last executing test programs: 31.080331757s ago: executing program 0 (id=152): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x123100, 0x0) (async) r1 = accept4$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x0, @loopback}, &(0x7f0000000340)=0x10, 0x80000) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000380)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async) r2 = memfd_create(&(0x7f00000001c0)='\x02A\xbbL\xeb\xbd]\x9c\x9aU\x9c\xcbb\xcc\xfa0\xf5JoeN\x8c\x86\xfa\xb3\x0e&\xfe\xa8NF\x96\t\x01\xceJ\xc3\x8f+\xe8\xa7v\xa34h\x17]\xa1\xe6\x80\xfaj\xfe\x11\x0e\xed6\x00\a\x00\x00\x00\x00\f\xd7\xe7\xdb?\xf3\xd9\xa3\xd6a\x1a\xfch}7K\xca\x90KA\x02\xd6\x94\xf0l\xcc\xd0\x14\x8c\xb3!\xa8\xea\xca>\x03\x16\xdc~\xea\xfd\x05\x13\x88Xa\x16\xcb\xe4', 0x3) pwrite64(r2, &(0x7f0000000180)='q', 0x1, 0x100004) (async) r3 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) setsockopt$sock_int(r3, 0x1, 0x20, &(0x7f0000000080)=0x1, 0x4) (async) sendfile(r3, r2, 0x0, 0xd39a) (async) r4 = socket$netlink(0x10, 0x3, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="5000000002060108000034e4000000000000000805000400000000000900020073797a3100000000050005000200000016000300686173683a6e65742c706f72742c6e65740000000500010007"], 0x50}, 0x1, 0x0, 0x0, 0x20044000}, 0x8042) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001880)=ANY=[@ANYBLOB="60000000090603000000000000000000050000000900020073797a3100000000050001000700000038000780060004404e21000005000700ff0000000c000180080001400a0101010c00028008000140e00000020c00148008000140"], 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3fe}, 0x94) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000040)='GPL\x00'}, 0x94) (async) syz_emit_ethernet(0x8d, &(0x7f0000000ac0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd6000800000b800f2760000000000000000000d0000000000ff02000000000000000000000000010100004001fdcafa04d5df2e91370c3de08e3190486d5fdfdc492aa279e0f855fca03f5684b1a7b1d884804ae5c997d37a297f1aee73c9a90b7bd252a6", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="500200009078000061ce3da14a437b557960e5d3e0af10c115e0a25cb278431bbee4f054d7ba221915fc64683abea8ab398cceeabd56e19d67c669005b85c5c584232a52f870f3f7ab2685"], 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r10, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYRES32], 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x4e014) (async) recvmsg(r9, &(0x7f000000c1c0)={0x0, 0x0, 0x0}, 0x20) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000005400010d2bbd70000200000007000000", @ANYRES32=r6, @ANYBLOB="20000100", @ANYRES32=r6, @ANYRES8=r4], 0x38}, 0x1, 0x0, 0x0, 0x22004804}, 0x40080c0) (async) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000900)=ANY=[@ANYBLOB="300000021a00f0ffffffffffffff000081001000000000000000000014000100000000000080000000000624050d000059393033b34db38e7ff8820706e80867705f5d1509e491a57aa16ba123dc2c4b58858e4f88ee7e343d1cc219b01389f852330fb725a4e271e230c8b4aa1f4a9757132344d7df9304c7343a5af10052327b1cde4155503d9496370b72a20fbd24950f0754b39c30e5d3c85a76672dec28672c1aee67199709b316e485d02d193f7aa8b965192f4fb75f34cfa965d246d265a502dc838dd539f81d3d9149d66d2504c86d7bcc269fd702"], 0x30}}, 0x0) 29.66068681s ago: executing program 0 (id=166): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000001240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="030000f601000000000014"], 0x46) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="180000002f00090027bd7000fddbdf250400000004001980"], 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 29.479862345s ago: executing program 0 (id=168): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r3, 0x0, 0x2e, &(0x7f0000001080)={0x2, {{0x2, 0x4e21, @multicast1}}, {{0x2, 0x4e1f, @dev={0xac, 0x14, 0x14, 0x43}}}}, 0x108) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000000)='source', &(0x7f0000000180)='4,.:\x00\x8e\xf7\xd4\t\xe1\xae\x19\xe5\xf7c\x84\x9c\x06\x00\x00\x00\x11\x01\xf2 \xec\xbe#\'S\xc4\xbd\xb5\x1e\x98MM\x06\x1a\x7f5U\x18\x90\x99\xb2\xfa\')Z\x9ew\xae\xe8\xdd\b\t\xf0\xc4\xbfj\xb6\x88/)~\x93E\x1d4\xa7\xcb\xeb\x0f\xd4(\xb6>\x87\xc3\t\xb0\x80\xf7\xe6\x8b?\xa4\xb3\b\x00\x81\xbe\xea\x1f\xfe\xed\x9d\x1a\x8aQ\xafQ\x06\x0fJ\xc0\xc0=}\x7f\xaeB\xb1\xed\xa4\xf3c#\xbe\b\x1f\xa4L[\xfa\x01Uu\xe0\x8b\x94E\xda\xd9j\x93\xc8~\xd9\x82\x8f\xcam\x17\xa2\xed\xf3\xc3_h\xfc6\t\x96@\xaf\xe6\xd0!)\xc3\xcfe\xe1g\xe7\xe5F\xbdC\xd9$\x9b@\xaf\xc2j1p\xa9\xb2d\x92\x8fo\xcbg\x9fZ\xd7\xef\xb2z\xf5\x0fq\x7f\b\xc2\xa7\x90\xc5\xf5Y\xbc\xf1s\x93X\xb6\xeb\x86&\xa7\x14%B', 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r4, 0x0, r5, 0x0, 0x8000f28, 0x5) sendmmsg$inet(r4, &(0x7f0000003240)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000000c0)="21ce69b44d694da1942fe60b573cae0295acfd319d160515e01a6aae0ebd289bbaa6e3de8b3e9e2ac1973218cf5687f5656f42a14836a8cd093dae6991e5f3c552753b02efee502d2fa5ebd65d9adcc43bf85e9044028aae746dc73e66fdbadbe25912d2543d32dfb8d3b9f70a8877db31ae45537aa9efec6e49728fbb11080f38ebf674cb789006cfd35affdf863ad174d0f161d04e3680a22ef6b188ea25d0eb", 0xfffffe3e}, {&(0x7f0000000240)="c556507959dc0d7f4b8dcdbae6f6b1410e8ec9d09802b442e392b756c312922d2872c4d958c84f61a5913105a078476c7acf114482d8eb8ae0609d1192ea1a564a14078e5de4304262e1e0a2c8d9037a428523acab5a85c46dc041ae1d90d9d1c8f87200b34ee579f06609a100f50ee1979b39f6f5d82d456bc2c2145d10afed28ebf934c0d3155da308cd6db84e077de7dc2174f01e5c64c17f9632d105aec4bc05227449fe57f20ffe936c8024428d808e6ef93914dec9d4e34c31e97c6289aaf59101ab90a30082c93e269f65490cb2d29109964a03000ecfe5e9a6eebce3a3418857788ef51e5d1281603c6a95ffe26875487feb8b8175fdd8994d786f6314476fddfe57f13ec0ad78bbc5a43354bbf161e55b70f2f867ac719e500db5b5ba3208a3f9d12e18723f528cff4da5986742f63443f1de3f39a0de87f5751861763923ae51ca4ab619c715f266a451590a162a04c5e120224b60806d422735ef51db2d987fea151bd86e03cda49f3685039dd41d0a07d593cb0a8e70c5b9d463ef0060f7078bf6d89d686d197cc9046f9d72aada7416a7833efd2de570d65972af11c448da006f7e4b33a780af6be1573d6340ee61d6202d29cb9fb43be9d88ff7cd300229201f360682e5e1dde7adffa0b00b711c153fb2beaa65f8cc8244d54b50fd52a1c962d25695c54b59e99005194b0f929526f8870350d7d3d6776c84ee3295a5ed6ac2e91b52c21491ab09b4669ff6e44bc695583b7a885b14d8778791edd01ab81568fd81df88a34d9560305eaa1f76ed6c60ea2a7a4e8b78f6c17111f748c5089df0bec573725357e7d6e9afacb9c5dc477cd3a13e980181490c16af5a8f83e1d3606baf181b6764f368447e1bacc69b332cf9ad90c4c7e036cd5ff8c8772ce55a687a25fc102ee90d264f320145e3d0f315d7393a7aff0396204e84a40108bfa55909641e9ff6be73519bf7d2be70a260c4dd3f8ce2c410893da950af63f33c464f1093336ca0a949ca702b30c426da56668af8c99743f18dd4d5eb9ae4cb453273e2ba8b181e47d4ff2cb16cc4ed71fd2d2352edc8975007ad4c0b3cc05991ec19078696bd58f81805ec135c2ccfb9cc3396cc6783ac90f335b4aaf7a1a274efc6182279a028c05ee5295922f66765bb1676cd67c82e920a780471e7029705e38abdfdabdb8bf50df6a4d98640c8b0941f66bc9d0cbfcbc74beb311f8ab81dce853d8119fa5da5b59dc708113feaf4d4ccc71721b76b741aa8237786bfa697ca4b9e38ff1dc41485cf34a1eefcba1dc499a11b048306a3016f9c8856b096ae1aa92f9e4e2ce0a455f02b64aea9c7e9dfc7a46ae58ce11df463a377256b3d5ab87b9d4c435a8664470f414724cd6efa12da1b1b21a332597dadba708b28cbb1d12f04f366e3130cf5fd7248967459e2ecb5b1e0e87088f5a046ae3d75b49feee17c7857f96d7703325feaaf4b2a212fb11943d3264af841d1a8fcba435f55efd8023a18b24961933ef3d564b669bdb8b3a185c387726daa0533307957759731c78e6c0c93b22217220f9250817a97befd6a8e0ed47fb1036292e4d66f2c2d32727d3bb87eb29e6ad57cb18a2803d57eb226c1b709740f351c3c2fb5d92bf7005cd24da69fc40400d54a07cd96fcad12f8b47619878a95bbd6f7e02ceab305580e835f148d57dbed79eb1f49421c8cdd2aed4a6e364fae2ab16ca085f4328b9a494b77bc864cf0d58639e1bf23eb067086b1282e110a3abd31a60709bf51b3c9628d00172c508c4080cddfbcb56ef8bfc7a9683e6d66e6aa2d448116499f33fe3bf619d080de2ffc463b3e80fbe657ffb3bebb0539be7d0141dcaf9a133e67687fc2ad763fc6f4420c42d32d7e6a3aac5663fb03aff53bee6814df704982afef2c965c11dba5b941a931e49c3e44e7955eebe059d42a0329c56e1ace10da0b83d705f025cb2c78ca084ea541023ee5f966084aa33b2a4292a08a27a92bca78c545ca483a5832356d1a469652ab4191b316d39fb46fce570e79d9bcefd02e02909db6b121f41280a2b17ad0676cb2639977743ffc214c23a339651c3fd4fa395b63676e646894f563c87875b1c5df26606711639874f1c10a7eaab0677ec983d1bc25e9284bd51fc08d6647f506796f786204a8049a32f48eb01d55366c4b1c1369f747b76b4e0a3c9a58a930c0108813c6df61fe5c62fb2460e9b264ec39400f7a510bfe5fc022c4108224d468823979429addcf19722072efc7b25e554a1c0cdb5a5661e6c30230ecda5c76e4a2649ca5dd774481649a5988576f5a51de32c812d743dac64c2d3689b01e66f83209bd9d1ad81670c46e4a720409e9a0582ebdfca121fdec9cbe818676eedd13e9832b66ca8ed0adc5dc3aa04bc0edc84372594183e0326791e6791d0b2a3d6967ec00fb2bc486a1a515e234965140939ae4d617b22cbeafc0b7f820ebef4442aa78eb82241f78d977c912a0f72d4eddbddf8332b4b8035d78f29655867846642cdc7b86323e70b3e091f5b76d9332a80bd27dfbc118355b76206e79cf679852f9294701b4657e071a78bba83ade9d624cabd25f3d9ce74b4c37825d41a8d650f3a9c7c0a37f1c099a7e546a178be3251b4b9b0642b1091fa6b2a03fcf8368cd4d09e4b54498c4c7cd6d2f756df1a61518a19f92beaef722b161e195c6d86a40a8dde587cedc7d98444d6f12384a31a55f9a897f4a9117dc64067a8c45318853db048421f7a4d1f2278b269565e6385fc2d9afc2c3db69756607856c85e7ff32afd9d14422ddb45d6abbabe838d93a1775ebc405ec5090b31a6f1d31dad8537e78934bdf615568e8f252578247941b0fba6fbdb6ca5e77ab0ee4e458374ad9906e71f556d26928d1b4876b701175487567bc7932385432833383437088d500e40ca449f23bbe3a827e1959d3950e3b928b548cae7018cd12fd7e41341eeca37d88ac12e4c2d610d80c57b52c0da927a0d3c465eda9cbcaf2285a0bbbb20c925d9493ad9fae474c3c133462be9505efb4e96172dbfcfc0412d20a07871f9eb1b79d2c677ff3bd0a5a1ed5c1ca482bc5a381b7573792cd3b3ebb095df1360cb2b4ded9dd235d19ab8afdd6f5423fa487d26fe7e0de77598b94f4587700f2dccbdbc45e7e8d39075dcd10c08fdddbdf39dd6477eba888fca4018ba0445b069ed26d213288dedd02c0552164e2223ac378acac3690ec015e4205a673d8cd7125a80592e6d688449a0b3d8749852f1925121d02c7b3783705d0b9b72ea5769a4fdfaf6167b8a4f6bef6d89815b8dac1c8689ac9e3bbfc1ff96efa39773a44c3da51e50b77d6b0cde8f145dc0f1f38626dc9615c0cdfc79cc53488cba3ad3ba4540e537c4f4b982b1a7eab831d12794ee4b59d2f128f6fb8e4a2c35c81ae32252d57e9dd306227417b031f8b8eb34265bd00fd62708ca41bda095791a13202731e7bb94d4978fab6aed6d6bd1073747d1a32cdff79e020d56738513c9d15c5c5a771d5dc549c25773c21590124cee5f198f1e47c64f13d3b312a0e2ff15555b6451fe2ba4afeba850695e84efab37da538433208aab2d370f5df245b9cf02754c31653b130578791d2516990cd083eb4aa856adf41a89963ae1072440db50a171857c2f6d30cd555eb623a756316dd50d566559b256ca4f587721048b64692b21547e12d15c21d5187e2604d91fa81d9dfe90c55c92ea10f45930029c06856833bfd38d35262b130c497e80f3613bfb1ecc97510f58183ec5e9db22fc78e9a4f4ec9c1417904ca2ef36621ddb654434160bfe33d6adfd23f0f8d009dccc2d12e093a89aa75544f7b2bb315af47cd40ac9bbe4f7db33622c681a1fe30c8cc26810f77c661ac198e6722a34c869f5baacab55b5b364f2f98217b4ef36309abed83a34f8f11e3e3e4fb468b48e4f0bc9e807ce9a19a11819187c14551f1acecea8a58ec210be5ce0fec1c7fdcfb51de2fcbdb96863b910fcfe11c6746c208cdfa1b7f8549c85ecee1a0c07c2133d3eb90e950f5bc3ae27c95d2f9edeedbbabe1d7c2242888723044aa6b5dc93742ad881562bc1f318be01c47c938c89d3265e6ca781e57cf22b51723c1b831b4aaff0817b9558ff0086ca9ab6007e4f17b5adad0e919c2adcc89a7842e23736c7e7a14f63b8e993a5fd7523c49ceea09817fa171e9346ca5a141aadbb31546a10bc05243ef86b9795893df115afb47eb85c837295baef3b9ec84b623d442c251c42421a0a36aca7d9f11cd27309e6ffcd34d280d7219e398c98767114259ada81164b11aa84a1b2009d88ffbf049d1ce917f32fbcfc3537ea120c38405e97026165216904bc26eb9beb06a477256ebc7a1016a4d73db072dad7b6860b0275696a90edbf930c6401adba9c0a13cacfab128829a1d60932af07389c019c68e23ce88f386456c0544a323af6743f86da383065522d446c7f722470469297cdfd1d56dc6513162cecc4bd9ac5b4204c8ec828ffb90799d2584fd30d5b2085193bf4b22e92fd8275e63750496c8f00b4f37fec0e7a5464aa9a17a8671ac7aba6fc3c319399d4f7089f9b9388b52af34f327e2b781388603b303ee9f83b6db6ac98c4b4cc1b355f5e2fff31204c38c0daf65becabdd9269d3f8ee20ddbc4ac6da2bc3b5227813e19605dca46b6ab680a22638a744e7791ae50e4b2854ec032b72194c64b7589fca7b4bb3ea2134d2b9e15dc7cb2d8ba2787b838898b57a6dc71a71f45bd6bbe0593398e7c20a70d8015af6d972167e7162e39c75e5919f97509e13b49bce27aa1dc0aacdc188ca24c3e1b9d4e8d479c2bd43e26030014ae391bf63d68a0f951d09daf3ba04344027aefe13c02524d780929c75b5238c7c66759c6ec19c1390a2588f8e923250a32e1a730717ae714b0f20c4fd6e5b54931345dd4867aac590d07f269eb2d5a92c965b372fd06290ff4056dc8491c7e4fbf145766a7c2d1bfa8e1eb93b31c4b392f16e34fbaf79627929c6fc890cc8cb998e1bf811be438efa414a52669deb960180e7b47ac3dab03a96a627615ff0be1926e8d50c36f4ac692571867ca4d5654602b2e0f1d2a8e729ed59b9b7ea7c36837117e5067a0a0d4896d925225c79b588ee77ad193f292d569202f86d247f397c84fd9c3578efbd2729f604959c136d905e9bedbbfdcc8efee3a653f795dfcec10a825ae31b3a0a3e7d7fe32f7e4b36a5c108ff7bdde6a0b36c5aba4dce91bbba4c2a24687e5013e36a8df69e236fbf968f314548804ac5b567ac8b3e95cbcf523f96fdaff0a6e7d5a2cf740f30a852c9d39a201578cdfcf2d43dfe99c3231b3bc364595486acc8a3166d42a0412c8c991c3ed43e937ce623936176090e3f20d4180aaa29aedd0c5ffc9ead34d955355a99420e78fdcdbee25febe4690e05065dac27e3f0ab567485319e46c2f4e8a6e90c751a5337af0735ca61a2c4659d10d3fcae4ba4a69ec41d894b89b9e80ac86e444c0e41f325e89fb269d113433a36004ec8a270cf61a141372907d51190eaf0fc2624d4dcbdd737420e0550bdf10071bcd1b5391fb4242ec95ff206e2b614a07aebdf22ae49c6adb7f9036bc833c6a36cdb7af3d7b3a1810da0f3a110d90193bca720fdda94ce85464d296c83b40e56e62e44fae34f7170d3275758001e95f3152150d197c420a992e5b2d53f31f2355a92fdf6a087621afcaf31b89df76342eac277197aaa834936b2e3f8c4cea9f20fb9ad95daa60c897b22f0093b5fe34eef8b11c2d81f291b7fc09c1b8f2ee849a0768a7622c35d8e61858a", 0x1000}, {&(0x7f0000001240)="319db9e457b4533b56b5db0d23d78ad9e3982f82df968053a99654839cd488192f024130aafa1e0818eee385d59582b3a3568a3c5dcc85811f29ea04d06fffd93cb7e70242664b809c38e85f8a67c5d0a910d8d1325ac98926fda8c88ba926233702239cc288e207de11888316dc82193985b760f2592dbc925c86dc1b60e57dbbb41b19f5b91d050a3484060d17204a55869158dc99ed98bbf87b4be3c57ff0456cf2d3e941c6724e5517261fed37cee09f756f046c0ca1", 0xb8}, {&(0x7f0000001300)="7614302176d7b33e590edbdc403bcf75b6fdff4a58b2af6c0f2af66a8d8eeed62d5106678364382355", 0x29}, {&(0x7f0000001340)="a05c7336076186d40ab122e5ec3b0269bff4cbebf4d0ccc3e2f7bbe3c08c03431fb631cc5f1e4eba59f4f5011238de601cdf6c221eae6404167300d703c1731267763df7cb8dab13a9ee480dec5958d82b67148c91baaeebb80e3d9998b45b9943637f15ce6edf740637e8dfcbf3eebdbf05cdd72e217f506cb9b585f2256a0ad1bef05e4b8cf14637f633b06f406827a724685d113cfee74a877ed2c6a2e57e155c44c658f05f9a1c7e097dbd8ac51bbf46425d8cdb1fa70a3a52acb52db856c4cffe06809ba1b67f61013ea70d09f6eaa017b4092c02a34b6f5a8b5592b2", 0xdf}], 0x5}}], 0x1, 0x4040000) openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0xf0202, 0x3) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8000000, 0x3, 0x2c8, 0x0, 0xffffffff, 0xffffffff, 0x110, 0xffffffff, 0x228, 0xffffffff, 0xffffffff, 0x228, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private1, [0xff000000, 0xffffff00, 0x6dc8f3d6512d1aed, 0xffffffff], [0xff, 0xff000000, 0xff000000], 'bond_slave_0\x00', 'batadv0\x00', {}, {}, 0x84, 0x2, 0x3, 0xe}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x17}, @loopback, [], [], 'veth1\x00', 'wlan1\x00', {}, {0x1fe}}, 0x0, 0xa8, 0xe8}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "4199fc6505f93cb13d0617f57700e5dba5afc775234fe52cca718b1ef125"}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x328) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') preadv(r6, &(0x7f0000000c40)=[{&(0x7f0000000140)=""/127, 0x7f}], 0x1, 0x0, 0x1) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x510, 0x2e0, 0xd0, 0x2e0, 0xd0, 0xd0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x570) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001b40)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r0, @ANYRES16=r0, @ANYRESDEC=r0, @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x48d4}, 0x40010) 28.600183147s ago: executing program 0 (id=182): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e21, @broadcast}}, 0x80, 0xaec5, 0x58, 0x5, 0x40, 0x6, 0x8}, &(0x7f00000004c0)=0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000500)={r2, @in={{0x2, 0x4e22, @remote}}, 0x4, 0x7, 0x8, 0x8, 0x92, 0x1, 0xfb}, 0x9c) listen(r1, 0x1ff) r3 = mq_open(&(0x7f0000000100)='&\x00', 0x40, 0x100, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r5, @ANYBLOB="07002abd5248ffdbdf2507ff000008000300", @ANYRES32=r6, @ANYBLOB="0c00990001000c0069000000140004002f6163766c616e3100000000000000000400cc00080005000a"], 0xe4}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) r7 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x801, 0x0) write$rfkill(r7, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) mq_notify(r3, &(0x7f00000003c0)={0x0, 0xd, 0x1, @thr={0x0, 0x0}}) read(r3, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000180)={0x0, 0x1c, "5f3c9d676ca0c2757b4b0a6d7e193ef53ad759eb87444b58c2639359"}, &(0x7f0000000200)=0x24) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r8, &(0x7f0000000340)="18000000010005", 0x7) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x4}, 0x1) write(r0, &(0x7f0000000240)="f75800d962db5b6c235a77b8f6f720f175cd7cd880a737689d8d7ad0b9beba5ce7aeaf45072b64d38fcb416b4023b61b56bfd6897693b1c4980c449de8b9de9c28056f94f63d37279cbeab40146056e21a38dcbc5dcd4549b406022d12d55808943f4058740f5d75f095f9dffbd0fe69406fd87e1264f4231298b0293b1f8c5ed44f5eec9278dff9127eb8e865362465f1a0916905f7d51e5db25507a9678a90c5c14948dc24187a2bea44e7a8513ac8cc06e0591d77714dcee8ac3a94b7290c7cbb5896aa0b778ba663b97271488cf0486b63eaabad5409e60d0b33ecff0779ec1ff3f026c386e2388e285175838464e797aa20c9a02c716e745850013c1cf10121b39ba43b7ea1e8c2237d0f128b90ee0c3aeef7cda7d1fbc7ac1d24730000000d0000000000000028af0fbf38a41dbe65d7d4a0c7eab4c7b51b7446e5c3fd1db1c7866080b7cb8af9f9ed8801b9ca49ea8b370237adca6b185c4c560be8e1", 0x160) 28.380446093s ago: executing program 0 (id=185): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/oops_count', 0x0, 0x0) readv(r0, &(0x7f0000000380)=[{&(0x7f0000000240)=""/237, 0xed}], 0x1) bpf$BPF_PROG_TEST_RUN_LIVE(0xa, &(0x7f00000001c0)={r0, 0x0, 0x30, 0x0, &(0x7f0000000140)="12d32ad0a77b9b7154a60b16127124771bf677a60278e107d680b85153d7983c3d633e9ef3753fcc16c8d6fecc4c0128", 0x0, 0xe3, 0x0, 0x3, 0x0, &(0x7f0000000180)='>${', 0x0, 0x2, 0x0, 0xffffc110}, 0x50) ioctl$NS_GET_OWNER_UID(r0, 0xb704, &(0x7f00000004c0)=0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) mount$9p_virtio(0x0, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000b40), 0x0, &(0x7f0000000200)={'trans=virtio,', {[{@dfltgid={'dfltgid', 0x3d, r3}}]}}) mount$fuseblk(&(0x7f0000000340), &(0x7f0000000440)='sys_mnt/block/zram0/comp_algorithm\x00', &(0x7f0000000480), 0x881001, &(0x7f0000000500)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x3}}, {@allow_other}, {@blksize={'blksize', 0x3d, 0x1400}}, {@default_permissions}, {@blksize={'blksize', 0x3d, 0x1f00}}], [{@fsuuid={'fsuuid', 0x3d, {[0x32, 0x61, 0x64, 0x62, 0x66, 0x35, 0x31, 0x51], 0x2d, [0x65, 0x61, 0x38, 0x33], 0x2d, [0x31, 0x38, 0x34, 0x63], 0x2d, [0x33, 0x32, 0x31, 0x31], 0x2d, [0x36, 0x32, 0x33, 0x61, 0x61, 0x33, 0x31, 0x36]}}}, {@fsmagic}, {@pcr={'pcr', 0x3d, 0x29}}, {@smackfsdef={'smackfsdef', 0x3d, '\'#'}}, {@dont_hash}, {@dont_appraise}]}}) r4 = creat(&(0x7f0000000000)='sys_mnt/block/zram0/disksize\x00', 0x19) r5 = openat(r4, &(0x7f0000000080)='sys_mnt/block/zram0/comp_algorithm\x00', 0x240f41, 0x27) write(r5, &(0x7f0000000300)='lzo-rle', 0x7) r6 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='sys_mnt/block/zram0/disksize\x00', 0x1, 0x0) syz_emit_vhci(&(0x7f0000003780)=@HCI_EVENT_PKT={0x4, @hci_ev_le_meta={{0x3e, 0x6}, @hci_ev_le_phy_update_complete={{}, {0x0, 0xc9, 0xff, 0x8}}}}, 0x9) write(r6, &(0x7f0000000400)='1', 0x1) 