last executing test programs: 1m28.887852208s ago: executing program 1 (id=893): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_BSS(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r3, 0x1, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0x1}]}, 0x24}}, 0x4000800) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xfc, r5, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x40000000}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private2={0xfc, 0x2, '\x00', 0x1}}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@dev={0xac, 0x14, 0x14, 0x17}}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}, @IPVS_DEST_ATTR_WEIGHT={0x8}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e23}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xd}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x9}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x800}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xbf48}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4040000}, 0x40) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x80a0}, [@IFLA_MTU={0x8, 0x4, 0x44}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) 1m28.77874229s ago: executing program 1 (id=896): ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x1}) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x1}) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_ublk_setup_io_uring(0x22, &(0x7f0000000340)={0x0, 0x20000000, 0x100, 0x2, 0x1db}, &(0x7f0000000000)=0x0, &(0x7f0000000300)=0x0, &(0x7f00000004c0)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000980)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x6, 0x0, 0x0, 0x0, {0x2002}}) io_uring_register$IORING_REGISTER_NAPI(r0, 0x1b, &(0x7f0000000100)={0x1, 0xa}, 0x1) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x20, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x100000001, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000140)=@any_dev={0x4, 0xfcd, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0x118}}}, &(0x7f0000000240)) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000280)={0x2e, 0x5, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x22, &(0x7f0000000200)=@new_dev={0x1, 0xeec}}}, 0x0) (async) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000280)={0x2e, 0x5, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x22, &(0x7f0000000200)=@new_dev={0x1, 0xeec}}}, 0x0) r5 = syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x1) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r5, 0x810c5701, &(0x7f0000000100)) (async) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r5, 0x810c5701, &(0x7f0000000100)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes\x00', 0x26e1, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes\x00', 0x26e1, 0x0) unshare(0x22020600) syz_open_procfs(0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x46f, 0x10000, @value=r6}, 0x28) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x46f, 0x10000, @value=r6}, 0x28) r7 = socket$nl_audit(0x10, 0x3, 0x9) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r9, 0x29, 0x49, &(0x7f0000000780)=0x5, 0x4) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000001c000100000000000000000007000000", @ANYRES32=r10, @ANYBLOB="800066180a000200aaaaaaaaaa0c000006000500"], 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={0xffffffffffffffff, r10, 0x25, 0x8, @void}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000003400)={'wlan0\x00', 0x0}) socket$nl_generic(0x10, 0x3, 0x10) (async) r12 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000006a00), r12) (async) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000006a00), r12) sendmsg$NL80211_CMD_JOIN_MESH(r12, &(0x7f0000006bc0)={0x0, 0x0, &(0x7f0000006b80)={&(0x7f0000006a40)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010027000003060b", @ANYRES32=r11, @ANYBLOB="0a00180003030303030300001000700005000800f400000004000700"], 0x38}, 0x1, 0x0, 0x0, 0x5}, 0x24000800) (async) sendmsg$NL80211_CMD_JOIN_MESH(r12, &(0x7f0000006bc0)={0x0, 0x0, &(0x7f0000006b80)={&(0x7f0000006a40)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010027000003060b", @ANYRES32=r11, @ANYBLOB="0a00180003030303030300001000700005000800f400000004000700"], 0x38}, 0x1, 0x0, 0x0, 0x5}, 0x24000800) 1m28.69862955s ago: executing program 1 (id=900): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000080)='./file0\x00', &(0x7f00000004c0), 0x2800028, &(0x7f0000000500)=ANY=[@ANYBLOB="56c78e3c733d76642c6163638173733d616e792c58616368653d667363616368652c76657273696f6e3d3970323030302e75"]) utimes(&(0x7f0000000100)='./file0\x00', 0x0) 1m28.647276542s ago: executing program 1 (id=902): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x7, &(0x7f0000000100)=0x4000200, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x6, 0x300, 0xfc}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b18094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x22, &(0x7f0000001680)=0x1, 0x4) bind$inet6(r1, &(0x7f0000000240)={0xa, 0x4e20, 0x9, @empty, 0x5}, 0x1c) setsockopt$inet6_buf(r1, 0x29, 0x31, &(0x7f0000000280)="b74560dcd2d46861", 0x8) sendmmsg$inet6(r1, &(0x7f0000000140)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000a40)="fb", 0x1}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x20080058) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r2 = open(&(0x7f0000000000)='.\x00', 0x0, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) lstat(&(0x7f00000000c0)='./file1/file0\x00', &(0x7f0000000280)) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f00000004c0)='./file1/file0\x00', &(0x7f0000000500)='./file1/file0\x00', 0x0, 0x5040, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r2, 0x40049366, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000880), 0xffffffffffffffff) 1m28.514015501s ago: executing program 1 (id=904): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) close(0x3) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @rand_addr=' \x01\x00'}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r1, &(0x7f0000000080)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30, 0x44040}], 0x1, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x40, @remote, 0x9}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000010c0)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000240)=@assoc_value={r5, 0x6}, 0x8) 1m28.11491485s ago: executing program 1 (id=909): r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000080)={0x0, 0x5e, "70367370fe6c8013cd13bb8ee6ca721abd5a5c28981390b40343ca24e967f311d2baa1abf71c25d11234b196d97df8b0a72fecc566e043b0fd0700ce4c9f80a2f87e2dfdb8a99fb15deaafe1179a4a0d599b481843bd7da771beddd4995e"}, &(0x7f0000000100)=0x66) (async, rerun: 64) r2 = openat$incfs(r0, &(0x7f0000000140)='.log\x00', 0x414100, 0x1c0) (rerun: 64) ioctl$DRM_IOCTL_PANTHOR_GROUP_CREATE(r0, 0xc0386447, &(0x7f00000001c0)={{0x8, 0x1, &(0x7f0000000180)=[{0x7, 0x0, 0x5}]}, 0x2, 0x7, 0x8, 0x1, 0x0, 0xa, 0x2, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_PANTHOR_GROUP_SUBMIT(r2, 0xc0186449, &(0x7f0000000280)={r3, 0x0, {0x28, 0x1, &(0x7f0000000240)=[{0x4, 0x334f8a08, 0xf8798db24540e380, 0x5, 0x0, {0x10, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0xffff}]}}]}}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000002c0)={r1, 0x1}, &(0x7f0000000300)=0x8) (async, rerun: 32) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r2, 0xc0106441, &(0x7f0000000340)={0x0, 0x0, 0xffffffff80000001}) (rerun: 32) ioctl$DRM_IOCTL_PANTHOR_TILER_HEAP_CREATE(r2, 0xc028644b, &(0x7f0000000380)={r4, 0x1db, 0x120000, 0x7, 0x8, 0x0, 0x3, 0x7fff}) (async) ioctl$DRM_IOCTL_MODE_GETGAMMA(r2, 0xc02064a4, &(0x7f0000000480)={0x0, 0x2, &(0x7f00000003c0)=[0x7, 0x4], &(0x7f0000000400)=[0x7fff, 0x8, 0x8], &(0x7f0000000440)=[0x9276, 0x3, 0x3, 0xfff9]}) (async) r5 = openat$nmem0(0xffffffffffffff9c, &(0x7f00000004c0), 0x492400, 0x0) ioctl$DRM_IOCTL_MARK_BUFS(r5, 0x40206417, &(0x7f0000000500)={0x2, 0x6, 0x4c8b, 0x6, 0x2, 0x3}) (async) r6 = syz_open_dev$dri(&(0x7f0000000540), 0x10000, 0x6400) ioctl$DRM_IOCTL_SET_VERSION(r6, 0xc0106407, &(0x7f0000000580)={0x80000000, 0x6, 0x1af6, 0x2}) (async) ioctl$DRM_IOCTL_GET_UNIQUE(r2, 0xc0106401, &(0x7f0000000680)={0x96, &(0x7f00000005c0)=""/150}) (async, rerun: 64) r7 = syz_open_dev$mtd(&(0x7f00000006c0), 0x0, 0x800) (rerun: 64) ioctl$OTPGETREGIONCOUNT(r7, 0x40044d0e, &(0x7f0000000700)) (async) ioctl$USBDEVFS_DISCSIGNAL(r2, 0x8010550e, &(0x7f0000000780)={0x0, &(0x7f0000000740)="c377fe91eeceaf6a1895acbc22c13255c94f0988e4d84e6ac33159a0e7a1687461d6f5c4f87be0"}) (async) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f00000007c0)=r5, 0x4) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000800)={0x3, 0x3, 0x0, 0x0, 0xab}) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000840)={r5, 0xfffffffffffff000, 0x2, 0x1}) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r9, 0x84, 0x20, &(0x7f0000000880)=0x81, 0x4) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f00000008c0)={0xffffffff, {{0x2, 0x4e23, @multicast1}}, 0x1, 0x6, [{{0x2, 0x4e23, @loopback}}, {{0x2, 0x4e23, @loopback}}, {{0x2, 0x4e21, @rand_addr=0x64010101}}, {{0x2, 0x4e22, @private=0xa010102}}, {{0x2, 0x4e22, @multicast1}}, {{0x2, 0x4e20, @multicast2}}]}, 0x390) (async, rerun: 32) ioctl$NS_GET_OWNER_UID(r5, 0xb704, &(0x7f0000000cc0)=0x0) (rerun: 32) fchownat(r8, &(0x7f0000000c80)='./file0\x00', r10, 0xee01, 0x800) (async) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000d00)={r1, 0xcb, "7c5a15fb14ec5ff2ec613b09d85a65786cffa33560f5fcf7ea6ffff091be5ca14308a9b30ea8bbc599d70a664e875f58c92d30578e254d2161c2709c3d2c3b641c1aa3e3cd230c402b5ec924dfda3f9bfeb7424046b18cbcea8e5c819a661410b63156400444537ea42727926f4087ee0b82c1dfe35f5be48ecada2912bc479c83625f1d66acc9817b72e7a31d21101050290017ae41d10d82c247964cc5799d531415bbd27d412584a00ab102258f78ad3c540961264f433303762b1a7d65483e07bb4f7b6586a9af1149"}, &(0x7f0000000e00)=0xd3) (async) syz_usb_connect$cdc_ncm(0x2, 0xb6, &(0x7f0000000e40)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa4, 0x2, 0x1, 0xf9, 0x90, 0x3, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "0494646eff19"}, {0x5, 0x24, 0x0, 0x857b}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x4, 0x7, 0x2}, {0x6, 0x24, 0x1a, 0xfffe, 0x12}, [@mbim_extended={0x8, 0x24, 0x1c, 0x2, 0x8d, 0x9}, @acm={0x4, 0x24, 0x2, 0xc}, @network_terminal={0x7, 0x24, 0xa, 0x1, 0x80, 0xd, 0xf}, @mdlm={0x15, 0x24, 0x12, 0x401}, @mdlm={0x15}, @obex={0x5, 0x24, 0x15, 0xb}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0xf, 0x3, 0x8}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x8, 0x23, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x3, 0x1, 0x9c}}}}}}}]}}, &(0x7f0000001080)={0xa, &(0x7f0000000f00)={0xa, 0x6, 0x110, 0x0, 0x5, 0x40, 0xff, 0xe6}, 0x24, &(0x7f0000000f40)={0x5, 0xf, 0x24, 0x2, [@wireless={0xb, 0x10, 0x1, 0xc, 0x20, 0x8, 0x1, 0xdd, 0x4}, @ss_container_id={0x14, 0x10, 0x4, 0x1, "8132110fffa408bceb11dc9615068325"}]}, 0x4, [{0x4, &(0x7f0000000f80)=@lang_id={0x4, 0x3, 0x1401}}, {0x4, &(0x7f0000000fc0)=@lang_id={0x4, 0x3, 0x827}}, {0x4, &(0x7f0000001000)=@lang_id={0x4, 0x3, 0x44b}}, {0x4, &(0x7f0000001040)=@lang_id={0x4, 0x3, 0x441}}]}) (async) syz_open_dev$vcsa(&(0x7f0000001100), 0x5, 0x80100) (async) syz_open_dev$vcsa(&(0x7f0000001140), 0x0, 0x2) 1m27.975510636s ago: executing program 32 (id=909): r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000080)={0x0, 0x5e, "70367370fe6c8013cd13bb8ee6ca721abd5a5c28981390b40343ca24e967f311d2baa1abf71c25d11234b196d97df8b0a72fecc566e043b0fd0700ce4c9f80a2f87e2dfdb8a99fb15deaafe1179a4a0d599b481843bd7da771beddd4995e"}, &(0x7f0000000100)=0x66) (async, rerun: 64) r2 = openat$incfs(r0, &(0x7f0000000140)='.log\x00', 0x414100, 0x1c0) (rerun: 64) ioctl$DRM_IOCTL_PANTHOR_GROUP_CREATE(r0, 0xc0386447, &(0x7f00000001c0)={{0x8, 0x1, &(0x7f0000000180)=[{0x7, 0x0, 0x5}]}, 0x2, 0x7, 0x8, 0x1, 0x0, 0xa, 0x2, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_PANTHOR_GROUP_SUBMIT(r2, 0xc0186449, &(0x7f0000000280)={r3, 0x0, {0x28, 0x1, &(0x7f0000000240)=[{0x4, 0x334f8a08, 0xf8798db24540e380, 0x5, 0x0, {0x10, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0xffff}]}}]}}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000002c0)={r1, 0x1}, &(0x7f0000000300)=0x8) (async, rerun: 32) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r2, 0xc0106441, &(0x7f0000000340)={0x0, 0x0, 0xffffffff80000001}) (rerun: 32) ioctl$DRM_IOCTL_PANTHOR_TILER_HEAP_CREATE(r2, 0xc028644b, &(0x7f0000000380)={r4, 0x1db, 0x120000, 0x7, 0x8, 0x0, 0x3, 0x7fff}) (async) ioctl$DRM_IOCTL_MODE_GETGAMMA(r2, 0xc02064a4, &(0x7f0000000480)={0x0, 0x2, &(0x7f00000003c0)=[0x7, 0x4], &(0x7f0000000400)=[0x7fff, 0x8, 0x8], &(0x7f0000000440)=[0x9276, 0x3, 0x3, 0xfff9]}) (async) r5 = openat$nmem0(0xffffffffffffff9c, &(0x7f00000004c0), 0x492400, 0x0) ioctl$DRM_IOCTL_MARK_BUFS(r5, 0x40206417, &(0x7f0000000500)={0x2, 0x6, 0x4c8b, 0x6, 0x2, 0x3}) (async) r6 = syz_open_dev$dri(&(0x7f0000000540), 0x10000, 0x6400) ioctl$DRM_IOCTL_SET_VERSION(r6, 0xc0106407, &(0x7f0000000580)={0x80000000, 0x6, 0x1af6, 0x2}) (async) ioctl$DRM_IOCTL_GET_UNIQUE(r2, 0xc0106401, &(0x7f0000000680)={0x96, &(0x7f00000005c0)=""/150}) (async, rerun: 64) r7 = syz_open_dev$mtd(&(0x7f00000006c0), 0x0, 0x800) (rerun: 64) ioctl$OTPGETREGIONCOUNT(r7, 0x40044d0e, &(0x7f0000000700)) (async) ioctl$USBDEVFS_DISCSIGNAL(r2, 0x8010550e, &(0x7f0000000780)={0x0, &(0x7f0000000740)="c377fe91eeceaf6a1895acbc22c13255c94f0988e4d84e6ac33159a0e7a1687461d6f5c4f87be0"}) (async) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f00000007c0)=r5, 0x4) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000800)={0x3, 0x3, 0x0, 0x0, 0xab}) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000840)={r5, 0xfffffffffffff000, 0x2, 0x1}) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r9, 0x84, 0x20, &(0x7f0000000880)=0x81, 0x4) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f00000008c0)={0xffffffff, {{0x2, 0x4e23, @multicast1}}, 0x1, 0x6, [{{0x2, 0x4e23, @loopback}}, {{0x2, 0x4e23, @loopback}}, {{0x2, 0x4e21, @rand_addr=0x64010101}}, {{0x2, 0x4e22, @private=0xa010102}}, {{0x2, 0x4e22, @multicast1}}, {{0x2, 0x4e20, @multicast2}}]}, 0x390) (async, rerun: 32) ioctl$NS_GET_OWNER_UID(r5, 0xb704, &(0x7f0000000cc0)=0x0) (rerun: 32) fchownat(r8, &(0x7f0000000c80)='./file0\x00', r10, 0xee01, 0x800) (async) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000d00)={r1, 0xcb, "7c5a15fb14ec5ff2ec613b09d85a65786cffa33560f5fcf7ea6ffff091be5ca14308a9b30ea8bbc599d70a664e875f58c92d30578e254d2161c2709c3d2c3b641c1aa3e3cd230c402b5ec924dfda3f9bfeb7424046b18cbcea8e5c819a661410b63156400444537ea42727926f4087ee0b82c1dfe35f5be48ecada2912bc479c83625f1d66acc9817b72e7a31d21101050290017ae41d10d82c247964cc5799d531415bbd27d412584a00ab102258f78ad3c540961264f433303762b1a7d65483e07bb4f7b6586a9af1149"}, &(0x7f0000000e00)=0xd3) (async) syz_usb_connect$cdc_ncm(0x2, 0xb6, &(0x7f0000000e40)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa4, 0x2, 0x1, 0xf9, 0x90, 0x3, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "0494646eff19"}, {0x5, 0x24, 0x0, 0x857b}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x4, 0x7, 0x2}, {0x6, 0x24, 0x1a, 0xfffe, 0x12}, [@mbim_extended={0x8, 0x24, 0x1c, 0x2, 0x8d, 0x9}, @acm={0x4, 0x24, 0x2, 0xc}, @network_terminal={0x7, 0x24, 0xa, 0x1, 0x80, 0xd, 0xf}, @mdlm={0x15, 0x24, 0x12, 0x401}, @mdlm={0x15}, @obex={0x5, 0x24, 0x15, 0xb}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0xf, 0x3, 0x8}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x8, 0x23, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x3, 0x1, 0x9c}}}}}}}]}}, &(0x7f0000001080)={0xa, &(0x7f0000000f00)={0xa, 0x6, 0x110, 0x0, 0x5, 0x40, 0xff, 0xe6}, 0x24, &(0x7f0000000f40)={0x5, 0xf, 0x24, 0x2, [@wireless={0xb, 0x10, 0x1, 0xc, 0x20, 0x8, 0x1, 0xdd, 0x4}, @ss_container_id={0x14, 0x10, 0x4, 0x1, "8132110fffa408bceb11dc9615068325"}]}, 0x4, [{0x4, &(0x7f0000000f80)=@lang_id={0x4, 0x3, 0x1401}}, {0x4, &(0x7f0000000fc0)=@lang_id={0x4, 0x3, 0x827}}, {0x4, &(0x7f0000001000)=@lang_id={0x4, 0x3, 0x44b}}, {0x4, &(0x7f0000001040)=@lang_id={0x4, 0x3, 0x441}}]}) (async) syz_open_dev$vcsa(&(0x7f0000001100), 0x5, 0x80100) (async) syz_open_dev$vcsa(&(0x7f0000001140), 0x0, 0x2) 1m14.678049954s ago: executing program 4 (id=1075): r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/softnet_stat\x00') read$FUSE(r0, &(0x7f00000001c0)={0x2020}, 0x2020) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000d40), r2) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r2, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000002200)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010028bd7000ffdbdf250400000014000300ff01000000000000000000000000000114000600776c616e30000000000000000000000014000200ff010000000000000000000000000001c0cc96a62298c064ac8a987eb860038cc36c3b1e9081d03913aa965382f80f00fcf7a289f8620655d1b66fc398e411542fa29c17db3cf55d3d6ee15844b6994744c74ed21e5de4da2a2e856eab2b2eb0c456bbe954479095d60900776aed8f62055689bd963f1de2344dd1c0b7c19afc5f53e33f12dc2dd9e9ca6f80d0b23550726ac9e6a52439116f3f29a02473621b9e84f0029369f8e59675b8c4b70ee8a08007399cee6c4ea09fe8fe1f3f3e10000000f0639bfe1cce5eb533c0f4c8e285d6207c5ebb72ef2f225739b19197ae80c655cc61e360f0904582feb20a6f742e73164c8e90094116d22fdcb24a196b4d9a3285bd6bbcf6ce8d870b55c2bcd78ddb8c9b418b2b6a"], 0x50}, 0x1, 0x0, 0x0, 0x24000000}, 0x400c850) sendmsg$nl_generic(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r4 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000c40)=@delqdisc={0x58, 0x25, 0x200, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2}, {0xc, 0xc}, {0x4, 0x6}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x2, 0x1, 0x0, 0x6, 0x1, 0xd865}, {0xdd, 0x2, 0xf, 0x8000, 0x1, 0x3}, 0x7ff, 0xff800000, 0x3a2}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000001}, 0x94) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803002d000b12d25a80648c2594f90224fc60100c024002000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r5, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f0000000000)=0x60, 0x4) 1m13.458125715s ago: executing program 4 (id=1081): capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)) setuid(0xee00) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x304, 0x36}, "1a88ef816c4b42ed", "a5fdeb69a751e94df50ad7e9df19c0df083c6e240d000000000000380100", "15f0ff80", "066580001e00"}, 0x38) writev(r0, &(0x7f00000007c0)=[{&(0x7f00000003c0)="817d4410fd2068200d2d4706a2702b0c61175b78117b1151f16a7ebf4eb2c140f4ec2bfbd9b3a01d22a4bc50a3b92113bd9ce2cf804313eff2bb879914384502", 0x40}], 0x1) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'rmd160-generic\x00'}, 0x58) accept4(r1, 0x0, 0x0, 0x0) getxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=@known='trusted.overlay.redirect\x00', &(0x7f00000002c0)=""/207, 0xcf) r2 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) sendmsg$FOU_CMD_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYRES64=r1, @ANYRESOCT=r2, @ANYRESDEC=r2, @ANYRES32=r1, @ANYRESOCT=r2, @ANYRES16=r2], 0x38}, 0x1, 0x0, 0x0, 0x40000d0}, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f000000e940)=[{{&(0x7f0000000000)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, &(0x7f000000e300)=[@ip_retopts={{0x10}}], 0x10}}], 0x1, 0x20044000) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)) (async) setuid(0xee00) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) (async) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) (async) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x304, 0x36}, "1a88ef816c4b42ed", "a5fdeb69a751e94df50ad7e9df19c0df083c6e240d000000000000380100", "15f0ff80", "066580001e00"}, 0x38) (async) writev(r0, &(0x7f00000007c0)=[{&(0x7f00000003c0)="817d4410fd2068200d2d4706a2702b0c61175b78117b1151f16a7ebf4eb2c140f4ec2bfbd9b3a01d22a4bc50a3b92113bd9ce2cf804313eff2bb879914384502", 0x40}], 0x1) (async) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'rmd160-generic\x00'}, 0x58) (async) accept4(r1, 0x0, 0x0, 0x0) (async) getxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=@known='trusted.overlay.redirect\x00', &(0x7f00000002c0)=""/207, 0xcf) (async) ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) (async) sendmsg$FOU_CMD_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYRES64=r1, @ANYRESOCT=r2, @ANYRESDEC=r2, @ANYRES32=r1, @ANYRESOCT=r2, @ANYRES16=r2], 0x38}, 0x1, 0x0, 0x0, 0x40000d0}, 0x0) (async) sendmmsg$inet(0xffffffffffffffff, &(0x7f000000e940)=[{{&(0x7f0000000000)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, &(0x7f000000e300)=[@ip_retopts={{0x10}}], 0x10}}], 0x1, 0x20044000) (async) 1m13.307956818s ago: executing program 4 (id=1084): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)=@deltfilter={0x141c, 0x2d, 0x1, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_matchall={{0xd}, {0x13e8, 0x2, [@TCA_MATCHALL_ACT={0x13e4, 0x2, [@m_skbedit={0x1088, 0xf, 0x0, 0x0, {{0xc}, {0x5c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0xfff, 0x4, 0x3, 0x0, 0xfffff000}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xad, 0x8, 0x0, 0x2, 0x3}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x9, 0x5, 0x2, 0x3, 0x8}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x3, 0x5}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x1}]}, {0x1004, 0x6, "33c6585258304fb59d4fb05c7ed94071a17122af28662767d67dc09a58dc67563c413edc651b36de7f15bbcf7c98e294e627eaef2ab92dfe4c8074ae571d461ecc663b0538dea5017c6de3b735a5e07352b1eaf26a37ddebf61bbf64359f7ea050d90795bca9c9ff8cdce502433aca834eb5aea6d1b7c4b0ef81f4f533f241ea570f7da7e92e088ca0b981bfb7b6c82db28f8bc4e90cab25c1cf6149d09614806a979560b34a2f00b322dba31762281faabcb187308f2214b9a28aa346052091d0ebfab617323207ff782be4b14bd1aebcb3a667a31d9a93b50445a3ca1f561d750659b9fad76e8f5a56021569c0792e69f1263164f2413227190f938372f4b14f9f2a155f5581023f00c6f08bc21fa6fc3907987864b7b513bdfa2abf1b370163d06d3a2bbbb8b5919bff312edad5f87f6fa59b441aa0b2949bd7b89fe8457870b6d4cb0fdd40a112d753891cb01b8aa27133fd6cf22d17c656ffd6fd0e9ae7049e33975c0c696b9d6ac3be674a3436cebc789b2df35350146e5da47560f3dbea8ec1d2566eff84450e99bfcdf79f561f26946e25f93760248f914fbb29b6c28900c3f240c2398adac95b92d131add4d1e12c0c10c5170a96bac25abeff7fbd7cee3935b04764a23c52a46975ede7c863237ed50c7577671555ec67376c7248d7c40d943acea95b3c11cb3c42a9d8f62fcdf31c34766c503d99db93f9c68eb398112c51a64ff5c21b1191bfa888ee7938bc8631ec2ab66718e1424e66e0b2bf441dbb041ba5528d6cea6af1d64adc9821df00cfa01e062e9a791228ca00b7e268153920926760dbda313396a8796326ea2864257d0eae74ff28f23339d2044e50fbc48b2ebca7ca6777b27db03e803c59274e5bfe83733fe95e041c9acea170770d98ddb663d2d366cf3dda3d58f5da02d47eec8c846d4b05b9bdf1dc14166bbc5a2bcd4dcbfbb4ce0747c7f49c9c087374f32d2a1dad2fa5992e91314fd2feadd977e8b6dac4a4e67bbd05948983ce732b950aed75f754233148d85bb7d83fd8e1ca6703140118219714a41eff9a25d86288f6a1e6f36b2b9d5a9cd25629438dc42da76764762072183df2f622e6386f4a995ce1c863af65a6b4d7c5c91abe6433739e631e32b5df44c5f399388e6e73eb845f22b6380791b18e34112c67519e7b98fba70fad60859c8f7be8442f20d48f479e12d39987f4e9c5b6089d2bb2c6143dc47bfe10ee75c5197df65878018857943cf0e571ba8862a17299e83fe30dc6627917b63905dbe98f33f670c720e01ca8dcf85715666e3d88dcc282d16691d79f8ec9cd267f235943d9a2f89eb9dcef5898bf7ae3c10bcdde44d68f84a1a7a70b4f3993894a9a695795db6586a0ba2674a4dc0a2ad9124420336688656d5c35feec79ecfa3c62bdf015d0fa0df7656c50f0613b7526a8b3e7d0ced4c224259b55c9b8da70ce34862f2ccd802bfb24bad13d6c7f6e0ddb3473fcf275e06227a97f49a3456ba0010a0f2ac4ac917ee2e2087f13da86470accacfc600c806532807fbe2ecb1175195deed0deea23971e9297cd72135feafa6030884276f7c73200e1eded0896b59886a96d3ef616636f4d452aef316629cfb7137f5da817bd1e445cafe14273dea5f35377bc758061c20e9602971ee5d37eed115a34ad5330361a3d3a445833f098a1d4315626a9bb8ef5fd1d9c774225a8158c7caca647efb4a17b865567454a38bd4b8f8356ccddc9f50209d3add273a99f85f2647cd6fead52032b07aedd90a84f1e5d8c5c626842db218b70e63800f61faecd29e766c95191399dbc5cf0442eef7adc6c6bdd369819c97fe7650a16676318617ca07ed8d59ba2871731235588993a08857543548dbcb36cbf9b998ed149e26be19cec695fac4a0b9415f3a8df1f71cafcfb3159c8bb7620a521363d1273fac126082db15c4c39ff31e934d203385326ab28af6711cb5dc2b651b7fb5c4d5d6e3658b57b96e2eba84921e7466d95abacb7ec168aa8a2a47e651a4a0490342865a324c61fdc5b093d11447e6a700d68fa9e63cd27bf7eb84f0edee028d95d57ddcf81d970cfccba791cad65b7eac19382d525a7cf4648dd6c6bc722ceacda2fe478c33adaa42b6f1ac00cb2ad5c38d27b622b9db61b552ffc831d144bce312be1e05ec2f33fe269eb5897665c593af950c6c7a142b9aa2af9189f1efb120c34506bf00d84dda468021270b0a47fbff8f3c7024039ff4a407e91420a3599a8cda090eae3a0898ca82d59b9d8fc4cc25fb366ef9451d6b09dac470a3b9b5bc6ef3f9fbf2057f51d842efb15ef6bc442a0c8425204526b2e89a67e9ff610077634459b8b8bd7109114010721f2b9056c77221bc8d7975e9f62ff82cf69f2121a920bb93851490a2861d249778f63627e04064fc6bce5b274287b51712f79caa096ab70962bff27a06ba658a49479ae82cb96d4e5e448bd14f6a9aa83d6346ffe40f02bede2c513a3f8bfaedea5c7c10051ec5af824fde83a2e0638a5e0309a6e930629b65bd3d158907354b60dadeca36381088a1951e93dff05629bbc0e72e6b6a5f70db655e335307f615de957b95d9cb7a738cdd67ae0ae3bafe5e3594405b15c709d01ed8b0275472d6fd3b384b80659fcf352257baa17191392b9cf1bfb90889accb9e5e30f4d5908374e698ad6a25caa7cf5b970be9d6b94052c57cedca31c68c12bd9ed0db6a1d7a1f57ea9417fbabbdfdf1993c4fed49da1b0c302e8d859be07313744a8abf6147678481283e48f07ea911a05814906f480b4a2d75c402b0f7c771831ec735965864332b21ec641d320fd3dcb856322f80fa0f0c60bf102ef89617b2ba9bc3fca92c944c91aabf8dc41788b68b7215ddaf9e335fbe965f51121180158f178404bb60f503e0368326af6dd1a5189a89f5135dee60b44803202e1fae91da3b61cb3c852a7cf05698cca9eddfd9ec1a19c46832b9631e942147ae1127202e9fa6e4861934092168014880d541c43bbfef86442baa1e5b09ae6b7bfe79207e59570b079ee1209154b56503c0f738f0d0965f827326076be260e4cb701d25dd9c0afdc44aaab16c7d06b1ea8fa2a232e8c47e4e2d68e2776e10fa49e7f69a53cf1588d759dfc86619c3e48525907e7e254f2005011d30f01c3834e2741873889af441ce4eb78e57724827d13cee346bb92f1f95b964aa9e66462cd5ef70ecee0866b44eac8a65d3e2d0ccac621bf1b8da83f0f3485dc5e5c2664302e8b83b3c98a6bd46a5c46b400f0b5bccd06ca76816dcab17a30daf1d4aed9c895f605bbbd2f0144e6ae8c69d6da5418e72ab8fd134d619f89fcc2a510f6947aad64f1a19781507aec4bec9783d59c0d9fdefaac30ef321329922eae251da9cae3e12575d42e53af71efa7444832a270d110d0d007ebf80b6c8861f8c0ba43640791f3a8c08c6ac3e27eebbe1376ce471a8e7bb20c157095c09eeeb0c82440082096862c9975b9b7b7955b472ed0de03f7c4fb14bc5605ea4744b9f716ea370a02383c17353b5d294fba9ca9b25e6dff43e0b245d5f5434a483bba5588938d43a8edbcf0fc5d6a93eeda3f8b28a01f41ad788bd2cdb4230cf4adcb8f3597ec14fbfd6668c683bdb5877c976042eb2d4ec2499004fcd07eeb890c33a3f52cff3134e538b6e9dad250f5ace2f9b71682fac5d2c18a1fe02810e4d675985ad8c9dd79635561ba5317f468cdc6dd5108d3d6f238cca9c2f45b495e2247d6fd78e6bd25a037ec25713be9237ad031175887a0a7fe33af1d7380888d58faecc57a35836bba2d7486239ec05e145866614d85e1410530b54a5cd3eeee79b0d50028f0af5a8c9065ac7b5dd22800310531ddac4e5d3cd9412b92dafb71597a0be114879dea8acce1aa2c067ed9594ece436c3a731975c849219b34855cb0315ad0c0aa2501163e8b0685d288f4f4528125f4b2353ed310ea7d44414c697d02b66d3845bec1161dc8c4254199aaf1342d2b73e03f6d03e448bdb9840ec75b8c9923c639559049811ab441ec62d601f1aac877a91300172cf448dbd42ee63f55c95d19e3e1f1d4a1a1118a2412d98a34b3c667a390ff397ee20afa624c7a442b2303b538016176eb95332dc9c6a6a4d747c6b234b4c4ef16b85aef23b519fe6ba5e0f0201d97adbaf1df1eb766371ac2d1c619931cae23b841c1e8c327bd20ba685cf6c7324533a6c7369bd7bf39db1033ab9c358f8e5439c155de8e876456ae5722dba8902f83b1ad707f414beb199ec33e838559adbb5ad3cca23873073a520e8986d042050d1e88d68b5e1604486e44d19e07c5b37cc84ba0761b9227e2a51ba665fdd2ccc400aa6036fbf8e2c5c430864b3b3d83bd2bda1ec91088de63e94a17627ee377a91b1a831be3d4c863053ef791c67d36428e5710f78b359e91567a3e55bb5200bd082951b36ec30926cb7e6a7d5b90597da66e55359718bfa519694bb27b9f8d66a24566c7b0eac811a56e0e3104fa4bf27be865b21952d2d948cc74c6e46899fca600932d3f1862fcf722bb62eae6ef5937d9d1072f9b3dacb31caa90f70d8003847394d9dc2bf584fd0b7130ccba6a12dd69bc92e435e180b10eab915a5b2fc6415e3290c7b2013588c5afaa7c508e6332cf21f108cfa4e605633e7307f013db30e1f76a6396875fa0b45b0f68124735c268e4a9794d90b41d6e6dc14e615244e275c6fe49439258e8d7f952b35a0ea6062b3c3a326d515dd1a5450ee926c84f9ed5072448e9e22c322cb652d5985940f33cb5b7a04084f9bed6ffa2b7c79375ce94dde2807f2af0127c6ef08bf92511a7856d9200d8410bdd38b6af3c1da777456b9497cf420af3d345dd2cf2e8a272ae5ffeebd5774655abc83447879444cc0d2f295214f054c48410431ed9e580c6f0eedc685b2657b8c6543c9e44dcba91fb4964f6190926715f79844d20f646fee68f6df725567020a701c0aa312d3056a7109686588adab8c878c1e0451e4b467e9b4d5546e1b06cda69b6cfc713fd495411eed8583fea66b7cc7cd190b514cb1df1c9ba9221b641c8fdaa2241ae46eefdf803bb69b328a0e7c80ba350ddb68b0537545586ad9a40b00bb3a1e2e3ddc05476ab7e861d86ef210f29ca6797e123236a783f984f23343bbcb38795dba577c8c9c713cea588f23e8f7407686b445bc06f0bf874a762d00cb8e16bc357be25bc07bc698be29e063b6384f1edbfdbd2516334a420ada5f33eeaa75c0f6a92bd8c327be2bf9edb4b93a35afac5bdd7d2231e27b488b281ab3fc365ff70daa288ef41a24b2c644c223630d1982f9d596100517efc0fd9af40dbaa2cffecae5ce8434d561ee2ee68158eb632c4a57c20ac3e0dc2b0d92b6422853c3ea548df1af14711c88c6da8dea78f95cba0b6b76d352226181d7495ec9d83615c73de10b9993eb2cba6e687a6b34d3a2d76ddacc02357ba8be8f14b33daaf935a65fe80a3f8ea37c71c0787e323065fb52ff171470f8f7568b44e2a038b535f8230bb7b7211041bd5dcd520afc4e996cb1b9adc1167e0ad7341615e59a660ac50c369baaf26d1866e543c07004aa7050b95c6d2fec451f842efd7dd406fab81726d18b50f7aa858887d8e02dad820f43d7df468aa85f941ea1c2243989921934511c15832a5670100a734b2a39428aeb4f0f996ec490d5dd4a2236d702a5aece00db6d7159ecc94e84e3e19cd8285b9d71ee88e200b4842392c96284414dec3fdb959e9492ddb6860d7a02df0e932c95a188ac8a50be0237a24b2c561a5fccc34107d7048687e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_xt={0x1b8, 