last executing test programs: 26.126304665s ago: executing program 2 (id=218): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x0, 0x3, 0x5}}]}, @action_gd=@TCA_ACT_TAB={0x43, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3e}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x2004c8d8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@getqdisc={0x24, 0x26, 0x400, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0xc}, {0x3, 0xfff0}, {0x2, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x50040) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x4, 0xc0000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x1b}, {0x2, 0xe}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_ECN={0x8}]}}]}, 0x3c}}, 0x4814) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x9, 0x2, &(0x7f00000000c0)=@raw=[@map_idx_val={0x18, 0x9, 0x6, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4}], &(0x7f0000000180)='syzkaller\x00', 0x3, 0xe3, &(0x7f0000000400)=""/227, 0x40f00, 0x0, '\x00', 0x0, @cgroup_sock=0xc, 0xffffffffffffffff, 0x8, &(0x7f0000000500)={0x3, 0x2}, 0x8, 0x10, &(0x7f0000000540)={0x4, 0x2, 0x3, 0xc8}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x4, &(0x7f0000000580)=[0x1, 0x1, 0x1], &(0x7f00000005c0)=[{0x0, 0x1, 0x6, 0x8}, {0x5, 0x4, 0xe, 0x9}, {0x1, 0x3, 0xe, 0x8}, {0x1, 0x3, 0xd, 0x3}], 0x10, 0x7}, 0x94) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 26.125850078s ago: executing program 2 (id=220): syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_le_meta={{0x3e, 0x1f}, @hci_ev_le_enh_conn_complete={{}, {0x5, 0xc8, 0xc, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, @none, @none, 0x6, 0x40, 0xff7f, 0x9}}}}, 0x22) 26.125628661s ago: executing program 2 (id=222): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, 0x0, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x2800, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r1, 0xc004ae02, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8480, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000580)={0x1ff, 0x1, 0x0, 0x1000, &(0x7f0000456000/0x1000)=nil}) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xcd}]}) ioctl$KVM_RUN(r5, 0xae80, 0xf000) 26.105879705s ago: executing program 2 (id=228): ioctl$MEMERASE64(0xffffffffffffffff, 0x125f, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/gser.usb0\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f00001e7000/0x2000)=nil, 0x2000, 0x8003, &(0x7f0000000000)=0x9, 0x3, 0x2) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) read$FUSE(r0, &(0x7f0000000400)={0x2020}, 0x2020) chdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00') symlink(&(0x7f0000000280)='functions/gser.usb0\x00', &(0x7f00000002c0)='configs/c.1/gser.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000000380), 0x0) unlink(&(0x7f00000003c0)='configs/c.1/gser.usb0\x00') 25.731561878s ago: executing program 2 (id=236): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = syz_io_uring_setup(0x208c, &(0x7f0000000200)={0x0, 0xcb14, 0x10100, 0x3, 0x4001bf}, &(0x7f0000000040), &(0x7f0000000000), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_ZCRX_CTRL(r0, 0x24, &(0x7f0000000480)={0x6, 0x1, '\x00', @zc_export={r0}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder0\x00', 0xc00, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, &(0x7f0000000280)=0x4e7) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) fallocate(r3, 0x0, 0x1, 0x8ffff) read$FUSE(r3, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@ipv6_deladdr={0x40, 0x15, 0x1, 0x70bd29, 0x25dfdbfe, {0xa, 0x20, 0x8}, [@IFA_LOCAL={0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, @IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, 0x40}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='sys_mnt\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000003c0)='sys_mnt/block/zram0/algorithm_params\x00', 0x1, 0x0) write(r4, &(0x7f00000005c0)="226c6722df93476d3432abff94da5096f57b27287f80fb582260a93908068ba64a3f78d6583c4468067fe5d80300000000000000b1224f70a7d3502a2394feddccde8ec2f89eb09104dc6a51067c3f885645e6bc2d697c0aa7a105197979999e2dde56ee1914892a3a684bb2ef5b03dc0743a7a4521119107484d163783d756f503df4213e823d4c778bcae7b075c58e", 0x90) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) syz_emit_ethernet(0x11b, &(0x7f0000000680)={@broadcast, @empty, @void, {@ipv6={0x86dd, @udp={0x6, 0x6, "45b32e", 0xe5, 0x11, 0x0, @mcast2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, {[@dstopts={0x8, 0x3, '\x00', [@padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @hao={0xc9, 0x10, @loopback}]}, @dstopts={0x2f, 0x0, '\x00', [@jumbo={0xc2, 0x4, 0xffffffff}]}], {0x4e23, 0x4e21, 0xad, 0x0, @opaque="37bb9eb5c0023f3574648d3b2433685cbf55fe279eb0f25cc226626b93654fd75216dfedf88891a6b62df8154e8cdba5db45e40bedfb3cd1de261fc3cf61bc20b0947b821bce2a25be6d9c3961daf0286234061394861fb3ca9c528651c0e26a0cc336fc627a6191691cf71d76855dd8ec427af2ac1a0476edcab7a022205f2a4a39b659cde1e04e5b65d604ebb283d981690e039f085af7e591787f70fc4e5ad2d8ddba23"}}}}}}, &(0x7f00000007c0)={0x1, 0x1, [0xed7, 0xbd0, 0x4a8, 0xb17]}) sendmsg$NL80211_CMD_SET_BSS(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010028bd7000ffdbdf251900000008000300", @ANYRES32=r7, @ANYBLOB="05001e008f00b300000000000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000380)=""/113, 0x71}], 0x1) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) madvise(&(0x7f0000662000/0x3000)=nil, 0x3000, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 25.620951018s ago: executing program 2 (id=237): r0 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x1bd, @loopback}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) listen(r1, 0xa) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff) socket(0x10, 0x4, 0x0) mount(&(0x7f0000000200)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='cifs\x00', 0x3000000, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x0) 10.206994219s ago: executing program 32 (id=237): r0 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x1bd, @loopback}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) listen(r1, 0xa) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff) socket(0x10, 0x4, 0x0) mount(&(0x7f0000000200)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='cifs\x00', 0x3000000, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x0) 8.499676512s ago: executing program 3 (id=398): r0 = socket$netlink(0x10, 0x3, 0x0) (async) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) r3 = syz_open_dev$radio(&(0x7f0000000040), 0x2, 0x2) ioctl$VIDIOC_G_FREQUENCY(r3, 0xc02c5638, &(0x7f0000000080)={0x8b, 0x4, 0x5}) (async) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0x503, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21111, 0x8831}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_SCB={0x5}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x44}, 0x1, 0x0, 0x0, 0x4c890}, 0x0) 8.091328716s ago: executing program 3 (id=401): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@getqdisc={0x24, 0x26, 0x400, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0xc}, {0x3, 0xfff0}, {0x2, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x50040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x9e) 8.018045274s ago: executing program 3 (id=403): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@getqdisc={0x24, 0x26, 0x400, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0xc}, {0x3, 0xfff0}, {0x2, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x50040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) (fail_nth: 3) 7.845173149s ago: executing program 3 (id=406): r0 = socket(0x10, 0x80003, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x2, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000080)='./file1\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_GETFMT(r1, 0xffffffff80000400, 0x0, 0x0) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904000a000000fe0000000000000008000f00fd000000", 0x85) set_mempolicy(0x3, &(0x7f0000000040)=0xfff, 0x5) syz_clone(0x200111, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'sit0\x00'}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), r0) 7.714563386s ago: executing program 3 (id=408): r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c0) statx(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x6000, &(0x7f0000000240)) stat(&(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$bpf(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x800881, &(0x7f00000007c0)={[{@uid={'uid', 0x3d, r2}}]}) lseek(r1, 0x10001, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_ifreq(r3, 0x8948, &(0x7f0000000080)={'wg1\x00', @ifru_addrs=@phonet={0x23, 0x3, 0xe, 0x4}}) r4 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r7, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r8, @ANYBLOB="00001000252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="3c0000001000030500000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r8], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r8], 0x5c}}, 0x40) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r8], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r10 = add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000000840)="3e12d23d346cfdeb1716f738274bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e43eba0b67b516be14a8b51a75bfd611b2d7ae6a21d056c2c5116a416a76b1a03dc55ea62d43c809e0ed6e56163fdab317afd5c", 0xba, 0xfffffffffffffffe) getpeername(r3, &(0x7f0000000400), &(0x7f0000000500)=0x80) keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r4, r10}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'sha256\x00'}}) r11 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000100)={0x0, r11, r11}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}}) keyctl$dh_compute(0x17, &(0x7f00000000c0)={r11, r4, r4}, &(0x7f0000000240)=""/119, 0x77, &(0x7f00000003c0)={&(0x7f00000002c0)={'blake2b-256\x00'}, &(0x7f0000000300)="e4aa8984dd7d35d67b33f4553ddd69f9e86bca2b4526528572ba917896c1ba9139a183095e1ebdae4772279b06e4afd271c2d30ac0a925c4ff6cab4b0e7aa5b49c0ab362ac096a7cdf05ea53b1c26b71771a305d98", 0x55}) 7.453699411s ago: executing program 3 (id=409): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106) recvmmsg(r0, &(0x7f0000005180)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40000142, 0x0) 7.406609249s ago: executing program 33 (id=409): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106) recvmmsg(r0, &(0x7f0000005180)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40000142, 0x0) 1.767329686s ago: executing program 1 (id=476): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x400100, 0x0) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) getsockopt$PNPIPE_INITSTATE(r1, 0x113, 0x4, &(0x7f0000000040), &(0x7f0000000080)=0x4) r2 = accept4$nfc_llcp(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000140)=0x60, 0x800) bind$nfc_llcp(r2, &(0x7f0000000180)={0x27, 0x0, 0xffffffffffffffff, 0x3, 0xc, 0x1, "d959d2694eef67cdb47147e27a7ead2ebae56a6d81a9ea92a492429bdc9892238e3883be329b17d20bf4e790a1eb63375dc3d8c8759fcf5fd8c5639cf5bf3c", 0x13}, 0x60) r3 = pidfd_getfd(0xffffffffffffffff, r1, 0x0) r4 = signalfd(r3, &(0x7f0000000200)={[0x2a]}, 0x8) ioctl$DRM_IOCTL_ADD_BUFS(0xffffffffffffffff, 0xc0206416, &(0x7f0000000240)={0x4, 0x80000001, 0x0, 0xf2, 0x1, 0x43ad}) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000280)={0x0, 0x7d, "df12c99bf1c02caa76cf84144e44dea50199f344c03a4426ede7c79b15178d7d414a1601c662036ba3f1dd4d27feeb2ef1299fae9e46adb60c9ee7700070f2f6c9753aa3ceaf540eb471a4081ee8bc61aced51ff05dd9f2a3eeb003d661700aebb2be2e500dfa2b89e74e92626474ad169136d19213003a8225ea09c00"}, &(0x7f0000000340)=0x85) ioctl$DRM_IOCTL_IRQ_BUSID(r4, 0xc0106403, &(0x7f0000000380)={0x0, 0x9bc5, 0x1fffc00, 0x2d1}) ioctl$DRM_IOCTL_SET_MASTER(0xffffffffffffffff, 0x641e) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000004c0)={&(0x7f00000003c0)=[0x0, 0x0, 0x0], &(0x7f0000000400)=[0x0, 0x0, 0x0], &(0x7f0000000440)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000480)=[0x0], 0x3, 0x3, 0xa, 0x1}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r3, 0xc01864b0, &(0x7f0000000500)={0x0, r5, 0x1, 0xab1a, 0x80000001}) ioctl$DRM_IOCTL_GET_CLIENT(r4, 0xc0286405, &(0x7f0000000540)={0x380, 0x10000, {0x0}, {0xee01}, 0x2, 0x9}) prctl$PR_SCHED_CORE(0x3e, 0x4, r6, 0x2, &(0x7f0000000580)) fallocate(r3, 0x43, 0x30, 0x9) ioctl$KVM_GET_MSR_INDEX_LIST(r4, 0xc004ae02, &(0x7f00000005c0)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) getsockopt$PNPIPE_ENCAP(r3, 0x113, 0x1, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$XFS_IOC_PATH_TO_HANDLE(r2, 0xc0385869, &(0x7f0000000780)={r4, &(0x7f0000000680)='/dev/net/tun\x00', 0xc0101, &(0x7f00000006c0)={@align=0xfff, {0xfce8, 0xfff, 0x5deee98, 0xa}}, 0x8, &(0x7f0000000700), &(0x7f0000000740)=0x3}) r8 = accept$nfc_llcp(r7, &(0x7f00000007c0), &(0x7f0000000840)=0x60) close(r8) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r9, 0x8983, &(0x7f0000000880)={0x8, 'syz_tun\x00', {'ip6_vti0\x00'}, 0x4}) ioctl$DRM_IOCTL_GET_MAGIC(r7, 0x80046402, &(0x7f00000008c0)) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r7, 0xe, &(0x7f0000000980)={0x1, 0x0, &(0x7f0000000900), &(0x7f0000000940)=[0xfffffffffffffff8, 0x1000, 0x4580]}, 0x20) syz_genetlink_get_family_id$batadv(&(0x7f00000009c0), r9) syz_open_dev$MSR(&(0x7f0000000a00), 0x2, 0x0) r10 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000a40), 0x2, 0x0) fsetxattr$security_selinux(r10, &(0x7f0000000a80), &(0x7f0000000ac0)='system_u:object_r:faillog_t:s0\x00', 0x1f, 0x2) 1.67291296s ago: executing program 1 (id=478): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) (async) r1 = gettid() fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x24e2, 0x4, r1}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {r2, r3+60000000}}, 0x0) (async) mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x2000000, 0x1010, 0xffffffffffffffff, 0x42795000) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='new user:syz 000000000000000020'], 0x2a, 0xfffffffffffffffc) (async) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000940)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) (async, rerun: 32) r5 = accept$alg(r4, 0x0, 0x0) (rerun: 32) sendmsg$alg(r5, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@assoc={0x18, 0x117, 0x4, 0xd4e5}], 0x18}, 0x0) (async, rerun: 64) r6 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (rerun: 64) write$binfmt_script(r6, &(0x7f0000000380)={'#! ', './file0'}, 0xb) (async) recvmmsg(r5, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000001c0)=""/200, 0xc8}], 0x1, 0x0, 0x0, 0x2000000}, 0x8000}], 0x1, 0x2129, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) (async) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) (async, rerun: 32) connect$inet(r7, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) (async, rerun: 32) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r7, 0x0, r8, 0x0, 0x8000f28, 0x5) 1.532142484s ago: executing program 1 (id=480): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@getqdisc={0x24, 0x26, 0x400, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0xc}, {0x3, 0xfff0}, {0x2, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x50040) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r0, &(0x7f0000000180)='r:s/p ./file0:0', 0xf) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) syz_io_uring_setup(0x6c6, &(0x7f0000000000)={0x0, 0xbae, 0x8aa, 0x2, 0xff}, 0x0, 0x0, &(0x7f0000000000)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000001680)='veno', 0x4) setsockopt$inet_tcp_int(r2, 0x6, 0x2, &(0x7f00000001c0)=0xa3, 0x4) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) sendmsg$NL80211_CMD_SET_POWER_SAVE(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)={0x50, 0x0, 0x400, 0x70bd27, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x4, 0x57}}}}, [@NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f0000000040)={r5, 0x8001}, 0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000040)={r5, 0x4, 0x30, 0x800, 0x5}, &(0x7f00000000c0)=0x18) 1.204632489s ago: executing program 0 (id=483): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000001a40)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="23000300013fef", 0x7) 1.123085806s ago: executing program 0 (id=484): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x44, 0x32, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3e}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x2004c8d8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@getqdisc={0x24, 0x26, 0x400, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0xc}, {0x3, 0xfff0}, {0x2, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x50040) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x4, 0xc0000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x1b}, {0x2, 0xe}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_ECN={0x8}]}}]}, 0x3c}}, 0x4814) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22e8a65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.110969917s ago: executing program 0 (id=485): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000001c0)={0x114, 0x30, 0x1, 0x0, 0x0, "", [@nested={0x101, 0x0, 0x0, 0x1, [@typed={0xc, 0x2, 0x0, 0x0, @u64}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@loopback={0x100000000000000}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767fc734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82"]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) (fail_nth: 7) 985.105191ms ago: executing program 0 (id=486): ioctl$UFFDIO_POISON(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}}) syz_open_dev$mtd(&(0x7f00000000c0), 0x260c, 0xa02) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000200)={r0, &(0x7f0000000100)='@\x00', 0x30fb00, &(0x7f0000000140)={@_ha_fsid={[0xfffff062, 0x7f]}, {0x8001, 0x9, 0xfff, 0xa}}, 0xc8, &(0x7f0000000180), &(0x7f00000001c0)=0x1}) gettid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000003700), &(0x7f0000003740)=0xc) lstat(&(0x7f0000000400)='UDC\x00', &(0x7f00000037c0)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000038c0)={{{@in6, @in6=@ipv4={""/10, ""/2, @private}}}, {{@in=@initdev}, 0x0, @in6=@ipv4={""/10, ""/2, @private}}}, &(0x7f00000004c0)=0xe8) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000003b80)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff, 0xee00}}, './file0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/gser.usb0\x00', 0x1ff) chdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00') symlink(&(0x7f0000000280)='functions/gser.usb0\x00', &(0x7f00000002c0)='configs/c.1/gser.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)='dummy_udc.0', 0xb) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) unlink(&(0x7f00000003c0)='configs/c.1/gser.usb0\x00') setresuid(0x0, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) setresuid(0x0, 0xee00, r2) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000003bc0)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) 893.324189ms ago: executing program 0 (id=490): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x4, 0x4, 0x388, 0xffffffff, 0xd0, 0xd0, 0x0, 0xfeffffff, 0xffffffff, 0x2b8, 0x2b8, 0x2b8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x2f2, 0xa8, 0xd0}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x17fe582d91d0b905}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xd}}, @remote, [0xff, 0x0, 0xff000000, 0xffffffff], [0xff000000, 0xff, 0xff000000, 0xffffff00], 'team0\x00', 'batadv_slave_0\x00', {0xff}, {}, 0xff, 0x9, 0x4, 0x44}, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@dst={{0x48}, {0x4, 0x9, 0x1, [0x3, 0x8575, 0x9, 0xfff, 0x8, 0x101, 0x1, 0x101, 0x8, 0x4, 0x800, 0xb9e, 0x6, 0x8, 0x440, 0x4], 0x13}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) ptrace$peekuser(0x3, r1, 0x8) r2 = socket$unix(0x1, 0x5, 0x0) getsockopt$sock_buf(r2, 0x1, 0x1c, 0x0, &(0x7f0000001100)) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x5c, 0x2, 0x6, 0x101, 0x0, 0x0, {0xa}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x5c}}, 0x0) 843.250814ms ago: executing program 5 (id=491): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000014c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000702000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff6d6405000000000065040400010000000404000001000000b7050000400000006a0a80fe000000008500000053000000b7000000000000009500001000000000a80501363034fdb117168bd07ba00af739d1a1ee35fe163a255c33282044b32495ef8ab9adc67ccc945f105d802f5132143c0a9fc7a84452569957c1002ed7d4d8e17f791f4798c8eb483e9973320d046c3126c6afcfd84de03352c69b3edff5be26f8ffa5f8f2879021c2ea53ea79acd7fb38dd1abb75aa393cea26d465637d11f705000000473e7b7c4ae7dd5e4dee88518ddf12dddd4bfc6a4dd3b6beba51074229b0d4b504516c4c3e5d1aa044d8d00728141cd67bcd68f253288e655c6b34e02e90637ef2912ba7de26ff2357ef17f95a25780c3a057844f226ef4e912f01a201e694e3806e8c70e8b69524cd19f7525d8d66bb766f7f3f918c86a70252236800001897133af94a5a4cfc794d8b9d7c33632152c48eaf302f0b2e0c252b00000000000000006f1bbefbe08de65e3762e194ba4cae8b13535d7d11ee917bca4885bbf597a14ab2458efce78510d86272d88e0c8088f404f011289ebc5623faa1182632161e073af1d69a2e36bed435000025ecd201d2ffb0a7fa4f5d11060cdcf071defd0a8be3b69ce3e4f361aca75827426dde87fdf4617222674280f55e98107450c19b9d86329bd5b4697336112b0b8754ce3574046bf6114d1a88597850b77378fa8edfff8faf8b8ec039bab385cac0535373bb8fab90539b1a65ddff841eb671f3faf37ebdfccea0c002ad2b42047c9ec43193ccf617dbf8a12b4f189edbf9fb7c42b1f435ccd4d96822e6b70100912c92e3943e9c4f45d8bcd528fa8a3ea847f10e9b2506f3bb506f1d7fbde8010000000000a073d0de5538ab42e170b3baae34c35987b0dda497ac3f5e97e6e6aeea15c6d5ed24310100000003bb6030f84b63aaf8690db0221b1705c501f802ff59b4e683efa4b6e77e042072bd2ac37d413008ec9eb8166f6e28b49a77ed91befc65315896f88a8fb1dd679fb4c515f8b7a5b7aca6a251a89d47b728502f7e621cc0e3ba04000000c149ee6601728c750d304197c22da8650579475afd96187d881e93b42a5fdfd686d8900c44c67133dad58037fda65885a15a429edfe3027a5ebf95254744f10fd607bc3300b94932b8d944e0b083bbd86b19cb074577a25ff581d92af08a06f857310a2f14326b0b290205e91a682e00c8762cbc6b904c980eef6e6a1def886c95676dce6a8194479700a02b92bdc8d05eae1f24fdd7b80d1bb404c22f681594de2ebb9687219de8d73ac83823feb402a2415a9850d5f0183ec67be96dc0e4c2d7acf1dfe79d6771903b76e21190c22d641030e1ddacf006c3116e1803af20a5f2b5f7ba58aca5bcabbbab24414a3810788e5503e4be66d683daac5f0001000077339b4200000000108a3c87b19d5b9a00c75d84a92d6dcf00ba96edf35ede0e2b57c26e94801b498924166bde57d5f24258d9fd028096cc15a8b912b494d4bbe609031ea1ca65a548971d5d16296dd08e020000007a27310d5d01f8a8a0f5212d7f628f554afea715ccbc66cbb1016490f5d579308cb3188cf2fcaf67e0c16443d526ba4b968f07ae362c2133c168313e84beb871203880dd453c45d0a137d7f5a8b039dbfa62fb2b4214f8e69f967bf1fbd89e77fcca110000000800000000000000f8877994ebdc35f7efd41e3babd9b3782edd6776d5b6cb4ecd72c9de9b5503747d71440378cf2c2c7ea2dc5febb654a867f853713cf4c0bb322fbbe446d18dee4c821275ef18259cafc346c8b3b9fb0f3adcf6ea310a6b9a3f59e29a5909ea047fb61affb4bc8bbea1fb761b8933795b1a91358a7791aa843d07020e8bb6fc18458c49ac6313e7165b7d9f65e94a62b69f1011b94340cdb7303f01e5cdb5682ddf73d65c3de1d88dd7496d6345d5b9de0223988056a53e19a8b96b9640bc6c09d3c2ff894d626b57c776ed53f94d5e22ff148061b37f72bd92924cb1d0a725e19b264346b7cae0251a850de78316503f3c3d395c7e3f04fc8d52583327cd2341ce4b2d092815376299686f41353b2823814563011a2223b9dd00000000000000000000003a131374a3371cb3e2a9bb4d798b91cefa444501f40b7c9589e8c0bb6c82123d2b45ce905d0903b32ecf30e828c71a07a83f3275f3d661d1af0ffbd5d7f0"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0xfeffff, 0xa40, 0x3f000002, &(0x7f0000000700)="c45c57ce395de5b289f07d637a223920f181c2e57d71483cfb2d075a3ff07258e080a194805cdb0c26d3f7ffb1e0d9cf4fa36dcb2168b72de48ac8f93e6804f1c4d70898d0810e044d7e1778eaac5dfdcc9f1208905522025bcfdf1b6f969b094d5c022c2b7ffefde71e0627b9a2069cc1e0175c4b8860aad4b0a103c589f676b6c4e85eb3950c533b6e62c39ccf9ae9bfe54ee5887358d44f46337fbe090d7c7e55847edee8130ffd3d1e719e01a68b0e691c0d35b0b56e0b514036342fd56f08ac0083f3c2fe41a1295a3d23cf3d160d4fd90f66beba68860456ed41272e1e68d16c2564c85f5556e18784113c493d13253e14d6eb891707fba3c30d07d5ee8619e4426cafec4cf6a3723c455d09b586b248", 