 RSI: 00007fe99be34972 RDI: ffffffffffffff9c [ 189.110198][T12086] RBP: 00007fe99be3506b R08: 0000000000000000 R09: 0000000000000000 [ 189.110208][T12086] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 189.110218][T12086] R13: 00007fe99c026038 R14: 00007fe99c025fa0 R15: 00007ffc6c4666f8 [ 189.110241][T12086] [ 189.161584][T12087] FAULT_INJECTION: forcing a failure. [ 189.161584][T12087] name failslab, interval 1, probability 0, space 0, times 0 [ 189.161615][T12087] CPU: 1 UID: 0 PID: 12087 Comm: syz.1.2310 Tainted: G L syzkaller #0 PREEMPT(full) [ 189.161637][T12087] Tainted: [L]=SOFTLOCKUP [ 189.161642][T12087] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 189.161651][T12087] Call Trace: [ 189.161657][T12087] [ 189.161664][T12087] dump_stack_lvl+0x100/0x190 [ 189.161691][T12087] should_fail_ex.cold+0x5/0xa [ 189.161717][T12087] should_failslab+0xc2/0x120 [ 189.161744][T12087] kmem_cache_alloc_noprof+0x92/0x6a0 [ 189.161767][T12087] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 189.161796][T12087] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 189.161829][T12087] mmu_topup_memory_caches+0x25/0x170 [ 189.161849][T12087] kvm_mmu_load+0xe8/0x2580 [ 189.161868][T12087] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 189.161892][T12087] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 189.161921][T12087] ? __pfx_kvm_mmu_load+0x10/0x10 [ 189.161942][T12087] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 189.161963][T12087] ? kvm_check_and_inject_events+0x896/0x1050 [ 189.161986][T12087] vcpu_run+0x419f/0x61a0 [ 189.162007][T12087] ? vmx_vcpu_load_vmcs+0x21d/0x760 [ 189.162039][T12087] ? __pfx_vcpu_run+0x10/0x10 [ 189.162061][T12087] ? lock_acquire+0x1d1/0x380 [ 189.162079][T12087] ? kvm_arch_vcpu_ioctl_run+0x2e9/0x1dd0 [ 189.162104][T12087] ? fpu_swap_kvm_fpstate+0x217/0x460 [ 189.162130][T12087] ? __local_bh_enable_ip+0xa5/0x120 [ 189.162155][T12087] ? kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 189.162174][T12087] kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 189.162203][T12087] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 189.162221][T12087] ? lock_acquire+0x1d1/0x380 [ 189.162240][T12087] ? do_raw_write_lock+0x11e/0x260 [ 189.162260][T12087] ? find_held_lock+0x2b/0x80 [ 189.162288][T12087] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 189.162312][T12087] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 189.162343][T12087] kvm_vcpu_ioctl+0x730/0x1700 [ 189.162368][T12087] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 189.162393][T12087] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 189.162414][T12087] ? do_vfs_ioctl+0x226/0x13e0 [ 189.162433][T12087] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 189.162449][T12087] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 189.162473][T12087] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 189.162501][T12087] ? __fget_files+0x34/0x3d0 [ 189.162536][T12087] ? selinux_file_ioctl+0x13b/0x290 [ 189.162556][T12087] ? selinux_file_ioctl+0xb6/0x290 [ 189.162580][T12087] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 189.162603][T12087] __x64_sys_ioctl+0x18e/0x210 [ 189.162623][T12087] do_syscall_64+0x123/0x790 [ 189.162642][T12087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 189.162658][T12087] RIP: 0033:0x7fafd3f9e159 [ 189.162672][T12087] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 189.162689][T12087] RSP: 002b:00007fafd4f1a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 189.162708][T12087] RAX: ffffffffffffffda RBX: 00007fafd4225fa0 RCX: 00007fafd3f9e159 [ 189.162721][T12087] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 189.162731][T12087] RBP: 00007fafd4f1a090 R08: 0000000000000000 R09: 0000000000000000 [ 189.162740][T12087] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 189.162749][T12087] R13: 00007fafd4226038 R14: 00007fafd4225fa0 R15: 00007ffd85af8f18 [ 189.162774][T12087] [ 189.651110][ T5734] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 189.656107][ T5734] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 189.657267][ T5734] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 189.658035][ T5734] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 189.661921][ T5734] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 189.737472][T12097] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2560 sclass=netlink_route_socket pid=12097 comm=syz.0.2315 [ 189.737496][T12097] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2563 sclass=netlink_route_socket pid=12097 comm=syz.0.2315 [ 189.737513][T12097] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2566 sclass=netlink_route_socket pid=12097 comm=syz.0.2315 [ 189.739095][T12097] xt_hashlimit: overflow, try lower: 0/0 [ 189.801616][T11783] tipc: Resetting bearer [ 189.854812][T11783] tipc: Disabling bearer [ 189.862615][ T5743] Bluetooth: hci4: command tx timeout [ 189.872751][T12111] fuse: Bad value for 'group_id' [ 189.872767][T12111] fuse: Bad value for 'group_id' [ 190.158880][T12127] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2319'. [ 190.181720][T12126] netlink: 'syz.2.2320': attribute type 1 has an invalid length. [ 190.216624][ T5824] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.235589][T12131] team_slave_0: Device is already in use. [ 190.322388][ T5824] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.346834][T12136] bond0: entered promiscuous mode [ 190.346853][T12136] bond_slave_0: entered promiscuous mode [ 190.347041][T12136] bond_slave_1: entered promiscuous mode [ 190.347879][T12136] batadv0: entered promiscuous mode [ 190.348935][T12136] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 190.348953][T12136] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 190.351875][T12136] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 190.355660][T12136] bond0: left promiscuous mode [ 190.355673][T12136] bond_slave_0: left promiscuous mode [ 190.355780][T12136] bond_slave_1: left promiscuous mode [ 190.357915][T12136] batadv0: left promiscuous mode [ 190.588415][ T5824] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.720426][ T5743] Bluetooth: hci0: unexpected event for opcode 0x202f [ 190.791659][ T5824] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.846548][T12099] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.846630][T12099] bridge0: port 1(bridge_slave_0) entered disabled state [ 190.846699][T12099] bridge_slave_0: entered allmulticast mode [ 190.847479][T12099] bridge_slave_0: entered promiscuous mode [ 190.849497][T12099] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.851792][T12099] bridge0: port 2(bridge_slave_1) entered disabled state [ 190.851863][T12099] bridge_slave_1: entered allmulticast mode [ 190.852614][T12099] bridge_slave_1: entered promiscuous mode [ 190.896445][T12099] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 190.900353][T12099] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 190.936708][T12099] team0: Port device team_slave_0 added [ 190.937907][T12099] team0: Port device team_slave_1 added [ 190.951822][T12099] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 190.951834][T12099] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 190.951847][T12099] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 190.955370][T12099] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 190.955380][T12099] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 190.955394][T12099] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 191.002749][T12099] hsr_slave_0: entered promiscuous mode [ 191.003678][T12099] hsr_slave_1: entered promiscuous mode [ 191.004186][T12099] debugfs: 'hsr0' already exists in 'hsr' [ 191.004201][T12099] Cannot create hsr debugfs directory [ 191.022584][T12154] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 191.217847][ T5824] bridge_slave_1: left allmulticast mode [ 191.217870][ T5824] bridge_slave_1: left promiscuous mode [ 191.218860][ T5824] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.235771][ T5824] bridge_slave_0: left allmulticast mode [ 191.235787][ T5824] bridge_slave_0: left promiscuous mode [ 191.235917][ T5824] bridge0: port 1(bridge_slave_0) entered disabled state [ 191.255718][ T5824] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 191.328863][ T5824] batman_adv: batadv0: Removing interface: ip6gretap1 [ 191.420158][ T5824] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 191.428437][ T5824] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 191.430200][ T5824] bond0 (unregistering): Released all slaves [ 191.439286][ T5824] bond1 (unregistering): (slave veth0_to_bond): Releasing active interface [ 191.441444][ T5824] bond1 (unregistering): Released all slaves [ 191.459176][ T5824] bond2 (unregistering): Released all slaves [ 191.545091][ T5824] tipc: Disabling bearer [ 191.554560][ T5824] tipc: Left network mode [ 191.641073][T12179] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 191.702459][ T5743] Bluetooth: hci3: command tx timeout [ 191.755621][ T43] audit: type=1400 audit(1791071215.497:819): avc: denied { write } for pid=12192 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 191.823071][ T5824] hsr_slave_0: left promiscuous mode [ 191.823587][ T5824] hsr_slave_1: left promiscuous mode [ 191.824045][ T5824] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 191.824056][ T5824] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 191.825720][ T5824] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 191.825731][ T5824] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 191.836506][ T43] audit: type=1400 audit(1791071215.577:820): avc: denied { write } for pid=12200 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 191.858090][ T5824] veth1_macvtap: left promiscuous mode [ 191.858127][ T5824] veth0_macvtap: left promiscuous mode [ 191.858178][ T5824] veth1_vlan: left promiscuous mode [ 191.858222][ T5824] veth0_vlan: left promiscuous mode [ 192.082913][ T5824] team0 (unregistering): Port device team_slave_1 removed [ 192.087897][ T5824] team0 (unregistering): Port device team_slave_0 removed [ 192.176800][ T5441] 8021q: adding VLAN 0 to HW filter on device eth2 [ 192.447761][T12224] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2347'. [ 192.499662][T12099] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 192.503296][T12099] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 192.507094][T12099] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 192.518282][T12099] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 192.518962][T12099] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 192.528487][T12099] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 192.529129][T12099] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 192.540792][T12099] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 192.598637][T12099] 8021q: adding VLAN 0 to HW filter on device bond0 [ 192.605876][T12099] 8021q: adding VLAN 0 to HW filter on device team0 [ 192.615661][ T55] bridge0: port 1(bridge_slave_0) entered blocking state [ 192.615738][ T55] bridge0: port 1(bridge_slave_0) entered forwarding state [ 192.625323][ T106] bridge0: port 2(bridge_slave_1) entered blocking state [ 192.625403][ T106] bridge0: port 2(bridge_slave_1) entered forwarding state [ 192.631383][T12239] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2351'. [ 192.736581][T12249] FAULT_INJECTION: forcing a failure. [ 192.736581][T12249] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 192.736611][T12249] CPU: 2 UID: 0 PID: 12249 Comm: syz.0.2354 Tainted: G L syzkaller #0 PREEMPT(full) [ 192.736634][T12249] Tainted: [L]=SOFTLOCKUP [ 192.736640][T12249] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 192.736649][T12249] Call Trace: [ 192.736654][T12249] [ 192.736659][T12249] dump_stack_lvl+0x100/0x190 [ 192.736703][T12249] should_fail_ex.cold+0x5/0xa [ 192.736726][T12249] _copy_from_user+0x2e/0xd0 [ 192.736753][T12249] cec_ioctl+0x5ab/0x2990 [ 192.736778][T12249] ? __pfx_cec_ioctl+0x10/0x10 [ 192.736791][T12249] ? tomoyo_path_number_perm+0x188/0x580 [ 192.736821][T12249] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 192.736844][T12249] ? do_vfs_ioctl+0x226/0x13e0 [ 192.736862][T12249] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 192.736879][T12249] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 192.736903][T12249] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 192.736927][T12249] ? __fget_files+0x34/0x3d0 [ 192.736956][T12249] ? selinux_file_ioctl+0x13b/0x290 [ 192.736975][T12249] ? selinux_file_ioctl+0xb6/0x290 [ 192.736997][T12249] ? __pfx_cec_ioctl+0x10/0x10 [ 192.737012][T12249] __x64_sys_ioctl+0x18e/0x210 [ 192.737032][T12249] do_syscall_64+0x123/0x790 [ 192.737058][T12249] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.737074][T12249] RIP: 0033:0x7f695f79e159 [ 192.737088][T12249] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 192.737102][T12249] RSP: 002b:00007f696070b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 192.737118][T12249] RAX: ffffffffffffffda RBX: 00007f695fa25fa0 RCX: 00007f695f79e159 [ 192.737128][T12249] RDX: 0000200000000580 RSI: 00000000c05c6104 RDI: 0000000000000003 [ 192.737138][T12249] RBP: 00007f696070b090 R08: 0000000000000000 R09: 0000000000000000 [ 192.737147][T12249] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 192.737157][T12249] R13: 00007f695fa26038 R14: 00007f695fa25fa0 R15: 00007fff4fd56a88 [ 192.737178][T12249] [ 192.901812][T12099] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 192.910669][ T25] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 