28.308156345s ago: executing program 0 (id=187): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000100), 0x24, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r1 = syz_clone(0x88200, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000380)={0x2140000, 0x0, 0x0, 0x0, {0x1a}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[r1], 0x1}, 0x58) process_vm_writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) 12.904858617s ago: executing program 32 (id=187): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000100), 0x24, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r1 = syz_clone(0x88200, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000380)={0x2140000, 0x0, 0x0, 0x0, {0x1a}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[r1], 0x1}, 0x58) process_vm_writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) 3.218982934s ago: executing program 2 (id=503): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000fcffffff00000000000000008500000036000000180100006420002500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000001800000850000000600000095"], &(0x7f00000000c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={r0, r2, 0x25, 0x0, @void}, 0x10) r3 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x80001, 0x0) ioctl$DRM_IOCTL_MAP_BUFS(r3, 0xc0186419, &(0x7f0000002c40)={0x4, &(0x7f0000000040)=""/98, &(0x7f0000002bc0)=[{0x0, 0x1000, 0xffffffff, &(0x7f0000000a80)=""/4096}, {0x1, 0x23, 0x1, &(0x7f0000001a80)=""/35}, {0x68, 0xf7, 0xffffffff, &(0x7f0000001ac0)=""/247}, {0x8, 0x1000, 0x704, &(0x7f0000001bc0)=""/4096}]}) syz_emit_ethernet(0x32, &(0x7f0000000a40)={@local, @random="991d32511a2a", @void, {@mpls_uc={0x8847, {[], @ipv4=@dccp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x68, 0x0, 0x38, 0x21, 0x0, @private=0xa010102, @multicast2}, {{0x4e21, 0x4e21, 0x4, 0x1, 0xd, 0x0, 0x0, 0x4, 0x5, "c50f7c", 0x2, "6d9bef"}}}}}}}, 0x0) 3.218366578s ago: executing program 2 (id=504): openat$sysfs(0xffffffffffffff9c, &(0x7f0000000600)='/sys/kernel/profiling', 0x1, 0x18f) (async) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000600)='/sys/kernel/profiling', 0x1, 0x18f) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_int(r0, &(0x7f0000000040)=0x1, 0xffffffffffffff4c) 3.138172042s ago: executing program 2 (id=505): r0 = fanotify_init(0x200, 0x2) r1 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0, @ANYBLOB="f7", @ANYRESDEC], 0x0) syz_usb_ep_write(r1, 0x81, 0x8, &(0x7f0000000080)="00012c615bc20000") (async) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB="2b09b1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) readv(r2, &(0x7f0000000040)=[{&(0x7f0000001640)=""/244, 0xf4}], 0x1) (async) fanotify_mark(r0, 0x1, 0x1010, 0xffffffffffffffff, 0x0) (async) pipe(&(0x7f0000005880)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$security_selinux(r3, &(0x7f00000000c0), &(0x7f0000000040)='system_u:object_r:dhcp_state_t:s0\x00', 0x1e, 0x0) (async) r4 = syz_usb_connect$hid(0x6, 0x3f, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x56a, 0x6b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x8, 0x80, 0x4, "", [{{0x9, 0x4, 0x0, 0x8, 0x1, 0x3, 0x1, 0x1, 0x1f, {0x9, 0x21, 0xf, 0x6, 0x1, {0x22, 0x7bc}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x1, 0xf2, 0x4c}}, [{{0x9, 0x5, 0x2, 0x3, 0x10, 0x5, 0x2, 0x5}}]}}}]}}]}}, &(0x7f0000000480)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x200, 0x2, 0x5, 0x5, 0x40, 0x10}, 0xe8, &(0x7f0000000180)={0x5, 0xf, 0xe8, 0x5, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "56361c72016f9d19475ce008a42b871a"}, @ss_container_id={0x14, 0x10, 0x4, 0x1, "166a6dec79d9ae523a6af7c26a3ed10b"}, @generic={0x5f, 0x10, 0x3, "2b9914012813aef5fe580f556eb8d2c7701495a2022bbece882484ac0a5c49f34fa1298e5c986648ae0ba5f933c94d4e6a314fede1f492a14e08ecf31b7adfc3cedcee285bbe0b299fc719873f6141766c991c5ec2e500701bfab338"}, @ptm_cap={0x3}, @generic={0x59, 0x10, 0x1, "4f7993082aa7e8210238f0ce098f9f117a9680087d44f49b6f2c3f949adc9bed925d9bb9c6dafa526b043ed7110903392827deafa2d923059af95019763dfa2a8063c10c3dd551bdff377ffffb865ba8276556c4dbbf"}]}, 0x5, [{0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x5}}, {0x7c, &(0x7f00000002c0)=@string={0x7c, 0x3, "9e3850fcd486c5fccc6097a8b49ef8b498cd7c522c1c311cd41fdc75ff7add87772c837b8324dea24ebe08823ae63fe3a3630566049a2056223bd84cb6ca1e971856c582506f37ed61872399e17c527b0b9663bd251e44025088b3f0003f5099855cd90c3b6f582e19fb71dbcc72ea40274b42f20d8acc8aff1d"}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x807}}, {0x1b, &(0x7f00000003c0)=@string={0x1b, 0x3, "68b8dc80c6e54b9eea04a174e2efaa156919907a7f781bb7ba"}}, {0x6a, &(0x7f0000000400)=@string={0x6a, 0x3, "e766954321530b42affb115b7f5e9bdf7e4881bd4fafe6037c967226c826362872fcc6b71eb51d5e2a91a5ad81a3323be4dbd0b4388b40bb4f775879eb8aaf58d1b2dffddb6ffa4f31836af9c2e7aa659d4c816694805c648ed8883f6715368effcb23e993c80413"}}]}) syz_usb_control_io$hid(r4, &(0x7f0000000700)={0x24, &(0x7f0000000500)={0x40, 0x30, 0x6b, {0x6b, 0x21, "16332c410e14cee9999c91c76c326c3b5a82b2c35ab8ade9fcb922e5359e5f14577c67f5033db6f15080e8a0bf6fe3f577cb3a3132771538c86db5ac76fefeb36d121d89dcee1bae0dc1135c3ab604c025cd375c1f583eb0e3f311abe25bdd7d4bfdf137e0d7ba01f9"}}, &(0x7f0000000580)={0x0, 0x3, 0xde, @string={0xde, 0x3, "f43def29701710a2ecf475929451f181eef8f993e85db1c950a77cddda2e261d81a3d986433e7c99df43b08993c37c999f48615a0a8a0394134895cf2781fed4e470281474d1132a44eddb8a85faa346b9e89cce4c48bcb97b451c4720d2a79e7e3477c894e63ee740a60c5fdc6db9cfac80fcfe02ed8e93869f8571359e0ffc75086e0847e4592b296ef7637d2ea5a0005740d46d85a58b31e8611506867fafd747e8f5e2cf1b321969e3eab60805665cec9e1b8eef98ac75ac217bb91d6b91468779ae4142b5a3fc18fdac71a64aacde8c385a50d9e5d0af65349c"}}, &(0x7f0000000680)={0x0, 0x22, 0x17, {[@main=@item_4={0x3, 0x0, 0x9, "75bc9800"}, @main=@item_012={0x1, 0x0, 0x8, 'H'}, @global=@item_012={0x2, 0x1, 0x0, 'M1'}, @local=@item_012={0x1, 0x2, 0x5, "c0"}, @global=@item_012={0x0, 0x1, 0x8}, @local=@item_4={0x3, 0x2, 0x9, "01cb3f52"}, @main=@item_4={0x3, 0x0, 0xa, "b464a2fc"}]}}, &(0x7f00000006c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0xc, 0x7, 0x1, {0x22, 0x92c}}}}, &(0x7f0000000b40)={0x2c, &(0x7f0000000840)={0x0, 0x5, 0xdb, "f40bfdf103d788fa3178879acf56946605c0889157d2a170c02aac6391ae36d79b5120b936ef91c081bb254ed5e92db2e7af68cabedc7b5d9dcc0ddb075cd5211ca28b92e82e362e7e0dcc27f02515189b8ccf31a605c1789fc18966029c99a14741ce2630c0d47f9227ede4f966be59b05736e9c7e56103395535f9f713b5fb1582fa69cfc6e0c378d1b56e2001917576ba0f8f1841f725e1b8622d8695a8119f19c90475c98862bf2a0d5f553492014a78e44a3063e8e8a3cd9180817b4e4b4c8ead457163677be86fd1758b41509eeebdb19a4298c4d72606c4"}, &(0x7f0000000940)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000980)={0x0, 0x8, 0x1, 0x10}, &(0x7f00000009c0)={0x20, 0x1, 0xfd, "6b6e7578ff37d43538ca02cb37e5eb15b2d8ac6296db46cf12e00e1564adcc862cd9ea691cdd84003be02d479f0bd3657c0f62eae55886af808bebbbfe218a7b53e06f8864feb8d3c393bc32cf3d1a9a69fe5e7cf02f814fb12c18e7056032df5571d7845620f087fcbafca30742a852b9027aab10bbe146b8cd75510935593dcf8349bd6b49e5bf039ef955babd7a6793f059432b138004b7e5c5e84e91ccdcd57e6948540b11f703d7d80ec51da3fa2365837fc01a16bb67cfedaf7cca6cea4a8e9c9c2e914ff110ed6aab577ef143764240eb9a07b1d4d0e84bf1d8804f423ea1fd346cb7ded534bf1fa4aa318b6ce97338b2f6e99b9c3ed29de99d"}, &(0x7f0000000b00)={0x20, 0x3, 0x1, 0x80}}) 2.25951288s ago: executing program 1 (id=520): timer_create(0x0, &(0x7f0000000080)={0x0, 0x28, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48) listen(0xffffffffffffffff, 0x5) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3000001, 0x11, r0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000040)=0x1, 0x14) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x608003) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000004b40)='./binderfs/binder-control\x00', 0x802, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, 0x0, 0x0}, 0x94) 1.010272737s ago: executing program 3 (id=544): r0 = syz_open_dev$loop(&(0x7f0000000000), 0x9, 0x80000) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000300)={'\x00', 0x1, 0x7, 0x801, 0x6, 0x800100000000}) 940.553619ms ago: executing program 3 (id=546): socket(0x10, 0x803, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x180) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='dyn']) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8880, 0x85) fadvise64(r0, 0x6907, 0x6fa2, 0x3) r1 = socket(0x10, 0x803, 0xfffffffd) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$l2tp6(0xa, 0x2, 0x73) socket$l2tp(0x2, 0x2, 0x73) r2 = syz_open_dev$midi(&(0x7f0000000240), 0x8000, 0x602040) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r2, 0xc0245720, &(0x7f0000000280)={0x1}) r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='ns\x00') lseek(r3, 0xb, 0x0) getdents64(r3, 0x0, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000080), 0xffe, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0x0, 0x2, 0x4, 0x0, 0x10, {}, {0x0, 0x1, 0x0, 0x3d, 0x0, 0x0, "a730ba01"}, 0x40, 0x1, {0x0}}) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000000)=0x1) socket$l2tp6(0xa, 0x2, 0x73) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000300), r5) sendmsg$NLBL_MGMT_C_ADDDEF(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000007c40)={&(0x7f0000007bc0)={0x34, r6, 0xa5c59466aaff822d, 0x70bd28, 0x25dfdbff, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @remote}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @private=0xa010101}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x48805}, 0x64040) 858.532623ms ago: executing program 3 (id=547): r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$llc_int(r0, 0x10c, 0x8, &(0x7f0000000000), 0x4) io_uring_setup(0x4dba, &(0x7f0000000040)={0x0, 0x159d, 0x800, 0x3, 0x2f}) syz_init_net_socket$llc(0x1a, 0x2, 0x0) (async) setsockopt$llc_int(r0, 0x10c, 0x8, &(0x7f0000000000), 0x4) (async) io_uring_setup(0x4dba, &(0x7f0000000040)={0x0, 0x159d, 0x800, 0x3, 0x2f}) (async) 857.521256ms ago: executing program 1 (id=548): keyctl$clear(0x11, 0xfffffffffffffffd) unshare(0x4000000) 856.896765ms ago: executing program 3 (id=549): mount(&(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='.\x00', &(0x7f0000000200)='ocfs2\x00', 0x200800, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/igmp6\x00') preadv(r1, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x40000000, 0x0) syz_emit_ethernet(0xa6, &(0x7f00000000c0)=ANY=[@ANYBLOB="ffffffffffffca0e506647514b29601200080070"], 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5800000010000104000002000000000000000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000300012800b00010067656e6576650000200002801400070020010000000000000000000000000000080001000100000008000a00", @ANYRES32], 0x58}, 0x1, 0x0, 0x0, 0x20004885}, 0x4054) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') r4 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) openat$binfmt(0xffffffffffffff9c, r4, 0x41, 0x1ff) prctl$PR_SET_SECUREBITS(0x1c, 0x15) setuid(0xee00) openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8924, &(0x7f00000000c0)={'wlan0\x00', 0x1}) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x1c, 0x2f, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x8, 0x18, 0x0, 0x0, @binary="02ac0f00"}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x4) 790.505186ms ago: executing program 1 (id=550): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=r1, @ANYRES64=0x0, @ANYRES8=r1, @ANYRES64=0x0, @ANYBLOB="3bef1bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x1) (async) r2 = syz_open_dev$dri(0x0, 0x200, 0x102) (async) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x4040800}, 0x4000) ioctl$DRM_IOCTL_MODE_CURSOR(r2, 0xc01c64a3, &(0x7f0000000100)={0x3, 0x0, 0x7ffffcd9, 0x7, 0x326, 0x89f, 0x1}) (async) close_range(0xffffffffffffffff, r2, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {0x7, 0x7fffffff}}, './file0\x00'}) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000180)={{0x17, @local, 0x4e22, 0x3, 'ovf\x00', 0x31, 0xfff, 0x3a}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e22, 0x3, 0x200, 0x4, 0xffff}}, 0x44) (async) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000340)={0x1d, r6, 0x80000, {0x2, 0xff, 0x6}, 0xfe}, 0x18) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@mcast1, 0xffffffff, 0x0, 0x2, 0x2, 0x9, 0xf}, 0x20) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r7, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/49, 0x210000, 0x800, 0x0, 0x2}, 0x1c) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0x90}) (async) ioctl(r8, 0x8b32, &(0x7f0000000040)) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r6, {0xfff2, 0xfff2}, {0xfff1, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050) 710.149446ms ago: executing program 1 (id=551): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x840, 0x41) r1 = openat(r0, &(0x7f0000000100)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='dwc3-generic-plat\x00', 0x12) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r3, 0x4048aec9, &(0x7f0000000380)={0x3, 0x0, @ioapic={0x2, 0x2, 0x800, 0x5, 0x0, [{0xd, 0x9, 0x2, '\x00', 0x1}, {0x86, 0x2, 0x26, '\x00', 0x1}, {0x4, 0xef, 0x8e, '\x00', 0xee}, {0xfb, 0x7, 0xd}, {0x13, 0xf, 0x2, '\x00', 0x5}, {0x0, 0x3, 0x5, '\x00', 0xd3}, {0xf, 0x0, 0x8, '\x00', 0x5}, {0x9, 0xdb, 0x1, '\x00', 0xd3}, {0x6, 0x23, 0x5, '\x00', 0x2}, {0xde, 0xc}, {0x40, 0x4, 0xf6, '\x00', 0x1}, {0xf5, 0x5, 0x4, '\x00', 0xb5}, {0x7, 0xe, 0x3, '\x00', 0x7}, {0x4, 0x0, 0x0, '\x00', 0xe9}, {0x10, 0x39, 0xc, '\x00', 0xcf}, {0x6c, 0x3f, 0x0, '\x00', 0x4}, {0x6e, 0x24, 0x1, '\x00', 0xa}, {0x7, 0x0, 0x8, '\x00', 0x9}, {0x7, 0x6, 0x0, '\x00', 0xfe}, {0x3, 0x9, 0x9, '\x00', 0x2}, {0x8, 0x6, 0x1, '\x00', 0x49}, {0xae, 0x2, 0x91, '\x00', 0xba}, {0x2, 0x8, 0x2, '\x00', 0xc3}, {0x5, 0xe, 0x54, '\x00', 0x9}]}}) (async) close(r1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x44) open_tree(r0, &(0x7f0000000240)='./sys\x00', 0x88100) (async) write(r4, &(0x7f00000001c0)='pcspkr\x00', 0x6) (async) close(r4) 688.119104ms ago: executing program 3 (id=552): r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_RUN(r0, 0xae80, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000001800010010000000fedbdf250a370000", @ANYRES32=0x0, @ANYBLOB="000000001400050000007fffffef000000000000000000042c865384b6d1aa349b8523b580cdf4b5b0b40e3cb108d3fecac99b2439b60373f49ec9f23f3c8d473045918c6ffe0e4fa97fc8616397da1642a6491d38ef59a9bc5400162b55fc5b4f1a737b47348f"], 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x0) 610.426533ms ago: executing program 1 (id=553): r0 = socket(0x28, 0x801, 0x0) connect$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x0, @my=0x0}, 0x10) (async) connect$unix(r0, &(0x7f00000000c0)=@file={0x0, './file1\x00'}, 0x6e) (async) r1 = openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$selinux_context(r1, &(0x7f0000000340)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) ioctl$SIOCPNADDRESOURCE(r0, 0x89e0, &(0x7f0000000040)=0x7) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="500015001013936fec0da4e241368bda0001040000000000000000000000001661b09ad2242a52d1e2bf7697d7520a7bb5a0ebcb43a0aba93976d5ec812227162896d2b638b2e6a43b5c155e477f06f868b8433209c23f52b3d2324595c8810d4334a8172b", @ANYRES32=r3, @ANYBLOB="0305000000000000300012800c0001006d6163766c616e00200002800a000400aaaaaaaaaaaa000008000300000000000800010010000000"], 0x50}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000010000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x8}, 0x94) 548.972492ms ago: executing program 1 (id=554): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) r1 = syz_open_dev$sg(&(0x7f00000001c0), 0x508d48d4, 0x40902) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000300)=ANY=[@ANYBLOB="0000000005000000a30c0395"]) sendmmsg$inet(r0, &(0x7f00000036c0)=[{{&(0x7f0000000200)={0x2, 0x4e25, @multicast1}, 0x10, 0x0}}, {{0x0, 0x0, &(0x7f0000001640)=[{&(0x7f0000000580)="b8b8436e2402e6abeade7161d583c775ef33629f79040f2f9fcf11633b3aa1964994ac5803e32126e694cf25756c9749c50ecf6e9f9dedc1b8827b8547a6d2c603e7b89631be59e1ce14e0adabcfd092783724ab8d4a6fd0d3b7294fea75d2a8fac091778455a099f2c3ed248a2e2eabc366d546e30dba7a81faa41ba0a9215a31723d6e81afa449dd8205509bbe9874e0e92479d0bb74d24e5a5dd35826aab8901c68f2d8524be169999d8f4f1a31cb2ff3cc339f74639c17a9c3a08f42323803d588a661afef5ea94146df81f5de5512849d4a934d332255ef2f552b35e0b6a550e4cef6d1211db89a2163817f84a45ee8a86f2b0f73e452e5be2f11a980f849cf52600e852237679351e5d9d90df385ad772f02cd08e87e89442fbc9c6d081b59000a85460027fc66d9ace62c21a0495f5f3d3bd752b6f26a570e5e99a812ce392b610d0f82124a51b71b7b1223a290b667d1f624f301e406f14f8c971c96251dbfea1e47e13885b0caced07b8a020d81620d90258da666e803fc2711e31047baf83d46e4bed49aca45f70f37d8d143fbc7f9f3a368711166db668c17739b28d67a754e48eeace7e5f00500657a2b5495c4abd89784a4c85e97a93251d564789e405abba00bf48cb7b68f92fab1b31e66a7a7441ccf6d68adba3af0d83ade29e25c54721dcf92a2bf0a3c8de5858deb3a7e537344a068f01625d226421c41c2b80bf4cdf212ab2cd47328d80d9abb152d58a70a85703e1237fc8f4695eb4d54dde0c4033cc5e7c778e45c6eff6694602df1a4e65095ebcaa8b3f991412972b62251480610e055c13a666d3daade8e9d736a3f6d29ebd857720d493b5e57db5ad3258cd4dccfdee05667c6d3540c0bc988bc38ef2e768108971305087112d396bada66f1b24c733a350e7968bf5aa81e162997db34a67757154f8c9de1fedcb8fb91f9b84c843685f11386355daaebd24c8107c0be19c1631135db7bd30d74ece50d490179307768b68322d761fc98ca4ee42367751b8cef30d35638b355e3255cd42857e865acef6efe56f9894c1bc84e5c2c10e7ef1ded00926362379e16aa542c57a5bf2609018ea674ed580d4c348eecaa69318e2a55ef74026a0b459d909dd3ba56fae4197f59177e8524eafdd1f2287412375f1bd6f6cd10914eb50be544fce875086d4d86ec0c347916e5875a5f917c5779f4333a806a7817bea2275df0d379c59061526ca857e7234951dd88d2022759dcc54e6724852463415c2765ca93417ff05573e7e244fa322a125b33f6f7153d43683ede91446c1211d128e24a7836a75d47f1c80e31cb9fc0838e9220cd881dac4e693d7641a01e51f3d00892379f4ea1f69e722ddf055606d51bf64ef39d6e8e1f97606cb2ab33ba714353c28c2b08264ab5573528e28e118598deec55c7ccbf597712cbd48a6d6c2474f142c4aa74fe93d703de0693c8dd63f2ab6eff05ee2a64ee689937d9c5c2bc86ea75e8a74b74261be10b7f07fd1cbe6403374518d625674cc73a940756c00314e02e469b91e1ca02dae1325af617dca14564976f2c16705e64abbf33779657a84066545f6e6a252107ada84285b279b855b597ddff35ce748a69389d7c0e96a5bb699706641fc48cc74c81f423cad5bd55576e799214dc201c9bdcd63c5b9cc97d843efe251e992a7844ff8117f09f6f9b4d8ae56093369e63d6586d29f69bde62b7aca165ed8a2fbfa53d14f42a5dbd58c5cb26cec523ff368633e87768da6cd5d0b4e450ba015acd6ee61b6b8e63905a7c5a6760af9ea1caa6c2c5c48ced3d9470e60d1451f6df68265109e81858f7c0724a84688dc0f6e838b98166d5524fd8b9b7007e1fa1cda4ecbb0f3ac25b87d4cf99501d6601154bb562b7bb53ffe3c0d8609d013cd257bbc5908d91a2dbcb623d5a578281ffb7026d459592942e86f572bb3d2e521f72ec0b20ac8b84e28c362d11bd91fd957b117cb0124dcb4f09562970edd8e34f4dcea1e7bec2670b6898e3ddaa3ec33a9a83945c1343d9d5ba01513fe482ff62620d28cf55ec22e3f7290f0096781952d4aae2bc163fb918fc60", 0x5c1}], 0x1}}], 0x2, 0x4a080) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'dummy0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000fbff27bd7002fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="14100400040004001c00128009000100766c616e000000000c000280060001000400000008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r5], 0x4c}, 0x1, 0x0, 0x0, 0x28001}, 0x8000002) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000240)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xff, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r6, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r6, 