last executing test programs: 1m34.759277137s ago: executing program 2 (id=446): setresuid(0xee01, 0xee00, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000002e00000084000000030000009500000000000000"], &(0x7f0000000180)='GPL\x00'}, 0x48) 1m34.759095768s ago: executing program 2 (id=447): r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x402) write$uinput_user_dev(r0, &(0x7f00000003c0)={'syz1\x00', {0x5, 0x5, 0x5, 0xfff7}, 0x24, [0x6, 0x83bd, 0x69e, 0xffffff81, 0x0, 0x8, 0x4, 0xc160, 0x4, 0xfffffffa, 0x0, 0x6, 0xfffff94c, 0x4, 0x8f2, 0x1e, 0x80, 0xfffffff8, 0x1, 0x1000, 0x0, 0x7c12ad8f, 0xff, 0x5, 0x80000001, 0x6, 0x8, 0x5, 0x1, 0x81, 0xb6, 0x5, 0x3, 0xd, 0x6, 0x192, 0x3, 0xffff, 0x5, 0xa0, 0x40, 0x100, 0xa, 0x9, 0xfffffffc, 0x0, 0x8, 0x6, 0x1, 0xffffffff, 0x0, 0x7ff, 0x4, 0x80, 0x7e, 0xf, 0xffffffff, 0x7, 0x2, 0x7, 0xffffffff, 0x4, 0x0, 0xffffffff], [0x5, 0x9, 0x7ff, 0xfffffffc, 0x8, 0x7, 0x7, 0x0, 0x1000, 0x0, 0x5426, 0xfffffeff, 0x8, 0x4, 0x4, 0x10, 0x8, 0x0, 0x8, 0x3, 0x800, 0xbd98, 0x6b, 0x73, 0x2, 0x1ff, 0x3, 0x0, 0x8, 0x65, 0xe, 0xa3, 0x1000, 0x166, 0x5, 0x3, 0x9, 0x5, 0x200, 0x5, 0xd, 0x5, 0xb, 0x5, 0xffff, 0x4130, 0x7, 0x8, 0x4, 0xfffffff4, 0x9, 0x2, 0x1, 0x4e9d, 0x2, 0x6, 0x0, 0x3, 0xfffffff9, 0x10000, 0x7, 0xd, 0xb, 0x9], [0x7, 0x894, 0xa0d, 0xffff, 0x2, 0x401, 0x8, 0x1, 0x5, 0x1, 0x1, 0x1ff, 0x7fffffff, 0xb4, 0xb, 0x8, 0x9, 0x4, 0x2, 0x8001, 0x2, 0xffffff0e, 0xc, 0x4, 0xb77c, 0x4, 0x5, 0xc, 0x80000000, 0x1, 0x5, 0xffff6b89, 0x1, 0x4, 0xfffffffd, 0xeb5, 0x8a, 0x28000, 0xff, 0x7, 0x2, 0x10, 0x2, 0x8, 0x807, 0x9, 0x200, 0x0, 0x6, 0xffffffff, 0xacf3, 0x4, 0x200, 0x3, 0x9, 0x7, 0x6a3, 0xd, 0x614d935e, 0x1ff, 0x400, 0x7a, 0x1ff, 0x2], [0xc, 0xfffffff7, 0x2, 0x1, 0x200, 0xd2a, 0x8, 0x7, 0x9, 0x5, 0x2, 0x80000000, 0x3, 0x6, 0xffffff56, 0xfffffffd, 0x3a, 0x3, 0xc, 0x1, 0x1, 0x7, 0xfff00000, 0x2, 0xc0, 0x4, 0x7, 0x2, 0xec, 0x62, 0x10001, 0x1, 0x114, 0x5, 0x3, 0xfffffff8, 0x0, 0x0, 0x28, 0x8000, 0x3, 0x5, 0x2, 0x9, 0x4, 0x15, 0x0, 0x9, 0xffffff42, 0x1, 0x3, 0xc, 0x2, 0x597b, 0x3ff, 0x7, 0xffffffff, 0x8, 0xffff, 0x3, 0x3, 0x5, 0xf, 0x6]}, 0x45c) (fail_nth: 1) 1m34.67958134s ago: executing program 2 (id=448): r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000780)={'vxcan1\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r1, 0x3}, 0x18) (async) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x140e, 0x100, 0x70bd27, 0x25dfdbfb}, 0x10}, 0x1, 0x0, 0x0, 0x4000080}, 0x40) (async) pselect6(0x2000, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x300}, 0x0, &(0x7f0000000100)={0x8}, 0x0, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KIOCSOUND(r3, 0x4b2f, 0x7f) (async) r4 = socket$can_bcm(0x1d, 0x2, 0x2) recvmsg$can_bcm(r4, &(0x7f0000000340)={&(0x7f0000000000)=@nfc_llcp, 0x80, &(0x7f0000000300)=[{&(0x7f0000000080)=""/161, 0xa1}, {&(0x7f0000000240)=""/150, 0x96}], 0x2}, 0x10080) (async) r5 = socket(0x2000000015, 0x80005, 0x0) bind$inet6(r5, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) getsockname$packet(r5, 0x0, &(0x7f0000000200)) (async) setsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, &(0x7f00000000c0), 0xf00) (async) setsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, 0x0, 0x0) 1m33.816267799s ago: executing program 2 (id=451): r0 = syz_socket_connect_nvme_tcp() ioctl$BTRFS_IOC_QGROUP_CREATE(r0, 0x4010942a, &(0x7f00000003c0)={0x0, 0xffffffff}) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4000, 0x10220}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0xff81}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000a40)='dummy_udc.0', 0xb) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000180)={{0x1, 0x1, 0x18, r3, {r3}}, './file0\x00'}) r5 = open(&(0x7f0000000280)='.\x00', 0x20000, 0x0) openat$cgroup_ro(r5, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(r5, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r6, @ANYBLOB="ff830500000700ffffff", @ANYRES8=r5], 0x4}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0x2c, r6, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x1ff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r7 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) mmap(&(0x7f0000386000/0x1000)=nil, 0x1000, 0x1000002, 0x8010, r7, 0x8e35a000) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=@newtaction={0x74, 0x30, 0xb, 0x70bd2d, 0x25dfdbfc, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x80000003, 0x0, 0x8, 0x0, 0x480}}, @TCA_CT_ACTION={0x6, 0x3, 0x19}, @TCA_CT_NAT_PORT_MAX={0x6, 0xe, 0x4e22}, @TCA_CT_NAT_PORT_MIN={0x6, 0xd, 0x4e24}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x890}, 0x40) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000400)={&(0x7f000000c300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWFLOWTABLE={0x74, 0x16, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_FLOWTABLE_HOOK={0x40, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'netdevsim0\x00'}, {0x14, 0x1, 'veth0_to_batadv\x00'}]}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x9c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r10 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r10, 0x4020aed2, &(0x7f00000000c0)={0x0, 0x8000}) pipe(&(0x7f0000000100)) 1m33.740247157s ago: executing program 2 (id=453): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000100)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000e4ffffff000700000008000300", @ANYRES32=r3, @ANYBLOB="0c0099000080000030000000140004006e69637666300000000000000000000008000500060000"], 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x40048a4) 1m33.300321254s ago: executing program 2 (id=458): mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001000)='./dev\x00', &(0x7f0000001040)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./dev/mapper/control\x00', 0x2, 0x0) write(0xffffffffffffffff, &(0x7f0000003138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00integrity', 0x21) ioctl(r0, 0xc138fd09, &(0x7f0000003000)="0400000000000000000000006c010000380100000100000000000032000000000000000000000000000000000000000074657374") 1m33.270930086s ago: executing program 32 (id=458): mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001000)='./dev\x00', &(0x7f0000001040)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./dev/mapper/control\x00', 0x2, 0x0) write(0xffffffffffffffff, &(0x7f0000003138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00integrity', 0x21) ioctl(r0, 0xc138fd09, &(0x7f0000003000)="0400000000000000000000006c010000380100000100000000000032000000000000000000000000000000000000000074657374") 1m25.250504766s ago: executing program 4 (id=546): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)={0x58, 0x42, 0x1, 0x0, 0x0, {0x3, 0x1}, [@generic="000000002600010000112233445566778899aabb88a845000014aaaa000001170000010203040506070800000c00020006002000080000000c0003000800110004"]}, 0x58}, 0x1, 0x4000}, 0x4000000) 1m25.249650626s ago: executing program 4 (id=548): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x5, 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000004080)='./mnt\x00', &(0x7f00000040c0)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000009180)='./mnt/trace_pipe\x00', 0x1b, 0x0) bind(r1, &(0x7f0000000100)=@generic={0x1f, "00000000000001001122334455660101010100"}, 0x32) (async) bind(r1, &(0x7f0000000100)=@generic={0x1f, "00000000000001001122334455660101010100"}, 0x32) listen(r1, 0x1) syz_emit_vhci(&(0x7f0000000200)=ANY=[@ANYBLOB="043e100e000100010111223344556601100000"], 0x13) (async) syz_emit_vhci(&(0x7f0000000200)=ANY=[@ANYBLOB="043e100e000100010111223344556601100000"], 0x13) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) (async) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000940)=@framed={{0x18, 0x9}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{r2}, &(0x7f0000000540), &(0x7f0000000580)=r3}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={r2, &(0x7f0000000780)}, 0x20) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="043e1422010001011000010101fb00000000fb00010000"], 0x17) (async) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="043e1422010001011000010101fb00000000fb00010000"], 0x17) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) (async) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[], 0x14) clock_gettime(0x0, &(0x7f0000000040)) nanosleep(&(0x7f0000000300)={0x0, 0x989680}, 0x0) (async) nanosleep(&(0x7f0000000300)={0x0, 0x989680}, 0x0) syz_emit_vhci(&(0x7f00000002c0)=ANY=[@ANYBLOB="040e06016e20004000"], 0x9) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) 1m24.487793892s ago: executing program 4 (id=561): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x7, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe5, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x8, 0xd, 0x800, 0x3, 0x6, 0x4, 0x100002, 0xc7, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0x1ff, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x3, 0x1000000, 0x489, 0x7ff, 0x4, 0x80000001, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0xfffffff7, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0xa, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee48, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x8, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x8, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x3, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xc, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x4, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0xa0, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xea1, 0x428, 0x5, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x13fff, 0x1, 0x1]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x82400, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1m24.2694118s ago: executing program 4 (id=568): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0xda6d, 0x80, 0x2, 0x27e}, &(0x7f0000000000)=0x0, &(0x7f0000000f00)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000980)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x13, r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x2}}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000440)={0x2e, 0x3, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000180)=@any_dev={0x81, 0xd1e, 0x0, 0x0, 0x1000, 0x8, 0x0, 0x0, 0xc1, 0x0, 0x1000000}}}, 0x0) 1m24.268630261s ago: executing program 4 (id=570): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x100, 0x10, 0x1, 0x0, 0x0, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e20, 0x0, 0x4e20, 0x0, 0xa, 0x80, 0x80}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x6c}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, {}, {0x0, 0x5d6}, {}, 0x0, 0x0, 0xa, 0x1}, [@replay_val={0x10, 0xa, {0x70bd2c, 0x70bd2a, 0xa}}]}, 0x100}}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r2, &(0x7f0000000000)='7', 0x1) syz_pidfd_open(r0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r4, &(0x7f0000000080), 0x80000000, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000400)={0x50, 0x0, r5, {0x7, 0x1f, 0x1, 0x50, 0x0, 0x0, 0x5}}, 0x50) syz_fuse_handle_req(r3, &(0x7f0000008280)="cab1f92d585917232bcfa47f91900c936355a83b5a41f6f43bd8b0d1a1e13674b6a8596a8376e6851e0b96decd071d92ce4887ddad2b82183858d82c7d11948024607d92ec0f1c23a4e755f29fa557d1353a3ced680f530e822eed64b4d1aaf20d1320f3583cadb9dfde95993487f96bc290dc10cfccc5ec8ea864590fc1678b79b0a36c9668b27ae142d22c305496881af0d0546076ec21e31bdab2465010e779e7140036d2b12f59b971792cfed8d07f0b8ae13ee944268f573ec11c1b14d53880a64fd2fdbe981f4d9af8863191efc03a39d5a3f19badf65dd49443297b38bf0c009eafad5879cb78e63b00e961de7d7180941f0d1e87a2635294bcb4619e9d84be1816784325d23fcb9c66388b586c8e719f3edfa2aa37cc3f6511add854c10fe546d1c11f11eeaff24cecc0d47ec8fd336ec08470f06227e4a9410074a3d715eb6a697b04bdfeda0b6753d880d012ef8fada7f4ed649ca214609e31cace9a33937813012e4c1b787d8f71ce9b495a69e5c8810ff9954b7b96743dcdd7e52ebbf526f339d3c8ad2550326d3a396de5ac90787b352feabe013c4044ca813344c97f836851d6daf2de3a8b07a61d1052bd302a641706af7629a042dc2f0374671b287f1325763e1818beba9f7cab9e25d6f8749f7dea4c5ef684723d33938aca32e19b1c6a6237d899fb397e9023764b3f4d6399885533a802e4d3ca76f2e0234ed6d7257f8cebddc900af88cc21ee2816513045e92f71fc8523894d684678f17b5fdb4adeda98fc019c0ba05efeffeff3bbda1d6d84a98002a74237cb8d13cb30d8a9a7e47e4da8273a47df4e6ea53036b5b154b9597e6eb00fcad29ed04a820b1ce807bf1818344122a6f0aac52d24426feeba0af56925cb4a1e70a84251f2b4d4693e689518a0e159647b5b60a62db699a25275520c208652ce4401bb5dcd633e7c889758d3d213f4dbe69c9bb76e80b6e892bb5f5809e042ee5cb1982a2373b1886711d1e68d0bc3d4c9d69ac605432bf84cd81104e77c71cd7c0708244fc9428edd52f8cc8f3023b4c6d3bbad7a9b874111098c4652b34c428a8f789c5e5f3f84354ab7afec1a7b11d2a34771ebad2f15c169a61b431c8a1cca9ca1596fce65242d03814ebf977da9bbde5707b22b5002cce68bd0f6d196df341c96bd0cf0916b8775e75021663ea82c99a90b844cc5f8b6c56b21b1fbbbf6fb40ed0c29ee4ecc2998df2cbe3a4d75025ef73dd9f3aa5bc7aa694fe573a73453c9ff873d0a8840afd91be319181836de45260b4e252394edae58f840858a9b64f0ff37bb1820031e563250e62ceea5a7c4d2cd4d5d10e57176fcf576e774920db06b36ea02f9cae9c1087bd1866fb4bcf7fbf393093b339860a61c61248000a2a1bbc982fa691e311fa1bf2a38afdf08b574eed0df42bdc30c3db7cdcb71687f48070077f91fef93e8e47e248d3e53e8a79fcb5a8f8aa39b3bfa2dd88d5c5840d517ae8c132d423a37a8be3301d62a99753bc72f674205a11850e045430abbdc4e68223a93c76d6d2f1d646af10a15705793e2fc5a532af3dda88f52063a091f1f79cd5a5b23ea7742b149eab1aa43c21c2f15227a1f94b5580adbb1e1c49ade49d6e8b838cff43aa2426651817f479252c8ef7af9e4a5ad33839be6c15b50016c59f13c26cfca796cfc01207acc69e9d3952f6e71c975bc77d5a001f6f6c044770f54d86a4518a4898e3136988d643dd2de907859f0b4d4de2a2d461ba5e05cff49eda86772799b2e7947fdbb89fc5b0347e87f1b9dbb94842cc1457d07f3e0c41342510f5ccb551cdf0fcac1a758041bff75812de1b2abf341ed5f667c9b0581d2c33e0b17f1b46c2287399c62252edb9c1cf2b80b7a1b4c3c903aa4cf5332a2998b9072f61f589ae5df1168f8d18e98fce2bec1d5d876f9757017b73495a4e8f4f2423cde8875aa8c95a9ce180cac6690657b8a70e5541d5ef46575cd74e063759fe4889f4d9737a6c9732f8b7f7836508814093b9bdac5733938e761b3642910d4df0b646c1b9583a502246988e9ab78de3d011e8590e48eadfcdb70c8aad6dfbe1dbd3ef20d9ba393db4e6cf91e3bb4e84883c60dc20ed974a5decde12d3c5a1c9a00999f8eefc244465f518425820b9713cbfc6027f427b9cd8756edec5b3a0301a01ebb12c6d412ee3422aeb8b291619f62f4ce41511156f73e54b5097051ea777af7cb73b36e1274ce1a3892007466cc793eb0515b8984acb99c04c7eaa51e175bd73d99bc0c67c8ea84d808a7906a6ad330ba2c9651b2ab82d0781a969873dcddb068c15b7899fd560a1c3d44b34e81cce079c46fd86522052659e2c3151c79a8ccab1dfcdb91f53ca067ea1b2aa507278e4166e817eb0d7dea67cde1598a1bdb76a8caf82add2b43fdd10bf80b0d2f32365849c425d6ac3d2d88a76378d23961eb96c8422e785ea61f33e4daec02393d51f44b177755749fe84b43f5246d20177800af05752af524265f34f62bd5167fa647d2118aa905a1af53f07e7447bee29675cc23f547339af140c0818aa974ca16da33e767d508e4f56726c7076acce57a9957d08348ef84a39188e800ca44682fccaa9ee1b42e1aaf7738dced1dce3ef2dadfcba2863f36b5f8080ed22539b5176bc2c57e52e4cfde659c1ce9e179c79f85d60ca51c7453dad593190b19a1be8f5c5b0249d70079f10f9d0f07f25a98bd95e6e6f71101842b55347ee008d58522e8f7598c1636c58fd20984a6bb17fd47e7db4bc72854054e7900cac4174cf0b4eda2406842955fd8a2ba00ea4d490dbbab02d659cea4c449d9ee37c8f35daa4740b3273693ee2c1b00965a79d18ad98ae92bf2e1ea84ff1e6181937d38765cb353c6223ead1257d88a8844cb0be17aecc2dd56b78dcd6e2999fe695db248dd68275a5ad0f223a4629b17a040a766b2bd2376d77a422375de14a3daaf4fee92f23ca831452826bc66d0cee2049acbde07bdbb6ce228147f9ed4f9437301e8ca9e1ace0684700e9623a1534212d4c557712a3196d86c86077e97172d7e89436e95e1d7e7629d5bc908e346e504839498890210ca15bea51bb2840f1275d36b99490ff0706aa3ca9e89f33fd99df863acc3bca504c15501ba9d987999ee118f47b7737d2dfe73ab257d680f983da1f5fd5975491ad966989f7b15e76e4e6b1a2987801adb3b7cd4cb1d2c9d0454429c2955643c8fb82ccf8e93051cc10081f8181af0d143deee686f67ec42db1e9914ed047e4bf0006af01028e3839451fa3e17d33586022c63cafaf6d0fc773c96143473316988d32f9943d7477604a27ae4b8a7093bee2cefe10cc02109c748d0676692a2411e5c3b4c4c1b9ac7f9b71a1a7126dacf4615e8c9c3d38f536e8b32e37f406b3dc44db80a00d6e423deec869edb32a411986be1517b6ea45e1f984a6fbd08edb25a305122fe5a90cc46af48ebc36433a1f27f43d85492ea60fd2f43125e7328da93f7aad97f97910112fed7ae7b1785822356a525df1f3ab4637b68d92ecd8d7f234973c686fb11821bb1de5f8459b57892f1dae08aae1924ee60a904d7be6e6611ec3d00002152ab7e0c29c7bf124dbec9a6eff25e619d89c27d187e3ffff63c996c33f4b7e967b607f36a8ac8dba6beb43395c9c9b2e3e36de29b07f9c2d60cdfd1d02813d4e508c56b99405b752758a01cc25bb5436ea1efd52c536fa1d2fb1cd9b1ee006d42b58600be2c1aba59c480cb6e9224d7a4df920598950634033087d3e356f35cd2f8b021d30f4ba79bc60eb6715c6c9bed84648552395cffa97c8cdb8f562f8f127f0e6f86dc61fab11ff782560d88cf2872d0e07a27f38120a0831a93c377298c2ed4fe180eb078422e5f030540fd21ebd414e6c42f1fa5491b5b8fdcada476376732edbfd66e10a475e2c0a43ccf6a41f7879f4577e987695d8d5097f6920fbe2b9ac2cb424de7afded1b5b7db89f3612c487770d58a7bb7517f1fa7a98ff6db3778d40c5f36b27d233a0c18587220f900f4a8e867e33e24c1981acb3445de995132d8fcc58f79ddb1475ba69c464071e95c0707c396c0b1b710cceb51efba5f30a271cd456d5f7216d90b412156ecb01dd41f15ac31980649c5eabc7fbb085a38318d43b0683cba055deb9dde4dc4584935473508837c1023993d50b434b311f126df6a0be0653b97a97bbc9b165098dac8dfd6ed6f033ccf7b32cfa3292296222aebfaec4dcd5066b66be45696067dfab907e2984f1bb6067c170e0617e245c9c09a85a061c4b7e2873ce0571b48d557007d5c7ddf5cc2ffa533e2a3975f3687a6d08a09dc1d285cfed129ec887d70bb5aded429b676c242d57c8f36721bf5732b1f25eced0ffedba7254486c9caab3fb3e0ad3b2dc332a06dadd39e5483a314b1d3086cc198b6b6b272fb56e35e0388b1dcddd484fde0ef9d855ca7bd98ebf0f686cec7d5e37f7b5dffbe4ab28c4422adbaef0c45649b0b830dfff90bbea3b7103ea9dd87d856ba7c5bb485319eecc71acc943c733f489ad72e13b1b232cd1eb4ce87917daad4b0405c9905f7a35501c75332d9acb36057715a6abd0958061fda860c00000000bc9aeac4f47acd022927c381012150fed83a99c2d7b268ff2e1c8d162d3feae2c5bdee747aa10566a94f13d4e1a00a4043bd179310e72ec8e4c68659be77907bba82fc416a72c0d2076821f77e8afdbeac769195a01515ab45ba73ec85a2f8a52146dbbc8d585def095aef4e4491362b596a84d2e9fd0131de2c72b71c4bd239146011eaa209957b2bb3f74bf2f42a17440749688d66a18a9d4a7d1e2bbb34dbb2a45460e69a1ec43467665c59438d35fe9b04a94e408ec4bcf7ba1a25bfc287d6189b65711904be9860f8a68d1bab99eed54890f963caef1fa0179224b650f090f67dca59f1241c2a25bc921d522f61e57d2bad88c057d3f7729499a0391fca3a62b27cc0a9b976da3eef333d88ad128ea757697ffdd50633b66b73ea3ddb565bc3d8780f9c0bb2347551969aaa500e7c030da2a92eb3f78d88b91eb547dba2e9be7ab2aa617f0890c39c73c8c2b35ff7ec529f6b8d08e3fcf2630e454bdb6474185ae72ba69310654c9c0b3ba158fe223954e1d46f9d27b0a4e090b0084918b2964bdcee31d258325b89ef96790ed1df4842b482023f1d22fb3e01280f1c8616153035f10bd65de57c1fa7d5a17e77b12e348bd3019092ef548c5249694168dd24df8a7318eccd779da4f547e9f162f484eb3ab9f5bd196f6b68656725d2624b61d09f73586753a1fb7eeb1721973f8e15522487f1dd1412b0f4846801d1abbfe53b755f15047981b162a1de04d52b4d4762ac877e4d718619e8cdba16df688fe95bdc9a1ee99c21004ba7e72985752d89d6892a4169296703fde314457f014ed89c129a4c83b5bee0bb93cb69a83313442837bc03679ee317cf8d1b908b70fae1b1461a398f310ac073642f954ab39e0eda329a94a5c12cf262ca4a25831dbc10aecf83d9d54776c379c230bb488cd6c9295bc31cfab61eb9b5486726f5c854db8aad2642d4468643f3bc8b25cdc9fda7aad04b06b61b185868a44acd46a0bd8debc1e431f19aeddfa3d0e480949bd361f6c988744acafae954c140192306c3066e8e434f70e8cd67b65a59923d166a95ca5e0515e2059e1f1aa9a74bfd49e4e37638bfa6b6117b790c4ec7f536d046c38f8ab6eedac1713bcb8860a18cac43e9add3c68c3ce5d17fbf76e966afcd3ed7795540650e093d39926f5e3719156baa54307b4f5e934f24951b3644a7657e798525d3f1207b28527a5bcdeb33e296c6c0e9e1757941ddd24a0d15c9a21918514a3143ef3fc2e775345ea10aeba6767686e9cfa646da377e88fd759a33ff20c9b258fd37d063d02fe22f090c5e324b507cd3bc42248a7abb2c7d0b1b85ecb5a67bf53a2f25d139ea523808678942e1588fd677df161b67b563a446a2cc69d9126fbf308258a13fcd6f53d92d9947311e3de4fa5acd7c2684d9eb3b4feb024e05bbf090836d92e30b68df6a7619542c9acbbb69dc73c781bdc7ef4b25c2af77186f493a5038a56508cc56b7085e13f4264e02a2a3bb515e15301371520481302f2367c883a5ac503ae4269cbbc8fb2f0f77ecaea7b8af04bc24aa90f677a72bbecfdb225864714344a8fd1c07ef664abaefe53bd76ba12c8bf45860a316812af87348682ee7005ac6a00523f4313102742ee5502d8c61c3321d1b872780192f4d00b12b38d0aedd34619c42f49b81d7bddc4ca481ed8f448bc3ad98b13f7176748838d623e007a24948480e978b80ce67ec952eca613091ad4f81cd521b2851bb8b2a6b1da0420eca80aecac9c0887988e1f29906c9ce65b990a00f22ba6f115a7a0001f511ec35dbcd401130173fded8b2e23365caf3d6d7c8f404383f16fcd76b17c220f88c1fe96211bd92c5803c63d9537a2ceb258508d9b1d74ca43174eaefd677ed6db63bb3d7712c9558c7879fbe67b7396c721407953db9dad13291f96d7d0290ad56cf1f65ccf58d3f5b8ba1f78f81d86ae0ea50926ff352d73629da44a6d31598dcdcf81355faed4f5a6ad8cc39d4a414b97f193c896bd3c270097cc96e4a5e36ca9a56a27c52a03decc4837d7b008acc1fd2724f97e0e9591afb5de3af3ec5fc16e1bee79098cc94d638375d69ae5065bedaed575e11b1b0a4d1189830856e8d48a6c50bf18cb9f8919fd8a55ad0b2f7d8c096c7f549fec8e1522be0de2a69699afe47e899ac6d5405c08e2e374326808ba76259d85b971dcce55aceed11583603dd280fd15c8e7b206e8bade3f6d83c6041838ea8b489fb9f92ab220ad5d3cd2af3f45cb2df7094d550b2cfea314469943a159e12c01897a7cc42904eeb24cc507e7ce7ffb4d22efdcd5cb5d75975582e14960fb0f2b83cb774faea32dfba7ed0e8b6a749785166cb5c77dde7498f67f7f20d0b85a7fe6e7f8a8e3f95bd795165f36440d84434cef17f81697816030e3a86bf003272ca4868ab935fa0d465fb10637a706c9fd04fa4d4eb421e87aa6628a1d6174833af4dbfceab7fc5989550c0847bf27a5243e3b318fffde95d11cf507bc4e092180dd228df9f89d193a160d50c223309eae580a09f2e78855f17f8ad25c1f5814becdfca7948c7045b242e22d5efab676fe717eb34d2f0fcb77289c8b12caadd2377b7ccdcfab61900971b4a2ac132587174117428739ebb109fa133e483956bd499dfa530cbb3d1df42309f6f0755b043d85776807f25c3b4b518a2274671eb38f3e82ad4397377f85201771877a7cc43b838791a4d4d655ecadf03d8c1687e961c83dbb64c4d54d4b745a3abca7e381a00c6f51f48f6f7ce29ec656d89a1fab216675febedfe6b08c35add5aeb8cf6c0b226d309a222e1783e45e560f6ea64bf7706787f199116341f874321b52b1135830ab8979ae5546aad4ecfdac0045d4d15b4ed2fe26e484793db6aa61d40333355fa96ac5d1b8a5b5fc033475cba14f344007bfd82deb64b5c2eda6c0d528e4de0c21802d6b27554c0e2090f2c4ebd19208ce904cc02756b44bb2f8ebc1d37961c0957a4815487cbf76fdbe1f2b77b563a5663a00952c92579399f7acc1d41d9289ea0345f02f6f760ced802c8e0b14760a43dd04e6c371ceab9f5cb3617cd7ab31457b6821c6a4f34b243fba61f5c553e58ca253d5723382cf5d3f8357347ee2af2d48d86367f993e4b80b849dd3f50b2a89338af97e11b9a796ae2548856cce01334bca0c558e160f16e74699c7eaefd699acdf4d5019bf70f2d9c083f62b5254262f05c01dba59b1779502d3ad310a3039447d730a2cebb1242331a9849921c07336e985a844c55ce6129a650b3fd7cbda52a0cfdf0ef566f24adb8c959e442e9d5663fa16561b185cfb18355863d9b9f91c3829c4b0ba580668402a7a100fcd4a4e901b660863a9537f46e4f36446945e8f62e53e8282ccd7cfe14fca161d7daf592188eb2e11e275f616f4e692db8f318e8fb635d1a2582a3c8ad3050995f4cd810c04b23aaa6b26a2276133b443280f0526c9b1c016a7fdc052eff91d167b2813ec4f868c2da5fd9568da148e0ced0229f415716c1caddba880efa2017a82829125e734b96333da0b15340c149b50be86e3017bdaae3d80ae51c35df37e67684e81b5933cc7bfbe7ef0486d57e3901f9ae3eb1d592eb3fc244