192.928578][T12099] veth0_vlan: entered promiscuous mode [ 192.932597][T12099] veth1_vlan: entered promiscuous mode [ 192.947982][T12099] veth0_macvtap: entered promiscuous mode [ 192.950759][T12099] veth1_macvtap: entered promiscuous mode [ 192.958714][T12099] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 192.963258][T12099] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 192.968320][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.968408][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.968498][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.968536][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 193.060710][ T25] usb 8-1: Using ep0 maxpacket: 16 [ 193.062641][ T25] usb 8-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 193.063943][ T25] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 193.063968][ T25] usb 8-1: config 0 interface 0 has no altsetting 0 [ 193.066506][ T25] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.066525][ T25] usb 8-1: Product: syz [ 193.066538][ T25] usb 8-1: Manufacturer: syz [ 193.066555][ T25] usb 8-1: SerialNumber: syz [ 193.069123][ T25] usb 8-1: config 0 descriptor?? [ 193.277133][ C2] imon 8-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 193.285355][ T25] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/input/input5 [ 193.293979][ T43] kauditd_printk_skb: 5 callbacks suppressed [ 193.293994][ T43] audit: type=1400 audit(1791071217.037:826): avc: denied { read } for pid=5124 comm="acpid" name="mouse2" dev="devtmpfs" ino=3260 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 193.297525][ T43] audit: type=1400 audit(1791071217.037:827): avc: denied { open } for pid=5124 comm="acpid" path="/dev/input/mouse2" dev="devtmpfs" ino=3260 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 193.305154][ T25] imon:send_packet: packet tx failed (-71) [ 193.320698][ T25] imon 8-1:0.0: panel buttons/knobs setup failed [ 193.335104][ T1165] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 193.335124][ T1165] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 193.345325][ T43] audit: type=1400 audit(1791071217.077:828): avc: denied { ioctl } for pid=5124 comm="acpid" path="/dev/input/mouse2" dev="devtmpfs" ino=3260 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 193.373891][ T55] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 193.373912][ T55] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 193.381575][ T25] rc_core: IR keymap rc-imon-pad not found [ 193.381588][ T25] Registered IR keymap rc-empty [ 193.381641][ T25] imon 8-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 193.381655][ T25] imon 8-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 193.384749][ T25] imon:send_packet: packet tx failed (-71) [ 193.402314][ T25] imon 8-1:0.0: remote input dev register failed [ 193.402405][ T25] imon 8-1:0.0: imon_init_intf0: rc device setup failed [ 193.451616][ T25] imon 8-1:0.0: unable to initialize intf0, err 0 [ 193.451636][ T25] imon:imon_probe: failed to initialize context! [ 193.451647][ T25] imon 8-1:0.0: unable to register, err -19 [ 193.459325][ T25] usb 8-1: USB disconnect, device number 7 [ 193.472806][T12262] tmpfs: Bad value for 'mpol' [ 193.555713][ T43] audit: type=1400 audit(1791071217.297:829): avc: denied { getopt } for pid=12265 comm="syz.1.2357" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 193.760768][ T25] usb 8-1: new full-speed USB device number 8 using dummy_hcd [ 193.781006][ T5743] Bluetooth: hci3: command tx timeout [ 193.913289][ T25] usb 8-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 193.916184][ T25] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 193.916207][ T25] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 198, setting to 64 [ 193.916225][ T25] usb 8-1: config 0 interface 0 has no altsetting 0 [ 193.918017][ T25] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.918035][ T25] usb 8-1: Product: syz [ 193.918045][ T25] usb 8-1: Manufacturer: syz [ 193.918055][ T25] usb 8-1: SerialNumber: syz [ 193.919861][ T25] usb 8-1: config 0 descriptor?? [ 193.920520][T12259] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 193.927684][T12279] syzkaller0: entered promiscuous mode [ 193.927701][T12279] syzkaller0: entered allmulticast mode [ 193.932173][T12279] FAULT_INJECTION: forcing a failure. [ 193.932173][T12279] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 193.932238][T12279] CPU: 2 UID: 0 PID: 12279 Comm: syz.1.2362 Tainted: G L syzkaller #0 PREEMPT(full) [ 193.932254][T12279] Tainted: [L]=SOFTLOCKUP [ 193.932258][T12279] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 193.932264][T12279] Call Trace: [ 193.932268][T12279] [ 193.932272][T12279] dump_stack_lvl+0x100/0x190 [ 193.932294][T12279] should_fail_ex.cold+0x5/0xa [ 193.932310][T12279] _copy_from_iter+0x1f4/0x1690 [ 193.932328][T12279] ? __pfx__copy_from_iter+0x10/0x10 [ 193.932342][T12279] ? find_held_lock+0x2b/0x80 [ 193.932372][T12279] ? dev_get_by_index+0x180/0x380 [ 193.932388][T12279] ? dev_get_by_index+0x180/0x380 [ 193.932407][T12279] packet_sendmsg+0x1b2c/0x4f90 [ 193.932425][T12279] ? __pfx_avc_has_perm+0x10/0x10 [ 193.932448][T12279] ? sock_has_perm+0x25a/0x2f0 [ 193.932460][T12279] ? __pfx_sock_has_perm+0x10/0x10 [ 193.932475][T12279] ? __pfx_packet_sendmsg+0x10/0x10 [ 193.932495][T12279] ? selinux_socket_sendmsg+0x198/0x2f0 [ 193.932510][T12279] ____sys_sendmsg+0xa4d/0xbe0 [ 193.932522][T12279] ? __pfx_packet_sendmsg+0x10/0x10 [ 193.932539][T12279] ? __pfx_____sys_sendmsg+0x10/0x10 [ 193.932553][T12279] ? lock_acquire+0x1d1/0x380 [ 193.932565][T12279] ? get_pid_task+0x2a/0x250 [ 193.932583][T12279] ___sys_sendmsg+0x190/0x1e0 [ 193.932596][T12279] ? __pfx____sys_sendmsg+0x10/0x10 [ 193.932608][T12279] ? get_pid_task+0x106/0x250 [ 193.932629][T12279] ? find_held_lock+0x2b/0x80 [ 193.932653][T12279] __sys_sendmsg+0x160/0x210 [ 193.932669][T12279] ? __pfx___sys_sendmsg+0x10/0x10 [ 193.932693][T12279] do_syscall_64+0x123/0x790 [ 193.932707][T12279] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.932718][T12279] RIP: 0033:0x7feb66b9e159 [ 193.932727][T12279] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 193.932738][T12279] RSP: 002b:00007feb67a48028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 193.932750][T12279] RAX: ffffffffffffffda RBX: 00007feb66e25fa0 RCX: 00007feb66b9e159 [ 193.932757][T12279] RDX: 0000000000004005 RSI: 0000200000000280 RDI: 0000000000000006 [ 193.932763][T12279] RBP: 00007feb67a48090 R08: 0000000000000000 R09: 0000000000000000 [ 193.932770][T12279] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 193.932776][T12279] R13: 00007feb66e26038 R14: 00007feb66e25fa0 R15: 00007ffdcd5decb8 [ 193.932793][T12279] [ 194.127283][ C2] imon 8-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 194.136291][T12286] FAULT_INJECTION: forcing a failure. [ 194.136291][T12286] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 194.136312][T12286] CPU: 3 UID: 0 PID: 12286 Comm: syz.0.2364 Tainted: G L syzkaller #0 PREEMPT(full) [ 194.136327][T12286] Tainted: [L]=SOFTLOCKUP [ 194.136331][T12286] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 194.136338][T12286] Call Trace: [ 194.136342][T12286] [ 194.136346][T12286] dump_stack_lvl+0x100/0x190 [ 194.136366][T12286] should_fail_ex.cold+0x5/0xa [ 194.136382][T12286] _copy_from_user+0x2e/0xd0 [ 194.136397][T12286] msr_io+0x93/0x860 [ 194.136409][T12286] ? is_bpf_text_address+0x8a/0x1a0 [ 194.136424][T12286] ? __pfx_do_set_msr+0x10/0x10 [ 194.136437][T12286] ? lock_acquire+0x1d1/0x380 [ 194.136451][T12286] ? __pfx_msr_io+0x10/0x10 [ 194.136464][T12286] ? __kernel_text_address+0xd/0x30 [ 194.136474][T12286] ? unwind_get_return_address+0x59/0xa0 [ 194.136492][T12286] kvm_set_msrs+0x91/0x100 [ 194.136506][T12286] ? kvm_set_msrs+0x77/0x100 [ 194.136521][T12286] kvm_arch_vcpu_ioctl+0x8c2/0x3a10 [ 194.136539][T12286] ? tomoyo_path_number_perm+0x46d/0x580 [ 194.136552][T12286] ? stack_trace_save+0x8e/0xc0 [ 194.136564][T12286] ? __pfx_stack_trace_save+0x10/0x10 [ 194.136575][T12286] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 194.136591][T12286] ? stack_depot_save_flags+0x27/0x9f0 [ 194.136608][T12286] ? __lock_acquire+0x5c0/0x1f40 [ 194.136621][T12286] ? tomoyo_path_number_perm+0x46d/0x580 [ 194.136634][T12286] ? kasan_save_stack+0x3f/0x50 [ 194.136650][T12286] ? __lock_acquire+0x5c0/0x1f40 [ 194.136668][T12286] ? lock_acquire+0x1d1/0x380 [ 194.136680][T12286] ? kvm_vcpu_ioctl+0x322/0x1700 [ 194.136698][T12286] ? rcu_is_watching+0x13/0xc0 [ 194.136714][T12286] ? trace_contention_end+0x126/0x160 [ 194.136731][T12286] ? __mutex_lock+0x26c/0x1bd0 [ 194.136743][T12286] ? kvm_vcpu_ioctl+0x322/0x1700 [ 194.136761][T12286] ? __pfx___mutex_lock+0x10/0x10 [ 194.136773][T12286] ? kasan_quarantine_put+0x104/0x240 [ 194.136786][T12286] ? lockdep_hardirqs_on+0x7d/0x110 [ 194.136799][T12286] ? tomoyo_path_number_perm+0x28f/0x580 [ 194.136816][T12286] ? tomoyo_path_number_perm+0x188/0x580 [ 194.136831][T12286] ? kvm_vcpu_ioctl+0x8a0/0x1700 [ 194.136846][T12286] kvm_vcpu_ioctl+0x8a0/0x1700 [ 194.136862][T12286] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 194.136879][T12286] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 194.136894][T12286] ? do_vfs_ioctl+0x226/0x13e0 [ 194.136907][T12286] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 194.136918][T12286] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 194.136935][T12286] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 194.136952][T12286] ? __fget_files+0x34/0x3d0 [ 194.136982][T12286] ? selinux_file_ioctl+0x13b/0x290 [ 194.136999][T12286] ? selinux_file_ioctl+0xb6/0x290 [ 194.137020][T12286] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 194.137044][T12286] __x64_sys_ioctl+0x18e/0x210 [ 194.137062][T12286] do_syscall_64+0x123/0x790 [ 194.137076][T12286] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.137087][T12286] RIP: 0033:0x7f695f79e159 [ 194.137097][T12286] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 194.137108][T12286] RSP: 002b:00007f696070b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 194.137119][T12286] RAX: ffffffffffffffda RBX: 00007f695fa25fa0 RCX: 00007f695f79e159 [ 194.137126][T12286] RDX: 0000200000000300 RSI: 000000004008ae89 RDI: 0000000000000005 [ 194.137133][T12286] RBP: 00007f696070b090 R08: 0000000000000000 R09: 0000000000000000 [ 194.137139][T12286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 194.137146][T12286] R13: 00007f695fa26038 R14: 00007f695fa25fa0 R15: 00007fff4fd56a88 [ 194.137160][T12286] [ 194.145788][ T25] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/input/input7 [ 194.167982][ T25] imon:send_packet: packet tx failed (-71) [ 194.180821][ T25] imon 8-1:0.0: panel buttons/knobs setup failed [ 194.192045][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.192091][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.232905][ T25] rc_core: IR keymap rc-imon-pad not found [ 194.232920][ T25] Registered IR keymap rc-empty [ 194.232971][ T25] imon 8-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 194.232984][ T25] imon 8-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 194.233247][ T25] imon:send_packet: packet tx failed (-71) [ 194.250831][ T25] imon 8-1:0.0: remote input dev register failed [ 194.250949][ T25] imon 8-1:0.0: imon_init_intf0: rc device setup failed [ 194.262906][ T25] imon 8-1:0.0: unable to initialize intf0, err 0 [ 194.262919][ T25] imon:imon_probe: failed to initialize context! [ 194.262926][ T25] imon 8-1:0.0: unable to register, err -19 [ 194.266723][ T25] usb 8-1: USB disconnect, device number 8 [ 194.380939][T12291] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2366'. [ 194.454858][T12297] FAULT_INJECTION: forcing a failure. [ 194.454858][T12297] name failslab, interval 1, probability 0, space 0, times 0 [ 194.454882][T12297] CPU: 2 UID: 0 PID: 12297 Comm: syz.0.2367 Tainted: G L syzkaller #0 PREEMPT(full) [ 194.454899][T12297] Tainted: [L]=SOFTLOCKUP [ 194.454903][T12297] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 194.454911][T12297] Call Trace: [ 194.454936][T12297] [ 194.454941][T12297] dump_stack_lvl+0x100/0x190 [ 194.454970][T12297] should_fail_ex.cold+0x5/0xa [ 194.454987][T12297] should_failslab+0xc2/0x120 [ 194.455008][T12297] __kmalloc_cache_noprof+0x91/0x6d0 [ 194.455020][T12297] ? rcu_is_watching+0x13/0xc0 [ 194.455037][T12297] ? vhost_task_create+0xee/0x370 [ 194.455050][T12297] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 194.455067][T12297] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 194.455087][T12297] vhost_task_create+0xee/0x370 [ 194.455098][T12297] ? __pfx_vhost_task_create+0x10/0x10 [ 194.455114][T12297] ? __pfx_vhost_task_fn+0x10/0x10 [ 194.455126][T12297] ? register_lock_class+0x3f/0x7b0 [ 194.455141][T12297] ? rcu_is_watching+0x13/0xc0 [ 194.455158][T12297] ? trace_contention_end+0x126/0x160 [ 194.455176][T12297] kvm_mmu_post_init_vm+0x1b3/0x360 [ 194.455192][T12297] kvm_arch_vcpu_ioctl_run+0xb5/0x1dd0 [ 194.455210][T12297] ? __pfx___mutex_lock+0x10/0x10 [ 194.455227][T12297] ? kasan_quarantine_put+0x104/0x240 [ 194.455244][T12297] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 194.455258][T12297] ? lock_acquire+0x1d1/0x380 [ 194.455272][T12297] ? do_raw_write_lock+0x11e/0x260 [ 194.455288][T12297] ? find_held_lock+0x2b/0x80 [ 194.455306][T12297] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 194.455322][T12297] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 194.455341][T12297] kvm_vcpu_ioctl+0x730/0x1700 [ 194.455360][T12297] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 