0xc0502100, &(0x7f00000003c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r6, 0x80082102, &(0x7f0000000080)={r7, 0x3, 0xffffffffffffffff, 0x5}) write$binfmt_misc(r0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000100)={'ip_vti0\x00', &(0x7f0000000280)={'syztnl1\x00', r5, 0x8, 0x20, 0x3, 0x2, {{0x17, 0x4, 0x3, 0x25, 0x5c, 0x66, 0x0, 0xb, 0x2f, 0x0, @multicast1, @dev={0xac, 0x14, 0x14, 0x2c}, {[@ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x44, 0xd6, 0x1, 0x4, [{@multicast2, 0x9}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x85cc}, {@multicast1, 0x100000}, {@remote, 0x90}, {@dev={0xac, 0x14, 0x14, 0x33}, 0x7fffffff}, {@empty, 0x2}, {@local, 0xd}, {@remote, 0x3ff}]}]}}}}}) 400.022142ms ago: executing program 4 (id=556): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) (async) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) (async) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0) (async) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) lseek(r3, 0x0, 0x2) fcntl$lock(r2, 0x25, &(0x7f0000002380)) preadv(r2, &(0x7f0000001e80)=[{&(0x7f0000000080)=""/4094, 0xffe}], 0x1, 0x33, 0x0) (async) ioctl$VT_GETMODE(r1, 0x5601, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000009500001d9500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$l2tp6(0xa, 0x2, 0x73) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4001}) (async) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', 0x1}) (async) r6 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r6, &(0x7f00000000c0)=@in={0x2, 0x270f, @rand_addr=0x64010101}, 0x10) (async) listen(r6, 0x5) (async) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f00000003c0)='batadv_slave_0\x00', 0x10) write$tun(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="0000080001031400e803140008004500005c000000004084b019640101026401010104d2270f"], 0x6a) (async) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000001300)={0xe, 0x18, 0xfa00, @id_tos={0x0, 0xffffffffffffffff, 0x0, 0x3, 0x1b}}, 0x20) (async) r7 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) (async) r8 = memfd_create(&(0x7f0000000700)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2) ftruncate(r8, 0xffff) (async) fcntl$addseals(r8, 0x409, 0x3) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x0, 0x100}, 0x0) ioctl$UDMABUF_CREATE(r7, 0x40187542, &(0x7f0000000000)={r8, 0x1, 0x0, 0x2000}) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) (async) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325}) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4d}, 0x94) 399.575371ms ago: executing program 4 (id=557): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_sco_SCO_OPTIONS(r1, 0x11, 0x1, 0x0, &(0x7f0000000cc0)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000040)={0x0, 'tunl0\x00', {0x1}, 0xb}) sendmsg$nl_route(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000180)=ANY=[], 0x48}}, 0x80) socket$inet_smc(0x2b, 0x1, 0x0) socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000000c0)="6880a642beaf34317f0dd3122a90ad0d2b", 0x11}], 0x1}, 0x0) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r2, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="97eb000014006bcd9e", 0xeb97}], 0x1, 0x0, 0x0, 0x1f000000}, 0x600) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x202800) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000780)={'gretap0\x00', &(0x7f0000000640)={'gretap0\x00', 0x0, 0x700, 0x20, 0x7f, 0xffff, {{0x1d, 0x4, 0x0, 0x18, 0x74, 0x68, 0x0, 0x2, 0x17, 0x0, @private=0xa010101, @private=0xa010101, {[@cipso={0x86, 0x39, 0x0, [{0x1, 0xe, "d1879071cb4ce1218bfe35b8"}, {0x5, 0x9, "a546b3690c5722"}, {0x0, 0x5, "1c5434"}, {0x6, 0x5, "982784"}, {0x2, 0x12, "a7b7dc0b88187b8caf98ffe10e58adbf"}]}, @timestamp={0x44, 0x10, 0xee, 0x0, 0x5, [0xffffff7f, 0xd20, 0x7]}, @ssrr={0x89, 0x17, 0xf, [@empty, @multicast2, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000840)={'syztnl0\x00', &(0x7f00000007c0)={'syztnl1\x00', 0x0, 0x7, 0x0, 0x10, 0x1, {{0x11, 0x4, 0x2, 0x5, 0x44, 0x64, 0x0, 0x5, 0x4, 0x0, @broadcast, @empty, {[@lsrr={0x83, 0xb, 0xd5, [@broadcast, @loopback]}, @timestamp_addr={0x44, 0x24, 0xec, 0x1, 0x8, [{@remote, 0x3}, {@empty}, {@remote, 0xffff}, {@rand_addr=0x64010102, 0x1}]}]}}}}}) sendmsg$inet(r0, &(0x7f00000009c0)={&(0x7f0000000100)={0x2, 0x4e22, @empty}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000180)="fd7b013d9b42995d290c1b544ec9eb99b8f8de58156d2b4f68bddec78ce386bf80a8cb10b599a2ef223500ffa5e2b18a04b9e38e5b9a5a11d1e4f83cb1c311027f868418fd2bbac36833d894c6bcbe043a7dfc6ccf6597303bade958cdf2620debfeb58654e93f02db812f270da7f7e4861e53f872f373f6f0fb39e46385fa91872804b522f3ef45157fa0127f262a6bbd9537f82632ce46e430f0999e29c618317e2e7c107d2e6d9522c61a5573a5c2d1cc520b300eae7042d2f097aa54427284c2d93b409cd2a2b907c5ff98e42beb828fbb341da78d2c075690ce3b6fb12b81b5986c4659c386d250398206", 0xed}, {&(0x7f0000000400)="2e025653bde8a8500f8b54f16a51a3dcdf4dfd1d2dfa73e556e9b200803a04543e30da6c516dd0d934b03a9e90f5eee67535513b931f26b765677781b9e2f2a9f83caa8cc4fbfc50bcd0092d8d9e1ce87f9d4f2f7930f65e29192cbd42f5fca8af67ab71d0af2e160d8ed67454ba6e2476db02f8006ef9a0f4d19ba106bc2eaad6f8950d15ece952177ce6cce774dd54741e6497fa7bf37dffdc80", 0x9b}], 0x2, &(0x7f0000000880)=[@ip_retopts={{0x38, 0x0, 0x7, {[@rr={0x7, 0xb, 0xce, [@private=0xa010100, @private=0xa010102]}, @lsrr={0x83, 0x17, 0x19, [@rand_addr=0x64010102, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @rand_addr=0x64010101]}, @end, @ra={0x94, 0x4, 0x1}, @end]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @remote, @rand_addr=0x64010101}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}, @ip_ttl={{0x14, 0x0, 0x2, 0xc7e}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}, @ip_ttl={{0x14}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @remote, @rand_addr=0x64010100}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x5}}, @ip_ttl={{0x14, 0x0, 0x2, 0x4}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4}}], 0x120}, 0x90) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[], 0xb8}, 0x1, 0x0, 0x0, 0x10}, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async) getsockopt$bt_sco_SCO_OPTIONS(r1, 0x11, 0x1, 0x0, &(0x7f0000000cc0)) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) (async) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000040)={0x0, 'tunl0\x00', {0x1}, 0xb}) (async) sendmsg$nl_route(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000180)=ANY=[], 0x48}}, 0x80) (async) socket$inet_smc(0x2b, 0x1, 0x0) (async) socket$kcm(0x2b, 0x1, 0x0) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000000c0)="6880a642beaf34317f0dd3122a90ad0d2b", 0x11}], 0x1}, 0x0) (async) socket$kcm(0x10, 0x2, 0x4) (async) sendmsg$inet(r2, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="97eb000014006bcd9e", 0xeb97}], 0x1, 0x0, 0x0, 0x1f000000}, 0x600) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x202800) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000780)={'gretap0\x00', &(0x7f0000000640)={'gretap0\x00', 0x0, 0x700, 0x20, 0x7f, 0xffff, {{0x1d, 0x4, 0x0, 0x18, 0x74, 0x68, 0x0, 0x2, 0x17, 0x0, @private=0xa010101, @private=0xa010101, {[@cipso={0x86, 0x39, 0x0, [{0x1, 0xe, "d1879071cb4ce1218bfe35b8"}, {0x5, 0x9, "a546b3690c5722"}, {0x0, 0x5, "1c5434"}, {0x6, 0x5, "982784"}, {0x2, 0x12, "a7b7dc0b88187b8caf98ffe10e58adbf"}]}, @timestamp={0x44, 0x10, 0xee, 0x0, 0x5, [0xffffff7f, 0xd20, 0x7]}, @ssrr={0x89, 0x17, 0xf, [@empty, @multicast2, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}]}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000840)={'syztnl0\x00', &(0x7f00000007c0)={'syztnl1\x00', 0x0, 0x7, 0x0, 0x10, 0x1, {{0x11, 0x4, 0x2, 0x5, 0x44, 0x64, 0x0, 0x5, 0x4, 0x0, @broadcast, @empty, {[@lsrr={0x83, 0xb, 0xd5, [@broadcast, @loopback]}, @timestamp_addr={0x44, 0x24, 0xec, 0x1, 0x8, [{@remote, 0x3}, {@empty}, {@remote, 0xffff}, {@rand_addr=0x64010102, 0x1}]}]}}}}}) (async) sendmsg$inet(r0, &(0x7f00000009c0)={&(0x7f0000000100)={0x2, 0x4e22, @empty}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000180)="fd7b013d9b42995d290c1b544ec9eb99b8f8de58156d2b4f68bddec78ce386bf80a8cb10b599a2ef223500ffa5e2b18a04b9e38e5b9a5a11d1e4f83cb1c311027f868418fd2bbac36833d894c6bcbe043a7dfc6ccf6597303bade958cdf2620debfeb58654e93f02db812f270da7f7e4861e53f872f373f6f0fb39e46385fa91872804b522f3ef45157fa0127f262a6bbd9537f82632ce46e430f0999e29c618317e2e7c107d2e6d9522c61a5573a5c2d1cc520b300eae7042d2f097aa54427284c2d93b409cd2a2b907c5ff98e42beb828fbb341da78d2c075690ce3b6fb12b81b5986c4659c386d250398206", 0xed}, {&(0x7f0000000400)="2e025653bde8a8500f8b54f16a51a3dcdf4dfd1d2dfa73e556e9b200803a04543e30da6c516dd0d934b03a9e90f5eee67535513b931f26b765677781b9e2f2a9f83caa8cc4fbfc50bcd0092d8d9e1ce87f9d4f2f7930f65e29192cbd42f5fca8af67ab71d0af2e160d8ed67454ba6e2476db02f8006ef9a0f4d19ba106bc2eaad6f8950d15ece952177ce6cce774dd54741e6497fa7bf37dffdc80", 0x9b}], 0x2, &(0x7f0000000880)=[@ip_retopts={{0x38, 0x0, 0x7, {[@rr={0x7, 0xb, 0xce, [@private=0xa010100, @private=0xa010102]}, @lsrr={0x83, 0x17, 0x19, [@rand_addr=0x64010102, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @rand_addr=0x64010101]}, @end, @ra={0x94, 0x4, 0x1}, @end]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @remote, @rand_addr=0x64010101}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}, @ip_ttl={{0x14, 0x0, 0x2, 0xc7e}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}, @ip_ttl={{0x14}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @remote, @rand_addr=0x64010100}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x5}}, @ip_ttl={{0x14, 0x0, 0x2, 0x4}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4}}], 0x120}, 0x90) (async) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (async) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[], 0xb8}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) 330.67087ms ago: executing program 4 (id=558): r0 = memfd_create(&(0x7f0000000540)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x17?&^\xe1Ob\xe1[\xd6\xeb\x91\x83;\xeb\xf1\xd0\xe3\xe5\x19T\xff\x01\x00\x00\xe2\x9f\xd9\xae\xcf>/\x05V%$6\x9fU\x86\xbe\xcbx\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xa2c\x12.\xb7\xbe`\'\xcb\xb6\xaf\x00\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x06\xb5\xaa\xe6\x05\xe4\xc3\x90\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4\x84$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\xd0\xe1{\x84\xb5\x82q\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xf8\xb1\xd2\x168\xbf`$\xbf\xca\xea\xa3\x83\x8e-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\xb0\xc0:\x8f|\x8f\x06\xf8\x83\x87+nM\x11\x1c\xb0\xber\xa6\xec\xcf\x03\xd3\xe8,?\x87\x84\\/y\xed\x01#?\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\xa3\xcc\x9b\f\xa7\x8f\x91O\xc9\xb9\x10M\x8b\xd0\xc0\xb8L\xbd\x1c4\xb59\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xdc\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5W\xfb\x82\xac\x19,\\D\x91T\xfd\x9c\xb8\x8b\x88\xa5\xcc\x8fI\x00\xf0\xc9%\n\xa7\xd6\x0f:\xb0\xf5?\xc3\x88\x1e\xbb-\xa6\xecA\x92\xaf\xa4Xl\v\xa5\xca\v|\xe2L\xac\x80\xc7\x15\x96fh\x83\x15\xc7\xea\xd5\xe8\x89W\x11\xd7oC\xe4\x06\xa8[O\xe6\x1d=\x87\x93\x0f\x87I\xdf\xb1\xeb\x89\x11.\x01\x00\r`\x1e8\x94\v)\x06B\xf0\xed\x91 )y\xb4\xba\xba\xb7\xbc\xc3\xad\xf1\x92/(A=A\x8b\xa5\xb0\x89\x9e5\x12\xa4\x9a\va\xdf\xf4\xea\xc6\xc7\x10g\x1d\xd5\xb0\xbb\xd2\x13]fC\x8d\x0f\xa6q\x0f\xef\x90\xfe\x94k\xf1\xb8\xfa\xbbb\xb1\x03\xb5pe,\xdfN\x0f8\t\xe7X_H\xd4\xe3\xb2,oj\xac\xd7\xbd\xd0\xadW\x1f<\xd0\b\x00\x00\x00\x00/ \xe4]@\xf7mA\xe8\xd1\xf4:\xb3\xeb\x81\xb9\x018\x1c\x95%o\x05x\x1a\x90\xf4\x03\xe7\xe9\xa9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\r\xcd\xf0\xad\x97uh\xb2\xb8\x17S~R\x19\xa9\xc3x\xb8l\xed\xbdz#6\x9f\x94\xba[xC\xed\x12}f\x0f\xc5', 0x3) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000000c0)={0x0, 0x2, 0x4, 0x1}) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f00000001c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000900)={0x14, 0x0, 0x4c3e225bbada8b1, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x840}, 0x8054) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r1, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, r3}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000100)={0x0, 0x1, &(0x7f0000000280)=[r3], &(0x7f00000000c0)=[0x3], &(0x7f0000000640)=[r5, r4, r5], &(0x7f0000000340), 0x0, 0xffffffffffffffff}) 330.348082ms ago: executing program 3 (id=559): r0 = socket$inet6_tcp(0xa, 0x1, 0x6) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x6) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @local, 0xb}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000800)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000180)={0x1, 0xffffffffffffffff}, 0x4) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0x20, &(0x7f00000003c0)={&(0x7f0000000080)=""/5, 0x5, 0x0, &(0x7f00000002c0)=""/227, 0xe3}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) r9 = dup(r8) write$UHID_INPUT(r9, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b5b09094bf70e0dd038e7ff7fc6e5539b324c078b089b3430076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a6217c2e837cd4c1ab72fcd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f229d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdffffffffffffffffe2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d41222d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315aff0dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e781b2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e9565868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000080000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1031}}, 0x1006) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x12, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r10}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r11) sendmsg$IEEE802154_ADD_IFACE(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x40, r12, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_TYPE={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x64008000) r13 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000003c0), 0x404001, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0xf, 0x8, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x324}, [@map_idx_val={0x18, 0x0, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x4}, @map_fd={0x18, 0x5, 0x1, 0x0, r6}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffb}]}, &(0x7f0000000280)='GPL\x00', 0x8000, 0xd, &(0x7f0000000300)=""/13, 0x41100, 0x27, '\x00', r4, @fallback=0xe, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x0, 0x5}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0xd, 0x2, 0x2}, 0x10, r7, 0xffffffffffffffff, 0x2, &(0x7f0000000400)=[r9, r10, r13, r1, r2], &(0x7f0000000440)=[{0x3, 0x3, 0x4, 0xb}, {0x3, 0x3, 0x3, 0x2}], 0x10, 0x4}, 0x94) r14 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r14, 0xc0105500, &(0x7f0000000000)={0x80, 0x6, 0xffa, 0x100, 0x0, 0x0, 0x0}) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r4, @ANYBLOB="00001700000000001c0037"], 0x44}, 0x1, 0x0, 0x0, 0x240080d8}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0xff, @local, @local, {[], {{0x4e23, 0x4e22, 0x2, 0x1, 0x0, 0x0, 0x5, 0x18, 0x1000}}}}}}}, 0x0) ioctl$XFS_IOC_FSGEOMETRY_V1(r5, 0x80705864, &(0x7f0000000100)) 270.590173ms ago: executing program 4 (id=560): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000008c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe2}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x2, 0x400000}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000140)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x1f00000000000000, 0x44081}, 0x0) 125.465435ms ago: executing program 4 (id=561): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x11}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x4084) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f00000005c0)) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000001c0)={@multicast2, @remote, 0x0}, &(0x7f0000000240)=0xc) (async) statx(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x400, 0x200, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=@ipv6_delroute={0x50, 0x19, 0x100, 0x70bd2d, 0x25dfdbfe, {0xa, 0x0, 0x80, 0x8, 0xfc, 0x3, 0xfd, 0x9, 0x400}, [@RTA_IIF={0x8, 0x3, r2}, @RTA_OIF={0x8, 0x4, r2}, @RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @SEG6_LOCAL_TABLE={0x8, 0x3, 0x526}}, @RTA_UID={0x8, 0x19, r3}, @RTA_PREF={0x5, 0x14, 0x7}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x8}]}, 0x50}}, 0x4850) (async) r4 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) set_robust_list(0x0, 0x0) (async) write$binfmt_misc(r5, &(0x7f0000000040), 0xe09) (async, rerun: 32) r6 = socket$igmp(0x2, 0x3, 0x2) (rerun: 32) setsockopt$MRT_TABLE(r6, 0x0, 0xd1, &(0x7f0000000000)=0xfd, 0x4) (async) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000002c0)={r5, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) (async) write$cgroup_subtree(r5, &(0x7f0000000000)={[{0x2d, 'rlimit'}]}, 0x8) 124.521939ms ago: executing program 2 (id=562): r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000000)={0x4000000, 0xf, 0x40000060, 0x100007f, 0x1a, "9f940b3491d052d172e0e573229ac6de50806c"}) r1 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) writev(r1, &(0x7f00000000c0), 0x0) r2 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x10001) ioctl$TCGETA(r2, 0x5405, &(0x7f0000000040)) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000100)=ANY=[@ANYRESHEX, @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r0, @ANYBLOB=',version=9p2000.u,\x00', @ANYBLOB="e61ed447e351100a9422e425251076c194156cf87644acfdf869723189c86caba90deac0cc95ea0265efd9cc00fbabafea7cc122a9cba7cc1709961293fccc2eda32544656ded7edd6a11c906f9d843c833db874566a93cd464d1bcf212899253a92adeb86d51b64b59a61ef990c5525ab5435083fea8794afe3bad1bc2c6387ea2808b127dcfb40659bb1ded5aebe7e37bcf3290549ab7f2cde22b24440f38c7b783cbae70847b863b65597b9"]) 70.514286ms ago: executing program 4 (id=563): mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='hfsplus\x00', 0x2000010, &(0x7f0000000100)='barrier') (async) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x10, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2501, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0x7, 0xfffffffffffffffd, 0x41, 0xc3d, 0x0, 0x100, 0x1000000003, 0xa1a, 0x7, 0x5, 0x79, 0x3, 0x3], 0x3332d000, 0x2}) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000000)=@x86={0x1, 0xa, 0x5, 0x0, 0x5, 0x1, 0x2, 0x5, 0xff, 0xf6, 0x5, 0x9, 0x0, 0x1, 0x5, 0x1, 0x2, 0x4, 0xff, '\x00', 0xdc, 0xe8}) (async) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) (async) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) (async) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x4, 0xe4}]}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) (async) sendmmsg$inet(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000500)="eb11946c3eeac60839553f9e6003a7c6fa8120c1cc9efcc39e37b1bce4396dd05c5d8b881233767b08e8d4faf9", 0x2d}], 0x1}}], 0x1, 0x40080) (async) sendto$inet(r3, &(0x7f0000000580)="17", 0x7fbc, 0x10008048, 0x0, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0x4000, 0xe000, 0x0, 0x77, 0x0, 0x3, 0xcb, 0x2, 0x0, 0x6, 0x6, 0xa}, {0x2, 0x9000, 0x3, 0xeb, 0x2, 0x0, 0x0, 0xff, 0x7, 0x0, 0x3}, {0xeeee0000, 0x1000, 0x3, 0x0, 0x7, 0xc4, 0x2, 0x1, 