0x0, 0xf0, 0x0, 0xf0, 0xffffff0c}, 0x40) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=@newtaction={0x14, 0x30, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x4004051}, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000b80)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$inet(r3, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000240), 0x1}}, {{0x0, 0x0, &(0x7f00000004c0)=[{0x0, 0xf00}, {&(0x7f00000002c0)="00000000008542f4cdb9eaa26519373f589fc2eb12c86e15e5d786493663546e514e6ad1b23e97c489", 0x5}], 0x2}}], 0x400000000000039, 0x8004) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='westwood', 0xa) setns(0xc9, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="30000000100001000000000000000071ff9aee24", @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000005000008001b"], 0x30}}, 0x0) r5 = socket(0x1, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, 0x0, &(0x7f0000cab000)) setresuid(0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, 0x0, 0x0) r6 = socket(0x8, 0x5, 0x5) ioctl$VFAT_IOCTL_READDIR_BOTH(r6, 0x400261f2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004840}, 0x8044) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a5ef423aae44b4edce02c0000000e0a01010000000000000000048717a61ece33c473797a30000000000900010073797a31000000001400e1bd962b0100000000"], 0x54}, 0x1, 0x0, 0x0, 0x20000044}, 0x800) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, 0x0, &(0x7f00000000c0)) socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_START_COMMIT(r1, 0x80585882, &(0x7f0000000100)={0xffffffffffffffff}) sendto$inet6(r7, &(0x7f0000000380)="245c1e0442ce0c63248a7f607ed73a69d0cd0aeed70038f9d3b1fc9d845f004827e813b9b0c1eb66c44131cef1169dc198d9873cd4b772bc5d73104760302245c7d90ce49e952e572166a305887947b4f98c8e44c28b78ea1d192c7f16478144efff1b201f19540f2288bd0c6227c5415a133e02b37801508bfbd384d86c4dabd8f0d38f8375e8b0c4f76906ec17cbb98aa6309ca55f5c670dfba1e93e305f754857f643b420f9268d538a19e0f319a21eb66f0031af2f3c0a264e93033e31802a8de11825f67a6d802523109c", 0xcd, 0x4008881, &(0x7f0000000500)={0xa, 0x4e24, 0x5, @empty, 0x2}, 0x1c) syz_genetlink_get_family_id$tipc2(&(0x7f0000001ec0), 0xffffffffffffffff) 812.115ms ago: executing program 0 (id=492): sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000325bd7000fddbdf25070000003c0004800900010073797a31000000002c00078008000400080002000800810018000000080002000900050000000800040000040000"], 0x50}, 0x1, 0x0, 0x0, 0x4008080}, 0x8000) mkdir(&(0x7f0000000100)='mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='mnt\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040a00e58684000010203010902270001010080320904000003ff00000007058102400000070502024000000705830308"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='mnt/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000480)={0x44, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TCSBRKP(r1, 0x541e, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x48040) 810.174247ms ago: executing program 5 (id=493): r0 = syz_usbip_server_init(0x5) write$usbip_server(r0, &(0x7f0000000000)=ANY=[], 0x3696) syz_usbip_server_init(0x1) 672.952884ms ago: executing program 4 (id=495): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async) r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000040)='./file0\x00', 0x20000210) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0xa4020, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) (async) chdir(&(0x7f0000000140)='./file0\x00') (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x480a00, 0x47) write$P9_RVERSION(r1, &(0x7f0000000000)={0x15, 0x65, 0xffff, 0x80000001, 0x8, '9P2000.L'}, 0x15) 672.635913ms ago: executing program 1 (id=496): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x5) r1 = eventfd2(0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r3 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000180)={{{@in=@initdev={0xac, 0x1e, 0xfe, 0x0}, @in=@rand_addr=0x64010102, 0x4e21, 0x0, 0x4e22, 0x48, 0x2, 0x0, 0x0, 0x1}, {0xfffffffffffffffc, 0xffffffffffffffff, 0xfff, 0x10001, 0x5, 0x5, 0x5, 0xffffffffffffffff}, {0x58b6c42b, 0xffffffffffff90e3, 0x0, 0x20000000000000}, 0x40, 0x0, 0x1, 0x0, 0x1}, {{@in6=@empty, 0x4d4, 0x6c}, 0x2, @in=@broadcast, 0x3502, 0x4, 0x3, 0x0, 0x0, 0x1, 0x200000}}, 0xe8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x17}}}, 0x1c) io_setup(0x4, &(0x7f0000000080)=0x0) io_submit(r4, 0x1, &(0x7f00000000c0)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0xfffe, r0, 0x0, 0x0, 0x0, 0x0, 0x3, r1}]) shutdown(r0, 0x0) r5 = socket$rxrpc(0x21, 0x2, 0x2) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) getresuid(&(0x7f00000001c0), &(0x7f0000000240)=0x0, &(0x7f0000000280)) sendmsg$nl_netfilter(r6, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)={0xcc, 0x2, 0xa, 0x5, 0x70bd26, 0x25dfdbfc, {0x2, 0x0, 0x3}, [@nested={0x3d, 0x90, 0x0, 0x1, [@nested={0x4, 0x83}, @nested={0x4, 0x12e}, @nested={0x4, 0x137}, @generic="93fed9c8709b949863187a0556d32086cee720ed6bfb86f52dc3e83c9d5d70b1e9336dae662cc7b9e18c482657"]}, @typed={0x8, 0x136, 0x0, 0x0, @uid=r7}, @typed={0x8, 0xca, 0x0, 0x0, @str='GPL\x00'}, @generic="6cc78a72cf79a75daf6b285b18575bfffa5fc35001f4a297ec20d68b3d2224fa01c48b0f5be8e6995f24cb1124f44cae0b7f3497fdbd487600bd0d714433be5295d6e0aa04582a52a54cd2591ca2d7f6e881047c50cf7df7b0322a6659f7d6841f16f4d429"]}, 0xcc}, 0x1, 0x0, 0x0, 0x48800}, 0x4008050) sendmsg(r5, &(0x7f0000000200)={&(0x7f0000000100)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e23, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="18000015000000001000040000000000000000000000009d7df387a22cf4a270dd7dc37689f4e52e0beba9ec42bca05bfbd6e2cacd9c9a197d59c78390fa38fa43aa3164deb59f41a1e74214c97788ed1edf1184"], 0x18}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x5a}, 0x48) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000040)=ANY=[@ANYBLOB="18020000f6ffffff00000000fcffffff8500000030000000180100002020642500000000002020207b1af8ff00000000bfa110000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000000)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x2}, 0x94) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x3, 0x0, 0xb}, @l2cap_cid_signaling={{0x7}, [@l2cap_move_chan_req={{0xe, 0x1, 0x3}, {0x7dc3, 0x8}}]}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000f2ffffff0000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) 671.788712ms ago: executing program 4 (id=497): r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0xa6242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r0, 0x4000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text32={0x20, &(0x7f0000000100)="260f00d6b805000000b90b3800000f01d9f30f5908650f08b8010000000f01d9660f172fb9351001c00f3264f20fd6e036360fc75a000f01cb", 0x39}], 0x1, 0x9, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000080)={0x8, {"b0476b76ba5d044f65271519727e4ff1ff0d12c0e6bdf3ea1f52e24f60ca698457b32832b83d7e96694c1feb5809bd67002f71e0b97c0d5270c04ffa64f63b2e18ee4b7b572fe2f4d03cad38bcd106ff12f53b443ac6fc81da518f54b9004a44859529c07a2b1b8feddc0180a0f37b13babba1dd0813b7ea56dac4b7ffe9a2ef54221439ecc55223ef2d40f4ba8108c10387ddffbaed25d41e7692bf26ddfa747a666caff49843e38c86cac7323f784a17df6beaa49c3f4a98fb4013f4e573e2ef77b0965d4bfbdf7d5eada69406ca93f422495e00addfca1518085a40f10284ff59388ecf476a12ef1a540163922098d600519ae8cf3ef544344e9d968f341af618503b455f3976b76975270e94d714302382c63de5b7c1fad1fa373b369916cb3b4d583a9ebbaeb262884d25a0e1d9fb141de60df7e64cb38b6f7167991f8fba06bffe2d49133bbb462cd8a9493177eee5f03875b15c7a92c3cd6a3fdfc64f236e14fa05a0e8d3c45f13eecd22e13528c74186dc50e0e2af44177e26bded1161e5533375508dadb83db5126cc810f4e30d4e24ec12c3b99e5220aacf42c58f2960bd43c337dbd318aeeb5c9a6cd5ffd3bf1497bb48ab7bcb32c9c33c9f5b9bc4645b96f23f9e0d826b780030444ffb925f55df587ef5ca5ea74ccd66afc7981da496d6f037efbb0b08f3f5078c60ffb4db18d1b59996bd9b1513442785bf4ece8587b39d8176dc9c735d5ea25133b2053bba227b81faab7220326f8814a9df4eba4ecc6acdd82f70b653b56a18cc9dfa4deb0a112c797ab89a51a103c3a9085d828523370c4d79d9484f4dc910735a2c9b5b85197cd9c073df7a54b40df8e1bf595bab957900c2a1a7dc40e88ed0c55c362ffbb7f88a0725a6ae73b936a639e951faf9c45ae74a2ece2f6f88e425ee41d2c60cb083a2fd6d07381908a7f629e32f89a553cf0794f54b8bdc7bd541d88464a4f80ac0b8b625a803a55de4b05a95fc7f8fc3d6d79858ccb269b7b8b21657654164a9aa29f4e8462377e9d234a41ea69841a4aaa1e5f89f9b074f6f71cb1ffaa450c3160b0e319ec81ad30101db66218b0c69f97c234465dc45849fcfd62d396f2b50ddcc0ed7dd8651431534232ab6d1186d7760770a1fc6c77553a79d0297194f794997ee47781094a76d9dccf632dcbb527b3e68950d9bb534245c7f08ae1d6ef2750292ae28e5e6dcfe2a69737dd7a1e453f3902ae90789e98c212905422099904d3bfb949bde187682a59c01aa8e6a9972a63d6aaef4d4139b10a24e063707f1aba79bd59e3f9709a873dff401d1f356c4be5e449ae0e2633a1fe50ed367fe56b0499957c3b6cabb42256547995ea998f3937d153897d1c83f1ad922d6835bdfa3b986dc6f4bd927a4ca13fbaa99b7b43758e2329d588f40fac718b16cca855468643f3818496b4915fe9a2bdd3e68889fea24bc1dfa6287a801d49a7bb84654147448550d2919e4df3a943a88cf616befea4e7a4fddb7969311c6837f9529966241be1e57ed2d773debc542986d09866905a3f63b6e1820086d52a70f039154e839da7ea852c33bf3722a048f61bbf068519e050b8788370fb130a42e9f5322dfff65b15d588f9e926b70e4530e8b66697cabb1e8514831431fa0eaecb49f9613ed5fd7bc50f897bda36d24d4296e143e2480e325ec09a77c03a07b4f86eb703085313ebeee94ef5b1cde3f6a7efd785772eb4034039f598c07819b769416a223fab824c4ac50086e78042a1ccf47b6c7ede8540cded4bd4c920ce6c2b7493a5634c5e96bb761373623ab473b121d555bfd5a8bc3f5c5418bed83ffd0d6492840550fccc0c35746370396d0190b7b1d2cadcc150877e0d197f692f97cec790c95e3d3959dc7c68aca37306c1bc13ad33848395dba5e3c9ce8090bc0e7e8312091773641be56411921e3d473321c6d8bd10b7d3f5aedd6620bcaa06474bbb298bc77297b8b5dcb9e6b33dbe676460cca825609857724cee245306d07fda287d5fe57c424c27cf9b6cf0f16d2c6a8071bd57c826d7371841cf43dab1b42421ce416d0d3a9c80bc807d2e6761e53f06b3e63c0af1b4548d820118421205f040f4ab35307871e4c7a21ff28082c29e02e89486064661898c0eb1811c70a6124c1f25d62c38794a3e87c312c870db7b60d0df8b57860c94d1a9c561b327fae3a68ce9ff4551e418eb00766f0341c5e796e3cbbbe6b4864928b966110256d5475eb1fd7b2893b60e19e859baaf23c9233a1b064771671ee2d07c151e2e99c37a116a338788052a726a8519b8335e9ff4f71d00ab634543c20ddea1bf57d4f2b797182ff19618b6974d2b69d9f052934d527a1830bf2785842f35eaf32b65b7c9fdd6f0c41756072a59c0cce0b7305740729f1daa14e0092da9d022321b726d658fcef55affa2bbf36ad788f1f423b7dfd328435b4d5df315143d8b8028ba4bea6134a3dc9720c73d5e66b8b8168752eea6b78c75f04efd9677dbe419f13f5e1c9764276a83821b710307d8f85359b34d038ff17de45e8739d4b647fd1a8d794a3273d922af3374f5d3c75b8345b9dfdabb2c0418a358921e0e73d0fe88caab1741b913673e22ff4b59afa0f653a423d9b2bb20cbf07951a349eea18a891b4f4dc6df8e42a6181284f643de5fd2924ae54f672a1920343476c67333e1e8205bf4877b1251a83f417936714edb1c6975ba7969d2fcc2e69024a4669ac2f998116ade1bd8456a18f3f1fccbe95df9ed21db77315b7469f30bfae418415d9cb5aeea627ba6811e30d56d4f4bfe5f794ea4243e3cdfad3ef55199699b8433083b6f72f95effc5f2f613cfcefaf0b94e801ebcb7095a1474ee93142b82c9bf9886617b6bf69d08c83c76cd21d4cce5872d99de8e54bbff915ab923b2d24bb3aa178dd50b44fd0eb880ef33ca51d4bf5f0fbc8ffe18afe4245397f277e4efad955baa10cf56613481253d69c02e7661714b68be0fd64f29bdafbc8b4a0b30bd6709c67fe8e8915d0479b3902b1d0169fb5486b02e966ad5d8a2bcf42ecba59177cd85e17239667f6b045d1f873ce24733ae17e2d8432709062e786a32ac925121f1b0d46c66d4fb9088f4aa0cfe2149f6c2cb5b75d45349bc88fbd47e01ea07e7cd573335aab8d389846566800dd084bc3caa95f7632719c651f2d33be0fb56347c063b3c6e3e75c5e58caeb4c37574859b78c1ed018fbeed788a4305a9ee1c1ef65a0c83a7cd717a8c08ecd4e86370ffffd6d40a89a0b1e8c15a10ad5406e867e49319ad83bfbb925d5e240b4bd44fd751e7510d5ea03a6cab95f37155d1fd69aaea1db4a1f53714eb90e669209cf634f84a50c85bdc51838ebbb545b4387790df67f0122740c2abc910cf83230394172a56c9ffda6675bb8bb39846730a1bf764aeb92407c90a194da880cb8a4efb5b57a8311d864209c7fd226b93582b6b11eec559abfbba653c0569c219d3a2e60555cb739f9d32d564f23c4e98be78aa553610822af426f961df0df2185c61ccaa22b2a6aa6fb3e917bdfb2be9c3ffb8a50821321119c4cf4917db39548abc17bfba267fa50f6af15c560a21055f967f1ca6f656ddb556f9c7e17a771eeef7e80940d1c14ddf2c27647686fd0526460036aeea395fb10abef2be2ea96c9bb380370c08d1568d30eea0f3e6b7cf8f7edc7b36d4d0affd249330707b54ee620f208d885791171eb67a25a80fcc6922e0258c9673b6576564949dfa5bed9a0299bf952aade654de16e22d54fcd391ded6adab94ff621efcd91ef69acf8dfa1b22692ba3e49cd1d3fbed6db1402065ab37e457056877977ebac33ef566f28a19b9acb67a9cc53feb156814e880b3dd5a9119ffdbc5a45c20ea375f2882575b9a28740eebf63f2895d9ffac1ec33cbdcdede98a201424d000df1efd64dd7268cc1b2366ccfb09754822dafdb1821de5e6ebee09608e82e679fafb7a5100172f26998d31d7f27c2b310f0372c3b5e888f8e6efb56074177bf6a2a5bbd9ed070ad5aaf23ce144d1ac86cad110e5916a8a57e1e7fc3d37353f84f2f6d43d92ab8b35040467f3f8b1d23fac021bbac3710edc8e2e26d794db38e48020f63e94d4b4dca3e015537a8e3008274d55f81af931a0faf1a438444b6a0489b93f7b88f81f761eae0f82e60cb0cf2745ca8c9e30d3cc189c1405b1994ed71b00d90ea7a94102916cdc915620c363d04e51eabaaca6c2814a7c1e7aaeec80bdc13135b813e6d0eea83446a5c57ec29695c302c0d8da65b61fe8ada51a36e1aff34d449f9eb70cb94931226121ab121a971c2fc070ca84272d122c1696f52fbd5ed06783abe188dcf133c4d41e10295f6ffda69fa8c5a7c0fec3425a2d60523a60d280b5ce34eac5911268172e772fefba63a6f5c6dafa9e500a5e1355fb614613f8fc1ef5e5466fa19212bcdc349a865f4cee6ea80b11a410bb6e4ad677393973e38621d25ff6c4876ef8a8d2ba651be4a78d2ba9fafadcea8eff9cca3f4ab71a0b84917794e521220dad099ac8aaf32abd162348879e4299e4d46395f9d55267b635e18ca2e2fc96146b96c8a8055130b8d8cb10cc31382df34057bd8637f86e48adc854af408226752a04df8d0362db263e0959f2bd7e8a4d33a8c4b257e19d308280baf40cced1b3cd3a86ee22df0da49d750539eee1104e99a9f8a065e5499c73125a8a8430eda7aee156821a97c237611b50f682a2cccd0969304f0a50ae98800dfb32ee1bcfeab98182c34a51e67fa5bd738c22c44fc1269ce73f464edd2f31296e92e62df51cf55798ae2e3c33c57b09f4ecd13469122095a3563f95f0a04cf58dcea4aed5e8bdda7617863cbc37a97ebadb46d679f7e30014d96d0ac7ce9484368fa5fd19cbc3d139410a2bd7ffacef1bdf76dd1d5f34d2392fcb91c7585fc1ae7d8ba2aa8ded9645d5a5e76e2279b6e0692101137da946dfbd3836476f5dad7fed70115d716dce87b5ad755e5653a709f5aa42265ec9657ed406cc9256af3628c0116b8e1d23306983e9adbc19dec354870c98e2e76566895df933a80c4c36b617db4bbda1a4ca7d6c80a43734471fc92d0bdeacfc125dddd73febd8f7ef84f221d52ae71372cee802d59013a15958e850f8fdf46d8fd3b874633daf3b1f346470456c05722258480959dd6afcffa1f3f2ca033011339c5cb85b7d1c9b5916fb8dc9c2783df64eb5cca5af83a74fe5bb259f93722842eb4ac851e71f3cfd67a39590e7f8e20f018744b9277e6eb46b5f211df5f767ef29dc9a972e14c40ea2d4624f187f301c1116d3a61adeb5c6f7ccc021ac5e18d8b40d7f1f19daf4445c06e72db8701c267c0144c92cddd49af7a87aca5aa05d0e380dd27cc780d2f7db3bef26cc4fd358543e19d73179b879f7bdc702ab405270c93a3ed64153e20b5b663773a2ad4e8e3e1e8eaf39ec80d75d02f74ff94f0e095240a564eeece4fc9bcf19bf2243c700e1dae14a1b0217013977bfa05f681abc37714fe462d0a632044ce52fdaa1c1a806b1eb4370e23ca0247e536165aa9f1c2af8adfea369ee1f4a2c7823a7baef028a1e77501db48db6aa0d7e30969f7197368db02d443803b53b2899315f7e2ba9c5ae952a3866b4ea60f3d669e0a91f7ef640cd938646bf8822fe455f0302fccf87c7fad6daf38fde038fa596b83a9fd5bf675669a6cb2bab44c6617f07950bf34edb93bbcb4174630f275dbda7a0631c4b456e5f80eb6258c1874e77d426743e478917fe44b73dc203baa2cc442b84b5818409abae99d97a28754969bd393df", 0x102b}}, 0x2000) 534.651025ms ago: executing program 4 (id=498): ioctl$UFFDIO_POISON(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}}) syz_open_dev$mtd(&(0x7f00000000c0), 0x260c, 0xa02) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000200)={r0, &(0x7f0000000100)='@\x00', 0x30fb00, &(0x7f0000000140)={@_ha_fsid={[0xfffff062, 0x7f]}, {0x8001, 0x9, 0xfff, 0xa}}, 0xc8, &(0x7f0000000180), &(0x7f00000001c0)=0x1}) gettid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000003700), &(0x7f0000003740)=0xc) lstat(&(0x7f0000000400)='UDC\x00', &(0x7f00000037c0)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000038c0)={{{@in6, @in6=@ipv4={""/10, ""/2, @private}}}, {{@in=@initdev}, 0x0, @in6=@ipv4={""/10, ""/2, @private}}}, &(0x7f00000004c0)=0xe8) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000003b80)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff, 0xee00}}, './file0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/gser.usb0\x00', 0x1ff) chdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00') symlink(&(0x7f0000000280)='functions/gser.usb0\x00', &(0x7f00000002c0)='configs/c.1/gser.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)='dummy_udc.0', 0xb) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) unlink(&(0x7f00000003c0)='configs/c.1/gser.usb0\x00') setresuid(0x0, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) setresuid(0x0, 0xee00, r2) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000003bc0)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) 438.085946ms ago: executing program 4 (id=499): r0 = memfd_create(&(0x7f0000000000)='-&:{-\xaa]{\x00', 0x2) fcntl$addseals(r0, 0x409, 0x20) r1 = syz_open_dev$rtc(&(0x7f0000000000), 0x2, 0x200000) r2 = socket(0x10, 0x80002, 0x0) r3 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=@RTM_NEWMDB={0x18, 0x54, 0x1, 0x70bd2a, 0xffffffff, {0x7, r4}}, 0x18}, 0x1, 0x0, 0x0, 0x804}, 0x4c90) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000040)) r5 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f00000001c0)=@raw={'raw\x00', 0x8, 0x3, 0x498, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3c8, 0xffffffff, 0xffffffff, 0x3c8, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x118, 0x140, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@length={{0x28}, {0x9, 0x200}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, [], [], 'erspan0\x00', 'gre0\x00', {}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x4, 0x7, 0x3ff}}}, @common=@inet=@policy={{0x158}, {[{@ipv6=@remote, [0xffffffff, 0x0, 0x0, 0xff], @ipv4=@multicast1, [0xff000000, 0xff000000, 0xffffff00, 0xff], 0x4d4, 0x3501, 0x0, 0x1, 0x17, 0x1}, {@ipv6=@loopback, [0x0, 0xff000000, 0xffffffff, 0xffffff00], @ipv4=@dev={0xac, 0x14, 0x14, 0x12}, [0xffffff00, 0xffffff00, 0xff0000ff, 0xffffffff], 0x4d5, 0x0, 0x2b, 0x0, 0x14, 0x18}, {@ipv4=@multicast2, [0xffffffff, 0xff000000, 0xffffffff, 0xffffff00], @ipv6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}, [0xff000000, 0xffffff00, 0xffffff00, 0xffffffff], 0x4d4, 0x3502, 0x1, 0x0, 0x17, 0x8}, {@ipv4=@loopback, [0xff000000, 0xff000000, 0xff000000, 0xff0000ff], @ipv4=@local, [0xffffff00, 0x0, 0xffffffff, 0xff000000], 0x4d3, 0x3500, 0x11, 0x0, 0x12}], 0x8, 0x3}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x4f8) 362.864686ms ago: executing program 4 (id=500): mkdir(&(0x7f00000003c0)='./file0\x00', 0x0) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) (async) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000002c80)='./file0\x00', &(0x7f00000004c0), 0x800, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r0, &(0x7f0000003480)={0x2020}, 0x2020) 362.458662ms ago: executing program 4 (id=501): r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000180)={0x0, 0xa, 0x5, &(0x7f0000000100)={0xb, "b6f5eac76e436afb93e063ed9db4f9bf42fd27e6a154034b28a38d7b6ef7ffe7e6"}}) unshare(0x6a040000) syz_usb_disconnect(0xffffffffffffffff) r1 = socket$inet(0x2, 0x1, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f00000001c0)={'nat\x00', 0x0, 0x0, 0x90, [0x4, 0x80, 0xffffffffffffffc0, 0xfff, 0xfffffffffffffff7, 0xd], 0x600, 0x0, 0x0}, &(0x7f0000000240)=0x108) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x3, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000080)="0f0179f8f3420f09420f01c20f2195b8010000000f01c10f226166b81c010f00d8410f20a2660f381d350000000066baf80cb88816398eef66bafc0cb8f09bec1cef", 0x42}], 0x1, 0x11, 0x0, 0x0) flistxattr(r3, &(0x7f00000001c0)=""/211, 0xd3) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r3, 0xc0189378, &(0x7f0000000040)={{0x1, 0x1, 0x18, r2, {r2}}, './file0\x00'}) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000100)=0x3) ioctl$KVM_RUN(r4, 0xae80, 0x0) 192.045861ms ago: executing program 5 (id=502): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000014c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000702000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff6d6405000000000065040400010000000404000001000000b7050000400000006a0a80fe000000008500000053000000b7000000000000009500001000000000a80501363034fdb117168bd07ba00af739d1a1ee35fe163a255c33282044b32495ef8ab9adc67ccc945f105d802f5132143c0a9fc7a84452569957c1002ed7d4d8e17f791f4798c8eb483e9973320d046c3126c6afcfd84de03352c69b3edff5be26f8ffa5f8f2879021c2ea53ea79acd7fb38dd1abb75aa393cea26d465637d11f705000000473e7b7c4ae7dd5e4dee88518ddf12dddd4bfc6a4dd3b6beba51074229b0d4b504516c4c3e5d1aa044d8d00728141cd67bcd68f253288e655c6b34e02e90637ef2912ba7de26ff2357ef17f95a25780c3a057844f226ef4e912f01a201e694e3806e8c70e8b69524cd19f7525d8d66bb766f7f3f918c86a70252236800001897133af94a5a4cfc794d8b9d7c33632152c48eaf302f0b2e0c252b00000000000000006f1bbefbe08de65e3762e194ba4cae8b13535d7d11ee917bca4885bbf597a14ab2458efce78510d86272d88e0c8088f404f011289ebc5623faa1182632161e073af1d69a2e36bed435000025ecd201d2ffb0a7fa4f5d11060cdcf071defd0a8be3b69ce3e4f361aca75827426dde87fdf4617222674280f55e98107450c19b9d86329bd5b4697336112b0b8754ce3574046bf6114d1a88597850b77378fa8edfff8faf8b8ec039bab385cac0535373bb8fab90539b1a65ddff841eb671f3faf37ebdfccea0c002ad2b42047c9ec43193ccf617dbf8a12b4f189edbf9fb7c42b1f435ccd4d96822e6b70100912c92e3943e9c4f45d8bcd528fa8a3ea847f10e9b2506f3bb506f1d7fbde8010000000000a073d0de5538ab42e170b3baae34c35987b0dda497ac3f5e97e6e6aeea15c6d5ed24310100000003bb6030f84b63aaf8690db0221b1705c501f802ff59b4e683efa4b6e77e042072bd2ac37d413008ec9eb8166f6e28b49a77ed91befc65315896f88a8fb1dd679fb4c515f8b7a5b7aca6a251a89d47b728502f7e621cc0e3ba04000000c149ee6601728c750d304197c22da8650579475afd96187d881e93b42a5fdfd686d8900c44c67133dad58037fda65885a15a429edfe3027a5ebf95254744f10fd607bc3300b94932b8d944e0b083bbd86b19cb074577a25ff581d92af08a06f857310a2f14326b0b290205e91a682e00c8762cbc6b904c980eef6e6a1def886c95676dce6a8194479700a02b92bdc8d05eae1f24fdd7b80d1bb404c22f681594de2ebb9687219de8d73ac83823feb402a2415a9850d5f0183ec67be96dc0e4c2d7acf1dfe79d6771903b76e21190c22d641030e1ddacf006c3116e1803af20a5f2b5f7ba58aca5bcabbbab24414a3810788e5503e4be66d683daac5f0001000077339b4200000000108a3c87b19d5b9a00c75d84a92d6dcf00ba96edf35ede0e2b57c26e94801b498924166bde57d5f24258d9fd028096cc15a8b912b494d4bbe609031ea1ca65a548971d5d16296dd08e020000007a27310d5d01f8a8a0f5212d7f628f554afea715ccbc66cbb1016490f5d579308cb3188cf2fcaf67e0c16443d526ba4b968f07ae362c2133c168313e84beb871203880dd453c45d0a137d7f5a8b039dbfa62fb2b4214f8e69f967bf1fbd89e77fcca110000000800000000000000f8877994ebdc35f7efd41e3babd9b3782edd6776d5b6cb4ecd72c9de9b5503747d71440378cf2c2c7ea2dc5febb654a867f853713cf4c0bb322fbbe446d18dee4c821275ef18259cafc346c8b3b9fb0f3adcf6ea310a6b9a3f59e29a5909ea047fb61affb4bc8bbea1fb761b8933795b1a91358a7791aa843d07020e8bb6fc18458c49ac6313e7165b7d9f65e94a62b69f1011b94340cdb7303f01e5cdb5682ddf73d65c3de1d88dd7496d6345d5b9de0223988056a53e19a8b96b9640bc6c09d3c2ff894d626b57c776ed53f94d5e22ff148061b37f72bd92924cb1d0a725e19b264346b7cae0251a850de78316503f3c3d395c7e3f04fc8d52583327cd2341ce4b2d092815376299686f41353b2823814563011a2223b9dd00000000000000000000003a131374a3371cb3e2a9bb4d798b91cefa444501f40b7c9589e8c0bb6c82123d2b45ce905d0903b32ecf30e828c71a07a83f3275f3d661d1af0ffbd5d7f0"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0xfeffff, 0xa40, 0x3f000002, &(0x7f0000000700)="c45c57ce395de5b289f07d637a223920f181c2e57d71483cfb2d075a3ff07258e080a194805cdb0c26d3f7ffb1e0d9cf4fa36dcb2168b72de48ac8f93e6804f1c4d70898d0810e044d7e1778eaac5dfdcc9f1208905522025bcfdf1b6f969b094d5c022c2b7ffefde71e0627b9a2069cc1e0175c4b8860aad4b0a103c589f676b6c4e85eb3950c533b6e62c39ccf9ae9bfe54ee5887358d44f46337fbe090d7c7e55847edee8130ffd3d1e719e01a68b0e691c0d35b0b56e0b514036342fd56f08ac0083f3c2fe41a1295a3d23cf3d160d4fd90f66beba68860456ed41272e1e68d16c2564c85f5556e18784113c493d13253e14d6eb891707fba3c30d07d5ee8619e4426cafec4cf6a3723c455d09b586b248", 0x0, 0xf0, 0x0, 0xf0, 0xffffff0c}, 