194.455377][T12297] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 194.455393][T12297] ? do_vfs_ioctl+0x226/0x13e0 [ 194.455408][T12297] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 194.455421][T12297] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 194.455439][T12297] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 194.455457][T12297] ? __fget_files+0x34/0x3d0 [ 194.455480][T12297] ? selinux_file_ioctl+0x13b/0x290 [ 194.455495][T12297] ? selinux_file_ioctl+0xb6/0x290 [ 194.455511][T12297] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 194.455528][T12297] __x64_sys_ioctl+0x18e/0x210 [ 194.455565][T12297] do_syscall_64+0x123/0x790 [ 194.455581][T12297] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.455593][T12297] RIP: 0033:0x7f695f79e159 [ 194.455604][T12297] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 194.455616][T12297] RSP: 002b:00007f696070b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 194.455633][T12297] RAX: ffffffffffffffda RBX: 00007f695fa25fa0 RCX: 00007f695f79e159 [ 194.455640][T12297] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000a [ 194.455647][T12297] RBP: 00007f696070b090 R08: 0000000000000000 R09: 0000000000000000 [ 194.455654][T12297] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 194.455660][T12297] R13: 00007f695fa26038 R14: 00007f695fa25fa0 R15: 00007fff4fd56a88 [ 194.455675][T12297] [ 194.734967][T12300] netlink: 'syz.0.2368': attribute type 178 has an invalid length. [ 194.734981][T12301] netlink: 'syz.0.2368': attribute type 178 has an invalid length. [ 195.044646][T12307] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.2371'. [ 195.044674][T12307] veth0_to_bond: default FDB implementation only supports local addresses [ 195.073601][T12307] binder: 12306:12307 ioctl 89f3 200000000d00 returned -22 [ 195.074841][T12307] binder: 12306:12307 ioctl 89f1 200000000e40 returned -22 [ 195.075368][T12307] binder: 12306:12307 ioctl c0306201 200000000040 returned -14 [ 195.218373][T12313] syzkaller0: left promiscuous mode [ 195.218397][T12313] syzkaller0: left allmulticast mode [ 195.220135][T12313] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2375'. [ 195.447068][ T43] audit: type=1400 audit(1791071219.187:830): avc: denied { ioctl } for pid=12326 comm="syz.3.2379" path="socket:[39509]" dev="sockfs" ino=39509 ioctlcmd=0x89f2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 195.553235][T12334] syzkaller0: entered promiscuous mode [ 195.553260][T12334] syzkaller0: entered allmulticast mode [ 195.594111][T12338] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2384'. [ 195.676844][ T43] audit: type=1400 audit(1791071219.417:831): avc: denied { getattr } for pid=12343 comm="syz.1.2388" name="/" dev="9p" ino=71827827 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 195.677749][T12344] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 195.860681][ T5743] Bluetooth: hci3: command tx timeout [ 196.360383][T12374] syzkaller0: left promiscuous mode [ 196.360398][T12374] syzkaller0: left allmulticast mode [ 196.364201][T12374] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2398'. [ 196.397952][T12376] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2399'. [ 196.437017][T12381] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2400'. [ 196.439795][T12381] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 196.440761][T12381] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 196.562691][ T43] audit: type=1326 audit(1791071220.307:832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12385 comm="syz.0.2402" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f695f79e159 code=0x0 [ 196.691331][ T5734] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 196.692137][ T5734] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 196.692877][ T5734] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 196.693584][ T5734] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 196.694162][ T5734] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 196.877211][ T5729] tipc: Disabling bearer [ 197.033411][T12407] faux_driver vgem: [drm] Unknown color mode 7; guessing buffer size. [ 197.115982][T12393] bridge0: port 1(bridge_slave_0) entered blocking state [ 197.116108][T12393] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.116200][T12393] bridge_slave_0: entered allmulticast mode [ 197.117049][T12393] bridge_slave_0: entered promiscuous mode [ 197.121906][T12393] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.121970][T12393] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.122052][T12393] bridge_slave_1: entered allmulticast mode [ 197.123194][T12393] bridge_slave_1: entered promiscuous mode [ 197.138939][T12393] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 197.141662][T12393] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 197.157858][T12393] team0: Port device team_slave_0 added [ 197.159431][T12393] team0: Port device team_slave_1 added [ 197.169037][T12420] FAULT_INJECTION: forcing a failure. [ 197.169037][T12420] name failslab, interval 1, probability 0, space 0, times 0 [ 197.169067][T12420] CPU: 2 UID: 0 PID: 12420 Comm: syz.1.2409 Tainted: G L syzkaller #0 PREEMPT(full) [ 197.169092][T12420] Tainted: [L]=SOFTLOCKUP [ 197.169098][T12420] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 197.169109][T12420] Call Trace: [ 197.169115][T12420] [ 197.169123][T12420] dump_stack_lvl+0x100/0x190 [ 197.169154][T12420] should_fail_ex.cold+0x5/0xa [ 197.169181][T12420] should_failslab+0xc2/0x120 [ 197.169207][T12420] __kmalloc_noprof+0xfc/0x840 [ 197.169251][T12420] ? __pfx_dynamic_dname+0x10/0x10 [ 197.169274][T12420] ? tomoyo_encode2+0xfb/0x3c0 [ 197.169304][T12420] tomoyo_encode2+0xfb/0x3c0 [ 197.169334][T12420] tomoyo_encode+0x29/0x50 [ 197.169357][T12420] tomoyo_realpath_from_path+0x18c/0x690 [ 197.169389][T12420] tomoyo_path_number_perm+0x23c/0x580 [ 197.169410][T12420] ? tomoyo_path_number_perm+0x22e/0x580 [ 197.169434][T12420] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 197.169467][T12420] ? __lock_acquire+0x5c0/0x1f40 [ 197.169502][T12420] ? __fget_files+0x34/0x3d0 [ 197.169528][T12420] ? find_held_lock+0x2b/0x80 [ 197.169554][T12420] ? hook_file_ioctl_common+0x140/0x440 [ 197.169589][T12420] ? __fget_files+0x21f/0x3d0 [ 197.169617][T12420] security_file_ioctl+0xd3/0x230 [ 197.169642][T12420] __x64_sys_ioctl+0xb7/0x210 [ 197.169666][T12420] do_syscall_64+0x123/0x790 [ 197.169690][T12420] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.169709][T12420] RIP: 0033:0x7feb66b9e159 [ 197.169724][T12420] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 197.169741][T12420] RSP: 002b:00007feb67a48028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 197.169760][T12420] RAX: ffffffffffffffda RBX: 00007feb66e25fa0 RCX: 00007feb66b9e159 [ 197.169772][T12420] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 197.169784][T12420] RBP: 00007feb67a48090 R08: 0000000000000000 R09: 0000000000000000 [ 197.169795][T12420] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 197.169807][T12420] R13: 00007feb66e26038 R14: 00007feb66e25fa0 R15: 00007ffdcd5decb8 [ 197.169833][T12420] [ 197.169881][T12420] ERROR: Out of memory at tomoyo_realpath_from_path. [ 197.173487][T12393] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 197.173497][T12393] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 197.173511][T12393] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 197.175141][T12393] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 197.175149][T12393] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 197.175162][T12393] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 197.199017][T12393] hsr_slave_0: entered promiscuous mode [ 197.199435][T12393] hsr_slave_1: entered promiscuous mode [ 197.199800][T12393] debugfs: 'hsr0' already exists in 'hsr' [ 197.199811][T12393] Cannot create hsr debugfs directory [ 197.344366][ T43] audit: type=1400 audit(1791071221.087:833): avc: denied { getopt } for pid=12424 comm="syz.1.2411" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 197.454627][T12431] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2412'. [ 197.571212][T12437] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2415'. [ 197.576272][ T43] audit: type=1400 audit(1791071221.317:834): avc: denied { setattr } for pid=12435 comm="syz.1.2415" name="video4" dev="devtmpfs" ino=958 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 197.655466][T12393] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 197.657455][T12393] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 197.657948][T12393] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 197.668022][T12393] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 197.668501][T12393] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 197.671007][T12393] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 197.671654][T12393] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 197.675015][T12393] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 197.706898][T12393] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.706982][T12393] bridge0: port 2(bridge_slave_1) entered forwarding state [ 197.707163][T12393] bridge0: port 1(bridge_slave_0) entered blocking state [ 197.707244][T12393] bridge0: port 1(bridge_slave_0) entered forwarding state [ 197.744521][T12393] 8021q: adding VLAN 0 to HW filter on device bond0 [ 197.746081][T12451] tipc: Enabling of bearer rejected, already enabled [ 197.753845][ T106] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.757143][ T106] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.767201][T12393] 8021q: adding VLAN 0 to HW filter on device team0 [ 197.775778][ T106] bridge0: port 1(bridge_slave_0) entered blocking state [ 197.775916][ T106] bridge0: port 1(bridge_slave_0) entered forwarding state [ 197.791349][ T106] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.791398][ T106] bridge0: port 2(bridge_slave_1) entered forwarding state [ 197.821897][T12453] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 197.869647][T12453] netlink: 308 bytes leftover after parsing attributes in process `syz.1.2417'. [ 197.940851][ T5734] Bluetooth: hci3: command tx timeout [ 198.053145][T12393] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 198.080004][T12393] veth0_vlan: entered promiscuous mode [ 198.090102][T12393] veth1_vlan: entered promiscuous mode [ 198.108021][T12393] veth0_macvtap: entered promiscuous mode [ 198.110250][T12393] veth1_macvtap: entered promiscuous mode [ 198.125041][T12393] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 198.132774][T12393] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 198.184511][ T5824] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.184777][ T5824] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.205621][ T106] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 198.205640][ T106] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 198.212431][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.221795][T12479] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 198.221810][T12479] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 198.227390][T12479] vhci_hcd vhci_hcd.0: Device attached [ 198.229103][T12479] i2c i2c-1: DVB: adapter 0 frontend 0 frequency 154 out of range (51000000..2150000000) [ 198.229334][T12480] vhci_hcd: connection closed [ 198.234028][ T12] vhci_hcd vhci_hcd.1: stop threads [ 198.234577][ T12] vhci_hcd vhci_hcd.1: release socket [ 198.234604][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 198.240102][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 198.240120][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 198.280669][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.323906][T12484] FAULT_INJECTION: forcing a failure. [ 198.323906][T12484] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 198.323930][T12484] CPU: 3 UID: 0 PID: 12484 Comm: syz.3.2405 Tainted: G L syzkaller #0 PREEMPT(full) [ 198.323946][T12484] Tainted: [L]=SOFTLOCKUP [ 198.323950][T12484] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 198.323956][T12484] Call Trace: [ 198.323960][T12484] [ 198.323966][T12484] dump_stack_lvl+0x100/0x190 [ 198.323986][T12484] should_fail_ex.cold+0x5/0xa [ 198.323999][T12484] ? prepare_alloc_pages+0x16d/0x5b0 [ 198.324016][T12484] should_fail_alloc_page+0xeb/0x140 [ 198.324033][T12484] prepare_alloc_pages+0x1f0/0x5b0 [ 198.324051][T12484] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 198.324068][T12484] ? eprobe_trigger_func+0x362/0x1450 [ 198.324082][T12484] ? __lock_acquire+0x5c0/0x1f40 [ 198.324095][T12484] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 198.324110][T12484] ? __css_rstat_updated+0x1ce/0x590 [ 198.324127][T12484] ? lock_acquire+0x1d1/0x380 [ 198.324140][T12484] ? do_raw_spin_lock+0x128/0x260 [ 198.324160][T12484] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 198.324175][T12484] ? find_held_lock+0x2b/0x80 [ 198.324195][T12484] ? __lock_acquire+0x5c0/0x1f40 [ 198.324209][T12484] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 198.324224][T12484] ? policy_nodemask+0xed/0x4f0 [ 198.324241][T12484] alloc_pages_mpol+0x201/0x550 [ 198.324258][T12484] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 198.324278][T12484] folio_alloc_mpol_noprof+0x36/0x260 [ 198.324291][T12484] shmem_alloc_folio+0x135/0x160 [ 198.324307][T12484] shmem_alloc_and_add_folio+0x371/0xd40 [ 198.324328][T12484] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 198.324348][T12484] ? shmem_allowable_huge_orders+0x1d7/0x470 [ 198.324370][T12484] shmem_get_folio_gfp+0x75b/0x1980 [ 198.324383][T12484] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 198.324396][T12484] ? filemap_map_pages+0x1155/0x2060 [ 198.324412][T12484] ? ktime_get_coarse_real_ts64_mg+0x249/0x300 [ 198.324430][T12484] shmem_fault+0x1fb/0xa30 [ 198.324442][T12484] ? __pfx_shmem_fault+0x10/0x10 [ 198.324454][T12484] ? __pfx_filemap_map_pages+0x10/0x10 [ 198.324472][T12484] ? find_held_lock+0x2b/0x80 [ 198.324490][T12484] ? __pfx_filemap_map_pages+0x10/0x10 [ 198.324505][T12484] __do_fault+0x10b/0x440 [ 198.324519][T12484] do_fault+0xb3f/0x1830 [ 198.324536][T12484] ? __pfx_do_fault+0x10/0x10 [ 198.324550][T12484] ? rcu_read_unlock+0x2d/0xb0 [ 198.324560][T12484] ? rcu_read_unlock+0x2d/0xb0 [ 198.324571][T12484] ? __pte_offset_map+0x179/0x310 [ 198.324586][T12484] __handle_mm_fault+0x150b/0x2f60 [ 198.324607][T12484] ? __pfx___handle_mm_fault+0x10/0x10 [ 198.324624][T12484] ? pte_offset_map_lock+0x174/0x320 [ 198.324639][T12484] ? find_held_lock+0x2b/0x80 [ 198.324655][T12484] ? find_held_lock+0x2b/0x80 [ 198.324671][T12484] ? follow_page_pte+0x536/0x1050 [ 198.324693][T12484] handle_mm_fault+0x363/0xa20 [ 198.324714][T12484] __get_user_pages+0x8ae/0x2c30 [ 198.324734][T12484] ? __pfx___get_user_pages+0x10/0x10 [ 198.324748][T12484] ? __pfx_down_read_killable+0x10/0x10 [ 198.324764][T12484] ? __pfx_gup_fast_fallback+0x10/0x10 [ 198.324782][T12484] get_user_pages_unlocked+0x1cb/0x7d0 [ 198.324800][T12484] ? __pfx_get_user_pages_unlocked+0x10/0x10 [ 198.324815][T12484] ? get_user_pages_fast_only+0xae/0xf0 [ 198.324830][T12484] ? __pfx_get_user_pages_fast_only+0x10/0x10 [ 198.324846][T12484] ? __pfx___might_resched+0x10/0x10 [ 198.324860][T12484] hva_to_pfn+0x871/0xd60 [ 198.324874][T12484] ? __pfx_hva_to_pfn+0x10/0x10 [ 198.324887][T12484] ? lock_acquire+0x1d1/0x380 [ 198.324900][T12484] ? __pfx_check_buffer+0x10/0x10 [ 198.324916][T12484] kvm_follow_pfn+0x291/0x430 [ 198.324928][T12484] __kvm_faultin_pfn+0x11c/0x1a0 [ 198.324940][T12484] ? __pfx___kvm_faultin_pfn+0x10/0x10 [ 198.324951][T12484] ? __pfx_xa_load+0x10/0x10 [ 198.324971][T12484] kvm_mmu_faultin_pfn+0xb73/0x2280 [ 198.324989][T12484] ? __pfx_fast_page_fault+0x10/0x10 [ 198.325004][T12484] ? __pfx_kvm_mmu_faultin_pfn+0x10/0x10 [ 198.325019][T12484] ? ring_buffer_unlock_commit+0x2e7/0x700 [ 198.325033][T12484] ? __kvm_mmu_topup_memory_cache+0x332/0x5f0 [ 198.325055][T12484] kvm_tdp_page_fault+0x182/0x3d0 [ 198.325075][T12484] kvm_mmu_do_page_fault+0x59b/0x6c0 [ 198.325100][T12484] ? __pfx_kvm_mmu_do_page_fault+0x10/0x10 [ 198.325139][T12484] kvm_mmu_page_fault+0x1dd/0x1ab0 [ 198.325164][T12484] ? event_triggers_call+0x337/0x4d0 [ 198.325188][T12484] ? trace_rcu_utilization+0x14b/0x240 [ 198.325204][T12484] ? rcu_qs+0x6/0xc0 [ 198.325220][T12484] ? __pfx_kvm_mmu_page_fault+0x10/0x10 [ 198.325231][T12484] ? __lock_acquire+0x5c0/0x1f40 [ 198.325244][T12484] ? vmx_vcpu_enter_exit+0x130/0x1e0 [ 198.325257][T12484] ? rcu_is_watching+0x13/0xc0 [ 198.325273][T12484] ? __vmx_complete_interrupts+0x129/0x570 [ 198.325287][T12484] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 198.325305][T12484] handle_ept_violation+0x3a5/0x860 [ 198.325320][T12484] ? __pfx_handle_ept_violation+0x10/0x10 [ 198.325334][T12484] vmx_handle_exit+0x4c8/0x1d30 [ 198.325350][T12484] vcpu_run+0x3725/0x61a0 [ 198.325370][T12484] ? __pfx_vcpu_run+0x10/0x10 [ 198.325385][T12484] ? lock_acquire+0x1d1/0x380 [ 198.325398][T12484] ? kvm_arch_vcpu_ioctl_run+0x2e9/0x1dd0 [ 198.325413][T12484] ? fpu_swap_kvm_fpstate+0x217/0x460 [ 198.325429][T12484] ? __local_bh_enable_ip+0xa5/0x120 [ 198.325444][T12484] ? kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 198.325458][T12484] kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 198.325475][T12484] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 198.325493][T12484] ? tomoyo_path_number_perm+0x188/0x580 [ 198.325509][T12484] kvm_vcpu_ioctl+0x730/0x1700 [ 198.325527][T12484] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 198.325543][T12484] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 198.325557][T12484] ? do_vfs_ioctl+0x226/0x13e0 [ 198.325570][T12484] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 198.325582][T12484] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 198.325598][T12484] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 198.325615][T12484] ? __fget_files+0x34/0x3d0 [ 198.325636][T12484] ? selinux_file_ioctl+0x13b/0x290 [ 198.325650][T12484] ? selinux_file_ioctl+0xb6/0x290 [ 198.325667][T12484] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 198.325683][T12484] __x64_sys_ioctl+0x18e/0x210 [ 198.325697][T12484] do_syscall_64+0x123/0x790 [ 198.325711][T12484] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.325722][T12484] RIP: 0033:0x7ff7ecd9e159 [ 198.325733][T12484] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 198.325743][T12484] RSP: 002b:00007ff7edc45028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 198.325755][T12484] RAX: ffffffffffffffda RBX: 00007ff7ed025fa0 RCX: 00007ff7ecd9e159 [ 198.325762][T12484] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 198.325768][T12484] RBP: 00007ff7edc45090 R08: 0000000000000000 R09: 0000000000000000 [ 198.325774][T12484] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 198.325783][T12484] R13: 00007ff7ed026038 R14: 00007ff7ed025fa0 R15: 00007ffd6d7391d8 [ 198.325804][T12484] [ 198.521459][ T43] audit: type=1400 audit(1791071222.257:835): avc: denied { write } for pid=12486 comm="syz.3.2423" name="/" dev="9p" ino=71827827 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 198.532185][ T43] audit: type=1400 audit(1791071222.267:836): avc: denied { write } for pid=12486 comm="syz.3.2423" name="blkio.throttle.io_service_bytes" dev="9p" ino=71827929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 198.740889][ T5734] Bluetooth: hci1: command tx timeout [ 198.817879][T12503] overlayfs: missing 'lowerdir' [ 198.940675][ T43] audit: type=1326 audit(1791071222.677:837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12504 comm="syz.0.2429" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f695f79e159 code=0x7ffc0000 [ 198.940705][ T43] audit: type=1326 audit(1791071222.677:838): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12504 comm="syz.0.2429" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f695f79e159 code=0x7ffc0000 [ 198.941334][ T43] audit: type=1326 audit(1791071222.687:839): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12504 comm="syz.0.2429" exe="/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f695f79e159 code=0x7ffc0000 [ 198.941359][ T43] audit: type=1326 audit(1791071222.687:840): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12504 comm="syz.0.2429" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f695f79e159 code=0x7ffc0000 [ 198.941379][ T43] audit: type=1326 audit(1791071222.687:841): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12504 comm="syz.0.2429" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f695f79e159 code=0x7ffc0000 [ 198.942063][ T43] audit: type=1326 audit(1791071222.687:842): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12504 comm="syz.0.2429" exe="/syz-executor" sig=0 arch=c000003e syscall=138 compat=0 ip=0x7f695f79e159 code=0x7ffc0000 [ 198.942164][ T43] audit: type=1326 audit(1791071222.687:843): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12504 comm="syz.0.2429" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f695f79e159 code=0x7ffc0000 [ 198.942281][ T43] audit: type=1326 audit(1791071222.687:844): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12504 comm="syz.0.2429" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f695f79e159 code=0x7ffc0000 [ 199.532144][T12512] batadv_slave_0: entered promiscuous mode [ 199.539249][T12511] batadv_slave_0: left promiscuous mode [ 199.607377][T12500] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 199.608085][T12517] FAULT_INJECTION: forcing a failure. [ 199.608085][T12517] name failslab, interval 1, probability 0, space 0, times 0 [ 199.608113][T12517] CPU: 3 UID: 0 PID: 12517 Comm: syz.3.2433 Tainted: G L syzkaller #0 PREEMPT(full) [ 199.608136][T12517] Tainted: [L]=SOFTLOCKUP [ 199.608143][T12517] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 199.608168][T12517] Call Trace: [ 199.608174][T12517] [ 199.608180][T12517] dump_stack_lvl+0x100/0x190 [ 199.608211][T12517] should_fail_ex.cold+0x5/0xa [ 199.608242][T12517] should_failslab+0xc2/0x120 [ 199.608266][T12517] kmem_cache_alloc_noprof+0x92/0x6a0 [ 199.608287][T12517] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 199.608319][T12517] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 199.608351][T12517] mmu_topup_memory_caches+0x25/0x170 [ 199.608373][T12517] kvm_mmu_load+0xe8/0x2580 [ 199.608396][T12517] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 199.608537][T12517] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 199.608566][T12517] ? __pfx_kvm_mmu_load+0x10/0x10 [ 199.608585][T12517] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 199.608603][T12517] ? kvm_check_and_inject_events+0x896/0x1050 [ 199.608627][T12517] vcpu_run+0x419f/0x61a0 [ 199.608646][T12517] ? vmx_vcpu_load_vmcs+0x21d/0x760 [ 199.608679][T12517] ? __pfx_vcpu_run+0x10/0x10 [ 199.608703][T12517] ? lock_acquire+0x1d1/0x380 [ 199.608722][T12517] ? kvm_arch_vcpu_ioctl_run+0x2e9/0x1dd0 [ 199.608746][T12517] ? fpu_swap_kvm_fpstate+0x217/0x460 [ 199.608769][T12517] ? __local_bh_enable_ip+0xa5/0x120 [ 199.608792][T12517] ? kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 199.608813][T12517] kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 199.608840][T12517] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 199.608861][T12517] ? lock_acquire+0x1d1/0x380 [ 199.608880][T12517] ? do_raw_write_lock+0x11e/0x260 [ 199.608903][T12517] ? find_held_lock+0x2b/0x80 [ 199.608926][T12517] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 199.608949][T12517] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 199.608977][T12517] kvm_vcpu_ioctl+0x730/0x1700 [ 199.609003][T12517] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 199.609027][T12517] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 199.609049][T12517] ? do_vfs_ioctl+0x226/0x13e0 [ 199.609083][T12517] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 199.609100][T12517] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 199.609126][T12517] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 199.609152][T12517] ? __fget_files+0x34/0x3d0 [ 199.609185][T12517] ? selinux_file_ioctl+0x13b/0x290 [ 199.609205][T12517] ? selinux_file_ioctl+0xb6/0x290 [ 199.609233][T12517] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 199.609258][T12517] __x64_sys_ioctl+0x18e/0x210 [ 199.609279][T12517] do_syscall_64+0x123/0x790 [ 199.609301][T12517] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.609318][T12517] RIP: 0033:0x7ff7ecd9e159 [ 199.609332][T12517] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 199.609347][T12517] RSP: 002b:00007ff7edc45028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 199.609367][T12517] RAX: ffffffffffffffda RBX: 00007ff7ed025fa0 RCX: 00007ff7ecd9e159 [ 199.609379][T12517] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 199.609390][T12517] RBP: 00007ff7edc45090 R08: 0000000000000000 R09: 0000000000000000 [ 199.609400][T12517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 199.609409][T12517] R13: 00007ff7ed026038 R14: 00007ff7ed025fa0 R15: 00007ffd6d7391d8 [ 199.609433][T12517] [ 199.869244][T12522] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 199.932999][T12524] comedi comedi2: fl512: I/O base address not correctly aligned [ 199.938944][T12524] tmpfs: Unknown parameter 'usrquota' [ 199.971227][T12527] binder: BINDER_SET_CONTEXT_MGR already set [ 199.971238][T12527] binder: 12526:12527 ioctl 4018620d 200000004a80 returned -16 [ 199.971251][T12527] FAULT_INJECTION: forcing a failure. [ 199.971251][T12527] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 199.971267][T12527] CPU: 2 UID: 0 PID: 12527 Comm: syz.0.2437 Tainted: G L syzkaller #0 PREEMPT(full) [ 199.971282][T12527] Tainted: [L]=SOFTLOCKUP [ 199.971286][T12527] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 199.971292][T12527] Call Trace: [ 199.971296][T12527] [ 199.971301][T12527] dump_stack_lvl+0x100/0x190 [ 199.971321][T12527] should_fail_ex.cold+0x5/0xa [ 199.971337][T12527] _copy_to_user+0x32/0xd0 [ 199.971353][T12527] simple_read_from_buffer+0xcb/0x170 [ 199.971370][T12527] proc_fail_nth_read+0x1af/0x230 [ 199.971386][T12527] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 199.971403][T12527] ? rw_verify_area+0xce/0x6d0 [ 199.971414][T12527] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 199.971429][T12527] vfs_read+0x1e4/0xb40 [ 199.971442][T12527] ? lock_acquire+0x1d1/0x380 [ 199.971455][T12527] ? __fget_files+0x34/0x3d0 [ 199.971470][T12527] ? __pfx_vfs_read+0x10/0x10 [ 199.971481][T12527] ? find_held_lock+0x2b/0x80 [ 199.971498][T12527] ? __fget_files+0x215/0x3d0 [ 199.971541][T12527] ? __fget_files+0x21f/0x3d0 [ 199.971562][T12527] ksys_read+0x12a/0x250 [ 199.971574][T12527] ? __pfx_ksys_read+0x10/0x10 [ 199.971591][T12527] do_syscall_64+0x123/0x790 [ 199.971605][T12527] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.971617][T12527] RIP: 0033:0x7f695f75e98e [ 199.971626][T12527] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 199.971637][T12527] RSP: 002b:00007f696070afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 199.971648][T12527] RAX: ffffffffffffffda RBX: 00007f696070b6c0 RCX: 00007f695f75e98e [ 199.971655][T12527] RDX: 