last executing test programs: 1m23.499228868s ago: executing program 0 (id=154): r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x34, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0xffff, r3, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}}, 0x24}}, 0x0) 1m23.421020031s ago: executing program 0 (id=155): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x168) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount$pvfs2(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0), 0x800000, 0x0) ioctl$DVD_READ_STRUCT(r0, 0x5390, 0x0) lstat(&(0x7f0000000040)='./file1\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000440)={{{@in=@multicast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@private0}}, &(0x7f0000000540)=0xe8) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000580)={[{@metacopy_off}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}], [{@fowner_eq={'fowner', 0x3d, r1}}, {@fowner_lt={'fowner<', r2}}, {@obj_type={'obj_type', 0x3d, '/dev/cdrom\x00'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x40, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12) write(r4, &(0x7f0000000240)="c7", 0x1) sendfile(r4, r3, 0x0, 0x3ffff) 1m23.210802817s ago: executing program 0 (id=156): r0 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x202, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000200)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r2, 0x3b88, &(0x7f0000000000)={0xc, r3}) ioctl$IOMMU_VFIO_SET_IOMMU(r2, 0x3b66, 0x1) ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000040)={0x2710, 0x80, 0xc0, &(0x7f0000000340)=[0x5, 0x800000, 0xe, 0x80, 0x0, 0x100000001, 0xfffffffffffffffa, 0x102, 0x8, 0x2, 0x2, 0x4, 0x9, 0xfffe, 0xfffffffffffffffe, 0x7, 0x80000002, 0x5, 0xc3e6, 0x9880, 0x4000000000080, 0x6, 0x8, 0x0, 0x3, 0x20000000009, 0x2, 0x1fd, 0x80007, 0x0, 0x9, 0x5, 0x5, 0x97d, 0x501, 0x1fe, 0xdec1, 0x4, 0x7fffffff, 0x7d, 0x0, 0x6, 0x7ff, 0x8, 0x101, 0x80, 0x8000000000000001, 0xffffff7ffffffff9, 0x4100000002, 0xfffffffffffffffd, 0xa, 0x8000, 0x7fff, 0xec, 0x8000000000000000, 0x4, 0xbe, 0x7, 0x7ffffffffffffffc, 0x0, 0x8001, 0xd, 0x11, 0xa, 0x4, 0x19602c81, 0x1, 0xd, 0x7fffffffffffffff, 0x38c, 0x8, 0x8, 0xae8f, 0x8, 0xa, 0x0, 0x24000008, 0xdac, 0xed6, 0x7, 0xfffffffffffffffc, 0xa7, 0x80000001, 0x0, 0x9, 0x0, 0x4007, 0x100, 0x4, 0xe, 0xfffffffffffffff9, 0x7, 0x5, 0x21, 0xfffffffffffffc02, 0xfffffffffffffffd, 0x401, 0x3, 0x1e4b, 0x5, 0x75, 0xf, 0x4, 0xe, 0x3, 0x3, 0x4, 0xfffffffffffffff9, 0x0, 0x4, 0x6, 0x4000000040000001, 0x9, 0x8fc3, 0xfff, 0x20000080, 0xfffffffffffffff9, 0x3, 0x4, 0x9, 0xfffd, 0x1, 0x50, 0x1, 0x2, 0x7, 0xea7, 0x1e17]}) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r2, 0x3b72, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"]) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_GET_SYSNAME(r4, 0x8040552c, &(0x7f0000000140)) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000100)={0xf030000, 0x1, 0x0, r1, 0x0, &(0x7f0000000040)={0x98f911, 0x8000, '\x00', @p_u16=&(0x7f0000001b80)=0x5}}) 1m23.208861069s ago: executing program 0 (id=157): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@gettaction={0x30, 0x32, 0x89910f7975f42df, 0x0, 0x10, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x800008}]}, 0x30}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./cfg/usb_gadget/g1\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) socket(0x10, 0x803, 0x0) r3 = socket(0xa, 0x3, 0x87) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) r4 = syz_open_dev$media(&(0x7f0000000500), 0x3, 0x2) ioctl$MEDIA_IOC_SETUP_LINK(r4, 0xc0347c03, &(0x7f000000a300)={{0x80000000, 0x0, 0x6, [0x1, 0x3]}, {0x80000000, 0x0, 0x0, [0xffffffff, 0x100400]}, 0x1, [0x83, 0x8]}) mount(0x0, &(0x7f0000000140)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) syz_fuse_handle_req(r5, &(0x7f000000e0c0)="217e85b50586813ca8a29f0bdf5bb78bdd034138e14fa3a60caaf3caa33ef3ac5446d296c0b5a5b2157c895e6457352b974be5d8495b0cfa2fd9e415a7463985c43b2564de27eef8faa79255da6af97b1e19a8e727bb964a9a3fb93940601c7dc725320e1de1a10f8992426b7f0d0ff3673cc472b2abfdb32c6cbf971b5f7cdea13c5291cfc5287ce6a6cd32a5a8ca4ab7cc4f3a1fc30c0cb02053cdd7fc9d102abf87d5e1cef13cf43dcd650235f0026b894b6bb5294daaf514e9617d38da63fde1dcc8d40e1ca0493e90b7e0f0398d649e8f69684bcc313fc26d49911b0ffaaf4a7ab1086dcaf191ab50b635a0342f36c4831e232edc85015f78357bdc17ada03b92b7fdc851b4659fe1d258e3109eba19622fbebb132ecfcd1aa0081bede5ecb8787200fedd2661e5e0bdbce9b19452db8d2d986a97ab8d2ea573820b4d951ad616aac4eff6830600000000000000af7e7b0a87b09fb022b4ef85c199e9a99e79a4eb37fd58266f679ded3c0ea8dfc64ba57c3d319a4d9787a189de901bb28cd022c44a2024a617f7deee79cbfde0c0eeac0f18baace936480d489c0ddb1350bc5594a5182438e1278095a249aabcfe98de26fab3871d83fe674eb12a2538737fe416fe75473b6253dbbd23559b0be2131fdf644171f4684500f1bc0ebf91a8010f3853123a5e2357bb5fac0e3cc74ad6d7a3b2a4972481ca3ba3c1af3c18387849af8f21f3d81f0770fa667a9e07c1210106e9c81cfedadc39dc4d5668be6a0ac01f957a3bf8ae9de500201bb288888ac969660c05bf71dfcdff1098b5a134affd08d5316d0c4e99df5751e2cab9444b7655d37ff65fc0c1de768f4ebf01aa3533809108ed4853c2c0cfe07824c6ade0b1863bdaa464d06332402b30bbfc2599e16531e3e3afc90be506e114bbb3fd72a86b1f571a5380fb0c8635b350c11ce5538b3706b2a690c89de7b39588f92cf9a47d4f3b63bf789a61c1f5bec772e131a6fc079bc311b0c56ae75bc01d8c7437f296c2fb2974a822ead41c9f333d4834a4d6a58dbe579b3577a5998659765ef83b2efb601eeb7e7725925c4a1f6786d1abb971a3e18b624e303dd9b1b2a7a284e4ffd9ddcbe9ed0968ed3241dd9be99de9d6140668663c6a931bcd86e4cc5df973296b62ac7bba1ce6761c2f1562d3033cd1d731fe976ac29503a044c7eb66b8cd2037b2b66f6cc7cf5a33698f6bf4d602741d25345bfea19336599fec791a0c64f13ba537bc156e62c8eace5e117f2652b2851800064ab021ee2addc40ed8b3c67ad0c98f71de6e7e68112fa9d689141c6d5a15da4e472176e77315df003f97f0db3bd6b7d55b804e5f809c3f2773d1e4db7ba762d22715889dd09e9d8ebd87ade42da1e85a98524f48777773a95c97fc3cb6e7a2416b871164a01a7ff32bf444bd905176f5a0a87d13b37499aa33b38ce14720980012fe0dc7dc07061eff65f7a66df8c16489c99de167feea2527869be27520192e3ca6c78b43ce4dbfae087d4e1785fbd0ab3d5c4f2a8c178dce6c32c73ba6c0d0d2767b938559f66038aaa6ee766e568062a56556b2dc5d0064af675d422b8bd676ddc236d4d271518cf5ddec3c3a230e38377ee08dc25d5784db2cfa6c779de55afb6f82e49d56e79c488fb9bf8ad771e518b03187e07ef8bdd5bc9bab3dd6dd0bbdc5d04adbe8ee210069f0ec51759b102597063532168935731781e3281e0a971b502fd8a563ec0724571fb61f0c32355956b3cd8b9bc3279eecdfc81151b2657e58305d332a711c05031b93d03a233d770d4717f0dc9bd97f807bc343f806be3e9030a83b6dc6a3d731dc1daae0109b73c00386a379e84fa661ff41300a712af3b1f9a2858a5f5d191c5dde9f95c250277be32b760b95f453de22dbd6dd970622e3f5d6830375850a9b2e275a913e48f808d8dda5c07d32e464179257fab8ce92e33f086484ff8448ae413a0e1478dfdecbf477b26d5aee75cbf1f2a5a06079cb534b67718ebb51f704985c19f2580241728bb2faff29ebd81a67f6f44e61ad42a5da18f939da47ddc52474871521ac733da45cf1a521ab3196996553261ae53478fae33afd36b7e2125ad7dc38b62657e35748809191997377ed18bca857822f21e4e66960060ab48539725e316e1f8244b35e805cf6f01b32c95abb527a1954870d9d11cde762e19788b2ac837f7d0726231090a22431366ffd8b8fa12a8aa3c3793c2970152fe7f75955d34580e00049628b1bfeab69378a38106f7451cc7e3f8336966a6f2e362912ebe34fbf5aa33d56bfe5dfe4c3c0e2298ad11053bb83816c744b3df38aab86202a2362543c511ea66a0ec3c4711c626cc4e377ee764c9dd51b7dd77fff5c2783bf403e1ceac5ce7dd5f8e4a95a38d491c690d6403e83e899d2ce2dd44f309418e8381fd93823206811edcbab2bd3d3a210b1c1392fe4abbb85eab303792f0dc393d2cac4003f30e77cc8d7541e532ba11397670f280b6f9388cf61108a56483488c3fa7e358eede7b5314549f52bb4ef295fafa6092fa8dbba94b27380258f4a4b3ee37185b16fd73c75b730d46a05efa868cc90b2b3617cd7de1b3de758d55cdc53a1f2ddf0211caa9a5d9a864becfa74e9a47fa31d7856a9a30bda4743b60ab4d4b36d588abcd0b4dfd2d835d10d5bef098e2fd0f617fd59468859cd13664329cc011ac4e677336516d1c853e8c5a37e09c2f7168d78998a9584ce5a666f418f9fba55857c6e80caf101daf48566c3b1e69bcf5b32bdd756b39da5268c1c38a859e8d0f80d16cbd8db33b1d3d4784259234733511701eb5c889f39051a499f9403566199a8b0fe06ec5c41beca27115befebbd1c0281a3722fc2d77d092c4509fe5589525c868be4ff1e2df53be13e28d725a7c1da6905e1ee0b8c26ba5029763e805c1946d404cc60b65ea516bff59d7258c8a5fdab53123aac6e12e6c4ddcbe01ff2e7950aaafd6970b5b05f45ed1985aa2322fed508850aa0674e0c855f58a557c301e8d1d7d60599fcf67a0d10c5064fcdc1df9759cd81c734b9cc5ac00773890c37f719288efb6ab9903d11f9d3caf78cbd885fb45cd52c00b04a421a76c38aa3f75fef04b48840ee05e49f80b104f086d3c5ffa517356030101e9752a600a6f67399897dbc3698616508b6a70ab8aca3547a798a1716cebe5d5af4a366bc77848470be6bf91f4c115568870d830cf1ccae377dcb7cdd6b5b9ee64de6529a0cd683ea80569b57d81c0f529bf3d6df3e930d3af6585911d46d5d8954c97747b05ecae1437af3ac9a3760fa5d60da3778b040c40259ee7f632f8db2da53c703365908d6e4281bea8ecbc13d88d87533f048fd5629937a5e79fa0bf993ceb11304dfb210e68a39cb53969203fbaebe084c61f3a9c38b6b89791a2285c4584ea977d47e31b7d4cf98b19b9fbfbb0229d3033bbf9973f106a93952126599ee4574bdd47cdfa5094eb970b24b9d44b7041a422ec06fb698a7c0638731bcef5354657248119095b484e90d96021e79875c353076ec8b96e2c3448f6575cb4cdf730cd37189ccaedea1e8de21a722fd72ad28b38d11fd0a49007eeea677c5aa16ad3e4577481cb848bc7eb860e005a9ffccee69670941c1d70971d6000000000000beaf37a02306ce348dc2a841d6cbaeecbe7a0276cccd9f0292e59f51aa99f16430991258f1c208454ac122f9b5c43642b326535c8a795757ddc10cd4ed8391d6cabc42a584e10d93988b6e36ed37bba5d7bbc6ba1b15c77945587a50e22d71ed3f6465a8c7ae90eb21e71f31c80e8dfea7711dd12984ca0e7c07c481639d87e249c6ebd1ca43715a775ee9b15752b273ef98e0d352e72a13ef21bfbed0fc9d5d5bde441692478d9e40bd59013fcdb55aa3323328a9ea77354b1ec7635cde81fae541676d06b324de2efe1fa286bd1faa6b9890fae9800ab4cde88e6be93c733537ccaaed0101bfd2416cf48b17455c1a9dc5353c48c2d07e1daec97f785850ff72e4dd0092bf7d0da19a61075fd395fcf86203b119ae1de4024c2002367a316a6443ff723437c6bf4ea33b07d8b81dfd56fd4749d6bc3fe6b1a65f09479b17d04f89a93ddde114ae2ffad05e6fe15a70145dca7c9bdd3b1f6706e9f78ab7af02553586a7fd950974137cb974ad4307a965efa529aa219d0f4f5075d10b3442cb02017af4b6519fb49d47c9020a3b12bbd391c442fa5ebdd0d3716ae2442604c678ce4af0b9dc21f66685b4c3ba7fbba6a9bcd2eeda1eb216185bdfdfc6971c5ed277b165e07dba10e7e7bd861f5e0755fe200000e1f7bace178011853c740294683f15709ff2cfc42580342bb0a1408e78658d1aa49aa87f35c89eb17a6b99c18ce6d6c6d2fc46b98cb4b0ce4f8a22852fe9d068977582c29d070f2d533f47a1d069eccf5ff85006c324f342ffa8275a1df254fc7c7e3844aef51b00b2ef655b5fcd4664021f79bd9f118665b24668053ab692ebffb4ea4daa2ea4fce9b32d18204bfdee826a11c9e10f48bfc338a46e7d58ab52749d979b5ab2ce630e9fa73842774896ecb367e8d1724a2a964177f5f2555e046d0da97d75aa1cb7869b11dc781537482408f1565c41a7581a00cbdb823e8865068056664ee1d696f02b6dfa0a0e659a9d6a0ad4fe378cc15a2963c4d0f049dae9aa8c3617ab692124a741511be9f1cb445351312d013168d7eee8f12d48126757ca06bee5e43f05284efe9c6cbd7b1f623139e93d8fcadd7e2fc53cf4c00f7fb0493292d753170cc67af99ac69757d71cbc54b1c1bdaa96eb73eab23a6163d5506aac1def5190dd7f73de5e27c8df56fe3b5079b1a28032450e09022095098f26d29d976b6891febd0346dbe917b725aa7dc28ce70c3503cf7fb0257a23fd179da04e141502117e39f5a208b17dcae08a3b5ce63f95baa61b2b9dfd358ac11e532b9a188e317b91c6ad11c67f9c933be582bcd87846088c98e00c26394292d2265f27595c45393210ca03211108e686fb0ff569e3085584daf7d4d2eab0380fbb3a7a5a25730997f59cf465c64ae4002c895e2a7de0ad735c366214e3df2bec29012324a298e4768fdcb560c07839cb4479c06d4499a7f984e3f4a8593fab553d144851441c6e91759b8e97b4a625effd6a5a197995da366bcdcff8bac79838ced68b6c31d242e60bed0853f150d103c81f2fd19e247d407ec00156c4b4e384f1a6bb86424f53fb9dded096e9f75bdc8c6d8c2a4b1c4f8afd728976c5ba804f9a2d3f5f94f73988431621808f67f35d0feda71238084411276150c0fb067a475ec2800bdb5b966c968187fccb7cefc43ecce8392a14962ed82eb34b7d118792efd0cf67061c43f240c5f82d723730153d38290968a405fd6ab4388079bc5b5b2392ab4f1cb16b6323822f174a324624c322224bcc709d9fd96d91e6bb244f510ed507d4d49a97330f6e12da2a1a274ff41b587f664af0ff775ab7379e49dd3f4c9ae00f4e1b309724f1defeb6bed948c047e94688d0ddc8bad8605e88fe810f9a89a072c4e2b6feddad1feae1ac92dc8b1f07b86d623b1ad4f3df359b03b829cdcede14b6dd29a58e7c5c6e1340d345b62a8ff8150d2dd22a631bc557f8760c26be00647d62291504f70c4f0d1c919d0beede001d3e8d24fc2ec95be1f33c44c7bb0b9764c9e5c38405bf7788da5c7883af3c31ad5c8ddb7b9f84a792d50b1597dc6454a2bc1254321f0a9d633437310fb25db7733c201371f0eb73506f4ecdb58b4c3e0b7a223ff20dbdeafd449de5968078eae4d758878fc18065a20c519a505d3bb07c4801634dea3410824e5f35d4caae801bdd2630141b944c1cbced4eaf1c74b4c59f7d00c97a7cc94084cfd84e4104c317a39f0b8ff9c4c8afefcd94833aa10fba9268d364af3e26a96cfead99f9b31e53725613343fc102c90d99bcdeaf43aa5052d9caf68953a0add5cffca28d3b23ae5dd6ae898325b6adbf95105afe7bd415839ea26db9fbd06b7de8747780d779f9589994e3d4efc717a5556073965b0fd35f2499120481baacb3f60563f68da9bbe1096484855b842b6b5f4d1e3f357e8001572bba4b366d9eeeb197832306af70f24610c6bb95cf58e484d25f4f11f2afadc5642a92717bda44cc5dba5d9e85474f8b49a042ceb8f0788bfca8168b54457a44ee0816bd4be191d18f67389766c41377da920036b1220ae14f05a332b59c5ecf66f50c4906834cd12a86d925dd58cb9ce7b502faf6859bdff36bf99020748307c38dbf110ffaf61491b7a5866e7f57314140f696fa4af9be0d83a1ce88b9eaa66581471aeb1cf15d8dd7362fa9f540515025aec1f2e98b141c97829d8a3edff5fb9f6881dc7486085658434504a5f24c597bcd1783ceec8c82fd17f29c5cb056764102bfd174aa82e17f7a4fc8720e7af98cf23a1dbe64dcc3d3420b4386e58798e0e0f46fc4feb11578ae384a8badd3828fd5118d6615fad7558387841199084b08d20ba3ebea818fc13d502f303dd2c192f3ee536e17889419c6f4024e2d130f4f60b956934df00fabe44739b1d356bf8e8cbe4f20eda6686bcbb4000000000000009e99e65a3bf002635ba5f1bd724057e1809976d11a87b6d31731577b0a8ff572ecf83a23807673e4e475f7cc0a96840e25b31c4b9064eef35502b681bb7f2c74071848aa2e92d73221e965df1aba81169436a809400caa4beaf44972411bcaa1770177b964635e9b45b42ddeea85f5643031cb421b8b90f95200960dc6b008baf4c1efcd9a267cb136450fb3c38bb6030589de0d666090c2259f1b4cd97083e092e8f28e617e510f66baa15d93111b0696a12e590f0b14f3834dce2a50413b8aa67c0a4e8971572dfd81dcaa2dec1ff79a2248404af4261c4d238e55d6e5c613ad9a06651cec8aa76fb0e458919795aae4e5c2f29b0f4ee062c83a09ff100bc4f95d3dd1852a8b727afc2b69e82d648f6bf67e6a2c9b3f13550a53b6219cd3c95c5bde422fd5e554585f81e3c5abd2c32bdc70c61f298cff392af03bbb12ac42590744eddbf79d85591a152d5b4d8062262a222afa343609e7bd48344610c7ca1d17837a33c6e5cf2843bfe65af61dc597fd9c56add05defbcba3735a2784506742b27dfd3d2301667d257c84f06a79eb43fbaadda1ec74a39ef30b51945d3d0ef217a3b9b3d96bf6c1ae06d9cfe1f44d37c7306aaf801ee99a599975833799de20b2837b0684f5af828401a83cc0f530e746997d187894ac95a3133216fefdec90ecdca21c96f76e5bf32094e62d700306cffe229f02f96eaf6956bf07278891aa8e4740813be862bee76607238a9daad12f68c9633b4f000703256e0fffaedd88f4386472578b38fc11dcb7367d7489bda56a78c94f3140c8b1abf2960d5ca0dd438eafd47fb499f6a9279f4eb5546c229bf7cf27cd655e91efc0c845e1afc9791afd87bba759ef1486493e99d01e99afd017fbfca764f690abdd2201dcd21b44164b38742cb27866aba9077b744c2c686191e5313477b7baeb7fdeae840b250e8339fcf4b709a5b6706972bbb48458881b4b68c228867a096454a36d869089446a3c784841d4e97aacead4d43c24062a15a8f3506ca8c860314fe4103bd4d39c090d80df4bfd773f468a71b332bb18c9416000b0b79d14369e922fa5f617aff95508c53287d0c780f2b4902f47f1c0741d4f919c64fc8198c995caefca90008ab94d337c41fd4e89a937a972bf4210925b3d2db1e0b3ec73d5b24308f5361ef0a8a3aff1e2c88bff171ddb2c57023ab709c73f3fd58060d99c7d04b7915e1b83c26ebe5dbaa3be454157b77b0f95a10ed9c028f9c5748684da343d61972e73ef35d82638476481395e62e9840465a20ed6b55ef42557869e071fe7e52aee1481fa12f4baf60c7dea1d8da27e51c76bb37a67cd3165c3865797f8a125e822e15b0c5749de618a62c3894e1a1e3a8c7f75001dbfc26fd62540bd5f58d2116f357ca73b157850d722b3b43ceac1b22849773b0c08e263993a86215e2e3b670c271f9aff66da80a991516e65d29a5586269993aea24ac5bf6aa5a1a5480b25cce76ff6914139d925f1b270102f38084334bd105c50658330eb3b1a96045b8f46397eee5e5db2980e23ff7aa59075a8083f8da0120a6f090a512d9995551bad82eaad75e12817f8b3e235ff93a08f454c3f3afc9bd1e99cbaaab16abf57a729ed2ea5374e328074fe709861916aaad610dc1949ae917569982d42d54108f6d0a532e59d7699cea8bf4e3fc5a66e9d399700b079c94ac22044ae6dbae5d3942e1b4076b10213749b54d80ca0d682713481c2c1630853e133682b0ea0bb4ff6e045d085c03881ec84e83cc0f9c4cacd1e3dc7a71e8c7c49e008820e2382db7eccd726dcb12800cffc195faaffa409e2cfcf94425af3b19f60fab2f5b601c3593aeeca90d60bf6f41fbf3a07808689842f3be70d08e9f1ade2a196330264206b1cdbdf3dbaa13bac630a6021b59c593716a80f8adeff1f155fbc44c281aa4b968d480184967554923fd08b43e239c49d0d7df6f7ed078d9d147a5cbbcbca837b2f55d6e888200813e6eb4453e9142206f93a7f89d264f013345162564aa49a6fe0f51184ccf9a0743df5873450b06d5ff90b6c3cbcccb66f4f1998eabcca5e0ffb452ad32f2816f575de99ffb56260d339cf2a2a36e9fbd8e911e9b240de3819afa860f8998940ab55c49189718a3f445c8254a74b2f3ca7340b7643e0d1a9f5bb22bfc1ba134762566df2af9bd5f12d36289aa1348e6966837260e79390c9f205b11a909994d21329c3ce4c33d0100de5aa63caae95de56ca34fff766e9589ae364b88e482e62428505554a6ffd25e28356531a39c393af359d80918fe3d7c0333db79a7a45d9afcee10da3285434a11cb3e1953348c02a41aa763cf92a34fa69f4ddfd992e3156c3163cdccbfaf28bce5412e744d8859b44d2166ee9ed7fb15d22a96de8301798216850ecfbeb2a32781082c1a6c758b98e8f2320d9b5cc1ae2d3b8d22de4e4bf23314f987e5d59a34c2a80177ef111b3b0109ff4af1d198ac058746168796a60d769ba4b53bb791e3a8bc1baa73b0eaa33830776ca8a810ff99f67f22de4fdd566823b4bea4f7ee38ccbe3298b04d567a6f4cbad957f6a2f4886af4ba357f2f4cb6b8f01be26120e83c8728da8ed86057b44d27705e9bc31b676c8bb0bd70ab478525b071388cd4b6be2c9ba3314323a938fc89548703599c6a78fd770129e3bd53a9a71e6b3b4fbbd7f8fd744c7a12a3cdfd98ba206b372ae643640f1e6e78adc23f859493f30fc560f67ad91cd988074f8a5b503cc0b332486696cbd786cf7556744762ad2874771a78a79a51946fb59989a19d3056aae52d988e9db95e9bb7209398ffd1b5301d88909131308377705089ef4747918d12402b54fe246c6589caec249bff4ffee2b6a135c108ea457bf3cafcac7582737ea7a1b65dc24bee4544cff0f6ce806384f6a28b7af0251a1fa5b4630e4710ff652a3ee72b0e6259f30ec16a52dcfeff64fb1b6f4c10c06e998ebda1cce43f926d82382a86d7b533fd7a65eb54ae6cb66276199888cc5ea4216ceb04db6bf5ece68a20b645b7792aba12702397cec110f9bdc58aa6819b7605eff0e68ce2a83d4f99319e391f35d7f810714d97318e01c0d91d8fecf3a1549cd51295da3b92c56eee965cab7db912c3fba86365693bfd2f357c4210737ce3697145852195336cbe89e6b7c0ee8620715ab330046cc2faf98bcce66d764b42b02451f665cb906558da6ed1c0a67e0cd1259dab5536e66988271256eadca86edf0ce071326abe01a20937aa62db7460d013dcbc2fb911de352cd5dc4480a09a393777e3ea7eb456feb9b94b8cf1df36355aa6bd635939e1981130c52d4195f90000845c0e0717b69148a3d78af78370593cc6ed18398ce7a36d1b2fa9a9b6041054e2899f135263a49b43d7cb207cacfb9cdc38beb4c2ec8edb128bab00ecf95906c82814b3b02230e1f94cb2811073d75da43d0d7c5ae5ad54d594a27a513cfd2c01e2ab33f4a9682d64cd4c5d9ee9d9c18684cd670f49849b8a3a8eefa0624bbf84fcea69c2d768a832f4433a563936131963f15de4ee43b6865a033b0129ee6ef26e5070a3ede03cefdb05dceef804f0aae68a59db56c64f5447ed9a2e865b5b81eee816ea18b1efbede2e71ac1dc45353431f5bdf361c1bb0d2fcf74b2af95ab47aec8563f60cceba7295a21b58baccd076b49faed2de8e4beb7c10694f86bf4aee05f5e64b21c4652eea9aa71fc3ec25205b5d06fa6c327e64df753cfe64233972639aad0a8f452379f1f598fb49e044d9572076d75a4726bdc8f03a9c51b000ea80cfb42716cdc23d990e5adf071a711b0512b2151d4c51465d73f0a90194fe71214d0ec867e67e5c6c57ad4fb76217559018e9572082c6ec99ab02c056c5c561efc254f6d3a551cff108195b74bbe21ccaab79bc942d32d976deb15b2926faa5459a9a34887555c0793912f93a60bb8a9fdf7164c6fecbdccfa6318bce178584221d1f4a445dab00c4a7acf28104bee65723141a4e2e31ce51aa54158e0ad875d852c89dbf02d371c08217bc84ac8ab8e6af7f5d81d8b428e8e1e4cb7c0cc33642440506ac4c5f0c91fa1d3a75246aa024ec5e6f72341a500b9308862ba45d588b1a5fa903a4dde04054d50d1241e0682c7479e237642168f9918fd133c0c32e570b7775901492b3aea72770f6f86e6443b9b04c384693ef7f2f085ae08c767f231dc8435ec123db3de1e44ae6c88216aaae35b23583152806225cbea39aecb768e37c8ef2635a910d1657fe5c32fd8415b1afe3d1e530fdcfde0173623de4f6cf7bceaa9e8e7ae95b865289b8cd640721a07f48895e0af73acb7610253b4267be9488d9922bcb183a6e8f0b4d549b53ec3166a3e5ce9739ef650af8b10600a94f1afb7cc281227408a7e48b29a86dc9d2bd410c54465dd7acc1ac062b761bdb298a9d609a71b4b905d7dae8bc27f24d8f1e9acb5501934da6c0807996f61252b60e04105e311248c1b7b0cdda7ee77db36a507bc4b476d9d88b7ece67c6bbccee8f6a85b0f1d7b70a14ea4a9e033778ce05de5503dcff0ec317f7ad2f40e773592e04d2109d757e8a274ecc4605acd2dd29173476dc2603507ae0486e1f3ae5b057b9c4f759fc071d9e1da59ee87343d8dfbad6d51920228148b2a9ae5d1d7e53cad8c5b09423c90c2abd098ed359e9098291ebf7efd5d7584c30541eb63e85553068e62e07bb764fe81b2d723d90d280a7eba95c581865c33d2ee5d112b58a1640283948379e894109c07eb39422cb55c9d690a9f55b9853ba030db2234eb3636cf2c981a907d710bfbbe666e701baba9aee635e664e83603662a8ff41ac146aae68df29010158f453b2027d54dc6976ca29533f8fff64f316cd3fd7b2f3bfcf7c07107d9725375bef48027bf27fa17c6eedec5e651abf98efdf675761397abdd30c8aa263e89008e0516cd199e10b60b800", 0x2000, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = socket(0xa, 0x3, 0x87) pwritev(r1, &(0x7f0000000380)=[{&(0x7f0000000280)="ac00b8dae69a65c84eb45b1e6afb01e74a6e5ae1d946f07c91fdf31d027e533fa6d0e359a220825e66e26e88b2d7329076bc1bbdd46700"/67, 0x43}, {&(0x7f00000001c0)}, {&(0x7f00000003c0)="134f8589c3f94d83a513e584fdedaf9c3e3b8d43f963c8a43abb7c240029a527d1c5b8f7f18be2bcd0087990650a0231a4ed59d3464b74ce3e494450f11ab4d82fa7f4814b91d7a6222b1e1531244144a2cf02584ab00ed5204f6a4a5789ad7e1e64e55d49890f08e1990dd3eff1331ab25d33188e4cc103682492f38b04922669a006d9e4e6d3a237d47f1de8683c0e7b91fda575afab9a308bd29000de8ecf165190a01de8b4a55965aa5407775170ae1adba3ead2aac866ef955e34a79eb186146151aaf719000000263bbd8187d219f38c92d7d42b91047750659832fbe37bb30e80599e5522af320f03505e2556f7007f7ae132355198faf3c3e09f69ea88439ae1f211ce", 0x107}, {&(0x7f0000000340)="2ded88da6f36bd6bc41612817773c94471a7accde4c14533766f0a839035438dcdb3b52ae5", 0x25}], 0x4, 0x748, 0x200) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000540)={'veth1_macvtap\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000040)={@local, 0x40, r7}) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYRESHEX=r2], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) close(r8) r9 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r9, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r9, 0x4) 1m23.080764962s ago: executing program 0 (id=158): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x4, 0x7fe2, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0xa, 0x17, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf092000000000009709010000000281650000000000000018010000646c6c2500000000002020207b9af8ff000000032e9100000000000037010000f8ffffffb702000008000000b70300000000000014000000060000805f93000000000000b5030000000000008500000076000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1m22.770206519s ago: executing program 0 (id=159): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=@newtaction={0x8c, 0x30, 0x871a15abc695f91d, 0x0, 0x0, {}, [{0x78, 0x1, [@m_tunnel_key={0x74, 0x1, 0x0, 0x0, {{0xf}, {0x44, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x40003, 0x0, 0x1, 0x200000, 0x10}, 0x1}}, @TCA_TUNNEL_KEY_ENC_KEY_ID={0x8, 0x7, 0x7fffffff}, @TCA_TUNNEL_KEY_NO_CSUM={0x5}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @local}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x7}}}}]}]}, 0x8c}}, 0x20000000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, r1, 0x100, 0x70bd28, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x14, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x11}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x38}}, 