0x40) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=@newtaction={0x14, 0x30, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x4004051}, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000b80)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$inet(r3, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000240), 0x1}}, {{0x0, 0x0, &(0x7f00000004c0)=[{0x0, 0xf00}, {&(0x7f00000002c0)="00000000008542f4cdb9eaa26519373f589fc2eb12c86e15e5d786493663546e514e6ad1b23e97c489", 0x5}], 0x2}}], 0x400000000000039, 0x8004) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='westwood', 0xa) setns(0xc9, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="30000000100001000000000000000071ff9aee24", @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000005000008001b"], 0x30}}, 0x0) r5 = socket(0x1, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, 0x0, &(0x7f0000cab000)) setresuid(0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, 0x0, 0x0) r6 = socket(0x8, 0x5, 0x5) ioctl$VFAT_IOCTL_READDIR_BOTH(r6, 0x400261f2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004840}, 0x8044) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a5ef423aae44b4edce02c0000000e0a01010000000000000000048717a61ece33c473797a30000000000900010073797a31000000001400e1bd962b0100000000"], 0x54}, 0x1, 0x0, 0x0, 0x20000044}, 0x800) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, 0x0, &(0x7f00000000c0)) socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_START_COMMIT(r1, 0x80585882, &(0x7f0000000100)={0xffffffffffffffff}) sendto$inet6(r7, &(0x7f0000000380)="245c1e0442ce0c63248a7f607ed73a69d0cd0aeed70038f9d3b1fc9d845f004827e813b9b0c1eb66c44131cef1169dc198d9873cd4b772bc5d73104760302245c7d90ce49e952e572166a305887947b4f98c8e44c28b78ea1d192c7f16478144efff1b201f19540f2288bd0c6227c5415a133e02b37801508bfbd384d86c4dabd8f0d38f8375e8b0c4f76906ec17cbb98aa6309ca55f5c670dfba1e93e305f754857f643b420f9268d538a19e0f319a21eb66f0031af2f3c0a264e93033e31802a8de11825f67a6d802523109c", 0xcd, 0x4008881, &(0x7f0000000500)={0xa, 0x4e24, 0x5, @empty, 0x2}, 0x1c) syz_genetlink_get_family_id$tipc2(&(0x7f0000001ec0), 0xffffffffffffffff) 166.187696ms ago: executing program 5 (id=503): r0 = socket(0x15, 0x5, 0x0) r1 = socket$kcm(0x21, 0x2, 0x2) sendmsg$inet(r1, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@ip_pktinfo={{0x1c, 0x110, 0xd, {0x0, @loopback=0x7f000300, @dev}}}], 0x20}, 0x0) getsockopt(r0, 0x200000000114, 0x2712, 0x0, &(0x7f0000000040)) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000000)={'netpci0\x00', {0x2, 0x4e20, @empty}}) 83.259598ms ago: executing program 5 (id=504): ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000140)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$unix(0x1, 0x2, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010026bd700000dcdf250700000008000300", @ANYRES32=r4, @ANYBLOB="0c009900010700004f000000140004007379026b070000000a001800030377d2030300"/52], 0x50}, 0x1, 0x0, 0x0, 0x93}, 0x24044884) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DISCONNECT(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r3, 0x400, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040000}, 0x4) openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x149a82, 0x12) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r6, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0xb, 0x6, 0x101, 0x0, 0x0, {0x2, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc0}, 0x8000) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)=0x8, 0xfffffffffffffed8) 82.750797ms ago: executing program 5 (id=505): r0 = socket$alg(0x26, 0x5, 0x0) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (rerun: 64) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSSOFTCAR(r1, 0x5412, &(0x7f00000004c0)=0x11) r2 = syz_open_procfs$userns(0x0, &(0x7f0000000280)) setns(r2, 0x4000000) (async) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) (async, rerun: 64) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) (rerun: 64) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r4, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) ioctl$sock_netdev_private(r4, 0x89f3, &(0x7f0000000000)) io_uring_register$IORING_REGISTER_IOWQ_AFF(0xffffffffffffffff, 0x25, &(0x7f0000000d40)="01", 0x1) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vhci_hcd/bind\x00', 0x1, 0x0) write(r5, &(0x7f0000000180)='vhci_hcd.0\x00', 0xa) (async) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) (async) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000040)) (async) r6 = accept4(r0, 0x0, 0x0, 0x800) setxattr$incfs_id(&(0x7f00000002c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', &(0x7f0000000340), &(0x7f0000000380)={'0000000000000000000000000000000', 0x32}, 0x20, 0x3) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000a40), 0x0, 0x0, 0xd, 0x4}], 0x1, 0x40840) (async) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d00000000000057"], 0x0, 0x34}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18300000010000000000000003000000950000550a"], &(0x7f0000000080)='GPL\x00', 0x8, 0x0, 0x0, 0x41000, 0x41}, 0x94) (async) getsockopt$IPT_SO_GET_INFO(r6, 0x0, 0x40, &(0x7f0000000100)={'mangle\x00', 0x0, [0x74925329, 0x3, 0x20, 0x8, 0x2]}, &(0x7f0000000180)=0x54) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64) r8 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000), 0x80080, 0x0) (rerun: 64) fchmodat(r8, &(0x7f0000000040)='./file0\x00', 0x90) (async, rerun: 32) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (rerun: 32) 2.369781ms ago: executing program 1 (id=506): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000ec0)=@mangle={'mangle\x00', 0x64, 0x6, 0x5e0, 0x0, 0x0, 0x2e0, 0x0, 0x440, 0x510, 0x510, 0x510, 0x510, 0x510, 0x6, 0x0, {[{{@ipv6={@empty, @local, [0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00], [0xffffffff, 0xff000000, 0xff, 0xff000000], 'bridge_slave_0\x00', 'dummy0\x00', {0xff}, {}, 0x84, 0x5, 0x6, 0x4c}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0xfffc, 0x5}}}, {{@ipv6={@mcast2, @private2, [0xff, 0xffffff00, 0x0, 0xffffff00], [0xff000000, 0xff, 0x0, 0xffffff00], 'macvtap0\x00', 'pimreg\x00', {0xff}, {0xff}, 0x88, 0x6, 0x6, 0x4}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@inet=@udplite={{0x30}, {[0x4e21, 0x4e23], [0x4e23, 0x4e20], 0x2}}]}, @common=@unspec=@MARK={0x28}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x3a}, [0x0, 0xffffff00, 0x0, 0xff000000], [0xffffff00, 0x0, 0xff, 0xffffffff], 'rose0\x00', 'batadv_slave_0\x00', {}, {}, 0x0, 0xc1, 0x5}, 0x0, 0x120, 0x160, 0x0, {}, [@common=@frag={{0x30}}, @common=@hbh={{0x48}, {0x0, 0x3, 0x0, [0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x6, 0x84, 0x0, 0x0, 0x0, 0x4]}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x10, 0x10001, @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e21}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x2b}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xffffff00, 0xee5f356c6f495b18, 0x100fffe00, 0xff], [0x0, 0xff, 0xffffff00, 0xffffff00], 'veth1_macvtap\x00', 'dummy0\x00', {}, {}, 0x1d, 0x6, 0x4, 0x19}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x640) (async, rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async, rerun: 32) mount$fuse(0x0, 0x0, 0x0, 0x8, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=0x0]) (async) mount(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000280)='autofs\x00', 0x201000c, &(0x7f0000000040)) (async) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x8) (async) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0), 0x2440, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r2, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {r1}}, './file0\x00'}) 0s ago: executing program 1 (id=507): ioctl$UFFDIO_POISON(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}}) syz_open_dev$mtd(&(0x7f00000000c0), 0x260c, 0xa02) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000200)={r0, &(0x7f0000000100)='@\x00', 0x30fb00, &(0x7f0000000140)={@_ha_fsid={[0xfffff062, 0x7f]}, {0x8001, 0x9, 0xfff, 0xa}}, 0xc8, &(0x7f0000000180), &(0x7f00000001c0)=0x1}) gettid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000003700), &(0x7f0000003740)=0xc) lstat(&(0x7f0000000400)='UDC\x00', &(0x7f00000037c0)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000038c0)={{{@in6, @in6=@ipv4={""/10, ""/2, @private}}}, {{@in=@initdev}, 0x0, @in6=@ipv4={""/10, ""/2, @private}}}, &(0x7f00000004c0)=0xe8) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000003b80)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff, 0xee00}}, './file0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/gser.usb0\x00', 0x1ff) chdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00') symlink(&(0x7f0000000280)='functions/gser.usb0\x00', &(0x7f00000002c0)='configs/c.1/gser.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)='dummy_udc.0', 0xb) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) unlink(&(0x7f00000003c0)='configs/c.1/gser.usb0\x00') setresuid(0x0, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) setresuid(0x0, 0xee00, r2) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000003bc0)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) kernel console output (not intermixed with test programs): (UM) 7*128kB (UM) 0*256kB 5*512kB (UM) 0*1024kB 2*2048kB (UM) 403*4096kB (UM) = 1658684kB [ 70.366018][ T6177] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 70.366218][ T6168] usb 2-1: USB disconnect, device number 2 [ 70.369159][ T6177] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 70.375179][ T6177] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 70.378982][ T6177] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 70.382288][ T6177] 59434 total pagecache pages [ 70.383929][ T6177] 0 pages in swap cache [ 70.385346][ T6177] Free swap = 124996kB [ 70.386846][ T6177] Total swap = 124996kB [ 70.388260][ T6177] 1048443 pages RAM [ 70.389562][ T6177] 0 pages HighMem/MovableOnly [ 70.391122][ T6177] 285333 pages reserved [ 70.393535][ T6177] 0 pages cma reserved [ 70.434833][ T6207] FAULT_INJECTION: forcing a failure. [ 70.434833][ T6207] name failslab, interval 1, probability 0, space 0, times 1 [ 70.439923][ T6207] CPU: 2 UID: 0 PID: 6207 Comm: syz.1.91 Tainted: G L syzkaller #0 PREEMPT(full) [ 70.439941][ T6207] Tainted: [L]=SOFTLOCKUP [ 70.439945][ T6207] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.439951][ T6207] Call Trace: [ 70.439956][ T6207] [ 70.439961][ T6207] dump_stack_lvl+0x100/0x190 [ 70.439987][ T6207] should_fail_ex.cold+0x5/0xa [ 70.440001][ T6207] should_failslab+0xc2/0x120 [ 70.440015][ T6207] __kmalloc_noprof+0xfc/0x820 [ 70.440028][ T6207] ? tomoyo_encode2+0xfb/0x3c0 [ 70.440040][ T6207] tomoyo_encode2+0xfb/0x3c0 [ 70.440052][ T6207] tomoyo_encode+0x29/0x50 [ 70.440061][ T6207] tomoyo_realpath_from_path+0x18c/0x690 [ 70.440075][ T6207] tomoyo_path_number_perm+0x23c/0x580 [ 70.440089][ T6207] ? tomoyo_path_number_perm+0x22e/0x580 [ 70.440105][ T6207] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 70.440133][ T6207] ? find_held_lock+0x2b/0x80 [ 70.440142][ T6207] ? __fget_files+0x215/0x3d0 [ 70.440153][ T6207] ? hook_file_ioctl_common+0x140/0x440 [ 70.440164][ T6207] ? __fget_files+0x215/0x3d0 [ 70.440177][ T6207] ? __fget_files+0x21f/0x3d0 [ 70.440189][ T6207] security_file_ioctl+0xd3/0x230 [ 70.440206][ T6207] __x64_sys_ioctl+0xb7/0x210 [ 70.440222][ T6207] do_syscall_64+0x115/0x870 [ 70.440235][ T6207] ? clear_bhb_loop+0x40/0x90 [ 70.440248][ T6207] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.440259][ T6207] RIP: 0033:0x7fcb8db9e019 [ 70.440268][ T6207] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 70.440279][ T6207] RSP: 002b:00007fcb8ead6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 70.440290][ T6207] RAX: ffffffffffffffda RBX: 00007fcb8de25fa0 RCX: 00007fcb8db9e019 [ 70.440296][ T6207] RDX: 0000200000000080 RSI: 00000000c0205648 RDI: 0000000000000003 [ 70.440302][ T6207] RBP: 00007fcb8ead6090 R08: 0000000000000000 R09: 0000000000000000 [ 70.440308][ T6207] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 70.440314][ T6207] R13: 00007fcb8de26038 R14: 00007fcb8de25fa0 R15: 00007ffd73685488 [ 70.440334][ T6207] [ 70.440350][ T6207] ERROR: Out of memory at tomoyo_realpath_from_path. [ 70.530389][ T6211] fido_id[6211]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 70.574845][ T6168] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 70.580988][ T6168] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 70.592332][ T6168] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 70.623830][ T6168] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 70.630962][ T6168] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 70.634270][ T6168] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 70.638032][ T6168] usb usb1: Product: EHCI Host Controller [ 70.638544][ T6219] warning: `syz.1.95' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 70.641055][ T6168] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 70.651552][ T6168] usb usb1: SerialNumber: 0000:00:1d.7 [ 70.673122][ T6168] hub 1-0:1.0: USB hub found [ 70.677984][ T6168] hub 1-0:1.0: 6 ports detected [ 70.703185][ T6217] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 70.736191][ T6168] hub 2-0:1.0: USB hub found [ 70.739307][ T6168] hub 2-0:1.0: 2 ports detected [ 70.799438][ T6168] hub 3-0:1.0: USB hub found [ 70.802153][ T6168] hub 3-0:1.0: 2 ports detected [ 70.869507][ T6168] hub 4-0:1.0: USB hub found [ 70.873951][ T6231] binder: 6230:6231 ioctl c0306201 0 returned -14 [ 70.878032][ T6168] hub 4-0:1.0: 2 ports detected [ 70.962143][ T1360] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 70.966794][ T6186] CIFS: VFS: cifs_mount failed w/return code = -112 [ 70.973522][ T6228] usb usb8: usbfs: interface 0 claimed by hub while 'syz.3.96' sets config #8 [ 71.163415][ T1360] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 71.172803][ T1360] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 71.172905][ T6254] FAULT_INJECTION: forcing a failure. [ 71.172905][ T6254] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 71.176432][ T1360] usb 1-1: Product: QEMU USB Tablet [ 71.181474][ T6254] CPU: 2 UID: 0 PID: 6254 Comm: syz.0.104 Tainted: G L syzkaller #0 PREEMPT(full) [ 71.181493][ T6254] Tainted: [L]=SOFTLOCKUP [ 71.181497][ T6254] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 71.181503][ T6254] Call Trace: [ 71.181507][ T6254] [ 71.181512][ T6254] dump_stack_lvl+0x100/0x190 [ 71.181550][ T6254] should_fail_ex.cold+0x5/0xa [ 71.181564][ T6254] _copy_from_user+0x2e/0xd0 [ 71.181582][ T6254] video_usercopy+0xe71/0x1730 [ 71.181623][ T6254] ? __pfx___video_do_ioctl+0x10/0x10 [ 71.181637][ T6254] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 71.181655][ T6254] ? __pfx_video_usercopy+0x10/0x10 [ 71.181677][ T6254] v4l2_ioctl+0x1bd/0x250 [ 71.181690][ T6254] ? __pfx_v4l2_ioctl+0x10/0x10 [ 71.181704][ T6254] __x64_sys_ioctl+0x18e/0x210 [ 71.181721][ T6254] do_syscall_64+0x115/0x870 [ 71.181761][ T6254] ? clear_bhb_loop+0x40/0x90 [ 71.181774][ T6254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.181785][ T6254] RIP: 0033:0x7fcd7839e019 [ 71.181795][ T6254] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 71.181805][ T6254] RSP: 002b:00007fcd7929f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 71.181822][ T6254] RAX: ffffffffffffffda RBX: 00007fcd78625fa0 RCX: 00007fcd7839e019 [ 71.181829][ T6254] RDX: 0000200000000080 RSI: 00000000c0205648 RDI: 0000000000000003 [ 71.181835][ T6254] RBP: 00007fcd7929f090 R08: 0000000000000000 R09: 0000000000000000 [ 71.181841][ T6254] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 71.181846][ T6254] R13: 00007fcd78626038 R14: 00007fcd78625fa0 R15: 00007fffb9bb8ef8 [ 71.181861][ T6254] [ 71.187490][ T6251] FAULT_INJECTION: forcing a failure. [ 71.187490][ T6251] name failslab, interval 1, probability 0, space 0, times 0 [ 71.187701][ T1360] usb 1-1: Manufacturer: QEMU [ 71.189327][ T6251] CPU: 0 UID: 0 PID: 6251 Comm: syz.2.103 Tainted: G L syzkaller #0 PREEMPT(full) [ 71.189344][ T6251] Tainted: [L]=SOFTLOCKUP [ 71.189348][ T6251] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 71.189355][ T6251] Call Trace: [ 71.189359][ T6251] [ 71.189364][ T6251] dump_stack_lvl+0x100/0x190 [ 71.189382][ T6251] should_fail_ex.cold+0x5/0xa [ 71.189396][ T6251] should_failslab+0xc2/0x120 [ 71.189411][ T6251] kmem_cache_alloc_noprof+0x91/0x6a0 [ 71.189424][ T6251] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 71.189440][ T6251] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 71.189457][ T6251] mmu_topup_memory_caches+0x25/0x170 [ 71.189473][ T6251] kvm_mmu_load+0xe2/0x2570 [ 71.189488][ T6251] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 71.189503][ T6251] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 71.189515][ T6251] ? kvm_apic_accept_pic_intr+0xdf/0x1b0 [ 71.189526][ T6251] ? __pfx_kvm_mmu_load+0x10/0x10 [ 71.189539][ T6251] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 71.189552][ T6251] ? kvm_check_and_inject_events+0x873/0x12a0 [ 71.189567][ T6251] ? vmx_load_vmcs01+0x50/0xe0 [ 71.189579][ T6251] vcpu_run+0x3aaa/0x5de0 [ 71.189600][ T6251] ? __pfx_vcpu_run+0x10/0x10 [ 71.189620][ T6251] ? rcu_is_watching+0x12/0xc0 [ 71.189638][ T6251] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 71.189653][ T6251] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 71.189672][ T6251] kvm_vcpu_ioctl+0x730/0x1700 [ 71.189685][ T6251] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 71.189697][ T6251] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 71.189711][ T6251] ? do_vfs_ioctl+0x226/0x13e0 [ 71.189726][ T6251] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 71.189742][ T6251] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 71.189763][ T6251] ? __fget_files+0x215/0x3d0 [ 71.189773][ T6251] ? hook_file_ioctl_common+0x140/0x440 [ 71.189789][ T6251] ? selinux_file_ioctl+0x13b/0x290 [ 71.189804][ T6251] ? selinux_file_ioctl+0xb6/0x290 [ 71.189821][ T6251] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 71.189833][ T6251] __x64_sys_ioctl+0x18e/0x210 [ 71.189850][ T6251] do_syscall_64+0x115/0x870 [ 71.189863][ T6251] ? clear_bhb_loop+0x40/0x90 [ 71.189875][ T6251] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.189886][ T6251] RIP: 0033:0x7f45b9b9e019 [ 71.189896][ T6251] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 71.189907][ T6251] RSP: 002b:00007f45baacf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 71.189917][ T6251] RAX: ffffffffffffffda RBX: 00007f45b9e25fa0 RCX: 00007f45b9b9e019 [ 71.189924][ T6251] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 71.189930][ T6251] RBP: 00007f45baacf090 R08: 0000000000000000 R09: 0000000000000000 [ 71.189935][ T6251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 71.189941][ T6251] R13: 00007f45b9e26038 R14: 00007f45b9e25fa0 R15: 00007ffc02082c58 [ 71.189954][ T6251] [ 71.206546][ T1445] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.210054][ T1360] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 71.210925][ T1445] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.269643][ T1360] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0003/input/input8 [ 71.360565][ T1360] hid-generic 0003:0627:0001.0003: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 71.458449][ T6275] CIFS: Attempting to mount //127.0.0.1/share [ 71.513290][ T6275] CIFS: VFS: cifs_mount failed w/return code = -112 [ 71.516475][ T6279] program syz.3.109 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 71.662104][ T5812] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 71.815614][ T5812] usb 7-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 71.819380][ T5812] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.822925][ T5812] usb 7-1: Product: syz [ 71.824518][ T5812] usb 7-1: Manufacturer: syz [ 71.826717][ T5812] usb 7-1: SerialNumber: syz [ 72.150975][ T6305] netlink: 'syz.1.110': attribute type 1 has an invalid length. [ 72.154347][ T6305] netlink: 'syz.1.110': attribute type 1 has an invalid length. [ 72.311232][ T6309] usb usb8: usbfs: interface 0 claimed by hub while 'syz.0.114' sets config #9 [ 72.353475][ T6311] binder: 6310:6311 ioctl c018620c 2000000001c0 returned -22 [ 72.379754][ T6311] binder: 6310:6311 ioctl c018620c 2000000001c0 returned -22 [ 72.379839][ T6312] binder: BINDER_SET_CONTEXT_MGR already set [ 72.386146][ T6312] binder: 6310:6312 ioctl 4018620d 200000003280 returned -16 [ 72.578084][ T6318] FAULT_INJECTION: forcing a failure. [ 72.578084][ T6318] name failslab, interval 1, probability 0, space 0, times 0 [ 72.583327][ T6318] CPU: 3 UID: 0 PID: 6318 Comm: syz.0.117 Tainted: G L syzkaller #0 PREEMPT(full) [ 72.583356][ T6318] Tainted: [L]=SOFTLOCKUP [ 72.583366][ T6318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 72.583376][ T6318] Call Trace: [ 72.583384][ T6318] [ 72.583391][ T6318] dump_stack_lvl+0x100/0x190 [ 72.583418][ T6318] should_fail_ex.cold+0x5/0xa [ 72.583440][ T6318] should_failslab+0xc2/0x120 [ 72.583462][ T6318] kmem_cache_alloc_noprof+0x91/0x6a0 [ 72.583483][ T6318] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 72.583529][ T6318] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 72.583559][ T6318] mmu_topup_memory_caches+0x25/0x170 [ 72.583584][ T6318] kvm_mmu_load+0xe2/0x2570 [ 72.583606][ T6318] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 72.583621][ T6318] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 72.583638][ T6318] ? kvm_apic_accept_pic_intr+0xdf/0x1b0 [ 72.583653][ T6318] ? __pfx_kvm_mmu_load+0x10/0x10 [ 72.583672][ T6318] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 72.583691][ T6318] ? kvm_check_and_inject_events+0x873/0x12a0 [ 72.583712][ T6318] ? vmx_load_vmcs01+0x50/0xe0 [ 72.583730][ T6318] vcpu_run+0x3aaa/0x5de0 [ 72.583751][ T6318] ? mark_held_locks+0x40/0x70 [ 72.583779][ T6318] ? __pfx_vcpu_run+0x10/0x10 [ 72.583811][ T6318] ? rcu_is_watching+0x12/0xc0 [ 72.583838][ T6318] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 72.583862][ T6318] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 72.583892][ T6318] kvm_vcpu_ioctl+0x730/0x1700 [ 72.583912][ T6318] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 72.583932][ T6318] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 72.583955][ T6318] ? do_vfs_ioctl+0x226/0x13e0 [ 72.583981][ T6318] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 72.584007][ T6318] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 72.584041][ T6318] ? __fget_files+0x215/0x3d0 [ 72.584058][ T6318] ? hook_file_ioctl_common+0x140/0x440 [ 72.584085][ T6318] ? selinux_file_ioctl+0x13b/0x290 [ 72.584111][ T6318] ? selinux_file_ioctl+0xb6/0x290 [ 72.584138][ T6318] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 72.584159][ T6318] __x64_sys_ioctl+0x18e/0x210 [ 72.584187][ T6318] do_syscall_64+0x115/0x870 [ 72.584208][ T6318] ? clear_bhb_loop+0x40/0x90 [ 72.584230][ T6318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.584253][ T6318] RIP: 0033:0x7fcd7839e019 [ 72.584269][ T6318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 72.584285][ T6318] RSP: 002b:00007fcd7929f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 72.584303][ T6318] RAX: ffffffffffffffda RBX: 00007fcd78625fa0 RCX: 00007fcd7839e019 [ 72.584314][ T6318] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 72.584324][ T6318] RBP: 00007fcd7929f090 R08: 0000000000000000 R09: 0000000000000000 [ 72.584333][ T6318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 72.584343][ T6318] R13: 00007fcd78626038 R14: 00007fcd78625fa0 R15: 00007fffb9bb8ef8 [ 72.584367][ T6318] [ 72.780053][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880566e6000: rx timeout, send abort [ 72.785479][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff8880566e6000: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 72.989368][ T6327] key id 000004d2 not found [ 73.039123][ T5812] usb 7-1: usb_control_msg returned -71 [ 73.041399][ T5812] usbtmc 7-1:1.0: can't read capabilities [ 73.055081][ T5812] usb 7-1: USB disconnect, device number 4 [ 73.771635][ T6339] FAULT_INJECTION: forcing a failure. [ 73.771635][ T6339] name failslab, interval 1, probability 0, space 0, times 0 [ 73.775887][ T6339] CPU: 1 UID: 0 PID: 6339 Comm: syz.0.123 Tainted: G L syzkaller #0 PREEMPT(full) [ 73.775906][ T6339] Tainted: [L]=SOFTLOCKUP [ 73.775910][ T6339] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 73.775916][ T6339] Call Trace: [ 73.775920][ T6339] [ 73.775924][ T6339] dump_stack_lvl+0x100/0x190 [ 73.775942][ T6339] should_fail_ex.cold+0x5/0xa [ 73.775956][ T6339] should_failslab+0xc2/0x120 [ 73.775970][ T6339] __kvmalloc_node_noprof+0x116/0x970 [ 73.775984][ T6339] ? video_usercopy+0x8a7/0x1730 [ 73.776003][ T6339] video_usercopy+0x8a7/0x1730 [ 73.776016][ T6339] ? __pfx___video_do_ioctl+0x10/0x10 [ 73.776030][ T6339] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 73.776048][ T6339] ? __pfx_video_usercopy+0x10/0x10 [ 73.776069][ T6339] v4l2_ioctl+0x1bd/0x250 [ 73.776083][ T6339] ? __pfx_v4l2_ioctl+0x10/0x10 [ 73.776097][ T6339] __x64_sys_ioctl+0x18e/0x210 [ 73.776114][ T6339] do_syscall_64+0x115/0x870 [ 73.776127][ T6339] ? clear_bhb_loop+0x40/0x90 [ 73.776140][ T6339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.776151][ T6339] RIP: 0033:0x7fcd7839e019 [ 73.776161][ T6339] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 73.776171][ T6339] RSP: 002b:00007fcd7929f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 73.776182][ T6339] RAX: ffffffffffffffda RBX: 00007fcd78625fa0 RCX: 00007fcd7839e019 [ 73.776189][ T6339] RDX: 0000200000000080 RSI: 00000000c0205648 RDI: 0000000000000003 [ 73.776195][ T6339] RBP: 00007fcd7929f090 R08: 0000000000000000 R09: 0000000000000000 [ 73.776200][ T6339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 73.776206][ T6339] R13: 00007fcd78626038 R14: 00007fcd78625fa0 R15: 00007fffb9bb8ef8 [ 73.776219][ T6339] [ 74.120470][ T5746] Bluetooth: hci1: ACL packet for unknown connection handle 0 [ 74.126174][ T6370] fuse: Bad value for 'fd' [ 74.502775][ T42] kauditd_printk_skb: 71 callbacks suppressed [ 74.502796][ T42] audit: type=1400 audit(1785493997.980:410): avc: denied { prog_run } for pid=6379 comm="syz.3.136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 74.520806][ T42] audit: type=1400 audit(1785493997.990:411): avc: denied { ioctl } for pid=6379 comm="syz.3.136" path="socket:[11148]" dev="sockfs" ino=11148 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 74.531105][ T42] audit: type=1400 audit(1785493997.990:412): avc: denied { setopt } for pid=6379 comm="syz.3.136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 74.739981][ T6387] netlink: 12 bytes leftover after parsing attributes in process `syz.3.138'. [ 74.870942][ T6395] netlink: 'syz.1.141': attribute type 1 has an invalid length. [ 74.873846][ T6395] netlink: 224 bytes leftover after parsing attributes in process `syz.1.141'. [ 74.926450][ T42] audit: type=1400 audit(1785493998.400:413): avc: denied { shutdown } for pid=6397 comm="syz.0.