0x45, 0x3, 0x4, 0xfc}, {0x1, 0x0, 0x9, 0x4, 0x81, 0x0, 0x9, 0x0, 0x3, 0x2f, 0x9}, {0x0, 0xffff1000, 0x3, 0x4, 0xc2, 0x6, 0x0, 0x4, 0x0, 0x34, 0x4}, {0xb000, 0x1, 0x0, 0x78, 0x8, 0x0, 0x2, 0x1c, 0xa3, 0xed, 0x5}, {0xeeee8000, 0xfec00000, 0xa, 0x1, 0x0, 0x0, 0x7, 0x20, 0x2}, {0x0, 0x6000, 0xa, 0x0, 0xa4, 0x7, 0x8, 0x40, 0x26, 0x0, 0x0, 0xfe}, {0x80a0000, 0x3}, {0x3000, 0xfffe}, 0xddf8ffdb, 0x0, 0x0, 0x120, 0x8, 0xf801, 0x3000, [0x80000001, 0x0, 0xffffffffffffffff, 0xfffffffffffffffe]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = memfd_secret(0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) write(r4, &(0x7f0000000140)="4ca6430629979c488fcfcfc59153b8b5dc4e43a8933cc00689649396515aff1fade07861749f71715c4e7268294ee850971eaafa5b672886042b32ee9e895e99744c31fa44574997ed64367d98e72ff449f295afb65e47003b3248d9ded86a9bb37e338ac4426371202f1cf091c27880daad04f07288c87e00d98b0b8d81a959b8d8057f63a3dd154fad4c2d72b61f485305b74e1c307afadab83fe75ee11b95", 0xa0) 601.151µs ago: executing program 2 (id=564): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=ANY=[@ANYBLOB="400000002f00090073cc72e16accbe0a040000002a00118031"], 0x40}, 0x1, 0x0, 0x0, 0x42804}, 0x600000) 0s ago: executing program 2 (id=565): r0 = socket$igmp(0x2, 0x3, 0x2) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f00000000c0)={0xffffffffffffffff, 0x1, 0x9, 0xf14, @vifc_lcl_ifindex=r1, @multicast1}, 0x10) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000100), 0x10) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x31, 0x80000, 0x9) connect$can_bcm(r2, &(0x7f0000000140), 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000180)=0x7fff, 0x4) recvmsg$can_raw(r3, &(0x7f00000002c0)={&(0x7f00000001c0)=@ax25={{0x3, @default}, [@rose, @remote, @bcast, @bcast, @null, @rose, @rose, @netrom]}, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000000280)=""/5, 0x5}, 0x0) r4 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r4, &(0x7f0000000340)={'a', ' *:* ', 'm\x00'}, 0x8) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000380)=""/159, 0x9f}, {&(0x7f0000000440)=""/86, 0x56}, {&(0x7f00000004c0)=""/157, 0x9d}, {&(0x7f0000000580)=""/4096, 0x1000}, {&(0x7f0000001580)}], 0x5, 0x7, 0xffffffff) getresuid(&(0x7f0000001680)=0x0, &(0x7f00000016c0)=0x0, &(0x7f0000001700)) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001840)={&(0x7f0000001740)={0xe8, 0x2e, 0x4, 0x70bd2c, 0xf, {0x12}, [@typed={0x8, 0x61, 0x0, 0x0, @uid=r5}, @generic="f3cb62b7ce787d9892a1c82576fa06c2a720b2edb918828798dd026904a3ddae63a7783e737c912e6d9407e6fff56b22221618a6732129b6998e5655c771049f4d5defcb0551ca93cb5d2f3c360cd1733f4980ca860b7e9aec6feb7f3a019ae7132951ddb677c5f0f1c1fb4f8a7eaeb0aef62720d9ed10611d7053705bcd7488e2b8565054d568d2ac1e5ee24d1daada98d78b2eb1be8f216e2566625543c728f3bfbef4efa18a3646439f3dfb879ed3311f0737f81f0c0a920f9f77f1af6a9f03391c11ecdd9eb932f06338"]}, 0xe8}, 0x1, 0x0, 0x0, 0x4000800}, 0x1000c8c1) r7 = signalfd4(r3, &(0x7f00000018c0)={[0x8]}, 0x8, 0x80000) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000001900)={0xffffffffffffffff, 0x8, 0x54, 0xd, @vifc_lcl_addr=@multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000001940)="448ed06ee158976bc12b19cd1abc388dc02172569d66e5a06b0e9f1301c4587516c14f7c96556390b1be39ccea7b9b80140417d723222eb7648ca238f5b6718927a9156d10066c549e8495df212bea123ce199bd7103079118840eed00dc", 0x5e) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r7, 0x3ba0, &(0x7f00000019c0)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000001a40)={0xc, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r7, 0x3b89, &(0x7f0000001b80)={0x28, 0x3, r8, r9, 0x0, 0x0, 0x0, 0xc7, &(0x7f0000001a80)="2905ba8b58af1ab92c70fc32f6f258ffccd4fc519147ac70483e67759d36348a2ad19b298e1d09c7a72630500e61e13b8beb6db003c30160ca7300b1eac2af93d09cbe784ccee69777d6f006f2609c5210f0883c5ad630fd62f33e4315c3fb35e1d35f0fb6e86d3848100818a5a207d8bd3a8ef012e791fe45c61fcbdfe7bda22a1dbe4a444ce451f2e2f8ff67bb11d68499e07262d0ff1ffcb3d1162efc5d52856163447c82a17d87708e2802777c82ea26405769187fbe95a471d72378466c26f9d7cd00594f"}) stat(&(0x7f0000001bc0)='./file0\x00', &(0x7f0000001c00)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(r10, r5, r6) connect$pptp(r3, &(0x7f0000001c80)={0x18, 0x2, {0x1, @remote}}, 0x1e) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001d00), r3) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000001d40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r7, &(0x7f0000002200)={&(0x7f0000001cc0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000021c0)={&(0x7f0000001d80)={0x43c, r11, 0x2, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x420, 0x11d, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x84}]}, {0x2c8, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x188, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x9c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x3c, 0x2, [{0x0, 0x2}, {0x5, 0x2}, {0x6, 0x3}, {0x1, 0x4}, {0x0, 0x5}, {0x6, 0x5}, {0x2, 0x7}, {0x5, 0x8}, {0x0, 0x7}, {0x4, 0x7}, {0x5, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x6, 0x8}, {0x0, 0x6}, {0x3, 0xe}, {0x5, 0x2}, {0x0, 0x4}, {0x0, 0x1}, {0x3, 0xa}, {0x4, 0x5}, {0x3, 0x2}, {0x3, 0x9}, {0x3, 0x1}, {0x3, 0x9}, {0x0, 0x7}, {}, {0x0, 0xa}, {0x7, 0xa}, {0x3, 0x3}, {0x2, 0x4}, {0x3, 0x9}, {}, {0x7, 0x2}, {0x4, 0x8}, {0x7, 0x4}, {0x3, 0x7}, {0x0, 0x4}, {0x0, 0x3}, {}, {0x6, 0x4}, {0x3, 0x1}, {0x0, 0xa}, {0x0, 0x6}, {0x0, 0x6}, {0x7, 0x5}, {0x0, 0x1}, {0x4, 0x4}, {0x6, 0x5}, {0x6, 0x6}, {0x2, 0x8}, {0x5, 0x8}, {0x7, 0x4}, {0x4, 0x5}, {0x0, 0xa}, {0x4, 0x3}]}, @NL80211_TXRATE_LEGACY={0x20, 0x1, [0x5, 0x3, 0x36, 0x6, 0x36, 0x14, 0x36, 0x16, 0x7c33a1852afd158b, 0x4, 0x36, 0x3, 0x6, 0xb, 0xb, 0x4, 0x30, 0x12, 0x6, 0x0, 0x12, 0x4, 0x1b, 0x60, 0xc6, 0xb, 0x1b, 0x16]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x2c, 0x2, [{0x0, 0x3}, {0x0, 0xa}, {0x6, 0x5}, {0x5, 0x4}, {0x5, 0x9}, {0x2, 0x12}, {0x0, 0x4}, {0x3, 0x7}, {0x0, 0x7}, {0x0, 0x5}, {0x4, 0x6}, {0x5}, {0x7, 0x2}, {0x5, 0xa}, {0x4, 0x2}, {0x6, 0x2}, {0x5, 0x5}, {0x0, 0x6}, {0x3, 0x9}, {}, {0x3}, {0x7, 0x1}, {0x6, 0x1}, {0x3, 0xa}, {0x0, 0x8}, {0x4, 0x8}, {0x4, 0x7}, {0x3, 0x9}, {0x0, 0x4}, {0x7, 0x7}, {0x2, 0x5}, {0x0, 0x1}, {0x6, 0x1}, {0x2, 0x6}, {0x4, 0xa}, {0x4, 0x4}, {0x5, 0x7}, {0x4, 0x4}, {0x3, 0x7}, {0x2, 0x6}]}]}, @NL80211_BAND_5GHZ={0x20, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x14, 0x1, [0x60, 0x6, 0x2, 0x30, 0x5, 0x4, 0x0, 0x24, 0x1, 0x48, 0x18, 0x6, 0x36, 0x2, 0x24, 0x6c]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_5GHZ={0x70, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x7, 0x6, 0x6a4, 0x1000, 0x8, 0x7, 0x2]}}, @NL80211_TXRATE_HT={0x45, 0x2, [{0x6, 0x6}, {0x1, 0x6}, {0x5, 0x1}, {0x4, 0x2}, {0x0, 0x5}, {0x0, 0x3}, {0x4, 0x1}, {0x5, 0x1}, {0x6, 0x6}, {0x0, 0x8}, {0x6, 0x4}, {0x1, 0x3}, {0x7, 0x6}, {0x3, 0xa}, {0x5, 0x7}, {0x1, 0x4}, {0x1, 0x8}, {0x6}, {0x6, 0x1}, {0x7, 0x2}, {0x7, 0x7}, {0x3, 0x2}, {0x0, 0x4}, {0x7, 0x9}, {0x4, 0x9}, {0x0, 0xa}, {0x7, 0x2}, {0x7, 0x5}, {0x7, 0x1}, {0x6, 0x4}, {0x5, 0x1}, {0x5, 0x3}, {0x0, 0x2}, {0x4, 0x6}, {0x2, 0xa}, {0x3, 0x7}, {0x0, 0x4}, {0x1, 0x7}, {0x0, 0x9}, {0x5, 0x9}, {0x3, 0x7}, {0x4, 0x8}, {0x1, 0x5}, {0x2, 0x4}, {0x0, 0x5}, {0x2, 0x1}, {0x5, 0x1}, {}, {0x0, 0x9}, {0x2, 0x8}, {0x3, 0x7}, {0x2, 0xa}, {0x6, 0x9}, {0x1, 0x5}, {0x5, 0x6}, {0x7, 0x4}, {0x4, 0x8}, {0x3, 0x4}, {0x3, 0x2}, {}, {0x2, 0x1}, {0x0, 0x2}, {0x4, 0x6}, {0x3, 0x4}, {0x5, 0x7}]}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_2GHZ={0x2c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x9, 0x4, 0x9, 0x2, 0x2, 0x4, 0x2]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x0, 0x7ff, 0x7, 0xae4d, 0xfff9, 0x8, 0x1]}}]}, @NL80211_BAND_2GHZ={0x2c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0xf, 0x9, 0xf937, 0x9, 0x4, 0x6, 0x5]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x8000, 0xe7f4, 0x10, 0x5f8, 0x7fff, 0x7f, 0x539]}}]}]}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xe7}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0xf}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x8c, 0xd, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x1c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0xf, 0x2, [{0x3, 0xa}, {0x4, 0x9}, {0x3, 0x9}, {0x7, 0xa}, {0x2, 0x3}, {0x4, 0x1}, {0x3, 0x5}, {0x5, 0x4}, {0x6, 0x3}, {0x4, 0x1}, {0x5, 0x1}]}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_5GHZ={0x40, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x3a, 0x2, [{0x3}, {0x4, 0x1}, {0x0, 0x2}, {0x5, 0x6}, {0x4, 0x6}, {0x5, 0x5}, {0x7, 0x1}, {0x3}, {0x6, 0x1}, {0x0, 0x8}, {0x4, 0x6}, {0x5, 0x4}, {0x1, 0x1}, {0x6, 0x5}, {0x4, 0x4}, {0x6, 0x8}, {}, {0x4, 0x8}, {0x7, 0x1}, {0x3, 0x2}, {0x6, 0x6}, {0x1}, {0x6, 0x5}, {0x5, 0xa}, {}, {0x3, 0x6}, {0x3}, {0x6, 0x8}, {0x0, 0x3}, {0x2, 0xa}, {0x7, 0x2}, {0x1, 0x4}, {0x0, 0x7}, {}, {0x6}, {0x4, 0x9}, {0x0, 0x9}, {0x0, 0xa}, {0x2}, {0x1, 0x1}, {0x5, 0x2}, {0x5, 0x5}, {0x3, 0x8}, {0x1, 0x7}, {0x2, 0x4}, {0x5, 0x9}, {0x0, 0xa}, {0x6, 0x5}, {0x1, 0x8}, {0x0, 0x7}, {0x0, 0x4}, {0x0, 0xa}, {0x0, 0x5}, {0x4, 0x2}]}]}, @NL80211_BAND_5GHZ={0x2c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xa, 0x845b, 0x0, 0x4, 0x0, 0xa7, 0x2, 0x3]}}, @NL80211_TXRATE_LEGACY={0xa, 0x1, [0xc, 0x1a, 0x9, 0x24, 0x4, 0x16]}]}]}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x9c, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0xc, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x8c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x7fff, 0xdd8c, 0x6, 0x2, 0x8, 0xb8c, 0xf]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x4, 0x8000, 0x1, 0x9, 0x7, 0x1, 0x5]}}, @NL80211_TXRATE_LEGACY={0x6, 0x1, [0x9, 0x6c]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xb642, 0xf, 0x5, 0x6, 0x8, 0x8, 0x541, 0xc74c]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x9, 0x2, 0x9, 0x5, 0xb001, 0x0, 0x8]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x105a, 0x8, 0x7, 0x6, 0x5, 0xc2, 0x5, 0x9]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0xfffd, 0xd, 0x9, 0x9, 0x8001, 0x6, 0x9]}}]}]}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xf3}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x9c}]}, {0x28, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x4d}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}]}, {0xf0, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0xe4, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x44, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xfff, 0x3, 0x7f, 0x1, 0xe8b, 0x40, 0x0, 0x2]}}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x48]}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x1, 0x2, 0x0, 0x60, 0x48, 0xce4d491907c0664f, 0x60, 0x18, 0x18, 0x3, 0x36, 0x1, 0xb, 0x6, 0x60, 0x36, 0x18, 0x36, 0x36, 0x1b, 0x36, 0x1b, 0x1, 0x9, 0x48, 0x2, 0x60, 0x36, 0xc]}]}, @NL80211_BAND_6GHZ={0x98, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0xa, 0x1, 0x8, 0x5, 0xf77, 0x80, 0x4]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x84fc, 0xe3, 0xd3e3, 0xe000, 0x8, 0x2, 0x6a6, 0x8000]}}, @NL80211_TXRATE_HT={0x19, 0x2, [{0x2}, {0x5, 0x5}, {0x5, 0x9}, {0x5, 0x8}, {0x1, 0x1}, {0x4, 0x9}, {0x7}, {0x2}, {0x3}, {0x1, 0x2}, {0x6}, {0x6, 0x7}, {0x4, 0x3}, {0x7, 0x4}, {0x4, 0x8}, {0x2, 0x3}, {0x6, 0xa}, {0x2}, {0x0, 0x8}, {0x3, 0x2}, {0x7, 0x1}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0x1a, 0x2, [{}, {0x5, 0x5}, {0x0, 0x1}, {0x4, 0x3}, {0x1, 0xa}, {0x4}, {0x1}, {0x2}, {0x7, 0xa}, {0x0, 0x1}, {0x4, 0x7}, {0x0, 0x1}, {0x5, 0x6}, {0x5, 0x8}, {0x1, 0xa}, {0x3, 0x8}, {0x2, 0x8}, {0x0, 0x7}, {0x1, 0x7}, {0x5, 0x4}, {0x3, 0xa}, {0x2, 0x6}]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xc, 0x0, 0x3, 0x7, 0x4, 0x2, 0x1, 0x4c6]}}]}, @NL80211_BAND_2GHZ={0x4}]}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}]}]}, 0x43c}, 0x1, 0x0, 0x0, 0x4000}, 0x80) setsockopt$SO_TIMESTAMP(r7, 0x1, 0x1d, &(0x7f0000002240)=0x9, 0x4) setsockopt$inet_mreq(r7, 0x0, 0x24, &(0x7f0000002280)={@multicast1, @remote}, 0x8) ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(0xffffffffffffffff, 0xc0905664, &(0x7f0000002300)={0x0, 0x0, '\x00', @raw_data=[0x8fa, 0x8d4e, 0x4, 0x8, 0xb1ac, 0x4, 0x3, 0x4, 0x3, 0x7, 0x7fffffff, 0x2, 0x1, 0x30e4fe8a, 0x6, 0x5, 0x3, 0x623e, 0x2, 0x6fb2, 0x0, 0x7fffffff, 0x3, 0x9, 0x6, 0x3, 0xf0cb, 0x0, 0xfffffffa, 0xfffffff9, 0x1, 0x61292da0]}) 0s ago: executing program 2 (id=570): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/remove\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1', 0x1) (async) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) close(r1) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_int(r2, 0x6, 0xc, &(0x7f00000002c0)=0x3, 0x4) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r3, &(0x7f00000001c0)='1', 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:16029' (ED25519) to the list of known hosts. [ 45.801339][ T43] kauditd_printk_skb: 17 callbacks suppressed [ 45.801359][ T43] audit: type=1400 audit(1785365562.933:138): avc: denied { name_bind } for pid=5723 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 45.839109][ T43] audit: type=1400 audit(1785365562.963:139): avc: denied { execute } for pid=5724 comm="sh" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 45.846118][ T43] audit: type=1400 audit(1785365562.963:140): avc: denied { execute_no_trans } for pid=5724 comm="sh" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 48.258805][ T43] audit: type=1400 audit(1785365565.383:141): avc: denied { mounton } for pid=5724 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 48.269233][ T43] audit: type=1400 audit(1785365565.393:142): avc: denied { mount } for pid=5724 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 48.271319][ T5724] cgroup: Unknown subsys name 'net' [ 48.283549][ T43] audit: type=1400 audit(1785365565.413:143): avc: denied { unmount } for pid=5724 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 48.433578][ T5724] cgroup: Unknown subsys name 'cpuset' [ 48.438330][ T5724] cgroup: Unknown subsys name 'rlimit' [ 48.624360][ T43] audit: type=1400 audit(1785365565.753:144): avc: denied { setattr } for pid=5724 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=850 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 48.633963][ T43] audit: type=1400 audit(1785365565.753:145): avc: denied { create } for pid=5724 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 48.643313][ T43] audit: type=1400 audit(1785365565.753:146): avc: denied { write } for pid=5724 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 48.649621][ T43] audit: type=1400 audit(1785365565.753:147): avc: denied { read } for pid=5724 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 48.682730][ T5727] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 49.418350][ T5724] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 53.220263][ T43] kauditd_printk_skb: 10 callbacks suppressed [ 53.220277][ T43] audit: type=1400 audit(1785365570.343:158): avc: denied { execmem } for pid=5733 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 53.478034][ T43] audit: type=1400 audit(1785365570.603:159): avc: denied { create } for pid=5737 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 53.486303][ T43] audit: type=1400 audit(1785365570.603:160): avc: denied { read write } for pid=5737 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 53.495310][ T43] audit: type=1400 audit(1785365570.603:161): avc: denied { open } for pid=5737 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 53.503580][ T43] audit: type=1400 audit(1785365570.623:162): avc: denied { ioctl } for pid=5739 comm="syz-executor" path="socket:[2903]" dev="sockfs" ino=2903 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 53.523718][ T5751] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 53.526776][ T5753] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 53.527633][ T5750] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 53.528208][ T5751] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 53.528482][ T5751] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 53.529197][ T5751] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 53.529758][ T5751] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 53.529974][ T5752] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 53.531302][ T5753] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 53.531942][ T5753] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 53.532538][ T5752] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 53.532960][ T5753] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 53.534201][ T5753] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 53.538655][ T5750] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 53.541411][ T5752] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 53.545007][ T5750] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 53.546502][ T43] audit: type=1400 audit(1785365570.673:163): avc: denied { read } for pid=5739 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 53.546637][ T5752] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 53.546916][ T5752] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 53.555102][ T5097] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 53.557825][ T43] audit: type=1400 audit(1785365570.673:164): avc: denied { open } for pid=5739 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 53.561817][ T5097] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 53.566052][ T43] audit: type=1400 audit(1785365570.683:165): avc: denied { mounton } for pid=5739 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 53.597301][ T43] audit: type=1400 audit(1785365570.693:166): avc: denied { module_request } for pid=5738 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 53.610413][ T43] audit: type=1400 audit(1785365570.713:167): avc: denied { sys_module } for pid=5740 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 54.164106][ T5738] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.167357][ T5738] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.169778][ T5738] bridge_slave_0: entered allmulticast mode [ 54.172981][ T5738] bridge_slave_0: entered promiscuous mode [ 54.203666][ T5738] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.206125][ T5738] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.208839][ T5738] bridge_slave_1: entered allmulticast mode [ 54.214329][ T5738] bridge_slave_1: entered promiscuous mode [ 54.259974][ T5738] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.288912][ T5738] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.314797][ T5740] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.317675][ T5740] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.320460][ T5740] bridge_slave_0: entered allmulticast mode [ 54.324178][ T5740] bridge_slave_0: entered promiscuous mode [ 54.328865][ T5740] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.331398][ T5740] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.334377][ T5740] bridge_slave_1: entered allmulticast mode [ 54.337955][ T5740] bridge_slave_1: entered promiscuous mode [ 54.363003][ T5738] team0: Port device team_slave_0 added [ 54.391178][ T5738] team0: Port device team_slave_1 added [ 54.399694][ T5737] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.403667][ T5737] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.406072][ T5737] bridge_slave_0: entered allmulticast mode [ 54.408962][ T5737] bridge_slave_0: entered promiscuous mode [ 54.413653][ T5737] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.416751][ T5737] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.419840][ T5737] bridge_slave_1: entered allmulticast mode [ 54.424257][ T5737] bridge_slave_1: entered promiscuous mode [ 54.437289][ T5740] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.472870][ T5740] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.493622][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.496470][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.506682][ T5738] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.514775][ T5737] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.520503][ T5737] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.539999][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.542926][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.552190][ T5738] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.575390][ T5740] team0: Port device team_slave_0 added [ 54.592021][ T5737] team0: Port device team_slave_0 added [ 54.595205][ T5740] team0: Port device team_slave_1 added [ 54.597006][ T5739] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.599301][ T5739] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.601859][ T5739] bridge_slave_0: entered allmulticast mode [ 54.604664][ T5739] bridge_slave_0: entered promiscuous mode [ 54.608196][ T5739] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.610402][ T5739] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.612641][ T5739] bridge_slave_1: entered allmulticast mode [ 54.616221][ T5739] bridge_slave_1: entered promiscuous mode [ 54.620870][ T5737] team0: Port device team_slave_1 added [ 54.637922][ T5740] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.640130][ T5740] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.648246][ T5740] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.694810][ T5740] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.697159][ T5740] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.705887][ T5740] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.726131][ T5739] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.731162][ T5739] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.747421][ T5738] hsr_slave_0: entered promiscuous mode [ 54.750177][ T5738] hsr_slave_1: entered promiscuous mode [ 54.754015][ T5737] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.756673][ T5737] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.764877][ T5737] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.779124][ T5737] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.781469][ T5737] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.789408][ T5737] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.823209][ T5740] hsr_slave_0: entered promiscuous mode [ 54.825560][ T5740] hsr_slave_1: entered promiscuous mode [ 54.827685][ T5740] debugfs: 'hsr0' already exists in 'hsr' [ 54.829667][ T5740] Cannot create hsr debugfs directory [ 54.833909][ T5739] team0: Port device team_slave_0 added [ 54.872432][ T5739] team0: Port device team_slave_1 added [ 54.907230][ T5737] hsr_slave_0: entered promiscuous mode [ 54.909720][ T5737] hsr_slave_1: entered promiscuous mode [ 54.912093][ T5737] debugfs: 'hsr0' already exists in 'hsr' [ 54.914211][ T5737] Cannot create hsr debugfs directory [ 54.943401][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.946174][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.955766][ T5739] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.961473][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.964201][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.973917][ T5739] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 55.094269][ T5739] hsr_slave_0: entered promiscuous mode [ 55.097217][ T5739] hsr_slave_1: entered promiscuous mode [ 55.099840][ T5739] debugfs: 'hsr0' already exists in 'hsr' [ 55.102445][ T5739] Cannot create hsr debugfs directory [ 55.304844][ T5738] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 55.313071][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 55.316412][ T5738] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 55.323586][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 55.327301][ T5738] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 55.334094][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 55.337756][ T5738] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 55.345132][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 55.409254][ T5740] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 55.414750][ T5740] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 55.417549][ T5740] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 55.423304][ T5740] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 55.432930][ T5740] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 55.437023][ T5740] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 55.439863][ T5740] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 55.446919][ T5740] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 55.522985][ T5737] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 55.529624][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 55.534386][ T5737] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 55.542802][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 55.546682][ T5737] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 55.552312][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 55.563822][ T5737] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 55.567673][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 55.603655][ T5738] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.620935][ T64] Bluetooth: hci1: command tx timeout [ 55.630823][ T64] Bluetooth: hci0: command tx timeout [ 55.632042][ T5097] Bluetooth: hci3: command tx timeout [ 55.632231][ T5747] Bluetooth: hci2: command tx timeout [ 55.649506][ T5738] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.661629][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.665139][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.695971][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.698180][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.703840][ T5739] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 55.710612][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 55.729299][ T5739] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 55.735767][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 55.739405][ T5739] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 55.744546][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 55.748134][ T5739] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 55.754613][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 55.794004][ T5740] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.839213][ T5737] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.842777][ T5740] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.866330][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.868843][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.874387][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.877156][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.888452][ T5737] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.896491][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.898705][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.907634][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.909906][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.967964][ T5739] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.009556][ T5739] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.024310][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.026534][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.039278][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.042422][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.166652][ T5738] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.206776][ T5738] veth0_vlan: entered promiscuous mode [ 56.215846][ T5738] veth1_vlan: entered promiscuous mode [ 56.234232][ T5738] veth0_macvtap: entered promiscuous mode [ 56.239235][ T5738] veth1_macvtap: entered promiscuous mode [ 56.249161][ T5737] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.256725][ T5740] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.264204][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 56.272047][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 56.289784][ T5837] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.296300][ T5837] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.305243][ T5837] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.307959][ T5837] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.339407][ T5739] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.358289][ T5740] veth0_vlan: entered promiscuous mode [ 56.366934][ T5740] veth1_vlan: entered promiscuous mode [ 56.389001][ T5737] veth0_vlan: entered promiscuous mode [ 56.416398][ T221] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.419673][ T221] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.423207][ T5737] veth1_vlan: entered promiscuous mode [ 56.454900][ T5740] veth0_macvtap: entered promiscuous mode [ 56.455285][ T95] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.459786][ T95] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.462162][ T5739] veth0_vlan: entered promiscuous mode [ 56.469619][ T5740] veth1_macvtap: entered promiscuous mode [ 56.479424][ T5739] veth1_vlan: entered promiscuous mode [ 56.494789][ T5740] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 56.506102][ T5740] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 56.521702][ T5738] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 56.522345][ T5737] veth0_macvtap: entered promiscuous mode [ 56.533375][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.536035][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.545126][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.548794][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.556791][ T5737] veth1_macvtap: entered promiscuous mode [ 56.587592][ T5739] veth0_macvtap: entered promiscuous mode [ 56.597178][ T5739] veth1_macvtap: entered promiscuous mode [ 56.614257][ T5737] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 56.634577][ T5737] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 56.637485][ T5889] program syz.1.2 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 56.649000][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.649350][ T1166] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.653378][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.655921][ T1166] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.672188][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.675039][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.679542][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 56.709356][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 56.720350][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.724238][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.735486][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.754539][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.758928][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.773230][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.794607][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.799098][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.864877][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.868225][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.887700][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.891880][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.973841][ T5895] bond1: option downdelay: invalid value (18446744073709551615) [ 56.976793][ T5895] bond1: option downdelay: allowed values 0 - 2147483647 [ 56.985775][ T5895] bond1 (unregistering): Released all slaves [ 57.017319][ T95] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.018320][ T5901] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3'. [ 57.020819][ T95] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.035186][ T5900] netlink: 3 bytes leftover after parsing attributes in process `syz.3.4'. [ 57.045713][ T41] IPVS: starting estimator thread 0... [ 57.150901][ T5902] IPVS: using max 43 ests per chain, 103200 per kthread [ 57.169565][ T5907] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 57.188527][ T5911] TC_ACT_REPEAT abuse ? [ 57.191803][ T5911] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8'. [ 57.197674][ T5911] netlink: 14 bytes leftover after parsing attributes in process `syz.2.8'. [ 57.272846][ T5914] syzkaller0: entered promiscuous mode [ 57.274688][ T5914] syzkaller0: entered allmulticast mode [ 57.278973][ T5914] tipc: Started in network mode [ 57.279154][ T5916] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 57.281485][ T5914] tipc: Node identity 8e5f3343e279, cluster identity 4711 [ 57.292725][ T5914] tipc: Enabled bearer , priority 0 [ 57.302587][ T5913] tipc: Resetting bearer [ 57.314193][ T5913] tipc: Disabling bearer [ 57.397473][ T5921] loop3: detected capacity change from 0 to 7 [ 57.404823][ T5921] Dev loop3: unable to read RDB block 7 [ 57.406985][ T5921] loop3: AHDI p1 p2 p3 [ 57.408319][ T5921] loop3: partition table partially beyond EOD, truncated [ 57.411050][ T5921] loop3: p1 start 1601398130 is beyond EOD, truncated [ 57.413212][ T5921] loop3: p2 start 1702059890 is beyond EOD, truncated [ 57.475995][ T5925] netlink: 20 bytes leftover after parsing attributes in process `syz.1.14'. [ 57.595619][ T5931] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 57.657669][ T5933] Zero length message leads to an empty skb [ 57.701093][ T64] Bluetooth: hci0: command tx timeout [ 57.701121][ T5097] Bluetooth: hci1: command tx timeout [ 57.701236][ T5747] Bluetooth: hci2: command tx timeout [ 57.701266][ T5747] Bluetooth: hci3: command tx timeout [ 57.708734][ T5937] netlink: 28 bytes leftover after parsing attributes in process `syz.1.20'. [ 57.815432][ T5939] process 'syz.1.21' launched './file1' with NULL argv: empty string added [ 57.869715][ T5943] loop3: detected capacity change from 0 to 7 [ 57.873199][ T5943] Dev loop3: unable to read RDB block 7 [ 57.874986][ T5943] loop3: AHDI p1 p2 p3 [ 57.876711][ T5943] loop3: partition table partially beyond EOD, truncated [ 57.878225][ T5945] syzkaller0: entered promiscuous mode [ 57.881917][ T5945] syzkaller0: entered allmulticast mode [ 57.882175][ T5943] loop3: p1 start 1601398130 is beyond EOD, truncated [ 57.885750][ T5945] tipc: Started in network mode [ 57.886631][ T5943] loop3: p2 start 1702059890 is beyond EOD, truncated [ 57.888270][ T5945] tipc: Node identity 221e5d214d25, cluster identity 4711 [ 57.893592][ T5945] tipc: Enabled bearer , priority 0 [ 57.899971][ T5944] tipc: Resetting bearer [ 57.912724][ T5944] tipc: Disabling bearer [ 58.127876][ T5958] 9p: Invalid gid '0x00000000ffffffff' [ 58.233193][ T43] kauditd_printk_skb: 103 callbacks suppressed [ 58.233211][ T43] audit: type=1400 audit(1785365575.363:271): avc: denied { connect } for pid=5970 comm="syz.3.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 58.238453][ T5974] netlink: 8 bytes leftover after parsing attributes in process `syz.0.33'. [ 58.247723][ T5973] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 58.247946][ T5974] netlink: 4 bytes leftover after parsing attributes in process `syz.0.33'. [ 58.253065][ T43] audit: type=1400 audit(1785365575.363:272): avc: denied { write } for pid=5970 comm="syz.3.32" path="socket:[9656]" dev="sockfs" ino=9656 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 58.255674][ T5974] netlink: 'syz.0.33': attribute type 7 has an invalid length. [ 58.267403][ T5974] netlink: 'syz.0.33': attribute type 13 has an invalid length. [ 58.267694][ T5973] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 58.269273][ T43] audit: type=1400 audit(1785365575.363:273): avc: denied { create } for pid=5970 comm="syz.3.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 58.269380][ T43] audit: type=1400 audit(1785365575.363:274): avc: denied { ioctl } for pid=5970 comm="syz.3.32" path="socket:[9660]" dev="sockfs" ino=9660 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 58.269416][ T43] audit: type=1400 audit(1785365575.363:275): avc: denied { bind } for pid=5970 comm="syz.3.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 58.269447][ T43] audit: type=1400 audit(1785365575.363:276): avc: denied { write } for pid=5970 comm="syz.3.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 58.269477][ T43] audit: type=1400 audit(1785365575.363:277): avc: denied { setopt } for pid=5972 comm="syz.0.