ce6555d3d69922dd3dcefecbba207fcbd5144a5ff97bf2216c046348a633284db59c10662350c7484ced762f353cd01a971c88d0eabb68eef856d585e8f5a684dc948b094754362ba8d606f85a755a27895ff5b6b4ea0387574afdf362a43b5535a2838b3f00f24612b9ae47e95f15d8b828efe56152d77871cfda0e0ff9936db3fe9c49f0d0f5ef9b71b81efd2e92d0166a4970254950a51235b66866d5402740adaa584e892572a6f46714704660cfbcaa56cc27cb538a908d1ee2fc7adaa674ce7a717f6e0481a2374f768fa3df8368bf4281bce6f9777f958f36502908d7c921ba745d0cc16b8a9a67f15c26d4b005788b1e90b19cc13f3e925fc14ef31d624c7500710d8f80e5bd4b14dd6bf70c210db6077c69d2d1751fe999442502d3542be12b732e3793e6c5e5c33a15a792ea344b0ed0be1ebb1d4e896e3e62d8d85afad2ae134dabc4f0d3fc719c6245d3bfafa42f0cdc9c0d5c4ba5c20b9da975bfd2f211bee8589ce1dc9652c2c3cee2a5e8a00049e42afe4403a905b60e0dcda1120d32ce36b91719d6308c93dfaa16c23a3b37e88194778be77d5e9e64b39477b76b4644ca32525b73bcf1fd9dc9af7776f2149e368053c58e1c93e1ec4575cb5e0b2da61d5e6b19436f3c095cdb4af4ddfc3364975700e5ff5275f9336b8cb3b959a1cd94f6b9c3a33f35e9ba4b7fea0466edf54e5e2e06a79bd170392c02b09749f3d111ef60baa8016dbf9ba581beab2c43d094add0d7fb7e16f198f3050641255f30a57c3045c1b51dd6e5d65613167596365b9c67aaa36fc89c44fbc4c8c96c328554a63a15511b04692651dd5e30780caf0dfce976c665e7b05fa6143914837bc82fb9d9dc5a1660e28a697e8a0a32eb8db109c5a045243d86ea11847fb64ec450112d77ecba32de418629a4ea2ae3f7ed3625b26def5c19813a6386ab4e43838c1fad3d4e92dfd7d3f98b3cf46d6e20304851899c59661e9639f3ff52fa023114907d930d74d605f3f7c5fd9ebb446d807e96cf3bf3517e369dc98f489026ec035a86f3719e1e50a48c0381f7fd2a7eea1d3a09ef7a0ba50b2ae28c2c955db4761ac005226ebc0c18d108e8ac066371be249b80eed88afee799411a50381cacb2d5164f0827720eb9d11b5cc548c2e145291dfbc5d4f70646dfbca077ce8ad3a3f8c627021295cbef70f5013c53e8fce32116e678a7b1dc535d43b429d330e9193f8de1a6c1da4353a86bc722ef1cffe59a012ff9c5f45b85e55ebdaa6b36a519c544ef8a86095e522d7dfbb9cac41e826fcc4bc676297141195f839ebcd8f64599fb15856960f97bc70d2336507d5060282d0988f354eb757c6f4b0ee77e2c0889e5336633ac28e2651c98e7f2fa4c163f8fc196b6798c1400c46710abed12a33a95afa56c7fe55de0b48cc984c80f6d98d212daeefdbcb457217b3962436e481d70967cab6b0943d5da59021ea9fbebf66e86943e029ef95d46d347b834098e1c8fb4c35d15945bc2e336f74c6c80430ad5fc4f5b9c6b41245ecf151eea90763ce3e09e050ae1c0925fa7a5ddbb7f210226cdcf9ee406041b73a5988646b90ed382d08e7a147078f9de025f5617017ec70f65dd25d7ccdb47ad7209474f4ca461ca46f0afe3cb405c3b72d320016d01b62def93fa4fa5a34df145c526fc497329a9e29ce17a929893f7beb417c88804418271dbeb51115821db4737b9cc467f190209649f543675defbf95640d20cdd124e85788b703213f4e99b4f36b74b5d44b67b7bc995ba133da4ae92f3a3db49c9ec039e0285001fc16760da0d07552e1ad621a4bac6d0b6409316e8a78273b79aa70df0e3ca024336d42c530550be8c68897bfa6a44f595bf5be48f8b25b48825ebcba815db4b3124522bc71e3970dbcafd479a6dab40f745a655cc3f9dd5aeb046d25baaaa160ba21f8b3c0292329ae107483c8caafcd70d041facfbf705dda95370a91879fc0ab9132e3b7b02cad69417178c4f34909df7a373bacb289476c25c901be7b52aabfdfcb3415ef3a565c7de2f0128c63e16984e2e98ad23e06b890f22894ebeceefdb472192e501e2c791232933b52ea4b9c4e9fe3654b8b1e08048fbcf58fada1cd49ca6658ce6ecd12102d90c81eac26090efa36514553abb298f7cf1a43bd6d473c1436b6be9e87445de726cfffb00c72de49db0585d677d5b245e15f9a53b4c258ba2fd67d38afd9ccd0d409c0bad675fcfbc1f4e5166fd1b29203274f758f55a266b8f7c9ec8ef1dd4913727fa392ce6b11baf902ea708adddd836982a609718c1dfb810aee6f21e47c27dc6b4eeebe5fc21aae6fe7d2908679c873e2aa45a1ee14cd7e10586216d5e17cdbfacd4bfedf00b7ba7fc46d4ac90667329ba76b4fcc6b991a55c9ed159a2fb9525c975bc0aa4a291fdde14a78b95adcde52fcb5a893ee7b4df6631b3ed5a9d9d9ebe36c7cedea777a9e67faad7f7004f0a820aeb6636f24685a15d12abc639aab2233b36584670c667f9e7a3fe1195d35b268d1052d5b4c9625dc963640c2c5e6c37d36acc31755b34f3ee2af7b7ba5dbe105322a3741c567c9edd817f6488fe69301b19481fe2e2cf74b19d4b224598b0ce1fa151fa1ef3d69aaeaab397a5eac72e0b969a09b85e3258e891db207393bc281afa93468b29b7e55cc2decf8292fc68e1a02b2faa873a846680992b37a548c8f724c0125027faa58be5b2836206cc34c063b50270d7fc968dab0d38072ca90bdef91119b72ab417d811d2f32bd41e6ab2bc5b5293f92f7a0a4f172bfea5403cd418db95e1a4232f78f6afd3d13978e206d85fa9ebe2abe444db065d03b6169bc9f0dbfc19237a74bd13c1ef844f839b20018fdaf1be6f1a171f6f3ce2205fdcce38330b88ceba0c5eae812e12be99993d265f806e61ec42c9527287967a1c3b27afb1edc35a5d17bb7f4d20ea708c62c9170ba2ab710f2d7f5dca7b33e0f9434cf0b6ee846fc8bc45d39f252ec682732fb090f46032491155d83a30894a259e037e57de7523481bcc2d704d8d728fbdf048df30f7e4861f62b8e63de47b3838b5062ccd2c125bc581024ea76bd4b1f53057f37d329f7861a2a70fd3b6d6fe252a1b892192ed75c585ab809f702e27e237c4aa2dc947585c2086eeaa29c3ff7e02cb7d3a0aa3a8156d2897daa9c45a2e28ba14fd40c8a3a058805e4b5b10641c3c25b9ab80cce83206b13a1e2bc362eb5ab7e0e677c01fc0486aa32862ad0afa4f1cc8496b961a0eec71c26ad107ead599d8ddd59d85adceb3ea442efcf8ed64f4c66547344dc81ef5b6ac102434395203f58d59656d41dcc192774d70f4f2964e304efde831126d402a240325e603347aa43626b5eb69b0", 0x2000, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x90, 0x0, 0x7fffe, {0x5, 0xfffffffffffffffd, 0x8001, 0x0, 0x0, 0x2, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0xc000, 0x1, r6, 0xee01, 0x0, 0x9}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r2, 0xc0189373, &(0x7f0000000340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file1\x00'}) getgroups(0x1, &(0x7f00000001c0)=[0xee00]) mount$fuseblk(&(0x7f0000000040), &(0x7f00000000c0)='./proc\x00', &(0x7f0000000180), 0x80, &(0x7f0000000200)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r6}, 0x2c, {'group_id', 0x3d, r7}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x7fffffffffffffff}}, {@allow_other}, {@default_permissions}, {@default_permissions}, {@blksize={'blksize', 0x3d, 0xc00}}], [{@obj_user}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x64, 0x36, 0x63, 0x61, 0x32, 0x32, 0x31, 0x61], 0x2d, [0x30, 0x63, 0x38, 0x36], 0x2d, [0x34, 0x63, 0x30, 0x66], 0x2d, [0x39, 0x61, 0x39, 0x36], 0x2d, [0x61, 0x65, 0x31, 0x34, 0x63, 0x35, 0x63, 0x65]}}}]}}) 1m24.059449084s ago: executing program 4 (id=577): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x7, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe5, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x8, 0xd, 0x800, 0x3, 0x6, 0x4, 0x100002, 0xc7, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0x1ff, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x3, 0x1000000, 0x489, 0x7ff, 0x4, 0x80000001, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0xfffffff7, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0xa, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee48, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x8, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x8, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x3, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xc, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x4, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0xa0, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xea1, 0x428, 0x5, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x13fff, 0x1, 0x1]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x82400, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0xfffffffffffffffa, 0x5, 0xf2, 0xd, 0x7fffffffffffe, 0xa, 0x5, 0xa, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1m8.142362543s ago: executing program 33 (id=577): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x7, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe5, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x8, 0xd, 0x800, 0x3, 0x6, 0x4, 0x100002, 0xc7, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0x1ff, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x3, 0x1000000, 0x489, 0x7ff, 0x4, 0x80000001, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0xfffffff7, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0xa, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee48, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x8, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x8, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x3, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xc, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x4, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0xa0, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xea1, 0x428, 0x5, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x13fff, 0x1, 0x1]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x82400, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0xfffffffffffffffa, 0x5, 0xf2, 0xd, 0x7fffffffffffe, 0xa, 0x5, 0xa, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.607838415s ago: executing program 1 (id=1553): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0xda6d, 0x80, 0x2, 0x27e}, &(0x7f0000000000)=0x0, &(0x7f0000000f00)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000980)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x13, r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x2}}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000440)={0x2e, 0x3, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000180)=@any_dev={0x81, 0xd1e, 0x0, 0x0, 0x1000, 0x8, 0x0, 0x0, 0xc1, 0x0, 0x0, 0x1000000}}}, 0x0) 2.449162774s ago: executing program 1 (id=1555): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=[@rights={{0x10}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xc8}, 0x80) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) getsockopt$MRT(r4, 0x0, 0xd0, &(0x7f0000000040), &(0x7f0000000080)=0x4) bind$rds(r2, &(0x7f0000000180)={0x2, 0x4e23, @empty}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) r10 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r10, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x270, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) sendto$inet6(r9, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) io_setup(0x8, &(0x7f0000000580)=0x0) io_submit(r11, 0x1, &(0x7f00000006c0)=[&(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0xdab, r6, &(0x7f00000005c0)="c6a27ae0ce5f5020b22d5fa54f5a1bd8673cc57bf0314f1b4755293601144d3a6109f770b2fdcba1af35b4bdc663db26d058f691c53073f8328d77a423ba159c78077741f8985113f02efd2dd90893458ed8d2cfaa4b5c2cee9b6c44654ece684b00f038881b1dfb21e8e8b1a59d025ce1cb28f3638061", 0x77, 0x4, 0x0, 0x1, r3}]) r12 = dup(r8) r13 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x42, 0x0) writev(r13, &(0x7f0000000440)=[{&(0x7f00000001c0)="2c1cbf6d78c76cca14f0b1dfd5af514fcc6f5bd69ce4df3145e02c97dd3c0a", 0x1f}], 0x1) syz_ublk_setup_queues(r12, r7, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x8000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 1.918896044s ago: executing program 3 (id=1561): setresuid(0xee01, 0xee00, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000002e000000840000fffe0000009500000000000000"], &(0x7f0000000180)='GPL\x00'}, 0x48) 1.789796613s ago: executing program 3 (id=1563): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000100)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000ff00000700000008000300", @ANYRES32=r3, @ANYBLOB="0c0099000080000030000000140004006e69637666300000000000000000000008000500060000"], 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x40048a4) 1.659498223s ago: executing program 3 (id=1564): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x570, 0x2e0, 0x0, 0x0, 0x0, 0x2e0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@ipv6={@mcast1, @dev={0xfe, 0x80, '\x00', 0xb}, [0x0, 0x0, 0x0, 0xffffffff], [], 'pimreg0\x00', 'macvtap0\x00', {}, {}, 0x33}, 0x0, 0xf8, 0x120, 0x0, {0x7a00000010000000}, [@common=@unspec=@cpu={{0x28}, {0x8}}, @inet=@rpfilter={{0x28}, {0x6}}]}, @HL={0x28}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x36}, [0x0, 0xffffff00, 0x0, 0xff], [], 'veth1_macvtap\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x0, 0x2, 0x1}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@mcast1, @ipv4=@multicast1, 0x36, 0x1f, 0x5}}}, {{@uncond, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0xb96, 0x2}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@loopback, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x1}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 1.559972364s ago: executing program 3 (id=1565): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0200000004000000040000000100000080"], 0x1b) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000006c0)={r0}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x6, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000100000000000000018200000", @ANYRES32=r0, @ANYBLOB="0000000000000000690300000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) 1.466044338s ago: executing program 3 (id=1566): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newsa={0x154, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0x1234, 0x0, 0x0, 0xa, 0x80, 0x80}, {@in6=@loopback, 0x4d2, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {0x200000000000000}, {}, 0x0, 0x0, 0xa, 0x0, 0xfd}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @encap={0x1c, 0x4, {0x3, 0x1234, 0x4e24, @in6=@loopback}}]}, 0x154}}, 0x0) 1.459982014s ago: executing program 3 (id=1567): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) syz_emit_ethernet(0x2a, &(0x7f0000000100)={@remote, @random="72b400000059", @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x16}, @remote, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}, @remote}}}}, 0x0) sendto$packet(r3, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @link_local}, 0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) write(r5, &(0x7f0000000700)='\\x01000000 -', 0xc) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffdf, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xffff, 0xffff}, {0xc, 0xfff1}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r6, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r8, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000980)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r11, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$TCFLSH(r0, 0x400455c8, 0x4) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000019080)=0x30) 1.440789818s ago: executing program 1 (id=1569): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) sendmsg$nl_route(r2, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000e00)=ANY=[@ANYBLOB="44000000100001042abd70000000000000000000", @ANYRES32=r1, @ANYBLOB="0028000000002000140012800c0001006d6163766c616e00", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r5], 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0) 1.135840094s ago: executing program 0 (id=1570): r0 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000080)) r1 = socket(0x11, 0x3, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x800, 0x0, 0x1}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000200)=0x1, 0x4) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f00000002c0)={'wg2\x00', 0x0}) bind$xdp(r2, &(0x7f0000000100)={0x2c, 0xa, r3}, 0x10) recvmmsg(r2, &(0x7f00000015c0)=[{{0x0, 0x0, 0x0}, 0xa}], 0x1, 0x400000c2, 0x0) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000100)={0x60, 0x0, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2e, 0x2}) 1.135476644s ago: executing program 5 (id=1571): r0 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$DRM_IOCTL_SET_MASTER(r0, 0x641e) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x3c1102, 0x0) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r1, 0x3b72, &(0x7f0000000080)={0xb6, 0x7, 0x1, 0x1, "01fdcfba57bd2983e8ed20b75c2b2eed5540b06cf4886ea46b0d5dda16f0f8177f82d79366a0f81850b3c029f279aacd2637c6700dd664b26ed4e5612e0219c13a646a8a2c990cd0c023e91f794753223febe65163bc35f5da9cdde36a408c85da380ec8efa89d779b57239a88d0b817391d37e862f259150cc892caaf098e623d12ae27c8b7c2aebbfa381fb9bc629ba02ba41d70f2bbba50833ade0115"}) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000140)={0x3, 0x0, 0x3, 0x6, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f00000001c0)={r2, 0x7, 0x8, 0xffff1ef8, 0x123, 0x5}, &(0x7f0000000200)=0x14) ioctl$VIDIOC_ENUMINPUT(0xffffffffffffffff, 0xc050561a, &(0x7f0000000240)={0x0, "16020391684643b6a6b7e4d3339e5cf517060e3dfd82af3756bb6befe3520f40", 0x2, 0x101, 0x5, 0xc000c, 0x4010804, 0x2}) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f00000002c0)={r3, 0xffff, 0x0, 0xfc51, 0x8001, 0x5}, &(0x7f0000000300)=0x14) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, 0x0) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000340)={{0x1, 0x1, 0x18, r4}, './file0\x00'}) ioctl$SNDCTL_DSP_SETFMT(r6, 0xc0045005, &(0x7f0000000380)=0xb21b) setsockopt$netlink_NETLINK_NO_ENOBUFS(r6, 0x10e, 0x5, &(0x7f00000003c0)=0x3, 0x4) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r6, 0xc0189373, &(0x7f0000000400)={{0x1, 0x1, 0x18, r0, {0xffffffff}}, './file0\x00'}) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x10002, 0x0) write$snapshot(r8, &(0x7f0000000480)="26a2b63a24f841c764d909607b4b59031a2776796de9d1d38a5344d2b8eb6a5130f8ab6e018e6b1e37f98bdf88dc3f4e182bc104dc208c81e059463eb7c4d3843d5f044df59ad13ee93530944e932617af3dde0a469ebf5a5ee0d174c7336cb525813a398a26aa9488b46ecd870a08ada4673474732a791a7f70b71a411a7c3caf987ea423", 0x85) r9 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$TIOCSTI(r9, 0x5412, &(0x7f0000000540)) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r4, 0x84, 0x17, &(0x7f0000000580)={r5, 0x7, 0xfc, "4b40cb9cacd3b08c871d0143a4a37d22ad391e25f9caa7d064cbc1493cef33bb113fc0ed6c24befe01c9872b9457374115c3367b95c2fb3b654dbec5493bfe0053cb38fa58d4500219bbf1e85a213d09b75ab9c27aa1c3b6d71c8a808cce79ae255146d3aa16b3fc18e714e76190c63e30ae99a19dddac1afef98388b483a56e8419c8481bd958239621cf36d96051d93d62cb2989b1c8edba856a5fca90528bc85c721afde3d2d4d5894aaaaea07b0cff9c24fa83b69a5bccd59a57fd23f5ed9549b18cd5270917eb9eb7715eef504b634b1e1947a6c8d6109777c5583f9d2b730654e994065391c109906901f74d860a10a45d7bf7e3de81cd8899"}, 0x104) io_uring_register$IORING_REGISTER_CLONE_BUFFERS(r6, 0x1e, &(0x7f00000006c0)={r9, 0x3, 0xdd, 0x1, 0xd}, 0x1) mount$pvfs2(&(0x7f0000000700), &(0x7f0000000740)='./file0\x00', &(0x7f0000000780), 0x2000800, &(0x7f00000007c0)={[], [{@appraise_type}, {@appraise_type}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fowner_lt={'fowner<', 0xee00}}]}) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000000880), r7) sendmsg$BATADV_CMD_GET_GATEWAYS(r7, &(0x7f0000000980)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x44, r10, 0x70c, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x812}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x800}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x20008010}, 0x4000) r11 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000a00), r6) sendmsg$SEG6_CMD_SETHMAC(r7, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x3c, r11, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x215f}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x3c16}, @SEG6_ATTR_SECRET={0x8, 0x4, [0x7]}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x4000) r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b00), 0x40, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r7, 0x3b88, &(0x7f0000000b40)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP(r12, 0x3b85, &(0x7f0000000c80)={0x28, 0x0, r13, 0x0, &(0x7f0000000b80)="9e9a8f57ed47a308c99ce64bf08b3bca755241adc63bc41fc2c64b56bc47d443cd17b36e906f891e32995cd6e8d6f93fae89d38d7364dc62e0ad57a09f777ccb434ed8ac02c1e22f9ab6a0bfdcb78c37fd92502d563a1ac5119c4d7f78340e98e8e39fa196971e1659a94073c20511cc7025e4194ef7d2f86076b6d0aca191a288cd3aa17827aeaea2d8a3c09b93f107063ad02eb5903b235d4cdd5715a1da6f4c104a33a02c199f3e246e2df7c41396528556b4ee9a8eddd3b1b8dbc891f429ce56f2989fb119a5f601291886e3afd9523cf41ab247956e1fff672b9e62406ed1439676184dc7b438c8e83e4e9bc8b2f4757324", 0xf4}) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r7, 0x84, 0xa, &(0x7f0000000cc0)={0x1, 0xfff7, 0x8008, 0x672, 0x80000001, 0x0, 0x3, 0x6, r3}, 0x20) 1.049622814s ago: executing program 1 (id=1572): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x28000, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x28000, 0x0) setuid(0x0) r1 = socket$inet(0x2, 0x2, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000000)=ANY=[@ANYRES8=r0], 0x0, 0x80, 0x0, 0x0, 0x0, 0x10000}, 0x28) (async) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000000)=ANY=[@ANYRES8=r0], 0x0, 0x80, 0x0, 0x0, 0x0, 0x10000}, 0x28) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000004000000080000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000800000feffffffffffffff00", @ANYRES32=0x0, @ANYRES32=r2, @ANYBLOB="010000000300"/28], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000180)={r3}, 0x4) sendmsg$inet(r1, &(0x7f00000000c0)={&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000280)="08001efbb07d5a6e", 0x8}], 0x1, &(0x7f0000000540)=[@ip_pktinfo={{0x1c, 0x0, 0x34, {0x0, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}}}}], 0x20}, 0x10000000) (async) sendmsg$inet(r1, &(0x7f00000000c0)={&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000280)="08001efbb07d5a6e", 0x8}], 0x1, &(0x7f0000000540)=[@ip_pktinfo={{0x1c, 0x0, 0x34, {0x0, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}}}}], 0x20}, 0x10000000) r4 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$inet_tcp_buf(r4, 0x6, 0x1c, &(0x7f0000000440)="657370681204f900d0ab8884f0d86e5edaba7487e038baa9fbcba6c8b59da372672a4b488beaa17d1aece82edeeaa0eb4ce41a2da9a7d181cac1c5ac275c7a2afad5f9a7fd520900000051f4398d40a5ff9e716b7748111ac20560dc77cb6b0e2d663eefcde3b71e1e5039339387ecc7f1bfc162423454671a144e7ec966b1e81f8ac82168340c035a208bea99b4178b44cde18bfea42b1b7a70d7fffbe01428c701a3f8c13b4cf0db4e0a7278c57ca913c19aba630bbb47d9c0f4e32d7121a4205aeb6ed6880a6301e97295", 0xcc) clock_gettime(0x4, &(0x7f0000003ec0)) recvfrom$inet(r4, 0x0, 0x0, 0x40, 0x0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x100}) (async) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x100}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r3) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'tunl0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000006c0)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25d7dbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x44, 0x2, [@TCA_TBF_RATE64={0xc, 0x4, 0xc6610dc17971eedc}, @TCA_TBF_PARMS={0x28, 0x1, {{0x2, 0x1, 0x38, 0xd, 0x9, 0x101}, {0x6, 0x1, 0x3, 0xfff8, 0xc8f, 0x7}, 0x10004, 0x101, 0xf36}}, @TCA_TBF_PRATE64={0xc, 0x5, 0xd07a4489ab999635}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x50}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) socket$nl_route(0x10, 0x3, 0x0) (async) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) fcntl$setlease(r1, 0x400, 0x1) r11 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r11, &(0x7f0000000140), 0x2) sendmsg$nl_route_sched(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x38, 0x24, 