0x20000001) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="5001000010000100feffffff000100006401010000000000000000000000000020010000000000000000000000000001000107164e230007000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe80000000000000000000000000001d000004d86c000000ac1e0001000000000000000000000000000000000000000092010000000000000100000000000000ffff00000000040000000800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffffffffffffffffffff0008000000000100000000000000008003000000080000000000000029bd700004350000020001002000000000000000480003006c7a730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050021000200000010000a"], 0x150}, 0x1, 0x0, 0x0, 0x8801}, 0x80) 1m22.717090301s ago: executing program 32 (id=159): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=@newtaction={0x8c, 0x30, 0x871a15abc695f91d, 0x0, 0x0, {}, [{0x78, 0x1, [@m_tunnel_key={0x74, 0x1, 0x0, 0x0, {{0xf}, {0x44, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x40003, 0x0, 0x1, 0x200000, 0x10}, 0x1}}, @TCA_TUNNEL_KEY_ENC_KEY_ID={0x8, 0x7, 0x7fffffff}, @TCA_TUNNEL_KEY_NO_CSUM={0x5}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @local}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x7}}}}]}]}, 0x8c}}, 0x20000000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, r1, 0x100, 0x70bd28, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x14, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x11}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x38}}, 0x20000001) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="5001000010000100feffffff000100006401010000000000000000000000000020010000000000000000000000000001000107164e230007000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe80000000000000000000000000001d000004d86c000000ac1e0001000000000000000000000000000000000000000092010000000000000100000000000000ffff00000000040000000800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffffffffffffffffffff0008000000000100000000000000008003000000080000000000000029bd700004350000020001002000000000000000480003006c7a730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050021000200000010000a"], 0x150}, 0x1, 0x0, 0x0, 0x8801}, 0x80) 46.330763573s ago: executing program 2 (id=429): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r1, 0x0, 0x480, &(0x7f0000000000), &(0x7f0000000040)=0x40) (async, rerun: 32) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) (rerun: 32) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x2, 0xfffffffffffffffc, 0x0, 0x0, 0x2, 0x401, 0xffeffffffffffffe}, {0x0, 0x2000000000000}, 0x0, 0x0, 0x1, 0x0, 0x2}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x0, 0x32}, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x10001, 0x0, 0x2, 0xb7, 0xc4, 0xfffffffe}}, 0xe8) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x1c) 46.231121059s ago: executing program 2 (id=430): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='t', 0x1) (fail_nth: 3) 46.230893437s ago: executing program 2 (id=431): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x400000001fc, 0x181181) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000280)=@urb_type_control={0x2, {}, 0xfffffff7, 0x84, &(0x7f0000000000)={0x4b5a9da54893e123, 0x1, 0x10, 0x2}, 0x8, 0x203ffffb, 0x300, 0x0, 0x2, 0x20000, 0x0}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$PIO_CMAP(0xffffffffffffffff, 0x4b71, 0x0) r3 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0xf1, @empty, 0x19f4929}], 0x1c) listen(r3, 0x100) r4 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r4, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000300)="d9", 0xffe0}], 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000008400000007000000ac"], 0x18, 0x48d5}, 0x8050) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r1, 0x3b87, &(0x7f0000000080)={0x18, 0x1, 0x1, 0x0, r2, 0x6}) 46.140811683s ago: executing program 2 (id=432): mkdir(&(0x7f00000020c0)='./file0\x00', 0x1c8) (async) mount$bind(&(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x315901c, 0x0) (async, rerun: 32) chroot(&(0x7f0000001140)='./file0\x00') (async, rerun: 32) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) (async, rerun: 32) pivot_root(&(0x7f00000000c0)='./file0/../file0\x00', &(0x7f0000000100)='./file0\x00') (async, rerun: 32) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905811765"], 0x0) (async) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) (async, rerun: 64) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0xea, 0x400400) (rerun: 64) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f00000002c0)={0x4, 0x48, &(0x7f0000000240)="7c8cf59e93eeffd203d06f8606a541e4138ea23c3f591b6a103587cacdaab269672dcea06cfd4c41c113b91f2d8b36617d7d74bf028f2cd3654166735f50ce53f89e32aaa61442e3"}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0x0, 0x121) (async, rerun: 64) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) (async, rerun: 64) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x1ff) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 32) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r2}, &(0x7f0000000840), &(0x7f0000000140)=r3}, 0x20) (async, rerun: 32) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r4, r6, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x10f2, &(0x7f0000000c40)={@multicast, @local, @void, {@ipv4={0x800, @udp={{0x37, 0x4, 0x3, 0x3, 0x10e4, 0x66, 0x0, 0x7, 0x11, 0x0, @broadcast, @remote, {[@ra={0x94, 0x4}, @lsrr={0x83, 0x1b, 0x12, [@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @loopback, @broadcast, @multicast1, @multicast2]}, @end, @timestamp_addr={0x44, 0x34, 0x2e, 0x1, 0x1, [{@multicast2, 0x4f6}, {@dev={0xac, 0x14, 0x14, 0x2f}}, {@empty, 0x5}, {@dev={0xac, 0x14, 0x14, 0xe}, 0x200}, {@empty, 0x3316465d}, {@broadcast, 0x5}]}, @timestamp_prespec={0x44, 0x1c, 0x62, 0x3, 0x7, [{@rand_addr=0x64010100, 0xd3}, {@remote, 0x6}, {@dev={0xac, 0x14, 0x14, 0x28}, 0x2}]}, @cipso={0x86, 0x41, 0xffffffffffffffff, [{0x1, 0xa, "2c75344325d60412"}, {0x6, 0xc, "4f0a39bc97f00f7dd55a"}, {0x2, 0x11, "e41cd9e657dbd5b7621c5e63023578"}, {0x0, 0x12, "8f10a660820c0a894bf061087c7cd878"}, {0x7, 0x2}]}, @timestamp_addr={0x44, 0x14, 0xd2, 0x1, 0x7, [{@rand_addr=0x64010102, 0x3}, {@rand_addr=0x64010100, 0x4}]}]}}, {0x4e22, 0x4e21, 0x1008, 0x0, @opaque="0c384d925868ca8e5721832a470b2d8448228858be131f669fdc73d369d36599088da435a3b007bf412c895da42d095377b356c826f87369706d94fa5f02c5e31b31a9c34b46804b2f05a415b5a8cabc92415c0e22e2326aca00b04d2da95975aefe4835b031581b032d5965e0f5abf1f21c030872e17d256082af4b075acafe0a01d2f2c83823a94288f46553cd2d5b9fcedd4711c0197d5a32d7df73a5a31e89774793b2f691853233685d02b7da66cc784d646259f03222efda6c2e082c16b351a0fe099f5ace2a0087bbf79db5d9c68352cc5fbd865d5f3b36c7213df17e1d10c57599ae4b55feb237b54ee9ba61b8e6dca084c1dd8bbb64363b42662ae26aa444520c2ebca73d49b52bb67943a29e43f64f0f011dfabfe2a81d225a727f1851e37012b3d930aa9a27603d317d8f5aa77fa23ac84a2a885138d293f88805f6c7b714821da579b2fb03bc49f4a5e19b2d2d9d1fbdcd3b63ef6faa6c245deb5fbe367e8287ed3550846f2d81a444a0c3f3be41e0c2b21cfec8c1676faa5679f7dee083bddcda873f62696e212de2193e100c39002b51dc7b186fae55ef0ed0e87158374afcd7418fad387b21feb78fbb006dfa8813c821447b27005583622191776af21af2fb02cf7fe7620b4eb4dd622e22fbdcd2d1ac095675bcfe1c74baecf90b36a5a6b5a2ad6a75f25f124d6e5377f65ce545a2a5b7e2ce119ca5c48f181b023b0387f7560aba09982f0760baf31105c75f16b707989e5131a88ff1d3fc2ad5c7a102028c526917e3f86bf8780155975df0fad1c45ba2fd8f8fe4ab4ac4c14259260051121388a7511a960fb687d248421bab9c5df205c732bd8e78b11ae9c08505ea4c245de719b6b599a9a60ee717f492a1ee8d11c357d800e63d4c2d672861f1e782f3498726659578fdcd2c4ea7077b31454bf4d45cc971e611fd4ae7d35880807780e21f2d255620aba01144807b1a7d66a14140fb65257a73658d04361d2be02ecb4f9de107f60175553d9580ddd398175c847fcaefbcd54dbede3420ea34007b1335febcc9892b781489c9401df6be2310d5844ae9970230d7e69a0aa95377cbd4d82040d1c8770c9008657f6594f3b91945e52637a05c1e130b940f0e67b9e4e2081f5a49cf5e68b7574ff73485276062c888303921eae91589c7ca300c3b50cf7693574b784a456430a061c61a048c0c774ac4e9b744787a5bcc245470d753daa6a7317dab013016f51038cf8623e50b0705043c112719c1f7f15729a76bd198273923950a7d7697f3ad0a622a3c120b44815ab95d1d7ef495e4622a2421aaf746f891a5bd16c8ac2b7884f3164dbbda6f52c99a49b40b0a5f48c3020307b2b625b16d7c09691a36584c4617e0ddfd2d94100551b24c7a6d341e183db9ae1f57bfeeeeeb1c9fee8bceeb6e211685ddf62ca4ac12b898fc6085e2018b19ceffb3bd0d006be74f92ebd8549593bc1c990f50002195552b989e0873589a5790f589992d473186543981422e8fece13865ee387edc5865431954b162859cdb3ac90dcd3d7a8f4b6e583d8c7f23b075aee007b245a4f4f03cda5e7f32dc644d115b97c780e2f4f117fe6b8b6093846a28dfec79f8d8da0d9dd42d41cad8dad289af37751fe9fda7099f1b178f4f472478302c3b24c8b37ab5c83a58350631637b4f2593ebd2744f6dd406c6dd267ed6c07e9dfd0d2a4e3335c8e396ebfd8add637218c289087f33f35a1af2763c56a3f294c47a7d896d6347b6489e81ae38fe62d146b4ba759acaaf1aa7bcdb25946efff9142c1bb75fd22e9c3972a244eea18d06bf1659ca023264390ea5055d1b08806f41f3b87325e65ab41ff00e72c073eae8e8ad32081797ca81d63389512b336eed7a08631c0406d31318b66319c4ec5c4c9aecf4476684dd57a21ef17f7c5bff4a9e91182612927c463fd7972977274083b928f2166c6bfdcde3c4ff977058062ba17cedb88250102b0aff9b6ffb3d4f0ae70bd341a73975552b7c38fe5e0132ec78bfa5580ae7901e28e2e1c05b837448a7bf937040fec01af8dbbafc2035f088c66f58d58ab9c8e72fd2eb329756299b25442f8bd650644cbdf4cebb84adc36f791ec6c519a64db4520b49a0e4c2748abcfd9e1293ebd9deaaf5a8e4d874106d15c80e74d3b848a3af8b1e064ab519f7400cbdc175759bdac8b1f7955b3c5d687511dff314b73e6f995668086122bb3795f360347d8f00910d6b3625529e71187cf9b383ba631238b5f54bc60bd953c6ac68f64f39a3f55fe20324842f49ca53783f9807ffff803ddd841f7d984a5bb208ac91830d6124681e936d2ae593c050d3b949886c98039bd6571c9aef014e8fc4cec41e3fd78a916d398f875034a33d4366e82ba7eb52ca068e02d5da99cb3fbab53935a47940cdaba806923609647cfbec6487607dd81e992bb71e493291874f47524cc6a2b834738f666f9dc03615141d1c0a987425928d87cca98d0e5dfae49907c36d234668cce25b91c45df2a1c6e0c6518c49b31437e0fbd94854c43601019b83c4408c4f6a8db29ddc0b34b6f54d370cf5ab3d7e71b3af8273beae762aff1a5e27071258611092beab53b77fb1127cce98c446482f8e196e24b56fb8cc376f4e4d697ebaf4911be0350ad367f2c820562168402ed284481326bc4f8969d20a9b3964388ee2e3e23a8519ba9da5c020b769681644582c052e9ed07ca9fe05c161203619dace5fa848ce5eeec89828ebc92513eba247d0525374ad803e2938ad4eb08442f5e8f80d7e30d9e46ad0d2dc4bc720bf7fa542d27dba778c1da4ee03d1f25e4bbbe399c32876505d33043d00d59dd7cdc3330efe61aceccb1e21e75fc4430ec9500ec6862aaabffbd5ba8af112abfd416f4aada2b61538a59961595007504c63aceff2dc1b0f38dd8aa659d6253d8c27bc2155bf4af306a659fa25d90e5c59f8fb72406f332f362d2794f1c4340574bc6464abb0768020de737d4f2510ba71a3f03dd873f2e335238580dbab4206950d2e45139765954f021374b08995cbbc4308dfc91aa34f8325c59b49c61e5278d3d2e44beb435d40504f9005f59d476afa23b08e5257cc0fe8f9a2b1887cc4336fcfcf1a26b32121249b318f77256d1b72cda56c54819d3e01f97dc23fad4d31c2207a0875a6c88b8bec176256eaadec88de12126db7117bc760d7ee776f69f6f92113ff34b229c4e02101c95b3fac27683bfcc3964f9550290e840a1306b096d9d0df109b60c476ffb68bf4bf958bebcbec185040d9c079b5a186c6e0b185286bfdd8a710254da1c02dd2f9a69dc7f5c09a4b88c45c0a291bba771730728282ec86823fe9fc428d3112c09cb432574cdc8847bf3d75d373c1a45444a1b15a6d86dbd039b2bb47a76c24861c5f6f8293e477bbf8b07470ca05f861acbd7f41093bb4bc8e4b8d61fefa4fc4b6a8ed2664d035e2770a969715c001620cd48d628db32ab2c9fc760d3cc7b53011ffd5e643ed6360eafa5cbef589176352e5998dad494452ed807a3eecc86acb885d791186bfa5035c42fabf822831ad371ac053c330e00a17400c888d24c665994f97a683d0c781bb470210188d784aed92815298c9b00b4e160afc168e53463158c48bf28bc1c8ec8fcb39a8e0d088684087b64b6a712feacefa504c975a8f8997d30fd0e44e979bcf8776abd4c46ad3ce437495b9f4a84aea7149d5473da2d7dc73804cd3fa4c096a93bc3e63eb9cb2ae5f2f99bc2736ea7552ae790d23fda44bf1febe1a76cdac55c1f32432137e5c429cfcaa4f06cc7b42a47a1623001d3aba1ad93905adf42bc27bc48f258f4089eaad62e3c934e093ee8bb775883e51871d8eff057df00225bcdfac30c14890dc54066bf3713376f84f90abc008fec8ede8b155d0b6290e6c91d0fe63b164b492a6b0f1e558a4f1eea0a03b10d2b837a2d4612a4de6e06e5d6f0d1b7187c777ee1514cb1552a0e1a76f692435b3bf08c113009cc5656f1d60d0b349fd0f0c1686dea6f54e1305ca3d935857c594f832df52ed733e297c849da2e07518ad6e4906f901ca08f2f74ecc4ef94c56cdd58dc6127b6addd0b5b73f9980c172e3cb47b6de8c09591cb20be76a2e0abbf4efdf5c483a4bfb86d47776c335cc631b93e9de56d11a69bcf21dded2a362b351050c24fa0a92bd449b8f91d74ccd96d19b184dac3d9cc5bf87ecdd270509f5a1e62bf5bb42f93e6b11f31e08c2fe7819dd82f33978fc85e14e2ab4e0038618544864ef4bd699506b2c2b276dc05ab0b969aa856c29bb908472b75afaf2cef9b3751a5c7fcd15c21a3b1cfb8537b5fc1134c50b2f37eedd7899aa6bd47c4ae326b7d977c4fb57b879b38bdb032d5fad4c1711ee5aa1aee609b75d9edb0ea01268db9474fff02cb5f316620d3853db80f7412f4c9fa6b0a41e3493c5a92b6d9ade1207989e9f859bd073b396cf5e11dacf17c320476513348edc04ce4a95974fc62afda07a697f951be49f9bb3a3d6eb8b7d571fe3fe86b56cb6bf4671148263bdab1d81b266a1feb7548eed65494e3678bbd8da686f9f4bb1ede57a02202215d37372f4c12d896fc00b915671e4446de03e98d955ebdbb565a2fb6970b63c0b9c1781cee5383716fbaefb7f76d428b92bd3a4a78c4880e85738a76ecbe7d67db1d6a4649f4562c03e799e7ad6be82f488f3ff050ae1b0dff6fbce0a863cac3e3a63bce3992f3c6cce7abf674a80ac0c2cb7932d7d2fefc8ebf0acdb6bafee67ac1404f99fb071640f1824ee6eda7252761c6e3b25f1d58559e40503ad7463ad382ee404aec9f397848d9102d2c59cf56156011dad69b5d83bb11b22fff394c599d7d9d720e42a78a3ab3cd5829393a75bddb0dc466fb7929ae62232f30b696be3be5caa0c563caf31f0536226e62c2fd106b216827c6f94f60620dce6b29f1b0c0681ea55d34c7001692c7efbc39306e11b2a5080cb87a521cbf3fb847b9f385cc09ae114a0e6618add18be9e3c19579e85f5d89fffa1f309198dce22d98779be37f89fb11e05c583e6c97fbb997da819c92451a13b0a22482a56c67fdfb324dab3e9ba4704201bf0ea19d6cc85b5c61bbd56f65b95b51ebaf82f9f6ad199015491a7df0416805bf51717199bc55fa7d1569a70235a41f6d7c7721ee13dd325c89079ed083ab3f0c076e08b3a637075e2fe39143b9da76b302ff8667f1da9c3ac3acdc51905222e8bc68d1f505fa1e0dcabc53478cfcb3430014a17e322a5fb83f051b0cc7324aba8fdf35b86ce8b60ad120bfc50bdfb5ae4c5b6fc8d94810b42d99f50b607173f07a99cef3bf78c6e33d027c9506908db4c0538761492125a30debba4ba0061a38ac167a79f5b662bb6b4df7edf9a5553174a238ad220a0d702bc06a73e41fe59479806f317701000359612600e5069b7b26961cba0ddaf511b8bbde67f2babca2ed981c7aac34c9462738d3ea523ba86beeb538a8c089051dd9d8b3b2e92acb1cdb577a674938bc4d4f938332785ffd7939d85e3007143107e75bb39b6851b8070754148dc63315b19c79583cfb819aaec8e8067c7e7a2abd89fe2d343780976e6f09643e72b29d57a40684af508ce0e1e38a1f9ce3fc64df5e0a465e4ea33db4c54efb8f156741c18f12b76a2a2f97e90ae00a0cfea7cc38e9116b9c644547fe876c889c22a89e26143f74cba6bdf52f123cc9ce3cfbd26460ca748ae7ae1ab8788daba0aa7396e37e1bb02137292fb89acf35ab209c649e9125eecd51b4a87446bac4a71ff4f71deb4d28924add5f45f6875"}}}}}, 0x0) (async) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xbda8ee4cc7852c63, 0x204031, 0xffffffffffffffff, 0x42791000) readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000040)=""/113, 0x71}], 0x1) (async, rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) (rerun: 32) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x2800402, 0x0) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv6/fib_multipath_hash_fields\x00', 0x1, 0x0) write$cgroup_pid(r7, 0x0, 0x0) (async, rerun: 32) socket$inet_udp(0x2, 0x2, 0x0) (rerun: 32) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffff7f}]}) 45.994215768s ago: executing program 2 (id=433): r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000380), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) sendmmsg(r2, 0x0, 0x0, 0x0) connect$pppoe(r2, 0x0, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) read$FUSE(0xffffffffffffffff, &(0x7f00000026c0)={0x2020}, 0x2020) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) socket$nl_route(0x10, 0x3, 0x0) syz_clone(0x648e7000, 0x0, 0x0, 0x0, 0x0, 0x0) unshare(0x42000000) (fail_nth: 41) 45.7900783s ago: executing program 2 (id=434): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000240)={0x14, r1, 0x303, 0x0, 0x25dfdbfd, {0x13}}, 0x14}, 0x1, 0x0, 0xffa6}, 0x0) 45.698042872s ago: executing program 33 (id=434): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000240)={0x14, r1, 0x303, 0x0, 0x25dfdbfd, {0x13}}, 0x14}, 0x1, 0x0, 0xffa6}, 0x0) 32.211394958s ago: executing program 1 (id=567): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000040)=@assoc_value, &(0x7f0000000080)=0x8) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000002f00090027bd7000fbdbdf02040000004200118027b88a909f3efae1c20d4e39dc0135e478d7d96804cb0d89bd70a18ffee06ec6"], 0x5c}, 0x1, 0x0, 0x0, 0x42914}, 0x40000d4) 32.121148284s ago: executing program 1 (id=568): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678', 0x8, 0xc30) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='T', 0x1, 0x100200) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x8}) 32.010410536s ago: executing program 1 (id=569): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) rt_sigprocmask(0x0, &(0x7f0000000040)={[0x456]}, &(0x7f0000000080), 0x8) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x3fe3aa0262d8c783, 0x4, 0x25dfdbfe, {0x0, 0x0, 0x0, r1, {0x0, 0xfff2}, {0xffff, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_OVERHEAD={0x8, 0x6, 0x58}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x7fffffff}]}}]}, 0x48}}, 0x0) syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) keyctl$clear(0x3, 0xfffffffffffffffd) request_key(&(0x7f0000000280)='user\x00', &(0x7f0000000380)={'syz', 0x3}, &(0x7f0000000200)=')\x00', 0x0) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'lo\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b595000000000000f2000a000000", @ANYRES32=r3, @ANYBLOB="14000200fe80"], 0x48}, 0x1, 0x0, 0x0, 0x84}, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 31.888947015s ago: executing program 1 (id=571): socket$inet6(0xa, 0x80803, 0x84) syz_open_dev$dvb_demux(&(0x7f00000001c0), 0x0, 0x2000) syz_open_dev$ndb(0x0, 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) socket$netlink(0x10, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) socket$inet6(0xa, 0x1, 0x100) syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x58bb, 0x10000, 0x10001, 0xa4}, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{}, 0x0, &(0x7f0000000200)=r2}, 0x1e) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f0000000280)}) 31.814984552s ago: executing program 1 (id=573): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYRES64, @ANYRES32, @ANYRESOCT=0x0, @ANYRESDEC=0x0, @ANYBLOB="66eb5a11c818b8d0b57fec41f5487c85615c4d1380691b5522fe426149c2d092cf2b3b3e7a702d689214787c99fafb28c7b8598bb29b98b3764cbfaa950dee081b37dbbeb6742ef9e39cee7f08e60a76591d3df3f1d29236cae7c23c4cca3f002b8a8a392af261690765a4b9b0dea971bfc2c520ef668ed71d02123611b49d1cd0e9e40b6dc1bdd7bcbb2036351989ae5ddae8c2e0386f45044afba3e4660a93093ce771f674118dc8fa239939b06804dee081bad0c557707573352dcc7e073867ed9de90284b235ad1167ada117b5095a7a0ca81da1b72bf5840b732827801244f0e13db7b107afb712026b55d00675c9424943cb5f1406", @ANYBLOB='\x00'/28], 0x48) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x298, 0x0, 0xffffffff, 0xffffffff, 0x1c8, 0xffffffff, 0xf8, 0xffffffff, 0xffffffff, 0x1c8, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@eui64={{0x28}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f8) syz_emit_ethernet(0x46, &(0x7f0000000540)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaabb86dd6050000000101100fc010000000000000000000000000001ff02000000000000000000000000000100000e22001090780200000000000000"], 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r0, &(0x7f0000000000), 0x0}, 0x20) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x80040, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) mknod$loop(&(0x7f00000002c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x100, 0x0) r6 = open(&(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x11) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r6, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x6, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r6, 0xa9525000) link(&(0x7f0000000600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000004c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') close_range(r5, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) setsockopt$RDS_GET_MR(r6, 0x114, 0x2, &(0x7f0000000740)={{&(0x7f00000003c0)=""/210, 0xd2}, &(0x7f0000000700), 0x2}, 0x20) sendmsg$nl_route_sched(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000a40)=@newtfilter={0x34, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x4, 0xc}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400c000}, 0x0) gettid() write$tun(r2, &(0x7f0000000500)=ANY=[], 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) syz_clone(0x22000211, 0x0, 0x0, 0x0, 0x0, 0x0) 31.421145419s ago: executing program 1 (id=579): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678', 0x8, 0xc30) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='T', 0x1, 0x100200) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x12000000, 0x0, 0x0, 0x0, 0x8}) 16.107978775s ago: executing program 34 (id=579): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678', 0x8, 0xc30) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='T', 0x1, 0x100200) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x12000000, 0x0, 0x0, 0x0, 0x8}) 2.421232612s ago: executing program 6 (id=821): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x4, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/power/pm_test', 0x8a881, 0xbb) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x1200000000000000, 0x0, 0x0, 0x1, 0xfff, 0x0, 0x0, 0x3, 0xc, "faf98317e5a1149989fc67be43ea6acc96e3a2503dc31c97214d58128bbad0099cebdc25f5ab60c9e69098c8b534464c516bdd8a0f350000000000000300", "32d8cc26f7305b74df2ce0fa7c19d1309abf30890997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f4cc50a1fcaed1e831fa79a00", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x2, 0x8]}}) 2.350295588s ago: executing program 6 (id=823): mkdirat(0xffffffffffffffff, &(0x7f0000000000)='./config\x00', 0x81) mount(&(0x7f0000000040), &(0x7f00000001c0)='./config/nvmet/ports/1/subsystems/subsys0\x00', &(0x7f00000000c0)='configfs\x00', 0x8088, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/subsys0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/subsys0/attr_allow_any_host\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='1\n', 0x2) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff) r1 = openat(r0, &(0x7f0000000080)='./config/nvmet/ports/1/addr_adrfam\x00', 0x101, 0x124) write(r1, &(0x7f0000000280)='ipv4\n', 0x5) close(r1) r2 = openat(r0, &(0x7f0000000240)='./config/nvmet/ports/1/addr_adrfam\x00', 0x8080, 0x0) write(r2, &(0x7f0000000040)="7463700ad2ba76ed174d43f3c653db1ae4627bc0a8002da6c48dc477758916324d71887d64a341cac2bbc60274", 0x2d) close(r2) r3 = openat(r2, &(0x7f0000000340)='./config/nvmet/ports/1/addr_traddr\x00', 0x42c103, 0x18) write(r3, &(0x7f0000000380)='127.0.0.1\n', 0xa) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='4420\n', 