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 74.984559][ T6399] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 74.986759][ T6399] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 74.993490][ T6399] vhci_hcd vhci_hcd.0: Device attached [ 75.005517][ T42] audit: type=1400 audit(1785493998.480:414): avc: denied { create } for pid=6404 comm="syz.3.144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 75.028625][ T42] audit: type=1326 audit(1785493998.500:415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6404 comm="syz.3.144" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f34d039e019 code=0x0 [ 75.083641][ T42] audit: type=1400 audit(1785493998.560:416): avc: denied { bind } for pid=6404 comm="syz.3.144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 75.094512][ T42] audit: type=1400 audit(1785493998.570:417): avc: denied { mount } for pid=6404 comm="syz.3.144" name="/" dev="autofs" ino=13815 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 75.179449][ T42] audit: type=1400 audit(1785493998.650:418): avc: denied { write } for pid=6419 comm="syz.1.149" name="card1" dev="devtmpfs" ino=636 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 75.202227][ T6422] netlink: 96 bytes leftover after parsing attributes in process `syz.2.150'. [ 75.207642][ T42] audit: type=1400 audit(1785493998.680:419): avc: denied { unmount } for pid=5733 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 75.252196][ T50] usb 37-1: new high-speed USB device number 2 using vhci_hcd [ 75.266729][ T6424] FAULT_INJECTION: forcing a failure. [ 75.266729][ T6424] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 75.272540][ T6424] CPU: 2 UID: 0 PID: 6424 Comm: syz.1.151 Tainted: G L syzkaller #0 PREEMPT(full) [ 75.272572][ T6424] Tainted: [L]=SOFTLOCKUP [ 75.272578][ T6424] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.272589][ T6424] Call Trace: [ 75.272596][ T6424] [ 75.272614][ T6424] dump_stack_lvl+0x100/0x190 [ 75.272667][ T6424] should_fail_ex.cold+0x5/0xa [ 75.272687][ T6424] ? prepare_alloc_pages+0x16d/0x5f0 [ 75.272714][ T6424] should_fail_alloc_page+0xeb/0x140 [ 75.272740][ T6424] prepare_alloc_pages+0x1f0/0x5f0 [ 75.272770][ T6424] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 75.272792][ T6424] ? do_syscall_64+0x115/0x870 [ 75.272876][ T6424] ? __kernel_text_address+0xd/0x30 [ 75.272897][ T6424] ? unwind_get_return_address+0x59/0xa0 [ 75.272916][ T6424] ? arch_stack_walk+0x88/0xf0 [ 75.272952][ T6424] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 75.272974][ T6424] ? __lock_acquire+0x49f/0x1a40 [ 75.273001][ T6424] ? __lock_acquire+0x49f/0x1a40 [ 75.273035][ T6424] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 75.273058][ T6424] ? policy_nodemask+0xed/0x4f0 [ 75.273084][ T6424] alloc_pages_mpol+0x1fb/0x540 [ 75.273109][ T6424] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 75.273134][ T6424] ? __kernel_text_address+0xd/0x30 [ 75.273154][ T6424] ? unwind_get_return_address+0x59/0xa0 [ 75.273176][ T6424] folio_alloc_mpol_noprof+0x36/0x260 [ 75.273205][ T6424] shmem_alloc_folio+0x135/0x160 [ 75.273234][ T6424] shmem_alloc_and_add_folio+0x371/0xd40 [ 75.273260][ T6424] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 75.273281][ T6424] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 75.273306][ T6424] shmem_get_folio_gfp+0x6ad/0x1910 [ 75.273331][ T6424] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 75.273357][ T6424] shmem_fault+0x1f9/0xa20 [ 75.273376][ T6424] ? __lock_acquire+0x49f/0x1a40 [ 75.273398][ T6424] ? __pfx_shmem_fault+0x10/0x10 [ 75.273430][ T6424] ? __pfx_filemap_map_pages+0x10/0x10 [ 75.273457][ T6424] __do_fault+0x10b/0x440 [ 75.273474][ T6424] ? find_held_lock+0x2b/0x80 [ 75.273489][ T6424] do_fault+0x2db/0x1750 [ 75.273531][ T6424] __handle_mm_fault+0x187d/0x2a00 [ 75.273566][ T6424] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 75.273594][ T6424] ? __pfx___handle_mm_fault+0x10/0x10 [ 75.273624][ T6424] ? pte_offset_map_lock+0x174/0x320 [ 75.273646][ T6424] ? find_held_lock+0x2b/0x80 [ 75.273669][ T6424] ? follow_page_pte+0x4d0/0x13f0 [ 75.273697][ T6424] handle_mm_fault+0x37b/0xa30 [ 75.273729][ T6424] __get_user_pages+0x1178/0x32a0 [ 75.273756][ T6424] ? down_read_killable+0x35e/0x520 [ 75.273778][ T6424] ? __pfx___get_user_pages+0x10/0x10 [ 75.273802][ T6424] ? __pfx_gup_fast_fallback+0x10/0x10 [ 75.273836][ T6424] get_user_pages_unlocked+0x1cb/0x7d0 [ 75.273862][ T6424] ? __pfx_get_user_pages_unlocked+0x10/0x10 [ 75.273885][ T6424] ? get_user_pages_fast_only+0xae/0xf0 [ 75.273908][ T6424] ? __pfx_get_user_pages_fast_only+0x10/0x10 [ 75.273930][ T6424] ? __pfx___might_resched+0x10/0x10 [ 75.273954][ T6424] ? __mutex_lock+0x26d/0x1bd0 [ 75.273975][ T6424] hva_to_pfn+0x871/0xd60 [ 75.273999][ T6424] ? kvm_hv_setup_tsc_page+0x290/0x870 [ 75.274023][ T6424] ? __pfx_hva_to_pfn+0x10/0x10 [ 75.274048][ T6424] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 75.274073][ T6424] ? __lock_acquire+0x49f/0x1a40 [ 75.274106][ T6424] kvm_follow_pfn+0x291/0x430 [ 75.274133][ T6424] __kvm_faultin_pfn+0x11c/0x1a0 [ 75.274158][ T6424] ? __pfx___kvm_faultin_pfn+0x10/0x10 [ 75.274196][ T6424] vmx_set_apic_access_page_addr+0x3e8/0x910 [ 75.274226][ T6424] ? __pfx_vmx_set_apic_access_page_addr+0x10/0x10 [ 75.274256][ T6424] ? vmx_flush_tlb_all+0x14a/0x2e0 [ 75.274280][ T6424] ? record_steal_time+0x452/0xbb0 [ 75.274304][ T6424] vcpu_run+0x457a/0x5de0 [ 75.274341][ T6424] ? __pfx_vcpu_run+0x10/0x10 [ 75.274378][ T6424] ? rcu_is_watching+0x12/0xc0 [ 75.274408][ T6424] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 75.274435][ T6424] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 75.274469][ T6424] kvm_vcpu_ioctl+0x730/0x1700 [ 75.274492][ T6424] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 75.274513][ T6424] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 75.274537][ T6424] ? do_vfs_ioctl+0x226/0x13e0 [ 75.274573][ T6424] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 75.274599][ T6424] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 75.274663][ T6424] ? __fget_files+0x215/0x3d0 [ 75.274682][ T6424] ? hook_file_ioctl_common+0x140/0x440 [ 75.274709][ T6424] ? selinux_file_ioctl+0x13b/0x290 [ 75.274737][ T6424] ? selinux_file_ioctl+0xb6/0x290 [ 75.274765][ T6424] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 75.274786][ T6424] __x64_sys_ioctl+0x18e/0x210 [ 75.274814][ T6424] do_syscall_64+0x115/0x870 [ 75.274841][ T6424] ? clear_bhb_loop+0x40/0x90 [ 75.274862][ T6424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.274878][ T6424] RIP: 0033:0x7fcb8db9e019 [ 75.274894][ T6424] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.274909][ T6424] RSP: 002b:00007fcb8ead6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 75.274936][ T6424] RAX: ffffffffffffffda RBX: 00007fcb8de25fa0 RCX: 00007fcb8db9e019 [ 75.274947][ T6424] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 75.274957][ T6424] RBP: 00007fcb8ead6090 R08: 0000000000000000 R09: 0000000000000000 [ 75.274967][ T6424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 75.274977][ T6424] R13: 00007fcb8de26038 R14: 00007fcb8de25fa0 R15: 00007ffd73685488 [ 75.275001][ T6424] [ 75.752836][ T6401] vhci_hcd: connection reset by peer [ 75.759550][ T12] vhci_hcd vhci_hcd.0: stop threads [ 75.761877][ T12] vhci_hcd vhci_hcd.0: release socket [ 75.764680][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 75.955396][ T6443] netlink: 32 bytes leftover after parsing attributes in process `syz.2.158'. [ 76.019974][ T6446] null_blk: disk nullb1 created [ 76.028925][ T6446] Bluetooth: MGMT ver 1.23 [ 76.097079][ T6450] FAULT_INJECTION: forcing a failure. [ 76.097079][ T6450] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 76.101062][ T6450] CPU: 3 UID: 0 PID: 6450 Comm: syz.1.161 Tainted: G L syzkaller #0 PREEMPT(full) [ 76.101081][ T6450] Tainted: [L]=SOFTLOCKUP [ 76.101084][ T6450] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.101091][ T6450] Call Trace: [ 76.101096][ T6450] [ 76.101100][ T6450] dump_stack_lvl+0x100/0x190 [ 76.101119][ T6450] should_fail_ex.cold+0x5/0xa [ 76.101133][ T6450] _copy_to_user+0x32/0xd0 [ 76.101149][ T6450] simple_read_from_buffer+0xcb/0x170 [ 76.101162][ T6450] proc_fail_nth_read+0x1af/0x230 [ 76.101180][ T6450] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 76.101197][ T6450] ? rw_verify_area+0xce/0x6d0 [ 76.101211][ T6450] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 76.101227][ T6450] vfs_read+0x1e4/0xb40 [ 76.101244][ T6450] ? __pfx_vfs_read+0x10/0x10 [ 76.101260][ T6450] ? __fget_files+0x215/0x3d0 [ 76.101274][ T6450] ? __fget_files+0x21f/0x3d0 [ 76.101288][ T6450] ksys_read+0x12a/0x250 [ 76.101304][ T6450] ? __pfx_ksys_read+0x10/0x10 [ 76.101319][ T6450] ? v4l2_ioctl+0x1c5/0x250 [ 76.101367][ T6450] do_syscall_64+0x115/0x870 [ 76.101379][ T6450] ? clear_bhb_loop+0x40/0x90 [ 76.101392][ T6450] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.101403][ T6450] RIP: 0033:0x7fcb8db5e84e [ 76.101413][ T6450] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 76.101426][ T6450] RSP: 002b:00007fcb8ead5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 76.101438][ T6450] RAX: ffffffffffffffda RBX: 00007fcb8ead66c0 RCX: 00007fcb8db5e84e [ 76.101444][ T6450] RDX: 000000000000000f RSI: 00007fcb8ead60a0 RDI: 0000000000000004 [ 76.101450][ T6450] RBP: 00007fcb8ead6090 R08: 0000000000000000 R09: 0000000000000000 [ 76.101456][ T6450] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 76.101461][ T6450] R13: 00007fcb8de26038 R14: 00007fcb8de25fa0 R15: 00007ffd73685488 [ 76.101475][ T6450] [ 76.263136][ T6456] CIFS: Attempting to mount //127.0.0.1/share [ 76.359048][ T6462] usb usb8: usbfs: interface 0 claimed by hub while 'syz.0.166' sets config #8 [ 76.393638][ T6456] CIFS: VFS: cifs_mount failed w/return code = -112 [ 76.483580][ T6470] FAULT_INJECTION: forcing a failure. [ 76.483580][ T6470] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 76.489133][ T6470] CPU: 3 UID: 0 PID: 6470 Comm: syz.3.169 Tainted: G L syzkaller #0 PREEMPT(full) [ 76.489162][ T6470] Tainted: [L]=SOFTLOCKUP [ 76.489168][ T6470] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.489178][ T6470] Call Trace: [ 76.489198][ T6470] [ 76.489206][ T6470] dump_stack_lvl+0x100/0x190 [ 76.489255][ T6470] should_fail_ex.cold+0x5/0xa [ 76.489285][ T6470] _copy_from_user+0x2e/0xd0 [ 76.489314][ T6470] ____sys_sendmsg+0x1d1/0xbe0 [ 76.489378][ T6470] ? __pfx_____sys_sendmsg+0x10/0x10 [ 76.489415][ T6470] ___sys_sendmsg+0x190/0x1e0 [ 76.489441][ T6470] ? __pfx____sys_sendmsg+0x10/0x10 [ 76.489479][ T6470] ? __lock_acquire+0x49f/0x1a40 [ 76.489497][ T6470] ? get_pid_task+0x106/0x250 [ 76.489538][ T6470] __sys_sendmsg+0x160/0x210 [ 76.489561][ T6470] ? __pfx___sys_sendmsg+0x10/0x10 [ 76.489595][ T6470] do_syscall_64+0x115/0x870 [ 76.489651][ T6470] ? clear_bhb_loop+0x40/0x90 [ 76.489672][ T6470] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.489690][ T6470] RIP: 0033:0x7f34d039e019 [ 76.489705][ T6470] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.489720][ T6470] RSP: 002b:00007f34d1236028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 76.489747][ T6470] RAX: ffffffffffffffda RBX: 00007f34d0625fa0 RCX: 00007f34d039e019 [ 76.489758][ T6470] RDX: 0000000000000000 RSI: 0000200000000a00 RDI: 0000000000000003 [ 76.489768][ T6470] RBP: 00007f34d1236090 R08: 0000000000000000 R09: 0000000000000000 [ 76.489778][ T6470] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 76.489787][ T6470] R13: 00007f34d0626038 R14: 00007f34d0625fa0 R15: 00007fff078482a8 [ 76.489810][ T6470] [ 76.550258][ T5104] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 76.576576][ T6481] Bluetooth: MGMT ver 1.23 [ 76.578502][ T6481] Bluetooth: hci0: unsupported parameter 255 [ 76.580974][ T6481] Bluetooth: hci0: unsupported parameter 255 [ 76.609682][ T6483] syzkaller1: entered promiscuous mode [ 76.611346][ T6483] syzkaller1: entered allmulticast mode [ 76.692935][ T6488] tmpfs: Bad value for 'mpol' [ 76.713248][ T5104] usb 6-1: Using ep0 maxpacket: 32 [ 76.716192][ T5104] usb 6-1: config 2 has an invalid interface number: 194 but max is 0 [ 76.719562][ T5104] usb 6-1: config 2 has no interface number 0 [ 76.722079][ T5104] usb 6-1: config 2 interface 194 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 833 [ 76.725171][ T5104] usb 6-1: config 2 interface 194 altsetting 0 endpoint 0xA has invalid maxpacket 1584, setting to 1024 [ 76.728767][ T5104] usb 6-1: config 2 interface 194 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 76.732653][ T5104] usb 6-1: New USB device found, idVendor=0499, idProduct=1025, bcdDevice=9c.f6 [ 76.736226][ T5104] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.745227][ T6455] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 76.747708][ T6455] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 76.830937][ T6490] bond1: entered promiscuous mode [ 76.889013][ T6500] ci_hdrc ci_hdrc.0: error -EINVAL: invalid resource (null) [ 76.892411][ T6500] ci_hdrc ci_hdrc.0: probe with driver ci_hdrc failed with error -22 [ 76.964168][ T6455] netlink: 'syz.1.164': attribute type 21 has an invalid length. [ 76.969494][ T5104] usb 6-1: string descriptor 0 read error: -71 [ 76.978201][ T5104] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 76.991670][ T6504] overlay: filesystem on ./bus not supported [ 77.052307][ T5104] usb 6-1: USB disconnect, device number 2 [ 77.100805][ T6508] FAULT_INJECTION: forcing a failure. [ 77.100805][ T6508] name failslab, interval 1, probability 0, space 0, times 0 [ 77.111535][ T6508] CPU: 1 UID: 0 PID: 6508 Comm: syz.2.184 Tainted: G L syzkaller #0 PREEMPT(full) [ 77.111563][ T6508] Tainted: [L]=SOFTLOCKUP [ 77.111569][ T6508] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.111577][ T6508] Call Trace: [ 77.111582][ T6508] [ 77.111587][ T6508] dump_stack_lvl+0x100/0x190 [ 77.111606][ T6508] should_fail_ex.cold+0x5/0xa [ 77.111620][ T6508] should_failslab+0xc2/0x120 [ 77.111634][ T6508] kmem_cache_alloc_noprof+0x91/0x6a0 [ 77.111647][ T6508] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 77.111663][ T6508] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 77.111680][ T6508] mmu_topup_memory_caches+0x25/0x170 [ 77.111696][ T6508] kvm_mmu_load+0xe2/0x2570 [ 77.111710][ T6508] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 77.111721][ T6508] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 77.111733][ T6508] ? kvm_apic_accept_pic_intr+0xdf/0x1b0 [ 77.111743][ T6508] ? __pfx_kvm_mmu_load+0x10/0x10 [ 77.111757][ T6508] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 77.111770][ T6508] ? kvm_check_and_inject_events+0x873/0x12a0 [ 77.111785][ T6508] ? vmx_load_vmcs01+0x50/0xe0 [ 77.111797][ T6508] vcpu_run+0x3aaa/0x5de0 [ 77.111817][ T6508] ? __pfx_vcpu_run+0x10/0x10 [ 77.111837][ T6508] ? rcu_is_watching+0x12/0xc0 [ 77.111855][ T6508] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 77.111870][ T6508] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 77.111889][ T6508] kvm_vcpu_ioctl+0x730/0x1700 [ 77.111908][ T6508] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 77.111934][ T6508] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 77.111948][ T6508] ? do_vfs_ioctl+0x226/0x13e0 [ 77.111963][ T6508] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 77.111979][ T6508] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 77.112001][ T6508] ? __fget_files+0x215/0x3d0 [ 77.112011][ T6508] ? hook_file_ioctl_common+0x140/0x440 [ 77.112027][ T6508] ? selinux_file_ioctl+0x13b/0x290 [ 77.112042][ T6508] ? selinux_file_ioctl+0xb6/0x290 [ 77.112059][ T6508] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 77.112072][ T6508] __x64_sys_ioctl+0x18e/0x210 [ 77.112088][ T6508] do_syscall_64+0x115/0x870 [ 77.112101][ T6508] ? clear_bhb_loop+0x40/0x90 [ 77.112114][ T6508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.112125][ T6508] RIP: 0033:0x7f45b9b9e019 [ 77.112135][ T6508] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.112145][ T6508] RSP: 002b:00007f45baacf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 77.112157][ T6508] RAX: ffffffffffffffda RBX: 00007f45b9e25fa0 RCX: 00007f45b9b9e019 [ 77.112163][ T6508] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 77.112169][ T6508] RBP: 00007f45baacf090 R08: 0000000000000000 R09: 0000000000000000 [ 77.112175][ T6508] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 77.112181][ T6508] R13: 00007f45b9e26038 R14: 00007f45b9e25fa0 R15: 00007ffc02082c58 [ 77.112195][ T6508] [ 77.555340][ T6522] netlink: 80 bytes leftover after parsing attributes in process `syz.1.190'. [ 77.736325][ T6541] overlayfs: cannot append lower layer [ 77.774697][ T6544] netlink: 'syz.2.196': attribute type 83 has an invalid length. [ 77.967930][ T6529] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 78.007269][ T6572] usb usb8: usbfs: interface 0 claimed by hub while 'syz.3.208' sets config #8 [ 78.172410][ T1360] e1000 0000:00:06.0 eth0: Reset adapter [ 78.207303][ T6597] FAULT_INJECTION: forcing a failure. [ 78.207303][ T6597] name failslab, interval 1, probability 0, space 0, times 0 [ 78.213574][ T6597] CPU: 3 UID: 0 PID: 6597 Comm: syz.0.215 Tainted: G L syzkaller #0 PREEMPT(full) [ 78.213606][ T6597] Tainted: [L]=SOFTLOCKUP [ 78.213610][ T6597] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.213616][ T6597] Call Trace: [ 78.213620][ T6597] [ 78.213625][ T6597] dump_stack_lvl+0x100/0x190 [ 78.213644][ T6597] should_fail_ex.cold+0x5/0xa [ 78.213659][ T6597] should_failslab+0xc2/0x120 [ 78.213674][ T6597] kmem_cache_alloc_noprof+0x91/0x6a0 [ 78.213687][ T6597] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 78.213703][ T6597] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 78.213720][ T6597] mmu_topup_memory_caches+0x25/0x170 [ 78.213736][ T6597] kvm_mmu_load+0xe2/0x2570 [ 78.213751][ T6597] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 78.213761][ T6597] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 78.213774][ T6597] ? kvm_apic_accept_pic_intr+0xdf/0x1b0 [ 78.213784][ T6597] ? __pfx_kvm_mmu_load+0x10/0x10 [ 78.213800][ T6597] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 78.213813][ T6597] ? kvm_check_and_inject_events+0x873/0x12a0 [ 78.213828][ T6597] ? vmx_load_vmcs01+0x50/0xe0 [ 78.213840][ T6597] vcpu_run+0x3aaa/0x5de0 [ 78.213861][ T6597] ? __pfx_vcpu_run+0x10/0x10 [ 78.213881][ T6597] ? rcu_is_watching+0x12/0xc0 [ 78.213899][ T6597] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 78.213914][ T6597] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 78.213934][ T6597] kvm_vcpu_ioctl+0x730/0x1700 [ 78.213947][ T6597] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 78.213959][ T6597] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 78.213972][ T6597] ? do_vfs_ioctl+0x226/0x13e0 [ 78.213988][ T6597] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 78.214003][ T6597] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 78.214025][ T6597] ? __fget_files+0x215/0x3d0 [ 78.214035][ T6597] ? hook_file_ioctl_common+0x140/0x440 [ 78.214051][ T6597] ? selinux_file_ioctl+0x13b/0x290 [ 78.214066][ T6597] ? selinux_file_ioctl+0xb6/0x290 [ 78.214083][ T6597] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 78.214096][ T6597] __x64_sys_ioctl+0x18e/0x210 [ 78.214112][ T6597] do_syscall_64+0x115/0x870 [ 78.214125][ T6597] ? clear_bhb_loop+0x40/0x90 [ 78.214138][ T6597] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.214149][ T6597] RIP: 0033:0x7fcd7839e019 [ 78.214159][ T6597] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.214169][ T6597] RSP: 002b:00007fcd7929f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 78.214180][ T6597] RAX: ffffffffffffffda RBX: 00007fcd78625fa0 RCX: 00007fcd7839e019 [ 78.214187][ T6597] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 78.214193][ T6597] RBP: 00007fcd7929f090 R08: 0000000000000000 R09: 0000000000000000 [ 78.214199][ T6597] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 78.214205][ T6597] R13: 00007fcd78626038 R14: 00007fcd78625fa0 R15: 00007fffb9bb8ef8 [ 78.214218][ T6597] [ 78.663179][ T5820] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX [ 80.392132][ T50] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 81.312183][ T6574] e1000e 0000:00:02.0 eth1: Hardware Error [ 81.449057][ T24] cfg80211: failed to load regulatory.db [ 81.626834][ T1360] e1000 0000:00:06.0 eth0: Reset adapter [ 81.657503][ T42] kauditd_printk_skb: 44 callbacks suppressed [ 81.657516][ T42] audit: type=1400 audit(1785494005.130:464): avc: denied { write } for pid=6625 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.714262][ T42] audit: type=1400 audit(1785494005.190:465): avc: denied { write } for pid=6629 