0xd, 0x0, 0x0, {{0x7}, {0x128, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0xbb, 0x6, {0x2, 'mangle\x00', 0xcb, 0x5, "bb58cf3113e6cf479003ced567fd8b6278c294b90dcae1ca0e60e469dcf48aff406f6c4fa1a02046b45d25dbf402d648b0555aa6ee79a392523bfd77c80c5dcd617ed54bda04f9d833e5209720cdb2371594d37cd3599adf734fc155b8c1ab35d729969aad7c05b4f21573f9754f9682af4d0a1a7748b7bca851cac66085c273ab8edfdecdcd92aa6601013908fbe40c0b"}}, @TCA_IPT_INDEX={0x8, 0x3, 0x81}, @TCA_IPT_HOOK={0x8, 0x2, 0x2}, @TCA_IPT_TABLE={0x24, 0x1, 'raw\x00'}, @TCA_IPT_HOOK={0x8, 0x2, 0x1}, @TCA_IPT_TABLE={0x24, 0x1, 'security\x00'}, @TCA_IPT_HOOK={0x8, 0x2, 0xd4be55827211ce00}]}, {0x69, 0x6, "64aed6d249b9fd842c0bd6dbe3f644079b2bc60e52ed7ecb8ce0656c3703e7d28adcc4ba4276f79e190fd8ee89399215bc809e3b0e335cc4fab6dc5f8353585de535b024ddc2399bc255e0d6141db44210249f698642cf75bcefa33fafb2f00b96b98a0422"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_ct={0x58, 0x16, 0x0, 0x0, {{0x7}, {0x18, 0x2, 0x0, 0x1, [@TCA_CT_LABELS={0x14, 0x7, "770bdd4ebafc6d407d7720ab5fef17af"}]}, {0x1b, 0x6, "1a529683795903682b2c857983c8357c4fe12ab4589fe0"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1}}}}, @m_ctinfo={0x64, 0xd, 0x0, 0x0, {{0xb}, {0x14, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x2}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x2}]}, {0x28, 0x6, "794afa01a12b7326f295aad6ce3e47ffc1215294aba08526a91b31ad8177bf17815b5088"}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}, @m_gact={0xe4, 0x15, 0x0, 0x0, {{0x9}, {0x88, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x1e71}}, @TCA_GACT_PARMS={0x18, 0x2, {0x1, 0x0, 0x30000003, 0x0, 0x1}}, @TCA_GACT_PARMS={0x18, 0x2, {0xcae3, 0x200, 0x2, 0x80000000, 0xfffff0d4}}, @TCA_GACT_PARMS={0x18, 0x2, {0xa7d, 0x5, 0xffffffffffffffff, 0xfc8, 0x6}}, @TCA_GACT_PROB={0xc, 0x3, {0x0, 0x1e0, 0x8}}, @TCA_GACT_PARMS={0x18, 0x2, {0x8d, 0x33c, 0x2, 0x2, 0x7ff}}, @TCA_GACT_PROB={0xc, 0x3, {0x0, 0x6f3, 0x4}}]}, {0x34, 0x6, "82b8c4195c30933e98c8be5860212f6eb91b609fcdd6bbf59d9f530a77a7af5729b5ec16b128c7d3a1e90b7799384023"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}}]}, 0x141c}}, 0x0) 1m13.307506791s ago: executing program 4 (id=1085): r0 = io_uring_setup(0x2f4f, &(0x7f0000000280)={0x0, 0x10, 0x1, 0x0, 0x29}) mkdir(&(0x7f0000000000)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)="00000000090209000101008001120100020000004000000000000000000001", 0x1f) read$FUSE(r1, &(0x7f0000000440)={0x2020}, 0x2020) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) mount_setattr(0xffffffffffffff9c, 0x0, 0x8000, 0x0, 0x0) r4 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) mount(0x0, &(0x7f0000000000)='.\x00', 0x0, 0x1010060, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1m12.938217449s ago: executing program 4 (id=1091): creat(&(0x7f0000000040)='./file0\x00', 0x1d) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000440)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1400}}]}}) 1m12.13797248s ago: executing program 4 (id=1093): r0 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x98) fcntl$setlease(r0, 0x400, 0x1) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x8) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/locks\x00', 0x0, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x149040, 0x40) pread64(r2, &(0x7f00000024c0)=""/209, 0xd1, 0x8) r3 = fspick(r1, &(0x7f0000000000)='./file0\x00', 0x1) ioctl$EXT4_IOC_GROUP_ADD(r3, 0x40286608, &(0x7f0000000100)={0xe8, 0x7, 0x3, 0x5, 0x80, 0x4}) 1m12.050855637s ago: executing program 33 (id=1093): r0 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x98) fcntl$setlease(r0, 0x400, 0x1) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x8) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/locks\x00', 0x0, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x149040, 0x40) pread64(r2, &(0x7f00000024c0)=""/209, 0xd1, 0x8) r3 = fspick(r1, &(0x7f0000000000)='./file0\x00', 0x1) ioctl$EXT4_IOC_GROUP_ADD(r3, 0x40286608, &(0x7f0000000100)={0xe8, 0x7, 0x3, 0x5, 0x80, 0x4}) 22.64056774s ago: executing program 3 (id=1518): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) ioctl$EVIOCGREP(r1, 0x80084523, &(0x7f0000001f40)=""/231) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) (async) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) flock(r3, 0x2) (async) unlink(&(0x7f0000000100)='./file0\x00') r4 = socket$can_j1939(0x1d, 0x2, 0x7) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x1, 0x70bd29, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4f246}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x60000090) (async) sendmsg$nl_route(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="380000001800010000000000000000000200000000000006000000000c00090008"], 0x38}}, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000340)={0x1d, r6, 0x0, {0x0, 0xff, 0x6}, 0xfe}, 0x18) (async) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000540)={0x0, 0x0}, 0x8) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') getdents64(r8, &(0x7f0000000240)=""/44, 0x7a) (async) getdents64(r8, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x1c, &(0x7f0000000300)=@raw=[@jmp={0x5, 0x1, 0x0, 0x7, 0x3, 0xfffffffffffffff0, 0xfffffffffffffff0}, @map_val={0x18, 0x6, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x7fff}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8001}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9}, @printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}}, @map_val={0x18, 0x2, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x40}], &(0x7f0000000400)='GPL\x00', 0x81, 0x58, &(0x7f0000000440)=""/88, 0x41100, 0x89, '\x00', r6, @fallback=0x18, 0xffffffffffffffff, 0x8, &(0x7f00000004c0)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000500)={0x0, 0xb, 0x1, 0x7}, 0x10, r7, 0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000580)=[{0x2, 0x2, 0x40005, 0x7}], 0x10, 0xffffffff}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) r9 = openat$cgroup_ro(r8, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x0, 0x0) readv(r9, &(0x7f0000000040)=[{&(0x7f0000001640)=""/228, 0xe4}], 0x1) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan1\x00'}) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000000)={0x200000, 0x200000, 0xa, 0x0, 0x8}) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r10, 0x400448df, 0x0) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x24, 0x2d, 0x107, 0xfffffffe, 0x2000001, {0x2, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x16, 0x0, 0x0, @uid}]}, @nested={0x4, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4c855}, 0xc800) 22.640217924s ago: executing program 3 (id=1519): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x77, 0x101301) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f0000000000)=[@in={0x2, 0x4e22, @private=0xa010102}], 0x10) ioctl$USBDEVFS_FREE_STREAMS(r0, 0xc0105500, &(0x7f0000000000)=ANY=[@ANYBLOB="a1"]) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x18, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000030feffff720af0fff8ffffff61a4f0ff000000002d040000000000003d400300000000006504000001ed000079130000000000006c440000000000007a0ab0fe000000007b13d00000000000b5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e94af05000000f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a715bc5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128c4e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e655400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d0800af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d390dd65be2467b373eafd9aa58f2077184b6a89adaf17b0a6041bdef728d236619074d6ebdf098bc908f523d228a40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c5da18ec0ae564162a27afea62d84f3a10746443d64364f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b93d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6ffc3a15d96c2ea3e2e04cfe0e669e51731b2875353193f82ade69d0540059fe6c7fe7cd86975023cb08cc7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c5538a294270a1ad10c80fef7c24c87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead35a655e0b4a26b702396df7e0cbe02b6e4114f244a9bf93f05beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba5823a34a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b728fe26e37037f27f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d0a874c74b777df005c55fc30511d00000000c85265b2bd83d64a532869d708000000000000007baa5b6a682b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a56edbd287eba77f35c35d91f3c62a0ca74836a640224de85f2b4a5fee500bbc584328a6a7a4628c4378c9b71dff64075b74a6520adb187b40d2cccbcb08c0634ee74658d3e23bf511c8b0bf1b69d2b3782b3f481c314e7bd4615dbbf24c06ac95bd639e68d0e6aa7f0d07bf69a93365f803f0144af37236ea133c2255b0613bf8ba1d538e06c2411e8d70053b712084fd0e313de9bb19266e49a3a2190cb039c6f89610acd896319b9c8d1b8aac2eaa5a4f8be7419a09e3fb5be3be2fcdadd2299839cc40e684e6e2b4e1385fde7a0babcb0be672110268a34dad364fddee69e564119cebb6940c6356ff83ca527c573d700000000000000c6299263e6d9097f225de969485bce3d7dc471c0669bb6a467cf0de54dfcc1857048fe22a19dbb1b3cb9babaa839f1f6e817a62d95a5b971ff96a5c66c338c6f2a2da4644519f40761402e9c81013d76c7152c95ba5efa24ce1930f23a2277f057ffb6b0144f3b434a2adc456ef4d2fbdf7c6238c2bb00ffcf2d23d68cb9b027f3b225ec4e09b089f7956b66c5692b46ea03abb6a404c8ccceaa4ba4161409fcb54b86eaca26b2a0c4b81f7b71cbfcef"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) 22.561156357s ago: executing program 3 (id=1520): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) (async) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0], &(0x7f0000000380), 0x2, r2, 0xcccccccc}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000580)={0x601, 0x1, &(0x7f0000000180)=[r2], &(0x7f00000000c0)=[0x3], &(0x7f0000000640)=[r4, r4, r3], &(0x7f0000000340), 0x0, 0xfffdffffffffffff}) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x4, &(0x7f0000000000)=@framed={{}, [@alu={0x7, 0x0, 0x3, 0x0, 0x0, 0x1, 0xffffffffffffffff}]}, &(0x7f00000000c0)='syzkaller\x00', 0x7}, 0x94) 22.56077221s ago: executing program 3 (id=1521): mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) read$FUSE(0xffffffffffffffff, &(0x7f0000000c40)={0x2020, 0x0, 0x0, 0x0}, 0x2020) mount$9p_virtio(&(0x7f0000000000), &(0x7f0000000040)='./file1\x00', &(0x7f0000000100), 0x100000, &(0x7f0000002c80)={'trans=virtio,', {[{@cachetag={'cachetag', 0x3d, '+'}}, {@version_L}], [{@audit}, {@audit}, {@seclabel}, {@fsname={'fsname', 0x3d, '9p\x00'}}, {@dont_hash}, {@fowner_gt={'fowner>', r0}}, {@pcr={'pcr', 0x3d, 0x12}}]}}) chdir(&(0x7f0000000080)='./file0\x00') r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/warn_count', 0x88000, 0x1) read$alg(r1, &(0x7f0000000e00)=""/59, 0x3b) write$tcp_congestion(0xffffffffffffffff, &(0x7f00000000c0)='lp\x00', 0xfffffdef) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) membarrier(0x10, 0x0) syz_clone3(&(0x7f000000dd80)={0xa00400, 0x0, 0x0, 0x0, {0x2}, 0x0, 0x0, 0x0, 0x0}, 0x58) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000002d40)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r2, &(0x7f0000004d80)={0x18, 0x0, r3, {0xfffffffffffffffc}}, 0x18) creat(&(0x7f0000000080)='./file1\x00', 0xec) 22.490853224s ago: executing program 3 (id=1522): timer_create(0x7, &(0x7f0000000080)={0x0, 0x11, 0x2}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(&(0x7f0000000400)=@filename='./dev\x00', &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040300880000001010203010902200001010080320904000002ff0000000705010240000007058202400000"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x8, '\x00\x00\x00\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000540)=ANY=[@ANYBLOB="4005080000009c0c11cc8436dfc69ff74bc5139d3f2b4c6b8cf292648a6a8c3883505762068da5721d9a7fa7103265ee16c91af2ceb58ebcc427014ef61c1c529b957e87fece81db04b497765a6f0e860c1e65d7ce9b632f182c9096958910d9ff39945f953ce3e0b2cba736b188fdd2f0aa94292574245bfd45d3cd9a898b48574003fcfbae63dde92c38e026185483f38f3a587679ac26134d293064058b8c529e7c4c6c5e00"/178], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x8, '\x00\x00\x00\x00\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r1, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000001c0)=ANY=[@ANYBLOB="402208005222307e000159830002000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) nanosleep(&(0x7f0000000700)={0x1}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./dev/ttyUSB0\x00', 0x2, 0x0) close(r2) r3 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da", 0x33}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmmsg$unix(r3, &(0x7f0000003900), 0x0, 0x40000041, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) r5 = landlock_create_ruleset(&(0x7f0000000080)={0xc0d8, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r5, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x81c0, 0x0) r6 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r6, 0x0) r7 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x1, 0x0) ftruncate(r7, 0x1) openat(r2, &(0x7f00000002c0)='./dev\x00', 0x40, 0x8) r8 = openat$hpet(0xffffffffffffff9c, &(0x7f0000002140), 0x40000, 0x0) waitid$P_PIDFD(0x3, r8, 0x0, 0x4, 0x0) read(r4, &(0x7f00000000c0)=""/250, 0xfa) 21.979649017s ago: executing program 3 (id=1535): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e1d, 0x9, @local, 0x2}, 0x1c) connect$netlink(r1, &(0x7f00000000c0)=@unspec, 0xc) syz_emit_ethernet(0x4e, &(0x7f0000000180)={@random="5b685c7e778f", @multicast, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, '\x00', 0x18, 0x11, 0x0, @local, @local, {[], {0x4e1d, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x6}}}}}}}, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x1}]}, 0x10) bind$bt_hci(r2, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) 21.916034889s ago: executing program 34 (id=1535): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e1d, 0x9, @local, 0x2}, 0x1c) connect$netlink(r1, &(0x7f00000000c0)=@unspec, 0xc) syz_emit_ethernet(0x4e, &(0x7f0000000180)={@random="5b685c7e778f", @multicast, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, '\x00', 0x18, 0x11, 0x0, @local, @local, {[], {0x4e1d, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x6}}}}}}}, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x1}]}, 0x10) bind$bt_hci(r2, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) 14.826297785s ago: executing program 2 (id=1637): epoll_create1(0x0) (async) r0 = epoll_create1(0x0) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000000), &(0x7f0000000040), 0x2, 0x0) (async) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000000), &(0x7f0000000040), 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) syz_extract_tcp_res(&(0x7f0000000080)={0x41424344}, 0x5, 0xfffffe02) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f0000000680)={0x1, 0x43}, 0x2) (async) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f0000000680)={0x1, 0x43}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f0000000000)={0x0, 0x78}, 0x2) (async) write$USERIO_CMD_REGISTER(r4, &(0x7f0000000000)={0x0, 0x78}, 0x2) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f0000000080)={0x1, 0xa8}, 0x2) syz_extract_tcp_res$synack(&(0x7f0000000180)={0x41424344}, 0x1, 0x0) syz_emit_ethernet(0x279, &(0x7f0000000600)={@broadcast, @dev, @val={@void, {0x8100, 0x2, 0x0, 0x2}}, {@ipv6={0x86dd, @tcp={0x0, 0x6, "3a904c", 0x23f, 0x6, 0x1, @private2, @dev={0xfe, 0x80, '\x00', 0x29}, {[@hopopts={0x6, 0x25, '\x00', [@generic={0x9, 0xe7, "0eea66df6860acbfead1f1b016604826e82a51e501fdb734cc0696e583686b4071510ec99733a2ad050b9bb13e8717a0af3722ad88ca431a653b0e6b8bc371ad21803035057f643c3408f28e64e745faeeb6dd0fb8aba88cbc4c4d6fa27920da7eb020e15471b84b7f6a62db9de6e4a5ddb8b1e0128e6fcaf3b976b14a277b2f3b1192f27b83760e4f5916ef7f0133e61a62e406b5e8bfe35505e24b50e14b94c2092caa8a38d59826e1e9337d2bc625fa2de2404cb64474db31e08e3868f59742409edce877e1c805b345697393f71789d505b9840a58fd14fd0446594e9c00d6be79b06e9c92"}, @jumbo={0xc2, 0x4, 0x6}, @pad1, @calipso={0x7, 0x30, {0x1, 0xa, 0x1, 0x3, [0x5, 0x100, 0x7, 0x1, 0xd136]}}, @jumbo={0xc2, 0x4, 0x6}]}], {{0x4e22, 0x4e21, r3, r5, 0x1, 0x0, 0x11, 0x10, 0xd, 0x0, 0x2, {[@fastopen={0x22, 0x2}, @sack={0x5, 0xa, [0x10000, 0x7]}, @md5sig={0x13, 0x12, "a1a9281ac5d514be0255a3c68daaa23b"}, @window={0x3, 0x3, 0x5}, @sack={0x5, 0xe, [0x7, 0x0, 0x4]}]}}, {"b2bca7e5f9a0e178d92f5c0fceb5cade0438876c7dadb8d548f1a56d6b7ccb8ec3313ae00c4348e5c24c3632fc0cdea873d28941f0f96b063a59fd2655f13a80498ba035ed0aac5ceba6d333a32f48e72a8f9beaa53391d274b82b4a2f06f29f433aba0cc5770eaacfc881372bd4125bccb3064d13f27f57b8e31f260c76cf6c56934c193745d36bffa10a596f3cee3beffc3e4a5934a26edabf635f197cc8b25c2f1eb62395d52c9b0cff225f7b6b0312d6fac265840d61c465f221cff2a0b5027c0a"}}}}}}}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)={0x20, r2, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x4}, @ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x20}}, 0x0) 14.709716706s ago: executing program 2 (id=1640): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_emit_vhci(&(0x7f00000024c0)=ANY=[@ANYBLOB="05c9"], 0xe) mount$fuse(0x0, 0x0, 0x0, 0x80, &(0x7f0000000180)=ANY=[@ANYBLOB="017969855b1bc3daf1d6aae2b3df000000d13288d006b658b23012159b0d0e5da0a9223d92740c0936bf372f8beb421411d63742d6e1dedc42c3f28ffdf37badfe6fa36536022e705de648bba35fa6"]) r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007c, 0x0) r2 = dup3(r0, r1, 0x0) ioctl$MON_IOCG_STATS(r2, 0xc0109207, &(0x7f00000001c0)) 13.338844423s ago: executing program 2 (id=1663): mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0) pivot_root(&(0x7f0000000040)='./sys/bus/nd/devices/region0/dax_seed/file0\x00', &(0x7f0000000080)='\\\\127.0.0.1\\share\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/bus/nd/devices/region0/pfn_seed\x00', 0x0, 0x0) read(r0, &(0x7f0000000100), 0x40) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/nd/devices/region0/dax_seed\x00', 0x0, 0x0) read(r1, &(0x7f0000000300), 0x40) close(r1) setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r2, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0x4, &(0x7f0000001a40)=@framed={{0x18, 0x0, 0x0, 0x0, 0xc4f, 0x0, 0x0, 0x0, 0xfffffffc}, [@ldst={0x2, 0x1, 0x3, 0x1, 0x0, 0x40, 0xfffffffffffffff0}]}, &(0x7f0000000180)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x18, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r3, 0x0, 0x0, 0x0, 0x10, 0x4a7}, 0x94) mount(&(0x7f0000000200)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='cifs\x00', 0x0, 0x0) 13.257726019s ago: executing program 2 (id=1666): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x49}, 0x94) (async) socket$inet(0x2, 0x3, 0x2) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) pipe2(&(0x7f0000000000), 0x800) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000040000004000000005"], 0x48) (async) socket(0x10, 0x803, 0x0) (async) syz_io_uring_setup(0xefd, &(0x7f0000000400)={0x0, 0x0, 0x400, 0x2, 0x55}, 0x0, 0x0, 0x0) (async) socket(0x10, 0x3, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) (async) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) (async) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{}, 0x0, &(0x7f0000000200)=r2}, 0x1e) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000180)={0x100, 0x0, &(0x7f00000000c0), &(0x7f0000000280)=[0x91a7, 0x7ff, 0x4, 0x100, 0x6, 0x1, 0xfff], &(0x7f0000000200), &(0x7f0000000300)=[0x7, 0xffffffffffffff11, 0x7f, 0x76a4]}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000800000000000090900010073797a300000000009f3020073797a300000000094000000060a010400000000000000000100000008000b40000000006c000480340001800b00010065787468647200002400028008000140006f54b2b6b41f549000000608000440000000220500020007000000340001800c0001006269747769736500240002800800034000000002080001400000000d080002400000001208000640000000040900010073797a3000000000140000001100010000000000000000000300000a"], 0x108}}, 0x0) mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0) (async) prlimit64(0x0, 0x9, &(0x7f0000000000)={0xfffffffffffffffb, 0xfffffffffffffffb}, 0x0) (async) mremap(&(0x7f000016c000/0x4000)=nil, 0x4000, 0x40000000, 0x3, &(0x7f000063c000/0x3000)=nil) (async) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/power/pm_wakeup_irq', 0x40, 0x101) (async) io_setup(0x6, &(0x7f0000003b80)=0x0) io_submit(r4, 0x2, &(0x7f0000000280)) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/failslab/times\x00', 0x22480, 0x28) read$FUSE(r5, 0x0, 0x0) (async) r6 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_TSC_KHZ_vm(r7, 0xaea2, 0x9) (async) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) r8 = open$dir(0xffffffffffffffff, 0x4d8403, 0x20) move_mount(r8, &(0x7f0000000340)='./debug\x00', r3, &(0x7f0000000380)='./debug/failslab/times\x00', 0x26) 13.191110954s ago: executing program 2 (id=1668): mknodat$loop(0xffffffffffffff9c, 0x0, 0x20, 0x1) ioctl$CEC_TRANSMIT(0xffffffffffffffff, 0xc0386105, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='omfs\x00', 0x208000, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/devices/system/clocksource/clocksource0/current_clocksource\x00', 0x2, 0x0) write(r1, &(0x7f00000000c0)='jiffies', 0x7) r2 = mq_open(&(0x7f0000000180)='&\xaf\x12}N\xf3oW\'\x00', 0x9998bdb00e53b971, 0x80, 0x0) close_range(r2, r0, 0x0) mq_notify(r2, &(0x7f0000000000)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./proc\x00', &(0x7f0000000600)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./proc/sys/net/ipv6/conf/syz_tun/addr_gen_mode\x00', 0x1, 0x16) write$binfmt_misc(r3, 0x0, 0x0) mq_timedsend(r2, &(0x7f00000001c0)="205a03990a1b1f5b5628ec85a7e3ae8e20d6c63d2aee177ba3318b4c8bef5e4d0d91112f8bf40bd896b4a5d18dc85f3e35698641d5c75e9a6f3bfb74821c58a3081ca8952623e400f472a32b", 0x4c, 0x48000000000, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$poke(0x1, r4, &(0x7f0000000000), 0x2) preadv2(r0, &(0x7f0000000400)=[{&(0x7f0000000100)=""/29, 0x1d}], 0x1, 0x9, 0x6, 0x5) 13.121160955s ago: executing program 2 (id=1672): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x200) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x5, 0x20010, r0, 0x3a014000) ioctl$SG_GET_ACCESS_COUNT(r0, 0x2289, &(0x7f0000000100)) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r1, 0x3b86, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r2, 0x0, 0x0, 0x0}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000002740)={&(0x7f00000026c0)={0x20, r5, 0x303, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x20}}, 0x8800) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r1, 0x3ba0, &(0x7f0000000800)={0x48, 0x3, r3, 0x0, 0x1004000, 0x1000, &(0x7f0000ffc000)}) 2.582009127s ago: executing