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 58.270114][ T43] audit: type=1400 audit(1785365575.393:278): avc: denied { write } for pid=5975 comm="syz.1.34" name="mtd0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 58.312617][ T43] audit: type=1400 audit(1785365575.393:279): avc: denied { open } for pid=5975 comm="syz.1.34" path="/dev/mtd0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 58.320056][ T43] audit: type=1400 audit(1785365575.423:280): avc: denied { unmount } for pid=5737 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 58.377889][ T5988] 9p: Invalid gid '0x00000000ffffffff' [ 58.420313][ T5994] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 58.423408][ T5994] IPv6: NLM_F_CREATE should be set when creating new route [ 58.430073][ T5993] netlink: 8 bytes leftover after parsing attributes in process `syz.2.40'. [ 58.472603][ T5998] netlink: 8 bytes leftover after parsing attributes in process `syz.1.41'. [ 58.550405][ T50] usb 8-1: new full-speed USB device number 2 using dummy_hcd [ 58.704085][ T50] usb 8-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 58.709163][ T50] usb 8-1: config 0 interface 0 altsetting 1 endpoint 0x89 has an invalid bInterval 0, changing to 10 [ 58.710312][ T9] usb 7-1: new full-speed USB device number 2 using dummy_hcd [ 58.714196][ T50] usb 8-1: config 0 interface 0 altsetting 1 endpoint 0x89 has invalid wMaxPacketSize 0 [ 58.718922][ T50] usb 8-1: config 0 interface 0 has no altsetting 0 [ 58.723505][ T50] usb 8-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 58.726519][ T50] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 58.729153][ T50] usb 8-1: Product: syz [ 58.730643][ T50] usb 8-1: Manufacturer: syz [ 58.732197][ T50] usb 8-1: SerialNumber: syz [ 58.738614][ T50] usb 8-1: config 0 descriptor?? [ 58.863895][ T9] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 58.867911][ T9] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 58.873379][ T9] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 58.877030][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 59.047502][ T6018] loop3: detected capacity change from 0 to 7 [ 59.053038][ T6018] Dev loop3: unable to read RDB block 7 [ 59.055359][ T6018] loop3: AHDI p1 p2 p3 [ 59.057134][ T6018] loop3: partition table partially beyond EOD, truncated [ 59.060096][ T6018] loop3: p1 start 1601398130 is beyond EOD, truncated [ 59.063883][ T6018] loop3: p2 start 1702059890 is beyond EOD, truncated [ 59.088595][ T9] usb 7-1: GET_CAPABILITIES returned fc [ 59.099616][ T9] usbtmc 7-1:16.0: can't read capabilities [ 59.291989][ T6002] usbtmc 7-1:16.0: usbtmc_ioctl_request failed -32 [ 59.299934][ T41] usb 7-1: USB disconnect, device number 2 [ 59.380760][ T9] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 59.530434][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 59.534355][ T9] usb 6-1: config 0 has an invalid interface number: 119 but max is 0 [ 59.537553][ T9] usb 6-1: config 0 has no interface number 0 [ 59.540101][ T9] usb 6-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 59.544955][ T9] usb 6-1: config 0 interface 119 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 59.550334][ T9] usb 6-1: config 0 interface 119 altsetting 0 endpoint 0x83 has invalid maxpacket 11621, setting to 1024 [ 59.553699][ T9] usb 6-1: config 0 interface 119 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 59.556783][ T9] usb 6-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 59.562615][ T9] usb 6-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 59.565423][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 59.567846][ T9] usb 6-1: Product: syz [ 59.569154][ T9] usb 6-1: Manufacturer: syz [ 59.570785][ T9] usb 6-1: SerialNumber: syz [ 59.574347][ T9] usb 6-1: config 0 descriptor?? [ 59.576441][ T6022] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 59.583197][ T9] input: bcm5974 as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.119/input/input7 [ 59.588571][ T5133] usb 6-1: BOGUS urb xfer, pipe 1 != type 3 [ 59.600441][ C3] bcm5974 6-1:0.119: trackpad urb failed: -1 [ 59.671401][ T6024] syzkaller0: entered promiscuous mode [ 59.673799][ T6024] syzkaller0: entered allmulticast mode [ 59.679015][ T6024] tipc: Started in network mode [ 59.681195][ T6024] tipc: Node identity 82cef1f63e58, cluster identity 4711 [ 59.684495][ T6024] tipc: Enabled bearer , priority 0 [ 59.688627][ T6023] tipc: Resetting bearer [ 59.699197][ T6023] tipc: Disabling bearer [ 59.782141][ T5097] Bluetooth: hci1: command tx timeout [ 59.782141][ T64] Bluetooth: hci0: command tx timeout [ 59.782383][ T5747] Bluetooth: hci2: command tx timeout [ 59.782436][ T5751] Bluetooth: hci3: command tx timeout [ 59.811095][ T41] usb 6-1: USB disconnect, device number 2 [ 59.859955][ T34] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 59.874209][ T34] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 59.906047][ T6034] ceph: No mds server is up or the cluster is laggy [ 59.912690][ T6043] gfs2: error -5 reading superblock [ 60.170418][ T6069] syzkaller0: entered promiscuous mode [ 60.172133][ T6069] syzkaller0: entered allmulticast mode [ 60.177001][ T6069] tipc: Started in network mode [ 60.179079][ T6069] tipc: Node identity 925c6cc02e0a, cluster identity 4711 [ 60.182873][ T6069] tipc: Enabled bearer , priority 0 [ 60.186837][ T6068] tipc: Resetting bearer [ 60.205318][ T6068] tipc: Disabling bearer [ 60.523194][ T6106] 9p: Invalid gid '0x00000000ffffffff' [ 60.815850][ T6117] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 60.817975][ T6117] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 60.826528][ T6117] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 60.831895][ T6117] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 60.834738][ T6117] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 60.838917][ T6117] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 60.844281][ T6117] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 60.846268][ T6117] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 60.850395][ T6117] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 60.853877][ T6117] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 60.856163][ T6117] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 60.860917][ T6117] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 60.916716][ T6122] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 61.235713][ T50] usb 8-1: Can not set alternate setting to 1, error: -71 [ 61.238550][ T50] synaptics_usb 8-1:0.0: probe with driver synaptics_usb failed with error -71 [ 61.252127][ T50] usb 8-1: USB disconnect, device number 2 [ 61.329778][ T6135] FAULT_INJECTION: forcing a failure. [ 61.329778][ T6135] name failslab, interval 1, probability 0, space 0, times 1 [ 61.334396][ T6134] tipc: Enabling of bearer rejected, failed to enable media [ 61.335123][ T6135] CPU: 3 UID: 0 PID: 6135 Comm: syz.3.81 Not tainted syzkaller #0 PREEMPT(full) [ 61.335138][ T6135] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 61.335145][ T6135] Call Trace: [ 61.335149][ T6135] [ 61.335154][ T6135] dump_stack_lvl+0x100/0x190 [ 61.335175][ T6135] should_fail_ex.cold+0x5/0xa [ 61.335190][ T6135] should_failslab+0xc2/0x120 [ 61.335207][ T6135] __kmalloc_node_track_caller_noprof+0xf9/0x830 [ 61.335221][ T6135] ? __kasan_kmalloc+0x30/0xb0 [ 61.335235][ T6135] ? v9fs_init_fs_context+0x17f/0x5c0 [ 61.335254][ T6135] kstrdup+0x51/0xe0 [ 61.335267][ T6135] v9fs_init_fs_context+0x17f/0x5c0 [ 61.335284][ T6135] alloc_fs_context+0x60c/0xf40 [ 61.335302][ T6135] path_mount+0xdbd/0x23d0 [ 61.335320][ T6135] ? __pfx_path_mount+0x10/0x10 [ 61.335333][ T6135] ? lockdep_hardirqs_on+0x78/0x100 [ 61.335362][ T6135] ? putname+0xb1/0x110 [ 61.335374][ T6135] ? kmem_cache_free+0x127/0x6b0 [ 61.335389][ T6135] ? __x64_sys_mount+0x293/0x310 [ 61.335403][ T6135] __x64_sys_mount+0x293/0x310 [ 61.335418][ T6135] ? __pfx___x64_sys_mount+0x10/0x10 [ 61.335436][ T6135] do_syscall_64+0x115/0x870 [ 61.335448][ T6135] ? clear_bhb_loop+0x40/0x90 [ 61.335462][ T6135] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.335473][ T6135] RIP: 0033:0x7fd5e139df99 [ 61.335483][ T6135] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 61.335494][ T6135] RSP: 002b:00007fd5e22c8028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 61.335506][ T6135] RAX: ffffffffffffffda RBX: 00007fd5e1625fa0 RCX: 00007fd5e139df99 [ 61.335512][ T6135] RDX: 0000200000000b40 RSI: 0000200000000b00 RDI: 0000000000000000 [ 61.335519][ T6135] RBP: 00007fd5e22c8090 R08: 0000200000000200 R09: 0000000000000000 [ 61.335525][ T6135] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 61.335531][ T6135] R13: 00007fd5e1626038 R14: 00007fd5e1625fa0 R15: 00007ffc99738158 [ 61.335544][ T6135] [ 61.417431][ T6140] syzkaller0: entered promiscuous mode [ 61.419816][ T6140] syzkaller0: entered allmulticast mode [ 61.424321][ T6140] tipc: Enabled bearer , priority 0 [ 61.428436][ T6139] tipc: Resetting bearer [ 61.445156][ T6139] tipc: Disabling bearer [ 61.491671][ T6149] i2c i2c-0: new_device: Missing parameters [ 61.642137][ T6174] SELinux: Context system_u:object_r:hwdata_t:s0 is not valid (left unmapped). [ 61.679621][ T6179] netlink: 'syz.0.97': attribute type 3 has an invalid length. [ 61.689793][ T6180] syz.2.96 uses obsolete (PF_INET,SOCK_PACKET) [ 61.904234][ T6190] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 61.965330][ T6192] ======================================================= [ 61.965330][ T6192] WARNING: The mand mount option has been deprecated and [ 61.965330][ T6192] and is ignored by this kernel. Remove the mand [ 61.965330][ T6192] option from the mount to silence this warning. [ 61.965330][ T6192] ======================================================= [ 61.976484][ T6192] 9p: Invalid gid '0x00000000ffffffff' [ 62.069127][ T6197] syzkaller0: entered promiscuous mode [ 62.071132][ T6197] syzkaller0: entered allmulticast mode [ 62.143373][ T6203] __nla_validate_parse: 19 callbacks suppressed [ 62.143391][ T6203] netlink: 8 bytes leftover after parsing attributes in process `syz.3.105'. [ 62.160135][ T6203] 8021q: adding VLAN 0 to HW filter on device bond1 [ 62.385104][ T6215] fuse: Unknown parameter 'fÍ' [ 62.387415][ T6216] fuse: Unknown parameter 'fÍ' [ 62.482236][ T6183] Trying to write to read-only block-device nullb0 [ 62.538369][ T6225] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 62.574561][ T6223] netlink: 4 bytes leftover after parsing attributes in process `syz.3.112'. [ 62.649503][ T6230] bridge0: port 3(syz_tun) entered blocking state [ 62.653588][ T6230] bridge0: port 3(syz_tun) entered disabled state [ 62.657304][ T6230] syz_tun: entered allmulticast mode [ 62.662320][ T6230] syz_tun: entered promiscuous mode [ 62.665375][ T6230] bridge0: port 3(syz_tun) entered blocking state [ 62.668266][ T6230] bridge0: port 3(syz_tun) entered forwarding state [ 62.675301][ T6230] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 62.821507][ T64] Bluetooth: hci2: command 0x0c1a tx timeout [ 62.824817][ T6242] netlink: 'syz.1.118': attribute type 10 has an invalid length. [ 62.842205][ T6242] 9p: Invalid gid '0x00000000ffffffff' [ 62.899383][ T6254] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 62.901596][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 62.904270][ T5097] Bluetooth: hci1: command 0x0c1a tx timeout [ 62.905895][ T64] Bluetooth: hci0: command 0x0c1a tx timeout [ 62.910048][ T6259] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 62.911169][ T6259] netlink: 8 bytes leftover after parsing attributes in process `syz.3.123'. [ 62.931573][ T6259] 8021q: adding VLAN 0 to HW filter on device bond2 [ 62.940016][ T6259] netlink: 16 bytes leftover after parsing attributes in process `syz.3.123'. [ 62.943636][ T6259] netlink: 4 bytes leftover after parsing attributes in process `syz.3.123'. qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. [ 63.197023][ T6276] sctp: [Deprecated]: syz.3.131 (pid 6276) Use of int in maxseg socket option. [ 63.197023][ T6276] Use struct sctp_assoc_value instead [ 63.322388][ T43] kauditd_printk_skb: 92 callbacks suppressed [ 63.322401][ T43] audit: type=1400 audit(1785365580.453:373): avc: denied { write } for pid=6286 comm="syz.3.134" name="card1" dev="devtmpfs" ino=636 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 63.353917][ T43] audit: type=1400 audit(1785365580.483:374): avc: denied { create } for pid=6290 comm="syz.3.136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 63.362625][ T43] audit: type=1400 audit(1785365580.483:375): avc: denied { setopt } for pid=6290 comm="syz.3.136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 63.363208][ T6294] IPVS: sync thread started: state = BACKUP, mcast_ifn = ip6gretap0, syncid = 4, id = 0 [ 63.371299][ T6292] IPVS: stopping backup sync thread 6294 ... [ 63.385865][ T43] audit: type=1400 audit(1785365580.513:376): avc: denied { associate } for pid=6278 comm="syz.1.132" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 63.584954][ T5850] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 63.588520][ T5850] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 63.597770][ T5850] hid-generic 0000:0000:0000.0002: hidraw1: HID v0.00 Device [syz0] on syz0 [ 63.721339][ T9] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 63.850386][ T9] usb 7-1: device descriptor read/64, error -71 [ 63.941732][ T6313] cgroup: release_agent respecified [ 63.980408][ T43] audit: type=1400 audit(1785365581.103:377): avc: denied { setopt } for pid=6314 comm="syz.1.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 64.086185][ T43] audit: type=1400 audit(1785365581.213:378): avc: denied { bind } for pid=6318 comm="syz.0.144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 64.092307][ T9] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 64.097296][ T43] audit: type=1400 audit(1785365581.213:379): avc: denied { name_bind } for pid=6318 comm="syz.0.144" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 64.104225][ T43] audit: type=1400 audit(1785365581.213:380): avc: denied { node_bind } for pid=6318 comm="syz.0.144" saddr=172.20.20.43 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 64.114525][ T43] audit: type=1400 audit(1785365581.223:381): avc: denied { write } for pid=6316 comm="syz.1.143" name="/" dev="9p" ino=82313407 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 64.115427][ T6317] SELinux: failed to load policy [ 64.121486][ T43] audit: type=1800 audit(1785365581.223:382): pid=6317 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.143" name="file1" dev="9p" ino=82313413 res=0 errno=0 [ 64.126447][ T6324] /dev/sg0: Can't lookup blockdev [ 64.189071][ T6325] capability: warning: `syz.0.145' uses deprecated v2 capabilities in a way that may be insecure [ 64.240313][ T9] usb 7-1: device descriptor read/64, error -71 [ 64.352101][ T9] usb usb7-port1: attempt power cycle [ 64.385641][ T6328] binder_alloc: 6327: binder_alloc_buf size -16 failed, no address space [ 64.391618][ T6328] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 64.448478][ T6334] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 64.653796][ T6345] af_packet: tpacket_rcv: packet too big, clamped from 78 to 4294967286. macoff=82 [ 64.706137][ T9] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 64.721039][ T9] usb 7-1: device descriptor read/8, error -71 [ 64.902676][ T64] Bluetooth: hci2: command 0x0c1a tx timeout [ 64.970534][ T9] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 64.980439][ T64] Bluetooth: hci0: command 0x0c1a tx timeout [ 64.990393][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 64.991120][ T9] usb 7-1: device descriptor read/8, error -71 [ 65.153604][ T9] usb usb7-port1: unable to enumerate USB device [ 65.206853][ T6349] overlay: Bad value for 'workdir' [ 65.533577][ T6372] syzkaller0: entered promiscuous mode [ 65.535438][ T6372] syzkaller0: entered allmulticast mode [ 65.805168][ T6382] netlink: 'syz.3.165': attribute type 6 has an invalid length. [ 65.922863][ T6341] Set syz1 is full, maxelem 65536 reached [ 66.143849][ T6395] libceph: resolve '4' (ret=-3): failed [ 66.501590][ T64] Bluetooth: hci1: command 0x0c1a tx timeout [ 66.608492][ T6428] 9p: Bad value for 'afid' [ 66.622490][ T6428] netlink: 88 bytes leftover after parsing attributes in process `syz.2.174'. [ 66.851350][ T6447] netlink: 32 bytes leftover after parsing attributes in process `syz.3.179'. [ 66.980501][ T64] Bluetooth: hci2: command 0x0c1a tx timeout [ 67.019187][ T6459] netlink: 156 bytes leftover after parsing attributes in process `syz.0.182'. [ 67.070732][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 67.070746][ T5097] Bluetooth: hci0: command 0x0c1a tx timeout [ 67.177104][ T6455] netlink: 8 bytes leftover after parsing attributes in process `syz.3.181'. [ 67.256812][ T6476] zram0: detected capacity change from 0 to 8 [ 67.675002][ T6502] syzkaller0: entered promiscuous mode [ 67.676844][ T6502] syzkaller0: entered allmulticast mode [ 67.681698][ T6502] tipc: Enabled bearer , priority 0 [ 67.684524][ T6501] tipc: Resetting bearer [ 67.694496][ T6501] tipc: Disabling bearer [ 68.173317][ T6530] bond0: entered promiscuous mode [ 68.175224][ T6530] bond_slave_0: entered promiscuous mode [ 68.177365][ T6530] bond_slave_1: entered promiscuous mode [ 68.180285][ T6530] batadv0: entered promiscuous mode [ 68.182851][ T6530] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 68.187883][ T6530] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 68.193906][ T6530] bond0: left promiscuous mode [ 68.197156][ T6530] bond_slave_0: left promiscuous mode [ 68.199655][ T6530] bond_slave_1: left promiscuous mode [ 68.203521][ T6530] batadv0: left promiscuous mode [ 68.384307][ T43] kauditd_printk_skb: 73 callbacks suppressed [ 68.384321][ T43] audit: type=1400 audit(1785365585.513:456): avc: denied { write } for pid=6539 comm="syz.3.200" name="/" dev="9p" ino=82313407 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 68.396477][ T43] audit: type=1800 audit(1785365585.523:457): pid=6540 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.200" name="file1" dev="9p" ino=82313413 res=0 errno=0 [ 68.955904][ T6549] loop3: detected capacity change from 0 to 7 [ 68.961570][ T6549] Dev loop3: unable to read RDB block 7 [ 68.965182][ T6549] loop3: AHDI p1 p2 p3 [ 68.966979][ T6549] loop3: partition table partially beyond EOD, truncated [ 68.971366][ T6549] loop3: p1 start 1601398130 is beyond EOD, truncated [ 68.973411][ T6549] loop3: p2 start 1702059890 is beyond EOD, truncated [ 69.023108][ T6554] syzkaller0: entered promiscuous mode [ 69.025471][ T6554] syzkaller0: entered allmulticast mode [ 69.039687][ T6554] program syz.1.205 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 69.121141][ T43] audit: type=1400 audit(1785365586.253:458): avc: denied { create } for pid=6555 comm="syz.2.206" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 69.164279][ T43] audit: type=1326 audit(1785365586.293:459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6555 comm="syz.2.206" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3dd739df99 code=0x0 [ 69.226096][ T43] audit: type=1400 audit(1785365586.353:460): avc: denied { bind } for pid=6555 comm="syz.2.206" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 69.269565][ T6560] netlink: 'syz.2.206': attribute type 1 has an invalid length. [ 69.292693][ T6560] gretap1: entered allmulticast mode [ 69.342240][ T43] audit: type=1326 audit(1785365586.473:461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6555 comm="syz.2.206" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3dd739df99 code=0x0 [ 69.437893][ T43] audit: type=1400 audit(1785365586.563:462): avc: denied { mount } for pid=6567 comm="syz.1.209" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 69.447598][ T6568] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 69.452391][ T43] audit: type=1400 audit(1785365586.583:463): avc: denied { mount } for pid=6567 comm="syz.1.209" name="/" dev="overlay" ino=4611686018427387905 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 69.462240][ T43] audit: type=1400 audit(1785365586.583:464): avc: denied { name_bind } for pid=6567 comm="syz.1.209" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 69.593594][ T6571] xt_l2tp: unknown flags: ff [ 69.598249][ T6570] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 69.598267][ T6571] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 69.678888][ T43] audit: type=1400 audit(1785365586.803:465): avc: denied { create } for pid=6574 comm="syz.3.212" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 69.814776][ T6575] netlink: 20 bytes leftover after parsing attributes in process `syz.3.212'. [ 70.034830][ T6584] can: request_module (can-proto-0) failed. [ 70.058612][ T6584] batman_adv: batadv0: Adding interface: dummy0 [ 70.062058][ T6584] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.071488][ T6584] batman_adv: batadv0: Interface activated: dummy0 [ 70.085342][ T6584] batadv0: mtu less than device minimum [ 70.087870][ T6591] FAULT_INJECTION: forcing a failure. [ 70.087870][ T6591] name failslab, interval 1, probability 0, space 0, times 0 [ 70.088385][ T6584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 70.092513][ T6591] CPU: 2 UID: 0 PID: 6591 Comm: syz.2.218 Not tainted syzkaller #0 PREEMPT(full) [ 70.092527][ T6591] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.092534][ T6591] Call Trace: [ 70.092538][ T6591] [ 70.092542][ T6591] dump_stack_lvl+0x100/0x190 [ 70.092565][ T6591] should_fail_ex.cold+0x5/0xa [ 70.092582][ T6591] should_failslab+0xc2/0x120 [ 70.092598][ T6591] __kmalloc_cache_noprof+0x91/0x6c0 [ 70.092617][ T6591] ? copy_mount_options+0x55/0x190 [ 70.092636][ T6591] copy_mount_options+0x55/0x190 [ 70.092654][ T6591] __x64_sys_mount+0x1ab/0x310 [ 70.092669][ T6591] ? __pfx___x64_sys_mount+0x10/0x10 [ 70.092691][ T6591] do_syscall_64+0x115/0x870 [ 70.092706][ T6591] ? clear_bhb_loop+0x40/0x90 [ 70.092719][ T6591] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.092731][ T6591] RIP: 0033:0x7f3dd739df99 [ 70.092741][ T6591] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 70.092751][ T6591] RSP: 002b:00007f3dd81c1028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 70.092763][ T6591] RAX: ffffffffffffffda RBX: 00007f3dd7625fa0 RCX: 00007f3dd739df99 [ 70.092770][ T6591] RDX: 0000200000000b40 RSI: 0000200000000b00 RDI: 0000200000000ac0 [ 70.092776][ T6591] RBP: 00007f3dd81c1090 R08: 0000200000000200 R09: 0000000000000000 [ 70.092783][ T6591] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 70.092789][ T6591] R13: 00007f3dd7626038 R14: 00007f3dd7625fa0 R15: 00007ffe90241248 [ 70.092802][ T6591] [ 70.130191][ T6593] /dev/sr0: Can't open blockdev [ 70.133740][ T6584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 70.153593][ T6584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 70.157699][ T6584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 70.161514][ T6584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 70.165305][ T6584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 70.169455][ T6584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 70.209823][ T6596] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.322024][ T64] Bluetooth: hci3: unexpected event for opcode 0x2023 [ 70.371397][ T6038] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 70.531622][ T6038] usb 7-1: Using ep0 maxpacket: 8 [ 70.535509][ T6038] usb 7-1: config 0 has an invalid interface number: 143 but max is 0 [ 70.538281][ T6038] usb 7-1: config 0 has no interface number 0 [ 70.540681][ T6038] usb 7-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 70.543740][ T6038] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 70.548731][ T6038] usb 7-1: config 0 descriptor?? [ 70.661095][ T6038] viperboard 7-1:0.143: version 0.00 found at bus 007 address 007 [ 70.682960][ T6038] viperboard-i2c viperboard-i2c.3.