0x4, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r10, {0xf, 0x8}, {0xe, 0xb}, {0x7, 0xffe2}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0xff8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008840}, 0x2004c090) (async) sendmsg$nl_route_sched(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x38, 0x24, 0x4, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r10, {0xf, 0x8}, {0xe, 0xb}, {0x7, 0xffe2}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0xff8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008840}, 0x2004c090) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_generic(0x10, 0x3, 0x10) (async) r12 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r12) (async) r13 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r12) sendmsg$TIPC_CMD_ENABLE_BEARER(r12, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) setsockopt$inet_tcp_buf(r1, 0x6, 0xb, &(0x7f0000000080)="43e8f4d589f13934a5a5a18be65ff14fe6d228606c014479547796f289a54d979c5ecfcbf01ed595ea41b14ad6125e8c896cf771f142fb137a6fc14aef997b35e2792d5f917c4c7e058ba684d8f3c99a360c5a07e16cd459463f43074533f749777232f8e959dc0e4dada3d1fc4f6f8c679a1e7351b0fdd0f61b2c823d8db55ba944e85df500ba9b1013e6c0d169b83c507283b68834f976e02d62ddcb3a219992eea7968d5fb01a0f1cdd45cc8d2de5994f956a7fc8b1968bd0c39f24ca496852207df6d981a4bdc97d7bee2f403f8581c961d0fa52184b9b4fda8eb83f", 0xde) 848.481267ms ago: executing program 5 (id=1573): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)={{0x14}, [@NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2b}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x98}, 0x1, 0x0, 0x0, 0x700}, 0x20050800) 745.327544ms ago: executing program 5 (id=1574): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="5001000010000100feffffff000100006401010000000000000000005f00000020010000000000000000000000000001000107164e230007000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe80000000000000000000000000001d000004d86c000000ac1e0001000000000000000000000000000000000000000092010000000000000100000000000000ffff00000000040000000800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffffffffffffffffffff0008000000000100000000000000008003000000080000000000000029bd700004350000020001002000000000000000480003006c7a730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050021000200000010000a"], 0x150}, 0x1, 0x0, 0x0, 0x8801}, 0x80) 745.147416ms ago: executing program 0 (id=1575): mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001000)='./dev\x00', &(0x7f0000001040)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./dev/mapper/control\x00', 0x2, 0x0) write(0xffffffffffffffff, &(0x7f0000003138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00integrity', 0x21) ioctl(r0, 0xc138fd09, &(0x7f0000003000)="0400000000000000000000006c010000380100000100000000000000000000080000000000000000000000000000000074657374") 539.390718ms ago: executing program 0 (id=1576): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0xda6d, 0x80, 0x2, 0x27e}, &(0x7f0000000000)=0x0, &(0x7f0000000f00)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000980)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x13, r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x2}}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000440)={0x2e, 0x3, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000180)=@any_dev={0x81, 0xd1e, 0x0, 0x0, 0x1000, 0x8, 0x0, 0x0, 0xc1, 0x0, 0x0, 0x2000000}}}, 0x0) 447.782709ms ago: executing program 1 (id=1577): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newsa={0xf0, 0x10, 0x713, 0x70bd2a, 0x25dfdbfc, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in=@dev={0xac, 0x14, 0x14, 0x26}, 0x4, 0x79b0, 0x4e21, 0x2, 0x500, 0x0, 0xa0, 0x21}, {@in=@dev, 0x4d6, 0x32}, @in=@multicast2, {0x200, 0xe839, 0x0, 0x9, 0xffffffff00000001, 0x3, 0x80000001, 0x543}, {0x80000000004, 0x7fffffffffffffff, 0x0, 0x1}, {}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x70}}, 0xf0}, 0x1, 0x0, 0x0, 0x8000881}, 0x2014) r1 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000180)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) write$selinux_attr(r1, &(0x7f0000000040)='system_u:object_r:ppp_device_t:s0\x00', 0x22) r2 = syz_open_dev$radio(&(0x7f0000000080), 0x2, 0x2) ioctl$VIDIOC_G_TUNER(r2, 0xc054561d, &(0x7f00000001c0)={0x2, "009ea82a7c0cf54a839c496cc582870b274f29c2e23a32ee79281ce0a8574d51", 0x1, 0x400, 0x5, 0x433, 0x4, 0x2, 0x2, 0x7}) r3 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x3) syz_clone(0x10000, &(0x7f0000000240)="b764412be16a054abb458a3e9aafbfb8d20ddb824694f5341c0a6907da41f100242b2c07f7d3f346fb52a0b2b9f69060325d35ee4d615da85dfcfbc49f6ec1d4307fa80c85d90c35246c186e10d3cd0f4ef804a7c4bdf50a951e7be25dea523e6ac4a7f35b864a9363529a26cb053af21c221e8842d11443a05abc02bdab873629349483bdb051e78c907441c17ee7e5b6887f7e8014b6786248711d15fae75c7e1ea66ec7810a0fb2ec6ffda476e2e8b32e318e8ee1989c23ad608c51fe263a28d21bb8ab1a67ed3d5e71ea0cd4203671e3c014", 0xd4, &(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)="191b498da56909f40b321c17b499fd3fb10caeb5d5985ffb4788b7b88f3302c2cb97c025453284f06f779b960103bbfaf1e0f61430ee3b84ee37a08aee436b03ea16d72a172cf1c407431df0b098f457a0b56e02a9a9dcd1e20918e125c77b3860d091460e277ed0da3cdfa33888291dc84a9f6c4ca1902c03a568817bb27ba89282ee4efc66088429400c1d68643fc49c07265d934cc363cbd170b89c45d8ea4657b07c03ec3feaf23ca8cace31f9709772ab6273039d46427555") syz_clone(0x88200, 0x0, 0x0, 0x0, 0x0, 0x0) execveat(r3, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 374.650608ms ago: executing program 5 (id=1578): socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000780)=ANY=[], 0x0) 372.854607ms ago: executing program 0 (id=1579): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000006000000040000000000000e0400000000000000340000000000000d000000000000000000000010040000000000000000000009030000000000000061"], 0x0, 0x52}, 0x28) 250.16133ms ago: executing program 5 (id=1580): setns(0xc9, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="54000000100005060000000000009700000000000000000000000000000000000b000300636f6e666967000008000500020000002000120009000100766c616e0000000010000200080001"], 0x54}}, 0x0) 250.08818ms ago: executing program 0 (id=1581): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000002f00090027ad70000000000004"], 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0xffffff97) 97.137535ms ago: executing program 1 (id=1582): r0 = socket(0x40000000015, 0x5, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) ftruncate(r1, 0x1000000) r2 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_CLR_FD(r2, 0x4c01) ioctl$LOOP_SET_FD(r2, 0x4c00, r1) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001000)='./dev\x00', &(0x7f0000001040)='devtmpfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r3, 0xc138fd03, &(0x7f0000003000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000007465737400") r4 = openat(0xffffffffffffff9c, &(0x7f0000002100)='./dummy\x00', 0x42, 0x1ff) write(r4, &(0x7f0000003138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00integrity\x00\x00\x00\x00\x00\x00\x007:0 0 4 J 0', 0x33) close(r4) ioctl(r3, 0xc138fd09, &(0x7f0000003000)="0400000000000000000000086c01000038010000010000000000000000000000000000000000000000000000000000007465737400") ioctl(r3, 0xc138fd06, &(0x7f0000003000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000007465737400") nanosleep(&(0x7f0000004000)={0x0, 0x5f5e100}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000004100)='./dev/dm-0\x00', 0x2, 0x0) pwrite64(r5, &(0x7f0000005000)="11111111111111111111111111111111", 0x10, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000000)=0x15de, 0x4) 96.794203ms ago: executing program 0 (id=1583): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x8a000, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) (async) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000000)) (async) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000300)=0x1a) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94) (async) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) (async) listen(r1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) connect$unix(r2, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) (async) bind$unix(0xffffffffffffffff, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4004045) (async, rerun: 32) r3 = io_uring_setup(0x1b7f, &(0x7f0000000040)={0x0, 0x970, 0xacc0663a1c16a88e, 0x4002, 0x398}) (rerun: 32) syz_emit_ethernet(0x22, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa"], 0x0) (async) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) io_uring_enter(r3, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) (async) r4 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x6) ioctl$TCXONC(r4, 0x540a, 0x2) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000180)={0x200000, 0x200000, 0x0, 0x0, 0xd33, 0x7}) (async) chroot(&(0x7f00000001c0)='./file0\x00') ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r5, 0xc00864bf, &(0x7f0000000040)={0x0, 0x1}) (async) r7 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc4910700004f78d4c1a0731cccff"], 0x1c}}, 0x0) (async) recvmmsg$unix(r7, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000001380)=""/4096, 0xec0}], 0x1, 0x0, 0x300, 0x1000000}}], 0x14, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_RESET(r5, 0xc01064c4, &(0x7f0000000100)={&(0x7f00000000c0)=[r6], 0x1}) (async, rerun: 64) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000180), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='mpol=bynd=s']) (rerun: 64) syz_emit_ethernet(0x3e, &(0x7f0000000140)=ANY=[@ANYBLOB="0180c200000eaaaaaaaaaabb86dd6000000000083a0020010000000000000000000000000000ff02000019000000ffffffff00faff00800090785f080000185ad902b707ee0774514405285e465b63f4f4483c3831172a7b47c2a9697043e19c5b20c2c9d62d9c0092d21751ff07145d6e51032956d29b383b6c7c728b69309630628ae4404d022738dff3614b41949f8d86d0e1330abc15a5589afe428e8244268a3a96a6c6ea4cd3967650c4429ffa1c75c6cacf55bb099430230ccd8068227a575a68db23db0417107b8f384cd500ccfaa521615e06a93d04dda032294be8f8fbc32bb3a8d5171dddc5cacee5ebb370077725ecfeb0190e9c4cd27cd0e8370c9e1cb0532bf46e342d6395e8f48fbc2e54d3444f478f5dd5f5ecf832941c4ae75434081b8da143d87d6104104646ac86c2a7"], 0x0) 0s ago: executing program 5 (id=1584): socket$nl_netfilter(0x10, 0x3, 0xc) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000005580)=ANY=[@ANYBLOB="14eec6935d00010000000000000000000300000a20000000000a01020000000000000000020000090900010073797a300000160a030000000000000000000200000a4000038008000140000000002c0003801400010069703667726574617030000000000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a3000000000140000001100010000000000000000000300000a"], 0xb4}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000040), 0x0, 0x0, 0x1) (async) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000040), 0x0, 0x0, 0x1) removexattr(&(0x7f0000000200)='./cgroup\x00', &(0x7f0000000240)=@known='user.incfs.metadata\x00') r1 = syz_usb_connect$hid(0x1, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x56a, 0x314, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0xc, 0x40, 0x4, "", [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x1, 0x0, 0xc1, {0x9, 0x21, 0x5, 0x6, 0x1, {0x22, 0x9fc}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x8, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x10, 0x0, 0x8, 0x7}}]}}}]}}]}}, &(0x7f0000000300)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x200, 0xff, 0x0, 0x0, 0x20, 0x7}, 0xf, &(0x7f0000000080)={0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0x5, 0x46, 0x5}]}, 0x4, [{0x9c, &(0x7f00000000c0)=@string={0x9c, 0x3, "55be09a15cd6f3f27f7ed9fc73f737fc142d3bc020967493387e48cbb9e15e2074c3a7f3de30867a031434b8578e2a1d28893fe13b0c5ca35daa02c8448c4871829340904c4553b473003c4474d3d19ddeab0168ad67896edad8388a615581d6fed17fdec32c2b67548d910922bbbab0824ba7a13c62454d2267366e4e0ba8690aeef8be549e91e204c04701c462d2efcc1115684e765f1338b7"}}, {0xd8, &(0x7f0000000180)=@string={0xd8, 0x3, "2d7e865b3331658fc0b722b5fbcbfc395d3753779463862116cbec0364d75087ba43e91bb2a2ec0476036494a2559b6da5336d73a56174a555362af57c178e5ac9c9fd44e82ad7dbbac36d49c62e7107499b82293d35d5cd479be7ec694220f536158c4854609b2705a958100e2b0d34a269dc0ed877f27034445fd13cadc7eb676d0a033511dc6f6a37cda9eb41112516c432dfc7e8b1b20dbb5fb31d63ce38478c6c3c1377a2e1e76614726739fb0512f0568269db1a63a4a09cc8a130112b2e09cc7a0c0d7e1691a47b36867762df0dbd4f9fb9f4"}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x409}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x40d}}]}) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000b80)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x38, 0x1, 0x2, 0x101, 0x0, 0x0, {0x1, 0x0, 0x9}, [@CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_FN={0xa, 0xb, 'Q.931\x00'}, @CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x10) syz_usb_control_io(r1, &(0x7f00000005c0)={0x2c, &(0x7f0000000380)={0x20, 0x8, 0xfd, {0xfd, 0x38, "1e2b23475a1907a00012c95f0453eb8e6cdf1958781a0fb8dd20c54b41a81786cb258ddd226fd196bc9565b1ea9bdd690672e6b718d98a02e1deb3222e7905f9c9a87b66486e389a3175cccc11ed49a83c6799e15292ae164c77bb60497a93584c4b5cd4a4ac8500a963b6607189f8b17e2871e5e0ee932a913ef86e67be38e5f7731ef301b5c2148be72a2702efc65ca7bd01021e751ba6f7287a06eb9fc5c928a0ac9abfbb90aef31fa2943e61ecfa109bde53c6fd1e3ae0e665f6ba429e67ae6024c5b10d56231f76c4152849274337073a2da4f2a9c923c3024058c1008280f79397254b9621d4911915816799989a32ccfc18377503013021"}}, &(0x7f00000004c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3801}}, &(0x7f0000000500)={0x0, 0xf, 0x1c, {0x5, 0xf, 0x1c, 0x2, [@ptm_cap={0x3}, @ssp_cap={0x14, 0x10, 0xa, 0x7, 0x2, 0xd, 0xee00, 0x3, [0xf, 0x0]}]}}, &(0x7f0000000540)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x3, 0x0, 0x30, "df778400", "df10cadd"}}, &(0x7f0000000580)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x4b, 0x0, 0x6, 0x5, 0x5, 0x0, 0xf8cc}}}, &(0x7f0000000a00)={0x84, &(0x7f0000000600)={0x40, 0x12, 0x22, "f7bf339394dc0df1a5589cd4929956eced0a07ffb881ccb8c3a190e7d9ded83889f0"}, &(0x7f0000000640)={0x0, 0xa, 0x1, 0xb}, &(0x7f0000000680)={0x0, 0x8, 0x1, 0x4}, &(0x7f00000006c0)={0x20, 0x0, 0x4, {0x0, 0x2}}, &(0x7f0000000700)={0x20, 0x0, 0x4, {0x160, 0x80}}, &(0x7f0000000740)={0x40, 0x7, 0x2}, &(0x7f0000000780)={0x40, 0x9, 0x1, 0x1}, &(0x7f00000007c0)={0x40, 0xb, 0x2, "51b5"}, &(0x7f0000000800)={0x40, 0xf, 0x2, 0x2}, &(0x7f0000000840)={0x40, 0x13, 0x6, @random="19179d0e2977"}, &(0x7f0000000880)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, &(0x7f00000008c0)={0x40, 0x19, 0x2, "df44"}, &(0x7f0000000900)={0x40, 0x1a, 0x2}, &(0x7f0000000940)={0x40, 0x1c, 0x1, 0x5}, &(0x7f0000000980)={0x40, 0x1e, 0x1, 0x6}, &(0x7f00000009c0)={0x40, 0x21, 0x1, 0x5}}) kernel console output (not intermixed with test programs): netlink: 4 bytes leftover after parsing attributes in process `syz.3.770'. [ 137.721494][ T2549] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 137.731350][ T8401] ISOFS: Unable to identify CD-ROM format. [ 137.742667][ T2549] usb 6-1: device descriptor read/8, error -71 [ 137.971183][ T35] usb 8-1: new high-speed USB device number 41 using dummy_hcd [ 138.011248][ T2549] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 138.032563][ T2549] usb 6-1: device descriptor read/8, error -71 [ 138.106693][ T8406] device-mapper: table: 248:0: : unknown target type [ 138.106711][ T8406] device-mapper: ioctl: error adding target to table [ 138.121289][ T35] usb 8-1: Using ep0 maxpacket: 16 [ 138.122016][ T35] usb 8-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 138.122898][ T35] usb 8-1: config index 0 descriptor too short (expected 127, got 27) [ 138.122911][ T35] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 138.122921][ T35] usb 8-1: config 1 has no interfaces? [ 138.124582][ T35] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.124594][ T35] usb 8-1: Product: syz [ 138.124601][ T35] usb 8-1: Manufacturer: syz [ 138.124609][ T35] usb 8-1: SerialNumber: syz [ 138.144404][ T2549] usb usb6-port1: unable to enumerate USB device [ 138.291250][ T5877] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 138.400330][ T8419] device-mapper: table: 248:0: zero-length target [ 138.400346][ T8419] device-mapper: ioctl: error adding target to table [ 138.427604][ T8421] netlink: 8 bytes leftover after parsing attributes in process `syz.0.777'. [ 138.453950][ T8423] 9pnet_fd: Insufficient options for proto=fd [ 138.462148][ T5877] usb 10-1: Using ep0 maxpacket: 32 [ 138.462660][ T5877] usb 10-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 138.465595][ T5877] usb 10-1: config index 0 descriptor too short (expected 156, got 27) [ 138.465619][ T5877] usb 10-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 138.465639][ T5877] usb 10-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 138.465657][ T5877] usb 10-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 138.465671][ T5877] usb 10-1: config 0 interface 0 has no altsetting 0 [ 138.467217][ T5877] usb 10-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 138.467229][ T5877] usb 10-1: Product: syz [ 138.467237][ T5877] usb 10-1: Manufacturer: syz [ 138.467246][ T5877] usb 10-1: SerialNumber: syz [ 138.468691][ T5877] usb 10-1: config 0 descriptor?? [ 138.487273][ T8425] netlink: 272 bytes leftover after parsing attributes in process `syz.0.779'. [ 138.547009][ T8401] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 138.547239][ T8401] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.564994][ T8429] netlink: 20 bytes leftover after parsing attributes in process `syz.0.781'. [ 138.565011][ T8429] tipc: Invalid UDP bearer configuration [ 138.565033][ T8429] tipc: Enabling of bearer rejected, failed to enable media [ 138.676627][ T5877] ldusb 10-1:0.0: Interrupt in endpoint not found [ 138.680489][ T5877] usb 10-1: USB disconnect, device number 6 [ 139.096746][ T8435] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 139.220626][ T8444] 9pnet_fd: Insufficient options for proto=fd [ 139.245691][ T8446] netlink: 8 bytes leftover after parsing attributes in process `syz.5.788'. [ 139.293724][ T8456] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 139.293743][ T8456] device-mapper: ioctl: error adding target to table [ 139.345956][ T8458] bond1: option downdelay: invalid value (18446744073709551615) [ 139.345973][ T8458] bond1: option downdelay: allowed values 0 - 2147483647 [ 139.346825][ T8458] bond1 (unregistering): Released all slaves [ 139.380314][ T8461] netlink: 12 bytes leftover after parsing attributes in process `syz.5.793'. [ 139.499878][ T8469] netlink: 8 bytes leftover after parsing attributes in process `syz.3.795'. [ 139.501622][ T8467] bond3 (unregistering): Released all slaves [ 139.641119][ T5877] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 139.801066][ T5877] usb 10-1: Using ep0 maxpacket: 32 [ 139.801805][ T5877] usb 10-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 139.802751][ T5877] usb 10-1: config index 0 descriptor too short (expected 156, got 27) [ 139.802777][ T5877] usb 10-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 139.802802][ T5877] usb 10-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 139.802831][ T5877] usb 10-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 139.802855][ T5877] usb 10-1: config 0 interface 0 has no altsetting 0 [ 139.805298][ T5877] usb 10-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 139.805320][ T5877] usb 10-1: Product: syz [ 139.805332][ T5877] usb 10-1: Manufacturer: syz [ 139.805343][ T5877] usb 10-1: SerialNumber: syz [ 139.809805][ T5877] usb 10-1: config 0 descriptor?? [ 139.996716][ T8475] 9pnet_fd: Insufficient options for proto=fd [ 140.019489][ T5877] ldusb 10-1:0.0: Interrupt in endpoint not found [ 140.024494][ T5877] usb 10-1: USB disconnect, device number 7 [ 140.104380][ T8479] RDS: rds_bind could not find a transport for fec0:ffff:ffff:ffff::1, load rds_tcp or rds_rdma? [ 140.137459][ T8482] netlink: 72 bytes leftover after parsing attributes in process `syz.0.801'. [ 140.183798][ T8484] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.100663296.0), cmd(9) [ 140.397156][ T8496] 9pnet_fd: Insufficient options for proto=fd [ 140.666910][ T43] kauditd_printk_skb: 16 callbacks suppressed [ 140.666922][ T43] audit: type=1400 audit(1790398906.432:872): avc: denied { remount } for pid=8515 comm="syz.3.816" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 140.706241][ T8522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 140.706460][ T8522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 141.236418][ T8527] 9pnet_fd: Insufficient options for proto=fd [ 141.567541][ T8538] netdevsim netdevsim5: Direct firmware load for . [ 141.567541][ T8538] failed with error -2 [ 141.569879][ T43] audit: type=1400 audit(1790398907.332:873): avc: denied { firmware_load } for pid=8537 comm="syz.5.824" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 141.569933][ T8538] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 141.569933][ T8538] [ 141.779275][ T8542] netlink: 'syz.0.826': attribute type 1 has an invalid length. [ 141.779299][ T8542] netlink: 4 bytes leftover after parsing attributes in process `syz.0.826'. [ 142.161127][ T5830] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 142.313419][ T8546] device-mapper: table: 248:0: : unknown target type [ 142.313439][ T8546] device-mapper: ioctl: error adding target to table [ 142.321223][ T5830] usb 5-1: Using ep0 maxpacket: 32 [ 142.327482][ T5830] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 142.335758][ T5830] usb 5-1: config index 0 descriptor too short (expected 156, got 27) [ 142.335781][ T5830] usb 5-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 142.335808][ T5830] usb 5-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 142.335833][ T5830] usb 5-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 142.335856][ T5830] usb 5-1: config 0 interface 0 has no altsetting 0 [ 142.341136][ T5830] usb 5-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 142.341158][ T5830] usb 5-1: Product: syz [ 142.341170][ T5830] usb 5-1: Manufacturer: syz [ 142.341183][ T5830] usb 5-1: SerialNumber: syz [ 142.374678][ T5830] usb 5-1: config 0 descriptor?? [ 142.387429][ T8549] 9pnet_fd: Insufficient options for proto=fd [ 142.483927][ T8553] netdevsim netdevsim5 ªªªªª»: renamed from netdevsim0 (while UP) [ 142.588697][ T5830] ldusb 5-1:0.0: Interrupt in endpoint not found [ 142.599445][ T5830] usb 5-1: USB disconnect, device number 42 [ 142.621820][ T8563] device-mapper: table: 248:0: zero-length target [ 142.621835][ T8563] device-mapper: ioctl: error adding target to table [ 142.660103][ T43] audit: type=1400 