0x5) close(r4) symlinkat(&(0x7f0000000100)='./config/nvmet/subsystems/subsys0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/ports/1/subsystems/subsys0\x00') nanosleep(&(0x7f0000000480), 0x0) r5 = socket$inet(0x2, 0x1, 0x0) connect$inet(r5, &(0x7f0000000500)={0x2, 0x1144, @loopback}, 0x10) sendto$inet(r5, &(0x7f0000000600)="000080008000"/128, 0x80, 0x0, 0x0, 0x0) sendto$inet(r5, &(0x7f0000000700)="040048004800"/72, 0x48, 0x0, 0x0, 0x0) shutdown(r5, 0x2) close(r5) r6 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) write(r6, &(0x7f0000000180), 0x0) ioctl$VIDIOC_S_CTRL(r6, 0xc008561c, &(0x7f0000000140)={0xf0f046}) 2.269962171s ago: executing program 6 (id=824): r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x984d, 0x10000, 0x100020, 0x273}, &(0x7f0000000180)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x4c, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x50a10, 0x51a23}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x1}, @IFLA_GRE_ERSPAN_INDEX={0x8, 0x15, 0xe0ced}]}}}]}, 0x4c}}, 0x20040040) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000000)='./file0\x00', 0x2e, 0x400, 0x23456}) io_uring_enter(r0, 0x1, 0xfffffffd, 0x9, 0x0, 0x0) 2.269836948s ago: executing program 6 (id=825): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, 0x0, 0x0, 0xd2b) pwrite64(r0, &(0x7f0000000100)='T', 0x1, 0x100200) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x41a9e50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 2.178812691s ago: executing program 6 (id=826): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xd8, 0xc8, 0x8, 0xd8, 0x5803, 0x200, 0x2e8, 0x2e8, 0x200, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd8, 0x0, {0x0, 0x200000000c003}}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x0, 0x4, 0x2}, {0xffffffffffffffff, 0x1, 0x6}, 0x5}}}, {{@ipv6={@rand_addr=' \x01\x00', @mcast2, [0x0, 0xffffff00, 0xff000000, 0xffffff00], [0x0, 0x0, 0x0, 0xff], 'ip_vti0\x00', 'dvmrp1\x00', {}, {}, 0x1d, 0xa9, 0x7, 0x2b}, 0x0, 0xf8, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x13}}, @inet=@rpfilter={{0x28}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x3, 0x4, 0xa}, {0x0, 0x4}, 0x6, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330) 2.169883906s ago: executing program 6 (id=827): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=@newsa={0x138, 0x1a, 0x633, 0xfffffffc, 0x25dfdbfd, {{@in=@private=0xa010101, @in=@broadcast, 0x0, 0x4000, 0x4e24, 0x8001, 0x0, 0x80}, {@in6=@remote, 0x0, 0x3c}, @in=@rand_addr=0x64010100, {0x5, 0x80000001, 0x0, 0xc0, 0x4000, 0x2, 0x0, 0x8}, {0x0, 0x0, 0x200000000, 0x4}, {0x0, 0x1, 0x2}, 0x70bd29, 0x3506, 0xa, 0x5}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x200080d4) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x5c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010101}}, @IPSET_ATTR_CIDR={0x5, 0x3, 0xa}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 2.099512602s ago: executing program 5 (id=832): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000c40)={0x18, 0x2f, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x18, 0x0, 0x0, @binary}]}, 0x18}, 0x1, 0xe00000000000000, 0x0, 0x42804}, 0x4) 2.018846377s ago: executing program 5 (id=835): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x4, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/power/pm_test', 0x8a881, 0xbb) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0xf5ffffffffffffff, 0x0, 0x0, 0x1, 0xfff, 0x0, 0x0, 0x3, 0xc, "faf98317e5a1149989fc67be43ea6acc96e3a2503dc31c97214d58128bbad0099cebdc25f5ab60c9e69098c8b534464c516bdd8a0f350000000000000300", "32d8cc26f7305b74df2ce0fa7c19d1309abf30890997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f4cc50a1fcaed1e831fa79a00", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x2, 0x8]}}) 1.92807691s ago: executing program 5 (id=836): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040), &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config/nvmet/subsystems/subsys0/attr_allow_any_host\x00', 0x61) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/subsys0/attr_allow_any_host\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='1\n', 0x2) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)="5f70762118", 0x5) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/subsystems/subsys0\x00', 0x1, 0x119) write(r2, &(0x7f0000000300)='tcp\n', 0x4) close(r2) r3 = openat(r2, &(0x7f0000000340)='./config/nvmet/ports/1/addr_traddr\x00', 0x400103, 0x18) write(r3, &(0x7f0000000380)='127.0.0.1\n', 0xa) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='4420\n', 0x5) close(r4) symlinkat(&(0x7f0000000100)='./config/nvmet/subsystems/subsys0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/ports/1/subsystems/subsys0\x00') nanosleep(&(0x7f0000000480)={0x0, 0x1000000}, 0x0) r5 = socket$inet(0x2, 0x1, 0x0) connect$inet(r5, &(0x7f0000000500)={0x2, 0x1144, @loopback}, 0x10) sendto$inet(r5, &(0x7f0000000600)="000080008000"/128, 0x80, 0x0, 0x0, 0x0) sendto$inet(r5, &(0x7f0000000700)="040048004800"/72, 0x48, 0x0, 0x0, 0x0) shutdown(r5, 0x0) close(r1) r6 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) write(r2, &(0x7f0000000780)="6eea772e8e075a871a8a4e0494817794961a774b3c491c0fa1ee3984a9992ae6f95ab7bdea64d11a1a66164945cad2d4c8e64e1f18015bd9542f9ed9d845f962c359d840bcc63dd29687f054078283fd8c85b83d35bab9cf4b9c613f87c7a9d5b7bfff2cb4182cac6644c69bcae055335601762130c7cf43ddef061f6b99065a02cab8", 0x83) ioctl$VIDIOC_S_CTRL(r6, 0xc008561c, &(0x7f0000000140)={0xf0f046}) 1.851208607s ago: executing program 5 (id=839): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xd8, 0xc8, 0x8, 0xd8, 0x5803, 0x200, 0x2e8, 0x2e8, 0x200, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd8, 0x0, {0x0, 0x200000000d800}}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x0, 0x4, 0x2}, {0xffffffffffffffff, 0x1, 0x6}, 0x5}}}, {{@ipv6={@rand_addr=' \x01\x00', @mcast2, [0x0, 0xffffff00, 0xff000000, 0xffffff00], [0x0, 0x0, 0x0, 0xff], 'ip_vti0\x00', 'dvmrp1\x00', {}, {}, 0x1d, 0xa9, 0x7, 0x2b}, 0x0, 0xf8, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x13}}, @inet=@rpfilter={{0x28}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x3, 0x4, 0xa}, {0x0, 0x4}, 0x6, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330) 1.529973143s ago: executing program 4 (id=845): r0 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r0, 0x20080204) keyctl$read(0xb, r0, 0x0, 0x0) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000001c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r1, 0xc0505405, &(0x7f0000000000)={{0x1, 0x0, 0x1}}) add_key$keyring(&(0x7f00000001c0), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) (async) keyctl$setperm(0x5, r0, 0x20080204) (async) keyctl$read(0xb, r0, 0x0, 0x0) (async) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000001c0), 0x0) (async) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r1, 0xc0505405, &(0x7f0000000000)={{0x1, 0x0, 0x1}}) (async) 1.529674022s ago: executing program 4 (id=846): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x4, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/power/pm_test', 0x8a881, 0xbb) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0xfffffffffffffff5, 0x0, 0x0, 0x1, 0xfff, 0x0, 0x0, 0x3, 0xc, "faf98317e5a1149989fc67be43ea6acc96e3a2503dc31c97214d58128bbad0099cebdc25f5ab60c9e69098c8b534464c516bdd8a0f350000000000000300", "32d8cc26f7305b74df2ce0fa7c19d1309abf30890997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f4cc50a1fcaed1e831fa79a00", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x2, 0x8]}}) 1.429038002s ago: executing program 4 (id=847): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0xc30) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='\x00', 0x1, 0x1e8133) pwrite64(r0, &(0x7f0000000100)='TOCBLOCK', 0x8, 0x100200) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 1.392660515s ago: executing program 4 (id=848): setsockopt(0xffffffffffffffff, 0x84, 0x7e, &(0x7f0000000280)='\x00', 0xfffffea4) setsockopt$inet_sctp6_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, &(0x7f00000002c0)=ANY=[], 0x9) (async) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205648, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async, rerun: 32) r1 = socket$inet6(0x10, 0x3, 0x0) (async, rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mnt\x00', 0x1ff) (async) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000200)='ext4\x00', 0x8410, 0x0) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) lseek(r2, 0x10001, 0x700000000000000) (async) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x77, 0x4) (async) r4 = open(0x0, 0x109042, 0x0) fcntl$addseals(r4, 0x409, 0x8e3652a1e0b94d91) (async) syz_usb_connect$cdc_ecm(0x0, 0x4d, 0x0, 0x0) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) (async) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) write$cgroup_pid(r6, &(0x7f00000001c0), 0x12) (async, rerun: 64) sync() (async, rerun: 64) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x400, 0x9) (async) r7 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) fcntl$notify(r7, 0x402, 0x44) (async) sendfile(r1, 0xffffffffffffffff, 0x0, 0x4) (async) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x1f, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020200600000000000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000008500000070000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 978.741719ms ago: executing program 3 (id=850): mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000002280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000140000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',5\x00\x00\x00\x00\x00\x00\x00=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0xaa0a1000, 0x0, 0x0, 0x0, 0x0, 0x0) 977.690906ms ago: executing program 3 (id=851): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000002100010025bd7000fddbdf2502000014000000000100010008000a0002000000475fb2f3258dc8eb23092574f5b7edc6a5f7b2cff0c1178c0dd2bf7973d353f979a7badd17b0bf460e703d9e64abab"], 0x24}}, 0x0) 899.884643ms ago: executing program 3 (id=852): r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x34, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x700}, 0x0) 750.525187ms ago: executing program 3 (id=853): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x103, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000001c0)={[0x207, 0x6, 0x0, 0x0, 0x10003, 0x40, 0x400200cc4, 0xffd, 0x4, 0x0, 0x7, 0xff7ffffffffffffd, 0x3, 0x0, 0x6a, 0x8d], 0xeeee8000, 0x2011c0}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="66b893000f00d0260f01c566baf80cb86058b885ef66bafc0c66ed66b82b018ee0670f01df9ad80000000301d9070f01c866b84a008ed0670f01c8", 0x3b}], 0x1, 0x49, 0x0, 0x0) ioctl$KVM_CAP_EXIT_ON_EMULATION_FAILURE(r1, 0x4068aea3, &(0x7f0000000080)={0xcc, 0x0, 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 650.51326ms ago: executing program 4 (id=854): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000c40)={0x18, 0x2f, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x18, 0x0, 0x0, @binary}]}, 0x18}, 0x1, 0x4000000000000000, 0x0, 0x42804}, 0x4) 550.970376ms ago: executing program 4 (id=855): mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @multicast1}}}}) syz_io_uring_complete(0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f4, &(0x7f00000001c0)={'syztnl0\x00', 0x0}) r1 = syz_usb_connect(0x3, 0x40, &(0x7f0000001300)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050204e5"], 0x0) setns(0xc9, 0x0) r2 = socket(0x8, 0x5, 0x7fff) syz_usb_ep_read(r1, 0x1, 0x0, 0x0) syz_usb_ep_write(r1, 0x81, 0x40, &(0x7f0000000100)="900100"/64) ioctl$sock_SIOCOUTQNSD(r2, 0x4010618c, &(0x7f0000000000)) 470.231427ms ago: executing program 3 (id=856): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0xc30) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='\x00', 0x1, 0x1e8133) pwrite64(r0, &(0x7f0000000100)='TOCBLOCK', 0x8, 0x100200) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 331.169367ms ago: executing program 3 (id=857): syz_emit_ethernet(0x4a, 0x0, 0x0) syz_open_dev$loop(0x0, 0x5, 0x0) set_mempolicy(0x3, &(0x7f0000000040)=0x9bd5, 0x4) inotify_init() socket$inet6(0xa, 0x80002, 0x0) socket(0x40000000015, 0x5, 0x0) syz_open_dev$vim2m(&(0x7f0000000800), 0x1, 0x2) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000440)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="33fa2dbd7000fcdb81a25700000008000300", @ANYRES32=r2, @ANYBLOB="14000400636169663000"/20], 0x38}, 0x1, 0x0, 0x0, 0xc804}, 0xc2010) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/timer_list\x00', 0x0, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$sock(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="2e00000013000500000000000000000003010000100002007664706173696d5f626c6b000a000400766470613000", 0x2e}], 0x1}, 0x0) preadv(r3, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1, 0xfffffffc, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="48000000140009052cbd03000000000002188f00", @ANYRES32=r8, @ANYBLOB="080004000000000008000200e000000208000100ac1414bb0800090002000000080008000000000008000200"], 0x48}}, 0x4000) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r9, 0x891c, &(0x7f0000000540)={'batadv_slave_1\x00', {0x2, 0x0, @empty}}) bind$bt_l2cap(r5, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x7, &(0x7f0000000140)=0x1, 0x4) listen(r5, 0x5) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xfffffffffffffffe, 0x9, 0x5, 0x9, 0x80000006, 0xb06c}, 0x0, 0x0) 330.814559ms ago: executing program 5 (id=858): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f000001f900)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000480)='dummy_udc.0', 0xb) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000280), r0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) mkdirat(r2, &(0x7f0000000100)='./config\x00', 0x4) sendmsg$IEEE802154_LLSEC_ADD_DEV(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x50, r3, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xfd}, @IEEE802154_ATTR_SHORT_ADDR={0x6}]}, 0x50}, 0x4, 0x700000000000000}, 0x0) 0s ago: executing program 5 (id=859): setsockopt$EBT_SO_SET_COUNTERS(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000240)={'nat\x00', 0x0, 0x0, 0x0, [0x48, 0x8, 0xffff, 0xf, 0x1, 0xffffffffffffffbd], 0x0, 0x0}, 0x78) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040250580100001000000010902200001010080320904000002ff00000007058102000200070502020002"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) ioctl(r0, 0x8914, &(0x7f0000000200)="7573623000000000000000005c00000003") syz_usb_control_io(r1, 0x0, &(0x7f0000001200)={0x84, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) kernel console output (not intermixed with test programs): T7473] netlink: 8 bytes leftover after parsing attributes in process `syz.3.482'. [ 104.915549][ T58] usb usb9-port1: unable to enumerate USB device [ 104.952159][ T7480] random: crng reseeded on system resumption [ 104.960271][ T7482] Cannot find add_set index 0 as target [ 104.962121][ T7480] Unrecognized hibernate image header format! [ 104.962134][ T7480] PM: hibernation: Image mismatch: architecture specific data [ 105.208345][ T43] kauditd_printk_skb: 20 callbacks suppressed [ 105.208359][ T43] audit: type=1400 audit(1789806282.125:799): avc: denied { write } for pid=7491 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.263558][ T43] audit: type=1400 audit(1789806282.175:800): avc: denied { write } for pid=7494 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.340447][ T43] audit: type=1400 audit(1789806282.255:801): avc: denied { write } for pid=7498 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.395082][ T43] audit: type=1400 audit(1789806282.315:802): avc: denied { write } for pid=7501 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.474656][ T43] audit: type=1400 audit(1789806282.395:803): avc: denied { write } for pid=7503 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.542351][ T43] audit: type=1400 audit(1789806282.455:804): avc: denied { write } for pid=7506 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.610590][ T43] audit: type=1400 audit(1789806282.525:805): avc: denied { write } for pid=7508 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.676030][ T43] audit: type=1400 audit(1789806282.595:806): avc: denied { write } for pid=7511 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.812824][ T7515] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 105.885631][ T7520] sd 0:0:0:0: PR command failed: 1026 [ 105.885656][ T7520] sd 0:0:0:0: Sense Key : Illegal Request [current] [ 105.885676][ T7520] sd 0:0:0:0: Add. Sense: Invalid command operation code [ 105.974090][ T5742] Bluetooth: hci4: command tx timeout [ 106.246288][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880389ea800: rx timeout, send abort [ 106.246522][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff8880389ea800: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 106.314245][ T30] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 106.401749][ T7535] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7535 comm=syz.5.495 [ 106.425672][ T43] audit: type=1400 audit(1789806283.345:807): avc: denied { mount } for pid=7527 comm="syz.4.494" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 106.464691][ T30] usb 6-1: Using ep0 maxpacket: 8 [ 106.465554][ T30] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 106.466691][ T30] usb 6-1: config index 0 descriptor too short (expected 74, got 45) [ 106.466733][ T30] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 106.466760][ T30] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 106.466781][ T30] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 106.466805][ T30] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 106.466829][ T30] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 106.466863][ T30] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.573880][ T7537] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 106.672713][ T30] usb 6-1: usb_control_msg returned -32 [ 106.672754][ T30] usbtmc 6-1:16.0: can't read capabilities [ 106.726847][ T43] audit: type=1400 audit(1789806283.645:808): avc: denied { read } for pid=7543 comm="syz.4.498" dev="sockfs" ino=20520 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 106.997712][ T7562] loop4: detected capacity change from 0 to 7 [ 107.008596][ T7562] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 107.008621][ T7562] loop4: partition table partially beyond EOD, truncated [ 107.009454][ T7562] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 107.029333][ C2] usbtmc 6-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 107.029559][ T7563] usbtmc 6-1:16.0: Unable to send data, error -71 [ 107.036334][ T7563] netlink: 36 bytes leftover after parsing attributes in process `syz.1.492'. [ 107.056896][ T6840] udevd[6840]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 107.326235][ T30] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 107.334510][ T7577] loop0: detected capacity change from 2049 to 0 [ 107.351728][ T7579] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 107.418869][ T7584] lo speed is unknown, defaulting to 1000 [ 107.486642][ T30] usb 10-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 107.487520][ T30] usb 10-1: config index 0 descriptor too short (expected 39, got 27) [ 107.487542][ T30] usb 10-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 107.487554][ T30] usb 10-1: config 0 interface 0 has no altsetting 0 [ 107.490308][ T30] usb 10-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 107.490322][ T30] usb 10-1: Product: syz [ 107.490330][ T30] usb 10-1: Manufacturer: syz [ 107.490338][ T30] usb 10-1: SerialNumber: syz [ 107.491813][ T30] usb 10-1: config 0 descriptor?? [ 107.496098][ T30] hub 10-1:0.0: bad descriptor, ignoring hub [ 107.496112][ T30] hub 10-1:0.0: probe with driver hub failed with error -5 [ 107.499403][ T30] usb 10-1: selecting invalid altsetting 0 [ 107.693354][ T7596] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7596 comm=syz.3.517 [ 107.934091][ T9] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 108.054418][ T5742] Bluetooth: hci4: command tx timeout [ 108.074283][ T9] usb 9-1: device descriptor read/64, error -71 [ 108.116330][ T7567] usb 10-1: reset high-speed USB device number 3 using dummy_hcd [ 108.117960][ T7567] usb 10-1: device reset changed ep0 maxpacket size! [ 108.120098][ T2363] usb 10-1: USB disconnect, device number 3 [ 108.274172][ T2363] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 108.324239][ T9] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 108.434106][ T2363] usb 10-1: Using ep0 maxpacket: 32 [ 108.435327][ T2363] usb 10-1: New USB device found, idVendor=0582, idProduct=009a, bcdDevice= 0.40 [ 108.436234][ T2363] usb 10-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 38, changing to 7 [ 108.438415][ T2363] usb 10-1: string descriptor 0 read error: -22 [ 108.438470][ T2363] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.442966][ T2363] usb 10-1: Audio class v2/v3 interfaces need an interface association [ 108.456078][ T9] usb 9-1: device descriptor read/64, error -71 [ 108.468321][ T2363] snd-usb-audio 10-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 