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 70.686493][ T6038] viperboard-i2c viperboard-i2c.3.auto: probe with driver viperboard-i2c failed with error -5 [ 70.761854][ T5887] usb 7-1: USB disconnect, device number 7 [ 70.810550][ T34] usb 8-1: new full-speed USB device number 3 using dummy_hcd [ 70.971383][ T34] usb 8-1: not running at top speed; connect to a high speed hub [ 70.974724][ T34] usb 8-1: config 1 interface 0 altsetting 19 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 70.978841][ T34] usb 8-1: config 1 interface 0 has no altsetting 0 [ 70.985830][ T34] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 70.988765][ T34] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.992082][ T34] usb 8-1: Product: syz [ 70.993425][ T34] usb 8-1: Manufacturer: syz [ 70.994868][ T34] usb 8-1: SerialNumber: syz [ 71.068707][ T6611] MINIX-fs: unable to read superblock [ 71.220102][ T34] cdc_ether 8-1:1.0: probe with driver cdc_ether failed with error -71 [ 71.226505][ T1444] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.229100][ T1444] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.238280][ T34] usb 8-1: USB disconnect, device number 3 [ 71.277783][ T6621] loop3: detected capacity change from 0 to 7 [ 71.282575][ T6621] Dev loop3: unable to read RDB block 7 [ 71.284389][ T6621] loop3: AHDI p1 p2 p3 [ 71.285756][ T6621] loop3: partition table partially beyond EOD, truncated [ 71.288714][ T6621] loop3: p1 start 1601398130 is beyond EOD, truncated [ 71.291761][ T6621] loop3: p2 start 1702059890 is beyond EOD, truncated [ 71.338564][ T6623] FAULT_INJECTION: forcing a failure. [ 71.338564][ T6623] name failslab, interval 1, probability 0, space 0, times 0 [ 71.343431][ T6623] CPU: 3 UID: 0 PID: 6623 Comm: syz.2.230 Not tainted syzkaller #0 PREEMPT(full) [ 71.343447][ T6623] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 71.343454][ T6623] Call Trace: [ 71.343458][ T6623] [ 71.343463][ T6623] dump_stack_lvl+0x100/0x190 [ 71.343549][ T6623] should_fail_ex.cold+0x5/0xa [ 71.343577][ T6623] should_failslab+0xc2/0x120 [ 71.343604][ T6623] kmem_cache_alloc_noprof+0x91/0x6a0 [ 71.343619][ T6623] ? do_getname+0x35/0x390 [ 71.343644][ T6623] do_getname+0x35/0x390 [ 71.343667][ T6623] user_path_at+0x26/0x60 [ 71.343683][ T6623] __x64_sys_mount+0x1fb/0x310 [ 71.343705][ T6623] ? __pfx___x64_sys_mount+0x10/0x10 [ 71.343724][ T6623] do_syscall_64+0x115/0x870 [ 71.343744][ T6623] ? clear_bhb_loop+0x40/0x90 [ 71.343758][ T6623] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.343770][ T6623] RIP: 0033:0x7f3dd739df99 [ 71.343780][ T6623] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 71.343791][ T6623] RSP: 002b:00007f3dd81c1028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 71.343802][ T6623] RAX: ffffffffffffffda RBX: 00007f3dd7625fa0 RCX: 00007f3dd739df99 [ 71.343809][ T6623] RDX: 0000200000000b40 RSI: 0000200000000b00 RDI: 0000200000000ac0 [ 71.343815][ T6623] RBP: 00007f3dd81c1090 R08: 0000200000000200 R09: 0000000000000000 [ 71.343822][ T6623] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 71.343828][ T6623] R13: 00007f3dd7626038 R14: 00007f3dd7625fa0 R15: 00007ffe90241248 [ 71.343841][ T6623] [ 71.772678][ T6638] fuse: Bad value for 'blksize' [ 71.938689][ T6647] cgroup: Name too long [ 72.025450][ T6654] erspan1: entered promiscuous mode [ 72.072858][ T6656] FAULT_INJECTION: forcing a failure. [ 72.072858][ T6656] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 72.079025][ T6656] CPU: 2 UID: 0 PID: 6656 Comm: syz.1.240 Not tainted syzkaller #0 PREEMPT(full) [ 72.079042][ T6656] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 72.079049][ T6656] Call Trace: [ 72.079061][ T6656] [ 72.079067][ T6656] dump_stack_lvl+0x100/0x190 [ 72.079128][ T6656] should_fail_ex.cold+0x5/0xa [ 72.079160][ T6656] strncpy_from_user+0x3b/0x2d0 [ 72.079200][ T6656] do_getname+0x78/0x390 [ 72.079227][ T6656] user_path_at+0x26/0x60 [ 72.079239][ T6656] __x64_sys_mount+0x1fb/0x310 [ 72.079256][ T6656] ? __pfx___x64_sys_mount+0x10/0x10 [ 72.079276][ T6656] do_syscall_64+0x115/0x870 [ 72.079296][ T6656] ? clear_bhb_loop+0x40/0x90 [ 72.079310][ T6656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.079323][ T6656] RIP: 0033:0x7efe3bf9df99 [ 72.079334][ T6656] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 72.079346][ T6656] RSP: 002b:00007efe3cf11028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 72.079362][ T6656] RAX: ffffffffffffffda RBX: 00007efe3c225fa0 RCX: 00007efe3bf9df99 [ 72.079369][ T6656] RDX: 0000200000000b40 RSI: 0000200000000b00 RDI: 0000200000000ac0 [ 72.079376][ T6656] RBP: 00007efe3cf11090 R08: 0000200000000200 R09: 0000000000000000 [ 72.079383][ T6656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 72.079389][ T6656] R13: 00007efe3c226038 R14: 00007efe3c225fa0 R15: 00007fffe9501b48 [ 72.079403][ T6656] [ 72.261318][ T6665] ntfs3: Unknown parameter 'discarder0' [ 72.543327][ T6704] macvtap0: entered allmulticast mode [ 72.545173][ T6704] veth0_macvtap: entered allmulticast mode [ 72.722933][ T6719] netlink: 4 bytes leftover after parsing attributes in process `syz.1.260'. [ 72.732110][ T6719] netlink: 112 bytes leftover after parsing attributes in process `syz.1.260'. [ 72.794933][ T6724] netlink: 'syz.1.261': attribute type 1 has an invalid length. [ 72.812967][ T6724] bond1: option mode: invalid value (7) [ 72.817270][ T6724] bond1 (unregistering): Released all slaves [ 72.847030][ T6727] bond0: entered allmulticast mode [ 72.849343][ T6727] bond_slave_0: entered allmulticast mode [ 72.852168][ T6727] bond_slave_1: entered allmulticast mode [ 72.961004][ T6729] trusted_key: encrypted_key: insufficient parameters specified [ 73.210388][ T24] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 73.360308][ T24] usb 6-1: Using ep0 maxpacket: 8 [ 73.364445][ T24] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 73.367723][ T24] usb 6-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 73.372399][ T24] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 73.376230][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 73.598549][ T5850] usb 6-1: USB disconnect, device number 4 [ 73.638908][ T6737] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 73.698722][ T6742] x_tables: duplicate underflow at hook 1 [ 73.791245][ T6752] FAULT_INJECTION: forcing a failure. [ 73.791245][ T6752] name failslab, interval 1, probability 0, space 0, times 0 [ 73.796305][ T6752] CPU: 3 UID: 0 PID: 6752 Comm: syz.2.268 Not tainted syzkaller #0 PREEMPT(full) [ 73.796320][ T6752] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 73.796327][ T6752] Call Trace: [ 73.796331][ T6752] [ 73.796337][ T6752] dump_stack_lvl+0x100/0x190 [ 73.796357][ T6752] should_fail_ex.cold+0x5/0xa [ 73.796372][ T6752] should_failslab+0xc2/0x120 [ 73.796389][ T6752] __kmalloc_noprof+0xfc/0x820 [ 73.796403][ T6752] ? rcu_is_watching+0x12/0xc0 [ 73.796433][ T6752] ? tomoyo_realpath_from_path+0xb6/0x690 [ 73.796455][ T6752] tomoyo_realpath_from_path+0xb6/0x690 [ 73.796470][ T6752] tomoyo_mount_acl+0x1b6/0x8b0 [ 73.796487][ T6752] ? is_bpf_text_address+0x8a/0x1a0 [ 73.796508][ T6752] ? bpf_ksym_find+0x128/0x1c0 [ 73.796526][ T6752] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 73.796540][ T6752] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 73.796557][ T6752] ? kernel_text_address+0x8d/0x100 [ 73.796573][ T6752] ? unwind_get_return_address+0x59/0xa0 [ 73.796609][ T6752] ? tomoyo_domain+0xb2/0x150 [ 73.796629][ T6752] ? tomoyo_profile+0x47/0x60 [ 73.796649][ T6752] tomoyo_mount_permission+0x214/0x460 [ 73.796675][ T6752] ? tomoyo_mount_permission+0x1f6/0x460 [ 73.796705][ T6752] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 73.796743][ T6752] security_sb_mount+0xdd/0x270 [ 73.796778][ T6752] path_mount+0x158/0x23d0 [ 73.796804][ T6752] ? __pfx_path_mount+0x10/0x10 [ 73.796820][ T6752] ? lockdep_hardirqs_on+0x78/0x100 [ 73.796852][ T6752] ? putname+0xb1/0x110 [ 73.796868][ T6752] ? kmem_cache_free+0x127/0x6b0 [ 73.796892][ T6752] ? __x64_sys_mount+0x293/0x310 [ 73.796911][ T6752] __x64_sys_mount+0x293/0x310 [ 73.796935][ T6752] ? __pfx___x64_sys_mount+0x10/0x10 [ 73.796961][ T6752] do_syscall_64+0x115/0x870 [ 73.796974][ T6752] ? clear_bhb_loop+0x40/0x90 [ 73.796988][ T6752] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.797000][ T6752] RIP: 0033:0x7f3dd739df99 [ 73.797010][ T6752] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 73.797021][ T6752] RSP: 002b:00007f3dd81c1028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 73.797033][ T6752] RAX: ffffffffffffffda RBX: 00007f3dd7625fa0 RCX: 00007f3dd739df99 [ 73.797039][ T6752] RDX: 0000200000000b40 RSI: 0000200000000b00 RDI: 0000200000000ac0 [ 73.797046][ T6752] RBP: 00007f3dd81c1090 R08: 0000200000000200 R09: 0000000000000000 [ 73.797052][ T6752] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 73.797059][ T6752] R13: 00007f3dd7626038 R14: 00007f3dd7625fa0 R15: 00007ffe90241248 [ 73.797072][ T6752] [ 73.797077][ T6752] ERROR: Out of memory at tomoyo_realpath_from_path. [ 73.976440][ T43] kauditd_printk_skb: 16 callbacks suppressed [ 73.976453][ T43] audit: type=1400 audit(1785365591.103:482): avc: denied { read } for pid=6760 comm="syz.2.271" name="mice" dev="devtmpfs" ino=940 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 73.985891][ T43] audit: type=1400 audit(1785365591.103:483): avc: denied { open } for pid=6760 comm="syz.2.271" path="/dev/input/mice" dev="devtmpfs" ino=940 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 74.000513][ T5887] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 74.028940][ T6763] nbd: must specify a device to reconfigure [ 74.126343][ T43] audit: type=1400 audit(1785365591.253:484): avc: denied { unmount } for pid=5738 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 74.140422][ T5887] usb 8-1: device descriptor read/64, error -71 [ 74.390365][ T5887] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 74.520479][ T5887] usb 8-1: device descriptor read/64, error -71 [ 74.631874][ T5887] usb usb8-port1: attempt power cycle [ 74.942886][ T6771] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 74.970414][ T5887] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 75.002498][ T5887] usb 8-1: device descriptor read/8, error -71 [ 75.260327][ T5887] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 75.291043][ T5887] usb 8-1: device descriptor read/8, error -71 [ 75.413104][ T5887] usb usb8-port1: unable to enumerate USB device [ 75.561021][ T34] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 75.710539][ T34] usb 8-1: device descriptor read/64, error -71 [ 75.970368][ T34] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 76.113423][ T34] usb 8-1: device descriptor read/64, error -71 [ 76.221168][ T34] usb usb8-port1: attempt power cycle [ 76.561113][ T34] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 76.722730][ T34] usb 8-1: device descriptor read/8, error -71 [ 76.781724][ T43] audit: type=1400 audit(1785365593.913:485): avc: denied { create } for pid=6775 comm="syz.3.276" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 76.863891][ T6777] gadgetfs: bound to dummy_udc driver [ 77.021243][ T6781] netlink: 'syz.1.275': attribute type 1 has an invalid length. [ 77.023812][ T6781] netlink: 'syz.1.275': attribute type 2 has an invalid length. [ 77.178765][ T43] audit: type=1400 audit(1785365594.303:486): avc: denied { ioctl } for pid=6786 comm="syz.1.278" path="socket:[13070]" dev="sockfs" ino=13070 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 77.186478][ T6788] syzkaller1: entered promiscuous mode [ 77.191988][ T6788] syzkaller1: entered allmulticast mode [ 77.447047][ T6797] clocksource: Override clocksource jiffies is not currently HRT compatible - deferring [ 77.603464][ T43] audit: type=1400 audit(1785365594.733:487): avc: denied { create } for pid=6798 comm="syz.1.282" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 77.613861][ T43] audit: type=1400 audit(1785365594.733:488): avc: denied { ioctl } for pid=6798 comm="syz.1.282" path="socket:[13075]" dev="sockfs" ino=13075 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 77.689340][ T6806] futex_wake_op: syz.3.283 tries to shift op by -1; fix this program [ 77.803864][ T6808] netdevsim netdevsim3 netdevsim3: entered allmulticast mode [ 77.958473][ T43] audit: type=1400 audit(1785365595.083:489): avc: denied { watch watch_reads } for pid=6816 comm="syz.2.286" path="/64" dev="tmpfs" ino=357 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 78.057265][ T6823] warning: `syz.3.287' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 78.072707][ T6818] xt_recent: Unsupported userspace flags (000000b2) [ 78.088497][ T43] audit: type=1400 audit(1785365595.213:490): avc: denied { write } for pid=6822 comm="syz.2.288" name="/" dev="9p" ino=82313407 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 78.100495][ T43] audit: type=1400 audit(1785365595.233:491): avc: denied { ioctl } for pid=6815 comm="syz.3.287" path="socket:[15524]" dev="sockfs" ino=15524 ioctlcmd=0x8916 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 78.573342][ T6844] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 78.637894][ T6846] ip6gre1: entered promiscuous mode [ 78.639685][ T6846] ip6gre1: entered allmulticast mode [ 79.308120][ T6848] kvm: user requested TSC rate below hardware speed [ 79.316675][ T43] kauditd_printk_skb: 5 callbacks suppressed [ 79.316685][ T43] audit: type=1400 audit(1785365596.443:497): avc: denied { cmd } for pid=6847 comm="syz.1.296" path="/dev/ublk-control" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 79.342726][ T43] audit: type=1400 audit(1785365596.473:498): avc: denied { map } for pid=6847 comm="syz.1.296" path="/dev/ublkc0" dev="devtmpfs" ino=2886 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 79.596003][ T6853] FAULT_INJECTION: forcing a failure. [ 79.596003][ T6853] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 79.602287][ T6853] CPU: 2 UID: 0 PID: 6853 Comm: syz.1.299 Not tainted syzkaller #0 PREEMPT(full) [ 79.602304][ T6853] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 79.602310][ T6853] Call Trace: [ 79.602315][ T6853] [ 79.602319][ T6853] dump_stack_lvl+0x100/0x190 [ 79.602339][ T6853] should_fail_ex.cold+0x5/0xa [ 79.602355][ T6853] _copy_from_user+0x2e/0xd0 [ 79.602372][ T6853] input_event_from_user+0x123/0x310 [ 79.602401][ T6853] ? __pfx_input_event_from_user+0x10/0x10 [ 79.602417][ T6853] ? __pfx___might_resched+0x10/0x10 [ 79.602433][ T6853] ? input_inject_event+0x198/0x380 [ 79.602450][ T6853] evdev_write+0x342/0x610 [ 79.602469][ T6853] ? __pfx_evdev_write+0x10/0x10 [ 79.602501][ T6853] ? bpf_lsm_file_permission+0x9/0x10 [ 79.602521][ T6853] ? security_file_permission+0x76/0x210 [ 79.602533][ T6853] ? rw_verify_area+0xce/0x6d0 [ 79.602551][ T6853] vfs_write+0x2aa/0x1050 [ 79.602569][ T6853] ? __pfx_evdev_write+0x10/0x10 [ 79.602586][ T6853] ? __pfx_vfs_write+0x10/0x10 [ 79.602602][ T6853] ? find_held_lock+0x2b/0x80 [ 79.602620][ T6853] ? __fget_files+0x215/0x3d0 [ 79.602632][ T6853] ? __fget_files+0x215/0x3d0 [ 79.602645][ T6853] ? __fget_files+0x21f/0x3d0 [ 79.602660][ T6853] ksys_write+0x1f8/0x250 [ 79.602677][ T6853] ? __pfx_ksys_write+0x10/0x10 [ 79.602698][ T6853] do_syscall_64+0x115/0x870 [ 79.602712][ T6853] ? clear_bhb_loop+0x40/0x90 [ 79.602726][ T6853] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.602737][ T6853] RIP: 0033:0x7efe3bf9df99 [ 79.602748][ T6853] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.602781][ T6853] RSP: 002b:00007efe3cf11028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 79.602799][ T6853] RAX: ffffffffffffffda RBX: 00007efe3c225fa0 RCX: 00007efe3bf9df99 [ 79.602809][ T6853] RDX: 00000000000012d8 RSI: 0000200000000040 RDI: 0000000000000009 [ 79.602816][ T6853] RBP: 00007efe3cf11090 R08: 0000000000000000 R09: 0000000000000000 [ 79.602822][ T6853] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 79.602828][ T6853] R13: 00007efe3c226038 R14: 00007efe3c225fa0 R15: 00007fffe9501b48 [ 79.602842][ T6853] [ 79.608204][ T6855] bridge1: entered promiscuous mode [ 79.698673][ T6855] bridge1: entered allmulticast mode [ 79.806147][ T6859] netlink: 8 bytes leftover after parsing attributes in process `syz.2.301'. [ 79.812746][ T6859] net_ratelimit: 12 callbacks suppressed [ 79.812762][ T6859] openvswitch: netlink: Multiple metadata blocks provided [ 79.904600][ T6863] bond1: (slave batadv0): Device is not bonding slave [ 79.907370][ T6863] bond1: option active_slave: invalid value (batadv0) [ 79.911624][ T6863] bond1 (unregistering): Released all slaves [ 79.965899][ T43] audit: type=1400 audit(1785365597.093:499): avc: denied { mount } for pid=6865 comm="syz.2.303" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 79.976919][ T43] audit: type=1400 audit(1785365597.103:500): avc: denied { create } for pid=6865 comm="syz.2.303" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 79.977845][ T6866] Bluetooth: MGMT ver 1.23 [ 79.987837][ T43] audit: type=1400 audit(1785365597.103:501): avc: denied { write } for pid=6865 comm="syz.2.303" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 