program 5 (id=1798): mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:1d.0/remove\x00', 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000003000000000000000200000d0000000000000000020000000100000002000000000000000000000500000000002e"], 0x0, 0x43, 0x0, 0x1}, 0x28) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4090}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800034000000130140000001100010000000000000000000100000a5264a32a3285d13de2d204aa402344dafa6a6e6bff490a80e9adf124fda9e2d43ab7b10905f7e0e0c0bc14e31eab1f88695dffb983c778c62769e9f5c0b69850127af5357c868ddd52d23036c9abb39bfb5de297fe75a9c2292d5805597a23f0406e91ba6d4d6a2a4ad89cba996da83900a9bdab0645"], 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x108, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0xdc, 0x3, 0x0, 0x1, [{0xd8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0xc6, 0x6, 0x1, 0x0, "c8392bad9591965c3292943fe63fdc5a5f0f90fa0f4be81783ced8b395df0d4849d9f498e0735092dd04696bc753b64f948fef0c98b1d73e8cc36dee2359d46912ac1cae736ac0f688a8eb7b14d35248099c9b2558bd63d2ba4a974e46571c6baf1eff66c0bbd7739410aebaf5f4b1589c76e152df7910e48e59253df698257bf076cc366232ca81c02db7a9c38a0cfea8d3e370803c6cbe02f687c85b69908b0f60d0053a31ac138722659955fa9188c2232f5dcc8ea5bd2ed8f726a92bc264f039"}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x130}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000200)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r4, 0x3b88, &(0x7f0000000280)={0xc, r5}) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r4, 0x3b70, &(0x7f0000000140)={0x13, 0x0, 0x0, 0x0, {}, {{}, 0x0, 0x0, [{}]}}) r6 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r6, 0x8955, &(0x7f0000000000)={{0x2, 0x4e23, @multicast1}, {0x1, @multicast}, 0x3d, {0x2, 0xe20, @empty}}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e20, 0x5, @loopback, 0x8}}, 0xfffffffe, 0x2, 0x7fffffff, 0x5, 0x40, 0x7, 0x1}, &(0x7f0000000240)=0x9c) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000280)={r7, 0x9}, &(0x7f00000002c0)=0x8) write(r0, &(0x7f0000000400)='1', 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys\x00', 0x503, 0x0) write(r8, &(0x7f0000000800)='1', 0x1) 2.575547285s ago: executing program 5 (id=1799): r0 = socket(0x200000000000011, 0x2, 0xd) bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000080)="95", 0x1) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000300)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='vegas', 0x5) write$binfmt_script(r1, &(0x7f0000000200), 0xfffffd9d) socket$nl_route(0x10, 0x3, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/mpls/platform_labels\x00', 0x1, 0x0) write(r2, &(0x7f0000000100)='100', 0x3) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="2c0000001800050400000000000000001c140000fe0000010000000008000100000101000800040001"], 0x2c}}, 0x0) syz_extract_tcp_res(&(0x7f0000000040)={0x41424344}, 0x5, 0x8001) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) setitimer(0x2, 0x0, &(0x7f0000000180)) syz_emit_ethernet(0x4e, &(0x7f00000000c0)={@multicast, @remote, @void, {@ipv4={0x800, @tcp={{0xb, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x5, 0x0, @rand_addr=0x64010100, @private=0xa010100, {[@ssrr={0x89, 0x3, 0xd1}, @ssrr={0x89, 0x13, 0x73, [@remote, @multicast1, @multicast1, @multicast1]}]}}, {{0x0, 0x0, 0x41424344, r4, 0x0, 0x6, 0x5}}}}}}, 0x0) 1.806321855s ago: executing program 5 (id=1803): mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0) (async) sigaltstack(&(0x7f0000000240)={&(0x7f0000001c00)=""/4095, 0x80000000, 0xfff}, 0x0) (async) r0 = socket$inet_smc(0x2b, 0x1, 0x0) (async) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) (async) r1 = syz_create_resource$binfmt(&(0x7f0000000100)='./file1\x00') r2 = openat$binfmt(0xffffffffffffff9c, r1, 0x42, 0x1ff) close(r2) execveat$binfmt(0xffffffffffffff9c, r1, 0x0, &(0x7f0000004780)={[], 0xf000}, 0x1000) truncate(&(0x7f0000000000)='./file1\x00', 0x6) (async) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, 0x0, &(0x7f0000003500)=0x1e) (async) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000080), 0x4) (async) openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) alarm(0x80000001) (async) timer_settime(0x0, 0x1, &(0x7f0000000080)={{r4, r5+10000000}}, 0x0) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r7 = syz_clone(0x178ae72b0cb9b7d2, &(0x7f0000000440)="01334d17a8766ea46a138b90a9abd8fb8f03a109eca66d3711c90b3ba62082837a7d59b73032b97c36109188581e16f8e70df793267a1c21f15bb7aade63c70ea989a1f286e78d6cc68e5d783956611465ce6a679613cb000000000000000051f41138dbe4ed0dc08deebb5f16ae5a1b1acf937197de4c241263e4ce7db13a4fa5b523e36b4ce9ac296783d01ed6b24b25e486664e8ae4fdd69ccccac647b92a001d8411e43ae33c7a5c2ab7f25f2e6ecdd0eac85edc72302dfa2127cf8fc874dc1f40414649d22c9f4a9dac2e21921f62c94e15ee7af0b60100000063d6d679d1e8393fc0e9b21d8adcc905c4295de1d7d549", 0xf3, &(0x7f0000000180), &(0x7f0000000140), &(0x7f00000005c0)="6e8cadffc70bd860d14352458ae185d89beef11e43d4041f27c0b13e693c6d01c19c4321a8789acc90ef5e407689012ec6e17e409840b7210a494904c49e181f4cc0dc7efbc437fea2a0517d75950cde8592acc0dc2bc1b22f282a8245d687e0b54de967b6b5f36c3f8f3b93d510e3c809984584fc425079308a37768ff3440e4219f32596da1aa271cb18b6ef714295eaa3ff00416713a0f8ba3530d60193f5c04e773a57e242d7973bb42a7e73992698e6fe859c89d2b897329ac3857e39fab4b2cb9528115324546972738361ace04bdd4a829469fce374b44f1ac3b71de5c870ce6fe962b82773a4fa8067c72e807142272503126687e0eba125c71b3f278c9bdc05dd9429c7c6d592c7e90eafa8186701358ab93ae622295ecf5d7ffd4f5ab8fdf2475e9e453a1e5c11dffc8a3540a90f907a448b3a6e664596462376c7bf4f04b61f333983218a7ec3acdd6a8e6387465aa9dea42f2149815b28b7be8effbb4fabf073ad43563d66a51bc0923f2a59d2378ebbf53a24aca86a760000") (async) r8 = syz_open_dev$sg(&(0x7f0000000600), 0x1, 0x840) futex_waitv(&(0x7f0000002dc0)=[{0xe, 0x0, 0x2}, {0x2, 0x0, 0x2}, {0x6, 0x0, 0x82}, {0x4, 0x0, 0x2}, {0x200, 0x0}, {0x10, 0x0, 0x82}, {0x0, 0x0, 0x82}, {0x4, 0x0, 0x2}, {0x7fff, 0x0, 0x2}, {0x100000001, 0x0, 0x2}, {0x57e6, 0x0, 0x82}, {0x8000, 0x0, 0x2}, {0x5, 0x0, 0x2}, {0x7, 0x0, 0x2}, {0x8, 0x0, 0x2}, {0x4, 0x0, 0x2}, {0x7, 0x0, 0x82}, {0xfff, 0x0, 0x2}, {0x6, 0x0, 0x2}, {0x1, 0x0, 0x2}, {0x7, &(0x7f0000002140)=0x8, 0x2}, {0x80, &(0x7f0000002180), 0x2}, {0x9, &(0x7f00000021c0)=0xe, 0x2}, {0x3, &(0x7f0000002200)=0x7cd1de08, 0x82}, {0xb8, &(0x7f0000002240)=0x7, 0x2}, {0x9, &(0x7f0000002280)=0x9ff, 0x82}, {0x7fffffffffffffff, 0x0, 0x82}, {0xfffffffffffffffd, 0x0, 0x86}, {0x769, &(0x7f0000002380)=0xffffffffffffffff, 0x2}, {0x1, 0x0, 0x2}, {0xfffffffffffffff8, 0x0, 0x2}, {0x5, 0x0, 0x2}, {0xfffffffffffffff9, 0x0, 0x82}, {0x2, &(0x7f00000025c0)=0x4, 0x2}, {0x5, &(0x7f0000002600)=0x4, 0x2}, {0x6c558f26, &(0x7f0000002680)=0x10001, 0x2}, {0x7, &(0x7f0000002700)=0x4, 0x82}, {0xffffffffffffffff, 0x0, 0x82}, {0x6, 0x0, 0x82}, {0x8, &(0x7f0000002840)=0xffff, 0x2}, {0x768d, 0x0, 0x2}, {0x265, 0x0, 0x2}, {0x7fffffff, &(0x7f0000002900)=0xa, 0x82}, {0x84, &(0x7f0000002940)=0xa60, 0x82}, {0x9, 0x0, 0xec5aba831a7e1e25}, {0x9, 0x0, 0x82}, {0x4, 0x0, 0x2}, {0xdef, &(0x7f0000002b00)=0x3, 0x80}, {0x6f, &(0x7f0000002b40)=0x5}, {0x100000001, &(0x7f0000002b80)=0x5, 0x2}, {0x0, 0x0, 0x2}, {0x0, 0x0, 0x82}, {0x1, &(0x7f0000002c40)=0x200, 0x2}, {0x6, 0x0, 0x82}], 0x36, 0x0, &(0x7f0000003680), 0x0) (async) ioctl$SG_BLKTRACETEARDOWN(r8, 0x1276, 0x0) mq_notify(r6, &(0x7f0000000580)={0x0, 0x12, 0x4, @tid=r7}) (async) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) (async) r11 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r11, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d080c30000000e8fe55a1190015000600142603600e120900400000000401a80016000a0004400a080000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x4) timer_settime(r3, 0x1, &(0x7f00000000c0)={{r9, r10+60000000}, {0x0, 0x989680}}, 0x0) 1.743956444s ago: executing program 5 (id=1806): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000007d00)}, 0x1d228f225720b5a6) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYRES16=r4, @ANYRES8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r8 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r5, r7}, 0x14) syz_emit_ethernet(0x4a, &(0x7f00000008c0)=ANY=[@ANYBLOB="000000000000fffff8ffffff86dd67acda00140600fe880000000000000000000000008101fc0000000000000000000000000000014e204e24666f725acf78cac08600ad5566e506f6aed73a157898ccb42fff4bc3379d15543fb1938228c81ca8a3af167ca0e6025b0c1425e3e00be1a85ebd6f25b9780ee4831f8fe3669efb065cb3cad1f5489708a07942998f10d19e59629e14a16094ae2c402215a6c08f2d99d9ddfe5e21b50ed8ac97860b", @ANYRES8=r8, @ANYRESDEC=r2, @ANYRESHEX=r4], 0x0) r9 = socket$inet(0x2, 0x2, 0x0) bind$inet(r9, &(0x7f0000000000)={0x2, 0x6f00, @loopback}, 0x10) r10 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r10, 0x1, &(0x7f0000000200)='vers\x00', &(0x7f0000000240)='4.0\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r10, 0x1, &(0x7f0000000280)='addr\x00', &(0x7f00000002c0)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r10, 0x1, &(0x7f0000000300)='source\x00', &(0x7f0000000340)='.0.1:?expZ?\x83\xf2\'Dk\xcb\xa4', 0x0) fsconfig$FSCONFIG_SET_STRING(r10, 0x1, &(0x7f0000000380)='proto\x00', &(0x7f00000003c0)='udp\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r10, 0x1, &(0x7f0000000400)='mountproto\x00', &(0x7f0000000440)='udp\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r10, 0x1, &(0x7f0000000480)='clientaddr\x00', &(0x7f00000004c0)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r10, 0x6, 0x0, 0x0, 0x0) (async) recvfrom$inet(r9, &(0x7f0000000500)=""/100, 0x64, 0x0, &(0x7f0000000600)={0x2, 0x0, @empty}, 0x10) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.171959455s ago: executing program 6 (id=1813): setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x5411, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x100, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000002090000850000004300000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r3}, 0xc) r4 = socket$inet6(0xa, 0x2, 0x3a) sendto$inet6(r4, 0x0, 0x0, 0x2004c080, 0x0, 0x0) r5 = socket$inet6_icmp(0xa, 0x2, 0x3a) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x4e21, 0xc4, @ipv4={'\x00', '\xff\xff', @loopback}, 0x8}, 0x1c) r6 = syz_open_procfs(0x0, &(0x7f0000000300)='net/icmp6\x00') preadv(r6, &(0x7f0000003fc0)=[{&(0x7f00000003c0)=""/252, 0xfc}, {&(0x7f0000000ac0)=""/78, 0x4e}], 0x2, 0x9, 0x7ffffffe) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r7 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r7, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r8 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r8, &(0x7f0000000000)=@in={0x2, 0x3210, @loopback}, 0x80) listen(r8, 0x5) write$tun(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000a00"], 0x4a) r9 = socket$pppoe(0x18, 0x1, 0x0) close(r8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000276000/0x2000)=nil, &(0x7f00006f5000/0x2000)=nil, &(0x7f000006a000/0x2000)=nil, &(0x7f0000797000/0x2000)=nil, &(0x7f00001a6000/0x1000)=nil, &(0x7f00004c4000/0x2000)=nil, &(0x7f0000509000/0x3000)=nil, &(0x7f00005d6000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000490000/0x3000)=nil, &(0x7f0000112000/0x3000)=nil, &(0x7f0000000000)="20829c86388fca5f33107a5ec23fecbe43006f3bc0510c4db26d7863fe1e6cea89866d5fa2fa0718ea6d47baf242f769ab5fab50c634595efdfc86ffd09758c5d1eb24358c8e9fd64466d4e3640581400de7da0605e9933ec9a53f", 0x5b, r9}, 0x68) 822.399072ms ago: executing program 6 (id=1814): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfdffa000) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) (async) setns(0xc9, 0x0) (async) io_setup(0xb, 0x0) (async) socket(0x40000000015, 0x5, 0x0) (async) r4 = gettid() sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0xa23, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_PID={0x8, 0x52, r4}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008880}, 0x20000084) 822.068845ms ago: executing program 5 (id=1815): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) ioctl$VIDIOC_TRY_FMT(0xffffffffffffffff, 0xc0d05640, &(0x7f0000000280)={0x4, @win={{0x6123, 0x9, 0x8, 0x2}, 0x8, 0x1, &(0x7f0000000000)={{0x101, 0x8, 0x10000000, 0x9}}, 0x2, 0x0, 0x9}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x48815, 0x50103}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) prctl$PR_GET_NAME(0x10, &(0x7f0000000040)=""/38) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) 698.587385ms ago: executing program 5 (id=1816): socket(0x10, 0x803, 0x0) (async) r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r1, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x9}}]}}]}, 0x48}}, 0xc840) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000800)=@newtfilter={0x44, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x6}, {0x0, 0xa297ccb6650fc8bd}, {0x7, 0xfff1}}, [@filter_kind_options=@f_u32={{0x8}, {0x18, 0x2, [@TCA_U32_SEL={0x14, 0x5, {0xf, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0xb709, 0x58f}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4884}, 0x24040084) recvmmsg$unix(r0, &(0x7f0000000580)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000002c0)=""/219, 0xdb}], 0x1}}], 0x1, 0x60, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xfffffffffffffdc9, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, 0x0, {0xffff}, {0x9, 0x3}, {0xfff2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20040098}, 0x880) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0xfffffffffffffc3a, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[], 0xc3}, 0x1, 0x100000000000000, 0x0, 0x2000}, 0x40400c0) sendto$inet6(r0, &(0x7f0000000440)="c7a8129b0f41060756913ac6e2410a95afd070f02b04726385cfc7bd54f62a5f784ea25c254019a76182d776f7ce8e5303a8e871adb55df6eadc3fc092c00719c9bf60a7111fc0acbf72e0451fec4dd940b27959f72ba563ea97b286f3f9042f0f8281fd170b45dd231a25", 0x6b, 0x4, &(0x7f00000004c0)={0xa, 0x4e20, 0x5, @remote, 0x400}, 0xfffffffffffffe34) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x7000000) capset(&(0x7f0000000040)={0x20080522, 0xffffffffffffffff}, &(0x7f0000000080)={0x0, 0x2, 0x4, 0x0, 0x20000, 0x4}) pipe2$watch_queue(&(0x7f00000002c0), 0x80) (async) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = socket$kcm(0x29, 0x2, 0x0) recvmsg$kcm(r5, &(0x7f0000001800)={0x0, 0x0, 0x0}, 0x40000000) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r4, 0x5760, 0x5e) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x67) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x67) write$P9_RLOCK(0xffffffffffffffff, &(0x7f00000003c0)={0x8, 0x35, 0x2, 0x1}, 0x8) (async) write$P9_RLOCK(0xffffffffffffffff, &(0x7f00000003c0)={0x8, 0x35, 0x2, 0x1}, 0x8) r6 = openat$pmem0(0xffffffffffffff9c, &(0x7f0000000080), 0x10000, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) r7 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCALLUSERDATA(r7, 0x89e5, &(0x7f00000001c0)={0x75, "d3e96f57555f5f18513ebfdd1ef90f8dfc772693e9f8e46909c8d4b62787cc4fdf615ffde1bba22c3ae4859df02af000cec5ebdef01a5c9a4dc200aeed53ee16bac1ae9108a64270077c0382f493b40ba4f79292e5adbcc6479bba03355c4e857b929c0d156014681e69e8bc73e5c283e4bc747951571ed819967907d6376af3"}) (async) ioctl$SIOCX25SCALLUSERDATA(r7, 0x89e5, &(0x7f00000001c0)={0x75, "d3e96f57555f5f18513ebfdd1ef90f8dfc772693e9f8e46909c8d4b62787cc4fdf615ffde1bba22c3ae4859df02af000cec5ebdef01a5c9a4dc200aeed53ee16bac1ae9108a64270077c0382f493b40ba4f79292e5adbcc6479bba03355c4e857b929c0d156014681e69e8bc73e5c283e4bc747951571ed819967907d6376af3"}) ioctl$BLKGETNRZONES(r6, 0x80041285, &(0x7f00000000c0)=0x1ff) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c03000000060108000000002333eb94b169408a9368bb08110003f4676173683a69702c706f7274000000000900020073797a31000000000500050002050000090000000000000005000100"], 0x4c}, 0x1, 0x0, 0x0, 0x44000}, 0xe4016) (async) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c03000000060108000000002333eb94b169408a9368bb08110003f4676173683a69702c706f7274000000000900020073797a31000000000500050002050000090000000000000005000100"], 0x4c}, 0x1, 0x0, 0x0, 0x44000}, 0xe4016) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000090601020000000000000000020000000900020073797a31000000000500010007000000280007800c00018008000140ffffffff0500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000883}, 0x80) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="540000000a0601020000000000000000020000000900020073797a310000000005000100070000002c0007800c00018008000140ffffffff0500070029000000060004404e2100000c00028008000140"], 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) 652.249831ms ago: executing program 0 (id=1817): r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000000)={0x5}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000180)={0x5, 0x0, 0x3}) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000300)=0x8df, 0x4) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0xffffff1f, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x310bb}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x30082, 0x22}}}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000081}, 0x24008000) r2 = syz_open_dev$vim2m(&(0x7f0000000280), 0x4eb36, 0x2) ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x0, 0xfdfd, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) 519.525058ms ago: executing program 0 (id=1818): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="200000006800e97802000000000000000a0000000000000008000500", @ANYRES32=r3], 0x20}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x804) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x10, 0x0, 0x0, 0x4, 0x0, 0x1, 0x20000000}, [@RTA_NH_ID={0x7, 0x1e, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="440000006c00100027bd7000fedbdf2500000000", @ANYRES32=r3, @ANYBLOB="00a202002020000024000e000e00000000000000ffffff7f00000094ba37d18927c12000b63000c7000000007f5a4febdfa6aa5a6f981278fdc517ff2f497104abb2e03fa6c1b9d1c2fb42783789f46f46fee3fd1fca2e9c0493e2eaa79aeaf62b124383e0944316a0c2e18d858ed77d72dd93a9b6d471f1d5c1f2f7447db922e626d9ca93af7e8a7bd7bb463f395ee27a7cabdc6df573a5f5e72411946dc9354380060854cf3196c45e732987d0e40263f54aad9e7e42e55fcf2caae4537ab80d37de12ee5b136080"], 0x44}}, 0x0) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x6, 0x0, 0x700, 0x0, 0x18, {[@eol]}}}}}}, 0x3a) 381.740295ms ago: executing program 0 (id=1819): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000001c0)={'gretap0\x00', &(0x7f0000000180)={'gre0\x00', r2, 0x80, 0x20, 0x8, 0x2, {{0x6, 0x4, 0x1, 0x8, 0x18, 0x65, 0x0, 0x80, 0x0, 0x0, @multicast1, @rand_addr=0x64010101, {[@ra={0x94, 0x4}]}}}}}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=@delqdisc={0x34, 0x25, 0x100, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xc, 0xa}, {0x5, 0x10}, {0xffe8, 0xa}}, [@TCA_RATE={0x6, 0x5, {0xa, 0x94}}, @TCA_RATE={0x6, 0x5, {0x3, 0x2}}]}, 0x34}, 0x1, 0x0, 0x0, 0x50}, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file1/file0\x00', 0x6a) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') renameat2(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x2) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="bc000000000105060100000000000000020000003400018014000180080001007f000001080002007f0000011c000280050001000600000006000200303900000600030006bb00003400028014000180080001007f000001080002007f0000011c00028005000100060000000600020006bb00000600030030390000080003000000000e08000700000000780d0005800900010070707470"], 0xbc}}, 0x0) close(r4) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) 248.804774ms ago: executing program 6 (id=1820): r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:02.0/irq\x00', 0x0, 0x0) read(r0, &(0x7f0000000400), 0x64) ioctl$VIDIOC_G_CTRL(r0, 0xc008561b, &(0x7f0000000040)={0x3}) memfd_secret(0x80000) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2042, 0x0) ioctl$AUTOFS_IOC_FAIL(r1, 0x4c80, 0xfffffffffffffffb) 168.791215ms ago: executing program 0 (id=1821): mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000080)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@metacopy_on}]}) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') mkdir(&(0x7f00000000c0)='./file0\x00', 0x4) read$FUSE(r0, &(0x7f0000000bc0)={0x2020}, 0x2020) 168.430014ms ago: executing program 6 (id=1822): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="2e00000010008108040f80ecdb4cb92e0a480e000f000000e8bd6efb250314000e000100240248ff050005001200", 0x2e}], 0x1}, 0x40880) setsockopt$inet_int(r0, 0x0, 0x7, &(0x7f00000002c0)=0x803, 0x4) syz_emit_ethernet(0x7e, &(0x7f0000000080)={@link_local, @random=' u\b\x00', @void, {@ipv4={0x800, @udp={{0xa, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty, {[@timestamp_addr={0x44, 0x14, 0x8, 0x1, 0x8, [{@private=0x4a010100, 0x6a9d2469}, {@dev={0xac, 0x14, 0x14, 0x11}, 0x2a5b}]}]}}, {0x0, 0x4e20, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "8e118b91368e5fcee44c2afd6f146d7a77f4936c9987c0b0", "e5e9186df61e7497c9d79a65bbeb111b2d21e95a312bd1795cccaa4cd188de61"}}}}}}, 0x0) recvmmsg(r0, &(0x7f0000001980)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0) 168.080893ms ago: executing program 0 (id=1823): r0 = socket$rxrpc(0x21, 0x2, 0x2) recvmsg(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)=""/150, 0x96}, {&(0x7f00000000c0)=""/245, 0xf5}], 0x2, &(0x7f0000000200)=""/220, 0xdc}, 0x40000000) r1 = syz_open_dev$midi(&(0x7f0000000340), 0x100, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r1, 0xc0305710, &(0x7f0000000380)={0x1, 0xffffffff, 0x9, 0x1, 0x6}) 112.185145ms ago: executing program 0 (id=1824): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x5, &(0x7f00000000c0)=0x100000001, 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0) write(r2, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) (async) write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) setsockopt$inet_tcp_int(r1, 0x6, 0x5, &(0x7f00000000c0)=0x100000001, 0x4) (async) openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0) (async) write(r2, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa) (async) 109.175501ms ago: executing program 6 (id=1825): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) (async) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) (async) r0 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) close(r0) (async) creat(&(0x7f0000000180)='./file0\x00', 0x9) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) connect$unix(r1, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f00000001c0)=0x3, 0x4) (async) fcntl$setstatus(r0, 0x4, 0x2c00) (async) ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x300}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) (async, rerun: 64) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/mpls/platform_labels\x00', 0x1, 0x0) (rerun: 64) write(r2, &(0x7f0000000100)='1000', 0x4) (async, rerun: 64) r3 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="2c0000001800050400000000000000001c140000fe000001000000000800010000011100"], 0x2c}}, 0x0) 0s ago: executing program 6 (id=1826): r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000240)={0x0, 0xd58c, 0x80, 0x2, 0x1e2}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000980)=@IORING_OP_TIMEOUT={0xb, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x1, 0x40, 0x1}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$eventfd(r4, &(0x7f0000000340), 0x8) r5 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x5, 0x0, 0x0, {}, {}, {}, 0x1, @can={{}, 0xfd}}, 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x0) sendmsg$can_bcm(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x7, 0x201, 0x4, {}, {}, {}, 0x1, @can={{}, 0x3, 0x4, 0x0, 0x0, "140400"}}, 0x48}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)={0x70, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @multicast2}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_DST={0xc, 0xd, 0x0, 0x1, [@CTA_NAT_V4_MAXIP={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x33}}]}]}, 0x70}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x33fe0}], 0x1}, 0x3) shutdown(r7, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000040)={'vcan0\x00'}) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r9, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) shutdown(r9, 0x1) listen(r9, 0x5) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r11, &(0x7f0000000100)={0x0, 0x2800, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r12, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x3c, r12, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x28, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xdb0c}]}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r13 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r13, &(0x7f00000003c0)=ANY=[@ANYRES8, @ANYBLOB="7672762dca"], 0x10) r14 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r14, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x5], 0x0, 0x0, 0x1, 0x1}}, 0x40) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, r13, 0x0) sendto$inet6(r10, 0x0, 0x0, 0x20040014, &(0x7f0000000280)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) kernel console output (not intermixed with test programs): .242532][ T8967] vivid-011: unregistering vbi22 [ 115.250039][ T8967] vivid-011: unregistering vbi23 [ 115.255841][ T8967] vivid-011: unregistering swradio11 [ 115.263909][ T8967] vivid-011: unregistering radio22 [ 115.267463][ T8967] vivid-011: unregistering radio23 [ 115.271969][ T8967] vivid-011: unregistering video53 [ 115.274409][ T8967] vivid-011: unregistering video54 [ 115.278190][ T8967] vivid-011: unregistering v4l-touch11 [ 115.326302][ T8967] vivid-012: unregistering video55 [ 115.329546][ T8967] vivid-012: unregistering video56 [ 115.332876][ T8967] vivid-012: unregistering vbi24 [ 115.338973][ T8967] vivid-012: unregistering vbi25 [ 115.350062][ T8967] vivid-012: unregistering swradio12 [ 115.353512][ T8967] vivid-012: unregistering radio24 [ 115.358917][ T8967] vivid-012: unregistering radio25 [ 115.362582][ T5743] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 115.366065][ T8967] vivid-012: unregistering video57 [ 115.368997][ T8967] vivid-012: unregistering video58 [ 115.372645][ T5743] usb 5-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 115.375612][ T5743] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 115.378586][ T8967] vivid-012: unregistering v4l-touch12 [ 115.381167][ T5743] usb 5-1: Product: syz [ 115.383110][ T5743] usb 5-1: Manufacturer: syz [ 115.412412][ T5743] usb_debug 5-1:1.0: debug converter detected [ 115.430211][ T5743] usb 5-1: debug converter now attached to ttyUSB0 [ 115.453072][ T8967] vivid-013: unregistering video59 [ 115.457426][ T8967] vivid-013: unregistering video60 [ 115.464750][ T8967] vivid-013: unregistering vbi26 [ 115.470624][ T8967] vivid-013: unregistering vbi27 [ 115.478320][ T8967] vivid-013: unregistering swradio13 [ 115.491051][ T8967] vivid-013: unregistering radio26 [ 115.500124][ T8967] vivid-013: unregistering radio27 [ 115.506481][ T8967] vivid-013: unregistering video61 [ 115.509632][ T8967] vivid-013: unregistering video62 [ 115.513308][ T8967] vivid-013: unregistering v4l-touch13 [ 115.555756][ T8967] vivid-014: unregistering video63 [ 115.558805][ T8967] vivid-014: unregistering video64 [ 115.562370][ T8967] vivid-014: unregistering vbi28 [ 115.567857][ T8967] vivid-014: unregistering vbi29 [ 115.572516][ T8967] vivid-014: unregistering swradio14 [ 115.580085][ T8967] vivid-014: unregistering radio28 [ 115.584310][ T8967] vivid-014: unregistering radio29 [ 115.586338][ T5743] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 115.587447][ T8967] vivid-014: unregistering video65 [ 115.591433][ T5743] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 115.592989][ T8967] vivid-014: unregistering video66 [ 115.596076][ T5743] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 115.599989][ T8967] vivid-014: unregistering v4l-touch14 [ 115.601581][ T5743] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 115.607424][ T5743] rtc rtc0: __rtc_set_alarm: err=-22 [ 115.650211][ T8967] vivid-015: unregistering video67 [ 115.653686][ T8967] vivid-015: unregistering video68 [ 115.657573][ T8967] vivid-015: unregistering vbi30 [ 115.663143][ T8967] vivid-015: unregistering vbi31 [ 115.668968][ T8967] vivid-015: unregistering swradio15 [ 115.676568][ T8967] vivid-015: unregistering radio30 [ 115.681042][ T8967] vivid-015: unregistering radio31 [ 115.686197][ T8967] vivid-015: unregistering video69 [ 115.690969][ T8967] vivid-015: unregistering video70 [ 115.695723][ T8967] vivid-015: unregistering v4l-touch15 [ 115.737619][ T8967] vivid-016: unregistering video71 [ 115.740986][ T8967] vivid-016: unregistering video72 [ 115.743334][ T8967] vivid-016: unregistering vbi32 [ 115.752271][ T8967] vivid-016: unregistering vbi33 [ 115.757271][ T8967] vivid-016: unregistering swradio16 [ 115.765860][ T9041] netlink: 'syz.4.1058': attribute type 4 has an invalid length. [ 115.770556][ T8967] vivid-016: unregistering radio32 [ 115.774864][ T8967] vivid-016: unregistering radio33 [ 115.778039][ T8967] vivid-016: unregistering video73 [ 115.781152][ T8967] vivid-016: unregistering video74 [ 115.784306][ T8967] vivid-016: unregistering v4l-touch16 [ 115.798443][ T9041] binder: 9040:9041 ioctl c0306201 200000000640 returned -22 [ 115.801146][ T9041] binder: 9040:9041 ioctl 0 200000000080 returned -22 [ 115.803447][ T9041] binder: 9040:9041 ioctl 5393 200000000d40 returned -22 [ 115.846465][ T8967] vivid-017: unregistering video75 [ 115.850513][ T8967] vivid-017: unregistering video76 [ 115.853274][ T8967] vivid-017: unregistering vbi34 [ 115.856774][ T8967] vivid-017: unregistering vbi35 [ 115.864647][ T8967] vivid-017: unregistering swradio17 [ 115.875671][ T8967] vivid-017: unregistering radio34 [ 115.879567][ T8967] vivid-017: unregistering radio35 [ 115.883169][ T8967] vivid-017: unregistering video77 [ 115.886454][ T8967] vivid-017: unregistering video78 [ 115.891018][ T8967] vivid-017: unregistering v4l-touch17 [ 115.927836][ T8967] vivid-018: unregistering video79 [ 115.931467][ T8967] vivid-018: unregistering video80 [ 115.934718][ T8967] vivid-018: unregistering vbi36 [ 115.943890][ T8967] vivid-018: unregistering vbi37 [ 115.947122][ T8967] vivid-018: unregistering swradio18 [ 115.950741][ T8967] vivid-018: unregistering radio36 [ 115.954818][ T8967] vivid-018: unregistering radio37 [ 115.957166][ T8967] vivid-018: unregistering video81 [ 115.959885][ T8967] vivid-018: unregistering video82 [ 115.962487][ T8967] vivid-018: unregistering v4l-touch18 [ 115.985261][ T8967] vivid-019: unregistering video83 [ 115.988212][ T8967] vivid-019: unregistering video84 [ 115.991265][ T8967] vivid-019: unregistering vbi38 [ 116.006918][ T8967] vivid-019: unregistering vbi39 [ 116.008157][ T9044] 9pnet_virtio: no channels available for device syz [ 116.011125][ T8967] vivid-019: unregistering swradio19 [ 116.020347][ T8967] vivid-019: unregistering radio38 [ 116.023464][ T8967] vivid-019: unregistering radio39 [ 116.027621][ T8967] vivid-019: unregistering video85 [ 116.032410][ T8967] vivid-019: unregistering video86 [ 116.035841][ T8967] vivid-019: unregistering v4l-touch19 [ 116.065776][ T8967] vivid-020: unregistering video87 [ 116.068341][ T8967] vivid-020: unregistering video88 [ 116.073434][ T8967] vivid-020: unregistering vbi40 [ 116.079423][ T8967] vivid-020: unregistering vbi41 [ 116.083052][ T8967] vivid-020: unregistering swradio20 [ 116.086031][ T8967] vivid-020: unregistering radio40 [ 116.089494][ T8967] vivid-020: unregistering radio41 [ 116.092628][ T8967] vivid-020: unregistering video89 [ 116.096368][ T8967] vivid-020: unregistering video90 [ 116.099400][ T8967] vivid-020: unregistering v4l-touch20 [ 116.126607][ T8967] vivid-021: unregistering video91 [ 116.130423][ T8967] vivid-021: unregistering video92 [ 116.133692][ T8967] vivid-021: unregistering vbi42 [ 116.138331][ T8967] vivid-021: unregistering vbi43 [ 116.143899][ T8967] vivid-021: unregistering swradio21 [ 116.146656][ T8967] vivid-021: unregistering radio42 [ 116.149455][ T8967] vivid-021: unregistering radio43 [ 116.152694][ T8967] vivid-021: unregistering video93 [ 116.155755][ T8967] vivid-021: unregistering video94 [ 116.158584][ T8967] vivid-021: unregistering v4l-touch21 [ 116.180140][ T8967] vivid-022: unregistering video95 [ 116.183151][ T8967] vivid-022: unregistering video96 [ 116.185713][ T8967] vivid-022: unregistering vbi44 [ 116.189539][ T8967] vivid-022: unregistering vbi45 [ 116.192407][ T8967] vivid-022: unregistering swradio22 [ 116.195286][ T8967] vivid-022: unregistering radio44 [ 116.198165][ T8967] vivid-022: unregistering radio45 [ 116.202002][ T8967] vivid-022: unregistering video97 [ 116.205559][ T8967] vivid-022: unregistering video98 [ 116.209335][ T8967] vivid-022: unregistering v4l-touch22 [ 116.238155][ T8967] vivid-023: unregistering video99 [ 116.243015][ T8967] vivid-023: unregistering video100 [ 116.245660][ T8967] vivid-023: unregistering vbi46 [ 116.256978][ T8967] vivid-023: unregistering vbi47 [ 116.258547][ T9048] binder: 9047:9048 ioctl 89e0 200000000540 returned -22 [ 116.259949][ T8967] vivid-023: unregistering swradio23 [ 116.264776][ T8967] vivid-023: unregistering radio46 [ 116.268538][ T8967] vivid-023: unregistering radio47 [ 116.272344][ T8967] vivid-023: unregistering video101 [ 116.275352][ T8967] vivid-023: unregistering video102 [ 116.279325][ T8967] vivid-023: unregistering v4l-touch23 [ 116.469820][ T9062] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 116.769806][ T9084] loop3: detected capacity change from 0 to 7 [ 116.777098][ T9084] loop3: p1 p4 [ 116.778288][ T9084] loop3: partition table partially beyond EOD, truncated [ 116.931426][ T9099] __nla_validate_parse: 16 callbacks suppressed [ 116.931447][ T9099] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1074'. [ 116.946421][ T9099] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 116.953139][ T9099] batman_adv: batadv0: Adding interface: gretap1 [ 116.955803][ T9099] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.966413][ T9099] batman_adv: batadv0: Interface activated: gretap1 [ 117.018028][ T42] kauditd_printk_skb: 2 callbacks suppressed [ 117.018047][ T42] audit: type=1400 audit(1785597423.431:1499): avc: denied { mmap_zero } for pid=9100 comm="syz.3.1076" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 117.124944][ T9106] netlink: 199784 bytes leftover after parsing attributes in process `syz.4.1075'. [ 117.128926][ T9106] netlink: 'syz.4.1075': attribute type 1 has an invalid length. [ 117.188929][ T42] audit: type=1400 audit(1785597423.601:1500): avc: denied { write } for pid=9109 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.235879][ T42] audit: type=1400 audit(1785597423.651:1501): avc: denied { write } for pid=9113 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.299791][ T42] audit: type=1400 audit(1785597423.721:1502): avc: denied { write } for pid=9115 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.363820][ T42] audit: type=1400 audit(1785597423.781:1503): avc: denied { write } for pid=9118 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.393312][ T5743] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 117.443055][ T42] audit: type=1400 audit(1785597423.861:1504): avc: denied { write } for pid=9120 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.510181][ T42] audit: type=1400 audit(1785597423.931:1505): avc: denied { write } for pid=9123 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.554130][ T5743] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 117.560004][ T5743] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 117.566634][ T5743] usb 8-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 117.575086][ T5743] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.578475][ T5743] usb 8-1: Product: syz [ 117.583271][ T5743] usb 8-1: Manufacturer: syz [ 117.585263][ T5743] usb 8-1: SerialNumber: syz [ 117.589525][ T42] audit: type=1400 audit(1785597424.001:1506): avc: denied { write } for pid=9125 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.593139][ T5743] ti_usb_3410_5052 8-1:2.0: TI USB 5052 2 port adapter converter detected [ 117.608138][ T5743] usb 8-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 117.614063][ T5743] usb 8-1: TI USB 5052 2 port adapter converter now attached to ttyUSB2 [ 117.633537][ T42] audit: type=1400 audit(1785597424.051:1507): avc: denied { write } for pid=9128 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.709659][ T42] audit: type=1400 audit(1785597424.131:1508): avc: denied { write } for pid=9130 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.939472][ T9106] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 117.944667][ T9106] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 117.963802][ T8602] usb 5-1: USB disconnect, device number 9 [ 117.974740][ T8602] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 117.977967][ T8602] usb_debug 5-1:1.0: device disconnected [ 117.978832][ T9106] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 117.982496][ T9106] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 117.991402][ T9141] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1079'. [ 118.010625][ T9141] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1079'. [ 118.014651][ T9141] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1079'. [ 118.060409][ T9106] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 118.063926][ T9106] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 118.186352][ T9148] 9p: Could not find request transport: virtio5{CKf|M1 [ 118.198537][ T9148] tmpfs: Bad value for 'mpol' [ 118.268026][ T9153] evm: overlay not supported [ 118.336438][ T9159] gadgetfs: bound to dummy_udc driver [ 118.357275][ T9161] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 118.361458][ T9161] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 118.417419][ T9161] Bluetooth: hci4: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 118.435701][ T9166] netlink: 'syz.2.1087': attribute type 1 has an invalid length. [ 118.455128][ T9166] 8021q: adding VLAN 0 to HW filter on device bond2 [ 118.484585][ T9166] bond2: (slave veth5): Enslaving as an active interface with a down link [ 118.588664][ T9183] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1090'. [ 118.609253][ T5743] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 118.612581][ C1] gadgetfs: connected [ 118.616333][ T5743] gadgetfs: disconnected [ 118.769519][ C1] gadgetfs: connected [ 118.780086][ T5743] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 118.783658][ T5743] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 118.787325][ T5743] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.793540][ C1] gadgetfs: configuration #1 [ 118.961705][ T9169] gadgetfs: suspended from state 3 [ 118.961854][ T5743] usb 5-1: can't set config #1, error -71 [ 118.964060][ T9169] gadgetfs: disconnected [ 118.967303][ T5743] usb 5-1: USB disconnect, device number 10 [ 119.276473][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.446878][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.462882][ T9199] trusted_key: encrypted_key: master key parameter is missing [ 119.604360][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.627180][ T5754] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 119.633654][ T5754] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 119.637206][ T5754] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 119.642834][ T5754] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 119.645678][ T5754] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 119.661362][ T5750] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 119.664777][ T5750] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 119.668549][ T5750] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 119.680416][ T5750] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 119.690766][ T5750] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 119.722281][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.821352][ T9203] /dev/sr0: Can't open blockdev [ 119.959782][ T12] bridge_slave_1: left allmulticast mode [ 119.962147][ T12] bridge_slave_1: left promiscuous mode [ 119.968830][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.994870][ T12] bridge_slave_0: left allmulticast mode [ 120.001479][ T12] bridge_slave_0: left promiscuous mode [ 120.003399][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.213312][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 120.221531][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 120.226968][ T12] bond0 (unregistering): Released all slaves [ 120.244269][ T12] bond1 (unregistering): Released all slaves [ 120.320033][ T5451] 8021q: adding VLAN 0 to HW filter on device eth5 [ 120.322600][ T50] usb 8-1: USB disconnect, device number 14 [ 120.353245][ T50] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 120.379686][ T50] ti_usb_3410_5052_2 ttyUSB2: TI USB 5052 2 port adapter converter now disconnected from ttyUSB2 [ 120.444211][ T50] ti_usb_3410_5052 8-1:2.0: device disconnected [ 120.449391][ T5750] Bluetooth: hci4: command 0x1003 tx timeout [ 120.479712][ T5744] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 120.522968][ T9237] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1099'. [ 120.535336][ T9237] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1099'. [ 120.547139][ T9237] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1099'. [ 120.556926][ T9237] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1099'. [ 120.740799][ T5451] 8021q: adding VLAN 0 to HW filter on device eth6 [ 120.858584][ T9204] bridge0: port 1(bridge_slave_0) entered blocking state [ 120.869451][ T9204] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.878734][ T9204] bridge_slave_0: entered allmulticast mode [ 120.881650][ T9204] bridge_slave_0: entered promiscuous mode [ 120.899042][ T9204] bridge0: port 2(bridge_slave_1) entered blocking state [ 120.909000][ T9204] bridge0: port 2(bridge_slave_1) entered disabled state [ 120.912550][ T9204] bridge_slave_1: entered allmulticast mode [ 120.919625][ T9237] block nbd3: shutting down sockets [ 120.924238][ T9204] bridge_slave_1: entered promiscuous mode [ 120.942455][ T9204] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 120.965081][ T9204] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 120.994063][ T12] hsr_slave_0: left promiscuous mode [ 120.997213][ T12] hsr_slave_1: left promiscuous mode [ 121.000297][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 121.003388][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 121.007386][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 121.010597][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 121.023031][ T12] veth1_macvtap: left promiscuous mode [ 121.026165][ T12] veth0_macvtap: left promiscuous mode [ 121.028629][ T12] veth1_vlan: left promiscuous mode [ 121.031223][ T12] veth0_vlan: left promiscuous mode [ 121.254393][ T12] team0 (unregistering): Port device team_slave_1 removed [ 121.272243][ T12] team0 (unregistering): Port device team_slave_0 removed [ 121.350706][ T9263] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 121.362631][ T9273] syzkaller1: entered promiscuous mode [ 121.366931][ T9273] syzkaller1: entered allmulticast mode [ 121.377229][ T9204] team0: Port device team_slave_0 added [ 121.382223][ T9204] team0: Port device team_slave_1 added [ 121.441059][ T9204] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 121.443803][ T9204] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 121.454839][ T9204] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 121.475540][ T9204] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 121.485764][ T9204] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 121.497598][ T9204] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 121.511526][ T9286] netlink: 'syz.3.1106': attribute type 1 has an invalid length. [ 121.574420][ T9286] 8021q: adding VLAN 0 to HW filter on device bond3 [ 121.590094][ T5451] 8021q: adding VLAN 0 to HW filter on device eth7 [ 121.602583][ T9204] hsr_slave_0: entered promiscuous mode [ 121.604815][ T9204] hsr_slave_1: entered promiscuous mode [ 121.606832][ T9204] debugfs: 'hsr0' already exists in 'hsr' [ 121.608606][ T9204] Cannot create hsr debugfs directory [ 121.616028][ T9305] A link change request failed with some changes committed already. Interface ipvlan0 may have been left with an inconsistent configuration, please check. [ 121.711024][ T9310] process 'syz.0.1111' launched '/dev/fd/4' with NULL argv: empty string added [ 121.790751][ T5754] Bluetooth: hci1: command tx timeout [ 121.828132][ T9323] xt_connbytes: Forcing CT accounting to be enabled [ 121.895382][ T5451] 8021q: adding VLAN 0 to HW filter on device eth8 [ 121.898528][ T9204] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 121.910242][ T9204] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 121.916038][ T9204] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 121.921801][ T9329] input: syz0 as /devices/virtual/input/input11 [ 121.925628][ T5825] IPVS: starting estimator thread 0... [ 121.927010][ T9204] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 121.937728][ T9204] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 121.952099][ T9204] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 121.954495][ T9345] __nla_validate_parse: 6 callbacks suppressed [ 121.954504][ T9345] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1119'. [ 121.978664][ T9204] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 121.987292][ T9204] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 122.019750][ T9339] IPVS: using max 44 ests per chain, 105600 per kthread [ 122.020646][ T42] kauditd_printk_skb: 25 callbacks suppressed [ 122.020687][ T42] audit: type=1400 audit(1785597428.431:1534): avc: denied { name_bind } for pid=9354 comm="syz.2.1121" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 122.093552][ T9204] 8021q: adding VLAN 0 to HW filter on device bond0 [ 122.113603][ T9204] 8021q: adding VLAN 0 to HW filter on device team0 [ 122.123608][ T9340] bridge0: port 1(bridge_slave_0) entered blocking state [ 122.126112][ T9340] bridge0: port 1(bridge_slave_0) entered forwarding state [ 122.131319][ T9340] bridge0: port 2(bridge_slave_1) entered blocking state [ 122.142479][ T9340] bridge0: port 2(bridge_slave_1) entered forwarding state [ 122.254492][ T9366] sock: sock_set_timeout: `syz.0.1122' (pid 9366) tries to set negative timeout [ 122.452038][ T9204] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 122.607402][ T9204] veth0_vlan: entered promiscuous mode [ 122.623139][ T9204] veth1_vlan: entered promiscuous mode [ 122.651309][ T9204] veth0_macvtap: entered promiscuous mode [ 122.655647][ T9204] veth1_macvtap: entered promiscuous mode [ 122.668462][ T9204] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 122.687558][ T9204] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 122.750606][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.760742][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.764140][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.791262][ T9338] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.802097][ T9338] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.824808][ T9338] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.827612][ T9338] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.833326][ T42] audit: type=1400 audit(1785597429.251:1535): avc: denied { mounton } for pid=9204 comm="syz-executor" path="/syzkaller.WaPMaQ/syz-tmp" dev="sda1" ino=2039 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 122.861201][ T5817] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.873754][ T42] audit: type=1400 audit(1785597429.291:1536): avc: denied { cmd } for pid=9392 comm="syz.3.1126" path="/dev/ublk-control" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 123.047231][ T9410] 9p: Invalid gid '0x00000000ffffffff' [ 123.051531][ T9410] netlink: 'syz.2.1130': attribute type 1 has an invalid length. [ 123.072991][ T9410] 8021q: adding VLAN 0 to HW filter on device bond3 [ 123.095420][ T9410] bond3: (slave gretap1): making interface the new active one [ 123.098880][ T9410] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 123.106059][ T9410] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=9410 comm=syz.2.1130 [ 123.243777][ T9426] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 123.306359][ T9416] /dev/sr0: Can't open blockdev [ 123.320510][ T42] audit: type=1400 audit(1785597429.741:1537): avc: denied { bind } for pid=9430 comm="syz.2.1138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 123.326815][ T42] audit: type=1400 audit(1785597429.741:1538): avc: denied { listen } for pid=9430 comm="syz.2.1138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 123.336832][ T42] audit: type=1400 audit(1785597429.761:1539): avc: denied { create } for pid=9430 comm="syz.2.1138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 123.347672][ T9432] bpf: Bad value for 'uid' [ 123.350837][ T42] audit: type=1400 audit(1785597429.771:1540): avc: denied { getopt } for pid=9430 comm="syz.2.1138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 123.398171][ T42] audit: type=1400 audit(1785597429.811:1541): avc: denied { bind } for pid=9439 comm="syz.3.1141" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 123.450541][ T42] audit: type=1400 audit(1785597429.871:1542): avc: denied { getopt } for pid=9443 comm="syz.3.1143" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 123.458540][ T42] audit: type=1400 audit(1785597429.871:1543): avc: denied { bind } for pid=9443 comm="syz.3.1143" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 123.551676][ T9456] overlayfs: failed to verify upper root origin [ 123.676181][ T9462] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1149'. [ 123.680145][ T9462] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1149'. [ 123.683568][ T9462] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1149'. [ 123.754939][ T9470] ieee802154 phy0 wpan0: encryption failed: -22 [ 123.869475][ T5754] Bluetooth: hci1: command tx timeout [ 123.949994][ T5743] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 124.119786][ T5743] usb 5-1: Using ep0 maxpacket: 8 [ 124.129621][ T5743] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 124.133983][ T5743] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 124.137744][ T5743] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 124.143929][ T5743] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 124.147565][ T5743] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.151175][ T5743] usb 5-1: Product: syz [ 124.152820][ T5743] usb 5-1: Manufacturer: syz [ 124.154690][ T5743] usb 5-1: SerialNumber: syz [ 124.160168][ T5743] usb 5-1: config 0 descriptor?? [ 124.162493][ T9464] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 124.231958][ T5743] rc_core: IR keymap rc-streamzap not found [ 124.233960][ T5743] Registered IR keymap rc-empty [ 124.237007][ T5743] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0 [ 124.243007][ T5743] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0/input12 [ 124.440933][ T5743] usb 5-1: USB disconnect, device number 11 [ 124.676821][ T9497] bridge4: port 1(macvlan2) entered blocking state [ 124.680062][ T9497] bridge4: port 1(macvlan2) entered disabled state [ 124.682965][ T9497] macvlan2: entered allmulticast mode [ 124.796327][ T9503] block nbd3: not configured, cannot reconfigure [ 124.802007][ T9503] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1159'. [ 124.805452][ T9503] block nbd0: not configured, cannot reconfigure [ 124.999333][ T9508] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1160'. [ 125.013453][ T9508] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1160'. [ 125.021971][ T9508] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1160'. [ 125.176587][ T9511] bond0: Error: Cannot