comm="syz.1.225" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 81.721862][ T42] audit: type=1400 audit(1785494005.190:466): avc: denied { write } for pid=6632 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.810273][ T42] audit: type=1400 audit(1785494005.280:467): avc: denied { write } for pid=6634 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.875144][ T42] audit: type=1400 audit(1785494005.350:468): avc: denied { write } for pid=6637 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.951487][ T42] audit: type=1400 audit(1785494005.420:469): avc: denied { write } for pid=6639 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.024787][ T42] audit: type=1400 audit(1785494005.500:470): avc: denied { write } for pid=6642 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.124793][ T42] audit: type=1400 audit(1785494005.600:471): avc: denied { write } for pid=6644 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.183235][ T42] audit: type=1400 audit(1785494005.660:472): avc: denied { write } for pid=6647 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.262143][ T42] audit: type=1400 audit(1785494005.730:473): avc: denied { write } for pid=6649 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.763277][ T1360] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX [ 87.069975][ T42] kauditd_printk_skb: 1 callbacks suppressed [ 87.069990][ T42] audit: type=1400 audit(1785494010.540:475): avc: denied { write } for pid=6658 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.111839][ T42] audit: type=1400 audit(1785494010.580:476): avc: denied { write } for pid=6661 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.854271][ T42] audit: type=1400 audit(1785494013.330:477): avc: denied { write } for pid=6666 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.928897][ T42] audit: type=1400 audit(1785494013.400:478): avc: denied { write } for pid=6677 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.135162][ T42] audit: type=1400 audit(1785494013.610:479): avc: denied { bind } for pid=6693 comm="syz.1.233" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 90.147400][ T42] audit: type=1400 audit(1785494013.610:480): avc: denied { name_bind } for pid=6693 comm="syz.1.233" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 90.156860][ T42] audit: type=1400 audit(1785494013.610:481): avc: denied { node_bind } for pid=6693 comm="syz.1.233" saddr=224.0.0.2 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 90.171289][ T6672] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 90.187181][ T42] audit: type=1400 audit(1785494013.660:482): avc: denied { write } for pid=6671 comm="syz.2.228" name="c.1" dev="configfs" ino=7966 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 90.195708][ T42] audit: type=1400 audit(1785494013.660:483): avc: denied { write } for pid=6671 comm="syz.2.228" name="c.1" dev="configfs" ino=7966 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 90.204611][ T42] audit: type=1400 audit(1785494013.660:484): avc: denied { write } for pid=6671 comm="syz.2.228" name="c.1" dev="configfs" ino=7966 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 90.269782][ T6703] netlink: 24 bytes leftover after parsing attributes in process `syz.2.236'. [ 90.447772][ T6710] netlink: 'syz.1.239': attribute type 1 has an invalid length. [ 90.495661][ T6710] 8021q: adding VLAN 0 to HW filter on device bond1 [ 90.819131][ T6727] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1124 sclass=netlink_route_socket pid=6727 comm=syz.0.245 [ 90.863107][ T6734] netlink: 'syz.3.248': attribute type 32 has an invalid length. [ 90.914379][ T6741] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 91.265363][ T6754] netlink: 4 bytes leftover after parsing attributes in process `syz.3.254'. [ 91.304820][ T6759] netlink: 'syz.3.255': attribute type 1 has an invalid length. [ 91.331497][ T6759] 8021q: adding VLAN 0 to HW filter on device bond1 [ 91.476104][ T6767] syzkaller1: entered promiscuous mode [ 91.479092][ T6767] syzkaller1: entered allmulticast mode [ 91.575190][ T6769] Bluetooth: hci4: Frame reassembly failed (-84) [ 91.585597][ T6769] Bluetooth: received HCILL_WAKE_UP_IND in state 2 [ 91.646720][ T6778] netlink: 4 bytes leftover after parsing attributes in process `syz.3.262'. [ 91.794325][ T6783] ieee802154 phy0 wpan0: encryption failed: -22 [ 92.025368][ T6791] netlink: 'syz.3.267': attribute type 1 has an invalid length. [ 92.048597][ T6791] 8021q: adding VLAN 0 to HW filter on device bond2 [ 92.251495][ T42] kauditd_printk_skb: 14 callbacks suppressed [ 92.251534][ T42] audit: type=1400 audit(1785494015.720:499): avc: denied { getopt } for pid=6796 comm="syz.3.269" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 92.431327][ T6811] netlink: 'syz.3.272': attribute type 4 has an invalid length. [ 92.434514][ T6811] netlink: 152 bytes leftover after parsing attributes in process `syz.3.272'. [ 92.444679][ T6811] .`: renamed from bond0 (while UP) [ 92.450519][ T6813] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 92.457425][ T6813] faux_driver vgem: [drm] Unknown color mode 135165; guessing buffer size. [ 92.463078][ T42] audit: type=1400 audit(1785494015.940:500): avc: denied { map } for pid=6812 comm="syz.0.274" path="/dev/dri/card0" dev="devtmpfs" ino=635 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 92.473784][ T42] audit: type=1400 audit(1785494015.940:501): avc: denied { execute } for pid=6812 comm="syz.0.274" path="/dev/dri/card0" dev="devtmpfs" ino=635 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 92.785182][ T6824] netlink: 'syz.3.278': attribute type 4 has an invalid length. [ 92.807417][ T42] audit: type=1400 audit(1785494016.280:502): avc: denied { unlink } for pid=6821 comm="syz.3.278" name="#1" dev="tmpfs" ino=538 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 92.816130][ T42] audit: type=1400 audit(1785494016.280:503): avc: denied { mount } for pid=6821 comm="syz.3.278" name="/" dev="overlay" ino=533 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 93.078053][ T42] audit: type=1400 audit(1785494016.550:504): avc: denied { write } for pid=6830 comm="syz.3.281" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 93.103933][ T6833] NILFS (loop0): device size too small [ 93.106123][ T42] audit: type=1400 audit(1785494016.580:505): avc: denied { ioctl } for pid=6830 comm="syz.3.281" path="socket:[17556]" dev="sockfs" ino=17556 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 93.111522][ T5844] IPVS: starting estimator thread 0... [ 93.164200][ T6833] netlink: 8 bytes leftover after parsing attributes in process `syz.0.282'. [ 93.212382][ T6834] IPVS: using max 45 ests per chain, 108000 per kthread [ 93.402356][ T5104] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 93.499639][ T42] audit: type=1400 audit(1785494016.970:506): avc: denied { write } for pid=6845 comm="syz.3.286" name="c.1" dev="configfs" ino=7966 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 93.504264][ T6846] UDC core: g1: couldn't find an available UDC or it's busy [ 93.510351][ T42] audit: type=1400 audit(1785494016.970:507): avc: denied { write } for pid=6845 comm="syz.3.286" name="c.1" dev="configfs" ino=7966 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 93.553233][ T5104] usb 5-1: not running at top speed; connect to a high speed hub [ 93.557678][ T5104] usb 5-1: config 1 interface 0 altsetting 19 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 93.563487][ T5104] usb 5-1: config 1 interface 0 has no altsetting 0 [ 93.568238][ T42] audit: type=1400 audit(1785494017.040:508): avc: denied { write } for pid=6845 comm="syz.3.286" name="c.1" dev="configfs" ino=7966 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 93.578905][ T5104] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 93.582808][ T5104] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.586039][ T5104] usb 5-1: Product: syz [ 93.587794][ T5104] usb 5-1: Manufacturer: syz [ 93.589783][ T5104] usb 5-1: SerialNumber: syz [ 93.595271][ T6848] IPv6: NLM_F_CREATE should be specified when creating new route [ 93.601732][ T6848] IPv6: Can't replace route, no match found [ 93.605409][ T64] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 93.683484][ T6853] FAULT_INJECTION: forcing a failure. [ 93.683484][ T6853] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 93.688321][ T6853] CPU: 0 UID: 0 PID: 6853 Comm: syz.1.289 Tainted: G L syzkaller #0 PREEMPT(full) [ 93.688352][ T6853] Tainted: [L]=SOFTLOCKUP [ 93.688359][ T6853] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.688369][ T6853] Call Trace: [ 93.688376][ T6853] [ 93.688384][ T6853] dump_stack_lvl+0x100/0x190 [ 93.688431][ T6853] should_fail_ex.cold+0x5/0xa [ 93.688455][ T6853] _copy_from_iter+0x1f4/0x1690 [ 93.688488][ T6853] ? __pfx__copy_from_iter+0x10/0x10 [ 93.688510][ T6853] ? sock_has_perm+0x25a/0x2f0 [ 93.688532][ T6853] ? __pfx_sock_has_perm+0x10/0x10 [ 93.688560][ T6853] hci_sock_sendmsg+0x4a1/0x2620 [ 93.688627][ T6853] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 93.688647][ T6853] ? selinux_socket_sendmsg+0x198/0x2f0 [ 93.688675][ T6853] sock_write_iter+0x53a/0x5b0 [ 93.688735][ T6853] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 93.688756][ T6853] ? __pfx_sock_write_iter+0x10/0x10 [ 93.688786][ T6853] ? bpf_lsm_file_permission+0x9/0x10 [ 93.688811][ T6853] ? security_file_permission+0x76/0x210 [ 93.688829][ T6853] ? rw_verify_area+0xce/0x6d0 [ 93.688855][ T6853] vfs_write+0x6ac/0x1050 [ 93.688880][ T6853] ? __pfx_sock_write_iter+0x10/0x10 [ 93.688907][ T6853] ? __pfx_vfs_write+0x10/0x10 [ 93.688930][ T6853] ? find_held_lock+0x2b/0x80 [ 93.688961][ T6853] ksys_write+0x1f8/0x250 [ 93.688986][ T6853] ? __pfx_ksys_write+0x10/0x10 [ 93.689017][ T6853] do_syscall_64+0x115/0x870 [ 93.689052][ T6853] ? clear_bhb_loop+0x40/0x90 [ 93.689074][ T6853] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.689092][ T6853] RIP: 0033:0x7fcb8db9e019 [ 93.689107][ T6853] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.689124][ T6853] RSP: 002b:00007fcb8ead6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 93.689152][ T6853] RAX: ffffffffffffffda RBX: 00007fcb8de25fa0 RCX: 00007fcb8db9e019 [ 93.689163][ T6853] RDX: 0000000000000007 RSI: 0000200000000000 RDI: 0000000000000004 [ 93.689173][ T6853] RBP: 00007fcb8ead6090 R08: 0000000000000000 R09: 0000000000000000 [ 93.689182][ T6853] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 93.689193][ T6853] R13: 00007fcb8de26038 R14: 00007fcb8de25fa0 R15: 00007ffd73685488 [ 93.689215][ T6853] [ 93.816530][ T5104] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -22 [ 93.847467][ T5104] usb 5-1: USB disconnect, device number 2 [ 94.081866][ T6879] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 94.524569][ T6890] netlink: 'syz.0.303': attribute type 1 has an invalid length. [ 94.551353][ T6890] 8021q: adding VLAN 0 to HW filter on device bond1 [ 94.625907][ T6893] xt_TCPMSS: Only works on TCP SYN packets [ 94.947966][ T6917] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 94.979843][ T6917] netlink: 64 bytes leftover after parsing attributes in process `syz.1.314'. [ 94.985864][ T6919] netlink: 36 bytes leftover after parsing attributes in process `syz.0.315'. [ 95.200898][ T6947] FAULT_INJECTION: forcing a failure. [ 95.200898][ T6947] name failslab, interval 1, probability 0, space 0, times 0 [ 95.207760][ T6947] CPU: 3 UID: 0 PID: 6947 Comm: syz.3.321 Tainted: G L syzkaller #0 PREEMPT(full) [ 95.207791][ T6947] Tainted: [L]=SOFTLOCKUP [ 95.207797][ T6947] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.207807][ T6947] Call Trace: [ 95.207813][ T6947] [ 95.207820][ T6947] dump_stack_lvl+0x100/0x190 [ 95.207847][ T6947] should_fail_ex.cold+0x5/0xa [ 95.207869][ T6947] should_failslab+0xc2/0x120 [ 95.207893][ T6947] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 95.207915][ T6947] ? __alloc_skb+0x140/0x710 [ 95.207940][ T6947] __alloc_skb+0x140/0x710 [ 95.207957][ T6947] ? __alloc_skb+0x5b7/0x710 [ 95.207975][ T6947] ? __pfx___alloc_skb+0x10/0x10 [ 95.207992][ T6947] ? __lock_acquire+0x49f/0x1a40 [ 95.208018][ T6947] mgmt_cmd_complete+0x4f/0x5a0 [ 95.208042][ T6947] start_discovery_internal+0x70b/0x830 [ 95.208083][ T6947] ? __pfx_start_discovery_internal+0x10/0x10 [ 95.208103][ T6947] ? do_raw_read_unlock+0x3f/0x70 [ 95.208125][ T6947] ? _raw_read_unlock+0x28/0x50 [ 95.208144][ T6947] ? __pfx_mgmt_init_hdev+0x10/0x10 [ 95.208166][ T6947] hci_sock_sendmsg+0x154e/0x2620 [ 95.208191][ T6947] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 95.208210][ T6947] ? selinux_socket_sendmsg+0x198/0x2f0 [ 95.208239][ T6947] sock_write_iter+0x53a/0x5b0 [ 95.208263][ T6947] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 95.208281][ T6947] ? __pfx_sock_write_iter+0x10/0x10 [ 95.208312][ T6947] ? bpf_lsm_file_permission+0x9/0x10 [ 95.208335][ T6947] ? security_file_permission+0x76/0x210 [ 95.208353][ T6947] ? rw_verify_area+0xce/0x6d0 [ 95.208377][ T6947] vfs_write+0x6ac/0x1050 [ 95.208401][ T6947] ? __pfx_sock_write_iter+0x10/0x10 [ 95.208426][ T6947] ? __pfx_vfs_write+0x10/0x10 [ 95.208448][ T6947] ? find_held_lock+0x2b/0x80 [ 95.208477][ T6947] ksys_write+0x1f8/0x250 [ 95.208501][ T6947] ? __pfx_ksys_write+0x10/0x10 [ 95.208532][ T6947] do_syscall_64+0x115/0x870 [ 95.208550][ T6947] ? clear_bhb_loop+0x40/0x90 [ 95.208570][ T6947] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.208587][ T6947] RIP: 0033:0x7f34d039e019 [ 95.208601][ T6947] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.208615][ T6947] RSP: 002b:00007f34d1236028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.208631][ T6947] RAX: ffffffffffffffda RBX: 00007f34d0625fa0 RCX: 00007f34d039e019 [ 95.208642][ T6947] RDX: 0000000000000007 RSI: 0000200000000000 RDI: 0000000000000004 [ 95.208651][ T6947] RBP: 00007f34d1236090 R08: 0000000000000000 R09: 0000000000000000 [ 95.208661][ T6947] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 95.208670][ T6947] R13: 00007f34d0626038 R14: 00007f34d0625fa0 R15: 00007fff078482a8 [ 95.208693][ T6947] [ 95.666858][ T5104] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 95.765096][ T6983] vlan2: entered promiscuous mode [ 95.776324][ T6983] bridge0: entered promiscuous mode [ 95.778846][ T6983] vlan2: entered allmulticast mode [ 95.780960][ T6983] bridge0: entered allmulticast mode [ 95.832209][ T5104] usb 8-1: Using ep0 maxpacket: 8 [ 95.835346][ T5104] usb 8-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 95.838911][ T5104] usb 8-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 95.842079][ T5104] usb 8-1: config 0 interface 0 has no altsetting 0 [ 95.844148][ T5104] usb 8-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 95.846832][ T5104] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.854863][ T5104] usb 8-1: config 0 descriptor?? [ 95.893729][ T6991] netlink: 44 bytes leftover after parsing attributes in process `syz.1.332'. [ 95.897280][ T6991] netlink: 5 bytes leftover after parsing attributes in process `syz.1.332'. [ 95.948488][ T6999] x_tables: ip6_tables: sctp match: only valid for protocol 132 [ 95.984059][ T7003] affs: No valid root block on device nullb0 [ 96.019197][ T7003] befs: (loop0): No write support. Marking filesystem read-only [ 96.025729][ T7003] befs: (loop0): unable to read superblock [ 96.301135][ T5104] mcp2221 0003:04D8:00DD.0004: unknown main item tag 0x0 [ 96.307925][ T5104] mcp2221 0003:04D8:00DD.0004: unknown main item tag 0x0 [ 96.314450][ T7022] FAULT_INJECTION: forcing a failure. [ 96.314450][ T7022] name failslab, interval 1, probability 0, space 0, times 0 [ 96.318016][ T5104] mcp2221 0003:04D8:00DD.0004: unknown main item tag 0x0 [ 96.318602][ T7022] CPU: 3 UID: 0 PID: 7022 Comm: syz.1.342 Tainted: G L syzkaller #0 PREEMPT(full) [ 96.318620][ T7022] Tainted: [L]=SOFTLOCKUP [ 96.318624][ T7022] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.318631][ T7022] Call Trace: [ 96.318636][ T7022] [ 96.318641][ T7022] dump_stack_lvl+0x100/0x190 [ 96.318676][ T7022] should_fail_ex.cold+0x5/0xa [ 96.318690][ T7022] should_failslab+0xc2/0x120 [ 96.318705][ T7022] kmem_cache_alloc_noprof+0x91/0x6a0 [ 96.318719][ T7022] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 96.318735][ T7022] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 96.318751][ T7022] mmu_topup_memory_caches+0x25/0x170 [ 96.318768][ T7022] kvm_mmu_load+0xe2/0x2570 [ 96.318783][ T7022] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 96.318795][ T7022] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 96.318807][ T7022] ? __pfx_kvm_mmu_load+0x10/0x10 [ 96.318821][ T7022] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 96.318834][ T7022] ? kvm_check_and_inject_events+0x873/0x12a0 [ 96.318849][ T7022] ? record_steal_time+0x3a0/0xbb0 [ 96.318862][ T7022] vcpu_run+0x3aaa/0x5de0 [ 96.318887][ T7022] ? __pfx_vcpu_run+0x10/0x10 [ 96.318907][ T7022] ? rcu_is_watching+0x12/0xc0 [ 96.318925][ T7022] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 96.318941][ T7022] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 96.318961][ T7022] kvm_vcpu_ioctl+0x730/0x1700 [ 96.318974][ T7022] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 96.318986][ T7022] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 96.319006][ T7022] ? do_vfs_ioctl+0x226/0x13e0 [ 96.319025][ T7022] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 96.319041][ T7022] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 96.319063][ T7022] ? __fget_files+0x215/0x3d0 [ 96.319073][ T7022] ? hook_file_ioctl_common+0x140/0x440 [ 96.319089][ T7022] ? selinux_file_ioctl+0x13b/0x290 [ 96.319111][ T7022] ? selinux_file_ioctl+0xb6/0x290 [ 96.319134][ T7022] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 96.319146][ T7022] __x64_sys_ioctl+0x18e/0x210 [ 96.319163][ T7022] do_syscall_64+0x115/0x870 [ 96.319222][ T7022] ? clear_bhb_loop+0x40/0x90 [ 96.319235][ T7022] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.319247][ T7022] RIP: 0033:0x7fcb8db9e019 [ 96.319257][ T7022] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.319268][ T7022] RSP: 002b:00007fcb8ead6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 96.319293][ T7022] RAX: ffffffffffffffda RBX: 00007fcb8de25fa0 RCX: 00007fcb8db9e019 [ 96.319303][ T7022] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 96.319313][ T7022] RBP: 00007fcb8ead6090 R08: 0000000000000000 R09: 0000000000000000 [ 96.319322][ T7022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 96.319329][ T7022] R13: 00007fcb8de26038 R14: 00007fcb8de25fa0 R15: 00007ffd73685488 [ 96.319343][ T7022] [ 96.428051][ T5104] mcp2221 0003:04D8:00DD.0004: unknown main item tag 0x0 [ 96.430302][ T5104] mcp2221 0003:04D8:00DD.0004: unknown main item tag 0x0 [ 96.433318][ T5104] mcp2221 0003:04D8:00DD.0004: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 96.530044][ T5104] usb 8-1: USB disconnect, device number 3 [ 96.722907][ T5813] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 96.862471][ T7046] ubi16: attaching mtd0 [ 96.866786][ T7046] ubi16: scanning is finished [ 96.868414][ T7046] ubi16: empty MTD device detected [ 96.892905][ T5813] usb 5-1: Using ep0 maxpacket: 8 [ 96.896250][ T5813] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 96.898706][ T5813] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 96.902121][ T5813] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 96.905545][ T5813] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 96.909233][ T5813] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 96.912621][ T5813] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 96.915644][ T7047] syzkaller0: entered promiscuous mode [ 96.916078][ T5813] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 96.918085][ T7047] syzkaller0: entered allmulticast mode [ 96.922087][ T5813] usb 5-1: config 168 interface 0 has no altsetting 0 [ 96.922993][ T5813] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 96.928819][ T5813] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 96.934480][ T5813] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 96.938150][ T5813] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 96.942370][ T5813] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 96.946730][ T5813] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 96.951175][ T5813] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 96.956350][ T5813] usb 5-1: config 168 interface 0 has no altsetting 0 [ 96.959788][ T5813] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 96.962072][ T5813] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 96.965736][ T5813] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 96.970140][ T5813] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 96.974795][ T5813] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 96.979217][ T5813] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 96.984068][ T5813] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 96.989544][ T5813] usb 5-1: config 168 interface 0 has no altsetting 0 [ 96.995925][ T5813] usb 5-1: string descriptor 0 read error: -22 [ 96.998754][ T5813] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 97.002574][ T5813] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.031263][ T5813] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 97.059803][ T7051] netlink: 8 bytes leftover after parsing attributes in process `syz.3.352'. [ 97.063429][ T7051] netlink: 24 bytes leftover after parsing attributes in process `syz.3.352'. [ 97.066352][ T7051] program syz.3.352 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 97.119828][ T7046] ubi16: attached mtd0 (name "mtdram test device", size 0 MiB) [ 97.123051][ T7046] ubi16: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 97.126626][ T7046] ubi16: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 97.131734][ T7046] ubi16: VID header offset: 64 (aligned 64), data offset: 128 [ 97.139782][ T7046] ubi16: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 97.143846][ T7046] ubi16: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 97.146809][ T7046] ubi16: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 1555678932 [ 97.150293][ T7056] FAULT_INJECTION: forcing a failure. [ 97.150293][ T7056] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 97.150373][ T7046] ubi16: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 97.160794][ T7054] ubi16: background thread "ubi_bgt16d" started, PID 7054 [ 97.174291][ T7056] CPU: 1 UID: 0 PID: 7056 Comm: syz.3.354 Tainted: G L syzkaller #0 PREEMPT(full) [ 97.174322][ T7056] Tainted: [L]=SOFTLOCKUP [ 97.174329][ T7056] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.174340][ T7056] Call Trace: [ 97.174347][ T7056] [ 97.174353][ T7056] dump_stack_lvl+0x100/0x190 [ 97.174383][ T7056] should_fail_ex.cold+0x5/0xa [ 97.174406][ T7056] _copy_from_user+0x2e/0xd0 [ 97.174432][ T7056] copy_from_sockptr_offset.constprop.0+0x12c/0x150 [ 97.174492][ T7056] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 97.174552][ T7056] do_sock_getsockopt+0x530/0x6e0 [ 97.174580][ T7056] ? __lock_acquire+0x49f/0x1a40 [ 97.174605][ T7056] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 97.174631][ T7056] ? rcu_read_lock_any_held+0x6a/0xa0 [ 97.174655][ T7056] ? find_held_lock+0x2b/0x80 [ 97.174678][ T7056] ? __fget_files+0x21f/0x3d0 [ 97.174703][ T7056] __sys_getsockopt+0x148/0x260 [ 97.174732][ T7056] ? __x64_sys_getsockopt+0xbd/0x160 [ 97.174752][ T7056] __x64_sys_getsockopt+0xbd/0x160 [ 97.174771][ T7056] ? do_syscall_64+0x90/0x870 [ 97.174792][ T7056] ? lockdep_hardirqs_on+0x78/0x100 [ 97.174810][ T7056] do_syscall_64+0x115/0x870 [ 97.174828][ T7056] ? clear_bhb_loop+0x40/0x90 [ 97.174849][ T7056] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.174881][ T7056] RIP: 0033:0x7f34d039e019 [ 97.174897][ T7056] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.174914][ T7056] RSP: 