audit(1790398908.422:874): avc: denied { write } for pid=8564 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 142.668039][ T43] audit: type=1400 audit(1790398908.422:875): avc: denied { write } for pid=8566 comm="syz.3.835" name="usbmon9" dev="devtmpfs" ino=764 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 142.669948][ T5744] Bluetooth: hci2: Malformed Event: 0x13 [ 142.674506][ T43] audit: type=1400 audit(1790398908.442:876): avc: denied { mmap_zero } for pid=8566 comm="syz.3.835" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 142.675356][ T43] audit: type=1400 audit(1790398908.442:877): avc: denied { ioctl } for pid=8566 comm="syz.3.835" path="/dev/usbmon9" dev="devtmpfs" ino=764 ioctlcmd=0x920a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 142.727523][ T43] audit: type=1400 audit(1790398908.492:878): avc: denied { connect } for pid=8566 comm="syz.3.835" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 142.733599][ T43] audit: type=1400 audit(1790398908.502:879): avc: denied { write } for pid=8570 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 142.827838][ T43] audit: type=1400 audit(1790398908.592:880): avc: denied { write } for pid=8574 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 142.865978][ T43] audit: type=1400 audit(1790398908.632:881): avc: denied { write } for pid=8577 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 143.152517][ T8583] netlink: 20 bytes leftover after parsing attributes in process `syz.0.837'. [ 143.152531][ T8583] tipc: Invalid UDP bearer configuration [ 143.152548][ T8583] tipc: Enabling of bearer rejected, failed to enable media [ 143.175981][ T8585] 9p: Unknown access argument Ì¢-~ [ 143.175981][ T8585] N¹»˜Í@'óploØn ÄQ¥¯’%çe0'µÿÂ¥ënËJ“ÉÇ&«ŸŠ]Éëbdø]äŒCYhÔ–áE€ÁÂ?: -22 [ 143.208113][ T8587] netlink: 8 bytes leftover after parsing attributes in process `syz.0.839'. [ 143.208128][ T8587] netlink: 4 bytes leftover after parsing attributes in process `syz.0.839'. [ 143.336813][ T8602] netlink: 8 bytes leftover after parsing attributes in process `syz.0.845'. [ 143.342683][ T8603] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 143.342887][ T8603] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 143.555961][ T8612] 9p: Unknown access argument Ì¢-~ [ 143.555961][ T8612] N¹»˜Í@'óploØn ÄQ¥¯’%çe0'µÿÂ¥ënËJ“ÉÇ: -22 [ 143.594258][ T8614] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 143.594274][ T8614] device-mapper: ioctl: error adding target to table [ 143.626532][ T8616] netlink: 12 bytes leftover after parsing attributes in process `syz.0.850'. [ 143.686535][ T8624] device-mapper: ioctl: Target spec extends beyond end of parameters [ 143.686545][ T8624] device-mapper: ioctl: unable to find target [ 143.737889][ T8628] netlink: 8 bytes leftover after parsing attributes in process `syz.0.854'. [ 143.737932][ T8629] netlink: 8 bytes leftover after parsing attributes in process `syz.0.854'. [ 143.840436][ T8635] netlink: 72 bytes leftover after parsing attributes in process `syz.0.856'. [ 143.878525][ T8638] 9p: Unknown access argument Ì¢-~ [ 143.878525][ T8638] N¹»˜Í@'óploØn: -22 [ 143.919304][ T8639] random: crng reseeded on system resumption [ 143.973819][ T8652] netlink: 16 bytes leftover after parsing attributes in process `syz.3.863'. [ 143.985991][ T8649] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.134217728.0), cmd(9) [ 144.133384][ T8666] 9p: Unknown access argument Ì¢-~ [ 144.133384][ T8666] N: -22 [ 144.382012][ T5877] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 144.531132][ T5877] usb 6-1: Using ep0 maxpacket: 32 [ 144.531781][ T5877] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 144.532546][ T5877] usb 6-1: config index 0 descriptor too short (expected 156, got 27) [ 144.532561][ T5877] usb 6-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 144.532576][ T5877] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 144.532597][ T5877] usb 6-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 144.532611][ T5877] usb 6-1: config 0 interface 0 has no altsetting 0 [ 144.534192][ T5877] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 144.534206][ T5877] usb 6-1: Product: syz [ 144.534214][ T5877] usb 6-1: Manufacturer: syz [ 144.534223][ T5877] usb 6-1: SerialNumber: syz [ 144.536880][ T5877] usb 6-1: config 0 descriptor?? [ 144.743034][ T5877] ldusb 6-1:0.0: Interrupt in endpoint not found [ 144.752070][ T5877] usb 6-1: USB disconnect, device number 36 [ 144.861040][ T8681] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1015 sclass=netlink_route_socket pid=8681 comm=syz.5.874 [ 145.137355][ T8691] 9p: Bad value for 'access' [ 145.285172][ T8702] vivid-002: ================= START STATUS ================= [ 145.285209][ T8702] vivid-002: Radio HW Seek Mode: Bounded [ 145.285223][ T8702] vivid-002: Radio Programmable HW Seek: false [ 145.285234][ T8702] vivid-002: RDS Rx I/O Mode: Block I/O [ 145.285244][ T8702] vivid-002: Generate RBDS Instead of RDS: false [ 145.285256][ T8702] vivid-002: RDS Reception: true [ 145.286209][ T8702] vivid-002: RDS Program Type: 0 inactive [ 145.286226][ T8702] vivid-002: RDS PS Name: inactive [ 145.286240][ T8702] vivid-002: RDS Radio Text: inactive [ 145.286253][ T8702] vivid-002: RDS Traffic Announcement: false inactive [ 145.286267][ T8702] vivid-002: RDS Traffic Program: false inactive [ 145.286280][ T8702] vivid-002: RDS Music: false inactive [ 145.286293][ T8702] vivid-002: ================== END STATUS ================== [ 145.323833][ T8708] xt_hashlimit: size too large, truncated to 1048576 [ 145.328579][ T8707] netlink: 'syz.5.882': attribute type 1 has an invalid length. [ 145.449128][ T8713] device-mapper: table: 248:0: : unknown target type [ 145.449140][ T8713] device-mapper: ioctl: error adding target to table [ 145.485437][ T8716] 9p: Bad value for 'access' [ 145.643849][ T8726] device-mapper: table: 248:0: zero-length target [ 145.643860][ T8726] device-mapper: ioctl: error adding target to table [ 145.683511][ T8730] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Add Mapping response ret = -22) [ 145.845459][ T43] kauditd_printk_skb: 7 callbacks suppressed [ 145.845472][ T43] audit: type=1400 audit(1790398911.612:889): avc: denied { write } for pid=8733 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 145.910255][ T43] audit: type=1400 audit(1790398911.672:890): avc: denied { write } for pid=8736 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 145.921059][ T5830] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 145.998712][ T8742] tipc: Invalid UDP bearer configuration [ 145.998736][ T8742] tipc: Enabling of bearer rejected, failed to enable media [ 146.030511][ T43] audit: type=1400 audit(1790398911.792:891): avc: denied { ioctl } for pid=8743 comm="syz.1.897" path="socket:[27458]" dev="sockfs" ino=27458 ioctlcmd=0xf512 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 146.060913][ T8746] 9p: Bad value for 'access' [ 146.073864][ T5830] usb 10-1: Using ep0 maxpacket: 32 [ 146.077381][ T5830] usb 10-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 146.079160][ T5830] usb 10-1: config index 0 descriptor too short (expected 156, got 27) [ 146.079182][ T5830] usb 10-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 146.079207][ T5830] usb 10-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 146.079237][ T5830] usb 10-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 146.079259][ T5830] usb 10-1: config 0 interface 0 has no altsetting 0 [ 146.083011][ T5830] usb 10-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 146.083026][ T5830] usb 10-1: Product: syz [ 146.083034][ T5830] usb 10-1: Manufacturer: syz [ 146.083041][ T5830] usb 10-1: SerialNumber: syz [ 146.084394][ T5830] usb 10-1: config 0 descriptor?? [ 146.254260][ T43] audit: type=1400 audit(1790398912.022:892): avc: denied { getattr } for pid=8755 comm="syz.0.902" path="pid:[4026532866]" dev="nsfs" ino=4026532866 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 146.254985][ T8756] bpf: Bad value for 'uid' [ 146.290862][ T5830] ldusb 10-1:0.0: Interrupt in endpoint not found [ 146.298536][ T5830] usb 10-1: USB disconnect, device number 8 [ 146.859784][ T8772] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 146.859805][ T8772] device-mapper: ioctl: error adding target to table [ 146.903874][ T8774] 9p: Unknown access argument Ì¢-: -22 [ 146.943420][ T8777] __nla_validate_parse: 10 callbacks suppressed [ 146.943439][ T8777] netlink: 12 bytes leftover after parsing attributes in process `syz.5.908'. [ 146.984892][ T8779] device-mapper: ioctl: Target spec extends beyond end of parameters [ 146.984907][ T8779] device-mapper: ioctl: unable to find target [ 147.053654][ T43] audit: type=1400 audit(1790398912.822:893): avc: denied { ioctl } for pid=8780 comm="syz.5.910" path="/dev/ndctl0" dev="devtmpfs" ino=109 ioctlcmd=0x640a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 147.217554][ T8786] netlink: 4 bytes leftover after parsing attributes in process `syz.0.912'. [ 147.481085][ T5830] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 147.508454][ T8792] netlink: 72 bytes leftover after parsing attributes in process `syz.1.915'. [ 147.557792][ T8794] overlay: ./file0 is not a directory [ 147.610720][ T8796] 9p: Unknown access argument Ì¢: -22 [ 147.661153][ T5830] usb 5-1: Using ep0 maxpacket: 32 [ 147.661768][ T5830] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 147.664030][ T5830] usb 5-1: config index 0 descriptor too short (expected 156, got 27) [ 147.664052][ T5830] usb 5-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 147.664078][ T5830] usb 5-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 147.664108][ T5830] usb 5-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 147.664132][ T5830] usb 5-1: config 0 interface 0 has no altsetting 0 [ 147.665999][ T5830] usb 5-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 147.666019][ T5830] usb 5-1: Product: syz [ 147.666033][ T5830] usb 5-1: Manufacturer: syz [ 147.666044][ T5830] usb 5-1: SerialNumber: syz [ 147.669658][ T5830] usb 5-1: config 0 descriptor?? [ 147.887626][ T5830] ldusb 5-1:0.0: Interrupt in endpoint not found [ 147.893021][ T5830] usb 5-1: USB disconnect, device number 43 [ 147.961684][ T8813] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.150994944.0), cmd(9) [ 148.274387][ T8823] 9p: Unknown access argument Ì¢: -22 [ 148.418174][ T8833] FAULT_INJECTION: forcing a failure. [ 148.418174][ T8833] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 148.418196][ T8833] CPU: 0 UID: 0 PID: 8833 Comm: syz.1.931 Not tainted syzkaller #0 PREEMPT(full) [ 148.418209][ T8833] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 148.418216][ T8833] Call Trace: [ 148.418220][ T8833] [ 148.418225][ T8833] dump_stack_lvl+0x100/0x190 [ 148.418259][ T8833] should_fail_ex.cold+0x5/0xa [ 148.418275][ T8833] strncpy_from_user+0x3b/0x2d0 [ 148.418293][ T8833] ? get_pid_task+0x106/0x250 [ 148.418309][ T8833] path_setxattrat+0x127/0x3b0 [ 148.418327][ T8833] ? __pfx_path_setxattrat+0x10/0x10 [ 148.418345][ T8833] ? ksys_write+0x190/0x250 [ 148.418357][ T8833] ? ksys_write+0x190/0x250 [ 148.418378][ T8833] ? fput+0x7c/0x100 [ 148.418392][ T8833] ? ksys_write+0x1ac/0x250 [ 148.418403][ T8833] ? __pfx_ksys_write+0x10/0x10 [ 148.418417][ T8833] __x64_sys_setxattr+0xc6/0x140 [ 148.418433][ T8833] ? do_syscall_64+0xae/0x790 [ 148.418447][ T8833] ? lockdep_hardirqs_on+0x7d/0x110 [ 148.418464][ T8833] do_syscall_64+0x123/0x790 [ 148.418476][ T8833] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.418507][ T8833] RIP: 0033:0x7fbaddb9e159 [ 148.418516][ T8833] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 148.418527][ T8833] RSP: 002b:00007fbadea55028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc [ 148.418539][ T8833] RAX: ffffffffffffffda RBX: 00007fbadde25fa0 RCX: 00007fbaddb9e159 [ 148.418566][ T8833] RDX: 0000200000000240 RSI: 0000200000000200 RDI: 0000200000000000 [ 148.418573][ T8833] RBP: 00007fbadea55090 R08: 0000000000000001 R09: 0000000000000000 [ 148.418579][ T8833] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 148.418586][ T8833] R13: 00007fbadde26038 R14: 00007fbadde25fa0 R15: 00007ffc7db87c38 [ 148.418600][ T8833] [ 148.630893][ T8843] netlink: 8 bytes leftover after parsing attributes in process `syz.0.934'. [ 148.672344][ T8847] 9pnet_fd: Insufficient options for proto=fd [ 148.733366][ T43] audit: type=1400 audit(1790398914.502:894): avc: denied { write } for pid=8848 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 148.785680][ T43] audit: type=1400 audit(1790398914.552:895): avc: denied { write } for pid=8856 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 148.866002][ T8865] faux_driver vgem: [drm] Unknown color mode 11176; guessing buffer size. [ 148.869182][ T43] audit: type=1400 audit(1790398914.632:896): avc: denied { write } for pid=8861 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 148.878662][ T43] audit: type=1400 audit(1790398914.642:897): avc: denied { bind } for pid=8864 comm="syz.3.942" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 148.879692][ T8865] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=51 sclass=netlink_xfrm_socket pid=8865 comm=syz.3.942 [ 148.945441][ T43] audit: type=1400 audit(1790398914.712:898): avc: denied { write } for pid=8868 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 149.062277][ T50] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 149.177117][ T8882] bridge0: port 3(team0) entered blocking state [ 149.177229][ T8882] bridge0: port 3(team0) entered disabled state [ 149.178170][ T8882] team0: entered allmulticast mode [ 149.178186][ T8882] team_slave_0: entered allmulticast mode [ 149.178203][ T8882] team_slave_1: entered allmulticast mode [ 149.184556][ T8882] team0: entered promiscuous mode [ 149.184581][ T8882] team_slave_0: entered promiscuous mode [ 149.184722][ T8882] team_slave_1: entered promiscuous mode [ 149.186438][ T8882] bridge0: port 3(team0) entered blocking state [ 149.186532][ T8882] bridge0: port 3(team0) entered forwarding state [ 149.223455][ T50] usb 6-1: Using ep0 maxpacket: 32 [ 149.224024][ T50] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 149.224987][ T50] usb 6-1: config index 0 descriptor too short (expected 156, got 27) [ 149.225010][ T50] usb 6-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 149.225035][ T50] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 149.225061][ T50] usb 6-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 149.225076][ T50] usb 6-1: config 0 interface 0 has no altsetting 0 [ 149.227537][ T50] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 149.227562][ T50] usb 6-1: Product: syz [ 149.227575][ T50] usb 6-1: Manufacturer: syz [ 149.227589][ T50] usb 6-1: SerialNumber: syz [ 149.232924][ T50] usb 6-1: config 0 descriptor?? [ 149.238301][ T8885] 9pnet_fd: Insufficient options for proto=fd [ 149.277721][ T8889] netlink: 'syz.3.948': attribute type 1 has an invalid length. [ 149.277735][ T8889] netlink: 4 bytes leftover after parsing attributes in process `syz.3.948'. [ 149.390229][ T8896] device-mapper: table: 248:0: : unknown target type [ 149.390248][ T8896] device-mapper: ioctl: error adding target to table [ 149.443651][ T50] ldusb 6-1:0.0: Interrupt in endpoint not found [ 149.451510][ T50] usb 6-1: USB disconnect, device number 37 [ 149.528973][ T8914] device-mapper: table: 248:0: zero-length target [ 149.528989][ T8914] device-mapper: ioctl: error adding target to table [ 149.682388][ T8926] netlink: 20 bytes leftover after parsing attributes in process `syz.0.959'. [ 149.682402][ T8926] tipc: Invalid UDP bearer configuration [ 149.682418][ T8926] tipc: Enabling of bearer rejected, failed to enable media [ 149.706590][ T8930] ip_tables: iptables: counters copy to user failed while replacing table [ 149.986007][ T8935] netlink: 8 bytes leftover after parsing attributes in process `syz.1.962'. [ 149.986021][ T8935] netlink: 4 bytes leftover after parsing attributes in process `syz.1.962'. [ 150.573016][ T8947] netlink: 8 bytes leftover after parsing attributes in process `syz.0.965'. [ 150.630437][ T8954] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 150.630458][ T8954] device-mapper: ioctl: error adding target to table [ 150.714322][ T8956] netlink: 12 bytes leftover after parsing attributes in process `syz.0.969'. [ 150.854014][ T8966] device-mapper: ioctl: Invalid ioctl structure: name test, dev 32 [ 150.901124][ T43] kauditd_printk_skb: 9 callbacks suppressed [ 150.901143][ T43] audit: type=1400 audit(1790398916.662:908): avc: denied { unmount } for pid=5727 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 150.953146][ T43] audit: type=1400 audit(1790398916.722:909): avc: denied { getopt } for pid=8973 comm="syz.5.976" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 150.956119][ T56] IPVS: starting estimator thread 0... [ 150.956475][ T8974] IPVS: nq: FWM 3 0x00000003 - no destination available [ 150.958203][ T43] audit: type=1400 audit(1790398916.722:910): avc: denied { create } for pid=8973 comm="syz.5.976" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 150.959927][ T43] audit: type=1400 audit(1790398916.722:911): avc: denied { connect } for pid=8973 comm="syz.5.976" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 150.963226][ T43] audit: type=1400 audit(1790398916.732:912): avc: denied { read } for pid=8973 comm="syz.5.976" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 150.971570][ T8979] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 150.971788][ T8979] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.011145][ T50] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 151.027431][ T8985] 8021q: adding VLAN 0 to HW filter on device bond3 [ 151.042325][ T8978] IPVS: using max 44 ests per chain, 105600 per kthread [ 151.046552][ T8985] netlink: 'syz.1.981': attribute type 4 has an invalid length. [ 151.047858][ T8985] .`: renamed from bond0 [ 151.073356][ T8988] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.218103808.0), cmd(9) [ 151.181247][ T50] usb 5-1: Using ep0 maxpacket: 32 [ 151.181969][ T50] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 151.183023][ T50] usb 5-1: config index 0 descriptor too short (expected 156, got 27) [ 151.183043][ T50] usb 5-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 151.183066][ T50] usb 5-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 151.183111][ T50] usb 5-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 151.183133][ T50] usb 5-1: config 0 interface 0 has no altsetting 0 [ 151.187961][ T50] usb 5-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 151.187983][ T50] usb 5-1: Product: syz [ 151.187995][ T50] usb 5-1: Manufacturer: syz [ 151.188008][ T50] usb 5-1: SerialNumber: syz [ 151.218081][ T50] usb 5-1: config 0 descriptor?? [ 151.429628][ T50] ldusb 5-1:0.0: Interrupt in endpoint not found [ 151.434203][ T50] usb 5-1: USB disconnect, device number 44 [ 151.471192][ T1356] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 151.641104][ T1356] usb 6-1: Using ep0 maxpacket: 32 [ 151.641875][ T1356] usb 6-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 151.642837][ T1356] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.645273][ T1356] usb 6-1: config 0 descriptor?? [ 151.649890][ T1356] as10x_usb: device has been detected [ 151.650301][ T1356] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 151.659302][ T1356] usb 6-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 151.676278][ T43] audit: type=1400 audit(1790398917.442:913): avc: denied { firmware_load } for pid=1356 comm="kworker/3:2" path="/lib/firmware/as102_data1_st.hex" dev="sda1" ino=297 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 151.676719][ T1356] as10x_usb: error during firmware upload part1 [ 151.677156][ T1356] Registered device nBox DVB-T Dongle [ 151.798453][ T9008] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 151.856301][ T10] usb 6-1: USB disconnect, device number 38 [ 151.871223][ T10] Unregistered device nBox DVB-T Dongle [ 151.871957][ T10] as10x_usb: device has been disconnected [ 151.940306][ T9011] FAULT_INJECTION: forcing a failure. [ 151.940306][ T9011] name failslab, interval 1, probability 0, space 0, times 0 [ 151.940327][ T9011] CPU: 0 UID: 0 PID: 9011 Comm: syz.3.989 Not tainted syzkaller #0 PREEMPT(full) [ 151.940340][ T9011] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 151.940346][ T9011] Call Trace: [ 151.940350][ T9011] [ 151.940355][ T9011] dump_stack_lvl+0x100/0x190 [ 151.940385][ T9011] should_fail_ex.cold+0x5/0xa [ 151.940402][ T9011] should_failslab+0xc2/0x120 [ 151.940420][ T9011] __kvmalloc_node_noprof+0x113/0x9b0 [ 151.940435][ T9011] ? vmemdup_user+0x2a/0xe0 [ 151.940448][ T9011] vmemdup_user+0x2a/0xe0 [ 151.940458][ T9011] path_setxattrat+0x29e/0x3b0 [ 151.940475][ T9011] ? __pfx_path_setxattrat+0x10/0x10 [ 151.940493][ T9011] ? ksys_write+0x190/0x250 [ 151.940505][ T9011] ? ksys_write+0x190/0x250 [ 151.940525][ T9011] ? fput+0x7c/0x100 [ 151.940539][ T9011] ? ksys_write+0x1ac/0x250 [ 151.940550][ T9011] ? __pfx_ksys_write+0x10/0x10 [ 151.940564][ T9011] __x64_sys_setxattr+0xc6/0x140 [ 151.940579][ T9011] ? do_syscall_64+0xae/0x790 [ 151.940593][ T9011] ? lockdep_hardirqs_on+0x7d/0x110 [ 151.940610][ T9011] do_syscall_64+0x123/0x790 [ 151.940621][ T9011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.940633][ T9011] RIP: 0033:0x7f395ad9e159 [ 151.940643][ T9011] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 151.940654][ T9011] RSP: 002b:00007f395bce5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc [ 151.940665][ T9011] RAX: ffffffffffffffda RBX: 00007f395b025fa0 RCX: 00007f395ad9e159 [ 151.940672][ T9011] RDX: 0000200000000240 RSI: 0000200000000200 RDI: 0000200000000000 [ 151.940679][ T9011] RBP: 00007f395bce5090 R08: 0000000000000001 R09: 0000000000000000 [ 151.940686][ T9011] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 151.940692][ T9011] R13: 00007f395b026038 R14: 00007f395b025fa0 R15: 00007ffe286b57a8 [ 151.940705][ T9011] [ 152.054436][ T43] audit: type=1400 audit(1790398917.822:914): avc: denied { ioctl } for pid=9014 comm="syz.3.991" path="/dev/ppp" dev="devtmpfs" ino=729 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 152.076021][ T9015] __nla_validate_parse: 8 callbacks suppressed [ 152.076034][ T9015] netlink: 16 bytes leftover after parsing attributes in process `syz.3.991'. [ 152.076048][ T9015] netlink: 'syz.3.991': attribute type 2 has an invalid length. [ 152.078004][ T9015] netlink: 'syz.3.991': attribute type 2 has an invalid length. [ 