108.531420][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531520][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531550][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531578][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531605][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531633][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531660][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531687][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531736][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531769][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531797][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531824][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531852][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531880][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531908][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531941][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.531974][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.532002][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.532029][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.532057][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.532085][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.532112][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.532140][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.532168][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.533279][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.533329][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.533373][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.533418][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.533462][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.533506][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.533550][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.533601][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.533646][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.534780][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.534836][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.534883][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.534928][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.534980][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.535024][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.535069][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.535113][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.535157][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.535311][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.537934][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.537994][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.538042][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.538087][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.538132][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.538620][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.538670][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.538726][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.538776][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.538823][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.538990][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.539038][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.539083][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.539129][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.539174][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.539219][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.539265][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.539312][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.539356][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.539400][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.539446][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.539492][ T7609] bond0: no command found in arp_ip_targets file - use + or - [ 108.566008][ T9] usb usb9-port1: attempt power cycle [ 108.645519][ T2363] usb 10-1: USB disconnect, device number 4 [ 108.727779][ T7617] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 108.944197][ T9] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 108.974902][ T9] usb 9-1: device descriptor read/8, error -71 [ 109.099521][ T58] usb 6-1: USB disconnect, device number 15 [ 109.224258][ T9] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 109.250670][ T7626] netlink: 8 bytes leftover after parsing attributes in process `syz.3.526'. [ 109.255288][ T9] usb 9-1: device descriptor read/8, error -71 [ 109.260288][ T7626] hfsplus: unable to find HFS+ superblock [ 109.300371][ T7628] FAULT_INJECTION: forcing a failure. [ 109.300371][ T7628] name failslab, interval 1, probability 0, space 0, times 0 [ 109.300395][ T7628] CPU: 2 UID: 0 PID: 7628 Comm: syz.3.527 Tainted: G L syzkaller #0 PREEMPT(full) [ 109.300410][ T7628] Tainted: [L]=SOFTLOCKUP [ 109.300414][ T7628] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 109.300421][ T7628] Call Trace: [ 109.300425][ T7628] [ 109.300430][ T7628] dump_stack_lvl+0x100/0x190 [ 109.300462][ T7628] should_fail_ex.cold+0x5/0xa [ 109.300479][ T7628] should_failslab+0xc2/0x120 [ 109.300497][ T7628] __kmalloc_cache_noprof+0x91/0x6d0 [ 109.300514][ T7628] ? inode_doinit_with_dentry+0x70b/0x1340 [ 109.300527][ T7628] ? inode_doinit_with_dentry+0x7b1/0x1340 [ 109.300542][ T7628] inode_doinit_with_dentry+0x7b1/0x1340 [ 109.300556][ T7628] ? lockdep_count_backward_deps+0x1b7/0x200 [ 109.300570][ T7628] ? __pfx_inode_doinit_with_dentry+0x10/0x10 [ 109.300587][ T7628] selinux_d_instantiate+0x26/0x40 [ 109.300599][ T7628] security_d_instantiate+0x14c/0x1b0 [ 109.300615][ T7628] d_splice_alias_ops+0xd7/0x15b0 [ 109.300628][ T7628] ? rcu_is_watching+0x13/0xc0 [ 109.300643][ T7628] ? __up_read+0x333/0x980 [ 109.300657][ T7628] ? __pfx_d_splice_alias_ops+0x10/0x10 [ 109.300669][ T7628] ? kernfs_iop_lookup+0x234/0x2d0 [ 109.300685][ T7628] ? kernfs_iop_lookup+0x234/0x2d0 [ 109.300703][ T7628] kernfs_iop_lookup+0x23f/0x2d0 [ 109.300719][ T7628] ? __pfx_kernfs_iop_lookup+0x10/0x10 [ 109.300735][ T7628] lookup_open+0xa79/0x1990 [ 109.300752][ T7628] path_openat+0xa2c/0x2440 [ 109.300768][ T7628] ? __pfx_path_openat+0x10/0x10 [ 109.300785][ T7628] do_file_open+0x20e/0x430 [ 109.300800][ T7628] ? __pfx_do_file_open+0x10/0x10 [ 109.300823][ T7628] ? _raw_spin_unlock+0x28/0x50 [ 109.300840][ T7628] ? alloc_fd+0x471/0x7a0 [ 109.300858][ T7628] do_sys_openat2+0x10f/0x1e0 [ 109.300889][ T7628] ? __pfx_do_sys_openat2+0x10/0x10 [ 109.300906][ T7628] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 109.300924][ T7628] ? __fget_files+0x21f/0x3d0 [ 109.300940][ T7628] __x64_sys_openat+0x12d/0x210 [ 109.300963][ T7628] ? __pfx___x64_sys_openat+0x10/0x10 [ 109.300978][ T7628] ? ksys_write+0x1ac/0x250 [ 109.300994][ T7628] do_syscall_64+0x123/0x790 [ 109.301011][ T7628] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.301023][ T7628] RIP: 0033:0x7fb71859e159 [ 109.301032][ T7628] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.301043][ T7628] RSP: 002b:00007fb71952f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 109.301055][ T7628] RAX: ffffffffffffffda RBX: 00007fb718825fa0 RCX: 00007fb71859e159 [ 109.301061][ T7628] RDX: 0000000000000001 RSI: 0000200000000500 RDI: ffffffffffffff9c [ 109.301068][ T7628] RBP: 00007fb71952f090 R08: 0000000000000000 R09: 0000000000000000 [ 109.301075][ T7628] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 109.301081][ T7628] R13: 00007fb718826038 R14: 00007fb718825fa0 R15: 00007ffdcc839da8 [ 109.301095][ T7628] [ 109.365583][ T9] usb usb9-port1: unable to enumerate USB device [ 109.419617][ T7634] FAULT_INJECTION: forcing a failure. [ 109.419617][ T7634] name failslab, interval 1, probability 0, space 0, times 0 [ 109.419653][ T7634] CPU: 0 UID: 0 PID: 7634 Comm: syz.5.530 Tainted: G L syzkaller #0 PREEMPT(full) [ 109.419681][ T7634] Tainted: [L]=SOFTLOCKUP [ 109.419689][ T7634] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 109.419701][ T7634] Call Trace: [ 109.419708][ T7634] [ 109.419719][ T7634] dump_stack_lvl+0x100/0x190 [ 109.419753][ T7634] should_fail_ex.cold+0x5/0xa [ 109.419801][ T7634] should_failslab+0xc2/0x120 [ 109.419829][ T7634] kmem_cache_alloc_noprof+0x92/0x6a0 [ 109.419852][ T7634] ? __kernfs_new_node+0xd2/0xa10 [ 109.419885][ T7634] __kernfs_new_node+0xd2/0xa10 [ 109.419914][ T7634] ? kernfs_add_one+0x214/0xaa0 [ 109.419943][ T7634] ? __pfx___kernfs_new_node+0x10/0x10 [ 109.419973][ T7634] ? lock_acquire+0x1d1/0x380 [ 109.419993][ T7634] ? kernfs_root+0x23/0x2a0 [ 109.420019][ T7634] ? find_held_lock+0x2b/0x80 [ 109.420045][ T7634] ? kernfs_root+0xee/0x2a0 [ 109.420069][ T7634] ? kernfs_root+0xee/0x2a0 [ 109.420100][ T7634] kernfs_new_node+0x117/0x150 [ 109.420133][ T7634] kernfs_create_link+0xcc/0x240 [ 109.420157][ T7634] sysfs_do_create_link_sd+0x90/0x140 [ 109.420185][ T7634] sysfs_create_link+0x61/0xc0 [ 109.420210][ T7634] device_add+0x553/0x1970 [ 109.420240][ T7634] ? __pfx_device_add+0x10/0x10 [ 109.420264][ T7634] ? kfree_const+0x5a/0x70 [ 109.420291][ T7634] ? kfree+0x1e5/0x6d0 [ 109.420333][ T7634] device_create_groups_vargs+0x1f8/0x270 [ 109.420364][ T7634] device_create+0xed/0x130 [ 109.420393][ T7634] ? __pfx_device_create+0x10/0x10 [ 109.420424][ T7634] ? __pfx_vsnprintf+0x10/0x10 [ 109.420454][ T7634] ? __pfx___debug_object_init+0x10/0x10 [ 109.420477][ T7634] ? mark_held_locks+0x40/0x70 [ 109.420503][ T7634] bdi_register_va+0x114/0x820 [ 109.420528][ T7634] ? __pfx_bdi_register_va+0x10/0x10 [ 109.420551][ T7634] ? lockdep_init_map_type+0x5c/0x250 [ 109.420573][ T7634] ? bdi_init+0x3f4/0x5b0 [ 109.420596][ T7634] super_setup_bdi_name+0xff/0x250 [ 109.420627][ T7634] ? __pfx_super_setup_bdi_name+0x10/0x10 [ 109.420657][ T7634] ? __kasan_kmalloc+0xaa/0xb0 [ 109.420679][ T7634] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 109.420708][ T7634] ? afs_get_tree+0x380/0x1420 [ 109.420739][ T7634] afs_get_tree+0xbe7/0x1420 [ 109.420770][ T7634] vfs_get_tree+0x92/0x320 [ 109.420798][ T7634] path_mount+0x7d0/0x24c0 [ 109.420829][ T7634] ? __pfx_path_mount+0x10/0x10 [ 109.420855][ T7634] ? lockdep_hardirqs_on+0x7d/0x110 [ 109.420885][ T7634] ? putname+0xb1/0x110 [ 109.420908][ T7634] ? kmem_cache_free+0x127/0x6c0 [ 109.420945][ T7634] ? __x64_sys_mount+0x293/0x310 [ 109.420972][ T7634] __x64_sys_mount+0x293/0x310 [ 109.421000][ T7634] ? __pfx___x64_sys_mount+0x10/0x10 [ 109.421035][ T7634] do_syscall_64+0x123/0x790 [ 109.421066][ T7634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.421085][ T7634] RIP: 0033:0x7fb62bf9e159 [ 109.421101][ T7634] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.421119][ T7634] RSP: 002b:00007fb62ce82028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 109.421139][ T7634] RAX: ffffffffffffffda RBX: 00007fb62c225fa0 RCX: 00007fb62bf9e159 [ 109.421153][ T7634] RDX: 0000200000000700 RSI: 00002000000006c0 RDI: 0000000000000000 [ 109.421165][ T7634] RBP: 00007fb62c03506b R08: 0000200000000740 R09: 0000000000000000 [ 109.421177][ T7634] R10: 0000000001000000 R11: 0000000000000246 R12: 0000000000000000 [ 109.421189][ T7634] R13: 00007fb62c226038 R14: 00007fb62c225fa0 R15: 00007ffe0a1548f8 [ 109.421213][ T7634] [ 109.433857][ T7634] netlink: 8 bytes leftover after parsing attributes in process `syz.5.530'. [ 109.444185][ T58] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 109.594910][ T58] usb 6-1: New USB device found, idVendor=0458, idProduct=5005, bcdDevice= 0.00 [ 109.596019][ T58] usb 6-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 109.596040][ T58] usb 6-1: config 3 has 0 interfaces, different from the descriptor's value: 2 [ 109.596071][ T58] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.841916][ T7642] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7642 comm=syz.3.532 [ 110.314980][ T5162] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 110.347611][ T43] kauditd_printk_skb: 17 callbacks suppressed [ 110.347627][ T43] audit: type=1400 audit(1789806287.265:826): avc: denied { write } for pid=7656 comm="syz.5.536" name="mice" dev="devtmpfs" ino=938 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 110.347893][ T43] audit: type=1400 audit(1789806287.265:827): avc: denied { open } for pid=7656 comm="syz.5.536" path="/dev/input/mice" dev="devtmpfs" ino=938 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 110.402379][ T43] audit: type=1400 audit(1789806287.315:828): avc: denied { ioctl } for pid=7656 comm="syz.5.536" path="/dev/fuse" dev="devtmpfs" ino=105 ioctlcmd=0x9409 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 110.474847][ T5162] usb 8-1: New USB device found, idVendor=0525, idProduct=1080, bcdDevice= 1.00 [ 110.475829][ T5162] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.524197][ T7660] loop0: detected capacity change from 0 to 2049 [ 110.572861][ T7662] binder: 7661:7662 ioctl c0306201 200000000080 returned -14 [ 110.575884][ T7662] binder: 7661:7662 ioctl c0306201 2000000003c0 returned -14 [ 110.693960][ T5162] net1080 8-1:1.0 usb0: register 'net1080' at usb-dummy_hcd.3-1, NetChip TurboCONNECT, aa:f6:11:b0:09:b7 [ 110.789280][ T43] audit: type=1400 audit(1789806287.705:829): avc: denied { write } for pid=7674 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 110.850496][ T43] audit: type=1400 audit(1789806287.765:830): avc: denied { write } for pid=7678 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 110.861696][ T7677] nvmet: Invalid value 't' for trtype [ 111.145569][ T25] usb 8-1: USB disconnect, device number 16 [ 111.146551][ T25] net1080 8-1:1.0 usb0: unregister 'net1080' usb-dummy_hcd.3-1, NetChip TurboCONNECT [ 111.179536][ T43] audit: type=1400 audit(1789806288.095:831): avc: denied { write } for pid=7681 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 111.232609][ T43] audit: type=1400 audit(1789806288.145:832): avc: denied { write } for pid=7684 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 111.675480][ T7687] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 111.727575][ T43] audit: type=1400 audit(1789806288.645:833): avc: denied { write } for pid=7689 comm="syz.3.544" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 112.135469][ T2363] usb 6-1: USB disconnect, device number 16 [ 112.171419][ T7695] lo speed is unknown, defaulting to 1000 [ 112.244310][ T43] audit: type=1400 audit(1789806289.165:834): avc: denied { write } for pid=7696 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 112.311427][ T43] audit: type=1400 audit(1789806289.225:835): avc: denied { write } for pid=7701 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 112.338091][ T7697] lo speed is unknown, defaulting to 1000 [ 112.390025][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 112.390043][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 112.390069][ T5143] loop0: [ 112.518450][ T7711] bond3: entered promiscuous mode [ 112.550947][ T7722] Cannot find add_set index 0 as target [ 112.610596][ T7729] ip_tables: iptables: counters copy to user failed while replacing table [ 112.665049][ T7734] netlink: 12 bytes leftover after parsing attributes in process `syz.1.554'. [ 112.693458][ T7735] warning: `syz.5.552' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 112.757958][ T7732] bridge3: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 112.901803][ T7748] FAULT_INJECTION: forcing a failure. [ 112.901803][ T7748] name failslab, interval 1, probability 0, space 0, times 0 [ 112.901842][ T7748] CPU: 0 UID: 0 PID: 7748 Comm: syz.4.559 Tainted: G L syzkaller #0 PREEMPT(full) [ 112.901872][ T7748] Tainted: [L]=SOFTLOCKUP [ 112.901880][ T7748] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 112.901892][ T7748] Call Trace: [ 112.901900][ T7748] [ 112.901909][ T7748] dump_stack_lvl+0x100/0x190 [ 112.901961][ T7748] should_fail_ex.cold+0x5/0xa [ 112.901991][ T7748] should_failslab+0xc2/0x120 [ 112.902023][ T7748] __kmalloc_cache_noprof+0x91/0x6d0 [ 112.902053][ T7748] ? kasan_quarantine_put+0x104/0x240 [ 112.902074][ T7748] ? inode_doinit_use_xattr+0x54/0x330 [ 112.902112][ T7748] inode_doinit_use_xattr+0x54/0x330 [ 112.902147][ T7748] inode_doinit_with_dentry+0x10fc/0x1340 [ 112.902179][ T7748] ? __pfx_inode_doinit_with_dentry+0x10/0x10 [ 112.902200][ T7748] ? wake_up_q+0xae/0x130 [ 112.902262][ T7748] selinux_d_instantiate+0x26/0x40 [ 112.902289][ T7748] security_d_instantiate+0x14c/0x1b0 [ 112.902318][ T7748] d_splice_alias_ops+0xd7/0x15b0 [ 112.902344][ T7748] ? __up_read+0x333/0x980 [ 112.902367][ T7748] ? __pfx_d_splice_alias_ops+0x10/0x10 [ 112.902389][ T7748] ? kernfs_iop_lookup+0x234/0x2d0 [ 112.902419][ T7748] ? kernfs_iop_lookup+0x234/0x2d0 [ 112.902455][ T7748] kernfs_iop_lookup+0x23f/0x2d0 [ 112.902483][ T7748] ? __pfx_kernfs_iop_lookup+0x10/0x10 [ 112.902510][ T7748] lookup_open+0xa79/0x1990 [ 112.902543][ T7748] path_openat+0xa2c/0x2440 [ 112.902575][ T7748] ? __pfx_path_openat+0x10/0x10 [ 112.902609][ T7748] do_file_open+0x20e/0x430 [ 112.902636][ T7748] ? __pfx_do_file_open+0x10/0x10 [ 112.902681][ T7748] ? _raw_spin_unlock+0x28/0x50 [ 112.902714][ T7748] ? alloc_fd+0x471/0x7a0 [ 112.902748][ T7748] do_sys_openat2+0x10f/0x1e0 [ 112.902781][ T7748] ? __pfx_do_sys_openat2+0x10/0x10 [ 112.902807][ T7748] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 112.902836][ T7748] ? __fget_files+0x21f/0x3d0 [ 112.902862][ T7748] __x64_sys_openat+0x12d/0x210 [ 112.902886][ T7748] ? __pfx___x64_sys_openat+0x10/0x10 [ 112.902906][ T7748] ? ksys_write+0x1ac/0x250 [ 112.902933][ T7748] do_syscall_64+0x123/0x790 [ 112.902961][ T7748] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.902981][ T7748] RIP: 0033:0x7f0bd2b9e159 [ 112.902997][ T7748] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.903012][ T7748] RSP: 002b:00007f0bd3b43028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 112.903030][ T7748] RAX: ffffffffffffffda RBX: 00007f0bd2e25fa0 RCX: 00007f0bd2b9e159 [ 112.903042][ T7748] RDX: 0000000000000001 RSI: 0000200000000500 RDI: ffffffffffffff9c [ 112.903053][ T7748] RBP: 00007f0bd3b43090 R08: 0000000000000000 R09: 0000000000000000 [ 112.903064][ T7748] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 112.903075][ T7748] R13: 00007f0bd2e26038 R14: 00007f0bd2e25fa0 R15: 00007ffd3dbf5e08 [ 112.903100][ T7748] [ 112.994148][ T5818] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 113.068395][ T7758] capability: warning: `syz.1.563' uses deprecated v2 capabilities in a way that may be insecure [ 113.109594][ T7763] Cannot find add_set index 0 as target [ 113.155339][ T5818] usb 8-1: New USB device found, idVendor=0525, idProduct=1080, bcdDevice= 1.00 [ 113.156460][ T5818] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.180651][ T7768] netlink: 4 bytes leftover after parsing attributes in process `syz.1.567'. [ 113.193536][ T7768] workqueue: name exceeds WQ_NAME_LEN. Truncating to: '¸ŠŸ>úáÂN9Ü5äx×Ùhˉ½p¡þàn [ 113.393141][ T7773] netlink: 28 bytes leftover after parsing attributes in process `syz.1.569'. [ 113.417879][ T5818] net1080 8-1:1.0 usb0: register 'net1080' at usb-dummy_hcd.3-1, NetChip TurboCONNECT, 62:fe:9e:88:dd:f8 [ 113.597464][ T7793] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 113.779312][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 113.779329][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 113.779354][ T5143] loop0: [ 113.829050][ T5818] usb 8-1: USB disconnect, device number 17 [ 113.831155][ T5818] net1080 8-1:1.0 usb0: unregister 'net1080' usb-dummy_hcd.3-1, NetChip TurboCONNECT [ 113.867125][ T7810] use of bytesused == 0 is deprecated and will be removed in the future, [ 113.867135][ T7810] use the actual size instead. [ 114.354873][ T42] usb 10-1: new low-speed USB device number 5 using dummy_hcd [ 114.383237][ T7824] FAULT_INJECTION: forcing a failure. [ 114.383237][ T7824] name failslab, interval 1, probability 0, space 0, times 0 [ 114.383259][ T7824] CPU: 0 UID: 0 PID: 7824 Comm: syz.3.581 Tainted: G L syzkaller #0 PREEMPT(full) [ 114.383274][ T7824] Tainted: [L]=SOFTLOCKUP [ 114.383279][ T7824] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 114.383285][ T7824] Call Trace: [ 114.383289][ T7824] [ 114.383293][ T7824] dump_stack_lvl+0x100/0x190 [ 114.383313][ T7824] should_fail_ex.cold+0x5/0xa [ 114.383329][ T7824] should_failslab+0xc2/0x120 [ 114.383345][ T7824] __kmalloc_noprof+0xfc/0x840 [ 114.383357][ T7824] ? tomoyo_encode2+0xfb/0x3c0 [ 114.383374][ T7824] tomoyo_encode2+0xfb/0x3c0 [ 114.383389][ T7824] tomoyo_encode+0x29/0x50 [ 114.383407][ T7824] tomoyo_realpath_from_path+0x18c/0x690 [ 114.383424][ T7824] tomoyo_check_open_permission+0x2af/0x3c0 [ 114.383437][ T7824] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 114.383453][ T7824] ? hook_file_open+0x248/0x8e0 [ 114.383481][ T7824] tomoyo_file_open+0x6b/0x90 [ 114.383497][ T7824] security_file_open+0xb5/0x1e0 [ 114.383511][ T7824] do_dentry_open+0x588/0x14d0 [ 114.383527][ T7824] vfs_open+0x82/0x3f0 [ 114.383542][ T7824] path_openat+0x19fa/0x2440 [ 114.383558][ T7824] ? __pfx_path_openat+0x10/0x10 [ 114.383576][ T7824] do_file_open+0x20e/0x430 [ 114.383591][ T7824] ? __pfx_do_file_open+0x10/0x10 [ 114.383613][ T7824] ? _raw_spin_unlock+0x28/0x50 [ 114.383628][ T7824] ? alloc_fd+0x471/0x7a0 [ 114.383645][ T7824] do_sys_openat2+0x10f/0x1e0 [ 114.383661][ T7824] ? __pfx_do_sys_openat2+0x10/0x10 [ 114.383676][ T7824] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 114.383694][ T7824] ? __fget_files+0x21f/0x3d0 [ 114.383710][ T7824] __x64_sys_openat+0x12d/0x210 [ 114.383725][ T7824] ? __pfx___x64_sys_openat+0x10/0x10 [ 114.383740][ T7824] ? ksys_write+0x1ac/0x250 [ 114.383756][ T7824] do_syscall_64+0x123/0x790 [ 114.383773][ T7824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.383784][ T7824] RIP: 0033:0x7fb71859e159 [ 114.383794][ T7824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.383804][ T7824] RSP: 002b:00007fb71952f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 114.383815][ T7824] RAX: ffffffffffffffda RBX: 00007fb718825fa0 RCX: 00007fb71859e159 [ 114.383822][ T7824] RDX: 0000000000000001 RSI: 0000200000000500 RDI: ffffffffffffff9c [ 114.383829][ T7824] RBP: 00007fb71952f090 R08: 0000000000000000 R09: 0000000000000000 [ 114.383835][ T7824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 114.383841][ T7824] R13: 00007fb718826038 R14: 00007fb718825fa0 R15: 00007ffdcc839da8 [ 114.383855][ T7824] [ 114.383865][ T7824] ERROR: Out of memory at tomoyo_realpath_from_path. [ 114.534117][ T42] usb 10-1: Invalid ep0 maxpacket: 16 [ 114.674832][ T42] usb 10-1: new low-speed USB device number 6 using dummy_hcd [ 114.844288][ T42] usb 10-1: Invalid ep0 maxpacket: 16 [ 114.847213][ T42] usb usb10-port1: attempt power cycle [ 115.184167][ T42] usb 10-1: new low-speed USB device number 7 using dummy_hcd [ 115.206247][ T42] usb 10-1: Invalid ep0 maxpacket: 16 [ 115.334130][ T42] usb 10-1: new low-speed USB device number 8 using dummy_hcd [ 115.354869][ T42] usb 10-1: Invalid ep0 maxpacket: 16 [ 115.355127][ T42] usb usb10-port1: unable to enumerate USB device [ 115.721683][ T43] kauditd_printk_skb: 19 callbacks suppressed [ 115.721695][ T43] audit: type=1400 audit(1789806292.635:855): avc: denied { unmount } for pid=6314 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 115.786545][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 115.786562][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 115.786587][ T5143] loop0: [ 115.869925][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 115.869942][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 115.869968][ T5143] loop0: [ 115.952459][ T7850] FAULT_INJECTION: forcing a failure. [ 115.952459][ T7850] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 115.952483][ T7850] CPU: 1 UID: 0 PID: 7850 Comm: syz.3.592 Tainted: G L syzkaller #0 PREEMPT(full) [ 115.952498][ T7850] Tainted: [L]=SOFTLOCKUP [ 115.952502][ T7850] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 115.952508][ T7850] Call Trace: [ 115.952512][ T7850] [ 115.952516][ T7850] dump_stack_lvl+0x100/0x190 [ 115.952536][ T7850] should_fail_ex.cold+0x5/0xa [ 115.952553][ T7850] strncpy_from_user+0x3b/0x2d0 [ 115.952568][ T7850] do_getname+0x78/0x390 [ 115.952586][ T7850] do_sys_openat2+0xc7/0x1e0 [ 115.952601][ T7850] ? __pfx_do_sys_openat2+0x10/0x10 [ 115.952617][ T7850] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 115.952635][ T7850] ? __fget_files+0x21f/0x3d0 [ 115.952650][ T7850] __x64_sys_openat+0x12d/0x210 [ 115.952666][ T7850] ? __pfx___x64_sys_openat+0x10/0x10 [ 115.952681][ T7850] ? ksys_write+0x1ac/0x250 [ 115.952696][ T7850] do_syscall_64+0x123/0x790 [ 115.952713][ T7850] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.952725][ T7850] RIP: 0033:0x7fb71855e98e [ 115.952734][ T7850] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 115.952744][ T7850] RSP: 002b:00007fb71952eb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 115.952756][ T7850] RAX: ffffffffffffffda RBX: 00007fb71952f6c0 RCX: 00007fb71855e98e [ 115.952763][ T7850] RDX: 0000000000000000 RSI: 00007fb71952ec00 RDI: ffffffffffffff9c [ 115.952769][ T7850] RBP: 00007fb71952ec00 R08: 0000000000000000 R09: 0000000000000000 [ 115.952776][ T7850] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 115.952782][ T7850] R13: 00007fb718826038 R14: 00007fb718825fa0 R15: 00007ffdcc839da8 [ 115.952796][ T7850] [ 115.955752][ T7849] nvmet: Invalid value 't' for trtype [ 116.018979][ T7854] bridge: RTM_NEWNEIGH with unconfigured vlan 2 on bridge_slave_1 [ 116.023788][ T7854] bridge4: entered promiscuous mode [ 116.029201][ T7854] netlink: 84 bytes leftover after parsing attributes in process `syz.4.594'. [ 116.038316][ T7855] netlink: 24 bytes leftover after parsing attributes in process `syz.3.593'. [ 116.866433][ T7852] syz.3.593 (7852): drop_caches: 2 [ 117.059971][ T7872] FAULT_INJECTION: forcing a failure. [ 117.059971][ T7872] name failslab, interval 1, probability 0, space 0, times 0 [ 117.060003][ T7872] CPU: 0 UID: 0 PID: 7872 Comm: syz.4.602 Tainted: G L syzkaller #0 PREEMPT(full) [ 117.060030][ T7872] Tainted: [L]=SOFTLOCKUP [ 117.060037][ T7872] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 117.060049][ T7872] Call Trace: [ 117.060056][ T7872] [ 117.060064][ T7872] dump_stack_lvl+0x100/0x190 [ 117.060098][ T7872] should_fail_ex.cold+0x5/0xa [ 117.060126][ T7872] should_failslab+0xc2/0x120 [ 117.060151][ T7872] __kmalloc_cache_noprof+0x91/0x6d0 [ 117.060183][ T7872] ? kernfs_fop_open+0x23d/0xd50 [ 117.060208][ T7872] kernfs_fop_open+0x23d/0xd50 [ 117.060235][ T7872] do_dentry_open+0x6ab/0x14d0 [ 117.060256][ T7872] ? __pfx_kernfs_fop_open+0x10/0x10 [ 117.060284][ T7872] vfs_open+0x82/0x3f0 [ 117.060312][ T7872] path_openat+0x19fa/0x2440 [ 117.060341][ T7872] ? __pfx_path_openat+0x10/0x10 [ 117.060388][ T7872] do_file_open+0x20e/0x430 [ 117.060415][ T7872] ? __pfx_do_file_open+0x10/0x10 [ 117.060464][ T7872] ? _raw_spin_unlock+0x28/0x50 [ 117.060488][ T7872] ? alloc_fd+0x471/0x7a0 [ 117.060520][ T7872] do_sys_openat2+0x10f/0x1e0 [ 117.060546][ T7872] ? __pfx_do_sys_openat2+0x10/0x10 [ 117.060574][ T7872] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 117.060604][ T7872] ? __fget_files+0x21f/0x3d0 [ 117.060632][ T7872] __x64_sys_openat+0x12d/0x210 [ 117.060659][ T7872] ? __pfx___x64_sys_openat+0x10/0x10 [ 117.060685][ T7872] ? ksys_write+0x1ac/0x250 [ 117.060714][ T7872] do_syscall_64+0x123/0x790 [ 117.060744][ T7872] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.060764][ T7872] RIP: 0033:0x7f0bd2b9e159 [ 117.060781][ T7872] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 117.060800][ T7872] RSP: 002b:00007f0bd3b43028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 117.060821][ T7872] RAX: ffffffffffffffda RBX: 00007f0bd2e25fa0 RCX: 00007f0bd2b9e159 [ 117.060834][ T7872] RDX: 0000000000000001 RSI: 0000200000000500 RDI: ffffffffffffff9c [ 117.060846][ T7872] RBP: 00007f0bd3b43090 R08: 0000000000000000 R09: 0000000000000000 [ 117.060858][ T7872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 117.060870][ T7872] R13: 00007f0bd2e26038 R14: 00007f0bd2e25fa0 R15: 00007ffd3dbf5e08 [ 117.060896][ T7872] [ 117.374194][ T5818] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 117.443159][ T7880] loop4: detected capacity change from 0 to 7 [ 117.450702][ T7880] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 117.450718][ T7880] loop4: partition table partially beyond EOD, truncated [ 117.451021][ T7880] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 117.477096][ T6840] udevd[6840]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 117.544855][ T5818] usb 8-1: New USB device found, idVendor=19d2, idProduct=ff5f, bcdDevice=d4.58 [ 117.547578][ T5818] usb 8-1: config 64 has an invalid interface number: 184 but max is 2 [ 117.547601][ T5818] usb 8-1: config 64 has an invalid descriptor of length 0, skipping remainder of the config [ 117.547615][ T5818] usb 8-1: config 64 has 1 interface, different from the descriptor's value: 3 [ 117.547631][ T5818] usb 8-1: config 64 has no interface number 0 [ 117.547662][ T5818] usb 8-1: config 64 interface 184 altsetting 6 endpoint 0xB has invalid wMaxPacketSize 0 [ 117.547680][ T5818] usb 8-1: config 64 interface 184 altsetting 6 endpoint 0xD has an invalid bInterval 56, changing to 9 [ 117.547699][ T5818] usb 8-1: config 64 interface 184 altsetting 6 endpoint 0x1 has an invalid bInterval 255, changing to 7 [ 117.547718][ T5818] usb 8-1: config 64 interface 184 altsetting 6 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 117.547737][ T5818] usb 8-1: config 64 interface 184 altsetting 6 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 117.547755][ T5818] usb 8-1: config 64 interface 184 altsetting 6 has 6 endpoint descriptors, different from the interface descriptor's value: 11 [ 117.547829][ T5818] usb 8-1: config 64 interface 184 has no altsetting 0 [ 117.549701][ T5818] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.549718][ T5818] usb 8-1: Product: ã° [ 117.549729][ T5818] usb 8-1: Manufacturer: ⚬ɖࠃᗩ︑훅㨶寘蘀際欧ΈⰌ㬶藋ⷢ६躅褵禎㓧䠘팭堸ê†ä±žà³©äœ·ê°„็ᩃ쉽饷࿄權ᛡ앦넕à©íƒ¼è“ঢ罫喽æ ì˜°çŽ¹å¹¥äŒ©ìƒ¯ïž€è¤‹å®Šâ€ºá¾¹èš’♬腘넖䓯髡ࢪꪆéœÎ–臭㮹ïµá €é°–㣇룹â譼䷛გ᥾㬢ë¸á¤‹î‡¬í‡­ãªµâµµî‰™ì¨µî±žèŒ¾á ‘㎱뱪Ⳣ庌ꠤ韜ꀙ뿽ã‹åˆá§ƒá¶ˆçƒ’⎻ [ 117.766460][ T43] audit: type=1400 audit(1789806294.685:856): avc: denied { mounton } for pid=7873 comm="syz.3.603" path="/145/dev/sda1" dev="devtmpfs" ino=724 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 117.847669][ T43] audit: type=1400 audit(1789806294.765:857): avc: denied { setopt } for pid=7890 comm="syz.4.610" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 117.938415][ T7874] netlink: 64 bytes leftover after parsing attributes in process `syz.3.603'. [ 118.461121][ T43] audit: type=1400 audit(1789806295.375:858): avc: denied { write } for pid=7902 comm="syz.5.611" name="subsystems" dev="configfs" ino=10566 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 118.461266][ T43] audit: type=1400 audit(1789806295.375:859): avc: denied { write } for pid=7902 comm="syz.5.611" name="subsystems" dev="configfs" ino=10566 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 118.461311][ T7903] nvmet_tcp: malformed ip/port passed: :4420 [ 118.565140][ T7913] FAULT_INJECTION: forcing a failure. [ 118.565140][ T7913] name failslab, interval 1, probability 0, space 0, times 0 [ 118.565163][ T7913] CPU: 0 UID: 0 PID: 7913 Comm: syz.5.615 Tainted: G L syzkaller #0 PREEMPT(full) [ 118.565178][ T7913] Tainted: [L]=SOFTLOCKUP [ 118.565182][ T7913] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 118.565189][ T7913] Call Trace: [ 118.565193][ T7913] [ 118.565197][ T7913] dump_stack_lvl+0x100/0x190 [ 118.565240][ T7913] should_fail_ex.cold+0x5/0xa [ 118.565256][ T7913] should_failslab+0xc2/0x120 [ 118.565274][ T7913] kmem_cache_alloc_noprof+0x92/0x6a0 [ 118.565287][ T7913] ? security_file_alloc+0x34/0x2c0 [ 118.565304][ T7913] security_file_alloc+0x34/0x2c0 [ 118.565317][ T7913] init_file+0x95/0x480 [ 118.565332][ T7913] alloc_empty_file+0x79/0x1c0 [ 118.565348][ T7913] path_openat+0xdb/0x2440 [ 118.565364][ T7913] ? __pfx_path_openat+0x10/0x10 [ 118.565381][ T7913] do_file_open+0x20e/0x430 [ 118.565396][ T7913] ? __pfx_do_file_open+0x10/0x10 [ 118.565418][ T7913] ? _raw_spin_unlock+0x28/0x50 [ 118.565436][ T7913] ? alloc_fd+0x471/0x7a0 [ 118.565453][ T7913] do_sys_openat2+0x10f/0x1e0 [ 118.565469][ T7913] ? __pfx_do_sys_openat2+0x10/0x10 [ 118.565484][ T7913] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 118.565502][ T7913] ? __fget_files+0x21f/0x3d0 [ 118.565517][ T7913] __x64_sys_openat+0x12d/0x210 [ 118.565533][ T7913] ? __pfx___x64_sys_openat+0x10/0x10 [ 118.565548][ T7913] ? ksys_write+0x1ac/0x250 [ 118.565563][ T7913] do_syscall_64+0x123/0x790 [ 118.565580][ T7913] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.565592][ T7913] RIP: 0033:0x7fb62bf5e98e [ 118.565601][ T7913] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 118.565612][ T7913] RSP: 002b:00007fb62ce81b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 118.565624][ T7913] RAX: ffffffffffffffda RBX: 00007fb62ce826c0 RCX: 00007fb62bf5e98e [ 118.565631][ T7913] RDX: 0000000000000000 RSI: 00007fb62ce81c00 RDI: ffffffffffffff9c [ 118.565637][ T7913] RBP: 00007fb62ce81c00 R08: 0000000000000000 R09: 0000000000000000 [ 118.565644][ T7913] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 118.565650][ T7913] R13: 00007fb62c226038 R14: 00007fb62c225fa0 R15: 00007ffe0a1548f8 [ 118.565664][ T7913] [ 118.597035][ T7915] Cannot find add_set index 0 as target [ 118.685249][ T43] audit: type=1400 audit(1789806295.605:860): avc: denied { nlmsg_read } for pid=7920 comm="syz.4.620" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 118.725781][ T7929] loop4: detected capacity change from 0 to 7 [ 118.730243][ T7929] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 118.730261][ T7929] loop4: partition table partially beyond EOD, truncated [ 118.730610][ T7929] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 118.753889][ T6825] udevd[6825]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 118.797059][ T7935] FAULT_INJECTION: forcing a failure. [ 118.797059][ T7935] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 118.797082][ T7935] CPU: 1 UID: 0 PID: 7935 Comm: syz.5.623 Tainted: G L syzkaller #0 PREEMPT(full) [ 118.797097][ T7935] Tainted: [L]=SOFTLOCKUP [ 118.797101][ T7935] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 118.797108][ T7935] Call Trace: [ 118.797112][ T7935] [ 118.797116][ T7935] dump_stack_lvl+0x100/0x190 [ 118.797136][ T7935] should_fail_ex.cold+0x5/0xa [ 118.797152][ T7935] _copy_from_iter+0x1f4/0x1690 [ 118.797168][ T7935] ? __pfx__copy_from_iter+0x10/0x10 [ 118.797180][ T7935] ? kasan_save_track+0x14/0x30 [ 118.797192][ T7935] ? __kasan_kmalloc+0xaa/0xb0 [ 118.797205][ T7935] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 118.797223][ T7935] ? configfs_write_iter+0x388/0x4e0 [ 118.797242][ T7935] configfs_write_iter+0xb3/0x4e0 [ 118.797261][ T7935] vfs_write+0x6af/0x1050 [ 118.797272][ T7935] ? __pfx_configfs_write_iter+0x10/0x10 [ 118.797291][ T7935] ? __pfx_vfs_write+0x10/0x10 [ 118.797301][ T7935] ? find_held_lock+0x2b/0x80 [ 118.797325][ T7935] ksys_write+0x12a/0x250 [ 118.797336][ T7935] ? __pfx_ksys_write+0x10/0x10 [ 118.797351][ T7935] do_syscall_64+0x123/0x790 [ 118.797369][ T7935] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.797381][ T7935] RIP: 0033:0x7fb62bf9e159 [ 118.797391][ T7935] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.797402][ T7935] RSP: 002b:00007fb62ce82028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 118.797413][ T7935] RAX: ffffffffffffffda RBX: 00007fb62c225fa0 RCX: 00007fb62bf9e159 [ 118.797420][ T7935] RDX: 0000000000000002 RSI: 0000200000000180 RDI: 0000000000000003 [ 118.797427][ T7935] RBP: 00007fb62ce82090 R08: 0000000000000000 R09: 0000000000000000 [ 118.797433][ T7935] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 118.797439][ T7935] R13: 00007fb62c226038 R14: 00007fb62c225fa0 R15: 00007ffe0a1548f8 [ 118.797453][ T7935] [ 118.799930][ T43] audit: type=1400 audit(1789806295.715:861): avc: denied { write } for pid=7934 comm="syz.5.623" name="subsystems" dev="configfs" ino=10566 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 118.800076][ T43] audit: type=1400 audit(1789806295.715:862): avc: denied { write } for pid=7934 comm="syz.5.623" name="subsystems" dev="configfs" ino=10566 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 118.800120][ T7935] nvmet_tcp: malformed ip/port passed: :4420 [ 118.858055][ T7938] FAULT_INJECTION: forcing a failure. [ 118.858055][ T7938] name failslab, interval 1, probability 0, space 0, times 0 [ 118.858088][ T7938] CPU: 0 UID: 0 PID: 7938 Comm: syz.3.624 Tainted: G L syzkaller #0 PREEMPT(full) [ 118.858116][ T7938] Tainted: [L]=SOFTLOCKUP [ 118.858123][ T7938] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 118.858135][ T7938] Call Trace: [ 118.858143][ T7938] [ 118.858150][ T7938] dump_stack_lvl+0x100/0x190 [ 118.858228][ T7938] should_fail_ex.cold+0x5/0xa [ 118.858259][ T7938] should_failslab+0xc2/0x120 [ 118.858283][ T7938] kmem_cache_alloc_noprof+0x92/0x6a0 [ 118.858303][ T7938] ? seq_open+0x55/0x170 [ 118.858325][ T7938] seq_open+0x55/0x170 [ 118.858341][ T7938] kernfs_fop_open+0x590/0xd50 [ 118.858358][ T7938] do_dentry_open+0x6ab/0x14d0 [ 118.858371][ T7938] ? __pfx_kernfs_fop_open+0x10/0x10 [ 118.858387][ T7938] vfs_open+0x82/0x3f0 [ 118.858405][ T7938] path_openat+0x19fa/0x2440 [ 118.858422][ T7938] ? __pfx_path_openat+0x10/0x10 [ 118.858442][ T7938] do_file_open+0x20e/0x430 [ 118.858458][ T7938] ? __pfx_do_file_open+0x10/0x10 [ 118.858484][ T7938] ? _raw_spin_unlock+0x28/0x50 [ 118.858499][ T7938] ? alloc_fd+0x471/0x7a0 [ 118.858518][ T7938] do_sys_openat2+0x10f/0x1e0 [ 118.858535][ T7938] ? __pfx_do_sys_openat2+0x10/0x10 [ 118.858552][ T7938] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 118.858571][ T7938] ? __fget_files+0x21f/0x3d0 [ 118.858589][ T7938] __x64_sys_openat+0x12d/0x210 [ 118.858606][ T7938] ? __pfx___x64_sys_openat+0x10/0x10 [ 118.858622][ T7938] ? ksys_write+0x1ac/0x250 [ 118.858639][ T7938] do_syscall_64+0x123/0x790 [ 118.858658][ T7938] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.858671][ T7938] RIP: 0033:0x7fb71859e159 [ 118.858682][ T7938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.858694][ T7938] RSP: 002b:00007fb71952f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 118.858706][ T7938] RAX: ffffffffffffffda RBX: 00007fb718825fa0 RCX: 00007fb71859e159 [ 118.858714][ T7938] RDX: 0000000000000001 RSI: 0000200000000500 RDI: ffffffffffffff9c [ 118.858721][ T7938] RBP: 00007fb71952f090 R08: 0000000000000000 R09: 0000000000000000 [ 118.858728][ T7938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 118.858735][ T7938] R13: 00007fb718826038 R14: 00007fb718825fa0 R15: 00007ffdcc839da8 [ 118.858750][ T7938] [ 118.924282][ T42] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 118.967573][ T43] audit: type=1400 audit(1789806295.885:863): avc: denied { create } for pid=7941 comm="syz.5.626" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 118.967885][ T43] audit: type=1400 audit(1789806295.885:864): avc: denied { write } for pid=7941 comm="syz.5.626" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 118.997114][ T7949] nvmet_tcp: malformed ip/port passed: :4420 [ 119.074555][ T42] usb 9-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 119.075351][ T42] usb 9-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 119.075365][ T42] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.075375][ T42] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 119.075394][ T42] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 119.075406][ T42] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 119.076530][ T42] usb 9-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 119.076542][ T42] usb 9-1: Product: syz [ 119.076549][ T42] usb 9-1: Manufacturer: syz [ 119.079015][ T42] cdc_wdm 9-1:1.0: skipping garbage [ 119.079025][ T42] cdc_wdm 9-1:1.0: skipping garbage [ 119.086905][ T42] cdc_wdm 9-1:1.0: cdc-wdm0: USB WDM device [ 119.086917][ T42] cdc_wdm 9-1:1.0: Unknown control protocol [ 119.220108][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 119.220133][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 119.220181][ T5143] loop0: [ 119.288430][ T7921] cdc_wdm 9-1:1.0: Error submitting int urb - -90 [ 119.289226][ T2363] usb 9-1: USB disconnect, device number 12 [ 119.526452][ T7968] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 119.854210][ T7973] netlink: 8 bytes leftover after parsing attributes in process `syz.4.634'. [ 119.964908][ T7977] netlink: 8 bytes leftover after parsing attributes in process `syz.3.636'. [ 119.995946][ T7977] netlink: 'syz.3.636': attribute type 1 has an invalid length. [ 119.998808][ T7978] netlink: 84 bytes leftover after parsing attributes in process `syz.3.636'. [ 119.998964][ T7977] netlink: 'syz.3.636': attribute type 1 has an invalid length. [ 120.181815][ T7986] FAULT_INJECTION: forcing a failure. [ 120.181815][ T7986] name failslab, interval 1, probability 0, space 0, times 0 [ 120.181846][ T7986] CPU: 0 UID: 0 PID: 7986 Comm: syz.5.638 Tainted: G L syzkaller #0 PREEMPT(full) [ 120.181872][ T7986] Tainted: [L]=SOFTLOCKUP [ 120.181878][ T7986] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 120.181890][ T7986] Call Trace: [ 120.181897][ T7986] [ 120.181904][ T7986] dump_stack_lvl+0x100/0x190 [ 120.181948][ T7986] should_fail_ex.cold+0x5/0xa [ 120.181973][ T7986] should_failslab+0xc2/0x120 [ 120.181999][ T7986] __kmalloc_noprof+0xfc/0x840 [ 120.182018][ T7986] ? rcu_is_watching+0x13/0xc0 [ 120.182044][ T7986] ? tomoyo_realpath_from_path+0xb6/0x690 [ 120.182074][ T7986] tomoyo_realpath_from_path+0xb6/0x690 [ 120.182103][ T7986] tomoyo_check_open_permission+0x2af/0x3c0 [ 120.182124][ T7986] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 120.182153][ T7986] ? hook_file_open+0x248/0x8e0 [ 120.182218][ T7986] ? path_get+0x61/0x80 [ 120.182248][ T7986] tomoyo_file_open+0x6b/0x90 [ 120.182274][ T7986] security_file_open+0xb5/0x1e0 [ 120.182298][ T7986] do_dentry_open+0x588/0x14d0 [ 120.182325][ T7986] vfs_open+0x82/0x3f0 [ 120.182352][ T7986] path_openat+0x19fa/0x2440 [ 120.182380][ T7986] ? __pfx_path_openat+0x10/0x10 [ 120.182415][ T7986] do_file_open+0x20e/0x430 [ 120.182440][ T7986] ? __pfx_do_file_open+0x10/0x10 [ 120.182481][ T7986] ? _raw_spin_unlock+0x28/0x50 [ 120.182505][ T7986] ? alloc_fd+0x471/0x7a0 [ 120.182536][ T7986] do_sys_openat2+0x10f/0x1e0 [ 120.182560][ T7986] ? __pfx_do_sys_openat2+0x10/0x10 [ 120.182587][ T7986] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 120.182616][ T7986] ? __fget_files+0x21f/0x3d0 [ 120.182643][ T7986] __x64_sys_openat+0x12d/0x210 [ 120.182669][ T7986] ? __pfx___x64_sys_openat+0x10/0x10 [ 120.182694][ T7986] ? ksys_write+0x1ac/0x250 [ 120.182723][ T7986] do_syscall_64+0x123/0x790 [ 120.182751][ T7986] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.182770][ T7986] RIP: 0033:0x7fb62bf5e98e [ 120.182785][ T7986] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 120.182803][ T7986] RSP: 002b:00007fb62ce81b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 120.182821][ T7986] RAX: ffffffffffffffda RBX: 00007fb62ce826c0 RCX: 00007fb62bf5e98e [ 120.182833][ T7986] RDX: 0000000000000000 RSI: 00007fb62ce81c00 RDI: ffffffffffffff9c [ 120.182845][ T7986] RBP: 00007fb62ce81c00 R08: 0000000000000000 R09: 0000000000000000 [ 120.182856][ T7986] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 120.182867][ T7986] R13: 00007fb62c226038 R14: 00007fb62c225fa0 R15: 00007ffe0a1548f8 [ 120.182892][ T7986] [ 120.182949][ T7986] ERROR: Out of memory at tomoyo_realpath_from_path. [ 120.333900][ T1164] IPVS: starting estimator thread 0... [ 120.339467][ T7992] netlink: 12 bytes leftover after parsing attributes in process `syz.5.641'. [ 120.366616][ T8002] FAULT_INJECTION: forcing a failure. [ 120.366616][ T8002] name failslab, interval 1, probability 0, space 0, times 0 [ 120.366648][ T8002] CPU: 0 UID: 0 PID: 8002 Comm: syz.3.645 Tainted: G L syzkaller #0 PREEMPT(full) [ 120.366686][ T8002] Tainted: [L]=SOFTLOCKUP [ 120.366692][ T8002] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 120.366702][ T8002] Call Trace: [ 120.366708][ T8002] [ 120.366717][ T8002] dump_stack_lvl+0x100/0x190 [ 120.366751][ T8002] should_fail_ex.cold+0x5/0xa [ 120.366775][ T8002] should_failslab+0xc2/0x120 [ 120.366797][ T8002] kmem_cache_alloc_noprof+0x92/0x6a0 [ 120.366816][ T8002] ? seq_open+0x55/0x170 [ 120.366837][ T8002] seq_open+0x55/0x170 [ 120.366853][ T8002] kernfs_fop_open+0x590/0xd50 [ 120.366880][ T8002] do_dentry_open+0x6ab/0x14d0 [ 120.366902][ T8002] ? __pfx_kernfs_fop_open+0x10/0x10 [ 120.366926][ T8002] vfs_open+0x82/0x3f0 [ 120.366950][ T8002] path_openat+0x19fa/0x2440 [ 120.366974][ T8002] ? __pfx_path_openat+0x10/0x10 [ 120.367001][ T8002] do_file_open+0x20e/0x430 [ 120.367025][ T8002] ? __pfx_do_file_open+0x10/0x10 [ 120.367067][ T8002] ? _raw_spin_unlock+0x28/0x50 [ 120.367088][ T8002] ? alloc_fd+0x471/0x7a0 [ 120.367115][ T8002] do_sys_openat2+0x10f/0x1e0 [ 120.367137][ T8002] ? __pfx_do_sys_openat2+0x10/0x10 [ 120.367160][ T8002] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 120.367190][ T8002] ? __fget_files+0x21f/0x3d0 [ 120.367217][ T8002] __x64_sys_openat+0x12d/0x210 [ 120.367240][ T8002] ? __pfx___x64_sys_openat+0x10/0x10 [ 120.367261][ T8002] ? ksys_write+0x1ac/0x250 [ 120.367285][ T8002] do_syscall_64+0x123/0x790 [ 120.367311][ T8002] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.367330][ T8002] RIP: 0033:0x7fb71859e159 [ 120.367347][ T8002] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.367366][ T8002] RSP: 002b:00007fb71952f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 120.367382][ T8002] RAX: ffffffffffffffda RBX: 00007fb718825fa0 RCX: 00007fb71859e159 [ 120.367398][ T8002] RDX: 0000000000000001 RSI: 0000200000000500 RDI: ffffffffffffff9c [ 120.367408][ T8002] RBP: 00007fb71952f090 R08: 0000000000000000 R09: 0000000000000000 [ 120.367418][ T8002] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 120.367427][ T8002] R13: 00007fb718826038 R14: 00007fb718825fa0 R15: 00007ffdcc839da8 [ 120.367450][ T8002] [ 120.434144][ T8000] IPVS: using max 44 ests per chain, 105600 per kthread [ 120.508009][ T8008] netlink: 28 bytes leftover after parsing attributes in process `syz.4.648'. [ 120.536574][ T8010] ip6t_rpfilter: unknown options [ 120.562500][ T8012] loop4: detected capacity change from 0 to 7 [ 120.569239][ T8012] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 120.569265][ T8012] loop4: partition table partially beyond EOD, truncated [ 120.569422][ T8012] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 120.615791][ T6825] udevd[6825]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 120.894255][ T42] usb 9-1: new full-speed