enslave bond to itself. [ 125.176915][ T9517] overlayfs: upper fs does not support file handles, falling back to index=off. [ 125.185925][ T9517] overlayfs: failed to set uuid (299/file2, err=-1); falling back to uuid=null. [ 125.303740][ T9522] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 125.464359][ T9535] netlink: 'syz.0.1167': attribute type 1 has an invalid length. [ 125.467384][ T9535] netlink: 'syz.0.1167': attribute type 2 has an invalid length. [ 125.532896][ T9539] netdevsim netdevsim0: Firmware load for './file0/../file0/file0' refused, path contains '..' component [ 125.538064][ T9539] program syz.0.1169 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 125.580101][ T9541] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1170'. [ 125.589816][ T9541] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1170'. [ 125.653611][ T9545] input: syz0 as /devices/virtual/input/input13 [ 125.768157][ T5855] IPVS: starting estimator thread 0... [ 125.861514][ T9555] IPVS: using max 44 ests per chain, 105600 per kthread [ 125.889337][ T9503] comedi comedi0: reset error (fatal) [ 125.957266][ T5754] Bluetooth: hci1: command tx timeout [ 125.974759][ T9578] FAULT_INJECTION: forcing a failure. [ 125.974759][ T9578] name failslab, interval 1, probability 0, space 0, times 0 [ 125.989407][ T9578] CPU: 2 UID: 0 PID: 9578 Comm: syz.0.1181 Tainted: G L syzkaller #0 PREEMPT(full) [ 125.989427][ T9578] Tainted: [L]=SOFTLOCKUP [ 125.989431][ T9578] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 125.989438][ T9578] Call Trace: [ 125.989454][ T9578] [ 125.989459][ T9578] dump_stack_lvl+0x100/0x190 [ 125.989486][ T9578] should_fail_ex.cold+0x5/0xa [ 125.989505][ T9578] should_failslab+0xc2/0x120 [ 125.989528][ T9578] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 125.989542][ T9578] ? __alloc_skb+0x5b7/0x710 [ 125.989568][ T9578] ? __alloc_skb+0x140/0x710 [ 125.989582][ T9578] __alloc_skb+0x140/0x710 [ 125.989594][ T9578] ? __alloc_skb+0x5b7/0x710 [ 125.989606][ T9578] ? __pfx___alloc_skb+0x10/0x10 [ 125.989622][ T9578] netlink_ack+0x117/0xb80 [ 125.989639][ T9578] netlink_rcv_skb+0x333/0x420 [ 125.989650][ T9578] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 125.989667][ T9578] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 125.989682][ T9578] ? netlink_deliver_tap+0x1ae/0xcc0 [ 125.989702][ T9578] netlink_unicast+0x585/0x850 [ 125.989714][ T9578] ? __pfx_netlink_unicast+0x10/0x10 [ 125.989729][ T9578] netlink_sendmsg+0x8b0/0xda0 [ 125.989742][ T9578] ? __pfx_netlink_sendmsg+0x10/0x10 [ 125.989755][ T9578] ? selinux_socket_sendmsg+0x198/0x2f0 [ 125.989779][ T9578] ____sys_sendmsg+0xa4d/0xbe0 [ 125.989795][ T9578] ? __pfx_netlink_sendmsg+0x10/0x10 [ 125.989807][ T9578] ? __pfx_____sys_sendmsg+0x10/0x10 [ 125.989829][ T9578] ___sys_sendmsg+0x190/0x1e0 [ 125.989841][ T9578] ? __pfx____sys_sendmsg+0x10/0x10 [ 125.989850][ T9578] ? __lock_acquire+0x49f/0x1a40 [ 125.989870][ T9578] ? get_pid_task+0x106/0x250 [ 125.989894][ T9578] __sys_sendmsg+0x160/0x210 [ 125.989909][ T9578] ? __pfx___sys_sendmsg+0x10/0x10 [ 125.989929][ T9578] do_syscall_64+0x115/0x870 [ 125.989943][ T9578] ? clear_bhb_loop+0x40/0x90 [ 125.989956][ T9578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.989967][ T9578] RIP: 0033:0x7f615939e019 [ 125.989977][ T9578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.989989][ T9578] RSP: 002b:00007f615a186028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 125.990007][ T9578] RAX: ffffffffffffffda RBX: 00007f6159625fa0 RCX: 00007f615939e019 [ 125.990013][ T9578] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 125.990020][ T9578] RBP: 00007f615a186090 R08: 0000000000000000 R09: 0000000000000000 [ 125.990026][ T9578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 125.990032][ T9578] R13: 00007f6159626038 R14: 00007f6159625fa0 R15: 00007ffe46669f08 [ 125.990046][ T9578] [ 126.200300][ T9590] overlayfs: statfs failed on './file0' [ 126.412490][ T9598] 9pnet_fd: Insufficient options for proto=fd [ 126.523340][ T5743] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 126.669303][ T5743] usb 5-1: Using ep0 maxpacket: 8 [ 126.673823][ T5743] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 126.676818][ T5743] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 126.680513][ T5743] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 126.683792][ T5743] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 126.687192][ T5743] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 126.692024][ T5743] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 126.695121][ T5743] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.853486][ T9607] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=11522 sclass=netlink_route_socket pid=9607 comm=syz.2.1192 [ 126.889183][ T9504] comedi comedi0: reset error (fatal) [ 127.038095][ T42] kauditd_printk_skb: 7 callbacks suppressed [ 127.038111][ T42] audit: type=1400 audit(1785597433.451:1551): avc: denied { map } for pid=9610 comm="syz.3.1193" path="/dev/ublkc0" dev="devtmpfs" ino=3066 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 127.099267][ T5818] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 127.161652][ T9622] X25: received unknown 00 with LCI 000 [ 127.248707][ T42] audit: type=1400 audit(1785597433.661:1552): avc: denied { write } for pid=9625 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 127.253133][ T9628] FAULT_INJECTION: forcing a failure. [ 127.253133][ T9628] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 127.260964][ T9628] CPU: 2 UID: 0 PID: 9628 Comm: syz.3.1195 Tainted: G L syzkaller #0 PREEMPT(full) [ 127.260981][ T9628] Tainted: [L]=SOFTLOCKUP [ 127.260985][ T9628] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 127.260991][ T9628] Call Trace: [ 127.260996][ T9628] [ 127.261000][ T9628] dump_stack_lvl+0x100/0x190 [ 127.261019][ T9628] should_fail_ex.cold+0x5/0xa [ 127.261033][ T9628] _copy_to_user+0x32/0xd0 [ 127.261065][ T9628] simple_read_from_buffer+0xcb/0x170 [ 127.261090][ T9628] proc_fail_nth_read+0x1af/0x230 [ 127.261114][ T9628] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 127.261131][ T9628] ? rw_verify_area+0xce/0x6d0 [ 127.261146][ T9628] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 127.261162][ T9628] vfs_read+0x1e4/0xb40 [ 127.261180][ T9628] ? __pfx_vfs_read+0x10/0x10 [ 127.261195][ T9628] ? __fget_files+0x215/0x3d0 [ 127.261210][ T9628] ? __fget_files+0x21f/0x3d0 [ 127.261224][ T9628] ksys_read+0x12a/0x250 [ 127.261240][ T9628] ? __pfx_ksys_read+0x10/0x10 [ 127.261259][ T9628] do_syscall_64+0x115/0x870 [ 127.261273][ T9628] ? clear_bhb_loop+0x40/0x90 [ 127.261286][ T9628] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.261297][ T9628] RIP: 0033:0x7fa22215e84e [ 127.261307][ T9628] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 127.261317][ T9628] RSP: 002b:00007fa22304dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 127.261329][ T9628] RAX: ffffffffffffffda RBX: 00007fa22304e6c0 RCX: 00007fa22215e84e [ 127.261336][ T9628] RDX: 000000000000000f RSI: 00007fa22304e0a0 RDI: 0000000000000004 [ 127.261342][ T9628] RBP: 00007fa22304e090 R08: 0000000000000000 R09: 0000000000000000 [ 127.261348][ T9628] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 127.261354][ T9628] R13: 00007fa222426038 R14: 00007fa222425fa0 R15: 00007ffeeb80de88 [ 127.261367][ T9628] [ 127.261714][ T5818] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 127.312376][ T42] audit: type=1400 audit(1785597433.731:1553): avc: denied { write } for pid=9630 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 127.318206][ T5818] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 127.355209][ T5818] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 127.359881][ T5818] usb 7-1: config 0 interface 0 has no altsetting 0 [ 127.363983][ T5818] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 127.368074][ T5818] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 127.372934][ T5818] usb 7-1: config 0 interface 0 has no altsetting 0 [ 127.382943][ T5818] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 127.386743][ T5818] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 127.391636][ T5818] usb 7-1: config 0 interface 0 has no altsetting 0 [ 127.396930][ T5818] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 127.400176][ T5818] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 127.403995][ T5818] usb 7-1: config 0 interface 0 has no altsetting 0 [ 127.406864][ T5818] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 127.407729][ T42] audit: type=1400 audit(1785597433.821:1554): avc: denied { write } for pid=9635 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 127.411069][ T5818] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 127.424123][ T5818] usb 7-1: config 0 interface 0 has no altsetting 0 [ 127.427047][ T5818] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 127.430171][ T5818] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 127.433614][ T5818] usb 7-1: config 0 interface 0 has no altsetting 0 [ 127.437772][ T5818] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 127.440885][ T5818] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 127.444310][ T5818] usb 7-1: config 0 interface 0 has no altsetting 0 [ 127.447162][ T5818] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 127.450486][ T5818] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 127.453901][ T5818] usb 7-1: config 0 interface 0 has no altsetting 0 [ 127.457458][ T5818] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 127.461081][ T5818] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 127.463714][ T5818] usb 7-1: Product: syz [ 127.465043][ T5818] usb 7-1: Manufacturer: syz [ 127.469638][ T42] audit: type=1400 audit(1785597433.881:1555): avc: denied { write } for pid=9642 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 127.475541][ T5818] usb 7-1: SerialNumber: syz [ 127.477832][ T9645] __nla_validate_parse: 4 callbacks suppressed [ 127.477843][ T9645] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1198'. [ 127.478214][ T9645] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1198'. [ 127.488193][ T9645] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1198'. [ 127.490921][ T5818] usb 7-1: config 0 descriptor?? [ 127.497819][ T5818] yurex 7-1:0.0: USB YUREX device now attached to Yurex #1 [ 127.545273][ T42] audit: type=1400 audit(1785597433.961:1556): avc: denied { write } for pid=9649 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 127.557983][ T42] audit: type=1400 audit(1785597433.971:1557): avc: denied { create } for pid=9651 comm="syz.5.1200" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 127.602783][ T42] audit: type=1400 audit(1785597434.021:1558): avc: denied { write } for pid=9654 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 127.609417][ T5743] usb 8-1: new full-speed USB device number 15 using dummy_hcd [ 127.760751][ T5743] usb 8-1: config 0 has no interfaces? [ 127.762539][ T5743] usb 8-1: New USB device found, idVendor=12d1, idProduct=42f7, bcdDevice=aa.47 [ 127.765329][ T5743] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.769275][ T5743] usb 8-1: config 0 descriptor?? [ 127.789690][ T5855] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 127.829064][ T9656] usbtmc 5-1:16.0: simple usb_control_msg failed -32 [ 127.939263][ T5855] usb 10-1: Using ep0 maxpacket: 32 [ 127.946516][ T5855] usb 10-1: config 249 has an invalid interface number: 141 but max is 2 [ 127.950186][ T5855] usb 10-1: config 249 contains an unexpected descriptor of type 0x1, skipping [ 127.953844][ T5855] usb 10-1: config 249 has an invalid interface number: 76 but max is 2 [ 127.957267][ T5855] usb 10-1: config 249 has an invalid interface number: 34 but max is 2 [ 127.960934][ T5855] usb 10-1: config 249 has an invalid interface number: 131 but max is 2 [ 127.964465][ T5855] usb 10-1: config 249 has an invalid interface number: 65 but max is 2 [ 127.967898][ T5855] usb 10-1: config 249 has 5 interfaces, different from the descriptor's value: 3 [ 127.971841][ T5855] usb 10-1: config 249 has no interface number 0 [ 127.974553][ T5855] usb 10-1: config 249 has no interface number 1 [ 127.977210][ T5855] usb 10-1: config 249 has no interface number 2 [ 127.979895][ T5855] usb 10-1: config 249 has no interface number 3 [ 127.982454][ T5855] usb 10-1: config 249 has no interface number 4 [ 127.985136][ T5855] usb 10-1: config 249 interface 141 altsetting 2 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 127.989618][ T5855] usb 10-1: config 249 interface 141 altsetting 2 endpoint 0x6 has invalid maxpacket 1552, setting to 64 [ 127.994223][ T5855] usb 10-1: config 249 interface 141 altsetting 2 has a duplicate endpoint with address 0x6, skipping [ 127.998679][ T5855] usb 10-1: config 249 interface 141 altsetting 2 has a duplicate endpoint with address 0x4, skipping [ 128.003203][ T5855] usb 10-1: config 249 interface 141 altsetting 2 endpoint 0x5 has invalid maxpacket 1024, setting to 64 [ 128.007775][ T5855] usb 10-1: config 249 interface 141 altsetting 2 has 9 endpoint descriptors, different from the interface descriptor's value: 15 [ 128.013363][ T5855] usb 10-1: too many endpoints for config 249 interface 76 altsetting 127: 124, using maximum allowed: 30 [ 128.016300][ T5818] usb 8-1: USB disconnect, device number 15 [ 128.017938][ T5855] usb 10-1: config 249 interface 76 altsetting 127 has a duplicate endpoint with address 0x6, skipping [ 128.017964][ T5855] usb 10-1: config 249 interface 76 altsetting 127 has a duplicate endpoint with address 0x6, skipping [ 128.029513][ T5754] Bluetooth: hci1: command tx timeout [ 128.032943][ T5855] usb 10-1: config 249 interface 76 altsetting 127 has an invalid descriptor for endpoint zero, skipping [ 128.037541][ T5855] usb 10-1: config 249 interface 76 altsetting 127 has a duplicate endpoint with address 0x4, skipping [ 128.041340][ T5855] usb 10-1: config 249 interface 76 altsetting 127 has 6 endpoint descriptors, different from the interface descriptor's value: 124 [ 128.045365][ T5855] usb 10-1: config 249 interface 34 altsetting 1 has a duplicate endpoint with address 0x3, skipping [ 128.050498][ T5855] usb 10-1: config 249 interface 34 altsetting 1 has a duplicate endpoint with address 0xD, skipping [ 128.055108][ T5855] usb 10-1: config 249 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 128.059799][ T5855] usb 10-1: config 249 interface 131 altsetting 91 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 128.064791][ T5855] usb 10-1: config 249 interface 131 altsetting 91 has a duplicate endpoint with address 0x8A, skipping [ 128.069594][ T5855] usb 10-1: config 249 interface 131 altsetting 91 has a duplicate endpoint with address 0xF, skipping [ 128.074353][ T5855] usb 10-1: config 249 interface 131 altsetting 91 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 128.079572][ T5855] usb 10-1: config 249 interface 131 altsetting 91 has a duplicate endpoint with address 0x81, skipping [ 128.084164][ T5855] usb 10-1: config 249 interface 131 altsetting 91 has an endpoint descriptor with address 0x74, changing to 0x4 [ 128.089319][ T5855] usb 10-1: config 249 interface 131 altsetting 91 has a duplicate endpoint with address 0x4, skipping [ 128.093948][ T5855] usb 10-1: config 249 interface 131 altsetting 91 has a duplicate endpoint with address 0x4, skipping [ 128.098517][ T5855] usb 10-1: config 249 interface 131 altsetting 91 has a duplicate endpoint with address 0x4, skipping [ 128.103137][ T5855] usb 10-1: config 249 interface 131 altsetting 91 has an endpoint descriptor with address 0x4D, changing to 0xD [ 128.108244][ T5855] usb 10-1: config 249 interface 131 altsetting 91 has a duplicate endpoint with address 0xD, skipping [ 128.112918][ T5855] usb 10-1: config 249 interface 131 altsetting 91 has a duplicate endpoint with address 0x6, skipping [ 128.117372][ T5855] usb 10-1: config 249 interface 131 altsetting 91 has 10 endpoint descriptors, different from the interface descriptor's value: 9 [ 128.123016][ T5855] usb 10-1: too many endpoints for config 249 interface 65 altsetting 59: 147, using maximum allowed: 30 [ 128.127739][ T5855] usb 10-1: config 249 interface 65 altsetting 59 has an invalid descriptor for endpoint zero, skipping [ 128.132405][ T5855] usb 10-1: config 249 interface 65 altsetting 59 has 1 endpoint descriptor, different from the interface descriptor's value: 147 [ 128.137909][ T5855] usb 10-1: config 249 interface 141 has no altsetting 0 [ 128.140945][ T5855] usb 10-1: config 249 interface 76 has no altsetting 0 [ 128.143824][ T5855] usb 10-1: config 249 interface 34 has no altsetting 0 [ 128.146721][ T5855] usb 10-1: config 249 interface 131 has no altsetting 0 [ 128.149717][ T5855] usb 10-1: config 249 interface 65 has no altsetting 0 [ 128.154632][ T5855] usb 10-1: Dual-Role OTG device on HNP port [ 128.157614][ T5855] usb 10-1: New USB device found, idVendor=0742, idProduct=2009, bcdDevice=9b.9a [ 128.161585][ T5855] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.164937][ T5855] usb 10-1: Product: syz [ 128.166772][ T5855] usb 10-1: Manufacturer: syz [ 128.168807][ T5855] usb 10-1: SerialNumber: syz [ 128.398135][ T5855] usb 10-1: USB disconnect, device number 2 [ 128.906769][ T42] audit: type=1400 audit(1785597435.321:1559): avc: denied { write } for pid=9671 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 128.953774][ T42] audit: type=1400 audit(1785597435.371:1560): avc: denied { write } for pid=9674 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.005517][ T9684] tmpfs: Group quota block hardlimit too large. [ 129.056771][ T9691] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1207'. [ 129.063385][ T9691] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1207'. [ 129.067486][ T9691] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1207'. [ 129.271902][ T9] usb 5-1: USB disconnect, device number 12 [ 129.302553][ T9702] SELinux: policydb magic number 0x10 does not match expected magic number 0xf97cff8c [ 129.306159][ T9702] SELinux: failed to load policy [ 129.317391][ T9702] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1209'. [ 129.417901][ T9712] netlink: 96 bytes leftover after parsing attributes in process `syz.5.1212'. [ 129.833645][ T9719] batman_adv: batadv0: Adding interface: macvtap1 [ 129.836160][ T9719] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 129.843803][ T9719] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 129.850494][ T5743] usb 7-1: USB disconnect, device number 6 [ 129.865318][ T5743] yurex 7-1:0.0: USB YUREX #1 now disconnected [ 129.911080][ T9726] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1216'. [ 129.929975][ T9726] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1216'. [ 130.090740][ T9739] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9739 comm=syz.3.1222 [ 130.828708][ T9773] i2c i2c-1: dtv_property_process_set: SET cmd 0x30656c69 undefined [ 131.006755][ T9794] can0: slcan on ttynull. [ 131.132794][ T9792] can0 (unregistered): slcan off ttynull. [ 131.134910][ T9799] netdevsim netdevsim3: Direct firmware load for . [ 131.134910][ T9799] failed with error -2 [ 131.152499][ T9799] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 131.152499][ T9799] [ 131.929327][ T5743] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 132.083027][ T5743] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 132.091189][ T5743] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 132.098700][ T5743] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 132.102744][ T5743] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.313715][ T5743] usb 5-1: GET_CAPABILITIES returned 0 [ 132.316195][ T5743] usbtmc 5-1:16.0: can't read capabilities [ 132.340280][ T5855] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 132.429395][ T5833] netdevsim netdevsim10 eth1: set [0, 0] type 1 family 0 port 2816 - 0 [ 132.433042][ T5833] netdevsim netdevsim10 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 132.436554][ T5833] netdevsim netdevsim10 eth0: set [0, 0] type 1 family 0 port 2816 - 0 [ 132.440605][ T5833] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 132.459829][ T9849] gtp0: entered promiscuous mode [ 132.461831][ T9849] gtp0: entered allmulticast mode [ 132.464975][ T9849] team0: Device gtp0 is of different type [ 132.491812][ T5855] usb 10-1: unable to get BOS descriptor or descriptor too short [ 132.495220][ T5855] usb 10-1: too many configurations: 95, using maximum allowed: 8 [ 132.500818][ T5855] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 132.504027][ T5855] usb 10-1: can't read configurations, error -61 [ 132.586470][ T34] usb 5-1: USB disconnect, device number 13 [ 132.639238][ T5855] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 132.673658][ T1445] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.675982][ T1445] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.791245][ T5855] usb 10-1: unable to get BOS descriptor or descriptor too short [ 132.794658][ T5855] usb 10-1: too many configurations: 95, using maximum allowed: 8 [ 132.799501][ T5855] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 132.802629][ T5855] usb 10-1: can't read configurations, error -61 [ 132.805451][ T5855] usb usb10-port1: attempt power cycle [ 133.149138][ T5855] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 133.175910][ T5855] usb 10-1: unable to get BOS descriptor or descriptor too short [ 133.184353][ T5855] usb 10-1: too many configurations: 95, using maximum allowed: 8 [ 133.193598][ T5855] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 133.196851][ T5855] usb 10-1: can't read configurations, error -61 [ 133.276089][ T9862] can0: slcan on ttyS3. [ 133.339018][ T5855] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 133.349680][ T9861] can0 (unregistered): slcan off ttyS3. [ 133.362076][ T5855] usb 10-1: unable to get BOS descriptor or descriptor too short [ 133.369084][ T5855] usb 10-1: too many configurations: 95, using maximum allowed: 8 [ 133.374794][ T5855] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 133.375982][ T42] kauditd_printk_skb: 15 callbacks suppressed [ 133.375995][ T42] audit: type=1400 audit(1785597439.792:1576): avc: denied { write } for pid=9868 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 133.378131][ T5855] usb 10-1: can't read configurations, error -61 [ 133.407282][ T5855] usb usb10-port1: unable to enumerate USB device [ 133.415689][ T9872] SELinux: ebitmap start bit (202309632) is beyond the end of the bitmap (1472) [ 133.418734][ T9872] SELinux: invalid class [ 133.427939][ T9872] SELinux: failed to load policy [ 133.453909][ T42] audit: type=1400 audit(1785597439.872:1577): avc: denied { write } for pid=9876 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 133.555596][ T42] audit: type=1400 audit(1785597439.972:1578): avc: denied { write } for pid=9881 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 133.559228][ T1047] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 133.628704][ T42] audit: type=1400 audit(1785597440.042:1579): avc: denied { write } for pid=9885 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 133.717666][ T42] audit: type=1400 audit(1785597440.132:1580): avc: denied { write } for pid=9888 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 133.725127][ T9891] xt_l2tp: unknown flags: ff [ 133.733185][ T1047] usb 5-1: Using ep0 maxpacket: 16 [ 133.742352][ T1047] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 133.746929][ T1047] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 133.751417][ T42] audit: type=1400 audit(1785597440.172:1581): avc: denied { read } for pid=9890 comm="syz.2.1259" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 133.753040][ T1047] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 133.763353][ T1047] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.768827][ T1047] usb 5-1: config 0 descriptor?? [ 133.788812][ T42] audit: type=1400 audit(1785597440.202:1582): avc: denied { write } for pid=9893 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 133.807377][ T9896] __nla_validate_parse: 6 callbacks suppressed [ 133.807394][ T9896] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1260'. [ 133.814764][ T9896] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1260'. [ 133.819025][ T9896] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1260'. [ 133.877418][ T42] audit: type=1400 audit(1785597440.292:1583): avc: denied { write } for pid=9897 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 133.913956][ T42] audit: type=1400 audit(1785597440.332:1584): avc: denied { write } for pid=9902 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 133.997594][ T42] audit: type=1400 audit(1785597440.412:1585): avc: denied { write } for pid=9908 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 134.091607][ T1047] usbhid 5-1:0.0: can't add hid device: -71 [ 134.094087][ T1047] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 134.115058][ T1047] usb 5-1: USB disconnect, device number 14 [ 134.321612][ T9] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 134.470664][ T9] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 134.474572][ T9] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 134.481409][ T9] usb 7-1: New USB device found, idVendor=0830, idProduct=0080, bcdDevice= 1.00 [ 134.484706][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.487605][ T9] usb 7-1: Product: syz [ 134.489359][ T9] usb 7-1: Manufacturer: syz [ 134.491412][ T9] usb 7-1: SerialNumber: syz [ 134.498449][ T9] kl5kusb105 7-1:1.0: KL5KUSB105D / PalmConnect converter detected [ 134.502753][ T9] usb 7-1: KL5KUSB105D / PalmConnect converter now attached to ttyUSB0 [ 134.764145][ T9933] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=9933 comm=syz.0.1265 [ 134.954161][ T9945] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1269'. [ 