152.084278][ T9015] netlink: 'syz.3.991': attribute type 3 has an invalid length. [ 152.084295][ T9015] netlink: 64 bytes leftover after parsing attributes in process `syz.3.991'. [ 152.089743][ T43] audit: type=1400 audit(1790398917.852:915): avc: denied { create } for pid=9014 comm="syz.3.991" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 152.091556][ T43] audit: type=1400 audit(1790398917.852:916): avc: denied { ioctl } for pid=9014 comm="syz.3.991" path="socket:[28859]" dev="sockfs" ino=28859 ioctlcmd=0x894b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 152.375548][ T50] hid (null): unknown global tag 0xd [ 152.387999][ T50] hid-generic 0007:07FF:0000.0002: unknown main item tag 0x2 [ 152.389557][ T50] hid-generic 0007:07FF:0000.0002: unknown main item tag 0x1 [ 152.389574][ T50] hid-generic 0007:07FF:0000.0002: unknown main item tag 0x4 [ 152.389592][ T50] hid-generic 0007:07FF:0000.0002: unexpected long global item [ 152.389979][ T50] hid-generic 0007:07FF:0000.0002: probe with driver hid-generic failed with error -22 [ 152.486862][ T9036] netlink: 'syz.1.1001': attribute type 1 has an invalid length. [ 152.486881][ T9036] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1001'. [ 152.610182][ T9038] device-mapper: table: 248:0: : unknown target type [ 152.610195][ T9038] device-mapper: ioctl: error adding target to table [ 152.694903][ T9044] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1004'. [ 153.123079][ T9051] device-mapper: table: 248:0: zero-length target [ 153.123123][ T9051] device-mapper: ioctl: error adding target to table [ 153.336931][ T9060] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1010'. [ 153.336947][ T9060] tipc: Invalid UDP bearer configuration [ 153.336966][ T9060] tipc: Enabling of bearer rejected, failed to enable media [ 153.527364][ T9069] binder: 9068:9069 ioctl c0306201 2000000004c0 returned -22 [ 153.615644][ T9077] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1013'. [ 153.615662][ T9077] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1013'. [ 153.686675][ T9083] overlayfs: failed to resolve './file0': -2 [ 153.777330][ T9097] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1020'. [ 153.810049][ T43] audit: type=1400 audit(1790398919.572:917): avc: denied { accept } for pid=9090 comm="syz.3.1018" lport=38377 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 153.857613][ T9110] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 153.857631][ T9110] device-mapper: ioctl: error adding target to table [ 153.888377][ T9112] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1023'. [ 153.976501][ T9117] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1024'. [ 154.005888][ T9119] device-mapper: ioctl: Target spec extends beyond end of parameters [ 154.005898][ T9119] device-mapper: ioctl: unable to find target [ 154.422571][ T9134] netlink: 'syz.3.1033': attribute type 1 has an invalid length. [ 154.422874][ T9134] netlink: 'syz.3.1033': attribute type 1 has an invalid length. [ 154.423070][ T9134] netlink: 'syz.3.1033': attribute type 1 has an invalid length. [ 154.423271][ T9134] netlink: 'syz.3.1033': attribute type 1 has an invalid length. [ 154.423471][ T9134] netlink: 'syz.3.1033': attribute type 1 has an invalid length. [ 154.423655][ T9134] netlink: 'syz.3.1033': attribute type 1 has an invalid length. [ 154.423850][ T9134] netlink: 'syz.3.1033': attribute type 1 has an invalid length. [ 154.424036][ T9134] netlink: 'syz.3.1033': attribute type 1 has an invalid length. [ 154.424217][ T9134] netlink: 'syz.3.1033': attribute type 1 has an invalid length. [ 154.424403][ T9134] netlink: 'syz.3.1033': attribute type 1 has an invalid length. [ 154.520246][ T9139] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.234881024.0), cmd(9) [ 154.675886][ T9145] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 154.676506][ T9145] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 154.776293][ T9153] tipc: Started in network mode [ 154.776312][ T9153] tipc: Node identity 2000004, cluster identity 4711 [ 154.776323][ T9153] tipc: Node number set to 33554436 [ 154.780389][ T9153] trusted_key: syz.1.1041 sent an empty control message without MSG_MORE. [ 154.964007][ T9162] netlink: NAT attribute has 8 unknown bytes [ 154.964038][ T9162] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 155.031233][ T25] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 155.081165][ T35] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 155.191239][ T25] usb 10-1: Using ep0 maxpacket: 32 [ 155.192087][ T25] usb 10-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 155.193221][ T25] usb 10-1: config index 0 descriptor too short (expected 156, got 27) [ 155.193242][ T25] usb 10-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 155.193267][ T25] usb 10-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 155.193296][ T25] usb 10-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 155.193319][ T25] usb 10-1: config 0 interface 0 has no altsetting 0 [ 155.195511][ T25] usb 10-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 155.195531][ T25] usb 10-1: Product: syz [ 155.195544][ T25] usb 10-1: Manufacturer: syz [ 155.195557][ T25] usb 10-1: SerialNumber: syz [ 155.197853][ T25] usb 10-1: config 0 descriptor?? [ 155.241186][ T35] usb 6-1: Using ep0 maxpacket: 32 [ 155.241641][ T35] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 155.242432][ T35] usb 6-1: config index 0 descriptor too short (expected 156, got 27) [ 155.242447][ T35] usb 6-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 155.242463][ T35] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 155.242481][ T35] usb 6-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 155.242496][ T35] usb 6-1: config 0 interface 0 has no altsetting 0 [ 155.244443][ T35] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 155.244458][ T35] usb 6-1: Product: syz [ 155.244467][ T35] usb 6-1: Manufacturer: syz [ 155.244475][ T35] usb 6-1: SerialNumber: syz [ 155.246072][ T35] usb 6-1: config 0 descriptor?? [ 155.361114][ T50] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 155.411591][ T25] ldusb 10-1:0.0: Interrupt in endpoint not found [ 155.414347][ T25] usb 10-1: USB disconnect, device number 9 [ 155.450384][ T9161] FAULT_INJECTION: forcing a failure. [ 155.450384][ T9161] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 155.450413][ T9161] CPU: 3 UID: 0 PID: 9161 Comm: syz.1.1045 Not tainted syzkaller #0 PREEMPT(full) [ 155.450432][ T9161] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 155.450443][ T9161] Call Trace: [ 155.450448][ T9161] [ 155.450471][ T9161] dump_stack_lvl+0x100/0x190 [ 155.450500][ T9161] should_fail_ex.cold+0x5/0xa [ 155.450545][ T9161] _copy_to_user+0x32/0xd0 [ 155.450568][ T9161] simple_read_from_buffer+0xcb/0x170 [ 155.450598][ T9161] proc_fail_nth_read+0x1af/0x230 [ 155.450621][ T9161] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 155.450644][ T9161] ? rw_verify_area+0xce/0x6d0 [ 155.450670][ T9161] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 155.450692][ T9161] vfs_read+0x1e4/0xb40 [ 155.450711][ T9161] ? lock_acquire+0x1d1/0x380 [ 155.450729][ T9161] ? __fget_files+0x34/0x3d0 [ 155.450751][ T9161] ? __pfx_vfs_read+0x10/0x10 [ 155.450767][ T9161] ? find_held_lock+0x2b/0x80 [ 155.450791][ T9161] ? __fget_files+0x215/0x3d0 [ 155.450816][ T9161] ? __fget_files+0x21f/0x3d0 [ 155.450843][ T9161] ksys_read+0x12a/0x250 [ 155.450862][ T9161] ? __pfx_ksys_read+0x10/0x10 [ 155.450886][ T9161] do_syscall_64+0x123/0x790 [ 155.450906][ T9161] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.450924][ T9161] RIP: 0033:0x7fbaddb5e98e [ 155.450938][ T9161] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 155.450955][ T9161] RSP: 002b:00007fbadea54fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 155.450973][ T9161] RAX: ffffffffffffffda RBX: 00007fbadea556c0 RCX: 00007fbaddb5e98e [ 155.450985][ T9161] RDX: 000000000000000f RSI: 00007fbadea550a0 RDI: 0000000000000005 [ 155.450995][ T9161] RBP: 00007fbadea55090 R08: 0000000000000000 R09: 0000000000000000 [ 155.451005][ T9161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 155.451016][ T9161] R13: 00007fbadde26038 R14: 00007fbadde25fa0 R15: 00007ffc7db87c38 [ 155.451040][ T9161] [ 155.513191][ T9171] FAULT_INJECTION: forcing a failure. [ 155.513191][ T9171] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 155.513223][ T9171] CPU: 2 UID: 0 PID: 9171 Comm: syz.1.1048 Not tainted syzkaller #0 PREEMPT(full) [ 155.513244][ T9171] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 155.513256][ T9171] Call Trace: [ 155.513262][ T9171] [ 155.513269][ T9171] dump_stack_lvl+0x100/0x190 [ 155.513302][ T9171] should_fail_ex.cold+0x5/0xa [ 155.513330][ T9171] _copy_from_user+0x2e/0xd0 [ 155.513353][ T9171] vmemdup_user+0x6b/0xe0 [ 155.513371][ T9171] path_setxattrat+0x29e/0x3b0 [ 155.513399][ T9171] ? __pfx_path_setxattrat+0x10/0x10 [ 155.513429][ T9171] ? ksys_write+0x190/0x250 [ 155.513448][ T9171] ? ksys_write+0x190/0x250 [ 155.513487][ T9171] ? fput+0x7c/0x100 [ 155.513511][ T9171] ? ksys_write+0x1ac/0x250 [ 155.513530][ T9171] ? __pfx_ksys_write+0x10/0x10 [ 155.513553][ T9171] __x64_sys_setxattr+0xc6/0x140 [ 155.513580][ T9171] ? do_syscall_64+0xae/0x790 [ 155.513598][ T9171] ? lockdep_hardirqs_on+0x7d/0x110 [ 155.513626][ T9171] do_syscall_64+0x123/0x790 [ 155.513652][ T9171] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.513672][ T9171] RIP: 0033:0x7fbaddb9e159 [ 155.513687][ T9171] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 155.513705][ T9171] RSP: 002b:00007fbadea55028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc [ 155.513725][ T9171] RAX: ffffffffffffffda RBX: 00007fbadde25fa0 RCX: 00007fbaddb9e159 [ 155.513737][ T9171] RDX: 0000200000000240 RSI: 0000200000000200 RDI: 0000200000000000 [ 155.513749][ T9171] RBP: 00007fbadea55090 R08: 0000000000000001 R09: 0000000000000000 [ 155.513760][ T9171] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 155.513771][ T9171] R13: 00007fbadde26038 R14: 00007fbadde25fa0 R15: 00007ffc7db87c38 [ 155.513797][ T9171] [ 155.541112][ T50] usb 5-1: Using ep0 maxpacket: 32 [ 155.541668][ T50] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 155.542583][ T50] usb 5-1: config index 0 descriptor too short (expected 156, got 27) [ 155.542601][ T50] usb 5-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 155.542624][ T50] usb 5-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 155.542643][ T50] usb 5-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 155.542657][ T50] usb 5-1: config 0 interface 0 has no altsetting 0 [ 155.545135][ T35] ldusb 6-1:0.0: Interrupt in endpoint not found [ 155.548135][ T50] usb 5-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 155.548154][ T50] usb 5-1: Product: syz [ 155.548165][ T50] usb 5-1: Manufacturer: syz [ 155.548175][ T50] usb 5-1: SerialNumber: syz [ 155.553491][ T35] usb 6-1: USB disconnect, device number 39 [ 155.633846][ T50] usb 5-1: config 0 descriptor?? [ 155.838720][ T9164] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 155.839018][ T9164] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 155.853182][ T50] ldusb 5-1:0.0: Interrupt in endpoint not found [ 155.856042][ T50] usb 5-1: USB disconnect, device number 45 [ 156.093879][ T43] kauditd_printk_skb: 3 callbacks suppressed [ 156.093897][ T43] audit: type=1400 audit(1790398921.862:921): avc: denied { write } for pid=9178 comm="syz.5.1051" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 156.314752][ T43] audit: type=1400 audit(1790398922.082:922): avc: denied { ioctl } for pid=9191 comm="syz.5.1056" path="socket:[28262]" dev="sockfs" ino=28262 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 156.343197][ T43] audit: type=1400 audit(1790398922.112:923): avc: denied { connect } for pid=9201 comm="syz.3.1059" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 156.343621][ T43] audit: type=1400 audit(1790398922.112:924): avc: denied { write } for pid=9201 comm="syz.3.1059" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 156.357889][ T43] audit: type=1400 audit(1790398922.122:925): avc: denied { read } for pid=9201 comm="syz.3.1059" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 156.433719][ T9212] device-mapper: table: 248:0: : unknown target type [ 156.433733][ T9212] device-mapper: ioctl: error adding target to table [ 156.540895][ T9224] syzkaller1: entered allmulticast mode [ 156.561818][ T9226] device-mapper: table: 248:0: zero-length target [ 156.561834][ T9226] device-mapper: ioctl: error adding target to table [ 156.627943][ T9230] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 156.628292][ T9230] CUSE: unknown device info "" [ 156.628299][ T9230] CUSE: unknown device info "" [ 156.628303][ T9230] CUSE: unknown device info "" [ 156.628308][ T9230] CUSE: unknown device info "" [ 156.628312][ T9230] CUSE: zero length info key specified [ 156.640918][ T43] audit: type=1400 audit(1790398922.402:926): avc: denied { mounton } for pid=9229 comm="syz.5.1070" path="/85/sys" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 156.729696][ T9234] tipc: Invalid UDP bearer configuration [ 156.729731][ T9234] tipc: Enabling of bearer rejected, failed to enable media [ 156.788438][ T9239] block nbd3: Device being setup by another task [ 156.896269][ T9237] block nbd3: shutting down sockets [ 156.919752][ T9253] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 156.919767][ T9253] device-mapper: ioctl: error adding target to table [ 156.990931][ T9267] device-mapper: ioctl: Target spec extends beyond end of parameters [ 156.990941][ T9267] device-mapper: ioctl: unable to find target [ 157.027130][ T9272] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 157.126962][ T9289] __nla_validate_parse: 44 callbacks suppressed [ 157.126976][ T9289] netlink: 272 bytes leftover after parsing attributes in process `syz.5.1093'. [ 157.176341][ T43] audit: type=1400 audit(1790398922.942:927): avc: denied { mount } for pid=9274 comm="syz.3.1089" name="/" dev="hugetlbfs" ino=30420 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 157.179745][ T9294] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.251658240.0), cmd(9) [ 157.271273][ T43] audit: type=1400 audit(1790398923.042:928): avc: denied { unmount } for pid=5729 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 157.741261][ T2549] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 157.827834][ T43] audit: type=1400 audit(1790398923.592:929): avc: denied { execmod } for pid=9325 comm="syz.3.1107" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=29369 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 157.829802][ T9326] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 157.875994][ T9329] FAULT_INJECTION: forcing a failure. [ 157.875994][ T9329] name failslab, interval 1, probability 0, space 0, times 0 [ 157.876024][ T9329] CPU: 2 UID: 0 PID: 9329 Comm: syz.3.1108 Not tainted syzkaller #0 PREEMPT(full) [ 157.876045][ T9329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 157.876057][ T9329] Call Trace: [ 157.876063][ T9329] [ 157.876071][ T9329] dump_stack_lvl+0x100/0x190 [ 157.876102][ T9329] should_fail_ex.cold+0x5/0xa [ 157.876129][ T9329] should_failslab+0xc2/0x120 [ 157.876155][ T9329] kmem_cache_alloc_noprof+0x92/0x6a0 [ 157.876178][ T9329] ? do_getname+0x35/0x390 [ 157.876210][ T9329] do_getname+0x35/0x390 [ 157.876240][ T9329] path_setxattrat+0x360/0x3b0 [ 157.876269][ T9329] ? __pfx_path_setxattrat+0x10/0x10 [ 157.876300][ T9329] ? ksys_write+0x190/0x250 [ 157.876321][ T9329] ? ksys_write+0x190/0x250 [ 157.876359][ T9329] ? fput+0x7c/0x100 [ 157.876385][ T9329] ? ksys_write+0x1ac/0x250 [ 157.876405][ T9329] ? __pfx_ksys_write+0x10/0x10 [ 157.876429][ T9329] __x64_sys_setxattr+0xc6/0x140 [ 157.876454][ T9329] ? do_syscall_64+0xae/0x790 [ 157.876473][ T9329] ? lockdep_hardirqs_on+0x7d/0x110 [ 157.876502][ T9329] do_syscall_64+0x123/0x790 [ 157.876522][ T9329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.876541][ T9329] RIP: 0033:0x7f395ad9e159 [ 157.876557][ T9329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 157.876574][ T9329] RSP: 002b:00007f395bce5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc [ 157.876594][ T9329] RAX: ffffffffffffffda RBX: 00007f395b025fa0 RCX: 00007f395ad9e159 [ 157.876607][ T9329] RDX: 0000200000000240 RSI: 0000200000000200 RDI: 0000200000000000 [ 157.876618][ T9329] RBP: 00007f395bce5090 R08: 0000000000000001 R09: 0000000000000000 [ 157.876629][ T9329] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 157.876640][ T9329] R13: 00007f395b026038 R14: 00007f395b025fa0 R15: 00007ffe286b57a8 [ 157.876666][ T9329] [ 157.912185][ T2549] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 157.912985][ T2549] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.977523][ T9331] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 157.977889][ T9331] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 158.119740][ T2549] cdc_acm 5-1:1.0: ttyACM0: USB ACM device [ 158.674614][ T9348] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 158.677016][ T9348] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 158.773699][ T43] audit: type=1400 audit(1790398924.542:930): avc: denied { append } for pid=9355 comm="syz.5.1117" name="001" dev="devtmpfs" ino=766 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 158.882383][ T9360] 9pnet_fd: Insufficient options for proto=fd [ 159.098048][ T9368] syz.5.1121 (9368): attempted to duplicate a private mapping with mremap. This is not supported. [ 159.411819][ T2549] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 159.432530][ T9375] device-mapper: table: 248:0: : unknown target type [ 159.432544][ T9375] device-mapper: ioctl: error adding target to table [ 159.562234][ T2549] usb 6-1: Using ep0 maxpacket: 32 [ 159.563401][ T2549] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 159.564886][ T2549] usb 6-1: config index 0 descriptor too short (expected 156, got 27) [ 159.564908][ T2549] usb 6-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 159.564935][ T2549] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 159.565016][ T2549] usb 6-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 159.565041][ T2549] usb 6-1: config 0 interface 0 has no altsetting 0 [ 159.568748][ T2549] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 159.568772][ T2549] usb 6-1: Product: syz [ 159.568786][ T2549] usb 6-1: Manufacturer: syz [ 159.568802][ T2549] usb 6-1: SerialNumber: syz [ 159.573099][ T2549] usb 6-1: config 0 descriptor?? [ 159.818007][ T2549] ldusb 6-1:0.0: Interrupt in endpoint not found [ 159.823665][ T2549] usb 6-1: USB disconnect, device number 40 [ 160.360322][ T9385] validate_nla: 24 callbacks suppressed [ 160.360336][ T9385] netlink: 'syz.1.1126': attribute type 1 has an invalid length. [ 160.360344][ T9385] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1126'. [ 160.589848][ T9393] 9pnet_fd: Insufficient options for proto=fd [ 160.635098][ T9395] device-mapper: table: 248:0: zero-length target [ 160.635114][ T9395] device-mapper: ioctl: error adding target to table [ 160.730048][ T9398] openvswitch: netlink: IP tunnel attribute has 5393 unknown bytes. [ 160.936071][ T9403] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1133'. [ 160.936090][ T9403] tipc: Invalid UDP bearer configuration [ 160.936107][ T9403] tipc: Enabling of bearer rejected, failed to enable media [ 161.149111][ T9407] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1135'. [ 161.151133][ T9409] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1135'. [ 161.350312][ T9418] 9p: Bad value for 'access' [ 161.599898][ T9426] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 161.599913][ T9426] device-mapper: ioctl: error adding target to table [ 161.637811][ T43] kauditd_printk_skb: 2 callbacks suppressed [ 161.637823][ T43] audit: type=1400 audit(1790398927.402:933): avc: denied { map } for pid=9427 comm="syz.1.1142" path="/294/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=5664 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 161.682268][ T9430] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1143'. [ 161.711587][ T9433] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1144'. [ 161.714764][ T9434] device-mapper: ioctl: Target spec extends beyond end of parameters [ 161.714772][ T9434] device-mapper: ioctl: unable to find target [ 161.715283][ T9435] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1144'. [ 161.755320][ T9438] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1146'. [ 161.771205][ T9440] 9p: Bad value for 'access' [ 161.888020][ T43] audit: type=1400 audit(1790398927.652:934): avc: denied { shutdown } for pid=9448 comm="syz.1.1151" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 162.048829][ T9465] netlink: 272 bytes leftover after parsing attributes in process `syz.3.1155'. [ 162.089506][ T9467] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65533 sclass=netlink_route_socket pid=9467 comm=syz.3.1157 [ 162.130117][ T9471] 9p: Bad value for 'access' [ 162.161424][ T9473] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 162.161633][ T9473] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 162.183758][ T9475] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.268435456.0), cmd(9) [ 162.333454][ T43] audit: type=1400 audit(1790398928.102:935): avc: denied { execute } for pid=9478 comm="syz.1.1161" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=30719 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 162.334599][ T9479] netlink: 'syz.1.1161': attribute type 21 has an invalid length. [ 163.435194][ T5830] usb 5-1: USB disconnect, device number 46 [ 163.479268][ T9503] 9p: Unknown access argument Ì: -22 [ 163.613034][ T9509] FAULT_INJECTION: forcing a failure. [ 163.613034][ T9509] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 163.613056][ T9509] CPU: 0 UID: 0 PID: 9509 Comm: syz.0.1169 Not tainted syzkaller #0 PREEMPT(full) [ 163.613069][ T9509] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 163.613076][ T9509] Call Trace: [ 163.613080][ T9509] [ 163.613085][ T9509] dump_stack_lvl+0x100/0x190 [ 163.613105][ T9509] should_fail_ex.cold+0x5/0xa [ 163.613121][ T9509] strncpy_from_user+0x3b/0x2d0 [ 163.613137][ T9509] do_getname+0x78/0x390 [ 163.613160][ T9509] path_setxattrat+0x360/0x3b0 [ 163.613180][ T9509] ? __pfx_path_setxattrat+0x10/0x10 [ 163.613198][ T9509] ? ksys_write+0x190/0x250 [ 163.613210][ T9509] ? ksys_write+0x190/0x250 [ 163.613231][ T9509] ? fput+0x7c/0x100 [ 163.613246][ T9509] ? ksys_write+0x1ac/0x250 [ 163.613257][ T9509] ? __pfx_ksys_write+0x10/0x10 [ 163.613270][ T9509] __x64_sys_setxattr+0xc6/0x140 [ 163.613286][ T9509] ? do_syscall_64+0xae/0x790 [ 163.613296][ T9509] ? lockdep_hardirqs_on+0x7d/0x110 [ 163.613315][ T9509] do_syscall_64+0x123/0x790 [ 163.613328][ T9509] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.613340][ T9509] RIP: 0033:0x7f84a399e159 [ 163.613351][ T9509] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 163.613362][ T9509] RSP: 002b:00007f84a1bb4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc [ 163.613373][ T9509] RAX: ffffffffffffffda RBX: 00007f84a3c26180 RCX: 00007f84a399e159 [ 163.613380][ T9509] RDX: 0000200000000240 RSI: 0000200000000200 RDI: 0000200000000000 [ 163.613387][ T9509] RBP: 00007f84a1bb4090 R08: 0000000000000001 R09: 0000000000000000 [ 163.613393][ T9509] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 163.613400][ T9509] R13: 00007f84a3c26218 R14: 00007f84a3c26180 R15: 00007ffc179c5158 [ 163.613413][ T9509] [ 164.425361][ T43] audit: type=1400 audit(1790398930.192:936): avc: denied { accept } for pid=9513 comm="syz.0.1171" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 164.661083][ T7976] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 164.821153][ T7976] usb 6-1: Using ep0 maxpacket: 32 [ 164.821902][ T7976] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 164.822888][ T7976] usb 6-1: config index 0 descriptor too short (expected 156, got 27) [ 164.822904][ T7976] usb 6-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 164.822922][ T7976] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 164.822940][ T7976] usb 6-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 164.822955][ T7976] usb 6-1: config 0 interface 0 has no altsetting 0 [ 164.824460][ T7976] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 164.824475][ T7976] usb 6-1: Product: syz [ 164.824483][ T7976] usb 6-1: Manufacturer: syz [ 164.824535][ T7976] usb 6-1: SerialNumber: syz [ 164.826028][ T7976] usb 6-1: config 0 descriptor?? [ 165.034643][ T7976] ldusb 6-1:0.0: Interrupt in endpoint not found [ 165.038694][ T7976] usb 6-1: USB disconnect, device number 41 [ 165.308514][ T9530] device-mapper: table: 248:0: zero-length target [ 165.308529][ T9530] device-mapper: ioctl: error adding target to table [ 165.366716][ T9536] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1181'. [ 165.366736][ T9536] tipc: Invalid UDP bearer configuration [ 165.366767][ T9536] tipc: Enabling of bearer rejected, failed to enable media [ 165.468270][ T43] audit: type=1400 audit(1790398931.232:937): avc: denied { write } for pid=9540 comm="syz.5.1183" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 165.661677][ T9551] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 165.661700][ T9551] device-mapper: ioctl: error adding target to table [ 165.735279][ T9555] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1189'. [ 165.764063][ T43] audit: type=1400 audit(1790398931.532:938): avc: denied { accept } for pid=9552 comm="syz.1.1188" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 165.764091][ T43] audit: type=1400 audit(1790398931.532:939): avc: denied { write } for pid=9552 comm="syz.1.1188" name="mcfilter" dev="proc" ino=4026532926 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 165.779901][ T9558] device-mapper: ioctl: Invalid ioctl structure: name test, dev 3200 [ 165.845111][ T43] audit: type=1400 audit(1790398931.612:940): avc: denied { getopt } for pid=9552 comm="syz.1.1188" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 165.864258][ T9565] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1192'. [ 165.899623][ T9570] jffs2: notice: (9570) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 165.908433][ T43] audit: type=1400 audit(1790398931.672:941): avc: denied { write } for pid=9568 comm="syz.1.1194" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 165.908462][ T43] audit: type=1400 audit(1790398931.672:942): avc: denied { add_name } for pid=9568 comm="syz.1.1194" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 165.985267][ T9581] netlink: 272 bytes leftover after parsing attributes in process `syz.0.1199'. [ 166.116660][ T9591] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.301989888.0), cmd(9) [ 166.357118][ T9607] netlink: Setting conntrack mark requires 'commit' flag. [ 166.357144][ T9607] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 166.437397][ T9621] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1211'. [ 166.771126][ T42] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 166.932248][ T42] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 166.933104][ T42] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.136880][ T9628] CIFS: enabling forceuid mount option implicitly because uid= option is specified [ 167.136891][ T9628] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 167.137136][ T9628] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 167.138384][ T42] cdc_acm 6-1:1.0: ttyACM0: USB ACM device [ 167.352544][ T9641] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1219'. [ 167.353294][ T9641] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 167.353313][ T9641] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 167.383033][ T9644] device-mapper: ioctl: device name cannot contain '/' [ 167.413661][ T43] kauditd_printk_skb: 4 callbacks suppressed [ 167.413672][ T43] audit: type=1400 audit(1790398933.182:947): avc: denied { wake_alarm } for pid=9647 comm="syz.5.1221" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 167.493997][ T9651] device-mapper: table: 248:0: zero-length target [ 167.494007][ T9651] device-mapper: ioctl: error adding target to table [ 167.544626][ T9655] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 167.544645][ T9655] device-mapper: ioctl: error adding target to table [ 167.569335][ T9659] x_tables: duplicate underflow at hook 3 [ 167.573327][ T43] audit: type=1400 audit(1790398933.342:948): avc: denied { module_request } for pid=9658 comm="syz.0.1225" kmod="net-pf-2-proto-129-type-2" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 167.598988][ T42] usb 6-1: USB disconnect, device number 42 [ 167.606522][ T9662] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1227'. [ 167.711152][ T9672] device-mapper: ioctl: Target spec extends beyond end of parameters [ 167.711162][ T9672] device-mapper: ioctl: unable to find target [ 167.758990][ T9679] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1233'. [ 168.485403][ T9690] input: syz0 as /devices/virtual/input/input8 [ 168.490487][ T43] audit: type=1400 audit(1790398934.252:949): avc: denied { read } for pid=5126 comm="acpid" name="js0" dev="devtmpfs" ino=3115 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 168.494208][ T43] audit: type=1400 audit(1790398934.262:950): avc: denied { open } for pid=5126 comm="acpid" path="/dev/input/js0" dev="devtmpfs" ino=3115 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 168.494236][ T43] audit: type=1400 audit(1790398934.262:951): avc: denied { ioctl } for pid=5126 comm="acpid" path="/dev/input/js0" dev="devtmpfs" ino=3115 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 168.563544][ T9692] netlink: 272 bytes leftover after parsing attributes in process `syz.5.1238'. [ 168.581105][ T43] audit: type=1326 audit(1790398934.342:952): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9676 comm="syz.3.1232" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f395ad9e159 code=0x7fc00000 [ 168.604386][ T9694] overlay: ./file0 is not a directory [ 168.607588][ T43] audit: type=1400 audit(1790398934.372:953): avc: denied { write } for pid=9693 comm="syz.5.1240" name="mouse0" dev="devtmpfs" ino=1113 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 168.652528][ T9698] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.520093696.0), cmd(9) [ 168.662871][ T43] audit: type=1400 audit(1790398934.432:954): avc: denied { map } for pid=9693 comm="syz.5.1240" path="/dev/input/mouse0" dev="devtmpfs" ino=1113 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 168.726282][ T9703] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1242'. [ 168.737242][ T9703] bond0: (slave bond_slave_0): Releasing backup interface [ 168.760323][ T9705] device-mapper: ioctl: Invalid ioctl structure: name test, dev 32 [ 168.853107][ T9713] loop6: detected capacity change from 0 to 524288000 [ 168.878512][ T9709] device-mapper: table: 248:0: : unknown target type [ 168.878529][ T9709] device-mapper: ioctl: error adding target to table [ 168.998306][ T9725] netlink: 'syz.3.1252': attribute type 2 has an invalid length. [ 168.998770][ T43] audit: type=1400 audit(1790398934.762:955): avc: denied { getopt } for pid=9724 comm="syz.3.1252" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 169.111794][ T9732] xt_l2tp: v2 sid > 0xffff: 4294967294 [ 169.139144][ T9734] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 169.139158][ T9734] device-mapper: ioctl: error adding target to table [ 169.200123][ T9739] 9pnet_fd: Insufficient options for proto=fd [ 169.332599][ T9747] input: syz1 as /devices/virtual/input/input9 [ 169.351510][ T43] audit: type=1400 audit(1790398935.122:956): avc: denied { block_suspend } for pid=9746 comm="syz.3.1262" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 169.763862][ T9779] FAULT_INJECTION: forcing a failure. [ 169.763862][ T9779] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 169.763891][ T9779] CPU: 3 UID: 0 PID: 9779 Comm: syz.3.1268 Not tainted syzkaller #0 PREEMPT(full) [ 169.763910][ T9779] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 169.763917][ T9779] Call Trace: [ 169.763922][ T9779] [ 169.763929][ T9779] dump_stack_lvl+0x100/0x190 [ 169.763958][ T9779] should_fail_ex.cold+0x5/0xa [ 169.763983][ T9779] _copy_to_user+0x32/0xd0 [ 169.764001][ T9779] simple_read_from_buffer+0xcb/0x170 [ 169.764024][ T9779] proc_fail_nth_read+0x1af/0x230 [ 169.764049][ T9779] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 169.764073][ T9779] ? rw_verify_area+0xce/0x6d0 [ 169.764093][ T9779] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 169.764115][ T9779] vfs_read+0x1e4/0xb40 [ 169.764134][ T9779] ? lock_acquire+0x1d1/0x380 [ 169.764152][ T9779] ? __fget_files+0x34/0x3d0 [ 169.764171][ T9779] ? __pfx_vfs_read+0x10/0x10 [ 169.764184][ T9779] ? find_held_lock+0x2b/0x80 [ 169.764208][ T9779] ? __fget_files+0x215/0x3d0 [ 169.764233][ T9779] ? __fget_files+0x21f/0x3d0 [ 169.764257][ T9779] ksys_read+0x12a/0x250 [ 169.764272][ T9779] ? __pfx_ksys_read+0x10/0x10 [ 169.764297][ T9779] do_syscall_64+0x123/0x790 [ 169.764316][ T9779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 169.764333][ T9779] RIP: 0033:0x7f395ad5e98e [ 169.764344][ T9779] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 169.764358][ T9779] RSP: 002b:00007f395bce4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 169.764374][ T9779] RAX: ffffffffffffffda RBX: 00007f395bce56c0 RCX: 00007f395ad5e98e [ 169.764386][ T9779] RDX: 000000000000000f RSI: 00007f395bce50a0 RDI: 0000000000000008 [ 169.764396][ T9779] RBP: 00007f395bce5090 R08: 0000000000000000 R09: 0000000000000000 [ 169.764405][ T9779] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 169.764415][ T9779] R13: 00007f395b026038 R14: 00007f395b025fa0 R15: 00007ffe286b57a8 [ 169.764432][ T9779] [ 169.829596][ T9785] 9pnet_fd: Insufficient options for proto=fd [ 169.908411][ T9792] tipc: Invalid UDP bearer configuration [ 169.908446][ T9792] tipc: Enabling of bearer rejected, failed to enable media [ 170.067063][ T9807] 9pnet_fd: Insufficient options for proto=fd [ 170.124925][ T9809] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1544 sclass=netlink_route_socket pid=9809 comm=syz.3.1281 [ 170.279940][ T9812] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.536870912.0), cmd(9) [ 170.530599][ T9827] __nla_validate_parse: 9 callbacks suppressed [ 170.530612][ T9827] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1286'. [ 170.530621][ T9827] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1286'. [ 170.541401][ T9829] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1288'. [ 170.608471][ T9832] device-mapper: table: 248:0: : unknown target type [ 170.608489][ T9832] device-mapper: ioctl: error adding target to table [ 170.624492][ T9833] netlink: zone id is out of range [ 170.624501][ T9833] netlink: zone id is out of range [ 170.624506][ T9833] netlink: zone id is out of range [ 170.624509][ T9833] netlink: zone id is out of range [ 170.624513][ T9833] netlink: zone id is out of range [ 170.624517][ T9833] netlink: zone id is out of range [ 170.624685][ T9833] netlink: zone id is out of range [ 170.624690][ T9833] netlink: zone id is out of range [ 170.764620][ T9842] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1292'. [ 170.772444][ T9844] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1294'. [ 170.865001][ T5743] Bluetooth: hci2: command 0x0406 tx timeout [ 170.903426][ T9856] netlink: 'syz.0.1298': attribute type 2 has an invalid length. [ 170.903445][ T9856] netlink: 'syz.0.1298': attribute type 1 has an invalid length. [ 170.918814][ T9861] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1299'. [ 170.918829][ T9861] tipc: Invalid UDP bearer configuration [ 170.918853][ T9861] tipc: Enabling of bearer rejected, failed to enable media [ 170.985194][ T9866] device-mapper: ioctl: Invalid ioctl structure: name test, dev 8 [ 171.108574][ T9884] batman_adv: batadv0: Adding interface: syzkaller0 [ 171.108587][ T9884] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 171.108602][ T9884] batman_adv: batadv0: Interface activated: syzkaller0 [ 171.144395][ T9887] 9p: Bad value for 'access' [ 171.258759][ T9898] fuse: Unknown parameter 'ro­í–íÛe¿00000000000060000' [ 171.258929][ T9899] fuse: Unknown parameter 'ser_id' [ 171.266239][ T9896] overlay: ./file0 is not a directory [ 171.369583][ T9896] overlay: ./file0 is not a directory [ 171.369956][ T9896] overlay: ./file0 is not a directory [ 171.370718][ T9896] overlay: ./file0 is not a directory [ 171.370837][ T9883] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 171.376134][ T9896] overlay: ./file0 is not a directory [ 171.376412][ T9896] overlay: ./file0 is not a directory [ 171.378271][ T9896] overlay: ./file0 is not a directory [ 171.380664][ T9896] overlay: ./file0 is not a directory [ 171.382536][ T9896] overlay: ./file0 is not a directory [ 171.387651][ T9896] overlay: ./file0 is not a directory [ 171.389753][ T9883] batman_adv: batadv0: Removing interface: syzkaller0 [ 171.390150][ T9896] overlay: ./file0 is not a directory [ 171.394383][ T9896] overlay: ./file0 is not a directory [ 171.398472][ T9896] overlay: ./file0 is not a directory [ 171.398793][ T9896] overlay: ./file0 is not a directory [ 171.399038][ T9896] overlay: ./file0 is not a directory [ 171.399328][ T9896] overlay: ./file0 is not a directory [ 171.399588][ T9896] overlay: ./file0 is not a directory [ 171.400018][ T9896] overlay: ./file0 is not a directory [ 171.400202][ T9896] overlay: ./file0 is not a directory [ 171.400372][ T9896] overlay: ./file0 is not a directory [ 171.400595][ T9896] overlay: ./file0 is not a directory [ 171.400768][ T9896] overlay: ./file0 is not a directory [ 171.400941][ T9896] overlay: ./file0 is not a directory [ 171.403631][ T9896] overlay: ./file0 is not a directory [ 171.405908][ T9896] overlay: ./file0 is not a directory [ 171.408205][ T9896] overlay: ./file0 is not a directory [ 171.410410][ T9896] overlay: ./file0 is not a directory [ 171.414931][ T9896] overlay: ./file0 is not a directory [ 171.417258][ T9896] overlay: ./file0 is not a directory [ 171.418662][ T9896] overlay: ./file0 is not a directory [ 171.420270][ T9896] overlay: ./file0 is not a directory [ 171.422298][ T9896] overlay: ./file0 is not a directory [ 171.425261][ T9896] overlay: ./file0 is not a directory [ 171.444740][ T9902] device-mapper: ioctl: Target spec extends beyond end of parameters [ 171.444752][ T9902] device-mapper: ioctl: unable to find target [ 171.896655][ T9921] 9p: Bad value for 'access' [ 171.951870][ T9927] Cannot find add_set index 65532 as target [ 171.978864][ T9930] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.838860800.0), cmd(9) [ 172.497157][ T9948] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1326'. [ 172.497171][ T9948] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1326'. [ 172.517441][ T9950] 9p: Bad value for 'access' [ 172.561289][ T9954] device-mapper: table: 248:0: : unknown target type [ 172.561302][ T9954] device-mapper: ioctl: error adding target to table [ 173.911895][ C1] net_ratelimit: 499 callbacks suppressed [ 173.911916][ C1] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 173.954519][ T9967] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1333'. [ 173.962025][ T9867] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 174.009870][ T9969] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 174.010105][ T9969] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 174.096680][ T9984] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 174.096694][ T9984] device-mapper: ioctl: error adding target to table [ 174.138106][ T9987] device-mapper: ioctl: Invalid ioctl structure: name test, dev 320000 [ 174.241066][ T2549] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 174.290319][ T9990] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1343'. [ 174.329546][T10003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 174.330014][T10003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 174.331626][T10003] FAULT_INJECTION: forcing a failure. [ 174.331626][T10003] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 174.331651][T10003] CPU: 3 UID: 0 PID: 10003 Comm: syz.3.1347 Not tainted syzkaller #0 PREEMPT(full) [ 174.331670][T10003] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.331680][T10003] Call Trace: [ 174.331687][T10003] [ 174.331694][T10003] dump_stack_lvl+0x100/0x190 [ 174.331725][T10003] should_fail_ex.cold+0x5/0xa [ 174.331751][T10003] _copy_from_user+0x2e/0xd0 [ 174.331774][T10003] core_sys_select+0x2d0/0xbb0 [ 174.331802][T10003] ? get_pid_task+0x2a/0x250 [ 174.331827][T10003] ? __pfx_core_sys_select+0x10/0x10 [ 174.331847][T10003] ? find_held_lock+0x2b/0x80 [ 174.331873][T10003] ? get_pid_task+0xfc/0x250 [ 174.331921][T10003] ? __pfx_set_user_sigmask+0x10/0x10 [ 174.331941][T10003] ? __mutex_unlock_slowpath+0x35d/0x930 [ 174.331963][T10003] do_pselect.constprop.0+0x238/0x270 [ 174.331990][T10003] ? __pfx_do_pselect.constprop.0+0x10/0x10 [ 174.332017][T10003] ? ksys_write+0x1ac/0x250 [ 174.332039][T10003] __x64_sys_pselect6+0x149/0x1c0 [ 174.332065][T10003] do_syscall_64+0x123/0x790 [ 174.332085][T10003] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.332103][T10003] RIP: 0033:0x7f395ad9e159 [ 174.332117][T10003] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 174.332134][T10003] RSP: 002b:00007f395bce5028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 174.332152][T10003] RAX: ffffffffffffffda RBX: 00007f395b025fa0 RCX: 00007f395ad9e159 [ 174.332164][T10003] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000040 [ 174.332174][T10003] RBP: 00007f395bce5090 R08: 0000000000000000 R09: 0000000000000000 [ 174.332185][T10003] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 174.332196][T10003] R13: 00007f395b026038 R14: 00007f395b025fa0 R15: 00007ffe286b57a8 [ 174.332220][T10003] [ 174.391686][ T2549] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 174.392579][ T2549] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 174.392594][ T2549] usb 10-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 174.392604][ T2549] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 174.392630][ T2549] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 174.392644][ T2549] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 174.393905][ T2549] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 174.393919][ T2549] usb 10-1: Product: syz [ 174.393926][ T2549] usb 10-1: Manufacturer: syz [ 174.402637][ T2549] cdc_wdm 10-1:1.0: skipping garbage [ 174.402649][ T2549] cdc_wdm 10-1:1.0: skipping garbage [ 174.405476][ T2549] cdc_wdm 10-1:1.0: cdc-wdm0: USB WDM device [ 174.405489][ T2549] cdc_wdm 10-1:1.0: Unknown control protocol [ 174.591154][ T5814] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 174.611096][ T1356] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 174.741654][ T5814] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 174.742556][ T5814] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 174.742576][ T5814] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 174.742587][ T5814] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 174.742608][ T5814] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 174.742628][ T5814] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 174.743934][ T5814] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 174.743947][ T5814] usb 6-1: Product: syz [ 174.743956][ T5814] usb 6-1: Manufacturer: syz [ 174.746543][ T5814] cdc_wdm 6-1:1.0: skipping garbage [ 174.746553][ T5814] cdc_wdm 6-1:1.0: skipping garbage [ 174.748812][ T5814] cdc_wdm 6-1:1.0: cdc-wdm1: USB WDM device [ 174.748823][ T5814] cdc_wdm 6-1:1.0: Unknown control protocol [ 174.767286][ T1356] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 174.768228][ T1356] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 174.768249][ T1356] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 174.768265][ T1356] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 174.768301][ T1356] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 174.768323][ T1356] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 174.769662][ T1356] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 174.769681][ T1356] usb 5-1: Product: syz [ 174.769694][ T1356] usb 5-1: Manufacturer: syz [ 174.774363][ T1356] cdc_wdm 5-1:1.0: skipping garbage [ 174.774379][ T1356] cdc_wdm 5-1:1.0: skipping garbage [ 174.778223][ T1356] cdc_wdm 5-1:1.0: cdc-wdm2: USB WDM device [ 174.778239][ T1356] cdc_wdm 5-1:1.0: Unknown control protocol [ 174.803141][ T5814] usb 10-1: USB disconnect, device number 10 [ 174.912096][T10012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 174.912625][T10012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 174.927607][T10011] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10011 comm=syz.3.1350 [ 174.960028][ T2549] usb 6-1: USB disconnect, device number 43 [ 174.977087][ T5877] usb 5-1: USB disconnect, device number 47 [ 175.347230][ T43] kauditd_printk_skb: 5 callbacks suppressed [ 175.347248][ T43] audit: type=1400 audit(1790398941.112:962): avc: denied { read write } for pid=10016 comm="syz.5.1351" name="mtrr" dev="proc" ino=4026531995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 175.347513][ T43] audit: type=1400 audit(1790398941.112:963): avc: denied { open } for pid=10016 comm="syz.5.1351" path="/167/proc/mtrr" dev="proc" ino=4026531995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 175.348231][T10017] type mismatch for 0000,1000 old: write-back new: write-combining [ 175.348299][ T43] audit: type=1400 audit(1790398941.112:964): avc: denied { ioctl } for pid=10016 comm="syz.5.1351" path="/167/proc/mtrr" dev="proc" ino=4026531995 ioctlcmd=0x4d05 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 175.570893][T10032] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1356'. [ 175.601053][ T7976] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 175.678044][T10034] device-mapper: table: 248:0: : unknown target type [ 175.678063][T10034] device-mapper: ioctl: error adding target to table [ 175.716680][T10039] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=39115 sclass=netlink_route_socket pid=10039 comm=syz.0.1360 [ 175.772931][ T7976] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 175.773810][ T7976] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.978571][ T7976] cdc_acm 10-1:1.0: ttyACM0: USB ACM device [ 176.011086][ T1356] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 176.161124][ T1356] usb 5-1: Using ep0 maxpacket: 32 [ 176.161752][ T1356] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 176.162691][ T1356] usb 5-1: config index 0 descriptor too short (expected 156, got 27) [ 176.162705][ T1356] usb 5-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 176.162719][ T1356] usb 5-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 176.162737][ T1356] usb 5-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 176.162750][ T1356] usb 5-1: config 0 interface 0 has no altsetting 0 [ 176.164644][ T1356] usb 5-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 176.164658][ T1356] usb 5-1: Product: syz [ 176.164665][ T1356] usb 5-1: Manufacturer: syz [ 176.164673][ T1356] usb 5-1: SerialNumber: syz [ 176.166128][ T1356] usb 5-1: config 0 descriptor?? [ 176.376850][T10042] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 176.378548][T10042] xt_MASQUERADE: bad rangesize 10242 [ 176.380743][ T43] audit: type=1400 audit(1790398942.142:965): avc: denied { set_context_mgr } for pid=10044 comm="syz.1.1362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 176.392886][ T43] audit: type=1400 audit(1790398942.162:966): avc: denied { ioctl } for pid=10044 comm="syz.1.1362" path="socket:[33307]" dev="sockfs" ino=33307 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 176.395066][ T43] audit: type=1400 audit(1790398942.162:967): avc: denied { listen } for pid=10041 comm="syz.0.1361" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 176.395385][ T43] audit: type=1400 audit(1790398942.162:968): avc: denied { accept } for pid=10041 comm="syz.0.1361" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 176.396197][T10046] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1362'. [ 176.495884][T10054] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1363'. [ 176.495898][T10054] tipc: Invalid UDP bearer configuration [ 176.495915][T10054] tipc: Enabling of bearer rejected, failed to enable media [ 176.530358][T10056] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1364'. [ 176.563311][ T1356] ldusb 5-1:0.0: Interrupt in endpoint not found [ 176.565363][ T1356] usb 5-1: USB disconnect, device number 48 [ 176.635986][T10066] xt_hashlimit: size too large, truncated to 1048576 [ 176.696020][T10064] FAULT_INJECTION: forcing a failure. [ 176.696020][T10064] name failslab, interval 1, probability 0, space 0, times 0 [ 176.696053][T10064] CPU: 2 UID: 0 PID: 10064 Comm: syz.3.1368 Not tainted syzkaller #0 PREEMPT(full) [ 176.696075][T10064] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 176.696086][T10064] Call Trace: [ 176.696093][T10064] [ 176.696101][T10064] dump_stack_lvl+0x100/0x190 [ 176.696150][T10064] should_fail_ex.cold+0x5/0xa [ 176.696178][T10064] should_failslab+0xc2/0x120 [ 176.696206][T10064] kmem_cache_alloc_noprof+0x92/0x6a0 [ 176.696229][T10064] ? do_getname+0x35/0x390 [ 176.696264][T10064] do_getname+0x35/0x390 [ 176.696295][T10064] __x64_sys_symlinkat+0x8b/0xe0 [ 176.696325][T10064] do_syscall_64+0x123/0x790 [ 176.696347][T10064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 176.696366][T10064] RIP: 0033:0x7f395ad9e159 [ 176.696383][T10064] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 176.696403][T10064] RSP: 002b:00007f395bce5028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 176.696423][T10064] RAX: ffffffffffffffda RBX: 00007f395b025fa0 RCX: 00007f395ad9e159 [ 176.696435][T10064] RDX: 0000200000000200 RSI: ffffffffffffff9c RDI: 0000200000000080 [ 176.696447][T10064] RBP: 00007f395ae3506b R08: 0000000000000000 R09: 0000000000000000 [ 176.696458][T10064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 176.696469][T10064] R13: 00007f395b026038 R14: 00007f395b025fa0 R15: 00007ffe286b57a8 [ 176.696495][T10064] [ 177.052662][T10085] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 177.052884][T10085] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.132204][ T1356] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 177.209535][T10091] device-mapper: table: 248:0: : unknown target type [ 177.209554][T10091] device-mapper: ioctl: error adding target to table [ 177.259469][T10094] netlink: 272 bytes leftover after parsing attributes in process `syz.0.1379'. [ 177.306740][T10096] kAFS: unable to lookup cell 'syz0' [ 177.314451][ T1356] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 177.315262][ T1356] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 177.315276][ T1356] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 177.315286][ T1356] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 177.315308][ T1356] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 177.315322][ T1356] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 177.316515][ T1356] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 177.316528][ T1356] usb 6-1: Product: syz [ 177.316537][ T1356] usb 6-1: Manufacturer: syz [ 177.321374][ T1356] cdc_wdm 6-1:1.0: skipping garbage [ 177.321386][ T1356] cdc_wdm 6-1:1.0: skipping garbage [ 177.353943][ T1356] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 177.353957][ T1356] cdc_wdm 6-1:1.0: Unknown control protocol [ 177.420607][T10103] device-mapper: table: 248:0: zero-length target [ 177.420618][T10103] device-mapper: ioctl: error adding target to table [ 177.455702][T10105] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 177.455718][T10105] device-mapper: ioctl: error adding target to table [ 177.515157][T10109] device-mapper: ioctl: Target spec extends beyond end of parameters [ 177.515167][T10109] device-mapper: ioctl: unable to find target [ 177.545378][ T3273] hid-generic 0007:0008:F0000000.0003: unknown main item tag 0x7 [ 177.545476][ T3273] hid-generic 0007:0008:F0000000.0003: item fetching failed at offset 12/13 [ 177.546194][ T3273] hid-generic 0007:0008:F0000000.0003: probe with driver hid-generic failed with error -22 [ 177.611294][ T1356] usb 6-1: USB disconnect, device number 44 [ 177.659774][ T43] audit: type=1400 audit(1790398943.422:969): avc: denied { name_bind } for pid=10115 comm="syz.3.1389" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 177.665921][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.666395][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.666709][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.666903][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.667140][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.667339][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.667577][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.667772][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.667964][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.668169][ T43] audit: type=1400 audit(1790398943.432:970): avc: denied { read } for pid=10115 comm="syz.3.1389" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 177.668893][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.669093][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.669542][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.669750][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.669980][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.670180][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.670442][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.670642][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.670833][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.671305][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.671456][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.671611][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.671758][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.671906][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.672053][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.672402][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.672559][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.672711][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.672861][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.673010][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.673161][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.673310][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.673744][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.673948][T10118] jfs: Unknown parameter 'discardrnel/warn_count' [ 177.735788][T10126] 9p: Unknown access argument Ì: -22 [ 177.768124][T10129] FAULT_INJECTION: forcing a failure. [ 177.768124][T10129] name failslab, interval 1, probability 0, space 0, times 0 [ 177.768146][T10129] CPU: 3 UID: 0 PID: 10129 Comm: syz.3.1393 Not tainted syzkaller #0 PREEMPT(full) [ 177.768159][T10129] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 177.768166][T10129] Call Trace: [ 177.768170][T10129] [ 177.768176][T10129] dump_stack_lvl+0x100/0x190 [ 177.768197][T10129] should_fail_ex.cold+0x5/0xa [ 177.768214][T10129] should_failslab+0xc2/0x120 [ 177.768231][T10129] __kmalloc_cache_noprof+0x91/0x6d0 [ 177.768250][T10129] ? rfkill_fop_open+0x1cc/0x480 [ 177.768270][T10129] rfkill_fop_open+0x1cc/0x480 [ 177.768287][T10129] ? __pfx_rfkill_fop_open+0x10/0x10 [ 177.768303][T10129] misc_open+0x26d/0x450 [ 177.768316][T10129] ? __pfx_misc_open+0x10/0x10 [ 177.768328][T10129] chrdev_open+0x234/0x6a0 [ 177.768344][T10129] ? __pfx_chrdev_open+0x10/0x10 [ 177.768359][T10129] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 177.768381][T10129] do_dentry_open+0x6ab/0x14d0 [ 177.768394][T10129] ? __pfx_chrdev_open+0x10/0x10 [ 177.768411][T10129] vfs_open+0x82/0x3f0 [ 177.768429][T10129] path_openat+0x19fa/0x2440 [ 177.768448][T10129] ? __pfx_path_openat+0x10/0x10 [ 177.768468][T10129] do_file_open+0x20e/0x430 [ 177.768485][T10129] ? __pfx_do_file_open+0x10/0x10 [ 177.768510][T10129] ? _raw_spin_unlock+0x28/0x50 [ 177.768526][T10129] ? alloc_fd+0x471/0x7a0 [ 177.768545][T10129] do_sys_openat2+0x10f/0x1e0 [ 177.768568][T10129] ? __pfx_do_sys_openat2+0x10/0x10 [ 177.768586][T10129] ? putname+0xb1/0x110 [ 177.768602][T10129] ? kmem_cache_free+0x127/0x6c0 [ 177.768617][T10129] __x64_sys_openat+0x12d/0x210 [ 177.768634][T10129] ? __pfx___x64_sys_openat+0x10/0x10 [ 177.768657][T10129] do_syscall_64+0x123/0x790 [ 177.768671][T10129] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 177.768684][T10129] RIP: 0033:0x7f395ad9e159 [ 177.768694][T10129] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 177.768705][T10129] RSP: 002b:00007f395bce5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 177.768717][T10129] RAX: ffffffffffffffda RBX: 00007f395b025fa0 RCX: 00007f395ad9e159 [ 177.768724][T10129] RDX: 0000000000020800 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 177.768732][T10129] RBP: 00007f395ae3506b R08: 0000000000000000 R09: 0000000000000000 [ 177.768738][T10129] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 177.768745][T10129] R13: 00007f395b026038 R14: 00007f395b025fa0 R15: 00007ffe286b57a8 [ 177.768760][T10129] [ 177.770460][T10129] 9p: Unknown access argument Ì: -22 [ 177.848439][ T43] audit: type=1400 audit(1790398943.612:971): avc: denied { nlmsg_read } for pid=10131 comm="syz.3.1394" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 177.929186][T10137] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1396'. [ 177.929200][T10137] tipc: Invalid UDP bearer configuration [ 177.929263][T10137] tipc: Enabling of bearer rejected, failed to enable media [ 177.970523][T10139] xt_hashlimit: size too large, truncated to 1048576 [ 177.986860][T10144] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1398'. [ 178.185058][T10159] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.4278648832.0), cmd(9) [ 178.243431][T10157] smpboot: CPU 1 is now offline [ 178.328247][T10157] smpboot: CPU 3 is now offline [ 178.378161][T10164] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1405'. [ 178.378223][T10164] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1405'. [ 178.727058][T10177] F2FS-fs (nbd1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 178.727121][T10177] F2FS-fs (nbd1): Can't find valid F2FS filesystem in 1th superblock [ 178.727309][T10177] F2FS-fs (nbd1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 178.727320][T10177] F2FS-fs (nbd1): Can't find valid F2FS filesystem in 2th superblock [ 178.808813][T10174] syzkaller0: entered promiscuous mode [ 178.808828][T10174] syzkaller0: entered allmulticast mode [ 178.997040][ T5814] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 179.068847][T10188] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 179.069382][T10188] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 179.080342][T10195] netlink: 272 bytes leftover after parsing attributes in process `syz.0.1416'. [ 179.090035][T10193] device-mapper: table: 248:0: : unknown target type [ 179.090045][T10193] device-mapper: ioctl: error adding target to table [ 179.104167][ T5814] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 179.201131][T10200] bond0: entered allmulticast mode [ 179.201191][T10200] bond_slave_0: entered allmulticast mode [ 179.201202][T10200] bond_slave_1: entered allmulticast mode [ 179.208691][T10199] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=47711 sclass=netlink_route_socket pid=10199 comm=syz.0.1418 [ 179.221457][T10200] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=47711 sclass=netlink_route_socket pid=10200 comm=syz.0.1418 [ 179.369531][ T5894] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 179.511129][ T3273] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 179.682022][ T3273] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 179.682932][ T3273] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 179.682947][ T3273] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 179.682957][ T3273] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 179.682978][ T3273] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 179.682992][ T3273] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 179.684254][ T3273] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 179.684313][ T3273] usb 6-1: Product: syz [ 179.684322][ T3273] usb 6-1: Manufacturer: syz [ 179.688653][ T3273] cdc_wdm 6-1:1.0: skipping garbage [ 179.688663][ T3273] cdc_wdm 6-1:1.0: skipping garbage [ 179.725411][ T3273] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 179.725425][ T3273] cdc_wdm 6-1:1.0: Unknown control protocol [ 179.888342][ T5894] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 179.890610][T10202] FAULT_INJECTION: forcing a failure. [ 179.890610][T10202] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 179.890628][T10202] CPU: 2 UID: 0 PID: 10202 Comm: syz.1.1419 Not tainted syzkaller #0 PREEMPT(full) [ 179.890642][T10202] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 179.890649][T10202] Call Trace: [ 179.890653][T10202] [ 179.890657][T10202] dump_stack_lvl+0x100/0x190 [ 179.890691][T10202] should_fail_ex.cold+0x5/0xa [ 179.890708][T10202] _copy_to_user+0x32/0xd0 [ 179.890723][T10202] simple_read_from_buffer+0xcb/0x170 [ 179.890739][T10202] proc_fail_nth_read+0x1af/0x230 [ 179.890754][T10202] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 179.890769][T10202] ? rw_verify_area+0xce/0x6d0 [ 179.890787][T10202] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 179.890801][T10202] vfs_read+0x1e4/0xb40 [ 179.890813][T10202] ? lock_acquire+0x1d1/0x380 [ 179.890825][T10202] ? __fget_files+0x34/0x3d0 [ 179.890839][T10202] ? __pfx_vfs_read+0x10/0x10 [ 179.890850][T10202] ? find_held_lock+0x2b/0x80 [ 179.890866][T10202] ? __fget_files+0x215/0x3d0 [ 179.890882][T10202] ? __fget_files+0x21f/0x3d0 [ 179.890900][T10202] ksys_read+0x12a/0x250 [ 179.890912][T10202] ? __pfx_ksys_read+0x10/0x10 [ 179.890927][T10202] do_syscall_64+0x123/0x790 [ 179.890940][T10202] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 179.890952][T10202] RIP: 0033:0x7fbaddb5e98e [ 179.890962][T10202] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 179.890973][T10202] RSP: 002b:00007fbadea54fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 179.890985][T10202] RAX: ffffffffffffffda RBX: 00007fbadea556c0 RCX: 00007fbaddb5e98e [ 179.890992][T10202] RDX: 000000000000000f RSI: 00007fbadea550a0 RDI: 0000000000000009 [ 179.891010][T10202] RBP: 00007fbadea55090 R08: 0000000000000000 R09: 0000000000000000 [ 179.891018][T10202] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 179.891024][T10202] R13: 00007fbadde26038 R14: 00007fbadde25fa0 R15: 00007ffc7db87c38 [ 179.891039][T10202] [ 179.988824][ T3273] usb 6-1: USB disconnect, device number 45 [ 180.016035][T10204] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 180.016051][T10204] device-mapper: ioctl: error adding target to table [ 180.070456][T10181] ceph: No mds server is up or the cluster is laggy [ 180.177022][T10208] device-mapper: ioctl: Target spec extends beyond end of parameters [ 180.177033][T10208] device-mapper: ioctl: unable to find target [ 180.344458][T10215] bridge0: port 4(syz_tun) entered blocking state [ 180.344593][T10215] bridge0: port 4(syz_tun) entered disabled state [ 180.344715][T10215] syz_tun: entered allmulticast mode [ 180.345784][T10215] syz_tun: entered promiscuous mode [ 180.357984][T10215] bridge0: port 4(syz_tun) entered blocking state [ 180.358059][T10215] bridge0: port 4(syz_tun) entered forwarding state [ 180.502070][ T3273] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 180.637529][T10222] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1428'. [ 180.651758][ T3273] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 180.652757][ T3273] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 180.652772][ T3273] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 180.652781][ T3273] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 180.652801][ T3273] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 180.652814][ T3273] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 180.654837][ T3273] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 180.654850][ T3273] usb 5-1: Product: syz [ 180.654857][ T3273] usb 5-1: Manufacturer: syz [ 180.698355][ T3273] cdc_wdm 5-1:1.0: skipping garbage [ 180.698368][ T3273] cdc_wdm 5-1:1.0: skipping garbage [ 180.710258][ T3273] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 180.710271][ T3273] cdc_wdm 5-1:1.0: Unknown control protocol [ 180.792712][T10228] jffs2: notice: (10228) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 180.808585][ T43] kauditd_printk_skb: 1 callbacks suppressed [ 180.808598][ T43] audit: type=1400 audit(1790398946.572:973): avc: denied { setattr } for pid=10227 comm="syz.3.1431" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 180.940204][ T25] usb 5-1: USB disconnect, device number 49 [ 181.188559][T10246] netlink: 272 bytes leftover after parsing attributes in process `syz.1.1436'. [ 181.194263][T10248] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.194790][T10248] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.209309][ T3273] usb 10-1: USB disconnect, device number 11 [ 181.320062][ T43] audit: type=1400 audit(1790398947.082:974): avc: denied { mount } for pid=10254 comm="syz.1.1440" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 181.336841][ T43] audit: type=1400 audit(1790398947.102:975): avc: denied { read } for pid=10255 comm="syz.5.1437" dev="nsfs" ino=4026534023 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 181.336870][ T43] audit: type=1400 audit(1790398947.102:976): avc: denied { open } for pid=10255 comm="syz.5.1437" path="net:[4026534023]" dev="nsfs" ino=4026534023 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 181.339561][ T43] audit: type=1400 audit(1790398947.102:977): avc: denied { remount } for pid=10254 comm="syz.1.1440" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 181.403214][ T43] audit: type=1400 audit(1790398947.172:978): avc: denied { unmount } for pid=5727 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 181.702057][T10275] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1446'. [ 181.879147][T10284] 9p: Unknown access argument Ì: -22 [ 182.034092][T10291] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1452'. [ 182.034106][T10291] tipc: Invalid UDP bearer configuration [ 182.034123][T10291] tipc: Enabling of bearer rejected, failed to enable media [ 182.289834][T10300] 9p: Unknown access argument Ì: -22 [ 182.330273][T10302] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 182.330288][T10302] device-mapper: ioctl: error adding target to table [ 182.893889][T10322] device-mapper: ioctl: Invalid ioctl structure: name test, dev 32000000 [ 183.010441][T10328] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1463'. [ 183.153374][T10331] 9pnet_virtio: no channels available for device syz [ 183.467102][T10348] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1471'. [ 183.467123][T10348] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1471'. [ 183.780815][T10352] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1473'. [ 183.853782][T10352] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 183.868963][T10352] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 184.116141][ T43] audit: type=1400 audit(1790398949.882:979): avc: denied { read } for pid=10371 