USB device number 13 using dummy_hcd [ 121.046534][ T42] usb 9-1: not running at top speed; connect to a high speed hub [ 121.046553][ T42] usb 9-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 121.047801][ T42] usb 9-1: config 1 interface 0 altsetting 4 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 121.047818][ T42] usb 9-1: config 1 interface 0 altsetting 4 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 121.047831][ T42] usb 9-1: config 1 interface 0 has no altsetting 0 [ 121.051073][ T42] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.051085][ T42] usb 9-1: Product: syz [ 121.051092][ T42] usb 9-1: Manufacturer: syz [ 121.051099][ T42] usb 9-1: SerialNumber: syz [ 121.055380][ T8015] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 121.473100][ T8032] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 121.473360][ T8032] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 122.265929][ T43] kauditd_printk_skb: 8 callbacks suppressed [ 122.265945][ T43] audit: type=1400 audit(1789806299.185:873): avc: denied { mmap_zero } for pid=8038 comm="syz.3.661" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 122.376584][ T5742] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 122.486252][ T43] audit: type=1400 audit(1789806299.405:874): avc: denied { create } for pid=8045 comm="syz.5.663" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=rose_socket permissive=1 [ 122.617581][ T5818] option 8-1:64.184: GSM modem (1-port) converter detected [ 122.768128][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 122.768205][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 122.768250][ T5143] loop0: [ 122.814961][ T43] audit: type=1400 audit(1789806299.735:875): avc: denied { map } for pid=8050 comm="syz.5.665" path="socket:[24840]" dev="sockfs" ino=24840 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 122.815139][ T43] audit: type=1400 audit(1789806299.735:876): avc: denied { read } for pid=8050 comm="syz.5.665" path="socket:[24840]" dev="sockfs" ino=24840 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 122.860243][ T8059] loop4: detected capacity change from 0 to 7 [ 122.870213][ T8059] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 122.870233][ T8059] loop4: partition table partially beyond EOD, truncated [ 122.870345][ T8059] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 122.895473][ T6840] udevd[6840]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 123.070318][ T43] audit: type=1400 audit(1789806299.985:877): avc: denied { ioctl } for pid=8064 comm="syz.5.669" path="socket:[24135]" dev="sockfs" ino=24135 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 123.083837][ T43] audit: type=1400 audit(1789806299.995:878): avc: denied { create } for pid=8064 comm="syz.5.669" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 123.085833][ T43] audit: type=1400 audit(1789806300.005:879): avc: denied { bind } for pid=8064 comm="syz.5.669" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 123.090477][ T43] audit: type=1400 audit(1789806300.005:880): avc: denied { listen } for pid=8064 comm="syz.5.669" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 123.096225][ T43] audit: type=1400 audit(1789806300.015:881): avc: denied { write } for pid=8064 comm="syz.5.669" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 123.152327][ T8068] Cannot find add_set index 0 as target [ 123.198114][ T43] audit: type=1400 audit(1789806300.115:882): avc: denied { mounton } for pid=8069 comm="syz.5.671" path="/" dev="tmpfs" ino=357 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=lnk_file permissive=1 [ 123.357515][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 123.357534][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 123.357615][ T5143] loop0: [ 123.408362][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.408373][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.408461][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.408467][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.408507][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.408511][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.408550][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.408628][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.408672][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.408676][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.408715][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.408719][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.408811][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.408816][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.408856][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.408860][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.408968][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.408973][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409013][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409017][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409094][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409099][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409141][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409145][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409183][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409187][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409279][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409284][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409323][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409327][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409410][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409415][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409456][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409460][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409500][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409551][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409595][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409599][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409640][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409644][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409762][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409767][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409808][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409812][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409893][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409898][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.409940][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.409944][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410022][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410027][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410068][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410072][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410111][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410115][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410225][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410230][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410277][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410318][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410364][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410368][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410407][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410412][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410492][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410497][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410538][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410542][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410621][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410626][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410668][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410672][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410713][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410717][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410833][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410838][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410879][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410883][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.410972][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.410977][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411019][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411023][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411103][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411108][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411149][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411153][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411192][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411196][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411304][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411308][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411347][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411352][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411430][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411436][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411475][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411480][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411571][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411577][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411617][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411621][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411659][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411711][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411759][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411763][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411815][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411819][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411932][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411937][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.411977][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.411981][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.412069][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.412074][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.412126][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.412130][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.412210][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.412215][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.412255][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.412259][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.412338][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.412343][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.412396][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.412400][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.412440][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.412444][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.412534][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.412539][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.412578][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.412582][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.412674][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.412679][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.412719][ T8077] binder: BINDER_SET_CONTEXT_MGR already set [ 123.412723][ T8077] binder: 8075:8077 ioctl 4018620d 200000000340 returned -16 [ 123.470784][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.470806][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.470818][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.470828][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.470839][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.470850][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.470861][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.470871][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.470882][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.471930][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.471950][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.471961][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.471972][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.471983][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.471994][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472004][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472015][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472025][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472036][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472097][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472109][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472119][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472130][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472140][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472151][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472161][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472172][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472182][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472193][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472249][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472262][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472273][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.472283][ T8077] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 123.621926][ T42] usb 9-1: USB disconnect, device number 13 [ 123.984122][ T42] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 124.134613][ T42] usb 9-1: New USB device found, idVendor=0525, idProduct=1080, bcdDevice= 1.00 [ 124.135545][ T42] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.348395][ T42] net1080 9-1:1.0 usb0: register 'net1080' at usb-dummy_hcd.4-1, NetChip TurboCONNECT, e6:d1:98:89:43:38 [ 124.462775][ T8096] nvmet_tcp: malformed ip/port passed: :4420 [ 124.797783][ T5162] usb 9-1: USB disconnect, device number 14 [ 124.798812][ T5162] net1080 9-1:1.0 usb0: unregister 'net1080' usb-dummy_hcd.4-1, NetChip TurboCONNECT [ 125.332910][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 125.332933][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 125.332971][ T5143] loop0: [ 125.340859][ T8115] loop4: detected capacity change from 0 to 7 [ 125.347978][ T8115] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 125.348009][ T8115] loop4: partition table partially beyond EOD, truncated [ 125.348169][ T8115] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 125.380199][ T8117] nvmet: Invalid value 't' for trtype [ 125.426960][ T6825] udevd[6825]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 125.590626][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 125.590649][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 125.590688][ T5143] loop0: [ 125.708482][ T8144] FAULT_INJECTION: forcing a failure. [ 125.708482][ T8144] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 125.708506][ T8144] CPU: 1 UID: 0 PID: 8144 Comm: syz.3.697 Tainted: G L syzkaller #0 PREEMPT(full) [ 125.708524][ T8144] Tainted: [L]=SOFTLOCKUP [ 125.708528][ T8144] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 125.708536][ T8144] Call Trace: [ 125.708540][ T8144] [ 125.708545][ T8144] dump_stack_lvl+0x100/0x190 [ 125.708569][ T8144] should_fail_ex.cold+0x5/0xa [ 125.708588][ T8144] _copy_to_user+0x32/0xd0 [ 125.708604][ T8144] simple_read_from_buffer+0xcb/0x170 [ 125.708621][ T8144] proc_fail_nth_read+0x1af/0x230 [ 125.708639][ T8144] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 125.708656][ T8144] ? rw_verify_area+0xce/0x6d0 [ 125.708675][ T8144] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 125.708690][ T8144] vfs_read+0x1e4/0xb40 [ 125.708703][ T8144] ? lock_acquire+0x1d1/0x380 [ 125.708716][ T8144] ? __fget_files+0x34/0x3d0 [ 125.708732][ T8144] ? __pfx_vfs_read+0x10/0x10 [ 125.708743][ T8144] ? find_held_lock+0x2b/0x80 [ 125.708761][ T8144] ? __fget_files+0x215/0x3d0 [ 125.708779][ T8144] ? __fget_files+0x21f/0x3d0 [ 125.708799][ T8144] ksys_read+0x12a/0x250 [ 125.708811][ T8144] ? __pfx_ksys_read+0x10/0x10 [ 125.708828][ T8144] do_syscall_64+0x123/0x790 [ 125.708853][ T8144] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.708866][ T8144] RIP: 0033:0x7fb71855e98e [ 125.708877][ T8144] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 125.708889][ T8144] RSP: 002b:00007fb71952efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 125.708902][ T8144] RAX: ffffffffffffffda RBX: 00007fb71952f6c0 RCX: 00007fb71855e98e [ 125.708911][ T8144] RDX: 000000000000000f RSI: 00007fb71952f0a0 RDI: 0000000000000004 [ 125.708919][ T8144] RBP: 00007fb71952f090 R08: 0000000000000000 R09: 0000000000000000 [ 125.708926][ T8144] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 125.708933][ T8144] R13: 00007fb718826038 R14: 00007fb718825fa0 R15: 00007ffdcc839da8 [ 125.708949][ T8144] [ 125.789885][ T8146] rdma_op ffff888036687a38 conn xmit_rdma 0000000000000000 [ 125.874282][ T42] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 125.914976][ T5162] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 125.987738][ T8149] loop4: detected capacity change from 0 to 7 [ 125.993438][ T8149] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 125.993465][ T8149] loop4: partition table partially beyond EOD, truncated [ 125.993638][ T8149] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 126.005099][ T42] usb 9-1: device descriptor read/64, error -71 [ 126.014248][ T6840] udevd[6840]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 126.085105][ T5162] usb 10-1: New USB device found, idVendor=0525, idProduct=1080, bcdDevice= 1.00 [ 126.086235][ T5162] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.093866][ T8157] nvmet: Invalid value 't' for trtype [ 126.244167][ T42] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 126.304861][ T5162] net1080 10-1:1.0 usb0: register 'net1080' at usb-dummy_hcd.5-1, NetChip TurboCONNECT, 7a:7b:5b:ba:30:c8 [ 126.361604][ T8159] FAULT_INJECTION: forcing a failure. [ 126.361604][ T8159] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 126.361637][ T8159] CPU: 0 UID: 0 PID: 8159 Comm: syz.3.702 Tainted: G L syzkaller #0 PREEMPT(full) [ 126.361662][ T8159] Tainted: [L]=SOFTLOCKUP [ 126.361667][ T8159] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 126.361676][ T8159] Call Trace: [ 126.361683][ T8159] [ 126.361689][ T8159] dump_stack_lvl+0x100/0x190 [ 126.361719][ T8159] should_fail_ex.cold+0x5/0xa [ 126.361740][ T8159] ? prepare_alloc_pages+0x16d/0x5b0 [ 126.361764][ T8159] should_fail_alloc_page+0xeb/0x140 [ 126.361786][ T8159] prepare_alloc_pages+0x1f0/0x5b0 [ 126.361812][ T8159] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 126.361832][ T8159] ? mark_held_locks+0x40/0x70 [ 126.361851][ T8159] ? smp_call_function_many_cond+0x1458/0x18c0 [ 126.361872][ T8159] ? lockdep_hardirqs_on+0x7d/0x110 [ 126.361895][ T8159] ? __pfx_flush_tlb_func+0x10/0x10 [ 126.361916][ T8159] ? smp_call_function_many_cond+0x944/0x18c0 [ 126.361938][ T8159] ? __pfx_should_flush_tlb+0x10/0x10 [ 126.361989][ T8159] ? __pfx_flush_tlb_func+0x10/0x10 [ 126.362011][ T8159] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 126.362029][ T8159] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 126.362052][ T8159] ? rcu_is_watching+0x13/0xc0 [ 126.362076][ T8159] ? trace_tlb_flush+0x14b/0x1a0 [ 126.362106][ T8159] ? __lock_acquire+0x5c0/0x1f40 [ 126.362127][ T8159] ? __css_rstat_updated+0x1ce/0x590 [ 126.362150][ T8159] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 126.362196][ T8159] ? policy_nodemask+0xed/0x4f0 [ 126.362223][ T8159] alloc_pages_mpol+0x201/0x550 [ 126.362246][ T8159] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 126.362272][ T8159] ? page_table_check_set+0x31e/0x580 [ 126.362298][ T8159] folio_alloc_mpol_noprof+0x36/0x260 [ 126.362325][ T8159] vma_alloc_folio_noprof+0xed/0x1d0 [ 126.362350][ T8159] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 126.362383][ T8159] ? rcu_read_unlock+0x2d/0xb0 [ 126.362408][ T8159] ? rcu_read_unlock+0x2d/0xb0 [ 126.362440][ T8159] do_wp_page+0x1b15/0x45c0 [ 126.362468][ T8159] ? lock_acquire+0x1d1/0x380 [ 126.362487][ T8159] ? __pfx_do_wp_page+0x10/0x10 [ 126.362512][ T8159] ? do_raw_spin_lock+0x128/0x260 [ 126.362536][ T8159] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 126.362566][ T8159] __handle_mm_fault+0x1cd2/0x2f60 [ 126.362592][ T8159] ? lock_vma_under_rcu+0x11d/0x590 [ 126.362615][ T8159] ? __pfx___handle_mm_fault+0x10/0x10 [ 126.362644][ T8159] ? lock_vma_under_rcu+0x17c/0x590 [ 126.362679][ T8159] handle_mm_fault+0x363/0xa20 [ 126.362709][ T8159] do_user_addr_fault+0x59c/0x12f0 [ 126.362742][ T8159] exc_page_fault+0x6f/0xd0 [ 126.362768][ T8159] asm_exc_page_fault+0x26/0x30 [ 126.362785][ T8159] RIP: 0033:0x7fb718464054 [ 126.362801][ T8159] Code: 00 00 00 64 f0 83 04 25 a0 ff ff ff 01 64 48 8b 04 25 00 00 00 00 48 8d b8 d8 fe ff ff e8 74 b1 0d 00 85 c0 0f 84 ec 01 00 00 <64> f0 83 2c 25 a0 ff ff ff 01 e8 1d 93 0c 00 48 8b 4c 24 08 8b 00 [ 126.362817][ T8159] RSP: 002b:00007fb71952f050 EFLAGS: 00010206 [ 126.362832][ T8159] RAX: 00000000000001bb RBX: 00007fb718825fa0 RCX: 00007fb71863506b [ 126.362845][ T8159] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 126.362855][ T8159] RBP: 00007fb71863506b R08: 0000000000000000 R09: 0000000000000000 [ 126.362865][ T8159] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000000 [ 126.362875][ T8159] R13: 00007fb718826038 R14: 00007fb718825fa0 R15: 00007ffdcc839da8 [ 126.362900][ T8159] [ 126.363245][ T8159] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 126.384261][ T42] usb 9-1: device descriptor read/64, error -71 [ 126.494880][ T42] usb usb9-port1: attempt power cycle [ 126.626268][ T8160] cgroup: fork rejected by pids controller in /syz3 [ 126.752291][ T5162] usb 10-1: USB disconnect, device number 9 [ 126.753267][ T5162] net1080 10-1:1.0 usb0: unregister 'net1080' usb-dummy_hcd.5-1, NetChip TurboCONNECT [ 126.875796][ T42] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 126.896929][ T42] usb 9-1: device descriptor read/8, error -71 [ 127.134404][ T42] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 127.154751][ T42] usb 9-1: device descriptor read/8, error -71 [ 127.264250][ T42] usb usb9-port1: unable to enumerate USB device [ 