134.958898][ T9945] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1269'. [ 134.962807][ T9945] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1269'. [ 135.100153][ T9966] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1274'. [ 135.107755][ T9969] netlink: 'syz.0.1275': attribute type 2 has an invalid length. [ 135.122146][ T9966] bond1: entered allmulticast mode [ 135.123889][ T9969] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9969 comm=syz.0.1275 [ 135.131042][ T9969] netlink: 'syz.0.1275': attribute type 1 has an invalid length. [ 135.133558][ T9966] bond1: (slave vti0): The slave device specified does not support setting the MAC address [ 135.139896][ T9966] bond1: (slave vti0): Error -95 calling set_mac_address [ 135.171305][ T9971] loop5: detected capacity change from 0 to 2640 [ 135.187694][ T9971] Buffer I/O error on dev loop5, logical block 0, lost async page write [ 135.191558][ T9971] Buffer I/O error on dev loop5, logical block 1, lost async page write [ 135.195090][ T9971] Buffer I/O error on dev loop5, logical block 2, lost async page write [ 135.198547][ T9971] Buffer I/O error on dev loop5, logical block 3, lost async page write [ 135.202480][ T9975] overlay: ./file0 is not a directory [ 135.202554][ T9971] Buffer I/O error on dev loop5, logical block 4, lost async page write [ 135.208912][ T9971] Buffer I/O error on dev loop5, logical block 5, lost async page write [ 135.212306][ T9971] Buffer I/O error on dev loop5, logical block 6, lost async page write [ 135.215779][ T9971] Buffer I/O error on dev loop5, logical block 7, lost async page write [ 135.219442][ T9971] Buffer I/O error on dev loop5, logical block 8, lost async page write [ 135.223001][ T9971] Buffer I/O error on dev loop5, logical block 9, lost async page write [ 135.285023][ T9981] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1279'. [ 135.292326][ T9981] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1279'. [ 135.295759][ T9981] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1279'. [ 135.324850][ T9986] faux_driver vgem: [drm] Unknown color mode 135165; guessing buffer size. [ 135.387863][ T9992] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00aa with DS=0xee [ 135.528391][ T9999] geneve0: entered promiscuous mode [ 135.536871][T10001] batman_adv: batadv0: Adding interface: dummy0 [ 135.539319][T10001] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 135.547816][T10001] batman_adv: batadv0: Interface activated: dummy0 [ 135.562503][T10001] batadv0: mtu less than device minimum [ 135.565980][T10001] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 135.570961][T10001] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 135.574846][T10001] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 135.576773][T10003] netlink: 'syz.3.1287': attribute type 1 has an invalid length. [ 135.579637][T10001] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 135.584822][T10001] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 135.588663][T10001] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 135.592484][T10001] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 135.596394][T10001] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 135.764432][ T5855] usb 7-1: USB disconnect, device number 7 [ 135.776774][ T5855] kl5kusb105d ttyUSB0: KL5KUSB105D / PalmConnect converter now disconnected from ttyUSB0 [ 135.782703][ T5855] kl5kusb105 7-1:1.0: device disconnected [ 152.909465][T10022] loop6: detected capacity change from 0 to 2640 [ 152.921642][T10025] buffer_io_error: 321 callbacks suppressed [ 152.921654][T10025] Buffer I/O error on dev loop6, logical block 0, async page read [ 152.926528][T10025] Buffer I/O error on dev loop6, logical block 0, async page read [ 152.929620][T10025] Buffer I/O error on dev loop6, logical block 0, async page read [ 152.932445][T10025] Buffer I/O error on dev loop6, logical block 0, async page read [ 152.935275][T10025] Buffer I/O error on dev loop6, logical block 0, async page read [ 153.041910][T10030] dvmrp0: entered allmulticast mode [ 153.043390][ T42] kauditd_printk_skb: 7 callbacks suppressed [ 153.043406][ T42] audit: type=1326 audit(1785597459.463:1593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10031 comm="syz.3.1298" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa22219e019 code=0x0 [ 153.087959][ T42] audit: type=1400 audit(1785597459.503:1594): avc: denied { getopt } for pid=10035 comm="syz.0.1299" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 153.203869][T10048] __nla_validate_parse: 8 callbacks suppressed [ 153.203883][T10048] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1302'. [ 153.211394][T10048] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1302'. [ 153.214660][T10048] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1302'. [ 153.347849][T10062] syzkaller0: entered promiscuous mode [ 153.349819][T10062] syzkaller0: entered allmulticast mode [ 153.469499][T10065] syzkaller0: entered promiscuous mode [ 153.471771][T10065] syzkaller0: entered allmulticast mode [ 153.482556][T10065] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1307'. [ 153.953051][ T42] audit: type=1400 audit(1785597460.373:1595): avc: denied { append } for pid=10085 comm="syz.3.1314" name="mouse0" dev="devtmpfs" ino=947 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 154.124416][ T42] audit: type=1326 audit(1785597460.543:1596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10085 comm="syz.3.1314" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa22219e019 code=0x0 [ 154.142825][T10103] PM: Enabling pm_trace changes system date and time during resume. [ 154.142825][T10103] PM: Correct system time has to be restored manually after resume. [ 154.543847][T10129] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1324'. [ 154.556280][T10129] program syz.2.1324 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 154.787964][ T5825] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 154.809350][T10134] i2c i2c-0: new_device: Instantiated device stusb160x at 0x48 [ 154.825975][T10134] i2c i2c-0: new_device: Instantiated device rt1719 at 0x49 [ 154.830069][T10137] netlink: 17 bytes leftover after parsing attributes in process `syz.3.1327'. [ 154.832529][T10134] wusb3801 0-004a: supply vbus not found, using dummy regulator [ 154.860192][T10134] i2c i2c-0: new_device: Instantiated device wusb3801 at 0x4a [ 154.865619][T10141] gadgetfs: Unknown parameter 'lowerdir' [ 154.865810][ T42] audit: type=1400 audit(1785597461.283:1597): avc: denied { remount } for pid=10140 comm="syz.3.1328" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 154.948172][ T5825] usb 10-1: Using ep0 maxpacket: 8 [ 154.952418][ T5825] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 154.957120][ T5825] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 154.962346][ T5825] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 154.966834][ T5825] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 154.974704][ T5825] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 154.978717][ T5825] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 155.187540][ T5825] usb 10-1: GET_CAPABILITIES returned 0 [ 155.189925][ T5825] usbtmc 10-1:16.0: can't read capabilities [ 155.225476][T10158] netlink: 7 bytes leftover after parsing attributes in process `syz.2.1332'. [ 155.266191][T10160] program syz.2.1333 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 155.390215][ T5743] usb 10-1: USB disconnect, device number 7 [ 156.013595][ T13] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0xc9 [ 156.071782][T10180] af_packet: tpacket_rcv: packet too big, clamped from 32 to 4294967272. macoff=96 [ 156.160827][T10184] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 156.445680][ T42] audit: type=1400 audit(1785597462.863:1598): avc: denied { mount } for pid=10188 comm="syz.3.1341" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 156.512092][ T42] audit: type=1400 audit(1785597462.933:1599): avc: denied { unmount } for pid=5738 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 156.782197][T10174] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 156.887938][ T42] audit: type=1400 audit(1785597463.303:1600): avc: denied { sqpoll } for pid=10204 comm="syz.5.1345" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 157.014266][ T42] audit: type=1400 audit(1785597463.433:1601): avc: denied { getattr } for pid=10208 comm="syz.2.1346" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=35551 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 157.031370][ T42] audit: type=1400 audit(1785597463.443:1602): avc: denied { map } for pid=10208 comm="syz.2.1346" path="/dev/zero" dev="devtmpfs" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:zero_device_t tclass=chr_file permissive=1 [ 157.069759][T10211] 8021q: VLANs not supported on ip_vti0 [ 157.259763][T10220] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 157.262742][T10220] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 157.270631][T10220] vhci_hcd vhci_hcd.0: Device attached [ 157.274114][T10221] vhci_hcd: connection closed [ 157.275840][ T5833] vhci_hcd vhci_hcd.2: stop threads [ 157.282537][ T5833] vhci_hcd vhci_hcd.2: release socket [ 157.284835][ T5833] vhci_hcd vhci_hcd.2: disconnect device [ 157.459097][T10227] mmap: syz.0.1352 (10227) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 157.741243][T10243] netlink: 220 bytes leftover after parsing attributes in process `syz.3.1356'. [ 157.845801][T10250] bond2: option arp_interval: mode dependency failed, not supported in mode balance-alb(6) [ 157.852224][T10250] bond2 (unregistering): Released all slaves [ 158.012323][T10274] nilfs2: Unknown parameter 'barrierı' [ 158.194037][T10286] overlayfs: conflicting options: nfs_export=on,index=off [ 158.305232][T10289] xt_CT: You must specify a L4 protocol and not use inversions on it [ 158.406567][T10301] binder: BINDER_SET_CONTEXT_MGR already set [ 158.414919][T10301] binder: 10300:10301 ioctl 4018620d 200000000240 returned -16 [ 158.440494][T10301] binder: BINDER_SET_CONTEXT_MGR already set [ 158.442522][T10301] binder: 10300:10301 ioctl 4018620d 200000000180 returned -16 [ 158.492305][T10305] 9pnet: Found fid 0 not clunked [ 158.649376][T10301] syz.3.1373 (10301): drop_caches: 2 [ 158.741685][T10316] vlan2: entered allmulticast mode [ 158.743922][T10316] bond0: entered allmulticast mode [ 158.746093][T10316] syz_tun: entered allmulticast mode [ 158.773948][T10318] netlink: 'syz.5.1379': attribute type 10 has an invalid length. [ 158.778006][T10318] syz_tun: entered promiscuous mode [ 158.786960][T10318] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 158.838533][ T42] kauditd_printk_skb: 7 callbacks suppressed [ 158.838547][ T42] audit: type=1400 audit(1785597465.263:1610): avc: denied { connect } for pid=10323 comm="syz.3.1382" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 158.927267][T10333] : renamed from bond0 (while UP) [ 158.948302][T10333] overlayfs: upper fs does not support file handles, falling back to index=off. [ 158.955241][T10333] overlayfs: NFS export requires "index=on", falling back to nfs_export=off. [ 158.982799][T10338] syz.2.1385 (10338): attempted to duplicate a private mapping with mremap. This is not supported. [ 159.123490][T10348] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1389'. [ 159.141560][ T42] audit: type=1400 audit(1785597465.563:1611): avc: denied { write } for pid=10351 comm="syz.3.1390" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 159.152409][ T42] audit: type=1400 audit(1785597465.563:1612): avc: denied { connect } for pid=10351 comm="syz.3.1390" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 159.482248][T10358] binder: BINDER_SET_CONTEXT_MGR already set [ 159.485982][T10358] binder: 10357:10358 ioctl 4018620d 200000000100 returned -16 [ 159.496843][T10358] kvm: kvm [10357]: vcpu2, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010058) = 0x6 [ 159.501413][T10360] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1393'. [ 159.501955][T10358] binder: BINDER_SET_CONTEXT_MGR already set [ 159.506499][T10360] block nbd1: Unsupported socket: should be TCP or UNIX. [ 159.506584][T10358] binder: 10357:10358 ioctl 4018620d 200000004a80 returned -16 [ 159.600854][T10365] 9pnet_fd: p9_fd_create_tcp (10365): problem binding to privport [ 159.810108][T10372] net_ratelimit: 11 callbacks suppressed [ 159.810120][T10372] openvswitch: netlink: Missing key (keys=40, expected=100) [ 159.900002][ T1498] kernel write not supported for file /audio1 (pid: 1498 comm: kworker/3:2) [ 159.975246][ T42] audit: type=1400 audit(1785597466.393:1613): avc: denied { append } for pid=10381 comm="syz.2.1402" name="hpet" dev="devtmpfs" ino=630 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 160.013080][T10384] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1403'. [ 160.040285][T10384] vlan3: entered promiscuous mode [ 160.047048][T10384] bridge0: entered promiscuous mode [ 160.100583][T10391] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1405'. [ 160.169859][ T42] audit: type=1400 audit(1785597466.593:1614): avc: denied { create } for pid=10392 comm="syz.2.1406" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 160.174169][T10396] scsi_nl_rcv_msg: Msgtype 1 failed - err -3 [ 160.180011][ T42] audit: type=1400 audit(1785597466.593:1615): avc: denied { write } for pid=10392 comm="syz.2.1406" path="socket:[38421]" dev="sockfs" ino=38421 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 160.192027][ T42] audit: type=1400 audit(1785597466.603:1616): avc: denied { ioctl } for pid=10392 comm="syz.2.1406" path="socket:[38421]" dev="sockfs" ino=38421 ioctlcmd=0x89a1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 160.221062][T10394] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1407'. [ 160.221090][T10394] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1407'. [ 160.227222][T10394] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1407'. [ 160.234676][T10394] vcan0: tx drop: invalid da for name 0xffffffffffffffff [ 160.315364][T10405] vxfs: WRONG superblock magic 00000000 at 1 [ 160.319978][T10405] vxfs: WRONG superblock magic 00000000 at 8 [ 160.323246][T10405] vxfs: can't find superblock. [ 160.405921][T10419] netlink: 'syz.3.1416': attribute type 11 has an invalid length. [ 160.408906][T10419] netlink: 'syz.3.1416': attribute type 11 has an invalid length. [ 160.408990][T10419] netlink: 'syz.3.1416': attribute type 11 has an invalid length. [ 160.409065][T10419] netlink: 'syz.3.1416': attribute type 11 has an invalid length. [ 160.409132][T10419] netlink: 'syz.3.1416': attribute type 11 has an invalid length. [ 160.409195][T10419] netlink: 'syz.3.1416': attribute type 11 has an invalid length. [ 160.409255][T10419] netlink: 'syz.3.1416': attribute type 11 has an invalid length. [ 160.409332][T10419] netlink: 'syz.3.1416': attribute type 11 has an invalid length. [ 160.409398][T10419] netlink: 'syz.3.1416': attribute type 11 has an invalid length. [ 160.451196][T10424] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1418'. [ 160.488950][ T42] audit: type=1400 audit(1785597466.903:1617): avc: denied { cmd } for pid=10421 comm="syz.0.1417" path="/dev/null" dev="devtmpfs" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:null_device_t tclass=io_uring permissive=1 [ 160.550335][T10432] bridge_slave_1: default FDB implementation only supports local addresses [ 160.785919][T10456] tmpfs: Bad value for 'grpquota_block_hardlimit' [ 160.896715][T10464] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 160.907667][T10464] CPU: 3 UID: 0 PID: 10464 Comm: syz.5.1428 Tainted: G L syzkaller #0 PREEMPT(full) [ 160.907703][T10464] Tainted: [L]=SOFTLOCKUP [ 160.907711][T10464] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 160.907733][T10464] Call Trace: [ 160.907749][T10464] [ 160.907758][T10464] dump_stack_lvl+0x100/0x190 [ 160.907810][T10464] sysfs_warn_dup.cold+0x1c/0x28 [ 160.907855][T10464] sysfs_create_dir_ns+0x24b/0x2b0 [ 160.907885][T10464] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 160.907918][T10464] ? find_held_lock+0x2b/0x80 [ 160.907942][T10464] ? kobject_add_internal+0x25f/0x930 [ 160.908012][T10464] ? kobject_add_internal+0x25f/0x930 [ 160.908043][T10464] ? class_dir_child_ns_type+0xd/0x60 [ 160.908090][T10464] kobject_add_internal+0x2c8/0x930 [ 160.908127][T10464] kobject_add+0x16a/0x1e0 [ 160.908160][T10464] ? __pfx_kobject_add+0x10/0x10 [ 160.908193][T10464] ? get_device_parent+0x1b3/0x4c0 [ 160.908228][T10464] ? kobject_put+0xb9/0x640 [ 160.908263][T10464] device_add+0x294/0x1970 [ 160.908291][T10464] ? lockdep_init_map_type+0x5c/0x250 [ 160.908317][T10464] ? __pfx_device_add+0x10/0x10 [ 160.908343][T10464] ? lockdep_init_map_type+0x5c/0x250 [ 160.908367][T10464] ? __init_waitqueue_head+0xca/0x150 [ 160.908401][T10464] tty_register_device_attr+0x388/0x7f0 [ 160.908433][T10464] ? lockdep_init_map_type+0x5c/0x250 [ 160.908459][T10464] ? __pfx_tty_register_device_attr+0x10/0x10 [ 160.908489][T10464] ? tty_port_init+0x156/0x1c0 [ 160.908565][T10464] gsm_activate_mux+0x155/0x2a0 [ 160.908597][T10464] gsmld_ioctl+0xbbc/0x15c0 [ 160.908633][T10464] ? kasan_quarantine_put+0x104/0x240 [ 160.908679][T10464] ? __pfx_gsmld_ioctl+0x10/0x10 [ 160.908709][T10464] ? __ldsem_down_read_nested+0xf3/0x890 [ 160.908745][T10464] ? __pfx___ldsem_down_read_nested+0x10/0x10 [ 160.908781][T10464] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 160.908814][T10464] ? __pfx_pty_unix98_ioctl+0x10/0x10 [ 160.908836][T10464] ? __pfx_gsmld_ioctl+0x10/0x10 [ 160.908868][T10464] tty_ioctl+0x11b4/0x1640 [ 160.908896][T10464] ? __pfx_tty_ioctl+0x10/0x10 [ 160.908920][T10464] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 160.908968][T10464] ? __fget_files+0x215/0x3d0 [ 160.908996][T10464] ? hook_file_ioctl_common+0x140/0x440 [ 160.909034][T10464] ? selinux_file_ioctl+0x13b/0x290 [ 160.909063][T10464] ? selinux_file_ioctl+0xb6/0x290 [ 160.909098][T10464] ? __pfx_tty_ioctl+0x10/0x10 [ 160.909123][T10464] __x64_sys_ioctl+0x18e/0x210 [ 160.909154][T10464] do_syscall_64+0x115/0x870 [ 160.909179][T10464] ? clear_bhb_loop+0x40/0x90 [ 160.909203][T10464] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.909222][T10464] RIP: 0033:0x7f12d9d9e019 [ 160.909239][T10464] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 160.909257][T10464] RSP: 002b:00007f12dabc0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 160.909285][T10464] RAX: ffffffffffffffda RBX: 00007f12da026090 RCX: 00007f12d9d9e019 [ 160.909299][T10464] RDX: 00002000000001c0 RSI: 00000000404c4701 RDI: 0000000000000003 [ 160.909311][T10464] RBP: 00007f12d9e3500c R08: 0000000000000000 R09: 0000000000000000 [ 160.909324][T10464] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 160.909336][T10464] R13: 00007f12da026128 R14: 00007f12da026090 R15: 00007ffe56b50928 [ 160.909363][T10464] [ 160.910253][T10464] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 160.923516][ T42] audit: type=1400 audit(1785597467.343:1618): avc: denied { setattr } for pid=10467 comm="syz.3.1429" name="XDP" dev="sockfs" ino=40272 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 160.926005][T10468] binder: BINDER_SET_CONTEXT_MGR already set [ 161.040734][T10472] binder: BINDER_SET_CONTEXT_MGR already set [ 161.042680][T10472] binder: 10467:10472 ioctl 4018620d 200000001000 returned -16 [ 161.045499][T10468] binder: 10467:10468 ioctl 4018620d 200000000100 returned -16 [ 161.117930][T10475] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=263 sclass=netlink_route_socket pid=10475 comm=syz.2.1430 [ 161.307931][T10483] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1433'. [ 161.356083][ T42] audit: type=1400 audit(1785597467.773:1619): avc: denied { mounton } for pid=10487 comm="syz.5.1434" path="/83/file0" dev="tmpfs" ino=466 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 161.653994][T10510] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1440'. [ 162.332355][T10571] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=34619 sclass=netlink_route_socket pid=10571 comm=syz.2.1449 [ 162.395305][T10582] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 163.613957][T10639] gfs2: error -5 reading superblock [ 163.617508][T10640] gfs2: error -5 reading superblock [ 163.621111][ T5817] netdevsim netdevsim10 eth1: set [0, 1] type 1 family 0 port 8472 - 0 [ 163.623764][ T5817] netdevsim netdevsim10 eth0: set [0, 1] type 1 family 0 port 8472 - 0 [ 163.626394][ T5817] netdevsim netdevsim2 netdevsim3: set [0, 1] type 1 family 0 port 8472 - 0 [ 163.630554][ T5817] netdevsim netdevsim2 netdevsim2: set [0, 1] type 1 family 0 port 8472 - 0 [ 163.640006][ T5817] netdevsim netdevsim2 netdevsim1: set [0, 1] type 1 family 0 port 8472 - 0 [ 163.644921][ T5817] netdevsim netdevsim2 netdevsim0: set [0, 1] type 1 family 0 port 8472 - 0 [ 163.822080][T10668] overlayfs: failed to decode file handle (len=8, type=8192, flags=0, err=-22) [ 163.833324][T10673] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10673 comm=syz.2.1477 [ 164.222362][ T42] kauditd_printk_skb: 10 callbacks suppressed [ 164.222381][ T42] audit: type=1400 audit(1785597470.643:1630): avc: denied { mounton } for pid=10689 comm="syz.0.1481" path="/376/file0" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 164.273626][T10692] validate_nla: 60 callbacks suppressed [ 164.273645][T10692] netlink: 'syz.0.1482': attribute type 16 has an invalid length. [ 164.279750][T10692] __nla_validate_parse: 15 callbacks suppressed [ 164.279761][T10692] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.1482'. [ 164.296289][T10692] Cannot find del_set index 2 as target [ 164.303029][ T42] audit: type=1400 audit(1785597470.723:1631): avc: denied { create } for pid=10691 comm="syz.0.1482" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 164.624701][T10703] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1485'. [ 164.632236][T10703] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1485'. [ 164.635341][T10703] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1485'. [ 164.930610][ T42] audit: type=1400 audit(1785597471.353:1632): avc: denied { mount } for pid=10711 comm="syz.0.1488" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 165.152925][ T42] audit: type=1400 audit(1785597471.573:1633): avc: denied { unmount } for pid=5747 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 165.320335][T10724] : renamed from vlan0 (while UP) [ 165.332431][ T42] audit: type=1400 audit(1785597471.753:1634): avc: denied { map } for pid=10722 comm="syz.0.1491" path="/dev/uinput" dev="devtmpfs" ino=944 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 166.867236][ T5855] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 166.904747][T10681] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 166.937272][T10732] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1495'. [ 166.941153][T10732] binder: BINDER_SET_CONTEXT_MGR already set [ 166.946927][T10732] binder: 10731:10732 ioctl 4018620d 200000000100 returned -16 [ 166.952726][T10734] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1494'. [ 166.954230][T10732] binder: BINDER_SET_CONTEXT_MGR already set [ 166.959427][T10732] binder: 10731:10732 ioctl 4018620d 200000000140 returned -16 [ 166.960103][T10734] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1494'. [ 166.966513][T10734] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1494'. [ 167.007815][T10740] program syz.0.1497 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 167.014989][T10740] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1497'. [ 167.027842][ T5855] usb 10-1: Using ep0 maxpacket: 8 [ 167.033739][ T5855] usb 10-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 167.037869][ T5855] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.053712][ T5855] pvrusb2: Hardware description: Terratec Grabster AV400 [ 167.056589][ T5855] pvrusb2: ********** [ 167.057213][T10745] netlink: 'syz.0.1498': attribute type 21 has an invalid length. [ 167.059020][ T5855] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 167.060749][T10745] netlink: 'syz.0.1498': attribute type 6 has an invalid length. [ 167.064346][ T5855] pvrusb2: Important functionality might not be entirely working. [ 167.066652][T10745] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1498'. [ 167.070051][ T5855] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 167.076288][ T5855] pvrusb2: ********** [ 167.227212][ T5743] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 167.253932][ T2522] pvrusb2: Invalid write control endpoint [ 167.301554][ T2522] pvrusb2: Invalid write control endpoint [ 167.304112][ T2522] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 167.308948][ T2522] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 167.312041][ T2522] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 167.314984][ T2522] pvrusb2: Device being rendered inoperable [ 167.321963][ T2522] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 167.325023][ T2522] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 167.334201][ T2522] pvrusb2: Attached sub-driver cx25840 [ 167.337717][ T2522] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 167.340863][ T2522] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 167.377145][ T5743] usb 7-1: Using ep0 maxpacket: 8 [ 167.380139][ T5743] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 167.383598][ T5743] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 167.386675][ T5743] usb 7-1: config 0 interface 0 has no altsetting 0 [ 167.389175][ T5743] usb 7-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 167.391904][ T5743] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.395770][ T5743] usb 7-1: config 0 descriptor?? [ 167.457459][ T1047] usb 10-1: USB disconnect, device number 8 [ 168.017452][ T5743] usbhid 7-1:0.0: can't add hid device: -71 [ 168.020976][ T5743] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 168.025094][ T5743] usb 7-1: USB disconnect, device number 8 [ 168.040666][T10769] syzkaller0: entered promiscuous mode [ 168.043177][T10769] syzkaller0: entered allmulticast mode [ 168.094247][T10778] syzkaller1: entered promiscuous mode [ 168.096193][T10778] syzkaller1: entered allmulticast mode [ 168.101075][T10770] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61 sclass=netlink_route_socket pid=10770 comm=syz.3.1504 [ 168.105779][ T42] audit: type=1400 audit(1785597474.524:1635): avc: denied { lock } for pid=10763 comm="syz.3.1504" path="socket:[41155]" dev="sockfs" ino=41155 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 168.115354][ T42] audit: type=1400 audit(1785597474.544:1636): avc: denied { connect } for pid=10763 comm="syz.3.1504" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 168.136910][T10786] raw_sendmsg: syz.5.1510 forgot to set AF_INET. Fix it! [ 168.152855][T10788] openvswitch: netlink: Duplicate or invalid key (type 0). [ 168.155992][T10788] openvswitch: netlink: Actions may not be safe on all matching packets [ 168.160311][T10788] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 168.163533][ T42] audit: type=1400 audit(1785597474.584:1637): avc: denied { mounton } for pid=10787 comm="syz.0.1512" path="/393/file0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 168.163799][T10789] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 168.175423][ T42] audit: type=1400 audit(1785597474.594:1638): avc: denied { read } for pid=10787 comm="syz.0.1512" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 168.184770][ T42] audit: type=1400 audit(1785597474.594:1639): avc: denied { read } for pid=10787 comm="syz.0.1512" name="/" dev="overlay" ino=4611686018427387905 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 168.988152][T10820] usb usb9: usbfs: process 10820 (syz.3.1519) did not claim interface 10 before use [ 169.134698][T10828] xt_l2tp: v2 sid > 0xffff: 4294967294 [ 169.319358][ T42] kauditd_printk_skb: 7 callbacks suppressed [ 169.319377][ T42] audit: type=1400 audit(1785597475.744:1647): avc: denied { execheap } for pid=10849 comm="syz.2.1530" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 169.447039][T10859] i2c i2c-1: DVB: adapter 0 frontend 0 symbol rate 3 out of range (1000000..45000000) [ 169.536088][T10826] bond0: (slave syz_tun): Releasing backup interface [ 169.546829][T10865] loop5: detected capacity change from 0 to 7 [ 169.551237][T10865] Dev loop5: unable to read RDB block 7 [ 169.553063][T10865] loop5: AHDI p1 p2 p3 [ 169.554471][T10865] loop5: partition table partially beyond EOD, truncated [ 169.556932][T10865] loop5: p1 start 1601398130 is beyond EOD, truncated [ 169.559098][T10865] loop5: p2 start 1702059890 is beyond EOD, truncated [ 169.568066][ T42] audit: type=1400 audit(1785597475.984:1648): avc: denied { setcurrent } for pid=10864 comm="syz.0.1529" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 169.613560][T10868] __nla_validate_parse: 13 callbacks suppressed [ 169.613574][T10868] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1534'. [ 169.632592][T10863] 8021q: adding VLAN 0 to HW filter on device bond1 [ 169.646749][T10868] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1534'. [ 169.651289][T10868] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1534'. [ 169.776903][ T42] audit: type=1326 audit(1785597476.194:1649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10870 comm="syz.0.1537" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f615939e019 code=0x50000 [ 169.783813][ T42] audit: type=1326 audit(1785597476.194:1650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10870 comm="syz.0.1537" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f615939e019 code=0x50000 [ 169.784522][ T5744] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 169.791237][ T42] audit: type=1326 audit(1785597476.194:1651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10870 comm="syz.0.1537" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f615939e019 code=0x50000 [ 169.800732][ T5744] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 169.801349][ T42] audit: type=1326 audit(1785597476.194:1652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10870 comm="syz.0.1537" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f615939e019 code=0x50000 [ 169.805072][ T5744] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 169.811748][ T42] audit: type=1326 audit(1785597476.194:1653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10870 comm="syz.0.1537" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f615939e019 code=0x50000 [ 169.815628][ T5744] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 169.821731][ T42] audit: type=1326 audit(1785597476.194:1654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10870 comm="syz.0.1537" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f615939e019 code=0x50000 [ 169.821756][ T42] audit: type=1326 audit(1785597476.194:1655): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10870 comm="syz.0.1537" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f615939e019 code=0x50000 [ 169.821778][ T42] audit: type=1326 audit(1785597476.194:1656): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10870 comm="syz.0.1537" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f615939e019 code=0x50000 [ 169.828341][ T5744] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 170.242097][T10888] ipt_ECN: cannot use operation on non-tcp rule [ 170.339531][T10872] bridge0: port 1(bridge_slave_0) entered blocking state [ 170.342566][T10872] bridge0: port 1(bridge_slave_0) entered disabled state [ 170.345574][T10872] bridge_slave_0: entered allmulticast mode [ 170.350359][T10872] bridge_slave_0: entered promiscuous mode [ 170.365204][T10872] bridge0: port 2(bridge_slave_1) entered blocking state [ 170.368569][T10872] bridge0: port 2(bridge_slave_1) entered disabled state [ 170.371519][T10872] bridge_slave_1: entered allmulticast mode [ 170.375124][T10872] bridge_slave_1: entered promiscuous mode [ 170.405461][T10872] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 170.414519][T10872] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 170.440830][T10893] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1539'. [ 170.447472][T10872] team0: Port device team_slave_0 added [ 170.448542][T10893] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1539'. [ 170.454140][T10872] team0: Port device team_slave_1 added [ 170.477357][T10893] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1539'. [ 170.487046][T10893] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1539'. [ 170.518529][T10872] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 170.523121][T10872] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 170.542152][T10872] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 170.547679][T10872] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 170.550440][T10872] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 170.560282][T10872] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 170.610298][T10872] hsr_slave_0: entered promiscuous mode [ 170.613425][T10872] hsr_slave_1: entered promiscuous mode [ 170.615968][T10903] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1543'. [ 170.618915][T10872] debugfs: 'hsr0' already exists in 'hsr' [ 170.621550][T10872] Cannot create hsr debugfs directory [ 170.759215][ T5817] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 170.762618][ T5817] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 170.831476][T10911] netlink: 76 bytes leftover after parsing attributes in process `syz.5.1542'. [ 170.844969][T10872] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 170.852185][T10872] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 170.855962][T10872] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 170.862831][T10872] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 170.865928][T10872] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 170.872090][T10872] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 170.876330][T10872] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 170.889563][T10872] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 170.908143][T10872] bridge0: port 2(bridge_slave_1) entered blocking state [ 170.910444][T10872] bridge0: port 2(bridge_slave_1) entered forwarding state [ 170.912793][T10872] bridge0: port 1(bridge_slave_0) entered blocking state [ 170.914985][T10872] bridge0: port 1(bridge_slave_0) entered forwarding state [ 170.923609][T10534] bridge0: port 1(bridge_slave_0) entered disabled state [ 170.926452][T10534] bridge0: port 2(bridge_slave_1) entered disabled state [ 171.003723][T10872] 8021q: adding VLAN 0 to HW filter on device bond0 [ 171.044868][T10872] 8021q: adding VLAN 0 to HW filter on device team0 [ 171.058246][ T1171] bridge0: port 1(bridge_slave_0) entered blocking state [ 171.060505][ T1171] bridge0: port 1(bridge_slave_0) entered forwarding state [ 171.076413][ T1171] bridge0: port 2(bridge_slave_1) entered blocking state [ 171.078784][ T1171] bridge0: port 2(bridge_slave_1) entered forwarding state [ 171.120551][ T12] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 171.147072][ T5833] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 171.375446][T10872] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 171.448597][T10932] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1545'. [ 171.574783][T10872] veth0_vlan: entered promiscuous mode [ 171.582197][T10872] veth1_vlan: entered promiscuous mode [ 171.611554][T10872] veth0_macvtap: entered promiscuous mode [ 171.618851][T10872] veth1_macvtap: entered promiscuous mode [ 171.630969][T10872] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 171.645830][T10872] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 171.698827][ T12] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.719023][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.732442][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.742978][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.753531][ T1177] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 171.759948][ T1177] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 171.796166][ T9330] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 171.798899][ T9330] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 171.946529][T10955] pi3usb30532 0-0059: Error reading config register -6 [ 171.948962][ T5744] Bluetooth: hci0: command tx timeout [ 171.954802][T10955] i2c i2c-0: new_device: Instantiated device pi3usb30532 at 0x59 [ 172.216943][ T1047] usb 11-1: new high-speed USB device number 2 using dummy_hcd [ 172.378772][ T1047] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 172.382872][ T1047] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 172.387467][ T1047] usb 11-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 172.392691][ T1047] usb 11-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 172.396398][ T1047] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 172.407648][ T1047] usb 11-1: config 0 descriptor?? [ 172.762613][ T5825] kernel write not supported for file /audio1 (pid: 5825 comm: kworker/2:4) [ 172.812195][T10963] binder: 10962:10963 ioctl c0306201 200000000600 returned -14 [ 172.816226][ T1047] hid_parser_main: 20 callbacks suppressed [ 172.816241][ T1047] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 172.823530][ T1047] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 172.825981][ T1047] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 172.829330][ T1047] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 172.831741][ T1047] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 172.834052][ T1047] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 172.836381][ T1047] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 172.839138][ T1047] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 172.841553][ T1047] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 172.843850][ T1047] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 172.849045][ T1047] plantronics 0003:047F:FFFF.0007: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 172.933431][T10969] i2c i2c-0: Failed to register i2c client pi3usb30532 at 0x59 (-16) [ 172.992693][T10971] syz_tun: refused to change device tx_queue_len [ 172.997000][T10973] : (slave syz_tun): Releasing backup interface [ 172.997328][T10971] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=10971 comm=syz.0.1558 [ 173.006984][T10973] bridge0: port 3(syz_tun) entered blocking state [ 173.009480][T10973] bridge0: port 3(syz_tun) entered disabled state [ 173.011694][T10973] syz_tun: entered allmulticast mode [ 173.074746][T10979] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 173.077838][T10979] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 173.091873][ T1047] usb 11-1: USB disconnect, device number 2 [ 173.279685][T11010] fuse: Bad value for 'group_id' [ 173.281722][T11010] fuse: Bad value for 'group_id' [ 173.290956][T11010] xt_cgroup: xt_cgroup: no path or classid specified [ 173.298453][T11012] netdevsim netdevsim5: Direct firmware load for . [ 173.298453][T11012] failed with error -2 [ 173.306367][T11012] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 173.306367][T11012] [ 173.433026][T11027] bond0: (slave syz_tun): Releasing backup interface [ 173.440391][T11027] syz_tun: left allmulticast mode [ 173.444035][T11027] batman_adv: batadv0: Interface deactivated: dummy0 [ 173.450342][T11027] batman_adv: batadv0: Removing interface: dummy0 [ 173.456353][T11027] bond4: (slave veth0_to_bond): Releasing backup interface [ 173.464180][T11027] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 173.487362][T11027] team0: Port device xfrm0 added [ 173.489106][T11028] tipc: Started in network mode [ 173.490691][T11028] tipc: Node identity ee019e070d52, cluster identity 4711 [ 173.493200][T11028] tipc: Enabled bearer , priority 0 [ 173.529035][T11041] binder: BC_ACQUIRE_RESULT not supported [ 173.531013][T11041] binder: 11040:11041 ioctl c0306201 2000000003c0 returned -22 [ 173.860601][T11058] tmpfs: Bad value for 'mpol' [ 173.869792][T11058] erspan0: entered promiscuous mode [ 174.026976][ T5744] Bluetooth: hci0: command tx timeout [ 174.129031][T11015] netdevsim netdevsim5: Direct firmware load for . [ 174.129031][T11015] failed with error -2 [ 174.133032][T11015] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 174.133032][T11015] [ 174.144573][T11076] IPVS: length: 120 != 24 [ 174.362136][T11094] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61 sclass=netlink_route_socket pid=11094 comm=syz.5.1593 [ 174.367036][T11094] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=35 sclass=netlink_route_socket pid=11094 comm=syz.5.1593 [ 174.487264][ T9] tipc: Node number set to 3813907975 [ 174.608383][ T42] kauditd_printk_skb: 34575 callbacks suppressed [ 174.608449][ T42] audit: type=1400 audit(1785597481.034:36232): avc: denied { setopt } for pid=11113 comm="syz.6.1598" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 174.763022][T11118] __nla_validate_parse: 21 callbacks suppressed [ 174.763034][T11118] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1600'. [ 174.769212][T11118] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1600'. [ 174.772854][T11118] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1600'. [ 174.776431][T11118] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1600'. [ 174.780729][T11118] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1600'. [ 174.783909][T11118] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1600'. [ 174.789310][T11118] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1600'. [ 174.794150][T11118] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1600'. [ 174.797859][T11118] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1600'. [ 174.801323][T11118] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1600'. [ 175.058538][T11136] kAFS: unparsable volume name [ 175.134003][ T42] audit: type=1400 audit(1785597481.554:36233): avc: denied { ioctl } for pid=11140 comm="syz.2.1607" path="socket:[41809]" dev="sockfs" ino=41809 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 175.209093][T11143] loop9: detected capacity change from 0 to 255852544 [ 175.256924][T11143] Invalid logical block size (4) [ 175.262393][T11143] netlink: 'syz.2.1608': attribute type 9 has an invalid length. [ 175.287785][T11143] /dev/sg0: Can't lookup blockdev [ 175.370654][T11148] netlink: 'syz.0.1610': attribute type 1 has an invalid length. [ 175.386069][T11148] 8021q: adding VLAN 0 to HW filter on device bond6 [ 175.884225][T11207] overlayfs: unescaped trailing colons in lowerdir mount option. [ 175.905456][T11207] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11207 comm=syz.5.1625 [ 175.928904][T11210] vhci_hcd vhci_hcd.0: failed to lookup sock [ 175.934049][ T42] audit: type=1400 audit(1785597482.354:36234): avc: denied { read } for pid=11202 comm="syz.6.1624" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 176.117282][ T5744] Bluetooth: hci0: command tx timeout [ 176.241498][ T42] audit: type=1400 audit(1785597482.664:36235): avc: denied { read } for pid=11224 comm="syz.0.1630" name="ndctl0" dev="devtmpfs" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 176.407060][T11233] random: crng reseeded on system resumption [ 176.407936][ T42] audit: type=1400 audit(1785597482.834:36236): avc: denied { write } for pid=11232 comm="syz.0.1632" name="snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 176.819270][T11245] misc userio: Begin command sent, but we're already running [ 176.833508][T11244] misc userio: Can't change port type on an already running userio instance [ 176.898465][T11255] Bluetooth: MGMT ver 1.23 [ 176.939583][T11261] vlan1: entered promiscuous mode [ 177.171622][T11277] openvswitch: netlink: Actions may not be safe on all matching packets [ 177.821282][T11308] sctp: [Deprecated]: syz.0.1659 (pid 11308) Use of int in max_burst socket option. [ 177.821282][T11308] Use struct sctp_assoc_value instead [ 177.854062][T11310] Invalid source name [ 177.855680][T11310] UBIFS error (pid: 11310): cannot open "./file0", error -22 [ 177.885266][T11310] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 177.985396][T11313] syzkaller0: entered promiscuous mode [ 177.987822][T11313] syzkaller0: entered allmulticast mode [ 177.998689][T11313] tipc: Enabled bearer , priority 0 [ 178.013545][T11312] tipc: Resetting bearer [ 178.038557][T11312] tipc: Disabling bearer [ 178.186513][ T5744] Bluetooth: hci0: command tx timeout [ 178.287872][T11318] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 178.301369][T11318] CIFS: Attempting to mount //127.0.0.1/share [ 178.308953][T11318] CIFS: VFS: Error connecting to socket. Aborting operation. [ 178.311752][T11318] CIFS: VFS: cifs_mount failed w/return code = -111 [ 178.400820][T11332] clocksource: Override clocksource jiffies is not currently HRT compatible - deferring [ 178.450525][T11339] openvswitch: netlink: Missing key (keys=c0, expected=480) [ 178.521599][T11345] netlink: del zone limit has 8 unknown bytes [ 178.583303][T11349] team0: No ports can be present during mode change [ 178.703597][ T42] audit: type=1400 audit(1785597485.124:36237): avc: denied { write } for pid=11366 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 178.734236][ T42] audit: type=1400 audit(1785597485.154:36238): avc: denied { append } for pid=11371 comm="syz.5.1679" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 178.754693][ T42] audit: type=1400 audit(1785597485.174:36239): avc: denied { write } for pid=11373 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 178.937662][ T42] audit: type=1400 audit(1785597485.354:36240): avc: denied { setopt } for pid=11381 comm="syz.0.1682" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 179.008360][T11392] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 179.133104][T11397] ip6erspan1: entered allmulticast mode [ 179.554210][T11416] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 179.558046][T11416] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 179.562453][T11416] overlayfs: failed to set uuid (160/file1, err=-13); falling back to uuid=null. [ 179.692398][T11442] 9pnet_virtio: no channels available for device 127.0.0.1 [ 179.792992][T11449] scsi_dev_info_list_add_str: bad dev info string 'end' '' '' [ 179.914960][T11456] __nla_validate_parse: 101 callbacks suppressed [ 179.914980][T11456] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1702'. [ 179.922005][T11456] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1702'. [ 179.925344][T11456] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1702'. [ 179.926075][T11458] netlink: 868 bytes leftover after parsing attributes in process `syz.0.1701'. [ 180.652182][T11463] cgroup: none used incorrectly [ 180.657199][T11464] cgroup: none used incorrectly [ 180.692033][T11466] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 181.057994][T11488] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1711'. [ 181.061274][T11488] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1711'. [ 181.064291][T11488] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1711'. [ 181.101897][ T42] audit: type=1400 audit(1785597487.524:36241): avc: denied { write } for pid=11489 comm="syz.0.1712" name="instances" dev="tracefs" ino=2165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 181.111330][ T42] audit: type=1400 audit(1785597487.524:36242): avc: denied { add_name } for pid=11489 comm="syz.0.1712" name="inst1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 181.119765][ T42] audit: type=1400 audit(1785597487.524:36243): avc: denied { create } for pid=11489 comm="syz.0.1712" name="inst1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:tracefs_t tclass=dir permissive=1 [ 181.169859][ T42] audit: type=1400 audit(1785597487.594:36244): avc: denied { write } for pid=11489 comm="syz.0.1712" name="set_event" dev="tracefs" ino=46109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 181.292816][T11500] nfs: Unknown parameter '' [ 181.579015][ T42] audit: type=1400 audit(1785597488.004:36245): avc: denied { checkpoint_restore } for pid=11505 comm="syz.6.1716" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 181.738936][ T42] audit: type=1400 audit(1785597488.164:36246): avc: denied { ioctl } for pid=11512 comm="syz.6.1717" path="socket:[44009]" dev="sockfs" ino=44009 ioctlcmd=0x89fa scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 181.785776][T11515] syzkaller0: entered promiscuous mode [ 181.788612][T11515] syzkaller0: entered allmulticast mode [ 181.900668][ T42] audit: type=1400 audit(1785597488.324:36247): avc: denied { mounton } for pid=11516 comm="syz.6.1719" path="/42/proc/sys/net/sctp/udp_port" dev="proc" ino=45304 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_net_t tclass=file permissive=1 [ 181.900685][T11517] gfs2meta: Unknown parameter 'GPL' [ 181.973106][ T42] audit: type=1400 audit(1785597488.394:36248): avc: denied { setattr } for pid=11518 comm="syz.6.1720" name="loop6" dev="devtmpfs" ino=664 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 182.158125][T11524] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1721'. [ 182.161779][T11524] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1721'. [ 182.165436][T11524] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1721'. [ 182.376647][T11529] netlink: 'syz.0.1723': attribute type 4 has an invalid length. [ 182.636283][ T5818] usb 5-1: new full-speed USB device number 15 using dummy_hcd [ 182.744101][T11551] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 182.789893][ T5818] usb 5-1: config 0 has no interfaces? [ 182.791588][ T5818] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 182.795061][ T5818] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.805197][ T5818] usb 5-1: config 0 descriptor?? [ 183.018032][ T5818] usb 5-1: USB disconnect, device number 15 [ 183.024817][T11570] overlay: ./file0 is not a directory [ 183.249847][T11574] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 183.555979][T11586] syzkaller0: entered promiscuous mode [ 183.559023][T11586] syzkaller0: entered allmulticast mode [ 184.062966][T11598] netlink: 'syz.6.1743': attribute type 4 has an invalid length. [ 184.177472][T11600] SELinux: policydb string  does not match my string SE Linux [ 184.180702][T11600] SELinux: failed to load policy [ 184.280713][ T42] audit: type=1400 audit(1785597490.704:36249): avc: denied { getopt } for pid=11609 comm="syz.6.1746" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 184.641590][T11617] dlm: no locking on control device [ 184.971391][T11624] __nla_validate_parse: 8 callbacks suppressed [ 184.971405][T11624] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1751'. [ 184.978568][T11624] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1751'. [ 184.982747][T11624] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1751'. [ 185.419668][T11643] netlink: 104 bytes leftover after parsing attributes in process `syz.5.1755'. [ 185.624653][T11656] netlink: 36 bytes leftover after parsing attributes in process `syz.6.1760'. [ 185.630921][T11656] netlink: 68 bytes leftover after parsing attributes in process `syz.6.1760'. [ 185.634973][T11656] netlink: 68 bytes leftover after parsing attributes in process `syz.6.1760'. [ 185.676702][ T5825] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 185.847674][ T5825] usb 5-1: not running at top speed; connect to a high speed hub [ 185.851086][ T5825] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 185.854689][ T5825] usb 5-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 185.859881][ T5825] usb 5-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 185.862886][ T5825] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.865418][ T5825] usb 5-1: Product: щ [ 185.867188][ T5825] usb 5-1: Manufacturer: 䁽攴븚櫖驘﷩簚騖鹆墯䤛墈쭟ꬡ꧒읁혚ꗸУ羀굙骱瘿䁅ᇹ [ 185.871467][ T5825] usb 5-1: SerialNumber: 䏝郝䊥꫆ႂᆓ㒙됿㻲鹰᳂祇䂄䂒倸堚䀡於涃鉼ꖸ绝ꃝ뀁㼑뺄ኻ溎蝡뚲湰砑靲됭⍆䭦㫓ꋕꡖᦔ줧抦䬥ਰ蔶⳩鑅⡀抶ꦃ॥