002b:00007f34d1236028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 97.174932][ T7056] RAX: ffffffffffffffda RBX: 00007f34d0625fa0 RCX: 00007f34d039e019 [ 97.174943][ T7056] RDX: 0000000000002714 RSI: 0000200000000114 RDI: 0000000000000003 [ 97.174954][ T7056] RBP: 00007f34d1236090 R08: 0000200000000000 R09: 0000000000000000 [ 97.174964][ T7056] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 97.174974][ T7056] R13: 00007f34d0626038 R14: 00007f34d0625fa0 R15: 00007fff078482a8 [ 97.174997][ T7056] [ 97.267571][ T5884] usb 5-1: USB disconnect, device number 3 [ 97.413914][ T7064] FAULT_INJECTION: forcing a failure. [ 97.413914][ T7064] name failslab, interval 1, probability 0, space 0, times 0 [ 97.418709][ T7064] CPU: 1 UID: 0 PID: 7064 Comm: syz.1.357 Tainted: G L syzkaller #0 PREEMPT(full) [ 97.418728][ T7064] Tainted: [L]=SOFTLOCKUP [ 97.418732][ T7064] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.418739][ T7064] Call Trace: [ 97.418743][ T7064] [ 97.418748][ T7064] dump_stack_lvl+0x100/0x190 [ 97.418767][ T7064] should_fail_ex.cold+0x5/0xa [ 97.418781][ T7064] should_failslab+0xc2/0x120 [ 97.418796][ T7064] kmem_cache_alloc_noprof+0x91/0x6a0 [ 97.418810][ T7064] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 97.418825][ T7064] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 97.418842][ T7064] mmu_topup_memory_caches+0x25/0x170 [ 97.418858][ T7064] kvm_mmu_load+0xe2/0x2570 [ 97.418873][ T7064] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 97.418884][ T7064] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 97.418897][ T7064] ? __pfx_kvm_mmu_load+0x10/0x10 [ 97.418910][ T7064] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 97.418923][ T7064] ? kvm_check_and_inject_events+0x873/0x12a0 [ 97.418939][ T7064] ? record_steal_time+0x3a0/0xbb0 [ 97.418951][ T7064] vcpu_run+0x3aaa/0x5de0 [ 97.418972][ T7064] ? __pfx_vcpu_run+0x10/0x10 [ 97.418992][ T7064] ? rcu_is_watching+0x12/0xc0 [ 97.419010][ T7064] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 97.419025][ T7064] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 97.419044][ T7064] kvm_vcpu_ioctl+0x730/0x1700 [ 97.419058][ T7064] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 97.419070][ T7064] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 97.419084][ T7064] ? do_vfs_ioctl+0x226/0x13e0 [ 97.419099][ T7064] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 97.419115][ T7064] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 97.419137][ T7064] ? __fget_files+0x215/0x3d0 [ 97.419147][ T7064] ? hook_file_ioctl_common+0x140/0x440 [ 97.419163][ T7064] ? selinux_file_ioctl+0x13b/0x290 [ 97.419179][ T7064] ? selinux_file_ioctl+0xb6/0x290 [ 97.419195][ T7064] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 97.419208][ T7064] __x64_sys_ioctl+0x18e/0x210 [ 97.419224][ T7064] do_syscall_64+0x115/0x870 [ 97.419240][ T7064] ? clear_bhb_loop+0x40/0x90 [ 97.419258][ T7064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.419273][ T7064] RIP: 0033:0x7fcb8db9e019 [ 97.419286][ T7064] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.419302][ T7064] RSP: 002b:00007fcb8ead6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 97.419314][ T7064] RAX: ffffffffffffffda RBX: 00007fcb8de25fa0 RCX: 00007fcb8db9e019 [ 97.419321][ T7064] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 97.419327][ T7064] RBP: 00007fcb8ead6090 R08: 0000000000000000 R09: 0000000000000000 [ 97.419333][ T7064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 97.419339][ T7064] R13: 00007fcb8de26038 R14: 00007fcb8de25fa0 R15: 00007ffd73685488 [ 97.419358][ T7064] [ 97.540971][ T7062] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 97.732836][ T7068] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 98.178092][ T42] kauditd_printk_skb: 44 callbacks suppressed [ 98.178106][ T42] audit: type=1400 audit(1785494021.650:553): avc: denied { create } for pid=7069 comm="syz.0.359" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 98.298230][ T42] audit: type=1400 audit(1785494021.770:554): avc: denied { create } for pid=7073 comm="syz.3.361" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 98.398883][ T7083] syz.3.361 (7083): /proc/7073/oom_adj is deprecated, please use /proc/7073/oom_score_adj instead. [ 98.408793][ T42] audit: type=1400 audit(1785494021.880:555): avc: denied { create } for pid=7082 comm="syz.0.365" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 98.540017][ T7086] FAULT_INJECTION: forcing a failure. [ 98.540017][ T7086] name failslab, interval 1, probability 0, space 0, times 0 [ 98.547295][ T7086] CPU: 0 UID: 0 PID: 7086 Comm: syz.3.366 Tainted: G L syzkaller #0 PREEMPT(full) [ 98.547324][ T7086] Tainted: [L]=SOFTLOCKUP [ 98.547331][ T7086] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.547342][ T7086] Call Trace: [ 98.547359][ T7086] [ 98.547367][ T7086] dump_stack_lvl+0x100/0x190 [ 98.547395][ T7086] should_fail_ex.cold+0x5/0xa [ 98.547418][ T7086] should_failslab+0xc2/0x120 [ 98.547440][ T7086] kmem_cache_alloc_noprof+0x91/0x6a0 [ 98.547463][ T7086] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 98.547490][ T7086] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 98.547517][ T7086] mmu_topup_memory_caches+0x25/0x170 [ 98.547542][ T7086] kvm_mmu_load+0xe2/0x2570 [ 98.547566][ T7086] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 98.547585][ T7086] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 98.547607][ T7086] ? __pfx_kvm_mmu_load+0x10/0x10 [ 98.547629][ T7086] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 98.547651][ T7086] ? kvm_check_and_inject_events+0x873/0x12a0 [ 98.547674][ T7086] ? record_steal_time+0x3a0/0xbb0 [ 98.547696][ T7086] vcpu_run+0x3aaa/0x5de0 [ 98.547735][ T7086] ? __pfx_vcpu_run+0x10/0x10 [ 98.547768][ T7086] ? rcu_is_watching+0x12/0xc0 [ 98.547794][ T7086] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 98.547818][ T7086] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 98.547850][ T7086] kvm_vcpu_ioctl+0x730/0x1700 [ 98.547872][ T7086] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 98.547892][ T7086] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 98.547912][ T7086] ? do_vfs_ioctl+0x226/0x13e0 [ 98.547938][ T7086] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 98.547962][ T7086] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 98.547996][ T7086] ? __fget_files+0x215/0x3d0 [ 98.548016][ T7086] ? hook_file_ioctl_common+0x140/0x440 [ 98.548040][ T7086] ? selinux_file_ioctl+0x13b/0x290 [ 98.548063][ T7086] ? selinux_file_ioctl+0xb6/0x290 [ 98.548089][ T7086] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 98.548109][ T7086] __x64_sys_ioctl+0x18e/0x210 [ 98.548135][ T7086] do_syscall_64+0x115/0x870 [ 98.548155][ T7086] ? clear_bhb_loop+0x40/0x90 [ 98.548174][ T7086] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.548191][ T7086] RIP: 0033:0x7f34d039e019 [ 98.548206][ T7086] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.548222][ T7086] RSP: 002b:00007f34d1236028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 98.548249][ T7086] RAX: ffffffffffffffda RBX: 00007f34d0625fa0 RCX: 00007f34d039e019 [ 98.548280][ T7086] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 98.548289][ T7086] RBP: 00007f34d1236090 R08: 0000000000000000 R09: 0000000000000000 [ 98.548298][ T7086] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 98.548308][ T7086] R13: 00007f34d0626038 R14: 00007f34d0625fa0 R15: 00007fff078482a8 [ 98.548333][ T7086] [ 98.732977][ T7097] netlink: 'syz.1.370': attribute type 1 has an invalid length. [ 98.750710][ T7097] bond2: entered allmulticast mode [ 98.752556][ T7089] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 98.759966][ T7099] bond2: (slave vti0): The slave device specified does not support setting the MAC address [ 98.763656][ T7099] bond2: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 98.785352][ T7099] bond2: (slave vti0): making interface the new active one [ 98.788174][ T7099] vti0: entered allmulticast mode [ 98.818164][ T7099] vti0: left allmulticast mode [ 98.843375][ T7101] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 99.142704][ T42] audit: type=1400 audit(1785494022.620:556): avc: denied { create } for pid=7109 comm="syz.0.375" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 99.148993][ T42] audit: type=1400 audit(1785494022.620:557): avc: denied { read } for pid=7109 comm="syz.0.375" path="socket:[18270]" dev="sockfs" ino=18270 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 99.191478][ T42] audit: type=1400 audit(1785494022.660:558): avc: denied { read } for pid=7111 comm="syz.0.376" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 99.264150][ T7113] binder: 7111:7113 ioctl c020662a 200000002700 returned -22 [ 99.400367][ T7116] 9pnet_fd: p9_fd_create_tcp (7116): problem binding to privport [ 99.477562][ T7122] e1000e 0000:00:02.0 eth1: removed PHC [ 99.522668][ T42] audit: type=1400 audit(1785494022.990:559): avc: denied { write } for pid=7123 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 99.587037][ T42] audit: type=1400 audit(1785494023.060:560): avc: denied { write } for pid=7127 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 99.659150][ T7130] netlink: 8 bytes leftover after parsing attributes in process `syz.3.379'. [ 100.221434][ T7132] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 100.344199][ T42] audit: type=1400 audit(1785494023.820:561): avc: denied { sqpoll } for pid=7134 comm="syz.0.381" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 100.369184][ T7135] netlink: 72 bytes leftover after parsing attributes in process `syz.0.381'. [ 100.426786][ T7137] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 100.433306][ T7137] netlink: 'syz.0.381': attribute type 10 has an invalid length. [ 102.680421][ T7122] e1000e 0000:00:02.0 eth1: Hardware Error [ 105.768239][ T42] audit: type=1400 audit(1785494029.240:562): avc: denied { execute } for pid=7139 comm="syz-executor" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 105.775680][ T42] audit: type=1400 audit(1785494029.240:563): avc: denied { execute_no_trans } for pid=7139 comm="syz-executor" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 105.822889][ T42] audit: type=1400 audit(1785494029.300:564): avc: denied { read write } for pid=7140 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 105.831259][ T42] audit: type=1400 audit(1785494029.300:565): avc: denied { open } for pid=7140 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 105.835968][ T5746] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 105.846406][ T5746] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 105.850670][ T5746] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 105.854760][ T5746] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 105.858406][ T5746] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 105.950764][ T7122] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 105.984799][ T7137] syz_tun: entered promiscuous mode [ 105.989655][ T7137] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 106.004992][ T42] audit: type=1400 audit(1785494029.470:566): avc: denied { write } for pid=7146 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.012366][ T7150] netlink: 'syz.1.383': attribute type 1 has an invalid length. [ 106.047736][ T42] audit: type=1400 audit(1785494029.520:567): avc: denied { write } for pid=7153 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.065433][ T7150] 8021q: adding VLAN 0 to HW filter on device bond3 [ 106.137625][ T42] audit: type=1400 audit(1785494029.610:568): avc: denied { write } for pid=7163 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.152434][ T7125] vp-vdpa 0000:00:02.0: Failed to probe modern PCI device [ 106.185969][ T42] audit: type=1400 audit(1785494029.660:569): avc: denied { read write } for pid=7161 comm="syz.0.385" name="file0" dev="fuse" ino=67 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 106.199915][ T42] audit: type=1400 audit(1785494029.660:570): avc: denied { open } for pid=7161 comm="syz.0.385" path="/94/file0/file0" dev="fuse" ino=67 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 106.210776][ T42] audit: type=1400 audit(1785494029.670:571): avc: denied { ioctl } for pid=7161 comm="syz.0.385" path="/94/file0/file0" dev="fuse" ino=67 ioctlcmd=0x5459 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 106.259578][ T5811] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.309066][ T7188] autofs4:pid:7188:validate_dev_ioctl: path string terminator missing for cmd(0xc0189371) [ 106.424607][ T5811] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.464340][ T7205] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 106.466439][ T7205] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 106.469776][ T7205] vhci_hcd vhci_hcd.0: Device attached [ 106.487711][ T7189] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 106.553455][ T5811] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.575849][ T7140] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.578250][ T7140] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.580596][ T7140] bridge_slave_0: entered allmulticast mode [ 106.583384][ T7140] bridge_slave_0: entered promiscuous mode [ 106.587702][ T7140] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.590039][ T7140] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.592508][ T7140] bridge_slave_1: entered allmulticast mode [ 106.595498][ T7140] bridge_slave_1: entered promiscuous mode [ 106.610930][ T7140] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 106.618640][ T7140] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 106.636188][ T5811] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.648993][ T7140] team0: Port device team_slave_0 added [ 106.653081][ T7140] team0: Port device team_slave_1 added [ 106.666515][ T7140] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 106.668733][ T7140] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 106.676605][ T7140] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 106.680892][ T7140] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 106.683177][ T7140] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 106.691059][ T7140] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 106.713773][ T7140] hsr_slave_0: entered promiscuous mode [ 106.716037][ T7140] hsr_slave_1: entered promiscuous mode [ 106.718135][ T7140] debugfs: 'hsr0' already exists in 'hsr' [ 106.719953][ T7140] Cannot create hsr debugfs directory [ 106.722325][ T5834] usb 37-1: new high-speed USB device number 3 using vhci_hcd [ 106.855911][ T5811] bridge_slave_1: left allmulticast mode [ 106.858159][ T5811] bridge_slave_1: left promiscuous mode [ 106.861158][ T5811] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.868120][ T5811] bridge_slave_0: left allmulticast mode [ 106.870191][ T5811] bridge_slave_0: left promiscuous mode [ 106.873287][ T5811] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.009625][ T5811] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 107.017146][ T5811] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 107.022522][ T5811] bond0 (unregistering): Released all slaves [ 107.030468][ T5811] bond1 (unregistering): Released all slaves [ 107.041902][ T7140] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 107.046575][ T7140] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.049241][ T7140] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 107.054032][ T7140] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.057402][ T5446] 8021q: adding VLAN 0 to HW filter on device eth1 [ 107.066362][ T7140] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 107.070775][ T7140] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.074323][ T7140] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 107.078247][ T7140] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.191762][ T7140] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.208773][ T7140] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.218983][ T6104] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.221873][ T6104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.237084][ T1171] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.239906][ T1171] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.243534][ T7206] vhci_hcd: connection reset by peer [ 107.248733][ T13] vhci_hcd vhci_hcd.0: stop threads [ 107.250420][ T13] vhci_hcd vhci_hcd.0: release socket [ 107.258589][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 107.306768][ T5446] 8021q: adding VLAN 0 to HW filter on device eth2 [ 107.406381][ T5811] hsr_slave_0: left promiscuous mode [ 107.413732][ T5811] hsr_slave_1: left promiscuous mode [ 107.416338][ T5811] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 107.419049][ T5811] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 107.422810][ T5811] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 107.427365][ T5811] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 107.430590][ T7244] FAULT_INJECTION: forcing a failure. [ 107.430590][ T7244] name failslab, interval 1, probability 0, space 0, times 0 [ 107.435820][ T7244] CPU: 0 UID: 0 PID: 7244 Comm: syz.1.396 Tainted: G L syzkaller #0 PREEMPT(full) [ 107.435838][ T7244] Tainted: [L]=SOFTLOCKUP [ 107.435842][ T7244] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 107.435848][ T7244] Call Trace: [ 107.435853][ T7244] [ 107.435857][ T7244] dump_stack_lvl+0x100/0x190 [ 107.435876][ T7244] should_fail_ex.cold+0x5/0xa [ 107.435891][ T7244] should_failslab+0xc2/0x120 [ 107.435906][ T7244] kmem_cache_alloc_noprof+0x91/0x6a0 [ 107.435919][ T7244] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 107.435935][ T7244] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 107.435951][ T7244] mmu_topup_memory_caches+0x25/0x170 [ 107.435968][ T7244] kvm_mmu_load+0xe2/0x2570 [ 107.435983][ T7244] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 107.435994][ T7244] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 107.436006][ T7244] ? __pfx_kvm_mmu_load+0x10/0x10 [ 107.436020][ T7244] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 107.436033][ T7244] ? kvm_check_and_inject_events+0x873/0x12a0 [ 107.436049][ T7244] ? record_steal_time+0x3a0/0xbb0 [ 107.436062][ T7244] vcpu_run+0x3aaa/0x5de0 [ 107.436083][ T7244] ? __pfx_vcpu_run+0x10/0x10 [ 107.436102][ T7244] ? rcu_is_watching+0x12/0xc0 [ 107.436120][ T7244] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 107.436135][ T7244] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 107.436155][ T7244] kvm_vcpu_ioctl+0x730/0x1700 [ 107.436168][ T7244] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 107.436180][ T7244] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 107.436194][ T7244] ? do_vfs_ioctl+0x226/0x13e0 [ 107.436210][ T7244] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 107.436225][ T7244] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 107.436247][ T7244] ? __fget_files+0x215/0x3d0 [ 107.436257][ T7244] ? hook_file_ioctl_common+0x140/0x440 [ 107.436273][ T7244] ? selinux_file_ioctl+0x13b/0x290 [ 107.436289][ T7244] ? selinux_file_ioctl+0xb6/0x290 [ 107.436306][ T7244] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 107.436318][ T7244] __x64_sys_ioctl+0x18e/0x210 [ 107.436351][ T7244] do_syscall_64+0x115/0x870 [ 107.436365][ T7244] ? clear_bhb_loop+0x40/0x90 [ 107.436378][ T7244] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.436389][ T7244] RIP: 0033:0x7fcb8db9e019 [ 107.436398][ T7244] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.436409][ T7244] RSP: 002b:00007fcb8ead6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 107.436420][ T7244] RAX: ffffffffffffffda RBX: 00007fcb8de25fa0 RCX: 00007fcb8db9e019 [ 107.436426][ T7244] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 107.436432][ T7244] RBP: 00007fcb8ead6090 R08: 0000000000000000 R09: 0000000000000000 [ 107.436438][ T7244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 107.436444][ T7244] R13: 00007fcb8de26038 R14: 00007fcb8de25fa0 R15: 00007ffd73685488 [ 107.436467][ T7244] [ 107.436913][ T5811] veth1_macvtap: left promiscuous mode [ 107.534272][ T5811] veth0_macvtap: left promiscuous mode [ 107.536657][ T5811] veth1_vlan: left promiscuous mode [ 107.538713][ T5811] veth0_vlan: left promiscuous mode [ 107.690314][ T5811] team0 (unregistering): Port device team_slave_1 removed [ 107.698081][ T5811] team0 (unregistering): Port device team_slave_0 removed [ 107.811581][ T7252] erspan0: entered promiscuous mode [ 107.817699][ T5446] 8021q: adding VLAN 0 to HW filter on device eth3 [ 107.882834][ T7265] netlink: 104 bytes leftover after parsing attributes in process `syz.0.400'. [ 107.901228][ T64] Bluetooth: Unknown BR/EDR signaling command 0x0e [ 107.904740][ T64] Bluetooth: Wrong link type (-22) [ 107.927794][ T64] Bluetooth: hci4: command tx timeout [ 107.965168][ T7279] FAULT_INJECTION: forcing a failure. [ 107.965168][ T7279] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 107.983371][ T7279] CPU: 2 UID: 0 PID: 7279 Comm: syz.3.403 Tainted: G L syzkaller #0 PREEMPT(full) [ 107.983393][ T7279] Tainted: [L]=SOFTLOCKUP [ 107.983397][ T7279] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 107.983404][ T7279] Call Trace: [ 107.983408][ T7279] [ 107.983413][ T7279] dump_stack_lvl+0x100/0x190 [ 107.983433][ T7279] should_fail_ex.cold+0x5/0xa [ 107.983448][ T7279] _copy_from_iter+0x1f4/0x1690 [ 107.983465][ T7279] ? __asan_memset+0x23/0x50 [ 107.983493][ T7279] ? __pfx__copy_from_iter+0x10/0x10 [ 107.983508][ T7279] ? __pfx___alloc_skb+0x10/0x10 [ 107.983527][ T7279] netlink_sendmsg+0x808/0xda0 [ 107.983559][ T7279] ? __pfx_netlink_sendmsg+0x10/0x10 [ 107.983571][ T7279] ? selinux_socket_sendmsg+0x198/0x2f0 [ 107.983589][ T7279] ____sys_sendmsg+0xa4d/0xbe0 [ 107.983604][ T7279] ? __pfx_netlink_sendmsg+0x10/0x10 [ 107.983616][ T7279] ? __pfx_____sys_sendmsg+0x10/0x10 [ 107.983634][ T7279] ? __pfx__kstrtoull+0x10/0x10 [ 107.983650][ T7279] ___sys_sendmsg+0x190/0x1e0 [ 107.983668][ T7279] ? __pfx____sys_sendmsg+0x10/0x10 [ 107.983691][ T7279] ? find_held_lock+0x2b/0x80 [ 107.983709][ T7279] __sys_sendmmsg+0x20c/0x440 [ 107.983724][ T7279] ? __pfx___sys_sendmmsg+0x10/0x10 [ 107.983736][ T7279] ? ksys_write+0x190/0x250 [ 107.983764][ T7279] ? fput+0x79/0x100 [ 107.983775][ T7279] ? ksys_write+0x1ac/0x250 [ 107.983791][ T7279] ? __pfx_ksys_write+0x10/0x10 [ 107.983810][ T7279] __x64_sys_sendmmsg+0x9c/0x100 [ 107.983822][ T7279] ? lockdep_hardirqs_on+0x78/0x100 [ 107.983836][ T7279] do_syscall_64+0x115/0x870 [ 107.983848][ T7279] ? clear_bhb_loop+0x40/0x90 [ 107.983861][ T7279] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.983872][ T7279] RIP: 0033:0x7f34d039e019 [ 107.983882][ T7279] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.983894][ T7279] RSP: 002b:00007f34d1236028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 107.983905][ T7279] RAX: ffffffffffffffda RBX: 00007f34d0625fa0 RCX: 00007f34d039e019 [ 107.983912][ T7279] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 107.983918][ T7279] RBP: 00007f34d1236090 R08: 0000000000000000 R09: 0000000000000000 [ 107.983925][ T7279] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 107.983931][ T7279] R13: 00007f34d0626038 R14: 00007f34d0625fa0 R15: 00007fff078482a8 [ 107.983944][ T7279] [ 108.122551][ T7140] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.207642][ T7311] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 108.210308][ T7311] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 108.214395][ T5446] 8021q: adding VLAN 0 to HW filter on device eth4 [ 108.214836][ T7311] vhci_hcd vhci_hcd.0: Device attached [ 108.348415][ T7140] veth0_vlan: entered promiscuous mode [ 108.355502][ T7140] veth1_vlan: entered promiscuous mode [ 108.371954][ T7140] veth0_macvtap: entered promiscuous mode [ 