127.473671][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 127.473687][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 127.473725][ T5143] loop0: [ 127.497058][ T8238] netlink: 8 bytes leftover after parsing attributes in process `syz.3.710'. [ 127.499160][ T43] kauditd_printk_skb: 18 callbacks suppressed [ 127.499175][ T43] audit: type=1326 audit(1789806304.415:901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8237 comm="syz.3.710" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb71859e159 code=0x0 [ 127.512014][ T8240] Cannot find add_set index 0 as target [ 127.595610][ T8248] loop4: detected capacity change from 0 to 7 [ 127.600544][ T8248] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 127.600564][ T8248] loop4: partition table partially beyond EOD, truncated [ 127.600679][ T8248] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 127.603324][ T43] audit: type=1400 audit(1789806304.515:902): avc: denied { write } for pid=8237 comm="syz.3.710" name="ptp0" dev="devtmpfs" ino=728 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 127.641665][ T6840] udevd[6840]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 127.655983][ T5162] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 127.660134][ T5162] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 127.692643][ T43] audit: type=1400 audit(1789806304.605:903): avc: denied { write } for pid=8250 comm="syz.5.715" name="c.1" dev="configfs" ino=11235 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 127.694119][ T43] audit: type=1400 audit(1789806304.605:904): avc: denied { write } for pid=8250 comm="syz.5.715" name="c.1" dev="configfs" ino=11235 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 127.748935][ T8254] x_tables: ip_tables: .0 target: invalid size 8 (kernel) != (user) 4 [ 127.917484][ T5162] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 128.372233][ T8257] nvmet: Invalid value 't' for trtype [ 128.425684][ T5162] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 128.443648][ T8259] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 128.629154][ T8263] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.629768][ T8263] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.673566][ T8263] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.676001][ T8263] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 128.706373][ T8251] ceph: No mds server is up or the cluster is laggy [ 128.814767][ T13] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.814801][ T13] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.814823][ T13] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.815878][ T13] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.115155][ T5880] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 129.268766][ T5880] usb 9-1: New USB device found, idVendor=0525, idProduct=1080, bcdDevice= 1.00 [ 129.269747][ T5880] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.383658][ T5742] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 129.386252][ T5742] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 129.386939][ T5742] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 129.387279][ T5742] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 129.387508][ T5742] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 129.423645][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 129.423668][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 129.423758][ T5143] loop0: [ 129.469486][ T8297] ip6t_rpfilter: unknown options [ 129.514119][ T5880] net1080 9-1:1.0 usb0: register 'net1080' at usb-dummy_hcd.4-1, NetChip TurboCONNECT, 0a:c9:ad:35:a7:6c [ 129.523744][ T43] audit: type=1400 audit(1789806306.435:905): avc: denied { write } for pid=8300 comm="syz.3.729" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 129.541307][ T8302] netlink: 'syz.3.729': attribute type 58 has an invalid length. [ 129.589787][ T8309] loop4: detected capacity change from 0 to 7 [ 129.594808][ T8309] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 129.594822][ T8309] loop4: partition table partially beyond EOD, truncated [ 129.594911][ T8309] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 129.626590][ T6840] udevd[6840]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 129.627715][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.631600][ T43] audit: type=1400 audit(1789806306.545:906): avc: denied { write } for pid=8310 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.672746][ T43] audit: type=1400 audit(1789806306.585:907): avc: denied { write } for pid=8316 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.701524][ T8285] lo speed is unknown, defaulting to 1000 [ 129.824293][ T30] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 129.953288][ T5880] usb 9-1: USB disconnect, device number 19 [ 129.954345][ T5880] net1080 9-1:1.0 usb0: unregister 'net1080' usb-dummy_hcd.4-1, NetChip TurboCONNECT [ 129.974203][ T30] usb 10-1: Using ep0 maxpacket: 32 [ 129.975213][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.976804][ T30] usb 10-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 129.977965][ T30] usb 10-1: config 0 has an invalid interface number: 85 but max is 0 [ 129.977984][ T30] usb 10-1: config 0 has no interface number 0 [ 129.978014][ T30] usb 10-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 129.978034][ T30] usb 10-1: config 0 interface 85 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 129.978052][ T30] usb 10-1: config 0 interface 85 has no altsetting 0 [ 129.980089][ T30] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.980107][ T30] usb 10-1: Product: syz [ 129.980119][ T30] usb 10-1: Manufacturer: syz [ 129.980131][ T30] usb 10-1: SerialNumber: syz [ 129.985985][ T30] usb 10-1: config 0 descriptor?? [ 130.042854][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 130.059403][ T43] audit: type=1400 audit(1789806306.975:908): avc: denied { write } for pid=8324 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.117718][ T43] audit: type=1400 audit(1789806307.035:909): avc: denied { write } for pid=8329 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.181318][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 130.252142][ T8285] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.252277][ T8285] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.252371][ T8285] bridge_slave_0: entered allmulticast mode [ 130.253641][ T8285] bridge_slave_0: entered promiscuous mode [ 130.267713][ T8285] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.267831][ T8285] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.267927][ T8285] bridge_slave_1: entered allmulticast mode [ 130.269232][ T8285] bridge_slave_1: entered promiscuous mode [ 130.348767][ T8337] nvmet: Invalid value 't' for trtype [ 130.365904][ T8285] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 130.394667][ T30] appletouch 10-1:0.85: Geyser mode initialized. [ 130.394889][ T8285] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 130.395893][ T30] input: appletouch as /devices/platform/dummy_hcd.5/usb10/10-1/10-1:0.85/input/input8 [ 130.452561][ T8285] team0: Port device team_slave_0 added [ 130.464456][ T13] bridge_slave_1: left allmulticast mode [ 130.464474][ T13] bridge_slave_1: left promiscuous mode [ 130.464577][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.480105][ T13] bridge_slave_0: left allmulticast mode [ 130.480123][ T13] bridge_slave_0: left promiscuous mode [ 130.480246][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.510656][ T43] audit: type=1400 audit(1789806307.425:910): avc: denied { bpf } for pid=8342 comm="syz.4.737" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 130.599273][ T8347] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 130.615390][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 130.617029][ T13] bond0 (unregistering): Released all slaves [ 130.619929][ T13] bond1 (unregistering): Released all slaves [ 130.631626][ T8285] team0: Port device team_slave_1 added [ 130.647850][ T8341] gre1: entered promiscuous mode [ 130.647871][ T8341] gre1: entered allmulticast mode [ 130.723792][ T5818] usb 10-1: USB disconnect, device number 10 [ 130.785155][ T8356] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20003 [ 130.785205][ T8285] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 130.785219][ T8285] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 130.785247][ T8285] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 130.787421][ T8356] openvswitch: netlink: IPv4 tun info is not correct [ 130.795728][ T8285] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 130.795743][ T8285] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 130.795767][ T8285] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 130.839129][ T5818] appletouch 10-1:0.85: input: appletouch disconnected [ 130.892897][ T8285] hsr_slave_0: entered promiscuous mode [ 130.893459][ T8285] hsr_slave_1: entered promiscuous mode [ 130.893820][ T8285] debugfs: 'hsr0' already exists in 'hsr' [ 130.893832][ T8285] Cannot create hsr debugfs directory [ 130.974434][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 130.974450][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 130.974475][ T5143] loop0: [ 131.019375][ T5446] 8021q: adding VLAN 0 to HW filter on device eth6 [ 131.040177][ T8372] ip6t_rpfilter: unknown options [ 131.040180][ T8356] mmap: syz.4.739 (8356) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 131.131854][ T8378] SET target dimension over the limit! [ 131.216656][ T8384] loop4: detected capacity change from 0 to 7 [ 131.223773][ T8384] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 131.223799][ T8384] loop4: partition table partially beyond EOD, truncated [ 131.223994][ T8384] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 131.239895][ T5446] 8021q: adding VLAN 0 to HW filter on device eth7 [ 131.240428][ T8285] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 131.254809][ T8285] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 131.255506][ T8285] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 131.267463][ T8285] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 131.272679][ T6840] udevd[6840]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 131.282979][ T8285] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 131.294527][ T8285] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 131.295231][ T8285] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 131.307499][ T8285] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 131.337940][ T8396] netlink: 'syz.5.749': attribute type 39 has an invalid length. [ 131.377365][ T8285] 8021q: adding VLAN 0 to HW filter on device bond0 [ 131.392550][ T8285] 8021q: adding VLAN 0 to HW filter on device team0 [ 131.398129][ T398] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.398199][ T398] bridge0: port 1(bridge_slave_0) entered forwarding state [ 131.411746][ T95] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.411795][ T95] bridge0: port 2(bridge_slave_1) entered forwarding state [ 131.414569][ T5742] Bluetooth: hci3: command tx timeout [ 131.485675][ T13] hsr_slave_0: left promiscuous mode [ 131.486440][ T13] hsr_slave_1: left promiscuous mode [ 131.487223][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 131.487240][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 131.489558][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 131.489577][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 131.498776][ T13] veth0_macvtap: left promiscuous mode [ 131.498834][ T13] veth1_vlan: left promiscuous mode [ 131.498865][ T13] veth0_vlan: left promiscuous mode [ 131.690558][ T13] team0 (unregistering): Port device team_slave_1 removed [ 131.711840][ T13] team0 (unregistering): Port device team_slave_0 removed [ 131.816263][ T5446] 8021q: adding VLAN 0 to HW filter on device eth8 [ 131.817059][ T8414] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 131.817398][ T8414] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 131.822384][ T8409] tipc: Started in network mode [ 131.822402][ T8409] tipc: Node identity 06af739bc7ce, cluster identity 4711 [ 131.822591][ T8409] tipc: Enabled bearer , priority 0 [ 131.850792][ T8410] syzkaller0: entered promiscuous mode [ 131.850810][ T8410] syzkaller0: entered allmulticast mode [ 131.851215][ T8410] tipc: Resetting bearer [ 131.925168][ T8406] tipc: Resetting bearer [ 132.170954][ T8399] orangefs_mount: mount request failed with -4 [ 132.218088][ T8430] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=97 sclass=netlink_xfrm_socket pid=8430 comm=syz.5.753 [ 132.699388][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.699436][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.769592][ T8451] loop5: detected capacity change from 0 to 7 [ 132.778822][ T8451] Dev loop5: unable to read RDB block 7 [ 132.778841][ T8451] loop5: AHDI p1 p2 p3 [ 132.778852][ T8451] loop5: partition table partially beyond EOD, truncated [ 132.778948][ T8451] loop5: p1 start 1601398130 is beyond EOD, truncated [ 132.778959][ T8451] loop5: p2 start 1702059890 is beyond EOD, truncated [ 133.281521][ T8406] tipc: Disabling bearer [ 133.290242][ T5446] 8021q: adding VLAN 0 to HW filter on device eth9 [ 133.309788][ T5881] tipc: Node number set to 3244389275 [ 133.409389][ T8464] loop4: detected capacity change from 0 to 7 [ 133.419481][ T8464] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 133.419508][ T8464] loop4: partition table partially beyond EOD, truncated [ 133.419736][ T8464] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 133.453405][ T6840] udevd[6840]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 133.494293][ T5742] Bluetooth: hci3: command tx timeout [ 133.521636][ T8285] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 133.532229][ T13] IPVS: stop unused estimator thread 0... [ 133.572863][ T8471] pim6reg9: entered allmulticast mode [ 133.609743][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 133.609761][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 133.609786][ T5143] loop0: [ 133.666924][ T8484] FAULT_INJECTION: forcing a failure. [ 133.666924][ T8484] name failslab, interval 1, probability 0, space 0, times 0 [ 133.666946][ T8484] CPU: 0 UID: 0 PID: 8484 Comm: syz.4.761 Tainted: G L syzkaller #0 PREEMPT(full) [ 133.666962][ T8484] Tainted: [L]=SOFTLOCKUP [ 133.666966][ T8484] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 133.666972][ T8484] Call Trace: [ 133.666984][ T8484] [ 133.666989][ T8484] dump_stack_lvl+0x100/0x190 [ 133.667017][ T8484] should_fail_ex.cold+0x5/0xa [ 133.667032][ T8484] ? __netlink_lookup+0x652/0x900 [ 133.667049][ T8484] should_failslab+0xc2/0x120 [ 133.667067][ T8484] kmem_cache_alloc_noprof+0x92/0x6a0 [ 133.667080][ T8484] ? skb_clone+0x190/0x400 [ 133.667097][ T8484] skb_clone+0x190/0x400 [ 133.667111][ T8484] netlink_deliver_tap+0xaed/0xcc0 [ 133.667126][ T8484] netlink_unicast+0x62b/0x850 [ 133.667141][ T8484] ? __pfx_netlink_unicast+0x10/0x10 [ 133.667157][ T8484] netlink_sendmsg+0x8b0/0xda0 [ 133.667173][ T8484] ? __pfx_netlink_sendmsg+0x10/0x10 [ 133.667187][ T8484] ? selinux_socket_sendmsg+0x198/0x2f0 [ 133.667203][ T8484] ____sys_sendmsg+0xa4d/0xbe0 [ 133.667219][ T8484] ? __pfx_netlink_sendmsg+0x10/0x10 [ 133.667233][ T8484] ? __pfx_____sys_sendmsg+0x10/0x10 [ 133.667253][ T8484] ? lock_acquire+0x1d1/0x380 [ 133.667265][ T8484] ? get_pid_task+0x2a/0x250 [ 133.667282][ T8484] ___sys_sendmsg+0x190/0x1e0 [ 133.667293][ T8484] ? __pfx____sys_sendmsg+0x10/0x10 [ 133.667304][ T8484] ? get_pid_task+0x106/0x250 [ 133.667324][ T8484] ? find_held_lock+0x2b/0x80 [ 133.667356][ T8484] __sys_sendmsg+0x160/0x210 [ 133.667372][ T8484] ? __pfx___sys_sendmsg+0x10/0x10 [ 133.667393][ T8484] do_syscall_64+0x123/0x790 [ 133.667416][ T8484] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 133.667427][ T8484] RIP: 0033:0x7f0bd2b9e159 [ 133.667437][ T8484] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 133.667448][ T8484] RSP: 002b:00007f0bd3b43028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 133.667463][ T8484] RAX: ffffffffffffffda RBX: 00007f0bd2e25fa0 RCX: 00007f0bd2b9e159 [ 133.667470][ T8484] RDX: 0000000000000080 RSI: 00002000000002c0 RDI: 0000000000000003 [ 133.667477][ T8484] RBP: 00007f0bd3b43090 R08: 0000000000000000 R09: 0000000000000000 [ 133.667483][ T8484] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 133.667490][ T8484] R13: 00007f0bd2e26038 R14: 00007f0bd2e25fa0 R15: 00007ffd3dbf5e08 [ 133.667504][ T8484] [ 133.751864][ T8285] veth0_vlan: entered promiscuous mode [ 133.757900][ T8285] veth1_vlan: entered promiscuous mode [ 133.781318][ T8285] veth0_macvtap: entered promiscuous mode [ 133.784501][ T8285] veth1_macvtap: entered promiscuous mode [ 133.792583][ T8285] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 133.800401][ T8285] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 133.906181][ T8498] ip6t_rpfilter: unknown options [ 133.911245][ T95] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 133.911264][ T95] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 133.960781][ T95] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 133.961896][ T95] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 133.974681][ T6448] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.974720][ T6448] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.974747][ T6448] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.974774][ T6448] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.974823][ T5818] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 133.977507][ T43] kauditd_printk_skb: 27 callbacks suppressed [ 133.977519][ T43] audit: type=1400 audit(1789806310.895:938): avc: denied { mounton } for pid=8285 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 134.031459][ T8508] netlink: 8 bytes leftover after parsing attributes in process `syz.3.770'. [ 134.078399][ T8514] loop4: detected capacity change from 0 to 7 [ 134.081874][ T8519] netlink: 'syz.6.774': attribute type 21 has an invalid length. [ 134.081921][ T8519] netlink: 156 bytes leftover after parsing attributes in process `syz.6.774'. [ 134.083565][ T8515] FAULT_INJECTION: forcing a failure. [ 134.083565][ T8515] name failslab, interval 1, probability 0, space 0, times 0 [ 134.083589][ T8515] CPU: 2 UID: 0 PID: 8515 Comm: syz.3.772 Tainted: G L syzkaller #0 PREEMPT(full) [ 134.083613][ T8515] Tainted: [L]=SOFTLOCKUP [ 134.083619][ T8515] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.083630][ T8515] Call Trace: [ 134.083636][ T8515] [ 134.083644][ T8515] dump_stack_lvl+0x100/0x190 [ 134.083669][ T8515] should_fail_ex.cold+0x5/0xa [ 134.083686][ T8515] should_failslab+0xc2/0x120 [ 134.083708][ T8515] __kmalloc_noprof+0xfc/0x840 [ 134.083745][ T8515] ? rcu_is_watching+0x13/0xc0 [ 134.083772][ T8515] ? tomoyo_realpath_from_path+0xb6/0x690 [ 134.083797][ T8515] tomoyo_realpath_from_path+0xb6/0x690 [ 134.083825][ T8515] tomoyo_check_open_permission+0x2af/0x3c0 [ 134.083846][ T8515] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 134.083879][ T8515] ? hook_file_open+0x248/0x8e0 [ 134.083918][ T8515] ? path_get+0x61/0x80 [ 134.083945][ T8515] tomoyo_file_open+0x6b/0x90 [ 134.083971][ T8515] security_file_open+0xb5/0x1e0 [ 134.083994][ T8515] do_dentry_open+0x588/0x14d0 [ 134.084016][ T8515] vfs_open+0x82/0x3f0 [ 134.084042][ T8515] path_openat+0x19fa/0x2440 [ 134.084069][ T8515] ? __pfx_path_openat+0x10/0x10 [ 134.084098][ T8515] do_file_open+0x20e/0x430 [ 134.084118][ T8515] ? __pfx_do_file_open+0x10/0x10 [ 134.084157][ T8515] ? _raw_spin_unlock+0x28/0x50 [ 134.084180][ T8515] ? alloc_fd+0x471/0x7a0 [ 134.084206][ T8515] do_sys_openat2+0x10f/0x1e0 [ 134.084229][ T8515] ? __pfx_do_sys_openat2+0x10/0x10 [ 134.084254][ T8515] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 134.084288][ T8515] __x64_sys_openat+0x12d/0x210 [ 134.084312][ T8515] ? __pfx___x64_sys_openat+0x10/0x10 [ 134.084343][ T8515] do_syscall_64+0x123/0x790 [ 134.084371][ T8515] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.084389][ T8515] RIP: 0033:0x7fb71859e159 [ 134.084401][ T8515] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.084416][ T8515] RSP: 002b:00007fb71952f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 134.084434][ T8515] RAX: ffffffffffffffda RBX: 00007fb718825fa0 RCX: 00007fb71859e159 [ 134.084446][ T8515] RDX: 0000000000000002 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 134.084457][ T8515] RBP: 00007fb71863506b R08: 0000000000000000 R09: 0000000000000000 [ 134.084468][ T8515] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 134.084479][ T8515] R13: 00007fb718826038 R14: 00007fb718825fa0 R15: 00007ffdcc839da8 [ 134.084498][ T8515] [ 134.093393][ T8515] ERROR: Out of memory at tomoyo_realpath_from_path. [ 134.095592][ T8514] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 134.095609][ T8514] loop4: partition table partially beyond EOD, truncated [ 134.095934][ T8514] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 134.125663][ T6840] udevd[6840]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 134.127582][ T5818] usb 10-1: New USB device found, idVendor=0525, idProduct=1080, bcdDevice= 1.00 [ 134.141504][ T5818] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.212564][ T43] audit: type=1400 audit(1789806311.125:939): avc: denied { write } for pid=8527 comm="syz.3.776" name="/" dev="9p" ino=76832937 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 134.212595][ T43] audit: type=1400 audit(1789806311.125:940): avc: denied { create } for pid=8527 comm="syz.3.776" name="cpuacct.usage_percpu" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 134.218622][ T43] audit: type=1400 audit(1789806311.135:941): avc: denied { read append } for pid=8527 comm="syz.3.776" path="/211/file0/cpuacct.usage_percpu" dev="9p" ino=76832997 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 134.219806][ T43] audit: type=1400 audit(1789806311.135:942): avc: denied { lock } for pid=8527 comm="syz.3.776" path="/211/file0/cpuacct.usage_percpu" dev="9p" ino=76832997 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 134.233100][ T43] audit: type=1400 audit(1789806311.145:943): avc: denied { setattr } for pid=8527 comm="syz.3.776" name="file0" dev="9p" ino=76832939 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 134.236503][ T43] audit: type=1400 audit(1789806311.145:944): avc: denied { connect } for pid=8527 comm="syz.3.776" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 134.421669][ T5818] net1080 10-1:1.0 usb0: register 'net1080' at usb-dummy_hcd.5-1, NetChip TurboCONNECT, 4e:2e:10:ee:4f:9e [ 134.501518][ T43] audit: type=1400 audit(1789806311.415:945): avc: denied { write } for