comm="syz.0.1476" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 184.116171][ T43] audit: type=1400 audit(1790398949.882:980): avc: denied { open } for pid=10371 comm="syz.0.1476" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 184.191988][T10372] netlink: 'syz.0.1476': attribute type 10 has an invalid length. [ 184.292810][T10372] team0 (unregistering): Port device team_slave_0 removed [ 184.305300][T10372] team0 (unregistering): Port device team_slave_1 removed [ 184.402244][ T2549] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 184.565724][ T2549] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 184.578632][ T2549] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 184.579013][ T2549] usb 10-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 184.579024][ T2549] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 184.579046][ T2549] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 184.579059][ T2549] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 184.588547][ T2549] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 184.588562][ T2549] usb 10-1: Product: syz [ 184.588570][ T2549] usb 10-1: Manufacturer: syz [ 184.674305][ T2549] cdc_wdm 10-1:1.0: skipping garbage [ 184.674322][ T2549] cdc_wdm 10-1:1.0: skipping garbage [ 184.686802][ T2549] cdc_wdm 10-1:1.0: cdc-wdm0: USB WDM device [ 184.686815][ T2549] cdc_wdm 10-1:1.0: Unknown control protocol [ 184.903444][ T50] usb 10-1: USB disconnect, device number 12 [ 185.131633][ T43] audit: type=1400 audit(1790398950.902:981): avc: denied { read } for pid=10389 comm="syz.1.1483" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 185.157770][T10392] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1484'. [ 185.157785][T10392] tipc: Invalid UDP bearer configuration [ 185.157801][T10392] tipc: Enabling of bearer rejected, failed to enable media [ 185.201150][ T43] audit: type=1400 audit(1790398950.962:982): avc: denied { write } for pid=10389 comm="syz.1.1483" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 185.354685][T10397] netlink: 'syz.0.1485': attribute type 1 has an invalid length. [ 185.354699][T10397] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1485'. [ 185.651798][T10405] 9p: Unknown access argument Ì: -22 [ 186.041806][ T43] audit: type=1400 audit(1790398951.812:983): avc: denied { read } for pid=10413 comm="syz.5.1493" name="mtd0" dev="devtmpfs" ino=714 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 186.041837][ T43] audit: type=1400 audit(1790398951.812:984): avc: denied { open } for pid=10413 comm="syz.5.1493" path="/dev/mtd0" dev="devtmpfs" ino=714 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 186.046539][ T43] audit: type=1400 audit(1790398951.812:985): avc: denied { ioctl } for pid=10413 comm="syz.5.1493" path="/dev/mtd0" dev="devtmpfs" ino=714 ioctlcmd=0x4d0d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 186.101088][ T50] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 186.274408][ T50] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 186.276709][ T50] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 186.276725][ T50] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 186.276734][ T50] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 186.276755][ T50] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 186.276767][ T50] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 186.280792][ T50] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 186.280806][ T50] usb 5-1: Product: syz [ 186.280813][ T50] usb 5-1: Manufacturer: syz [ 186.309965][ T50] cdc_wdm 5-1:1.0: skipping garbage [ 186.309977][ T50] cdc_wdm 5-1:1.0: skipping garbage [ 186.315968][ T50] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 186.315980][ T50] cdc_wdm 5-1:1.0: Unknown control protocol [ 186.639090][T10411] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1492'. [ 186.665711][T10411] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1492'. [ 186.818020][ T50] usb 5-1: USB disconnect, device number 50 [ 187.421402][ T3273] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 187.594721][ T3273] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 187.597450][ T3273] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.816164][ T3273] cdc_acm 10-1:1.0: ttyACM0: USB ACM device [ 188.227619][T10461] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1507'. [ 188.254489][T10463] comedi comedi3: comedi_config --init_data is deprecated [ 188.272126][T10463] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1508'. [ 188.274942][ T25] usb 10-1: USB disconnect, device number 13 [ 188.291346][T10463] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1508'. [ 188.431545][T10467] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1510'. [ 188.431572][T10467] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1510'. [ 188.467136][ T5806] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 188.467165][ T5806] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 188.471227][ T5806] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 188.471252][ T5806] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 188.516326][T10467] 9p: Unknown access argument Ì: -22 [ 189.038320][ T10] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 189.200504][ T43] audit: type=1400 audit(1790398954.962:986): avc: denied { getopt } for pid=10477 comm="syz.5.1515" lport=51 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 189.202792][T10482] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1514'. [ 189.202808][T10482] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1514'. [ 189.214404][ T10] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 189.215642][ T10] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 189.215664][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 189.215677][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 189.215688][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 189.215700][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 189.215711][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 189.215723][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 189.215735][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 189.215746][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 189.215758][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 189.215770][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 189.215781][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 189.215793][ T10] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 189.215803][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 189.215814][ T10] usb 5-1: config 1 interface 0 altsetting 0 has 12 endpoint descriptors, different from the interface descriptor's value: 14 [ 189.252411][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 189.252427][ T10] usb 5-1: Product: syz [ 189.252435][ T10] usb 5-1: Manufacturer: syz [ 189.252442][ T10] usb 5-1: SerialNumber: syz [ 189.284493][T10473] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 189.284549][T10473] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 189.284597][T10473] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 189.284643][T10473] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 189.284688][T10473] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 189.284734][T10473] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 189.284779][T10473] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 189.284823][T10473] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 189.284867][T10473] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 189.284913][T10473] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 189.284957][T10473] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 189.352270][ T10] keyspan 5-1:1.0: Keyspan 2 port adapter converter detected [ 189.352929][ T10] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 7 [ 189.373814][ T10] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 189.375601][ T10] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 189.390154][ T10] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 190.288632][ T25] usb 5-1: USB disconnect, device number 51 [ 190.378920][T10496] kAFS: Invalid Command on /proc/fs/afs/cells file [ 190.525495][ T25] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 190.547434][ T25] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 190.556339][ T25] keyspan 5-1:1.0: device disconnected [ 191.312998][T10520] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1525'. [ 191.313011][T10520] tipc: Invalid UDP bearer configuration [ 191.313029][T10520] tipc: Enabling of bearer rejected, failed to enable media [ 191.345556][T10407] Set syz1 is full, maxelem 65536 reached [ 191.632459][T10532] netlink: 'syz.3.1530': attribute type 1 has an invalid length. [ 191.770858][T10528] mmap: syz.0.1528 (10528) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 191.854823][ T43] audit: type=1400 audit(1790398957.622:987): avc: denied { cmd } for pid=10533 comm="iou-wrk-10534" path="/dev/ublk-control" dev="devtmpfs" ino=706 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 192.013296][T10545] __nla_validate_parse: 1 callbacks suppressed [ 192.013310][T10545] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1533'. [ 192.060480][ T43] audit: type=1400 audit(1790398957.822:988): avc: denied { append } for pid=10546 comm="syz.5.1534" name="card1" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 192.200520][ T43] audit: type=1400 audit(1790398957.962:989): avc: denied { setopt } for pid=10555 comm="syz.3.1536" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 192.209068][T10556] 9pnet_virtio: no channels available for device syz [ 192.522509][ T5744] Bluetooth: hci4: link tx timeout [ 192.534726][ T43] audit: type=1400 audit(1790398958.302:990): avc: denied { read } for pid=10563 comm="syz.1.1539" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 192.552406][ T5744] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 192.555157][ T5744] Bluetooth: hci4: link tx timeout [ 192.555174][ T5744] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 192.559999][ T5744] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 192.561917][ T5744] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 192.575959][ T5744] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 192.753589][ T43] audit: type=1400 audit(1790398958.522:991): avc: denied { create } for pid=10575 comm="syz.1.1543" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 192.853148][T10579] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1544'. [ 192.853163][T10579] tipc: Invalid UDP bearer configuration [ 192.853181][T10579] tipc: Enabling of bearer rejected, failed to enable media [ 193.015412][T10587] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1548'. [ 193.115103][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.115470][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.272404][T10595] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 193.596505][T10607] netlink: 272 bytes leftover after parsing attributes in process `syz.5.1556'. [ 193.665718][T10608] netlink: 'syz.0.1557': attribute type 1 has an invalid length. [ 193.665739][T10608] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1557'. [ 194.009951][T10613] kvm: pic: non byte write [ 194.242474][T10629] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1563'. [ 194.348649][T10623] netlink: 'syz.0.1562': attribute type 1 has an invalid length. [ 194.356132][T10632] x_tables: ip6_tables: rpfilter match: used from hooks INPUT, but only valid from PREROUTING [ 194.631147][ T5744] Bluetooth: hci4: command 0x0406 tx timeout [ 194.716971][T10640] 9p: Bad value for 'rfdno' [ 194.750019][T10648] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1569'. [ 194.750034][T10648] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1569'. [ 194.998674][ T43] audit: type=1400 audit(1790398960.762:992): avc: denied { open } for pid=10650 comm="syz.5.1571" path="/dev/ttyqe" dev="devtmpfs" ino=397 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 195.038714][ T56] Bluetooth: hci1: Frame reassembly failed (-84) [ 195.178593][ T43] audit: type=1400 audit(1790398960.942:993): avc: denied { lock } for pid=10653 comm="syz.1.1572" path="socket:[37531]" dev="sockfs" ino=37531 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 195.188916][T10655] misc userio: The device must be registered before sending interrupts [ 195.294210][T10661] tipc: Enabling of bearer rejected, failed to enable media [ 195.336101][T10667] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 195.336117][T10667] device-mapper: ioctl: error adding target to table [ 195.770831][T10682] netlink: 'syz.5.1580': attribute type 1 has an invalid length. [ 195.770845][T10682] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1580'. [ 196.002611][T10689] ------------[ cut here ]------------ [ 196.002620][T10689] 1 [ 196.002623][T10689] WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0x2137/0x3300, CPU#2: syz.0.1583/10689 [ 196.008723][T10689] Modules linked in: [ 196.010840][T10689] CPU: 2 UID: 0 PID: 10689 Comm: syz.0.1583 Not tainted syzkaller #0 PREEMPT(full) [ 196.013902][T10689] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 196.017168][T10689] RIP: 0010:__alloc_frozen_pages_noprof+0x2137/0x3300 [ 196.019319][T10689] Code: 13 00 00 39 84 24 98 00 00 00 0f 85 4a fa ff ff e9 91 f6 ff ff 80 3d a6 82 bb 0e 00 0f 85 9d e2 ff ff c6 05 99 82 bb 0e 01 90 <0f> 0b 90 e9 8d e2 ff ff 31 c0 e9 5f ec ff ff 48 8b 7c 24 08 48 c7 [ 196.025630][T10689] RSP: 0018:ffffc90007cbf728 EFLAGS: 00010246 [ 196.027909][T10689] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 196.030426][T10689] RDX: 0000000000000000 RSI: 000000000000000d RDI: 0000000000040cc0 [ 196.033007][T10689] RBP: 000000000000000d R08: 0000000000000000 R09: 0000000000000009 [ 196.035479][T10689] R10: 000000000000000d R11: 0000000000000000 R12: 0000000000040cc0 [ 196.037946][T10689] R13: 1ffff92000f97f41 R14: 0000000000000000 R15: 1ffff92000f97eff [ 196.040489][T10689] FS: 00007f84a1bb46c0(0000) GS:ffff8880d5d52000(0000) knlGS:0000000000000000 [ 196.043335][T10689] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 196.045477][T10689] CR2: 0000200000001340 CR3: 0000000063b5e000 CR4: 0000000000352ef0 [ 196.047981][T10689] Call Trace: [ 196.049030][T10689] [ 196.049980][T10689] ? lock_acquire+0x1d1/0x380 [ 196.051530][T10689] ? is_bpf_text_address+0x25/0x1a0 [ 196.053202][T10689] ? find_held_lock+0x2b/0x80 [ 196.054739][T10689] ? is_bpf_text_address+0x8a/0x1a0 [ 196.056384][T10689] ? is_bpf_text_address+0x8a/0x1a0 [ 196.058063][T10689] ? bpf_ksym_find+0x128/0x1c0 [ 196.059550][T10689] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 196.061584][T10689] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 196.063551][T10689] ? kernel_text_address+0x8d/0x100 [ 196.065132][T10689] ? unwind_get_return_address+0x59/0xa0 [ 196.067010][T10689] ? arch_stack_walk+0xa6/0xf0 [ 196.068486][T10689] ? tomoyo_path_number_perm+0x46d/0x580 [ 196.070265][T10689] ? stack_depot_save_flags+0x27/0x9f0 [ 196.072008][T10689] ? __lock_acquire+0x5c0/0x1f40 [ 196.073572][T10689] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 196.075398][T10689] ? policy_nodemask+0xed/0x4f0 [ 196.076960][T10689] alloc_pages_mpol+0x201/0x550 [ 196.078527][T10689] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 196.080311][T10689] ? avc_has_extended_perms+0x201/0x1080 [ 196.082184][T10689] ? find_held_lock+0x2b/0x80 [ 196.083705][T10689] ___kmalloc_large_node+0xe8/0x130 [ 196.085448][T10689] __kmalloc_large_node_noprof+0x1c/0x70 [ 196.087288][T10689] __kmalloc_noprof+0x5a8/0x840 [ 196.088836][T10689] ? __lock_acquire+0x5c0/0x1f40 [ 196.090392][T10689] ? drm_syncobj_array_find+0x34/0x3a0 [ 196.092151][T10689] drm_syncobj_array_find+0x34/0x3a0 [ 196.093873][T10689] drm_syncobj_reset_ioctl+0x20b/0x370 [ 196.095634][T10689] ? __pfx_drm_syncobj_reset_ioctl+0x10/0x10 [ 196.097666][T10689] ? drm_dev_exit+0x41/0x60 [ 196.099115][T10689] ? drm_dev_exit+0x41/0x60 [ 196.100551][T10689] drm_ioctl_kernel+0x1f3/0x3e0 [ 196.102131][T10689] ? __pfx_drm_syncobj_reset_ioctl+0x10/0x10 [ 196.104027][T10689] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 196.105715][T10689] drm_ioctl+0x5e6/0xc60 [ 196.107175][T10689] ? __pfx_drm_syncobj_reset_ioctl+0x10/0x10 [ 196.109057][T10689] ? __pfx_drm_ioctl+0x10/0x10 [ 196.110575][T10689] ? __fget_files+0x34/0x3d0 [ 196.112325][T10689] ? selinux_file_ioctl+0x13b/0x290 [ 196.114043][T10689] ? selinux_file_ioctl+0xb6/0x290 [ 196.115655][T10689] ? __pfx_drm_ioctl+0x10/0x10 [ 196.117252][T10689] __x64_sys_ioctl+0x18e/0x210 [ 196.118835][T10689] do_syscall_64+0x123/0x790 [ 196.120378][T10689] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.122433][T10689] RIP: 0033:0x7f84a399e159 [ 196.123893][T10689] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 196.130601][T10689] RSP: 002b:00007f84a1bb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 196.133888][T10689] RAX: ffffffffffffffda RBX: 00007f84a3c26180 RCX: 00007f84a399e159 [ 196.137010][T10689] RDX: 0000200000000100 RSI: 00000000c01064c4 RDI: 0000000000000007 [ 196.139739][T10689] RBP: 00007f84a3a3506b R08: 0000000000000000 R09: 0000000000000000 [ 196.142553][T10689] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 196.145228][T10689] R13: 00007f84a3c26218 R14: 00007f84a3c26180 R15: 00007ffc179c5158 [ 196.148022][T10689] [ 196.149094][T10689] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 196.151623][T10689] CPU: 2 UID: 0 PID: 10689 Comm: syz.0.1583 Not tainted syzkaller #0 PREEMPT(full) [ 196.154759][T10689] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 196.158187][T10689] Call Trace: [ 196.159322][T10689] [ 196.160325][T10689] dump_stack_lvl+0x100/0x190 [ 196.161904][T10689] vpanic+0x553/0x970 [ 196.163242][T10689] ? __pfx_vpanic+0x10/0x10 [ 196.164772][T10689] panic+0xd1/0xe0 [ 196.166040][T10689] ? __pfx_panic+0x10/0x10 [ 196.167836][T10689] check_panic_on_warn.cold+0x19/0x34 [ 196.169628][T10689] ? __alloc_frozen_pages_noprof+0x2137/0x3300 [ 196.171643][T10689] __warn.cold+0x191/0x318 [ 196.173087][T10689] __report_bug+0x30f/0x440 [ 196.174618][T10689] ? __alloc_frozen_pages_noprof+0x2137/0x3300 [ 196.176617][T10689] ? __pfx___report_bug+0x10/0x10 [ 196.178301][T10689] ? __lock_acquire+0x5c0/0x1f40 [ 196.179913][T10689] ? __alloc_frozen_pages_noprof+0x2137/0x3300 [ 196.181905][T10689] report_bug+0xb3/0x220 [ 196.183291][T10689] ? __alloc_frozen_pages_noprof+0x2137/0x3300 [ 196.185462][T10689] handle_bug+0x16a/0x2a0 [ 196.187049][T10689] exc_invalid_op+0x17/0x50 [ 196.188593][T10689] asm_exc_invalid_op+0x1a/0x20 [ 196.190213][T10689] RIP: 0010:__alloc_frozen_pages_noprof+0x2137/0x3300 [ 196.192435][T10689] Code: 13 00 00 39 84 24 98 00 00 00 0f 85 4a fa ff ff e9 91 f6 ff ff 80 3d a6 82 bb 0e 00 0f 85 9d e2 ff ff c6 05 99 82 bb 0e 01 90 <0f> 0b 90 e9 8d e2 ff ff 31 c0 e9 5f ec ff ff 48 8b 7c 24 08 48 c7 [ 196.198757][T10689] RSP: 0018:ffffc90007cbf728 EFLAGS: 00010246 [ 196.201054][T10689] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 196.204396][T10689] RDX: 0000000000000000 RSI: 000000000000000d RDI: 0000000000040cc0 [ 196.207834][T10689] RBP: 000000000000000d R08: 0000000000000000 R09: 0000000000000009 [ 196.211259][T10689] R10: 000000000000000d R11: 0000000000000000 R12: 0000000000040cc0 [ 196.214611][T10689] R13: 1ffff92000f97f41 R14: 0000000000000000 R15: 1ffff92000f97eff [ 196.217935][T10689] ? lock_acquire+0x1d1/0x380 [ 196.219849][T10689] ? is_bpf_text_address+0x25/0x1a0 [ 196.221491][T10689] ? find_held_lock+0x2b/0x80 [ 196.223110][T10689] ? is_bpf_text_address+0x8a/0x1a0 [ 196.225287][T10689] ? is_bpf_text_address+0x8a/0x1a0 [ 196.227538][T10689] ? bpf_ksym_find+0x128/0x1c0 [ 196.229644][T10689] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 196.232351][T10689] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 196.234878][T10689] ? kernel_text_address+0x8d/0x100 [ 196.236772][T10689] ? unwind_get_return_address+0x59/0xa0 [ 196.238586][T10689] ? arch_stack_walk+0xa6/0xf0 [ 196.240110][T10689] ? tomoyo_path_number_perm+0x46d/0x580 [ 196.241857][T10689] ? stack_depot_save_flags+0x27/0x9f0 [ 196.243748][T10689] ? __lock_acquire+0x5c0/0x1f40 [ 196.245352][T10689] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 196.247380][T10689] ? policy_nodemask+0xed/0x4f0 [ 196.248869][T10689] alloc_pages_mpol+0x201/0x550 [ 196.250410][T10689] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 196.252105][T10689] ? avc_has_extended_perms+0x201/0x1080 [ 196.253935][T10689] ? find_held_lock+0x2b/0x80 [ 196.255447][T10689] ___kmalloc_large_node+0xe8/0x130 [ 196.257411][T10689] __kmalloc_large_node_noprof+0x1c/0x70 [ 196.259331][T10689] __kmalloc_noprof+0x5a8/0x840 [ 196.260861][T10689] ? __lock_acquire+0x5c0/0x1f40 [ 196.262448][T10689] ? drm_syncobj_array_find+0x34/0x3a0 [ 196.264139][T10689] drm_syncobj_array_find+0x34/0x3a0 [ 196.265797][T10689] drm_syncobj_reset_ioctl+0x20b/0x370 [ 196.267572][T10689] ? __pfx_drm_syncobj_reset_ioctl+0x10/0x10 [ 196.269381][T10689] ? drm_dev_exit+0x41/0x60 [ 196.270759][T10689] ? drm_dev_exit+0x41/0x60 [ 196.272176][T10689] drm_ioctl_kernel+0x1f3/0x3e0 [ 196.273673][T10689] ? __pfx_drm_syncobj_reset_ioctl+0x10/0x10 [ 196.275481][T10689] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 196.277418][T10689] drm_ioctl+0x5e6/0xc60 [ 196.279077][T10689] ? __pfx_drm_syncobj_reset_ioctl+0x10/0x10 [ 196.281190][T10689] ? __pfx_drm_ioctl+0x10/0x10 [ 196.283199][T10689] ? __fget_files+0x34/0x3d0 [ 196.285207][T10689] ? selinux_file_ioctl+0x13b/0x290 [ 196.287481][T10689] ? selinux_file_ioctl+0xb6/0x290 [ 196.289753][T10689] ? __pfx_drm_ioctl+0x10/0x10 [ 196.291830][T10689] __x64_sys_ioctl+0x18e/0x210 [ 196.293761][T10689] do_syscall_64+0x123/0x790 [ 196.295368][T10689] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.297490][T10689] RIP: 0033:0x7f84a399e159 [ 196.299075][T10689] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 196.305100][T10689] RSP: 002b:00007f84a1bb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 196.307728][T10689] RAX: ffffffffffffffda RBX: 00007f84a3c26180 RCX: 00007f84a399e159 [ 196.310099][T10689] RDX: 0000200000000100 RSI: 00000000c01064c4 RDI: 0000000000000007 [ 196.312605][T10689] RBP: 00007f84a3a3506b R08: 0000000000000000 R09: 0000000000000000 [ 196.315101][T10689] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 196.317744][T10689] R13: 00007f84a3c26218 R14: 00007f84a3c26180 R15: 00007ffc179c5158 [ 196.320246][T10689] [ 196.321767][T10689] Kernel Offset: disabled [ 196.323231][T10689] Rebooting in 86400 seconds..