108.381314][ T7140] veth1_macvtap: entered promiscuous mode [ 108.393147][ T7140] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.404745][ T7140] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.473298][ T50] usb 39-1: new high-speed USB device number 2 using vhci_hcd [ 108.483004][ T6105] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.488963][ T6105] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.515448][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.518377][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.542745][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.588543][ T5811] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.613037][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.622684][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.630969][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.654395][ T5746] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 108.660104][ T5746] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 108.665087][ T5746] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 108.670879][ T5746] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 108.676290][ T5746] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 108.726062][ T7356] netlink: 188 bytes leftover after parsing attributes in process `syz.4.411'. [ 108.731349][ T5811] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.875886][ T5811] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.977779][ T7312] vhci_hcd: connection reset by peer [ 108.981145][ T13] vhci_hcd vhci_hcd.1: stop threads [ 108.983754][ T13] vhci_hcd vhci_hcd.1: release socket [ 108.985598][ T13] vhci_hcd vhci_hcd.1: disconnect device [ 108.996371][ T5811] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.005749][ T7371] netlink: 344 bytes leftover after parsing attributes in process `syz.0.412'. [ 109.209928][ T7343] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.213801][ T7343] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.216278][ T7343] bridge_slave_0: entered allmulticast mode [ 109.219127][ T7343] bridge_slave_0: entered promiscuous mode [ 109.235404][ T5811] bridge_slave_1: left allmulticast mode [ 109.236965][ T7385] FAULT_INJECTION: forcing a failure. [ 109.236965][ T7385] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 109.238466][ T5811] bridge_slave_1: left promiscuous mode [ 109.242186][ T7385] CPU: 0 UID: 0 PID: 7385 Comm: syz.0.413 Tainted: G L syzkaller #0 PREEMPT(full) [ 109.242210][ T7385] Tainted: [L]=SOFTLOCKUP [ 109.242214][ T7385] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 109.242221][ T7385] Call Trace: [ 109.242225][ T7385] [ 109.242230][ T7385] dump_stack_lvl+0x100/0x190 [ 109.242248][ T7385] should_fail_ex.cold+0x5/0xa [ 109.242262][ T7385] _copy_from_iter+0x1f4/0x1690 [ 109.242279][ T7385] ? __asan_memset+0x23/0x50 [ 109.242290][ T7385] ? __pfx__copy_from_iter+0x10/0x10 [ 109.242305][ T7385] ? __pfx___alloc_skb+0x10/0x10 [ 109.242323][ T7385] netlink_sendmsg+0x808/0xda0 [ 109.242338][ T7385] ? __pfx_netlink_sendmsg+0x10/0x10 [ 109.242350][ T7385] ? selinux_socket_sendmsg+0x198/0x2f0 [ 109.242396][ T7385] ____sys_sendmsg+0xa4d/0xbe0 [ 109.242412][ T7385] ? __pfx_netlink_sendmsg+0x10/0x10 [ 109.242423][ T7385] ? __pfx_____sys_sendmsg+0x10/0x10 [ 109.242441][ T7385] ? __pfx__kstrtoull+0x10/0x10 [ 109.242454][ T7385] ___sys_sendmsg+0x190/0x1e0 [ 109.242488][ T7385] ? __pfx____sys_sendmsg+0x10/0x10 [ 109.242514][ T7385] ? find_held_lock+0x2b/0x80 [ 109.242531][ T7385] __sys_sendmmsg+0x20c/0x440 [ 109.242547][ T7385] ? __pfx___sys_sendmmsg+0x10/0x10 [ 109.242560][ T7385] ? ksys_write+0x190/0x250 [ 109.242597][ T7385] ? fput+0x79/0x100 [ 109.242614][ T7385] ? ksys_write+0x1ac/0x250 [ 109.242638][ T7385] ? __pfx_ksys_write+0x10/0x10 [ 109.242663][ T7385] __x64_sys_sendmmsg+0x9c/0x100 [ 109.242676][ T7385] ? lockdep_hardirqs_on+0x78/0x100 [ 109.242690][ T7385] do_syscall_64+0x115/0x870 [ 109.242704][ T7385] ? clear_bhb_loop+0x40/0x90 [ 109.242717][ T7385] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.242728][ T7385] RIP: 0033:0x7fcd7839e019 [ 109.242739][ T7385] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.242749][ T7385] RSP: 002b:00007fcd7929f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 109.242760][ T7385] RAX: ffffffffffffffda RBX: 00007fcd78625fa0 RCX: 00007fcd7839e019 [ 109.242767][ T7385] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 109.242773][ T7385] RBP: 00007fcd7929f090 R08: 0000000000000000 R09: 0000000000000000 [ 109.242780][ T7385] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 109.242786][ T7385] R13: 00007fcd78626038 R14: 00007fcd78625fa0 R15: 00007fffb9bb8ef8 [ 109.242800][ T7385] [ 109.345799][ T5811] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.354711][ T5811] bridge_slave_0: left allmulticast mode [ 109.356563][ T5811] bridge_slave_0: left promiscuous mode [ 109.358534][ T5811] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.466860][ T5811] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 109.474196][ T5811] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 109.479256][ T5811] .` (unregistering): Released all slaves [ 109.486769][ T5811] bond1 (unregistering): Released all slaves [ 109.498952][ T5811] bond2 (unregistering): Released all slaves [ 109.531692][ T7343] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.536792][ T7343] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.539055][ T7343] bridge_slave_1: entered allmulticast mode [ 109.543792][ T7343] bridge_slave_1: entered promiscuous mode [ 109.554258][ T7401] FAULT_INJECTION: forcing a failure. [ 109.554258][ T7401] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 109.559908][ T5446] 8021q: adding VLAN 0 to HW filter on device eth5 [ 109.565664][ T7401] CPU: 0 UID: 0 PID: 7401 Comm: syz.0.417 Tainted: G L syzkaller #0 PREEMPT(full) [ 109.565693][ T7401] Tainted: [L]=SOFTLOCKUP [ 109.565700][ T7401] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 109.565710][ T7401] Call Trace: [ 109.565716][ T7401] [ 109.565723][ T7401] dump_stack_lvl+0x100/0x190 [ 109.565751][ T7401] should_fail_ex.cold+0x5/0xa [ 109.565774][ T7401] _copy_to_user+0x32/0xd0 [ 109.565800][ T7401] simple_read_from_buffer+0xcb/0x170 [ 109.565822][ T7401] proc_fail_nth_read+0x1af/0x230 [ 109.565850][ T7401] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 109.565877][ T7401] ? rw_verify_area+0xce/0x6d0 [ 109.565900][ T7401] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 109.565926][ T7401] vfs_read+0x1e4/0xb40 [ 109.565955][ T7401] ? __pfx_vfs_read+0x10/0x10 [ 109.565981][ T7401] ? __fget_files+0x215/0x3d0 [ 109.566005][ T7401] ? __fget_files+0x21f/0x3d0 [ 109.566030][ T7401] ksys_read+0x12a/0x250 [ 109.566056][ T7401] ? __pfx_ksys_read+0x10/0x10 [ 109.566108][ T7401] do_syscall_64+0x115/0x870 [ 109.566130][ T7401] ? clear_bhb_loop+0x40/0x90 [ 109.566152][ T7401] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.566171][ T7401] RIP: 0033:0x7fcd7835e84e [ 109.566187][ T7401] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 109.566209][ T7401] RSP: 002b:00007fcd7929efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 109.566228][ T7401] RAX: ffffffffffffffda RBX: 00007fcd7929f6c0 RCX: 00007fcd7835e84e [ 109.566240][ T7401] RDX: 000000000000000f RSI: 00007fcd7929f0a0 RDI: 0000000000000004 [ 109.566250][ T7401] RBP: 00007fcd7929f090 R08: 0000000000000000 R09: 0000000000000000 [ 109.566261][ T7401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 109.566270][ T7401] R13: 00007fcd78626038 R14: 00007fcd78625fa0 R15: 00007fffb9bb8ef8 [ 109.566293][ T7401] [ 109.577287][ T7343] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.646094][ T7343] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.730760][ T7343] team0: Port device team_slave_0 added [ 109.736163][ T7343] team0: Port device team_slave_1 added [ 109.765583][ T7343] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.768058][ T7343] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.779927][ T7343] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.784769][ T7343] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.787075][ T7343] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.796751][ T7343] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.818849][ T7418] netlink: 12 bytes leftover after parsing attributes in process `syz.4.422'. [ 109.827680][ T7418] block nbd0: Unsupported socket: should be TCP or UNIX. [ 109.839831][ T7343] hsr_slave_0: entered promiscuous mode [ 109.842319][ T7343] hsr_slave_1: entered promiscuous mode [ 109.844747][ T7343] debugfs: 'hsr0' already exists in 'hsr' [ 109.846656][ T7343] Cannot create hsr debugfs directory [ 109.857492][ T7418] syzkaller0: entered promiscuous mode [ 109.859829][ T7418] syzkaller0: entered allmulticast mode [ 109.920862][ T5811] hsr_slave_0: left promiscuous mode [ 109.926161][ T5811] hsr_slave_1: left promiscuous mode [ 109.928984][ T5811] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 109.931709][ T5811] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 109.939797][ T5811] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 109.942220][ T5811] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 109.949859][ T5811] veth1_macvtap: left promiscuous mode [ 109.951666][ T5811] veth0_macvtap: left promiscuous mode [ 109.954604][ T5811] veth1_vlan: left promiscuous mode [ 109.956287][ T5811] veth0_vlan: left promiscuous mode [ 110.012174][ T64] Bluetooth: hci4: command tx timeout [ 110.174911][ T5811] team0 (unregistering): Port device team_slave_1 removed [ 110.185476][ T5811] team0 (unregistering): Port device team_slave_0 removed [ 110.271024][ T5446] 8021q: adding VLAN 0 to HW filter on device eth6 [ 110.356487][ T7429] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 110.359305][ T7429] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 110.363021][ T7429] vhci_hcd vhci_hcd.0: Device attached [ 110.434930][ T7343] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 110.441995][ T7343] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 110.445146][ T7343] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 110.448767][ T7343] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 110.452853][ T7343] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 110.460113][ T7343] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 110.464272][ T7343] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 110.470021][ T7343] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 110.550280][ T5446] 8021q: adding VLAN 0 to HW filter on device eth7 [ 110.564156][ T7343] 8021q: adding VLAN 0 to HW filter on device bond0 [ 110.570936][ T7437] netlink: 'syz.0.424': attribute type 15 has an invalid length. [ 110.586400][ T7343] 8021q: adding VLAN 0 to HW filter on device team0 [ 110.592336][ T1169] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.594854][ T1169] bridge0: port 1(bridge_slave_0) entered forwarding state [ 110.602063][ T5884] usb 45-1: new high-speed USB device number 2 using vhci_hcd [ 110.603094][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.606834][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.633397][ T5811] IPVS: stop unused estimator thread 0... [ 110.663976][ T7454] netlink: 'syz.0.427': attribute type 1 has an invalid length. [ 110.690622][ T7454] bond2: entered promiscuous mode [ 110.695994][ T7454] 8021q: adding VLAN 0 to HW filter on device bond2 [ 110.702196][ T7456] netlink: 104 bytes leftover after parsing attributes in process `syz.1.426'. [ 110.734899][ T64] Bluetooth: hci1: command tx timeout [ 110.774796][ T42] kauditd_printk_skb: 36 callbacks suppressed [ 110.774818][ T42] audit: type=1400 audit(1785494034.250:608): avc: denied { write } for pid=7462 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 110.830047][ T5446] 8021q: adding VLAN 0 to HW filter on device eth8 [ 110.841104][ T7477] FAULT_INJECTION: forcing a failure. [ 110.841104][ T7477] name failslab, interval 1, probability 0, space 0, times 0 [ 110.848267][ T7477] CPU: 0 UID: 0 PID: 7477 Comm: syz.0.432 Tainted: G L syzkaller #0 PREEMPT(full) [ 110.848285][ T7477] Tainted: [L]=SOFTLOCKUP [ 110.848289][ T7477] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 110.848309][ T7477] Call Trace: [ 110.848315][ T7477] [ 110.848319][ T7477] dump_stack_lvl+0x100/0x190 [ 110.848338][ T7477] should_fail_ex.cold+0x5/0xa [ 110.848353][ T7477] should_failslab+0xc2/0x120 [ 110.848367][ T7477] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 110.848380][ T7477] ? __alloc_skb+0x5b7/0x710 [ 110.848392][ T7477] ? __alloc_skb+0x140/0x710 [ 110.848406][ T7477] __alloc_skb+0x140/0x710 [ 110.848417][ T7477] ? __alloc_skb+0x5b7/0x710 [ 110.848428][ T7477] ? __pfx___alloc_skb+0x10/0x10 [ 110.848439][ T7477] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 110.848456][ T7477] ? sock_has_perm+0x25a/0x2f0 [ 110.848469][ T7477] ? __pfx_sock_has_perm+0x10/0x10 [ 110.848484][ T7477] netlink_alloc_large_skb+0x69/0x150 [ 110.848497][ T7477] netlink_sendmsg+0x680/0xda0 [ 110.848509][ T7477] ? __pfx_netlink_sendmsg+0x10/0x10 [ 110.848521][ T7477] ? selinux_socket_sendmsg+0x198/0x2f0 [ 110.848538][ T7477] ____sys_sendmsg+0xa4d/0xbe0 [ 110.848553][ T7477] ? __pfx_netlink_sendmsg+0x10/0x10 [ 110.848564][ T7477] ? __pfx_____sys_sendmsg+0x10/0x10 [ 110.848582][ T7477] ? rcu_is_watching+0x12/0xc0 [ 110.848598][ T7477] ? ___sys_sendmsg+0x19d/0x1e0 [ 110.848613][ T7477] ? kfree+0x1e5/0x6c0 [ 110.848630][ T7477] ___sys_sendmsg+0x190/0x1e0 [ 110.848649][ T7477] ? __pfx____sys_sendmsg+0x10/0x10 [ 110.848678][ T7477] ? __pfx___might_resched+0x10/0x10 [ 110.848695][ T7477] __sys_sendmmsg+0x20c/0x440 [ 110.848709][ T7477] ? __pfx___sys_sendmmsg+0x10/0x10 [ 110.848722][ T7477] ? ksys_write+0x190/0x250 [ 110.848748][ T7477] ? fput+0x79/0x100 [ 110.848760][ T7477] ? ksys_write+0x1ac/0x250 [ 110.848776][ T7477] ? __pfx_ksys_write+0x10/0x10 [ 110.848795][ T7477] __x64_sys_sendmmsg+0x9c/0x100 [ 110.848814][ T7477] ? lockdep_hardirqs_on+0x78/0x100 [ 110.848832][ T7477] do_syscall_64+0x115/0x870 [ 110.848850][ T7477] ? clear_bhb_loop+0x40/0x90 [ 110.848871][ T7477] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.848888][ T7477] RIP: 0033:0x7fcd7839e019 [ 110.848904][ T7477] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 110.848917][ T7477] RSP: 002b:00007fcd7929f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 110.848928][ T7477] RAX: ffffffffffffffda RBX: 00007fcd78625fa0 RCX: 00007fcd7839e019 [ 110.848935][ T7477] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 110.848941][ T7477] RBP: 00007fcd7929f090 R08: 0000000000000000 R09: 0000000000000000 [ 110.848947][ T7477] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 110.848953][ T7477] R13: 00007fcd78626038 R14: 00007fcd78625fa0 R15: 00007fffb9bb8ef8 [ 110.848967][ T7477] [ 110.869515][ T7480] Context (ID=0x0) not attached to queue pair (handle=0x2:0x2) [ 110.874405][ T42] audit: type=1400 audit(1785494034.340:609): avc: denied { name_bind } for pid=7479 comm="syz.1.433" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 110.989703][ T7343] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.133054][ T7430] vhci_hcd: connection reset by peer [ 111.134982][ T5811] vhci_hcd vhci_hcd.4: stop threads [ 111.136646][ T5811] vhci_hcd vhci_hcd.4: release socket [ 111.139313][ T5811] vhci_hcd vhci_hcd.4: disconnect device [ 111.161567][ T7343] veth0_vlan: entered promiscuous mode [ 111.167192][ T7343] veth1_vlan: entered promiscuous mode [ 111.184477][ T7343] veth0_macvtap: entered promiscuous mode [ 111.189229][ T7343] veth1_macvtap: entered promiscuous mode [ 111.201700][ T7343] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.207894][ T7343] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.271725][ T109] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.275895][ T109] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.300734][ T1169] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.303428][ T1169] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.303496][ T13] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.309053][ T13] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.343170][ T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.347303][ T13] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.421238][ T7511] kvm: user requested TSC rate below hardware speed [ 111.701891][ T42] audit: type=1400 audit(1785494035.170:610): avc: denied { create } for pid=7520 comm="syz.5.441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 111.717392][ T42] audit: type=1400 audit(1785494035.190:611): avc: denied { bind } for pid=7520 comm="syz.5.441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 111.725004][ T42] audit: type=1400 audit(1785494035.200:612): avc: denied { listen } for pid=7520 comm="syz.5.441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 111.732223][ T7523] netlink: 24 bytes leftover after parsing attributes in process `syz.4.442'. [ 111.735679][ T7523] netlink: 40 bytes leftover after parsing attributes in process `syz.4.442'. [ 111.832837][ T5834] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 111.879218][ T42] audit: type=1400 audit(1785494035.350:613): avc: denied { create } for pid=7530 comm="syz.4.445" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 111.886700][ T7531] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 111.887458][ T42] audit: type=1400 audit(1785494035.350:614): avc: denied { write } for pid=7530 comm="syz.4.445" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 111.890648][ T7531] netlink: 'syz.4.445': attribute type 39 has an invalid length. [ 111.920372][ T7521] binder: 7520:7521 ioctl c0306201 200000000040 returned -14 [ 112.082042][ T64] Bluetooth: hci4: command tx timeout [ 112.249166][ T7547] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 112.251844][ T7547] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 112.260082][ T7547] vhci_hcd vhci_hcd.0: Device attached [ 112.329858][ T7540] syz.4.447 (7540): drop_caches: 2 [ 112.332261][ T7541] syz.4.447 (7541): drop_caches: 2 [ 112.512207][ T1360] usb 47-1: new high-speed USB device number 2 using vhci_hcd [ 112.736334][ T7565] netlink: 'syz.0.451': attribute type 1 has an invalid length. [ 112.739371][ T7565] netlink: 224 bytes leftover after parsing attributes in process `syz.0.451'. [ 112.764331][ T7561] /dev/sr0: Can't open blockdev [ 112.812203][ T64] Bluetooth: hci1: command tx timeout [ 112.960031][ T42] audit: type=1400 audit(1785494036.430:615): avc: denied { read } for pid=7496 comm="syz.1.436" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 113.018062][ T7548] vhci_hcd: connection reset by peer [ 113.022668][ T13] vhci_hcd vhci_hcd.5: stop threads [ 113.024502][ T13] vhci_hcd vhci_hcd.5: release socket [ 113.028325][ T13] vhci_hcd vhci_hcd.5: disconnect device [ 113.060047][ T7579] netlink: 24 bytes leftover after parsing attributes in process `syz.4.456'. [ 113.104608][ T7579] xt_hl: Unknown TTL match mode: 255 [ 113.118424][ T7586] IPv6: NLM_F_CREATE should be specified when creating new route [ 113.121416][ T7579] netlink: 'syz.4.456': attribute type 7 has an invalid length. [ 113.134729][ T7582] netlink: 12 bytes leftover after parsing attributes in process `syz.0.457'. [ 113.144696][ T7582] netlink: 20 bytes leftover after parsing attributes in process `syz.0.457'. [ 113.152296][ T42] audit: type=1400 audit(1785494036.630:616): avc: denied { unmount } for pid=7140 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 113.201370][ T42] audit: type=1400 audit(1785494036.670:617): avc: denied { lock } for pid=7581 comm="syz.0.457" path="socket:[21750]" dev="sockfs" ino=21750 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 113.348069][ T7591] netlink: 8 bytes leftover after parsing attributes in process `syz.4.460'. [ 113.350976][ T7591] netlink: 12 bytes leftover after parsing attributes in process `syz.4.460'. [ 113.359633][ T7591] netlink: 8 bytes leftover after parsing attributes in process `syz.4.460'. [ 113.363317][ T7591] netlink: 12 bytes leftover after parsing attributes in process `syz.4.460'. [ 113.372055][ T13] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 113.375612][ T13] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 113.385005][ T13] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 113.388528][ T13] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 113.592221][ T50] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 113.602957][ T7598] netlink: 16 bytes leftover after parsing attributes in process `syz.5.464'. [ 113.607075][ T7598] netlink: 28 bytes leftover after parsing attributes in process `syz.5.464'. [ 113.616590][ T7598] netlink: 16 bytes leftover after parsing attributes in process `syz.5.464'. [ 113.763296][ T7609] overlayfs: upper fs does not support file handles, falling back to index=off. [ 113.782900][ T7609] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 113.785388][ T7609] syzkaller1: linktype set to 776 [ 113.800117][ T7598] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 113.802581][ T7598] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 113.814293][ T7598] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 113.817077][ T7598] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 113.835954][ T7598] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 113.840060][ T7598] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 113.898078][ T7598] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 113.900556][ T7598] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 114.239425][ T7646] SELinux: Context system_u:object_r:faillog_t:s0 is not valid (left unmapped). [ 114.862074][ T13] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 114.865384][ T13] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 114.868998][ T13] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 114.876925][ T13] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 114.878106][ T7703] netlink: 'syz.0.485': attribute type 1 has an invalid length. [ 114.884120][ T7703] FAULT_INJECTION: forcing a failure. [ 114.884120][ T7703] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 114.888679][ T7703] CPU: 0 UID: 0 PID: 7703 Comm: syz.0.485 Tainted: G L syzkaller #0 PREEMPT(full) [ 114.888698][ T7703] Tainted: [L]=SOFTLOCKUP [ 114.888701][ T7703] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 114.888708][ T7703] Call Trace: [ 114.888725][ T7703] [ 114.888730][ T7703] dump_stack_lvl+0x100/0x190 [ 114.888749][ T7703] should_fail_ex.cold+0x5/0xa [ 114.888765][ T7703] _copy_to_user+0x32/0xd0 [ 114.888781][ T7703] simple_read_from_buffer+0xcb/0x170 [ 114.888809][ T7703] proc_fail_nth_read+0x1af/0x230 [ 114.888827][ T7703] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 114.888844][ T7703] ? rw_verify_area+0xce/0x6d0 [ 114.888858][ T7703] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 114.888874][ T7703] vfs_read+0x1e4/0xb40 [ 114.888892][ T7703] ? __pfx_vfs_read+0x10/0x10 [ 114.888907][ T7703] ? __fget_files+0x215/0x3d0 [ 114.888922][ T7703] ? __fget_files+0x21f/0x3d0 [ 114.888936][ T7703] ksys_read+0x12a/0x250 [ 114.888952][ T7703] ? __pfx_ksys_read+0x10/0x10 [ 114.888971][ T7703] do_syscall_64+0x115/0x870 [ 114.888985][ T7703] ? clear_bhb_loop+0x40/0x90 [ 114.888998][ T7703] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.889009][ T7703] RIP: 0033:0x7fcd7835e84e [ 114.889019][ T7703] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 114.889029][ T7703] RSP: 002b:00007fcd7929efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 114.889046][ T7703] RAX: ffffffffffffffda RBX: 00007fcd7929f6c0 RCX: 00007fcd7835e84e [ 114.889053][ T7703] RDX: 000000000000000f RSI: 00007fcd7929f0a0 RDI: 0000000000000003 [ 114.889060][ T7703] RBP: 00007fcd7929f090 R08: 0000000000000000 R09: 0000000000000000 [ 114.889066][ T7703] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 