pid=8534 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 134.524305][ T851] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 134.574647][ T43] audit: type=1400 audit(1789806311.495:946): avc: denied { write } for pid=8537 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 134.699023][ T851] usb 9-1: New USB device found, idVendor=0525, idProduct=1080, bcdDevice= 1.00 [ 134.700029][ T851] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.750111][ T43] audit: type=1326 audit(1789806311.665:947): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8540 comm="syz.6.779" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f65f599e159 code=0x0 [ 134.873488][ T30] usb 10-1: USB disconnect, device number 11 [ 134.876671][ T30] net1080 10-1:1.0 usb0: unregister 'net1080' usb-dummy_hcd.5-1, NetChip TurboCONNECT [ 134.917470][ T851] net1080 9-1:1.0 usb0: register 'net1080' at usb-dummy_hcd.4-1, NetChip TurboCONNECT, 06:5e:ae:c3:dd:63 [ 134.937200][ T42] usb 11-1: new high-speed USB device number 2 using dummy_hcd [ 135.060869][ T8551] ip6t_rpfilter: unknown options [ 135.197117][ T8564] netlink: 8 bytes leftover after parsing attributes in process `syz.3.782'. [ 135.197149][ T8564] netlink: 'syz.3.782': attribute type 30 has an invalid length. [ 135.197162][ T8564] netlink: 4 bytes leftover after parsing attributes in process `syz.3.782'. [ 135.423387][ T8576] netlink: 8 bytes leftover after parsing attributes in process `syz.5.785'. [ 135.423402][ T8576] netlink: 4 bytes leftover after parsing attributes in process `syz.5.785'. [ 135.574267][ T5742] Bluetooth: hci3: command tx timeout [ 135.769364][ T8562] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 135.769628][ T8562] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 137.655483][ T5742] Bluetooth: hci3: command tx timeout [ 140.618920][ T8568] syz_tun: entered allmulticast mode [ 140.619287][ T8568] syz_tun: left allmulticast mode [ 140.620429][ T8569] syz_tun: entered allmulticast mode [ 140.620621][ T8574] syz_tun: left allmulticast mode [ 140.625830][ T35] usb 9-1: USB disconnect, device number 20 [ 140.626798][ T35] net1080 9-1:1.0 usb0: unregister 'net1080' usb-dummy_hcd.4-1, NetChip TurboCONNECT [ 140.653793][ T8576] netlink: 8 bytes leftover after parsing attributes in process `syz.5.785'. [ 140.653814][ T8576] netlink: 4 bytes leftover after parsing attributes in process `syz.5.785'. [ 140.692130][ T8591] loop4: detected capacity change from 0 to 7 [ 140.697792][ T8591] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 140.697809][ T8591] loop4: partition table partially beyond EOD, truncated [ 140.697905][ T8591] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 140.704896][ T8590] netlink: 96 bytes leftover after parsing attributes in process `syz.4.789'. [ 140.714664][ T6448] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 140.714690][ T6448] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 140.714707][ T6448] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 140.714723][ T6448] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 140.747593][ T8597] ip6t_rpfilter: unknown options [ 140.790244][ T8579] udevd[8579]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 140.799113][ T8603] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 140.799580][ T8603] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 140.803160][ T43] kauditd_printk_skb: 7 callbacks suppressed [ 140.803171][ T43] audit: type=1400 audit(1789806317.715:955): avc: denied { ioctl } for pid=8602 comm="syz.3.794" path="socket:[25923]" dev="sockfs" ino=25923 ioctlcmd=0x618c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 140.811841][ T43] audit: type=1400 audit(1789806317.725:956): avc: denied { write } for pid=8600 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 140.863672][ T43] audit: type=1400 audit(1789806317.775:957): avc: denied { write } for pid=8613 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 140.901647][ T8599] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 140.917116][ T43] audit: type=1400 audit(1789806317.835:958): avc: denied { mounton } for pid=8585 comm="syz.6.787" path="/5/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 141.375083][ T43] audit: type=1400 audit(1789806318.295:959): avc: denied { write } for pid=8624 comm="syz.3.798" name="functions" dev="configfs" ino=11230 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 141.377268][ T43] audit: type=1400 audit(1789806318.295:960): avc: denied { write } for pid=8624 comm="syz.3.798" name="target" dev="configfs" ino=6121 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 141.377799][ T43] audit: type=1400 audit(1789806318.295:961): avc: denied { write } for pid=8624 comm="syz.3.798" name="usb_gadget" dev="configfs" ino=25945 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 141.378643][ T43] audit: type=1400 audit(1789806318.295:962): avc: denied { write } for pid=8624 comm="syz.3.798" name="naa.6001405c935d7912" dev="configfs" ino=25947 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 141.381058][ T8625] netlink: 184 bytes leftover after parsing attributes in process `syz.3.798'. [ 141.382624][ T8625] Emulated NAA Sas Address: NÛÜ ŽÑ<ŒR-PVTšÏ€>¾j•ê¥”²>ùQãS‹•y+퉲ôî–¹a™q;½cw§¿Y©±|, exceeds max: 32 [ 141.384348][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 141.384361][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 141.384387][ T5143] loop0: [ 141.558568][ T43] audit: type=1400 audit(1789806318.475:963): avc: denied { connect } for pid=8639 comm="syz.3.804" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 141.622287][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 141.622316][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 141.622359][ T5143] loop0: [ 141.693920][ T8646] nvmet: Invalid value 'D' for trtype [ 141.723285][ T8649] netlink: 76 bytes leftover after parsing attributes in process `syz.6.808'. [ 141.723830][ T8649] netlink: 'syz.6.808': attribute type 1 has an invalid length. [ 141.924188][ T5162] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 141.959285][ T8662] ALSA: mixer_oss: invalid OSS volume '00000000000000000071G' [ 141.959899][ T8662] ALSA: mixer_oss: invalid OSS volume '' [ 142.075253][ T5162] usb 10-1: New USB device found, idVendor=0525, idProduct=1080, bcdDevice= 1.00 [ 142.076393][ T5162] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.296784][ T5162] net1080 10-1:1.0 usb0: register 'net1080' at usb-dummy_hcd.5-1, NetChip TurboCONNECT, ce:96:bd:d5:4a:d5 [ 142.367064][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 142.367086][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 142.367128][ T5143] loop0: [ 142.397276][ T43] audit: type=1400 audit(1789806319.315:964): avc: denied { write } for pid=8672 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 142.746435][ T35] usb 10-1: USB disconnect, device number 12 [ 142.751230][ T35] net1080 10-1:1.0 usb0: unregister 'net1080' usb-dummy_hcd.5-1, NetChip TurboCONNECT [ 142.949601][ T8724] loop4: detected capacity change from 0 to 7 [ 142.961973][ T8724] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 142.961997][ T8724] loop4: partition table partially beyond EOD, truncated [ 142.962247][ T8724] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 142.962258][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 142.962276][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 142.962319][ T5143] loop0: [ 143.035726][ T8579] udevd[8579]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 143.056033][ T8729] ip6t_frag: unknown flags 6 [ 143.095530][ T8737] ip6erspan0: entered allmulticast mode [ 143.147148][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 143.147168][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 143.147195][ T5143] loop0: [ 143.170208][ T8745] ip6t_rpfilter: unknown options [ 143.382772][ T8763] loop4: detected capacity change from 0 to 7 [ 143.389773][ T8763] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 143.389793][ T8763] loop4: partition table partially beyond EOD, truncated [ 143.389921][ T8763] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 143.402065][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 143.402111][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 143.402165][ T5143] loop0: [ 143.435120][ T8579] udevd[8579]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 143.440674][ T8765] nvmet: Invalid value '_pv!' for adrfam [ 143.441765][ T8765] nvmet_tcp: malformed ip/port passed: :4420 [ 143.453463][ T8767] jffs2: notice: (8767) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 143.508245][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 143.508261][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 143.508287][ T5143] loop0: [ 143.553763][ T8775] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 143.557627][ T8775] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 143.566751][ T8777] ntfs3(sr0): Primary boot signature is not NTFS. [ 143.567535][ T8777] ntfs3(sr0): try to read out of volume at offset 0xf800 [ 143.610767][ T8781] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 143.610794][ T8781] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 143.865698][ T8793] loop4: detected capacity change from 0 to 7 [ 143.870475][ T8793] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 143.870491][ T8793] loop4: partition table partially beyond EOD, truncated [ 143.870609][ T8793] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 143.899399][ T8579] udevd[8579]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 143.966453][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 143.966478][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 143.966525][ T5143] loop0: [ 144.165357][ T8803] nvmet_tcp: malformed ip/port passed: :4420 [ 144.556881][ T8772] ip6t_rpfilter: unknown options [ 144.986396][ T5143] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 144.986418][ T5143] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 144.986458][ T5143] loop0: [ 145.037038][ T8826] netlink: 8 bytes leftover after parsing attributes in process `syz.3.857'. [ 145.054777][ T5162] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 145.183839][ T8826] virtio_blk virtio3: 1/0/0 default/read/poll queues [ 145.190997][ T8826] virtio_blk virtio3: [vda] 262144 512-byte logical blocks (134 MB/128 MiB) [ 145.214832][ T5162] usb 9-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 145.215773][ T5162] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 145.215811][ T5162] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 145.215831][ T5162] usb 9-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 145.215863][ T5162] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.324278][ T5880] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 145.474471][ T5880] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.03 [ 145.476838][ T5880] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 145.476866][ T5880] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 145.476897][ T5880] usb 5-1: Dual-Role OTG device on HNP port [ 145.477229][ T5880] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.482952][ C0] ------------[ cut here ]------------ [ 145.482964][ C0] usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0 [ 145.482978][ C0] WARNING: drivers/usb/gadget/udc/core.c:124 at usb_ep_enable+0x3e6/0x490, CPU#0: udevd/8579 [ 145.509131][ C0] Modules linked in: [ 145.510657][ C0] CPU: 0 UID: 0 PID: 8579 Comm: udevd Tainted: G L syzkaller #0 PREEMPT(full) SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 145.514394][ C0] Tainted: [L]=SOFTLOCKUP [ 145.516321][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 145.520913][ C0] RIP: 0010:usb_ep_enable+0x3f8/0x490 [ 145.522716][ C0] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8d 3d fa 2e 74 09 48 8b 4b 08 40 0f b6 d5 4d 89 e0 48 c7 c6 c0 11 da 8c <67> 48 0f b9 3a bd ea ff ff ff e9 8e fd ff ff 49 c7 c4 60 04 da 8c [ 145.528696][ C0] RSP: 0018:ffffc90000007a00 EFLAGS: 00010046 [ 145.531210][ C0] RAX: dffffc0000000000 RBX: ffff88802826c0e0 RCX: ffffffff8cda4860 [ 145.534089][ C0] RDX: 0000000000000081 RSI: ffffffff8cda11c0 RDI: ffffffff9152a2b0 [ 145.536588][ C0] RBP: 0000000000000081 R08: ffffffff8cda04a0 R09: 0000000000000000 [ 145.539172][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff8cda04a0 [ 145.542744][ C0] R13: 0000000000000000 R14: ffff88802826c0e0 R15: ffff888058447e20 [ 145.546661][ C0] FS: 00007f71e4c59880(0000) GS:ffff8880d5b56000(0000) knlGS:0000000000000000 [ 145.550884][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 145.553063][ C0] CR2: 00007f71e4be75f4 CR3: 000000003d276000 CR4: 0000000000352ef0 [ 145.555650][ C0] Call Trace: [ 145.556740][ C0] [ 145.557692][ C0] hidg_set_alt+0x190/0xa10 [ 145.559528][ C0] ? do_raw_spin_unlock+0x145/0x1e0 [ 145.561846][ C0] ? rcu_is_watching+0x13/0xc0 [ 145.563998][ C0] composite_setup+0x2ccf/0x9290 [ 145.566152][ C0] ? __lock_acquire+0x5c0/0x1f40 [ 145.568282][ C0] ? __pfx_composite_setup+0x10/0x10 [ 145.570494][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 145.572493][ C0] ? do_raw_spin_lock+0x128/0x260 [ 145.574124][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 145.575934][ C0] ? configfs_composite_setup+0xfb/0x130 [ 145.577883][ C0] configfs_composite_setup+0xfb/0x130 [ 145.580058][ C0] dummy_timer+0x2039/0x3700 [ 145.582067][ C0] ? __trace_array_vprintk+0x310/0x470 [ 145.583917][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 145.585756][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 145.587517][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 145.589171][ C0] ? rcu_is_watching+0x13/0xc0 [ 145.590703][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 145.592546][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 145.594176][ C0] __hrtimer_run_queues+0x462/0x9c0 [ 145.595838][ C0] hrtimer_run_softirq+0x1ca/0x360 [ 145.597473][ C0] handle_softirqs+0x1e6/0x9d0 [ 145.599142][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 145.600891][ C0] ? _raw_spin_unlock+0x28/0x50 [ 145.602552][ C0] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 145.604492][ C0] __irq_exit_rcu+0x16a/0x210 [ 145.606064][ C0] irq_exit_rcu+0x9/0x30 [ 145.607424][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 145.609272][ C0] [ 145.610224][ C0] [ 145.611163][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 145.613039][ C0] RIP: 0010:selinux_inode_permission+0x2b8/0x1130 [ 145.615079][ C0] Code: 09 00 00 e8 ba 87 2b fd 8b 05 14 76 86 09 48 01 c5 48 b8 00 00 00 00 00 fc ff df 48 8d 7d 22 48 89 fa 48 c1 ea 03 0f b6 04 02 <48> 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 91 07 00 00 44 0f b6 75 [ 145.621500][ C0] RSP: 0018:ffffc90003cbf918 EFLAGS: 00000a06 [ 145.623523][ C0] RAX: 0000000000000000 RBX: ffff888035432e10 RCX: 0000000000000000 [ 145.626095][ C0] RDX: 1ffff11006d0071e RSI: ffffffff84e097f6 RDI: ffff8880368038f2 [ 145.628686][ C0] RBP: ffff8880368038d0 R08: 0000000000000001 R09: 0000000000000000 [ 145.631313][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880614f8000 [ 145.633831][ C0] R13: ffffc90003cbf988 R14: ffff888036187b1d R15: ffffc90003cbfc00 [ 145.636383][ C0] ? selinux_inode_permission+0x296/0x1130 [ 145.638331][ C0] ? selinux_inode_permission+0x296/0x1130 [ 145.640720][ C0] ? step_into_slowpath+0x2ea/0xf90 [ 145.642621][ C0] ? __pfx_selinux_inode_permission+0x10/0x10 [ 145.644720][ C0] security_inode_permission+0xda/0x250 [ 145.646542][ C0] link_path_walk+0x2a5/0x1cc0 [ 145.648065][ C0] path_openat+0x1ac/0x2440 [ 145.649605][ C0] ? __pfx_path_openat+0x10/0x10 [ 145.651209][ C0] do_file_open+0x20e/0x430 [ 145.652661][ C0] ? __pfx_do_file_open+0x10/0x10 [ 145.654323][ C0] ? _raw_spin_unlock+0x28/0x50 [ 145.656008][ C0] ? alloc_fd+0x471/0x7a0 [ 145.657454][ C0] do_sys_openat2+0x10f/0x1e0 [ 145.659312][ C0] ? __pfx_do_sys_openat2+0x10/0x10 [ 145.661749][ C0] ? __fput+0x692/0xb50 [ 145.663542][ C0] __x64_sys_openat+0x12d/0x210 [ 145.665591][ C0] ? __pfx___x64_sys_openat+0x10/0x10 [ 145.667629][ C0] do_syscall_64+0x123/0x790 [ 145.669378][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.671850][ C0] RIP: 0033:0x7f71e44a7407 [ 145.674149][ C0] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 145.682414][ C0] RSP: 002b:00007fff81611f10 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 145.685850][ C0] RAX: ffffffffffffffda RBX: 00007f71e4c59880 RCX: 00007f71e44a7407 [ 145.689102][ C0] RDX: 0000000000080000 RSI: 00007fff81612080 RDI: ffffffffffffff9c [ 145.692364][ C0] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 145.695787][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 00005568629f17f5 [ 145.699605][ C0] R13: 00005568629f17f5 R14: 0000000000000001 R15: 0000556862a0c140 [ 145.703313][ C0] [ 145.704615][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 145.707613][ C0] CPU: 0 UID: 0 PID: 8579 Comm: udevd Tainted: G L syzkaller #0 PREEMPT(full) [ 145.711886][ C0] Tainted: [L]=SOFTLOCKUP [ 145.713748][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 145.717900][ C0] Call Trace: [ 145.719314][ C0] [ 145.720529][ C0] dump_stack_lvl+0x100/0x190 [ 145.722520][ C0] vpanic+0x553/0x970 [ 145.724234][ C0] ? __pfx_vpanic+0x10/0x10 [ 145.726160][ C0] panic+0xd1/0xe0 [ 145.727755][ C0] ? __pfx_panic+0x10/0x10 [ 145.729661][ C0] check_panic_on_warn.cold+0x19/0x34 [ 145.731948][ C0] ? usb_ep_enable+0x3e6/0x490 [ 145.733907][ C0] __warn.cold+0x191/0x318 [ 145.736098][ C0] __report_bug+0x30f/0x440 [ 145.738514][ C0] ? usb_ep_enable+0x3e6/0x490 [ 145.741049][ C0] ? __pfx___report_bug+0x10/0x10 [ 145.743209][ C0] ? try_to_wake_up+0x158/0x1c90 [ 145.745276][ C0] report_bug_entry+0xe2/0x290 [ 145.747279][ C0] ? usb_ep_enable+0x3f8/0x490 [ 145.749263][ C0] handle_bug+0x1cd/0x2a0 [ 145.751076][ C0] exc_invalid_op+0x17/0x50 [ 145.752972][ C0] asm_exc_invalid_op+0x1a/0x20 [ 145.755021][ C0] RIP: 0010:usb_ep_enable+0x3f8/0x490 [ 145.757253][ C0] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8d 3d fa 2e 74 09 48 8b 4b 08 40 0f b6 d5 4d 89 e0 48 c7 c6 c0 11 da 8c <67> 48 0f b9 3a bd ea ff ff ff e9 8e fd ff ff 49 c7 c4 60 04 da 8c [ 145.765451][ C0] RSP: 0018:ffffc90000007a00 EFLAGS: 00010046 [ 145.768110][ C0] RAX: dffffc0000000000 RBX: ffff88802826c0e0 RCX: ffffffff8cda4860 [ 145.771473][ C0] RDX: 0000000000000081 RSI: ffffffff8cda11c0 RDI: ffffffff9152a2b0 [ 145.774775][ C0] RBP: 0000000000000081 R08: ffffffff8cda04a0 R09: 0000000000000000 [ 145.778185][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff8cda04a0 [ 145.781850][ C0] R13: 0000000000000000 R14: ffff88802826c0e0 R15: ffff888058447e20 [ 145.785431][ C0] hidg_set_alt+0x190/0xa10 [ 145.787362][ C0] ? do_raw_spin_unlock+0x145/0x1e0 [ 145.789535][ C0] ? rcu_is_watching+0x13/0xc0 [ 145.791580][ C0] composite_setup+0x2ccf/0x9290 [ 145.793777][ C0] ? __lock_acquire+0x5c0/0x1f40 [ 145.795999][ C0] ? __pfx_composite_setup+0x10/0x10 [ 145.798358][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 145.800879][ C0] ? do_raw_spin_lock+0x128/0x260 [ 145.803148][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 145.805480][ C0] ? configfs_composite_setup+0xfb/0x130 [ 145.807814][ C0] configfs_composite_setup+0xfb/0x130 [ 145.810098][ C0] dummy_timer+0x2039/0x3700 [ 145.812051][ C0] ? __trace_array_vprintk+0x310/0x470 [ 145.814428][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 145.817332][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 145.820284][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 145.822773][ C0] ? rcu_is_watching+0x13/0xc0 [ 145.824828][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 145.827305][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 145.829315][ C0] __hrtimer_run_queues+0x462/0x9c0 [ 145.831385][ C0] hrtimer_run_softirq+0x1ca/0x360 [ 145.833552][ C0] handle_softirqs+0x1e6/0x9d0 [ 145.835603][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 145.837803][ C0] ? _raw_spin_unlock+0x28/0x50 [ 145.839845][ C0] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 145.842193][ C0] __irq_exit_rcu+0x16a/0x210 [ 145.844235][ C0] irq_exit_rcu+0x9/0x30 [ 145.846099][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 145.848643][ C0] [ 145.849944][ C0] [ 145.851261][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 145.853877][ C0] RIP: 0010:selinux_inode_permission+0x2b8/0x1130 [ 145.856551][ C0] Code: 09 00 00 e8 ba 87 2b fd 8b 05 14 76 86 09 48 01 c5 48 b8 00 00 00 00 00 fc ff df 48 8d 7d 22 48 89 fa 48 c1 ea 03 0f b6 04 02 <48> 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 91 07 00 00 44 0f b6 75 [ 145.864826][ C0] RSP: 0018:ffffc90003cbf918 EFLAGS: 00000a06 [ 145.867756][ C0] RAX: 0000000000000000 RBX: ffff888035432e10 RCX: 0000000000000000 [ 145.871000][ C0] RDX: 1ffff11006d0071e RSI: ffffffff84e097f6 RDI: ffff8880368038f2 [ 145.874311][ C0] RBP: ffff8880368038d0 R08: 0000000000000001 R09: 0000000000000000 [ 145.877567][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880614f8000 [ 145.880840][ C0] R13: ffffc90003cbf988 R14: ffff888036187b1d R15: ffffc90003cbfc00 [ 145.884329][ C0] ? selinux_inode_permission+0x296/0x1130 [ 145.886975][ C0] ? selinux_inode_permission+0x296/0x1130 [ 145.889424][ C0] ? step_into_slowpath+0x2ea/0xf90 [ 145.891596][ C0] ? __pfx_selinux_inode_permission+0x10/0x10 [ 145.894156][ C0] security_inode_permission+0xda/0x250 [ 145.896441][ C0] link_path_walk+0x2a5/0x1cc0 [ 145.898459][ C0] path_openat+0x1ac/0x2440 [ 145.900355][ C0] ? __pfx_path_openat+0x10/0x10 [ 145.902422][ C0] do_file_open+0x20e/0x430 [ 145.904322][ C0] ? __pfx_do_file_open+0x10/0x10 [ 145.906615][ C0] ? _raw_spin_unlock+0x28/0x50 [ 145.908848][ C0] ? alloc_fd+0x471/0x7a0 [ 145.910844][ C0] do_sys_openat2+0x10f/0x1e0 [ 145.912815][ C0] ? __pfx_do_sys_openat2+0x10/0x10 [ 145.915033][ C0] ? __fput+0x692/0xb50 [ 145.916776][ C0] __x64_sys_openat+0x12d/0x210 [ 145.918821][ C0] ? __pfx___x64_sys_openat+0x10/0x10 [ 145.921265][ C0] do_syscall_64+0x123/0x790 [ 145.923529][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.926228][ C0] RIP: 0033:0x7f71e44a7407 [ 145.928084][ C0] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 145.935928][ C0] RSP: 002b:00007fff81611f10 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 145.939118][ C0] RAX: ffffffffffffffda RBX: 00007f71e4c59880 RCX: 00007f71e44a7407 [ 145.942723][ C0] RDX: 0000000000080000 RSI: 00007fff81612080 RDI: ffffffffffffff9c [ 145.946464][ C0] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 145.949807][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 00005568629f17f5 [ 145.953079][ C0] R13: 00005568629f17f5 R14: 0000000000000001 R15: 0000556862a0c140 [ 145.956375][ C0] [ 145.958376][ C0] Kernel Offset: disabled [ 145.960175][ C0] Rebooting in 86400 seconds..