000000000000000f RSI: 00007f696070b0a0 RDI: 0000000000000005 [ 199.971662][T12527] RBP: 00007f696070b090 R08: 0000000000000000 R09: 0000000000000000 [ 199.971668][T12527] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 199.971675][T12527] R13: 00007f695fa26038 R14: 00007f695fa25fa0 R15: 00007fff4fd56a88 [ 199.971689][T12527] [ 200.233673][T12547] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2445'. [ 200.347291][T12552] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 200.591256][T12556] netlink: 'syz.3.2449': attribute type 1 has an invalid length. [ 200.642882][T12557] hub 6-0:1.0: USB hub found [ 200.643167][T12557] hub 6-0:1.0: 1 port detected [ 200.820935][ T5734] Bluetooth: hci1: command tx timeout [ 200.967785][T12543] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 201.067391][T12571] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2455'. [ 201.073279][T12571] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 201.077500][T12571] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 201.205219][T12584] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2459'. [ 201.228928][T12586] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2457'. [ 201.478984][T12591] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2461'. [ 201.479024][T12591] netlink: 'syz.1.2461': attribute type 10 has an invalid length. [ 201.479038][T12591] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2461'. [ 201.486964][T12591] geneve2: entered promiscuous mode [ 201.486984][T12591] geneve2: entered allmulticast mode [ 201.652162][T12600] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2464'. [ 201.652913][T12600] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 201.690692][T12603] netlink: 'syz.3.2465': attribute type 4 has an invalid length. [ 201.697967][T12603] ip6erspan0: entered allmulticast mode [ 201.740905][T12605] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 201.741730][T12605] netdevsim netdevsim3 netdevsim3: entered promiscuous mode [ 201.905507][T12616] FAULT_INJECTION: forcing a failure. [ 201.905507][T12616] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 201.905529][T12616] CPU: 3 UID: 0 PID: 12616 Comm: syz.3.2471 Tainted: G L syzkaller #0 PREEMPT(full) [ 201.905545][T12616] Tainted: [L]=SOFTLOCKUP [ 201.905549][T12616] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 201.905555][T12616] Call Trace: [ 201.905559][T12616] [ 201.905564][T12616] dump_stack_lvl+0x100/0x190 [ 201.905585][T12616] should_fail_ex.cold+0x5/0xa [ 201.905601][T12616] _copy_from_user+0x2e/0xd0 [ 201.905616][T12616] fscrypt_ioctl_add_key+0x3f6/0x6e0 [ 201.905630][T12616] ? __pfx_fscrypt_ioctl_add_key+0x10/0x10 [ 201.905646][T12616] ? avc_has_extended_perms+0x33a/0x1080 [ 201.905664][T12616] ? avc_has_extended_perms+0x33a/0x1080 [ 201.905690][T12616] ? kasan_quarantine_put+0x104/0x240 [ 201.905706][T12616] ? find_held_lock+0x2b/0x80 [ 201.905729][T12616] ? tomoyo_path_number_perm+0x28f/0x580 [ 201.905745][T12616] __ext4_ioctl+0x8ae/0x4200 [ 201.905760][T12616] ? __pfx___ext4_ioctl+0x10/0x10 [ 201.905775][T12616] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 201.905790][T12616] ? do_vfs_ioctl+0x226/0x13e0 [ 201.905804][T12616] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 201.905815][T12616] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 201.905832][T12616] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 201.905849][T12616] ? __fget_files+0x34/0x3d0 [ 201.905870][T12616] ? selinux_file_ioctl+0x13b/0x290 [ 201.905883][T12616] ? selinux_file_ioctl+0xb6/0x290 [ 201.905899][T12616] ? __pfx_ext4_ioctl+0x10/0x10 [ 201.905911][T12616] __x64_sys_ioctl+0x18e/0x210 [ 201.905925][T12616] do_syscall_64+0x123/0x790 [ 201.905939][T12616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.905951][T12616] RIP: 0033:0x7ff7ecd9e159 [ 201.905960][T12616] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 201.905971][T12616] RSP: 002b:00007ff7edc45028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 201.905982][T12616] RAX: ffffffffffffffda RBX: 00007ff7ed025fa0 RCX: 00007ff7ecd9e159 [ 201.905989][T12616] RDX: 00002000000003c0 RSI: 00000000c0506617 RDI: 0000000000000003 [ 201.905996][T12616] RBP: 00007ff7edc45090 R08: 0000000000000000 R09: 0000000000000000 [ 201.906002][T12616] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 201.906009][T12616] R13: 00007ff7ed026038 R14: 00007ff7ed025fa0 R15: 00007ffd6d7391d8 [ 201.906022][T12616] [ 202.901017][ T5734] Bluetooth: hci1: command tx timeout [ 203.029350][T12648] __nla_validate_parse: 6 callbacks suppressed [ 203.029368][T12648] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2482'. [ 203.034330][T12648] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 203.043291][T12648] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 203.281027][T12657] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 203.329707][T12662] FAULT_INJECTION: forcing a failure. [ 203.329707][T12662] name failslab, interval 1, probability 0, space 0, times 0 [ 203.329742][T12662] CPU: 3 UID: 0 PID: 12662 Comm: syz.3.2485 Tainted: G L syzkaller #0 PREEMPT(full) [ 203.329769][T12662] Tainted: [L]=SOFTLOCKUP [ 203.329776][T12662] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 203.329787][T12662] Call Trace: [ 203.329795][T12662] [ 203.329803][T12662] dump_stack_lvl+0x100/0x190 [ 203.329837][T12662] should_fail_ex.cold+0x5/0xa [ 203.329866][T12662] should_failslab+0xc2/0x120 [ 203.329895][T12662] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 203.329920][T12662] ? copy_process+0x6a2/0x8380 [ 203.329947][T12662] copy_process+0x6a2/0x8380 [ 203.329980][T12662] ? __pfx_copy_process+0x10/0x10 [ 203.330002][T12662] ? kasan_save_track+0x14/0x30 [ 203.330026][T12662] ? __kasan_kmalloc+0xaa/0xb0 [ 203.330051][T12662] ? lockdep_init_map_type+0x5c/0x250 [ 203.330076][T12662] ? lockdep_init_map_type+0x5c/0x250 [ 203.330098][T12662] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 203.330129][T12662] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 203.330151][T12662] vhost_task_create+0x1db/0x370 [ 203.330171][T12662] ? __pfx_vhost_task_create+0x10/0x10 [ 203.330195][T12662] ? __pfx_vhost_task_fn+0x10/0x10 [ 203.330213][T12662] ? register_lock_class+0x3f/0x7b0 [ 203.330233][T12662] ? rcu_is_watching+0x13/0xc0 [ 203.330259][T12662] ? trace_contention_end+0x126/0x160 [ 203.330292][T12662] kvm_mmu_post_init_vm+0x1b3/0x360 [ 203.330314][T12662] kvm_arch_vcpu_ioctl_run+0xb5/0x1dd0 [ 203.330339][T12662] ? __pfx___mutex_lock+0x10/0x10 [ 203.330361][T12662] ? kasan_quarantine_put+0x104/0x240 [ 203.330388][T12662] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 203.330410][T12662] ? lock_acquire+0x1d1/0x380 [ 203.330432][T12662] ? do_raw_write_lock+0x11e/0x260 [ 203.330455][T12662] ? find_held_lock+0x2b/0x80 [ 203.330478][T12662] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 203.330500][T12662] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 203.330530][T12662] kvm_vcpu_ioctl+0x730/0x1700 [ 203.330576][T12662] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 203.330603][T12662] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 203.330628][T12662] ? do_vfs_ioctl+0x226/0x13e0 [ 203.330651][T12662] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 203.330668][T12662] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 203.330699][T12662] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 203.330728][T12662] ? __fget_files+0x34/0x3d0 [ 203.330765][T12662] ? selinux_file_ioctl+0x13b/0x290 [ 203.330787][T12662] ? selinux_file_ioctl+0xb6/0x290 [ 203.330813][T12662] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 203.330839][T12662] __x64_sys_ioctl+0x18e/0x210 [ 203.330862][T12662] do_syscall_64+0x123/0x790 [ 203.330887][T12662] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 203.330907][T12662] RIP: 0033:0x7ff7ecd9e159 [ 203.330922][T12662] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 203.330938][T12662] RSP: 002b:00007ff7edc45028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 203.330957][T12662] RAX: ffffffffffffffda RBX: 00007ff7ed025fa0 RCX: 00007ff7ecd9e159 [ 203.330968][T12662] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 203.330980][T12662] RBP: 00007ff7edc45090 R08: 0000000000000000 R09: 0000000000000000 [ 203.330992][T12662] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 203.331004][T12662] R13: 00007ff7ed026038 R14: 00007ff7ed025fa0 R15: 00007ffd6d7391d8 [ 203.331049][T12662] [ 203.494436][T12666] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2487'. [ 203.658114][T12674] FAULT_INJECTION: forcing a failure. [ 203.658114][T12674] name failslab, interval 1, probability 0, space 0, times 0 [ 203.658141][T12674] CPU: 3 UID: 0 PID: 12674 Comm: syz.3.2491 Tainted: G L syzkaller #0 PREEMPT(full) [ 203.658160][T12674] Tainted: [L]=SOFTLOCKUP [ 203.658165][T12674] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 203.658174][T12674] Call Trace: [ 203.658179][T12674] [ 203.658184][T12674] dump_stack_lvl+0x100/0x190 [ 203.658210][T12674] should_fail_ex.cold+0x5/0xa [ 203.658231][T12674] should_failslab+0xc2/0x120 [ 203.658250][T12674] __kmalloc_noprof+0xfc/0x840 [ 203.658266][T12674] ? __pfx_dynamic_dname+0x10/0x10 [ 203.658288][T12674] ? tomoyo_encode2+0xfb/0x3c0 [ 203.658311][T12674] tomoyo_encode2+0xfb/0x3c0 [ 203.658333][T12674] tomoyo_encode+0x29/0x50 [ 203.658350][T12674] tomoyo_realpath_from_path+0x18c/0x690 [ 203.658374][T12674] tomoyo_path_number_perm+0x23c/0x580 [ 203.658390][T12674] ? tomoyo_path_number_perm+0x22e/0x580 [ 203.658409][T12674] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 203.658433][T12674] ? __lock_acquire+0x5c0/0x1f40 [ 203.658459][T12674] ? __fget_files+0x34/0x3d0 [ 203.658478][T12674] ? find_held_lock+0x2b/0x80 [ 203.658498][T12674] ? hook_file_ioctl_common+0x140/0x440 [ 203.658523][T12674] ? __fget_files+0x21f/0x3d0 [ 203.658549][T12674] security_file_ioctl+0xd3/0x230 [ 203.658575][T12674] __x64_sys_ioctl+0xb7/0x210 [ 203.658613][T12674] do_syscall_64+0x123/0x790 [ 203.658634][T12674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 203.658653][T12674] RIP: 0033:0x7ff7ecd9e159 [ 203.658669][T12674] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 203.658687][T12674] RSP: 002b:00007ff7edc45028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 203.658707][T12674] RAX: ffffffffffffffda RBX: 00007ff7ed025fa0 RCX: 00007ff7ecd9e159 [ 203.658719][T12674] RDX: 0000000000000000 RSI: 00000000000089e8 RDI: 0000000000000004 [ 203.658730][T12674] RBP: 00007ff7edc45090 R08: 0000000000000000 R09: 0000000000000000 [ 203.658742][T12674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 203.658753][T12674] R13: 00007ff7ed026038 R14: 00007ff7ed025fa0 R15: 00007ffd6d7391d8 [ 203.658779][T12674] [ 203.658842][T12674] ERROR: Out of memory at tomoyo_realpath_from_path. [ 203.725600][T12676] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2492'. [ 204.015865][T12679] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 204.731087][T10362] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 204.782242][T12686] FAULT_INJECTION: forcing a failure. [ 204.782242][T12686] name failslab, interval 1, probability 0, space 0, times 0 [ 204.782264][T12686] CPU: 0 UID: 0 PID: 12686 Comm: syz.3.2496 Tainted: G L syzkaller #0 PREEMPT(full) [ 204.782280][T12686] Tainted: [L]=SOFTLOCKUP [ 204.782284][T12686] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 204.782290][T12686] Call Trace: [ 204.782294][T12686] [ 204.782299][T12686] dump_stack_lvl+0x100/0x190 [ 204.782333][T12686] should_fail_ex.cold+0x5/0xa [ 204.782350][T12686] should_failslab+0xc2/0x120 [ 204.782367][T12686] __kmalloc_cache_noprof+0x91/0x6d0 [ 204.782379][T12686] ? assoc_array_insert+0x262/0x32c0 [ 204.782396][T12686] assoc_array_insert+0x262/0x32c0 [ 204.782411][T12686] ? __key_instantiate_and_link+0x139/0x500 [ 204.782433][T12686] ? __pfx_assoc_array_insert+0x10/0x10 [ 204.782447][T12686] ? __pfx___might_resched+0x10/0x10 [ 204.782458][T12686] ? keyring_free_preparse+0x9/0x10 [ 204.782476][T12686] ? down_write+0x146/0x1f0 [ 204.782493][T12686] __key_link_begin+0xf5/0x260 [ 204.782504][T12686] key_link+0x103/0x390 [ 204.782515][T12686] ? __pfx_key_link+0x10/0x10 [ 204.782529][T12686] ? keyring_alloc+0x8e/0xc0 [ 204.782547][T12686] call_sbin_request_key+0x3dd/0xd90 [ 204.782564][T12686] ? __pfx_call_sbin_request_key+0x10/0x10 [ 204.782578][T12686] ? key_instantiate_and_link+0x39d/0x4b0 [ 204.782594][T12686] ? key_alloc+0xbb4/0x1310 [ 204.782609][T12686] ? __pfx_key_instantiate_and_link+0x10/0x10 [ 204.782634][T12686] ? request_key_auth_new+0x732/0xb50 [ 204.782651][T12686] ? __pfx_request_key_auth_new+0x10/0x10 [ 204.782670][T12686] ? __pfx_call_sbin_request_key+0x10/0x10 [ 204.782685][T12686] request_key_and_link+0x1115/0x1330 [ 204.782702][T12686] ? __pfx_request_key_and_link+0x10/0x10 [ 204.782716][T12686] ? __pfx___might_resched+0x10/0x10 [ 204.782729][T12686] ? __pfx_key_default_cmp+0x10/0x10 [ 204.782746][T12686] ? __pfx_keyring_search_iterator+0x10/0x10 [ 204.782765][T12686] ? _copy_from_user+0x59/0xd0 [ 204.782781][T12686] __do_sys_request_key+0x2a2/0x3c0 [ 204.782793][T12686] ? __pfx___do_sys_request_key+0x10/0x10 [ 204.782804][T12686] ? ksys_write+0x1ac/0x250 [ 204.782822][T12686] do_syscall_64+0x123/0x790 [ 204.782836][T12686] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.782847][T12686] RIP: 0033:0x7ff7ecd9e159 [ 204.782857][T12686] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 204.782868][T12686] RSP: 002b:00007ff7edc45028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 204.782879][T12686] RAX: ffffffffffffffda RBX: 00007ff7ed025fa0 RCX: 00007ff7ecd9e159 [ 204.782886][T12686] RDX: 0000200000000140 RSI: 0000200000000080 RDI: 0000200000000040 [ 204.782893][T12686] RBP: 00007ff7edc45090 R08: 0000000000000000 R09: 0000000000000000 [ 204.782899][T12686] R10: fffffffffffffffe R11: 0000000000000246 R12: 0000000000000002 [ 204.782906][T12686] R13: 00007ff7ed026038 R14: 00007ff7ed025fa0 R15: 00007ffd6d7391d8 [ 204.782921][T12686] [ 204.930680][T10362] usb 5-1: Using ep0 maxpacket: 8 [ 204.931478][T10362] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 204.933046][T10362] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 204.933064][T10362] usb 5-1: config 0 has no interfaces? [ 204.934950][T10362] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.934971][T10362] usb 5-1: Product: syz [ 204.934984][T10362] usb 5-1: Manufacturer: syz [ 204.934996][T10362] usb 5-1: SerialNumber: syz [ 204.938317][T10362] usb 5-1: config 0 descriptor?? [ 204.980737][ T5734] Bluetooth: hci1: command tx timeout [ 205.012959][T12688] syzkaller0: entered promiscuous mode [ 205.012983][T12688] syzkaller0: entered allmulticast mode [ 205.201461][T12693] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 205.353455][T12702] loop5: detected capacity change from 0 to 7 [ 205.396222][T12702] Dev loop5: unable to read RDB block 7 [ 205.396247][T12702] loop5: unable to read partition table [ 205.396342][T12702] loop5: partition table beyond EOD, truncated [ 205.396376][T12702] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 205.456784][T12706] ecryptfs_validate_options: eCryptfs doesn't support cipher: aes [ 205.456814][T12706] Error validating options; rc = [-22] [ 205.511174][T12708] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 205.533330][T12710] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2505'. [ 205.537833][T12710] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 205.540687][T12710] netdevsim netdevsim1 netdevsim3: entered promiscuous mode [ 205.541734][T12710] debugfs: 'hsr1' already exists in 'hsr' [ 205.541808][T12710] Cannot create hsr debugfs directory [ 205.588983][ T1046] usb 5-1: USB disconnect, device number 11 [ 205.632024][T12715] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2507'. [ 205.684096][T12715] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2507'. [ 206.145586][ T43] kauditd_printk_skb: 14 callbacks suppressed [ 206.145605][ T43] audit: type=1400 audit(1791071229.897:859): avc: denied { getopt } for pid=12716 comm="syz.0.2508" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 207.428781][T12731] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 207.683239][T12739] tipc: Started in network mode [ 207.683256][T12739] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 207.683362][T12739] tipc: Enabled bearer , priority 1 [ 207.694494][ T5743] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 207.698567][ T5743] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 207.700863][ T5743] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 207.701757][ T5743] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 207.702339][ T5743] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 208.024396][ T5824] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.170850][T12773] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2519'. [ 208.188495][ T5824] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.197136][T12740] bridge0: port 1(bridge_slave_0) entered blocking state [ 208.197844][T12740] bridge0: port 1(bridge_slave_0) entered disabled state [ 208.197928][T12740] bridge_slave_0: entered allmulticast mode [ 208.198672][T12740] bridge_slave_0: entered promiscuous mode [ 208.200284][T12740] bridge0: port 2(bridge_slave_1) entered blocking state [ 208.200324][T12740] bridge0: port 2(bridge_slave_1) entered disabled state [ 208.200384][T12740] bridge_slave_1: entered allmulticast mode [ 208.202216][T12740] bridge_slave_1: entered promiscuous mode [ 208.208273][T12762] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2519'. [ 208.259181][ T5824] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.275505][T12740] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 208.282519][T12740] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 208.327062][T12740] team0: Port device team_slave_0 added [ 208.329570][T12740] team0: Port device team_slave_1 added [ 208.359326][T12782] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2523'. [ 208.422239][ T5824] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.493711][T12740] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 208.493724][T12740] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 208.493738][T12740] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 208.494735][T12740] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 208.494743][T12740] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 208.494755][T12740] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 208.549786][T12740] hsr_slave_0: entered promiscuous mode [ 208.550329][T12740] hsr_slave_1: entered promiscuous mode [ 208.550953][T12740] debugfs: 'hsr0' already exists in 'hsr' [ 208.550969][T12740] Cannot create hsr debugfs directory [ 208.706378][T12786] overlayfs: missing 'lowerdir' [ 208.706727][T12784] overlayfs: missing 'lowerdir' [ 208.713201][ T43] audit: type=1400 audit(1791071232.457:860): avc: denied { listen } for pid=12783 comm="syz.0.2524" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 208.727604][ T43] audit: type=1400 audit(1791071232.467:861): avc: denied { shutdown } for pid=12783 comm="syz.0.2524" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 208.728233][T12784] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 208.732754][T12784] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.741533][ T5824] bridge_slave_1: left allmulticast mode [ 208.741549][ T5824] bridge_slave_1: left promiscuous mode [ 208.741661][ T5824] bridge0: port 2(bridge_slave_1) entered disabled state [ 208.757558][ T5824] bridge_slave_0: left allmulticast mode [ 208.757575][ T5824] bridge_slave_0: left promiscuous mode [ 208.761350][ T5824] bridge0: port 1(bridge_slave_0) entered disabled state [ 208.780770][ T1348] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 208.831492][T12795] FAULT_INJECTION: forcing a failure. [ 208.831492][T12795] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 208.831524][T12795] CPU: 3 UID: 0 PID: 12795 Comm: syz.1.2526 Tainted: G L syzkaller #0 PREEMPT(full) [ 208.831557][T12795] Tainted: [L]=SOFTLOCKUP [ 208.831563][T12795] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 208.831571][T12795] Call Trace: [ 208.831577][T12795] [ 208.831583][T12795] dump_stack_lvl+0x100/0x190 [ 208.831610][T12795] should_fail_ex.cold+0x5/0xa [ 208.831635][T12795] _copy_from_user+0x2e/0xd0 [ 208.831655][T12795] comedi_unlocked_ioctl+0xf3f/0x3310 [ 208.831688][T12795] ? tomoyo_path_number_perm+0x188/0x580 [ 208.831709][T12795] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 208.831740][T12795] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 208.831760][T12795] ? do_vfs_ioctl+0x226/0x13e0 [ 208.831777][T12795] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 208.831791][T12795] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 208.831813][T12795] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 208.831835][T12795] ? __fget_files+0x34/0x3d0 [ 208.831862][T12795] ? selinux_file_ioctl+0x13b/0x290 [ 208.831879][T12795] ? selinux_file_ioctl+0xb6/0x290 [ 208.831899][T12795] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 208.831921][T12795] __x64_sys_ioctl+0x18e/0x210 [ 208.831939][T12795] do_syscall_64+0x123/0x790 [ 208.831960][T12795] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 208.831978][T12795] RIP: 0033:0x7feb66b9e159 [ 208.831993][T12795] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 208.832009][T12795] RSP: 002b:00007feb67a48028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 208.832028][T12795] RAX: ffffffffffffffda RBX: 00007feb66e25fa0 RCX: 00007feb66b9e159 [ 208.832039][T12795] RDX: 0000200000000380 RSI: 000000008028640c RDI: 0000000000000004 [ 208.832048][T12795] RBP: 00007feb67a48090 R08: 0000000000000000 R09: 0000000000000000 [ 208.832055][T12795] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 208.832062][T12795] R13: 00007feb66e26038 R14: 00007feb66e25fa0 R15: 00007ffdcd5decb8 [ 208.832077][T12795] [ 208.927889][ T5824] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 208.943232][ T5824] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 208.945448][ T5824] bond0 (unregistering): Released all slaves [ 208.959301][ T5806] tipc: Node number set to 43690 [ 209.119283][T12800] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 209.137044][T12800] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 209.211338][ T43] audit: type=1400 audit(1791071232.957:862): avc: denied { write } for pid=12802 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 209.214806][T12804] FAULT_INJECTION: forcing a failure. [ 209.214806][T12804] name failslab, interval 1, probability 0, space 0, times 0 [ 209.214847][T12804] CPU: 2 UID: 0 PID: 12804 Comm: syz.1.2529 Tainted: G L syzkaller #0 PREEMPT(full) [ 209.214881][T12804] Tainted: [L]=SOFTLOCKUP [ 209.214890][T12804] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 209.214902][T12804] Call Trace: [ 209.214911][T12804] [ 209.214921][T12804] dump_stack_lvl+0x100/0x190 [ 209.214961][T12804] should_fail_ex.cold+0x5/0xa [ 209.214997][T12804] should_failslab+0xc2/0x120 [ 209.215030][T12804] kmem_cache_alloc_noprof+0x92/0x6a0 [ 209.215061][T12804] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 209.215112][T12804] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 209.215157][T12804] mmu_topup_memory_caches+0x25/0x170 [ 209.215189][T12804] kvm_mmu_load+0xe8/0x2580 [ 209.215218][T12804] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 209.215253][T12804] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 209.215297][T12804] ? __pfx_kvm_mmu_load+0x10/0x10 [ 209.215324][T12804] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 209.215348][T12804] ? kvm_check_and_inject_events+0x896/0x1050 [ 209.215382][T12804] vcpu_run+0x419f/0x61a0 [ 209.215409][T12804] ? wakeup_preempt_fair+0x5c3/0xdc0 [ 209.215441][T12804] ? vmx_vcpu_load_vmcs+0x21d/0x760 [ 209.215518][T12804] ? __pfx_vcpu_run+0x10/0x10 [ 209.215553][T12804] ? lock_acquire+0x1d1/0x380 [ 209.215578][T12804] ? kvm_arch_vcpu_ioctl_run+0x2e9/0x1dd0 [ 209.215607][T12804] ? fpu_swap_kvm_fpstate+0x217/0x460 [ 209.215640][T12804] ? __local_bh_enable_ip+0xa5/0x120 [ 209.215671][T12804] ? kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 209.215701][T12804] kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 209.215739][T12804] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 209.215768][T12804] ? lock_acquire+0x1d1/0x380 [ 209.215796][T12804] ? do_raw_write_lock+0x11e/0x260 [ 209.215826][T12804] ? find_held_lock+0x2b/0x80 [ 209.215859][T12804] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 209.215911][T12804] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 209.215950][T12804] kvm_vcpu_ioctl+0x730/0x1700 [ 209.215988][T12804] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 209.216022][T12804] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 209.216056][T12804] ? do_vfs_ioctl+0x226/0x13e0 [ 209.216086][T12804] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 209.216105][T12804] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 209.216133][T12804] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 209.216161][T12804] ? __fget_files+0x34/0x3d0 [ 209.216196][T12804] ? selinux_file_ioctl+0x13b/0x290 [ 209.216219][T12804] ? selinux_file_ioctl+0xb6/0x290 [ 209.216244][T12804] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 209.216271][T12804] __x64_sys_ioctl+0x18e/0x210 [ 209.216294][T12804] do_syscall_64+0x123/0x790 [ 209.216319][T12804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.216338][T12804] RIP: 0033:0x7feb66b9e159 [ 209.216357][T12804] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 209.216375][T12804] RSP: 002b:00007feb67a48028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 209.216394][T12804] RAX: ffffffffffffffda RBX: 00007feb66e25fa0 RCX: 00007feb66b9e159 [ 209.216406][T12804] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 209.216418][T12804] RBP: 00007feb67a48090 R08: 0000000000000000 R09: 0000000000000000 [ 209.216429][T12804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 209.216439][T12804] R13: 00007feb66e26038 R14: 00007feb66e25fa0 R15: 00007ffdcd5decb8 [ 209.216465][T12804] [ 209.310846][T12740] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 209.320411][T12740] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 209.321859][T12740] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 209.322575][ T43] audit: type=1400 audit(1791071233.067:863): avc: denied { write } for pid=12810 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 209.333439][T12740] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 209.338930][T12740] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 209.348426][T12740] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 209.349195][T12740] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 209.353454][T12740] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 209.421391][ T5824] hsr_slave_0: left promiscuous mode [ 209.422042][ T5824] hsr_slave_1: left promiscuous mode [ 209.422423][ T5824] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 209.422434][ T5824] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 209.424168][ T5824] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 209.424185][ T5824] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 209.433749][ T43] audit: type=1400 audit(1791071233.177:864): avc: denied { read } for pid=12820 comm="syz.1.2532" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 209.438101][ T5824] veth1_macvtap: left promiscuous mode [ 209.438218][ T5824] veth0_macvtap: left promiscuous mode [ 209.438297][ T5824] veth1_vlan: left promiscuous mode [ 209.438350][ T5824] veth0_vlan: left promiscuous mode [ 209.672291][ T5824] team0 (unregistering): Port device team_slave_1 removed [ 209.678892][ T5824] team0 (unregistering): Port device team_slave_0 removed [ 209.759790][ T5441] 8021q: adding VLAN 0 to HW filter on device eth2 [ 209.780766][ T5734] Bluetooth: hci2: command tx timeout [ 209.886960][T12740] 8021q: adding VLAN 0 to HW filter on device bond0 [ 209.901450][T12740] 8021q: adding VLAN 0 to HW filter on device team0 [ 209.906246][ T1170] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.906294][ T1170] bridge0: port 1(bridge_slave_0) entered forwarding state [ 209.924683][ T1170] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.924731][ T1170] bridge0: port 2(bridge_slave_1) entered forwarding state [ 209.971181][ T43] audit: type=1400 audit(1791071233.707:865): avc: denied { write } for pid=12836 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 210.067401][ T43] audit: type=1400 audit(1791071233.807:866): avc: denied { write } for pid=12840 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 210.104576][ T25] input: syz0 as /devices/virtual/misc/uhid/0005:057B:0009.0003/input/input9 [ 210.150432][ T5441] 8021q: adding VLAN 0 to HW filter on device eth3 [ 210.210955][T10362] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 210.316430][ T25] hid-generic 0005:057B:0009.0003: input,hidraw1: BLUETOOTH HID v0.03 Gamepad [syz0] on syz1 [ 210.370370][ T43] audit: type=1400 audit(1791071234.107:867): avc: denied { write } for pid=12849 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 210.381603][T10362] usb 8-1: Using ep0 maxpacket: 8 [ 210.382231][T10362] usb 8-1: New USB device found, idVendor=0d8c, idProduct=000c, bcdDevice= 0.40 [ 210.384992][T10362] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.385010][T10362] usb 8-1: Product: syz [ 210.385022][T10362] usb 8-1: Manufacturer: syz [ 210.385033][T10362] usb 8-1: SerialNumber: syz [ 210.447778][ T43] audit: type=1400 audit(1791071234.187:868): avc: denied { write } for pid=12855 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 210.458877][T12740] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 210.526987][ T5441] 8021q: adding VLAN 0 to HW filter on device eth4 [ 210.719993][T12740] veth0_vlan: entered promiscuous mode [ 210.749398][T12740] veth1_vlan: entered promiscuous mode [ 210.761256][T10362] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 210.761308][T10362] usb 8-1: MIDIStreaming interface descriptor not found [ 210.787656][T12881] Bluetooth: MGMT ver 1.23 [ 210.799602][T10362] usb 8-1: USB disconnect, device number 10 [ 210.806192][ T5441] 8021q: adding VLAN 0 to HW filter on device eth5 [ 210.838631][T12740] veth0_macvtap: entered promiscuous mode [ 210.848758][T12740] veth1_macvtap: entered promiscuous mode [ 210.870379][T12740] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 210.873013][T12740] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 210.913346][ T5824] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 210.913391][ T5824] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 210.913423][ T5824] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 210.913444][ T5824] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 210.933143][ T9425] udevd[9425]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 210.987838][ T1165] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 210.987858][ T1165] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 211.023188][ T1163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 211.023209][ T1163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 211.151322][T12901] UDC core: g1: couldn't find an available UDC or it's busy [ 211.194191][T12897] netlink: 'syz.0.2542': attribute type 1 has an invalid length. [ 211.210297][T12897] bond1: option mode: invalid value (8) [ 211.213261][T12897] bond1 (unregistering): Released all slaves [ 211.246171][T12906] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 211.470428][T12919] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2548'. [ 211.649932][ T43] kauditd_printk_skb: 3 callbacks suppressed [ 211.649949][ T43] audit: type=1400 audit(1791071235.387:872): avc: denied { write } for pid=12922 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 211.713761][ T43] audit: type=1400 audit(1791071235.457:873): avc: denied { write } for pid=12928 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 211.728799][T12930] FAULT_INJECTION: forcing a failure. [ 211.728799][T12930] name fail_futex, interval 1, probability 0, space 0, times 0 [ 211.728855][T12930] CPU: 1 UID: 0 PID: 12930 Comm: syz.4.2550 Tainted: G L syzkaller #0 PREEMPT(full) [ 211.728890][T12930] Tainted: [L]=SOFTLOCKUP [ 211.728898][T12930] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 211.728914][T12930] Call Trace: [ 211.728924][T12930] [ 211.728933][T12930] dump_stack_lvl+0x100/0x190 [ 211.728969][T12930] should_fail_ex.cold+0x5/0xa [ 211.729002][T12930] get_futex_key+0x1d0/0x14f0 [ 211.729034][T12930] ? __pfx_get_futex_key+0x10/0x10 [ 211.729065][T12930] ? ___sys_sendmsg+0x127/0x1e0 [ 211.729093][T12930] futex_wake+0xf4/0x5e0 [ 211.729114][T12930] ? futex_wait+0x11e/0x370 [ 211.729136][T12930] ? __pfx_futex_wake+0x10/0x10 [ 211.729162][T12930] ? find_held_lock+0x2b/0x80 [ 211.729197][T12930] do_futex+0x2b2/0x440 [ 211.729227][T12930] ? __pfx_do_futex+0x10/0x10 [ 211.729257][T12930] ? fput+0x7c/0x100 [ 211.729286][T12930] __x64_sys_futex+0x34f/0x4d0 [ 211.729321][T12930] ? __pfx___x64_sys_futex+0x10/0x10 [ 211.729362][T12930] do_syscall_64+0x123/0x790 [ 211.729389][T12930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.729414][T12930] RIP: 0033:0x7f5814f9e159 [ 211.729433][T12930] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 211.729456][T12930] RSP: 002b:00007f5815e8c0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 211.729475][T12930] RAX: ffffffffffffffda RBX: 00007f5815225fa8 RCX: 00007f5814f9e159 [ 211.729490][T12930] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5815225fac [ 211.729504][T12930] RBP: 00007f5815225fa0 R08: 0000000000000001 R09: 0000000000000000 [ 211.729514][T12930] R10: 000000000000007c R11: 0000000000000246 R12: 0000000000000000 [ 211.729524][T12930] R13: 00007f5815226038 R14: 00007ffd990abe50 R15: 00007ffd990abf38 [ 211.729563][T12930] [ 211.779680][T12930] FAULT_INJECTION: forcing a failure. [ 211.779680][T12930] name failslab, interval 1, probability 0, space 0, times 0 [ 211.779711][T12930] CPU: 1 UID: 0 PID: 12930 Comm: syz.4.2550 Tainted: G L syzkaller #0 PREEMPT(full) [ 211.779738][T12930] Tainted: [L]=SOFTLOCKUP [ 211.779745][T12930] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 211.779757][T12930] Call Trace: [ 211.779764][T12930] [ 211.779771][T12930] dump_stack_lvl+0x100/0x190 [ 211.779801][T12930] should_fail_ex.cold+0x5/0xa [ 211.779830][T12930] should_failslab+0xc2/0x120 [ 211.779856][T12930] __kmalloc_cache_noprof+0x91/0x6d0 [ 211.779876][T12930] ? sctp_add_bind_addr+0xae/0x3e0 [ 211.779899][T12930] sctp_add_bind_addr+0xae/0x3e0 [ 211.779922][T12930] sctp_copy_local_addr_list+0x349/0x550 [ 211.779950][T12930] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 211.779974][T12930] ? sctp_auth_asoc_copy_shkeys+0x2a5/0x360 [ 211.779998][T12930] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 211.780026][T12930] sctp_bind_addr_copy+0x331/0x530 [ 211.780052][T12930] sctp_connect_new_asoc+0x1c9/0x770 [ 211.780097][T12930] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 211.780126][T12930] ? sctp_get_af_specific+0x62/0x70 [ 211.780146][T12930] ? sctp_sockaddr_af+0x2a3/0x340 [ 211.780171][T12930] __sctp_connect+0x3e7/0xc70 [ 211.780201][T12930] ? __pfx___sctp_connect+0x10/0x10 [ 211.780227][T12930] ? selinux_sctp_bind_connect+0xe0/0x230 [ 211.780257][T12930] __sctp_setsockopt_connectx+0x100/0x190 [ 211.780285][T12930] sctp_setsockopt+0x46a9/0xb370 [ 211.780314][T12930] ? __pfx_sctp_setsockopt+0x10/0x10 [ 211.780337][T12930] ? __fget_files+0x215/0x3d0 [ 211.780365][T12930] ? selinux_socket_setsockopt+0x6a/0x80 [ 211.780387][T12930] ? sock_common_setsockopt+0x2e/0xf0 [ 211.780405][T12930] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 211.780426][T12930] do_sock_setsockopt+0xf3/0x1d0 [ 211.780447][T12930] __sys_setsockopt+0x195/0x220 [ 211.780477][T12930] __x64_sys_setsockopt+0xbd/0x160 [ 211.780500][T12930] ? do_syscall_64+0xae/0x790 [ 211.780519][T12930] ? lockdep_hardirqs_on+0x7d/0x110 [ 211.780540][T12930] do_syscall_64+0x123/0x790 [ 211.780561][T12930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.780582][T12930] RIP: 0033:0x7f5814f9e159 [ 211.780597][T12930] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 211.780615][T12930] RSP: 002b:00007f5815e8c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 211.780634][T12930] RAX: ffffffffffffffda RBX: 00007f5815225fa0 RCX: 00007f5814f9e159 [ 211.780645][T12930] RDX: 000000000000006e RSI: 0000000000000084 RDI: 0000000000000007 [ 211.780655][T12930] RBP: 00007f581503506b R08: 0000000000000010 R09: 0000000000000000 [ 211.780666][T12930] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000000 [ 211.780682][T12930] R13: 00007f5815226038 R14: 00007f5815225fa0 R15: 00007ffd990abf38 [ 211.780707][T12930] [ 211.787178][T12933] netlink: 'syz.3.2551': attribute type 1 has an invalid length. [ 211.787196][T12933] netlink: 16150 bytes leftover after parsing attributes in process `syz.3.2551'. [ 211.940322][T12942] FAULT_INJECTION: forcing a failure. [ 211.940322][T12942] name failslab, interval 1, probability 0, space 0, times 0 [ 211.940343][T12942] CPU: 0 UID: 0 PID: 12942 Comm: syz.3.2556 Tainted: G L syzkaller #0 PREEMPT(full) [ 211.940358][T12942] Tainted: [L]=SOFTLOCKUP [ 211.940362][T12942] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 211.940368][T12942] Call Trace: [ 211.940372][T12942] [ 211.940376][T12942] dump_stack_lvl+0x100/0x190 [ 211.940396][T12942] should_fail_ex.cold+0x5/0xa [ 211.940412][T12942] should_failslab+0xc2/0x120 [ 211.940428][T12942] __kmalloc_noprof+0xfc/0x840 [ 211.940442][T12942] ? copy_splice_read+0x1a3/0xbb0 [ 211.940460][T12942] copy_splice_read+0x1a3/0xbb0 [ 211.940476][T12942] ? __pfx_iter_file_splice_write+0x10/0x10 [ 211.940495][T12942] ? __pfx_copy_splice_read+0x10/0x10 [ 211.940513][T12942] ? look_up_lock_class+0x55/0x120 [ 211.940524][T12942] ? rcu_is_watching+0x13/0xc0 [ 211.940545][T12942] ? __pfx_copy_splice_read+0x10/0x10 [ 211.940575][T12942] do_splice_read+0x285/0x370 [ 211.940594][T12942] splice_direct_to_actor+0x2a1/0xa30 [ 211.940611][T12942] ? __pfx_direct_splice_actor+0x10/0x10 [ 211.940630][T12942] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 211.940648][T12942] ? lock_acquire+0x1d1/0x380 [ 211.940662][T12942] do_splice_direct+0x174/0x240 [ 211.940679][T12942] ? __pfx_do_splice_direct+0x10/0x10 [ 211.940695][T12942] ? avc_policy_seqno+0x9/0x20 [ 211.940707][T12942] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 211.940723][T12942] ? bpf_lsm_file_permission+0x9/0x10 [ 211.940739][T12942] ? security_file_permission+0x76/0x210 [ 211.940754][T12942] ? rw_verify_area+0xce/0x6d0 [ 211.940767][T12942] do_sendfile+0xadc/0xe20 [ 211.940781][T12942] ? __pfx_do_sendfile+0x10/0x10 [ 211.940792][T12942] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 211.940805][T12942] ? __fget_files+0x21f/0x3d0 [ 211.940824][T12942] __x64_sys_sendfile64+0x1d8/0x220 [ 211.940839][T12942] ? ksys_write+0x1ac/0x250 [ 211.940851][T12942] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 211.940871][T12942] do_syscall_64+0x123/0x790 [ 211.940884][T12942] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.940896][T12942] RIP: 0033:0x7ff7ecd9e159 [ 211.940905][T12942] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 211.940915][T12942] RSP: 002b:00007ff7edc45028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 211.940926][T12942] RAX: ffffffffffffffda RBX: 00007ff7ed025fa0 RCX: 00007ff7ecd9e159 [ 211.940933][T12942] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003 [ 211.940939][T12942] RBP: 00007ff7edc45090 R08: 0000000000000000 R09: 0000000000000000 [ 211.940945][T12942] R10: 0000000000110000 R11: 0000000000000246 R12: 0000000000000002 [ 211.940952][T12942] R13: 00007ff7ed026038 R14: 00007ff7ed025fa0 R15: 00007ffd6d7391d8 [ 211.940966][T12942] [ 211.982994][ T5743] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 211.988109][ T5743] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 211.988942][ T5743] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 211.989930][ T5743] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 211.990109][T12946] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 211.990125][T12946] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 211.992782][ T5743] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 212.096694][T12955] FAULT_INJECTION: forcing a failure. [ 212.096694][T12955] name failslab, interval 1, probability 0, space 0, times 0 [ 212.096718][T12955] CPU: 1 UID: 0 PID: 12955 Comm: syz.3.2560 Tainted: G L syzkaller #0 PREEMPT(full) [ 