114.889072][ T7703] R13: 00007fcd78626038 R14: 00007fcd78625fa0 R15: 00007fffb9bb8ef8 [ 114.889086][ T7703] [ 115.027176][ T7709] block nbd0: Unsupported socket: should be TCP or UNIX. [ 115.063624][ T7711] netlink: 'syz.5.489': attribute type 4 has an invalid length. [ 115.066389][ T7709] syzkaller0: entered promiscuous mode [ 115.069258][ T7709] syzkaller0: entered allmulticast mode [ 115.112478][ T7714] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 115.195205][ T7721] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 115.197776][ T7721] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 115.203415][ T7721] vhci_hcd vhci_hcd.0: Device attached [ 115.209583][ T7722] usbip_core: unknown command [ 115.210194][ T7721] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(5) [ 115.211470][ T7722] vhci_hcd: unknown pdu 0 [ 115.211483][ T7722] usbip_core: unknown command [ 115.214028][ T7721] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 115.218407][ T7721] vhci_hcd vhci_hcd.0: Device attached [ 115.222771][ T5811] vhci_hcd vhci_hcd.5: stop threads [ 115.225188][ T5811] vhci_hcd vhci_hcd.5: release socket [ 115.226339][ T7725] vhci_hcd: connection closed [ 115.227401][ T5811] vhci_hcd vhci_hcd.5: disconnect device [ 115.232546][ T5811] vhci_hcd vhci_hcd.5: stop threads [ 115.234621][ T5811] vhci_hcd vhci_hcd.5: release socket [ 115.237341][ T5811] vhci_hcd vhci_hcd.5: disconnect device [ 115.463216][ T7752] UDC core: g1: couldn't find an available UDC or it's busy [ 115.512108][ T50] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 115.554476][ T7759] xt_policy: neither incoming nor outgoing policy selected [ 115.664034][ T50] usb 5-1: not running at top speed; connect to a high speed hub [ 115.667511][ T50] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 115.674106][ T50] usb 5-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 115.677209][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.679858][ T50] usb 5-1: Product: syz [ 115.681269][ T50] usb 5-1: Manufacturer: syz [ 115.684455][ T50] usb 5-1: SerialNumber: syz [ 115.692449][ T50] oti6858 5-1:1.0: oti6858 converter detected [ 115.697694][ T50] usb 5-1: oti6858 converter now attached to ttyUSB0 [ 115.755695][ T5884] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 115.829624][ T42] kauditd_printk_skb: 26 callbacks suppressed [ 115.829643][ T42] audit: type=1400 audit(1785494039.300:644): avc: denied { ioctl } for pid=7778 comm="syz.5.503" path="socket:[22069]" dev="sockfs" ino=22069 ioctlcmd=0x8918 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 115.910209][ T7784] vhci_hcd vhci_hcd.0: remove, state 4 [ 115.915780][ T7784] usb usb38: USB disconnect, device number 1 [ 115.943512][ T7788] xt_NFQUEUE: number of queues (5) out of range (got 65536) [ 115.947426][ T7788] xt_NFQUEUE: number of queues (5) out of range (got 65536) [ 115.950926][ T7788] xt_NFQUEUE: number of queues (5) out of range (got 65536) [ 115.955134][ T7788] xt_NFQUEUE: number of queues (5) out of range (got 65536) [ 115.980677][ T7784] vhci_hcd vhci_hcd.0: USB bus 38 deregistered [ 115.982256][ T5811] vhci_hcd vhci_hcd.0: stop threads [ 115.989861][ T5811] vhci_hcd vhci_hcd.0: release socket [ 115.995908][ T5811] vhci_hcd vhci_hcd.0: disconnect device [ 116.003445][ T5811] vhci_hcd vhci_hcd.0: stop threads [ 116.005832][ T5811] vhci_hcd vhci_hcd.0: release socket [ 116.006123][ T7784] vhci_hcd vhci_hcd.0: remove, state 4 [ 116.008409][ T5811] ================================================================== [ 116.008422][ T5811] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x44/0x456 [ 116.009597][ T7795] UDC core: g1: couldn't find an available UDC or it's busy [ 116.009931][ T42] audit: type=1400 audit(1785494039.480:645): avc: denied { write } for pid=7794 comm="syz.1.507" name="c.1" dev="configfs" ino=7966 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 116.009960][ T42] audit: type=1400 audit(1785494039.480:646): avc: denied { write } for pid=7794 comm="syz.1.507" name="c.1" dev="configfs" ino=7966 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 116.012555][ T7784] usb usb37: USB disconnect, device number 1 [ 116.013979][ T5811] Read of size 4 at addr ffff88802bff46a0 by task kworker/u32:3/5811 [ 116.013998][ T5811] [ 116.014032][ T5811] CPU: 3 UID: 0 PID: 5811 Comm: kworker/u32:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 116.014059][ T5811] Tainted: [L]=SOFTLOCKUP [ 116.014067][ T5811] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.014079][ T5811] Workqueue: usbip_event event_handler [ 116.014151][ T5811] Call Trace: [ 116.014169][ T5811] [ 116.014178][ T5811] dump_stack_lvl+0x100/0x190 [ 116.014203][ T5811] print_report+0x13d/0x4b0 [ 116.014230][ T5811] ? __virt_addr_valid+0x239/0x430 [ 116.014255][ T5811] ? vhci_cleanup_unlink_list+0x44/0x456 [ 116.014281][ T5811] kasan_report+0xdf/0x1c0 [ 116.014307][ T5811] ? vhci_cleanup_unlink_list+0x44/0x456 [ 116.014335][ T5811] vhci_cleanup_unlink_list+0x44/0x456 [ 116.014365][ T5811] vhci_shutdown_connection.cold+0x165/0x37c [ 116.014394][ T5811] event_handler+0x216/0x570 [ 116.014414][ T5811] process_one_work+0xa23/0x1940 [ 116.014566][ T5811] ? __pfx_process_one_work+0x10/0x10 [ 116.014590][ T5811] ? __pfx_event_handler+0x10/0x10 [ 116.014608][ T5811] worker_thread+0x5ef/0xe50 [ 116.014637][ T5811] ? __pfx_worker_thread+0x10/0x10 [ 116.014658][ T5811] ? kthread+0x13a/0x450 [ 116.014675][ T5811] ? __pfx_worker_thread+0x10/0x10 [ 116.014695][ T5811] kthread+0x370/0x450 [ 116.014712][ T5811] ? __pfx_kthread+0x10/0x10 [ 116.014729][ T5811] ret_from_fork+0x72b/0xd50 [ 116.014755][ T5811] ? __pfx_ret_from_fork+0x10/0x10 [ 116.014781][ T5811] ? __switch_to+0x800/0x10f0 [ 116.014799][ T5811] ? __pfx_kthread+0x10/0x10 [ 116.014816][ T5811] ret_from_fork_asm+0x1a/0x30 [ 116.014848][ T5811] [ 116.014855][ T5811] [ 116.014860][ T5811] Allocated by task 1: [ 116.014869][ T5811] kasan_save_stack+0x30/0x50 [ 116.014889][ T5811] kasan_save_track+0x14/0x30 [ 116.014908][ T5811] __kasan_kmalloc+0xaa/0xb0 [ 116.014926][ T5811] __kmalloc_noprof+0x322/0x820 [ 116.014946][ T5811] __usb_create_hcd+0x5e/0xac0 [ 116.080717][ T7784] vhci_hcd vhci_hcd.0: USB bus 37 deregistered [ 116.080832][ T5811] vhci_hcd_probe+0x1a5/0x4e0 [ 116.080862][ T5811] platform_probe+0x106/0x1d0 [ 116.082526][ T42] audit: type=1400 audit(1785494039.550:647): avc: denied { write } for pid=7794 comm="syz.1.507" name="c.1" dev="configfs" ino=7966 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 116.151031][ T5811] really_probe+0x241/0xa60 [ 116.153114][ T5811] __driver_probe_device+0x20e/0x450 [ 116.155480][ T5811] driver_probe_device+0x4a/0x140 [ 116.157865][ T5811] __device_attach_driver+0x1df/0x320 [ 116.160177][ T5811] bus_for_each_drv+0x159/0x1e0 [ 116.162482][ T5811] __device_attach+0x1e4/0x4d0 [ 116.164636][ T5811] device_initial_probe+0xaf/0xd0 [ 116.166855][ T5811] bus_probe_device+0x64/0x160 [ 116.169081][ T5811] device_add+0x121d/0x1970 [ 116.171062][ T5811] platform_device_add+0x35a/0x800 [ 116.173418][ T5811] platform_device_register_full+0x5cf/0x830 [ 116.175852][ T5811] vhci_hcd_init+0x1a1/0x2f0 [ 116.177807][ T5811] do_one_initcall+0x11d/0x700 [ 116.179862][ T5811] kernel_init_freeable+0x6ea/0x7b0 [ 116.181775][ T5811] kernel_init+0x1f/0x1e0 [ 116.183236][ T5811] ret_from_fork+0x72b/0xd50 [ 116.184798][ T5811] ret_from_fork_asm+0x1a/0x30 [ 116.186924][ T5811] [ 116.187949][ T5811] Freed by task 7784: [ 116.189615][ T5811] kasan_save_stack+0x30/0x50 [ 116.191270][ T5811] kasan_save_track+0x14/0x30 [ 116.192849][ T5811] kasan_save_free_info+0x3b/0x70 [ 116.194785][ T5811] __kasan_slab_free+0x5f/0x80 [ 116.196780][ T5811] kfree+0x22b/0x6c0 [ 116.198231][ T5811] usb_put_hcd+0x149/0x1f0 [ 116.199898][ T5811] vhci_hcd_remove+0xb5/0x1b0 [ 116.201814][ T5811] platform_remove+0x5f/0x80 [ 116.204052][ T5811] device_remove+0xcb/0x180 [ 116.206248][ T5811] device_release_driver_internal+0x44e/0x620 [ 116.209133][ T5811] unbind_store+0xf8/0x110 [ 116.211164][ T5811] drv_attr_store+0x74/0xb0 [ 116.213353][ T5811] sysfs_kf_write+0xf2/0x150 [ 116.215472][ T5811] kernfs_fop_write_iter+0x3e0/0x5f0 [ 116.217596][ T5811] vfs_write+0x6ac/0x1050 [ 116.219169][ T5811] ksys_write+0x12a/0x250 [ 116.221129][ T5811] do_syscall_64+0x115/0x870 [ 116.223340][ T5811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.226130][ T5811] [ 116.227309][ T5811] Last potentially related work creation: [ 116.229958][ T5811] kasan_save_stack+0x30/0x50 [ 116.232096][ T5811] kasan_record_aux_stack+0xa7/0xc0 [ 116.234581][ T5811] insert_work+0x36/0x230 [ 116.236547][ T5811] __queue_work+0x9bc/0x12b0 [ 116.238806][ T5811] queue_work_on+0x1a9/0x1e0 [ 116.240936][ T5811] usb_hcd_giveback_urb+0x330/0x4a0 [ 116.242991][ T5811] unlink1+0x418/0x510 [ 116.244876][ T5811] usb_hcd_unlink_urb+0x131/0x210 [ 116.247269][ T5811] usb_kill_urb+0x121/0x320 [ 116.249414][ T5811] hub_quiesce+0x1e9/0x320 [ 116.251319][ T5811] hub_suspend+0x4ab/0x9e0 [ 116.253194][ T5811] usb_suspend_both+0x288/0x950 [ 116.255445][ T5811] usb_runtime_suspend+0x49/0x120 [ 116.256727][ T848] usb 5-1: USB disconnect, device number 4 [ 116.257730][ T5811] __rpm_callback+0xc8/0x620 [ 116.257755][ T5811] rpm_callback+0x16a/0x1b0 [ 116.257774][ T5811] rpm_suspend+0x2f4/0x11a0 [ 116.266345][ T5811] __pm_runtime_suspend+0xba/0x1a0 [ 116.268716][ T5811] usb_runtime_idle+0x7e/0x90 [ 116.270768][ T5811] rpm_idle+0x322/0x790 [ 116.272583][ T5811] pm_runtime_work+0x120/0x150 [ 116.274744][ T5811] process_one_work+0xa23/0x1940 [ 116.276832][ T5811] worker_thread+0x5ef/0xe50 [ 116.278776][ T5811] kthread+0x370/0x450 [ 116.280595][ T5811] ret_from_fork+0x72b/0xd50 [ 116.282677][ T5811] ret_from_fork_asm+0x1a/0x30 [ 116.284550][ T5811] [ 116.285461][ T5811] Second to last potentially related work creation: [ 116.287768][ T5811] kasan_save_stack+0x30/0x50 [ 116.288718][ T848] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 116.289884][ T5811] kasan_record_aux_stack+0xa7/0xc0 [ 116.289914][ T5811] insert_work+0x36/0x230 [ 116.289929][ T5811] __queue_work+0x9bc/0x12b0 [ 116.298036][ T5811] queue_work_on+0x1a9/0x1e0 [ 116.299526][ T5811] usb_hcd_giveback_urb+0x3b8/0x4a0 [ 116.301110][ T848] oti6858 5-1:1.0: device disconnected [ 116.301362][ T5811] usb_hcd_submit_urb+0xab7/0x2150 [ 116.305018][ T5811] usb_submit_urb+0x827/0x19b0 [ 116.306799][ T5811] usb_start_wait_urb+0x10e/0x580 [ 116.309011][ T5811] usb_control_msg+0x328/0x4b0 [ 116.311002][ T5811] hub_suspend+0x826/0x9e0 [ 116.312886][ T5811] usb_suspend_both+0x288/0x950 [ 116.314979][ T5811] usb_runtime_suspend+0x49/0x120 [ 116.317060][ T5811] __rpm_callback+0xc8/0x620 [ 116.319081][ T5811] rpm_callback+0x16a/0x1b0 [ 116.320965][ T5811] rpm_suspend+0x2f4/0x11a0 [ 116.322948][ T5811] __pm_runtime_suspend+0xba/0x1a0 [ 116.325115][ T5811] usb_runtime_idle+0x7e/0x90 [ 116.327150][ T5811] rpm_idle+0x322/0x790 [ 116.328936][ T5811] pm_runtime_work+0x120/0x150 [ 116.330948][ T5811] process_one_work+0xa23/0x1940 [ 116.333023][ T5811] worker_thread+0x5ef/0xe50 [ 116.334958][ T5811] kthread+0x370/0x450 [ 116.336446][ T5811] ret_from_fork+0x72b/0xd50 [ 116.338291][ T5811] ret_from_fork_asm+0x1a/0x30 [ 116.340086][ T5811] [ 116.341064][ T5811] The buggy address belongs to the object at ffff88802bff4000 [ 116.341064][ T5811] which belongs to the cache kmalloc-8k of size 8192 [ 116.346750][ T5811] The buggy address is located 1696 bytes inside of [ 116.346750][ T5811] freed 8192-byte region [ffff88802bff4000, ffff88802bff6000) [ 116.351624][ T5811] [ 116.352676][ T5811] The buggy address belongs to the physical page: [ 116.355146][ T5811] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2bff0 [ 116.358759][ T5811] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 116.362124][ T5811] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 116.365218][ T5811] page_type: f5(slab) [ 116.366704][ T5811] raw: 00fff00000000040 ffff88801bc43180 dead000000000122 0000000000000000 [ 116.369392][ T5811] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 116.372089][ T5811] head: 00fff00000000040 ffff88801bc43180 dead000000000122 0000000000000000 [ 116.374791][ T5811] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 116.377566][ T5811] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 116.380851][ T5811] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 116.384426][ T5811] page dumped because: kasan: bad access detected [ 116.386963][ T5811] page_owner tracks the page as allocated [ 116.389028][ T5811] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 36, tgid 36 (kworker/u33:0), ts 8081131536, free_ts 8062815789 [ 116.397556][ T5811] post_alloc_hook+0xfd/0x120 [ 116.399621][ T5811] get_page_from_freelist+0xf48/0x3530 [ 116.401857][ T5811] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 116.404143][ T5811] new_slab+0xa2/0x640 [ 116.405447][ T5811] refill_objects+0xe3/0x410 [ 116.406928][ T5811] __pcs_replace_empty_main+0x376/0x680 [ 116.408676][ T5811] __kmalloc_noprof+0x66d/0x820 [ 116.410188][ T5811] acpi_ut_initialize_buffer+0x144/0x220 [ 116.412500][ T5811] acpi_rs_create_pci_routing_table+0x135/0xe00 [ 116.414532][ T5811] acpi_rs_get_prt_method_data+0xc1/0x150 [ 116.416307][ T5811] acpi_get_irq_routing_table+0xb8/0x140 [ 116.418088][ T5811] acpi_pci_irq_find_prt_entry+0x179/0xdd0 [ 116.419896][ T5811] acpi_pci_irq_lookup+0x8e/0x6b0 [ 116.421588][ T5811] acpi_pci_irq_enable+0x1f5/0x6f0 [ 116.423218][ T5811] pcibios_enable_device+0xb6/0xe0 [ 116.424825][ T5811] do_pci_enable_device+0x21f/0x4a0 [ 116.426479][ T5811] page last free pid 1360 tgid 1360 stack trace: [ 116.428628][ T5811] free_pages_prepare+0x586/0xd80 [ 116.430607][ T5811] __free_contig_range_common+0x14f/0x250 [ 116.433099][ T5811] free_pages_bulk+0x12a/0x200 [ 116.435096][ T5811] vm_area_free_pages+0xad/0x2b0 [ 116.437196][ T5811] vfree+0x107/0x750 [ 116.438997][ T5811] delayed_vfree_work+0x56/0x80 [ 116.441165][ T5811] process_one_work+0xa23/0x1940 [ 116.443264][ T5811] worker_thread+0x5ef/0xe50 [ 116.445404][ T5811] kthread+0x370/0x450 [ 116.447236][ T5811] ret_from_fork+0x72b/0xd50 [ 116.449330][ T5811] ret_from_fork_asm+0x1a/0x30 [ 116.451355][ T5811] [ 116.452517][ T5811] Memory state around the buggy address: [ 116.454509][ T5811] ffff88802bff4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 116.457158][ T5811] ffff88802bff4600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 116.459824][ T5811] >ffff88802bff4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 116.462650][ T5811] ^ [ 116.464499][ T5811] ffff88802bff4700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 116.468050][ T5811] ffff88802bff4780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 116.471449][ T5811] ================================================================== [ 116.476008][ T5811] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 116.478473][ T5811] CPU: 3 UID: 0 PID: 5811 Comm: kworker/u32:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 116.482214][ T5811] Tainted: [L]=SOFTLOCKUP [ 116.483706][ T5811] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.487219][ T5811] Workqueue: usbip_event event_handler [ 116.489674][ T5811] Call Trace: [ 116.491193][ T5811] [ 116.492562][ T5811] dump_stack_lvl+0x100/0x190 [ 116.494624][ T5811] vpanic+0x552/0x970 [ 116.496515][ T5811] ? __pfx_vpanic+0x10/0x10 [ 116.498616][ T5811] ? mark_held_locks+0x40/0x70 [ 116.500801][ T5811] ? vhci_cleanup_unlink_list+0x44/0x456 [ 116.503263][ T5811] panic+0xd1/0xe0 [ 116.504899][ T5811] ? __pfx_panic+0x10/0x10 [ 116.506805][ T5811] ? vhci_cleanup_unlink_list+0x44/0x456 [ 116.509332][ T5811] ? preempt_schedule_common+0x42/0xc0 [ 116.511764][ T5811] ? check_panic_on_warn+0x1f/0x90 [ 116.513959][ T5811] check_panic_on_warn.cold+0x19/0x34 [ 116.516375][ T5811] end_report.part.0+0x3a/0x90 [ 116.518414][ T5811] kasan_report.cold+0xe/0x18 [ 116.520399][ T5811] ? vhci_cleanup_unlink_list+0x44/0x456 [ 116.522512][ T5811] vhci_cleanup_unlink_list+0x44/0x456 [ 116.524370][ T5811] vhci_shutdown_connection.cold+0x165/0x37c [ 116.527002][ T5811] event_handler+0x216/0x570 [ 116.529046][ T5811] process_one_work+0xa23/0x1940 [ 116.531327][ T5811] ? __pfx_process_one_work+0x10/0x10 [ 116.533679][ T5811] ? __pfx_event_handler+0x10/0x10 [ 116.535983][ T5811] worker_thread+0x5ef/0xe50 [ 116.538124][ T5811] ? __pfx_worker_thread+0x10/0x10 [ 116.540315][ T5811] ? kthread+0x13a/0x450 [ 116.542283][ T5811] ? __pfx_worker_thread+0x10/0x10 [ 116.544515][ T5811] kthread+0x370/0x450 [ 116.546487][ T5811] ? __pfx_kthread+0x10/0x10 [ 116.548533][ T5811] ret_from_fork+0x72b/0xd50 [ 116.550670][ T5811] ? __pfx_ret_from_fork+0x10/0x10 [ 116.552923][ T5811] ? __switch_to+0x800/0x10f0 [ 116.555099][ T5811] ? __pfx_kthread+0x10/0x10 [ 116.556958][ T5811] ret_from_fork_asm+0x1a/0x30 [ 116.558579][ T5811] [ 116.560438][ T5811] Kernel Offset: disabled [ 116.562255][ T5811] Rebooting in 86400 seconds.. VM DIAGNOSIS: 10:33:59 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000003 RBX=ffff88806a433c68 RCX=ffffffff91d53501 RDX=0000000000000000 RSI=ffffffff8c402600 RDI=ffffffff8e46f920 RBP=0000000000000000 RSP=ffffc9000d8cf5a8 R8 =0000000000000001 R9 =0000000000000007 R10=0000000000000200 R11=0000000000018edc R12=ffffc9000d8cf680 R13=ffffc9000d8cf630 R14=ffffc9000d8cff08 R15=ffffc9000d8cf664 RIP=ffffffff81ee651d RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f16fde7cc80 ffffffff 00c00000 GS =0000 ffff8880d5dda000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007fcb8de27dac CR3=0000000026ba1000 CR4=00352ef0 DR0=ffffffffffffffff DR1=00000000000001f8 DR2=0000000000000002 DR3=ffffffffefffff15 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000001 Opmask01=0000000000008000 Opmask02=0000000000c00006 Opmask03=0000000000000000 Opmask04=00000000ffffffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fff0dc35d6b 00007fff0dc35d6b ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fff0dc36270 0000003000000018 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fff0dc36270 0000003000000018 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0a0a0a0a0a0a0a0a 0a0a0a0a0a0a0a0a 0a0a0a0a0a0a0a0a 0a0a0a0a0a0a0a0a ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 656c646e61685f74 6e6576655f786670 5f5f203f20205d31 31383554205b5d00 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6566646461625574 6465766555726670 5555203520205731 3132355420515700 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 747568735f696368 7620205d31313835 54205b5d35363334 31302e3631312020 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 313d657669737369 6d72657020726964 3d7373616c637420 745f73666769666e ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6f633a725f746365 6a626f3a755f6d65 747379733d747865 746e6f637420745f ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6d64617379733a72 5f6d64617379733a 746f6f723d747865 746e6f6373203636 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 39373d6f6e692022 73666769666e6f63 223d766564202231 2e63223d656d616e ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 31393878303d646d 636c74636f692039 363032323d6f6e69 202273666b636f73 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=00000000000008a0 RBX=0000004795c43f50 RCX=0000000000000001 RDX=0000004700000000 RSI=ffffffff8c402600 RDI=0000000000000001 RBP=0000004795c436b0 RSP=ffffc900039bfab0 R8 =0000000000000000 R9 =0000000000000003 R10=ffffe8ffffd79907 R11=0000000000000000 R12=0000000000000001 R13=00000000000032c9 R14=ffff8880373ca0f8 R15=dffffc0000000000 RIP=ffffffff81d556e0 RFL=00000297 [--S-APC] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d5eda000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000200000001008 CR3=0000000035964000 CR4=00352ef0 DR0=ffffffffffffffff DR1=00000000000001f8 DR2=0000000000000002 DR3=ffffffffefffff15 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000fffffc00 Opmask01=0000000000000000 Opmask02=0000000000000007 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0008001800180010 0018000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00008f0000509120 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000800000509120 0000800000509120 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00008e0000509120 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00008e0000509120 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00008e0000509120 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00008f0000509120 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000002300000022 0000002100000020 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00ff00ff00ff00ff 00ff00ff00ff00ff ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0f0f0f0f0f0f0f0f 0f0f0f0f0f0f0f0f ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000400000004 0000000400000004 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00008f0000509120 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2323232323232323 2323232323232323 2323232323232323 2323232323232323 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000000312d 6332692f7665642f ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000adc0de ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fbeebdf25f8 00007fbeebdf25c8 00007fbeebdf2600 00007fbeebdf25e0 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000000 RBX=0000000000000014 RCX=ffffffff87d158cc RDX=0000000000000014 RSI=0000000000000019 RDI=0000000000000005 RBP=ffffffff8cb7e7a0 RSP=ffffc90000648c58 R8 =0000000000000005 R9 =0000000000000019 R10=0000000000000013 R11=0000000000000000 R12=ffff88802734ca10 R13=dffffc0000000000 R14=0000000000000013 R15=ffff88802734c000 RIP=ffffffff820a5a90 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f0874ded6c0 ffffffff 00c00000 GS =0000 ffff8880d5fda000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007fcd7927ed58 CR3=000000002dd57000 CR4=00352ef0 DR0=ffffffffffffffff DR1=00000000000001f8 DR2=0000000000000002 DR3=ffffffffefffff15 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000008000100 Opmask01=0000000000000000 Opmask02=0000000002fefefe Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 3030303030303030 3030303030303030 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffdfc911d06 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffdfc911d06 00007ffdfc911d0c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fbeebc355ef ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fbeebc3562f ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fbeebc35793 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fbeebc35621 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000000034 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85a391b5 RDI=ffffffff9ba09b40 RBP=ffffffff9ba09b00 RSP=ffffc900016cf538 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=342e393330347561 R12=0000000000000000 R13=0000000000000034 R14=ffffffff9b6fc1f3 R15=ffffffff85a39150 RIP=ffffffff85a391df RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d60da000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000001b32e63fff CR3=000000002dd57000 CR4=00352ef0 DR0=ffffffffffffffff DR1=00000000000001f8 DR2=0000000000000002 DR3=ffffffffefffff15 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000001000000 Opmask01=0000000001000001 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 7570637265705f65 676173752e746363 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd73685976 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd73685976 00007ffd7368597c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fcb8dc355ef ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fcb8dc3562f ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fcb8dc35793 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fcb8dc35621 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000050 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000050 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000