靡ᚩ胐악廃텲萄䯧샀飾刞ࢫ鹵팼夭ⓐ [ 185.884431][T11646] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 185.925388][T11669] netlink: 'syz.6.1764': attribute type 11 has an invalid length. [ 186.080274][T11672] misc userio: Can't change port type on an already running userio instance [ 186.101011][ T5825] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 186.103453][ T5825] usb 5-1: MIDIStreaming interface descriptor not found [ 186.139923][ T5825] usb 5-1: USB disconnect, device number 16 [ 186.197713][T10471] udevd[10471]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 186.949074][T11676] netdevsim netdevsim6: Firmware load for './file0/../file0/file0' refused, path contains '..' component [ 186.958938][T11676] program syz.6.1766 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 187.048715][T11678] loop5: detected capacity change from 0 to 2640 [ 187.075098][T10466] Buffer I/O error on dev loop5, logical block 0, async page read [ 187.089907][T11678] Buffer I/O error on dev loop5, logical block 0, lost async page write [ 187.092738][T11678] Buffer I/O error on dev loop5, logical block 1, lost async page write [ 187.095703][T11678] Buffer I/O error on dev loop5, logical block 2, lost async page write [ 187.099676][T11678] Buffer I/O error on dev loop5, logical block 3, lost async page write [ 187.102549][T11678] Buffer I/O error on dev loop5, logical block 4, lost async page write [ 187.105240][T11678] Buffer I/O error on dev loop5, logical block 5, lost async page write [ 187.109034][T11678] Buffer I/O error on dev loop5, logical block 6, lost async page write [ 187.112115][T11678] Buffer I/O error on dev loop5, logical block 7, lost async page write [ 187.114932][T11678] Buffer I/O error on dev loop5, logical block 8, lost async page write [ 187.234270][T11687] netlink: 36 bytes leftover after parsing attributes in process `syz.6.1770'. [ 187.291501][T11691] netlink: 36 bytes leftover after parsing attributes in process `syz.6.1771'. [ 187.309103][T11691] netlink: 68 bytes leftover after parsing attributes in process `syz.6.1771'. [ 187.820248][T11705] bridge0: port 2(bridge_slave_1) entered disabled state [ 187.884791][ T42] audit: type=1400 audit(1785597494.305:36250): avc: denied { name_bind } for pid=11707 comm="syz.6.1778" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 187.886643][T11708] Invalid source name [ 187.894942][T11708] UBIFS error (pid: 11708): cannot open "ubifs", error -22 [ 188.081703][ T42] audit: type=1400 audit(1785597494.505:36251): avc: denied { write } for pid=11712 comm="syz.6.1780" name="h" dev="configfs" ino=16673 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 188.096474][ T42] audit: type=1400 audit(1785597494.505:36252): avc: denied { write } for pid=11712 comm="syz.6.1780" name="h" dev="configfs" ino=16673 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 188.219316][T11723] tmpfs: Bad value for 'mpol' [ 188.346339][T11729] overlay: ./bus is not a directory [ 189.142377][T11774] syz.5.1799 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 189.810383][ T42] audit: type=1400 audit(1785597496.235:36253): avc: denied { create } for pid=11784 comm="syz.5.1803" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 189.985000][T11804] __nla_validate_parse: 9 callbacks suppressed [ 189.985017][T11804] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1809'. [ 189.986202][T11805] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1808'. [ 189.988797][T11804] netlink: 144 bytes leftover after parsing attributes in process `syz.6.1809'. [ 190.006560][T11805] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1808'. [ 190.017215][T11805] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1808'. [ 190.700229][ T42] audit: type=1400 audit(1785597497.125:36254): avc: denied { write } for pid=11828 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 190.750690][ T42] audit: type=1400 audit(1785597497.175:36255): avc: denied { write } for pid=11831 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 190.833061][ T42] audit: type=1400 audit(1785597497.255:36256): avc: denied { write } for pid=11837 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 190.896872][ T42] audit: type=1400 audit(1785597497.325:36257): avc: denied { write } for pid=11845 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 190.920419][ T42] audit: type=1400 audit(1785597497.345:36258): avc: denied { read } for pid=11846 comm="syz.5.1816" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 191.063252][T11856] netlink: 'syz.0.1818': attribute type 30 has an invalid length. [ 191.282215][T11858] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1819'. [ 191.349588][ T42] audit: type=1400 audit(1785597497.775:36259): avc: denied { read write } for pid=11863 comm="syz.6.1820" name="loop-control" dev="devtmpfs" ino=657 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 191.441404][T11868] bond0: entered promiscuous mode [ 191.442935][T11868] bond_slave_0: entered promiscuous mode [ 191.444733][T11868] bond_slave_1: entered promiscuous mode [ 191.499024][T11876] vhci_hcd vhci_hcd.0: remove, state 4 [ 191.503323][T11876] usb usb38: USB disconnect, device number 1 [ 191.542308][T11874] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1825'. [ 191.632627][ T13] vhci_hcd vhci_hcd.0: stop threads [ 191.633551][T11876] vhci_hcd vhci_hcd.0: USB bus 38 deregistered [ 191.636094][ T13] vhci_hcd vhci_hcd.0: release socket [ 191.639355][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 191.641917][ T13] vhci_hcd vhci_hcd.0: stop threads [ 191.644642][ T13] vhci_hcd vhci_hcd.0: release socket [ 191.655273][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 191.657706][ T13] vhci_hcd vhci_hcd.0: stop threads [ 191.660030][ T13] vhci_hcd vhci_hcd.0: release socket [ 191.661063][T11876] vhci_hcd vhci_hcd.0: remove, state 4 [ 191.662488][ T13] ================================================================== [ 191.665967][T11876] usb usb37: USB disconnect, device number 1 [ 191.668099][ T13] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x44/0x456 [ 191.674096][ T13] Read of size 4 at addr ffff88802dc348f0 by task kworker/u32:1/13 [ 191.678508][ T13] [ 191.680287][ T13] CPU: 3 UID: 0 PID: 13 Comm: kworker/u32:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 191.680312][ T13] Tainted: [L]=SOFTLOCKUP [ 191.680319][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 191.680333][ T13] Workqueue: usbip_event event_handler [ 191.680420][ T13] Call Trace: [ 191.680435][ T13] [ 191.680441][ T13] dump_stack_lvl+0x100/0x190 [ 191.680475][ T13] print_report+0x13d/0x4b0 [ 191.680510][ T13] ? __virt_addr_valid+0x239/0x430 [ 191.680545][ T13] ? vhci_cleanup_unlink_list+0x44/0x456 [ 191.680572][ T13] kasan_report+0xdf/0x1c0 [ 191.680607][ T13] ? vhci_cleanup_unlink_list+0x44/0x456 [ 191.680634][ T13] vhci_cleanup_unlink_list+0x44/0x456 [ 191.680660][ T13] vhci_shutdown_connection.cold+0x165/0x37c [ 191.680688][ T13] event_handler+0x216/0x570 [ 191.680708][ T13] process_one_work+0xa23/0x1940 [ 191.680741][ T13] ? __pfx_process_one_work+0x10/0x10 [ 191.680764][ T13] ? __pfx_event_handler+0x10/0x10 [ 191.680783][ T13] worker_thread+0x5ef/0xe50 [ 191.680803][ T13] ? kthread+0x13a/0x450 [ 191.680825][ T13] ? __pfx_worker_thread+0x10/0x10 [ 191.680843][ T13] kthread+0x370/0x450 [ 191.680861][ T13] ? __pfx_kthread+0x10/0x10 [ 191.680879][ T13] ret_from_fork+0x72b/0xd50 [ 191.680910][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 191.680934][ T13] ? __switch_to+0x800/0x10f0 [ 191.680953][ T13] ? __pfx_kthread+0x10/0x10 [ 191.680971][ T13] ret_from_fork_asm+0x1a/0x30 [ 191.681000][ T13] [ 191.681007][ T13] [ 191.699209][T11876] vhci_hcd vhci_hcd.0: USB bus 37 deregistered [ 191.700347][ T13] Allocated by task 1: [ 191.714259][T11877] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller [ 191.715542][ T13] kasan_save_stack+0x30/0x50 [ 191.747754][T11877] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 1 [ 191.748272][ T13] kasan_save_track+0x14/0x30 [ 191.753866][T11877] vhci_hcd vhci_hcd.0: created sysfs vhci_hcd.0 [ 191.756158][ T13] __kasan_kmalloc+0xaa/0xb0 [ 191.756180][ T13] __kmalloc_noprof+0x322/0x820 [ 191.756209][ T13] __usb_create_hcd+0x5e/0xac0 [ 191.766624][ T13] vhci_hcd_probe+0x1a5/0x4e0 [ 191.768653][ T13] platform_probe+0x106/0x1d0 [ 191.770665][ T13] really_probe+0x241/0xa60 [ 191.772620][ T13] __driver_probe_device+0x20e/0x450 [ 191.774847][ T13] driver_probe_device+0x4a/0x140 [ 191.776990][ T13] __device_attach_driver+0x1df/0x320 [ 191.778936][T11877] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 191.779261][ T13] bus_for_each_drv+0x159/0x1e0 [ 191.784170][ T13] __device_attach+0x1e4/0x4d0 [ 191.784326][T11877] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 191.786200][ T13] device_initial_probe+0xaf/0xd0 [ 191.786225][ T13] bus_probe_device+0x64/0x160 [ 191.786243][ T13] device_add+0x121d/0x1970 [ 191.794618][ T13] platform_device_add+0x35a/0x800 [ 191.795669][T11877] usb usb1: Product: USB/IP Virtual Host Controller [ 191.796681][ T13] platform_device_register_full+0x5cf/0x830 [ 191.800989][T11877] usb usb1: Manufacturer: Linux syzkaller vhci_hcd [ 191.801027][ T13] vhci_hcd_init+0x1a1/0x2f0 [ 191.803022][T11877] usb usb1: SerialNumber: vhci_hcd.0 [ 191.804986][ T13] do_one_initcall+0x11d/0x700 [ 191.805015][ T13] kernel_init_freeable+0x6ea/0x7b0 [ 191.810897][ T13] kernel_init+0x1f/0x1e0 [ 191.812785][ T13] ret_from_fork+0x72b/0xd50 [ 191.814711][ T13] ret_from_fork_asm+0x1a/0x30 [ 191.816754][ T13] [ 191.817800][ T13] Freed by task 11876: [ 191.819509][ T13] kasan_save_stack+0x30/0x50 [ 191.821509][ T13] kasan_save_track+0x14/0x30 [ 191.823507][ T13] kasan_save_free_info+0x3b/0x70 [ 191.825651][ T13] __kasan_slab_free+0x5f/0x80 [ 191.827691][ T13] kfree+0x22b/0x6c0 [ 191.829373][ T13] usb_put_hcd+0x149/0x1f0 [ 191.831272][ T13] vhci_hcd_remove+0xb5/0x1b0 [ 191.833255][ T13] platform_remove+0x5f/0x80 [ 191.835235][ T13] device_remove+0xcb/0x180 [ 191.837196][ T13] device_release_driver_internal+0x44e/0x620 [ 191.837409][T11877] hub 1-0:1.0: USB hub found [ 191.839780][ T13] unbind_store+0xf8/0x110 [ 191.839801][ T13] drv_attr_store+0x74/0xb0 [ 191.845393][ T13] sysfs_kf_write+0xf2/0x150 [ 191.847419][ T13] kernfs_fop_write_iter+0x3e0/0x5f0 [ 191.849643][ T13] vfs_write+0x6ac/0x1050 [ 191.851446][ T13] ksys_write+0x12a/0x250 [ 191.853281][ T13] do_syscall_64+0x115/0x870 [ 191.855223][ T13] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 191.857722][ T13] [ 191.857968][T11877] hub 1-0:1.0: 8 ports detected [ 191.858739][ T13] Last potentially related work creation: [ 191.862725][ T13] kasan_save_stack+0x30/0x50 [ 191.864747][ T13] kasan_record_aux_stack+0xa7/0xc0 [ 191.866969][ T13] insert_work+0x36/0x230 [ 191.868856][ T13] __queue_work+0x9bc/0x12b0 [ 191.870824][ T13] queue_work_on+0x1a9/0x1e0 [ 191.872803][ T13] usb_hcd_giveback_urb+0x330/0x4a0 [ 191.875017][ T13] unlink1+0x418/0x510 [ 191.876783][ T13] usb_hcd_unlink_urb+0x131/0x210 [ 191.878923][ T13] usb_kill_urb+0x121/0x320 [ 191.880830][ T13] hub_quiesce+0x1e9/0x320 [ 191.882737][ T13] hub_suspend+0x4ab/0x9e0 [ 191.884653][ T13] usb_suspend_both+0x288/0x950 [ 191.885834][T11877] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller [ 191.886752][ T13] usb_runtime_suspend+0x49/0x120 [ 191.891001][ T13] __rpm_callback+0xc8/0x620 [ 191.892898][ T13] rpm_callback+0x16a/0x1b0 [ 191.894799][ T13] rpm_suspend+0x2f4/0x11a0 [ 191.896728][ T13] __pm_runtime_suspend+0xba/0x1a0 [ 191.898517][T11877] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 2 [ 191.898738][ T13] usb_new_device.cold+0xd61/0x115c [ 191.902020][T11877] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM. [ 191.903467][ T13] register_root_hub+0x4e6/0x639 [ 191.908520][ T13] usb_add_hcd.cold+0xccd/0x1158 [ 191.910544][ T13] vhci_hcd_probe+0x1c2/0x4e0 [ 191.910668][T11877] usb usb2: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 7.02 [ 191.912535][ T13] platform_probe+0x106/0x1d0 [ 191.912555][ T13] really_probe+0x241/0xa60 [ 191.915827][T11877] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 191.917676][ T13] __driver_probe_device+0x20e/0x450 [ 191.919154][T11877] usb usb2: Product: USB/IP Virtual Host Controller [ 191.922459][ T13] driver_probe_device+0x4a/0x140 [ 191.924130][T11877] usb usb2: Manufacturer: Linux syzkaller vhci_hcd [ 191.926877][ T13] __device_attach_driver+0x1df/0x320 [ 191.926901][ T13] bus_for_each_drv+0x159/0x1e0 [ 191.926916][ T13] __device_attach+0x1e4/0x4d0 [ 191.926936][ T13] device_initial_probe+0xaf/0xd0 [ 191.926954][ T13] bus_probe_device+0x64/0x160 [ 191.928638][T11877] usb usb2: SerialNumber: vhci_hcd.0 [ 191.931021][ T13] device_add+0x121d/0x1970 [ 191.944719][ T13] platform_device_add+0x35a/0x800 [ 191.946889][ T13] platform_device_register_full+0x5cf/0x830 [ 191.949230][T11877] hub 2-0:1.0: USB hub found [ 191.949439][ T13] vhci_hcd_init+0x1a1/0x2f0 [ 191.951191][T11877] hub 2-0:1.0: 8 ports detected [ 191.952855][ T13] do_one_initcall+0x11d/0x700 [ 191.956360][ T13] kernel_init_freeable+0x6ea/0x7b0 [ 191.958561][ T13] kernel_init+0x1f/0x1e0 [ 191.960417][ T13] ret_from_fork+0x72b/0xd50 [ 191.962396][ T13] ret_from_fork_asm+0x1a/0x30 [ 191.964441][ T13] [ 191.965483][ T13] Second to last potentially related work creation: [ 191.968272][ T13] kasan_save_stack+0x30/0x50 [ 191.970295][ T13] kasan_record_aux_stack+0xa7/0xc0 [ 191.972513][ T13] insert_work+0x36/0x230 [ 191.974335][ T13] __queue_work+0x9bc/0x12b0 [ 191.976299][ T13] queue_work_on+0x1a9/0x1e0 [ 191.978301][ T13] usb_hcd_giveback_urb+0x3b8/0x4a0 [ 191.980519][ T13] usb_hcd_submit_urb+0xab7/0x2150 [ 191.982699][ T13] usb_submit_urb+0x827/0x19b0 [ 191.984729][ T13] usb_start_wait_urb+0x10e/0x580 [ 191.986874][ T13] usb_control_msg+0x328/0x4b0 [ 191.988935][ T13] hub_suspend+0x826/0x9e0 [ 191.990835][ T13] usb_suspend_both+0x288/0x950 [ 191.992909][ T13] usb_runtime_suspend+0x49/0x120 [ 191.995031][ T13] __rpm_callback+0xc8/0x620 [ 191.997024][ T13] rpm_callback+0x16a/0x1b0 [ 191.998998][ T13] rpm_suspend+0x2f4/0x11a0 [ 192.000942][ T13] __pm_runtime_suspend+0xba/0x1a0 [ 192.003112][ T13] usb_new_device.cold+0xd61/0x115c [ 192.005360][ T13] register_root_hub+0x4e6/0x639 [ 192.007475][ T13] usb_add_hcd.cold+0xccd/0x1158 [ 192.009615][ T13] vhci_hcd_probe+0x1c2/0x4e0 [ 192.011618][ T13] platform_probe+0x106/0x1d0 [ 192.013641][ T13] really_probe+0x241/0xa60 [ 192.015562][ T13] __driver_probe_device+0x20e/0x450 [ 192.017799][ T13] driver_probe_device+0x4a/0x140 [ 192.019949][ T13] __device_attach_driver+0x1df/0x320 [ 192.022229][ T13] bus_for_each_drv+0x159/0x1e0 [ 192.024279][ T13] __device_attach+0x1e4/0x4d0 [ 192.026331][ T13] device_initial_probe+0xaf/0xd0 [ 192.028470][ T13] bus_probe_device+0x64/0x160 [ 192.030497][ T13] device_add+0x121d/0x1970 [ 192.032445][ T13] platform_device_add+0x35a/0x800 [ 192.034551][ T13] platform_device_register_full+0x5cf/0x830 [ 192.036985][ T13] vhci_hcd_init+0x1a1/0x2f0 [ 192.038932][ T13] do_one_initcall+0x11d/0x700 [ 192.040925][ T13] kernel_init_freeable+0x6ea/0x7b0 [ 192.042991][ T13] kernel_init+0x1f/0x1e0 [ 192.044747][ T13] ret_from_fork+0x72b/0xd50 [ 192.046726][ T13] ret_from_fork_asm+0x1a/0x30 [ 192.048779][ T13] [ 192.049813][ T13] The buggy address belongs to the object at ffff88802dc34000 [ 192.049813][ T13] which belongs to the cache kmalloc-8k of size 8192 [ 192.055557][ T13] The buggy address is located 2288 bytes inside of [ 192.055557][ T13] freed 8192-byte region [ffff88802dc34000, ffff88802dc36000) [ 192.061296][ T13] [ 192.062331][ T13] The buggy address belongs to the physical page: [ 192.065004][ T13] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2dc30 [ 192.068586][ T13] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 192.072111][ T13] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 192.075258][ T13] page_type: f5(slab) [ 192.076978][ T13] raw: 00fff00000000040 ffff88801bc43180 dead000000000122 0000000000000000 [ 192.080580][ T13] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 192.084195][ T13] head: 00fff00000000040 ffff88801bc43180 dead000000000122 0000000000000000 [ 192.087841][ T13] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 192.091464][ T13] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 192.095087][ T13] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 192.098676][ T13] page dumped because: kasan: bad access detected [ 192.101383][ T13] page_owner tracks the page as allocated [ 192.103781][ T13] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 10387835437, free_ts 10365473121 [ 192.112112][ T13] post_alloc_hook+0xfd/0x120 [ 192.114139][ T13] get_page_from_freelist+0xf48/0x3530 [ 192.116427][ T13] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 192.118740][ T13] new_slab+0xa2/0x640 [ 192.120430][ T13] refill_objects+0xe3/0x410 [ 192.122376][ T13] __pcs_replace_empty_main+0x376/0x680 [ 192.124721][ T13] __kmalloc_noprof+0x66d/0x820 [ 192.126813][ T13] __usb_create_hcd+0x5e/0xac0 [ 192.128902][ T13] vhci_hcd_probe+0x1a5/0x4e0 [ 192.130904][ T13] platform_probe+0x106/0x1d0 [ 192.132910][ T13] really_probe+0x241/0xa60 [ 192.134856][ T13] __driver_probe_device+0x20e/0x450 [ 192.137087][ T13] driver_probe_device+0x4a/0x140 [ 192.139126][ T13] __device_attach_driver+0x1df/0x320 [ 192.141253][ T13] bus_for_each_drv+0x159/0x1e0 [ 192.143225][ T13] __device_attach+0x1e4/0x4d0 [ 192.145157][ T13] page last free pid 1047 tgid 1047 stack trace: [ 192.147802][ T13] free_pages_prepare+0x586/0xd80 [ 192.149854][ T13] __free_contig_range_common+0x14f/0x250 [ 192.152108][ T13] free_pages_bulk+0x12a/0x200 [ 192.154043][ T13] vm_area_free_pages+0xad/0x2b0 [ 192.156007][ T13] vfree+0x107/0x750 [ 192.157569][ T13] delayed_vfree_work+0x56/0x80 [ 192.159514][ T13] process_one_work+0xa23/0x1940 [ 192.161505][ T13] worker_thread+0x5ef/0xe50 [ 192.163313][ T13] kthread+0x370/0x450 [ 192.164995][ T13] ret_from_fork+0x72b/0xd50 [ 192.166925][ T13] ret_from_fork_asm+0x1a/0x30 [ 192.168937][ T13] [ 192.169941][ T13] Memory state around the buggy address: [ 192.172239][ T13] ffff88802dc34780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 192.175548][ T13] ffff88802dc34800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 192.178850][ T13] >ffff88802dc34880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 192.182130][ T13] ^ [ 192.185289][ T13] ffff88802dc34900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 192.188619][ T13] ffff88802dc34980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 192.191893][ T13] ================================================================== [ 192.196751][ T13] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 192.199732][ T13] CPU: 3 UID: 0 PID: 13 Comm: kworker/u32:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 192.204178][ T13] Tainted: [L]=SOFTLOCKUP [ 192.205966][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 192.210059][ T13] Workqueue: usbip_event event_handler [ 192.212199][ T13] Call Trace: [ 192.213589][ T13] [ 192.214844][ T13] dump_stack_lvl+0x100/0x190 [ 192.216836][ T13] vpanic+0x552/0x970 [ 192.218517][ T13] ? __pfx_vpanic+0x10/0x10 [ 192.220432][ T13] ? mark_held_locks+0x40/0x70 [ 192.222399][ T13] ? vhci_cleanup_unlink_list+0x44/0x456 [ 192.224797][ T13] panic+0xd1/0xe0 [ 192.226416][ T13] ? __pfx_panic+0x10/0x10 [ 192.228314][ T13] ? vhci_cleanup_unlink_list+0x44/0x456 [ 192.230625][ T13] ? preempt_schedule_common+0x42/0xc0 [ 192.232921][ T13] ? check_panic_on_warn+0x1f/0x90 [ 192.235063][ T13] check_panic_on_warn.cold+0x19/0x34 [ 192.237325][ T13] end_report.part.0+0x3a/0x90 [ 192.239371][ T13] kasan_report.cold+0xe/0x18 [ 192.241366][ T13] ? vhci_cleanup_unlink_list+0x44/0x456 [ 192.243716][ T13] vhci_cleanup_unlink_list+0x44/0x456 [ 192.246004][ T13] vhci_shutdown_connection.cold+0x165/0x37c [ 192.248534][ T13] event_handler+0x216/0x570 [ 192.250393][ T13] process_one_work+0xa23/0x1940 [ 192.252484][ T13] ? __pfx_process_one_work+0x10/0x10 [ 192.254709][ T13] ? __pfx_event_handler+0x10/0x10 [ 192.256855][ T13] worker_thread+0x5ef/0xe50 [ 192.258831][ T13] ? kthread+0x13a/0x450 [ 192.260629][ T13] ? __pfx_worker_thread+0x10/0x10 [ 192.262736][ T13] kthread+0x370/0x450 [ 192.264443][ T13] ? __pfx_kthread+0x10/0x10 [ 192.266379][ T13] ret_from_fork+0x72b/0xd50 [ 192.268328][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 192.270454][ T13] ? __switch_to+0x800/0x10f0 [ 192.272434][ T13] ? __pfx_kthread+0x10/0x10 [ 192.274356][ T13] ret_from_fork_asm+0x1a/0x30 [ 192.276366][ T13] [ 192.278550][ T13] Kernel Offset: disabled [ 192.280403][ T13] Rebooting in 86400 seconds.. VM DIAGNOSIS: 15:14:02 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000001 RBX=ffff88806a43b508 RCX=0000000000000100 RDX=0000000000000001 RSI=0000000000000002 RDI=ffff88806a43b50a RBP=dffffc0000000000 RSP=ffffc90007dff900 R8 =0000000000000001 R9 =ffffed100d4876a1 R10=ffff88806a43b50b R11=0000000000000000 R12=0000000000007e9e R13=ffffed100d4876a1 R14=ffff88806a43c4c0 R15=0000000000000000 RIP=ffffffff8bbec014 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000555568d74500 ffffffff 00c00000 GS =0000 ffff8880d5dd8000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007face47556c8 CR3=0000000034782000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=000000000000003f Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12dab5d560 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe56b50e16 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe56b50e16 00007ffe56b50e1c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12d9e355ef ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12d9e3562f ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12d9e35793 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12d9e35621 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000002900070005 ffffffff40010008 8001000c8007002c 0000000700010005 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000700080006 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 8001000c8007002c 0000000700010005 00000000317a7973 0002000900000002 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=00000000001d1da3 RBX=ffff88801eaf2540 RCX=ffffffff8bbbc2d5 RDX=0000000000000000 RSI=ffffffff8e1a80b8 RDI=ffffffff8c402680 RBP=ffffed1003d5e4a8 RSP=ffffc90000177e00 R8 =0000000000000001 R9 =ffffed100d4a678d R10=ffff88806a533c6b R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffff9200002efc4 R15=dffffc0000000000 RIP=ffffffff8bbba89f RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d5ed8000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000055555efe2a28 CR3=0000000050ce7000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000008000100 Opmask01=0000000000000000 Opmask02=0000000002fefcfe Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 7570637265705f65 676173752e746363 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe4666a3f6 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe4666a3f6 00007ffe4666a3fc ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f61594355ef ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f615943562f ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f6159435793 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f6159435621 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000007 RBX=ffff88802ba58d58 RCX=0000000000000000 RDX=00000000927b1223 RSI=000000002fad04df RDI=0000000010512042 RBP=ffff88802ba58000 RSP=ffffc90004707270 R8 =000000008a01ebe9 R9 =0000000000000007 R10=0000000000000000 R11=0000000000000000 R12=32ce3e5ab1d6f6c0 R13=000000000000000b R14=0000000000000000 R15=000000000000000b RIP=ffffffff81e5de55 RFL=00000003 [------C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f615a1866c0 ffffffff 00c00000 GS =0000 ffff8880d5fd8000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f61575f5ff8 CR3=000000002fb56000 CR4=00352ef0 DR0=ffffffffffffffff DR1=00000000000001f8 DR2=0000000000000002 DR3=ffffffffefffff15 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=000000000000003f Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12dab5d560 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe56b50e16 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe56b50e16 00007ffe56b50e1c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12d9e355ef ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12d9e3562f ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12d9e35793 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12d9e35621 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000002900070005 ffffffff40010008 8001000c8007002c 0000000700010005 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000700080006 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 8001000c8007002c 0000000700010005 00000000317a7973 0002000900000002 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000000020 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85a39335 RDI=ffffffff9ba0bb40 RBP=ffffffff9ba0bb00 RSP=ffffc90000107560 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=3230383838666666 R12=0000000000000000 R13=0000000000000020 R14=ffffffff9b6fe1f0 R15=ffffffff85a392d0 RIP=ffffffff85a3935f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d60d8000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f61575b3ff8 CR3=000000000e994000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12dab5d560 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe56b50e16 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe56b50e16 00007ffe56b50e1c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12d9e355ef ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12d9e3562f ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12d9e35793 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f12d9e35621 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000