212.096742][T12955] Tainted: [L]=SOFTLOCKUP [ 212.096748][T12955] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 212.096758][T12955] Call Trace: [ 212.096764][T12955] [ 212.096771][T12955] dump_stack_lvl+0x100/0x190 [ 212.096799][T12955] should_fail_ex.cold+0x5/0xa [ 212.096815][T12955] ? __netlink_lookup+0x652/0x900 [ 212.096839][T12955] should_failslab+0xc2/0x120 [ 212.096864][T12955] kmem_cache_alloc_noprof+0x92/0x6a0 [ 212.096885][T12955] ? skb_clone+0x190/0x400 [ 212.096907][T12955] skb_clone+0x190/0x400 [ 212.096931][T12955] netlink_deliver_tap+0xaed/0xcc0 [ 212.096957][T12955] netlink_unicast+0x62b/0x850 [ 212.096984][T12955] ? __pfx_netlink_unicast+0x10/0x10 [ 212.097002][T12955] ? __pfx_sock_has_perm+0x10/0x10 [ 212.097026][T12955] netlink_sendmsg+0x8b0/0xda0 [ 212.097052][T12955] ? __pfx_netlink_sendmsg+0x10/0x10 [ 212.097076][T12955] ? selinux_socket_sendmsg+0x198/0x2f0 [ 212.097096][T12955] ____sys_sendmsg+0xa4d/0xbe0 [ 212.097112][T12955] ? __pfx_netlink_sendmsg+0x10/0x10 [ 212.097136][T12955] ? __pfx_____sys_sendmsg+0x10/0x10 [ 212.097160][T12955] ? lock_acquire+0x1d1/0x380 [ 212.097180][T12955] ? get_pid_task+0x2a/0x250 [ 212.097206][T12955] ___sys_sendmsg+0x190/0x1e0 [ 212.097227][T12955] ? __pfx____sys_sendmsg+0x10/0x10 [ 212.097246][T12955] ? get_pid_task+0x106/0x250 [ 212.097269][T12955] ? find_held_lock+0x2b/0x80 [ 212.097293][T12955] __sys_sendmsg+0x160/0x210 [ 212.097310][T12955] ? __pfx___sys_sendmsg+0x10/0x10 [ 212.097333][T12955] do_syscall_64+0x123/0x790 [ 212.097347][T12955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.097359][T12955] RIP: 0033:0x7ff7ecd9e159 [ 212.097368][T12955] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 212.097379][T12955] RSP: 002b:00007ff7edc45028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 212.097393][T12955] RAX: ffffffffffffffda RBX: 00007ff7ed025fa0 RCX: 00007ff7ecd9e159 [ 212.097403][T12955] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 212.097414][T12955] RBP: 00007ff7edc45090 R08: 0000000000000000 R09: 0000000000000000 [ 212.097423][T12955] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 212.097433][T12955] R13: 00007ff7ed026038 R14: 00007ff7ed025fa0 R15: 00007ffd6d7391d8 [ 212.097456][T12955] [ 212.259409][ T7786] tipc: Disabling bearer [ 212.267138][ T43] audit: type=1400 audit(1791071236.007:874): avc: denied { setopt } for pid=12958 comm="syz.3.2561" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 212.289593][T12966] xt_hashlimit: size too large, truncated to 1048576 [ 212.471239][ T43] audit: type=1400 audit(1791071236.217:875): avc: denied { setopt } for pid=12980 comm="syz.4.2565" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 212.475839][ T43] audit: type=1400 audit(1791071236.217:876): avc: denied { getopt } for pid=12980 comm="syz.4.2565" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 212.612337][T12944] bridge0: port 1(bridge_slave_0) entered blocking state [ 212.613187][T12944] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.613475][T12944] bridge_slave_0: entered allmulticast mode [ 212.615708][T12944] bridge_slave_0: entered promiscuous mode [ 212.619436][T12944] bridge0: port 2(bridge_slave_1) entered blocking state [ 212.619573][T12944] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.620068][T12944] bridge_slave_1: entered allmulticast mode [ 212.624461][T12944] bridge_slave_1: entered promiscuous mode [ 212.660888][T12944] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 212.663242][T12944] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 212.699247][T12944] team0: Port device team_slave_0 added [ 212.704758][T12944] team0: Port device team_slave_1 added [ 212.729152][T12944] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 212.729174][T12944] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 212.729195][T12944] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 212.731006][T12944] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 212.731020][T12944] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 212.731041][T12944] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 212.784922][T12944] hsr_slave_0: entered promiscuous mode [ 212.786089][T12944] hsr_slave_1: entered promiscuous mode [ 212.786780][T12944] debugfs: 'hsr0' already exists in 'hsr' [ 212.786801][T12944] Cannot create hsr debugfs directory [ 212.807623][T13005] iommufd_mock iommufd_mock0: Adding to iommu group 1 [ 212.829108][T13005] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 212.881099][ T43] audit: type=1400 audit(1791071236.617:877): avc: denied { write } for pid=13004 comm="syz.1.2571" name="instances" dev="tracefs" ino=869 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 212.883164][ T43] audit: type=1400 audit(1791071236.627:878): avc: denied { add_name } for pid=13004 comm="syz.1.2571" name="foo" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 212.884581][ T43] audit: type=1400 audit(1791071236.627:879): avc: denied { create } for pid=13004 comm="syz.1.2571" name="foo" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:tracefs_t tclass=dir permissive=1 [ 212.901771][ T1046] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 212.910932][ T1046] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 212.915229][ T1046] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 212.916353][ T1046] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 212.916370][ ** replaying previous printk message ** [ 212.916370][ T1046] rtc rtc0: __rtc_set_alarm: err=-22 [ 212.931553][T13005] ------------[ cut here ]------------ [ 212.931562][T13005] failed to allocate ring buffer on CPU 2 [ 212.931567][T13005] WARNING: kernel/trace/ring_buffer.c:8109 at trace_rb_cpu_prepare+0x463/0x520, CPU#1: syz.1.2571/13005 [ 212.945568][T13005] Modules linked in: [ 212.948004][T13005] CPU: 1 UID: 0 PID: 13005 Comm: syz.1.2571 Tainted: G L syzkaller #0 PREEMPT(full) [ 212.951769][T13005] Tainted: [L]=SOFTLOCKUP [ 212.953197][T13005] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 212.956336][T13005] RIP: 0010:trace_rb_cpu_prepare+0x465/0x520 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 212.958204][T13005] Code: 48 c1 ea 03 80 3c 02 00 0f 84 bc fc ff ff 48 8b 3c 24 e8 ce f7 6e 00 e9 ae fc ff ff e8 b4 7e fb ff 48 8d 3d 9d 69 38 0f 89 ee <67> 48 0f b9 3a bb f4 ff ff ff e9 d3 fd ff ff 4c 89 ef e8 a4 f7 6e [ 212.964927][ T43] audit: type=1400 audit(1791071236.707:880): avc: denied { write } for pid=5715 comm="syz-executor" path="pipe:[6766]" dev="pipefs" ino=6766 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 212.974457][T13005] RSP: 0018:ffffc90025c1f8d8 EFLAGS: 00010283 [ 212.976810][T13005] RAX: 0000000000020d8a RBX: ffff8880550a78b8 RCX: ffffc90003ca9000 [ 212.981395][T13005] RDX: 0000000000080000 RSI: 0000000000000002 RDI: ffffffff914934c0 [ 212.984071][T13005] RBP: 0000000000000002 R08: ffff88802dbeec10 R09: 0000000000000000 [ 212.986567][T13005] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000002 [ 212.989025][T13005] R13: ffff8880550a7810 R14: 0000000000000162 R15: 0000000000000000 [ 212.992265][T13005] FS: 00007feb67a486c0(0000) GS:ffff8880d5c4e000(0000) knlGS:0000000000000000 [ 212.995806][T13005] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 212.998375][T13005] CR2: 00007feb67a27d58 CR3: 00000000519ce000 CR4: 0000000000352ef0 [ 213.001833][T13005] Call Trace: [ 213.003259][T13005] [ 213.004566][T13005] ? __pfx_trace_rb_cpu_prepare+0x10/0x10 [ 213.006822][T13005] cpuhp_invoke_callback+0x205/0x9a0 [ 213.009445][T13005] ? __pfx_trace_rb_cpu_prepare+0x10/0x10 [ 213.012357][T13005] cpuhp_issue_call+0x1b8/0x970 [ 213.014792][T13005] __cpuhp_state_add_instance_cpuslocked+0x2d7/0x400 [ 213.017387][T13005] __cpuhp_state_add_instance+0xda/0x2e0 [ 213.019322][T13005] alloc_buffer+0x6f8/0x1690 [ 213.021370][T13005] __ring_buffer_alloc+0x2d/0x40 [ 213.023342][T13005] allocate_trace_buffer+0x150/0xa30 [ 213.025520][T13005] ? __kmalloc_node_track_caller_noprof+0x35b/0x870 [ 213.028035][T13005] ? __pfx_allocate_trace_buffer+0x10/0x10 [ 213.030865][T13005] ? lockdep_init_map_type+0x5c/0x250 [ 213.032776][T13005] trace_array_create_systems+0x582/0xc30 [ 213.035155][T13005] instance_mkdir+0xca/0x140 [ 213.036798][T13005] tracefs_syscall_mkdir+0x10e/0x180 [ 213.038560][T13005] ? __pfx_tracefs_syscall_mkdir+0x10/0x10 [ 213.040505][T13005] vfs_mkdir+0x364/0x850 [ 213.042794][T13005] filename_mkdirat+0x48b/0x5e0 [ 213.044387][T13005] ? __pfx_filename_mkdirat+0x10/0x10 [ 213.046501][T13005] ? strncpy_from_user+0x19d/0x2d0 [ 213.048315][T13005] ? do_getname+0x191/0x390 [ 213.050145][T13005] __x64_sys_mkdirat+0x89/0xc0 [ 213.052098][T13005] do_syscall_64+0x123/0x790 [ 213.053948][T13005] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.056730][T13005] RIP: 0033:0x7feb66b9e159 [ 213.058487][T13005] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 213.065111][T13005] RSP: 002b:00007feb67a48028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 213.067911][T13005] RAX: ffffffffffffffda RBX: 00007feb66e25fa0 RCX: 00007feb66b9e159 [ 213.070720][T13005] RDX: 00000000000001ff RSI: 0000200000000140 RDI: ffffffffffffff9c [ 213.073442][T13005] RBP: 00007feb66c3506b R08: 0000000000000000 R09: 0000000000000000 [ 213.075874][T13005] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 213.078554][T13005] R13: 00007feb66e26038 R14: 00007feb66e25fa0 R15: 00007ffdcd5decb8 [ 213.084058][T13005] [ 213.085198][T13005] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 213.087783][T13005] CPU: 1 UID: 0 PID: 13005 Comm: syz.1.2571 Tainted: G L syzkaller #0 PREEMPT(full) [ 213.091287][T13005] Tainted: [L]=SOFTLOCKUP [ 213.092685][T13005] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 213.095775][T13005] Call Trace: [ 213.096848][T13005] [ 213.097902][T13005] dump_stack_lvl+0x100/0x190 [ 213.099418][T13005] vpanic+0x553/0x970 [ 213.100700][T13005] ? __pfx_vpanic+0x10/0x10 [ 213.102133][T13005] panic+0xd1/0xe0 [ 213.103312][T13005] ? __pfx_panic+0x10/0x10 [ 213.104793][T13005] check_panic_on_warn.cold+0x19/0x34 [ 213.106949][T13005] ? trace_rb_cpu_prepare+0x463/0x520 [ 213.109134][T13005] __warn.cold+0x191/0x318 [ 213.110974][T13005] __report_bug+0x30f/0x440 [ 213.112740][T13005] ? trace_rb_cpu_prepare+0x463/0x520 [ 213.114467][T13005] ? __pfx___report_bug+0x10/0x10 [ 213.116111][T13005] ? rb_allocate_cpu_buffer+0xe30/0x2780 [ 213.118208][T13005] ? rb_allocate_cpu_buffer+0xeec/0x2780 [ 213.120623][T13005] report_bug_entry+0xe2/0x290 [ 213.122536][T13005] ? trace_rb_cpu_prepare+0x465/0x520 [ 213.124252][T13005] handle_bug+0x1cd/0x2a0 [ 213.125864][T13005] exc_invalid_op+0x17/0x50 [ 213.127827][T13005] asm_exc_invalid_op+0x1a/0x20 [ 213.129874][T13005] RIP: 0010:trace_rb_cpu_prepare+0x465/0x520 [ 213.132430][T13005] Code: 48 c1 ea 03 80 3c 02 00 0f 84 bc fc ff ff 48 8b 3c 24 e8 ce f7 6e 00 e9 ae fc ff ff e8 b4 7e fb ff 48 8d 3d 9d 69 38 0f 89 ee <67> 48 0f b9 3a bb f4 ff ff ff e9 d3 fd ff ff 4c 89 ef e8 a4 f7 6e [ 213.139310][T13005] RSP: 0018:ffffc90025c1f8d8 EFLAGS: 00010283 [ 213.141144][T13005] RAX: 0000000000020d8a RBX: ffff8880550a78b8 RCX: ffffc90003ca9000 [ 213.144146][T13005] RDX: 0000000000080000 RSI: 0000000000000002 RDI: ffffffff914934c0 [ 213.146752][T13005] RBP: 0000000000000002 R08: ffff88802dbeec10 R09: 0000000000000000 [ 213.149853][T13005] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000002 [ 213.153009][T13005] R13: ffff8880550a7810 R14: 0000000000000162 R15: 0000000000000000 [ 213.156222][T13005] ? trace_rb_cpu_prepare+0x45c/0x520 [ 213.157852][T13005] ? __pfx_trace_rb_cpu_prepare+0x10/0x10 [ 213.160054][T13005] cpuhp_invoke_callback+0x205/0x9a0 [ 213.162188][T13005] ? __pfx_trace_rb_cpu_prepare+0x10/0x10 [ 213.164481][T13005] cpuhp_issue_call+0x1b8/0x970 [ 213.166439][T13005] __cpuhp_state_add_instance_cpuslocked+0x2d7/0x400 [ 213.168519][T13005] __cpuhp_state_add_instance+0xda/0x2e0 [ 213.170726][T13005] alloc_buffer+0x6f8/0x1690 [ 213.172487][T13005] __ring_buffer_alloc+0x2d/0x40 [ 213.174435][T13005] allocate_trace_buffer+0x150/0xa30 [ 213.176504][T13005] ? __kmalloc_node_track_caller_noprof+0x35b/0x870 [ 213.179053][T13005] ? __pfx_allocate_trace_buffer+0x10/0x10 [ 213.180901][T13005] ? lockdep_init_map_type+0x5c/0x250 [ 213.182842][T13005] trace_array_create_systems+0x582/0xc30 [ 213.185016][T13005] instance_mkdir+0xca/0x140 [ 213.186824][T13005] tracefs_syscall_mkdir+0x10e/0x180 [ 213.188575][T13005] ? __pfx_tracefs_syscall_mkdir+0x10/0x10 [ 213.190461][T13005] vfs_mkdir+0x364/0x850 [ 213.192156][T13005] filename_mkdirat+0x48b/0x5e0 [ 213.194142][T13005] ? __pfx_filename_mkdirat+0x10/0x10 [ 213.196338][T13005] ? strncpy_from_user+0x19d/0x2d0 [ 213.198411][T13005] ? do_getname+0x191/0x390 [ 213.200254][T13005] __x64_sys_mkdirat+0x89/0xc0 [ 213.202177][T13005] do_syscall_64+0x123/0x790 [ 213.204173][T13005] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.206344][T13005] RIP: 0033:0x7feb66b9e159 [ 213.207722][T13005] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 213.214000][T13005] RSP: 002b:00007feb67a48028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 213.216654][T13005] RAX: ffffffffffffffda RBX: 00007feb66e25fa0 RCX: 00007feb66b9e159 [ 213.219218][T13005] RDX: 00000000000001ff RSI: 0000200000000140 RDI: ffffffffffffff9c [ 213.221847][T13005] RBP: 00007feb66c3506b R08: 0000000000000000 R09: 0000000000000000 [ 213.224629][T13005] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 213.227292][T13005] R13: 00007feb66e26038 R14: 00007feb66e25fa0 R15: 00007ffdcd5decb8 [ 213.229897][T13005] [ 213.231771][T13005] Kernel Offset: disabled [ 213.233417][T13005] Rebooting in 86400 seconds..