80.007488][ T6866] netlink: 4 bytes leftover after parsing attributes in process `syz.2.303'. [ 80.046357][ T6866] team0: Port device team_slave_0 removed [ 80.112724][ T6871] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 80.133010][ T43] audit: type=1400 audit(1785365597.263:502): avc: denied { setopt } for pid=6870 comm="syz.1.305" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 80.133188][ T6871] ieee802154 phy0 wpan0: encryption failed: -22 [ 80.142662][ T43] audit: type=1400 audit(1785365597.273:503): avc: denied { unmount } for pid=5737 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 80.159792][ T43] audit: type=1400 audit(1785365597.283:504): avc: denied { getopt } for pid=6870 comm="syz.1.305" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 80.169014][ T6874] netlink: 16 bytes leftover after parsing attributes in process `syz.2.306'. [ 80.193207][ T6873] nvme_fabrics: missing parameter 'transport=%s' [ 80.196706][ T6873] nvme_fabrics: missing parameter 'nqn=%s' [ 80.228201][ T43] audit: type=1400 audit(1785365597.353:505): avc: denied { read write } for pid=6879 comm="syz.2.308" name="rdma_cm" dev="devtmpfs" ino=1294 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 80.242731][ T43] audit: type=1400 audit(1785365597.353:506): avc: denied { open } for pid=6879 comm="syz.2.308" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1294 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 80.243214][ T6883] netlink: 24 bytes leftover after parsing attributes in process `syz.2.308'. [ 80.301697][ T6883] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=6883 comm=syz.2.308 [ 80.377969][ T6885] FAULT_INJECTION: forcing a failure. [ 80.377969][ T6885] name failslab, interval 1, probability 0, space 0, times 0 [ 80.382141][ T6885] CPU: 1 UID: 0 PID: 6885 Comm: syz.1.309 Not tainted syzkaller #0 PREEMPT(full) [ 80.382157][ T6885] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.382164][ T6885] Call Trace: [ 80.382169][ T6885] [ 80.382173][ T6885] dump_stack_lvl+0x100/0x190 [ 80.382194][ T6885] should_fail_ex.cold+0x5/0xa [ 80.382210][ T6885] should_failslab+0xc2/0x120 [ 80.382226][ T6885] __kmalloc_cache_noprof+0x91/0x6c0 [ 80.382244][ T6885] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 80.382269][ T6885] ? v9fs_get_tree+0x9c/0xb50 [ 80.382320][ T6885] v9fs_get_tree+0x9c/0xb50 [ 80.382343][ T6885] ? rcu_is_watching+0x12/0xc0 [ 80.382370][ T6885] ? __pfx_v9fs_get_tree+0x10/0x10 [ 80.382396][ T6885] ? bpf_lsm_capable+0x9/0x10 [ 80.382416][ T6885] ? security_capable+0x80/0x260 [ 80.382440][ T6885] vfs_get_tree+0x92/0x320 [ 80.382463][ T6885] path_mount+0x7d0/0x23d0 [ 80.382480][ T6885] ? __pfx_path_mount+0x10/0x10 [ 80.382493][ T6885] ? lockdep_hardirqs_on+0x78/0x100 [ 80.382508][ T6885] ? putname+0xb1/0x110 [ 80.382519][ T6885] ? kmem_cache_free+0x127/0x6b0 [ 80.382534][ T6885] ? __x64_sys_mount+0x293/0x310 [ 80.382552][ T6885] __x64_sys_mount+0x293/0x310 [ 80.382574][ T6885] ? __pfx___x64_sys_mount+0x10/0x10 [ 80.382599][ T6885] do_syscall_64+0x115/0x870 [ 80.382616][ T6885] ? clear_bhb_loop+0x40/0x90 [ 80.382636][ T6885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.382652][ T6885] RIP: 0033:0x7efe3bf9df99 [ 80.382668][ T6885] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.382683][ T6885] RSP: 002b:00007efe3cf11028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 80.382701][ T6885] RAX: ffffffffffffffda RBX: 00007efe3c225fa0 RCX: 00007efe3bf9df99 [ 80.382713][ T6885] RDX: 0000200000000b40 RSI: 0000200000000b00 RDI: 0000200000000ac0 [ 80.382723][ T6885] RBP: 00007efe3cf11090 R08: 0000200000000200 R09: 0000000000000000 [ 80.382734][ T6885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 80.382744][ T6885] R13: 00007efe3c226038 R14: 00007efe3c225fa0 R15: 00007fffe9501b48 [ 80.382787][ T6885] [ 80.693063][ T6890] F2FS-fs (nbd2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 80.697325][ T6890] F2FS-fs (nbd2): Can't find valid F2FS filesystem in 1th superblock [ 80.701553][ T6890] F2FS-fs (nbd2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 80.704682][ T6890] F2FS-fs (nbd2): Can't find valid F2FS filesystem in 2th superblock [ 80.718624][ T6895] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 80.793210][ T6897] netlink: 4 bytes leftover after parsing attributes in process `syz.1.314'. [ 80.834009][ T6900] netlink: 8 bytes leftover after parsing attributes in process `syz.1.315'. [ 80.914148][ T6905] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 80.961084][ T6904] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 80.971725][ T6904] CIFS mount error: No usable UNC path provided in device string! [ 80.971725][ T6904] [ 80.975970][ T6904] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 81.195259][ T6931] syzkaller0: entered promiscuous mode [ 81.197054][ T6931] syzkaller0: entered allmulticast mode [ 81.361388][ T6939] netlink: 16 bytes leftover after parsing attributes in process `syz.1.326'. [ 81.486622][ T29] cfg80211: failed to load regulatory.db [ 81.497754][ T6951] netlink: 'syz.1.327': attribute type 7 has an invalid length. [ 81.501032][ T6951] netlink: 4 bytes leftover after parsing attributes in process `syz.1.327'. [ 81.516509][ T6951] netlink: 'syz.1.327': attribute type 7 has an invalid length. [ 81.517628][ T5790] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 81.519039][ T6951] netlink: 4 bytes leftover after parsing attributes in process `syz.1.327'. [ 81.525686][ T5790] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 81.537438][ T5790] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 81.550400][ T5790] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 81.689247][ T6957] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 82.809310][ T5097] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 82.813821][ T5097] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 82.817961][ T5097] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 82.825210][ T5097] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 82.835662][ T5097] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 83.064118][ T5790] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.172566][ T5790] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.266603][ T5790] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.286231][ T6960] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.288519][ T6960] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.291784][ T6960] bridge_slave_0: entered allmulticast mode [ 83.295648][ T6960] bridge_slave_0: entered promiscuous mode [ 83.299574][ T6960] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.302178][ T6960] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.304920][ T6960] bridge_slave_1: entered allmulticast mode [ 83.308740][ T6960] bridge_slave_1: entered promiscuous mode [ 83.336080][ T6960] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.342191][ T6960] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.365406][ T5790] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.384660][ T6960] team0: Port device team_slave_0 added [ 83.389257][ T6960] team0: Port device team_slave_1 added [ 83.412609][ T6960] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.414832][ T6960] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.423613][ T6960] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.429233][ T6960] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.432260][ T6960] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.442930][ T6960] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.473812][ T6960] hsr_slave_0: entered promiscuous mode [ 83.476044][ T6960] hsr_slave_1: entered promiscuous mode [ 83.478027][ T6960] debugfs: 'hsr0' already exists in 'hsr' [ 83.479745][ T6960] Cannot create hsr debugfs directory [ 83.560501][ T5790] bridge_slave_1: left allmulticast mode [ 83.562937][ T5790] bridge_slave_1: left promiscuous mode [ 83.566471][ T5790] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.574716][ T5790] bridge_slave_0: left allmulticast mode [ 83.576529][ T5790] bridge_slave_0: left promiscuous mode [ 83.578362][ T5790] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.681463][ T5790] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 83.686470][ T5790] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 83.692701][ T5790] bond0 (unregistering): Released all slaves [ 83.780624][ T5790] tipc: Left network mode [ 83.981989][ T5790] hsr_slave_0: left promiscuous mode [ 83.985128][ T5790] hsr_slave_1: left promiscuous mode [ 83.988064][ T5790] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 83.991480][ T5790] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 84.003908][ T5790] veth1_macvtap: left promiscuous mode [ 84.006438][ T5790] veth0_macvtap: left promiscuous mode [ 84.008881][ T5790] veth1_vlan: left promiscuous mode [ 84.012414][ T5790] veth0_vlan: left promiscuous mode [ 84.118641][ T5790] team0 (unregistering): Port device team_slave_1 removed [ 84.130887][ T5790] team0 (unregistering): Port device team_slave_0 removed [ 84.401256][ T6941] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 84.410059][ T6960] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 84.441273][ T6960] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.447400][ T6960] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 84.456701][ T6960] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.460623][ T6960] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 84.466973][ T6960] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.471578][ T6960] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 84.492788][ T6960] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.521745][ T6979] syzkaller0: entered promiscuous mode [ 84.524063][ T6979] syzkaller0: entered allmulticast mode [ 84.529886][ T43] kauditd_printk_skb: 9 callbacks suppressed [ 84.529902][ T43] audit: type=1400 audit(1785365601.653:516): avc: denied { write } for pid=6980 comm="syz.3.332" name="/" dev="9p" ino=82313407 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 84.558600][ T43] audit: type=1400 audit(1785365601.683:517): avc: denied { write } for pid=6984 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 84.618318][ T43] audit: type=1400 audit(1785365601.743:518): avc: denied { write } for pid=6997 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 84.648261][ T6960] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.659946][ T6960] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.677146][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.679749][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.684906][ T7004] tmpfs: Bad value for 'mpol' [ 84.686615][ T7004] tmpfs: Bad value for 'mpol' [ 84.688548][ T7004] tmpfs: Bad value for 'mpol' [ 84.690163][ T7004] tmpfs: Bad value for 'mpol' [ 84.692076][ T7004] tmpfs: Bad value for 'mpol' [ 84.693754][ T7004] tmpfs: Bad value for 'mpol' [ 84.695644][ T7004] tmpfs: Bad value for 'mpol' [ 84.696114][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.697289][ T7004] tmpfs: Bad value for 'mpol' [ 84.697394][ T7004] tmpfs: Bad value for 'mpol' [ 84.697498][ T7004] tmpfs: Bad value for 'mpol' [ 84.697642][ T7004] tmpfs: Bad value for 'mpol' [ 84.698187][ T7004] tmpfs: Bad value for 'mpol' [ 84.700922][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.717537][ T7004] tmpfs: Bad value for 'mpol' [ 84.718966][ T5450] 8021q: adding VLAN 0 to HW filter on device eth2 [ 84.719326][ T7004] tmpfs: Bad value for 'mpol' [ 84.723341][ T7004] tmpfs: Bad value for 'mpol' [ 84.725143][ T7004] tmpfs: Bad value for 'mpol' [ 84.728020][ T7004] tmpfs: Bad value for 'mpol' [ 84.729746][ T7004] tmpfs: Bad value for 'mpol' [ 84.731713][ T7004] tmpfs: Bad value for 'mpol' [ 84.733671][ T7004] tmpfs: Bad value for 'mpol' [ 84.735412][ T7004] tmpfs: Bad value for 'mpol' [ 84.737741][ T7004] tmpfs: Bad value for 'mpol' [ 84.739984][ T7004] tmpfs: Bad value for 'mpol' [ 84.744787][ T6960] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 84.746109][ T7004] tmpfs: Bad value for 'mpol' [ 84.751425][ T7004] tmpfs: Bad value for 'mpol' [ 84.753206][ T7004] tmpfs: Bad value for 'mpol' [ 84.754910][ T7004] tmpfs: Bad value for 'mpol' [ 84.756550][ T7004] tmpfs: Bad value for 'mpol' [ 84.758326][ T7004] tmpfs: Bad value for 'mpol' [ 84.760031][ T7004] tmpfs: Bad value for 'mpol' [ 84.762011][ T7004] tmpfs: Bad value for 'mpol' [ 84.764009][ T7004] tmpfs: Bad value for 'mpol' [ 84.765996][ T7004] tmpfs: Bad value for 'mpol' [ 84.849192][ T43] audit: type=1400 audit(1785365601.973:519): avc: denied { write } for pid=7011 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 84.891995][ T7017] bond3: option mode: invalid value (134) [ 84.897164][ T7017] bond3 (unregistering): Released all slaves [ 84.900561][ T64] Bluetooth: hci4: command tx timeout [ 84.903903][ T43] audit: type=1400 audit(1785365602.033:520): avc: denied { write } for pid=7022 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 84.910928][ T43] audit: type=1400 audit(1785365602.033:521): avc: denied { mount } for pid=7016 comm="syz.3.336" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 84.913025][ T7019] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 84.943190][ T5450] 8021q: adding VLAN 0 to HW filter on device eth3 [ 84.970170][ T43] audit: type=1400 audit(1785365602.093:522): avc: denied { remount } for pid=7030 comm="syz.2.339" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 84.993463][ T7038] IPVS: sync thread started: state = BACKUP, mcast_ifn = sit0, syncid = 0, id = 0 [ 85.012862][ T43] audit: type=1400 audit(1785365602.143:523): avc: denied { write } for pid=7036 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 85.024297][ T43] audit: type=1400 audit(1785365602.153:524): avc: denied { unmount } for pid=5740 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 85.059772][ T7043] FAULT_INJECTION: forcing a failure. [ 85.059772][ T7043] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 85.065599][ T7043] CPU: 3 UID: 0 PID: 7043 Comm: syz.2.342 Not tainted syzkaller #0 PREEMPT(full) [ 85.065616][ T7043] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.065623][ T7043] Call Trace: [ 85.065626][ T7043] [ 85.065631][ T7043] dump_stack_lvl+0x100/0x190 [ 85.065651][ T7043] should_fail_ex.cold+0x5/0xa [ 85.065667][ T7043] _copy_from_user+0x2e/0xd0 [ 85.065684][ T7043] input_event_from_user+0x123/0x310 [ 85.065702][ T7043] ? __pfx_input_event_from_user+0x10/0x10 [ 85.065718][ T7043] ? __pfx___might_resched+0x10/0x10 [ 85.065733][ T7043] ? input_inject_event+0x198/0x380 [ 85.065751][ T7043] evdev_write+0x342/0x610 [ 85.065770][ T7043] ? __pfx_evdev_write+0x10/0x10 [ 85.065787][ T7043] ? bpf_lsm_file_permission+0x9/0x10 [ 85.065805][ T7043] ? security_file_permission+0x76/0x210 [ 85.065817][ T7043] ? rw_verify_area+0xce/0x6d0 [ 85.065835][ T7043] vfs_write+0x2aa/0x1050 [ 85.065853][ T7043] ? __pfx_evdev_write+0x10/0x10 [ 85.065869][ T7043] ? __pfx_vfs_write+0x10/0x10 [ 85.065886][ T7043] ? find_held_lock+0x2b/0x80 [ 85.065904][ T7043] ? __fget_files+0x215/0x3d0 [ 85.065915][ T7043] ? __fget_files+0x215/0x3d0 [ 85.065929][ T7043] ? __fget_files+0x21f/0x3d0 [ 85.065943][ T7043] ksys_write+0x1f8/0x250 [ 85.065966][ T7043] ? __pfx_ksys_write+0x10/0x10 [ 85.065987][ T7043] do_syscall_64+0x115/0x870 [ 85.066000][ T7043] ? clear_bhb_loop+0x40/0x90 [ 85.066014][ T7043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.066025][ T7043] RIP: 0033:0x7f3dd739df99 [ 85.066036][ T7043] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.066046][ T7043] RSP: 002b:00007f3dd81c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 85.066057][ T7043] RAX: ffffffffffffffda RBX: 00007f3dd7625fa0 RCX: 00007f3dd739df99 [ 85.066064][ T7043] RDX: 00000000000012d8 RSI: 0000200000000040 RDI: 0000000000000009 [ 85.066070][ T7043] RBP: 00007f3dd81c1090 R08: 0000000000000000 R09: 0000000000000000 [ 85.066076][ T7043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 85.066082][ T7043] R13: 00007f3dd7626038 R14: 00007f3dd7625fa0 R15: 00007ffe90241248 [ 85.066096][ T7043] [ 85.074666][ T6960] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.098919][ T43] audit: type=1400 audit(1785365602.223:525): avc: denied { write } for pid=7048 comm="syz.2.344" name="autofs" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 85.138004][ T5450] 8021q: adding VLAN 0 to HW filter on device eth4 [ 85.196999][ T7056] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 85.279855][ T6960] veth0_vlan: entered promiscuous mode [ 85.291522][ T6960] veth1_vlan: entered promiscuous mode [ 85.294496][ T34] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 85.308525][ T6960] veth0_macvtap: entered promiscuous mode [ 85.315297][ T6960] veth1_macvtap: entered promiscuous mode [ 85.322606][ T5450] 8021q: adding VLAN 0 to HW filter on device eth5 [ 85.340371][ T6960] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.348529][ T6960] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.362269][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.365019][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.367684][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.376869][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.461869][ T34] usb 8-1: Using ep0 maxpacket: 32 [ 85.465848][ T34] usb 8-1: unable to get BOS descriptor or descriptor too short [ 85.478941][ T95] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.482139][ T34] usb 8-1: string descriptor 0 read error: -22 [ 85.482264][ T95] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.485138][ T34] usb 8-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 85.493320][ T34] usb 8-1: New USB device strings: Mfr=1, Product=252, SerialNumber=3 [ 85.511784][ T34] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 85.518140][ T34] dw2102: su3000_power_ctrl: 1, initialized 0 [ 85.522292][ T34] dvb-usb: bulk message failed: -22 (2/0) [ 85.533731][ T34] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 85.539130][ T34] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 85.539465][ T95] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.544519][ T34] usb 8-1: media controller created [ 85.547913][ T95] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.550079][ T34] dvb-usb: bulk message failed: -22 (6/0) [ 85.557866][ T34] dw2102: i2c transfer failed. [ 85.560652][ T34] dvb-usb: bulk message failed: -22 (6/0) [ 85.563134][ T34] dw2102: i2c transfer failed. [ 85.565375][ T34] dvb-usb: bulk message failed: -22 (6/0) [ 85.569413][ T34] dw2102: i2c transfer failed. [ 85.572112][ T34] dvb-usb: bulk message failed: -22 (6/0) [ 85.574608][ T34] dw2102: i2c transfer failed. [ 85.576671][ T34] dvb-usb: bulk message failed: -22 (6/0) [ 85.579085][ T34] dw2102: i2c transfer failed. [ 85.583261][ T34] dvb-usb: bulk message failed: -22 (6/0) [ 85.585730][ T34] dw2102: i2c transfer failed. [ 85.587758][ T34] dvb-usb: MAC address: 02:02:02:02:02:02 [ 85.605765][ T34] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 85.625138][ T34] dvb-usb: bulk message failed: -22 (3/0) [ 85.627553][ T34] dw2102: command 0x0e transfer failed. [ 85.629426][ T34] dvb-usb: bulk message failed: -22 (3/0) [ 85.631346][ T34] dw2102: command 0x0e transfer failed. [ 85.675079][ T7083] loop3: detected capacity change from 0 to 7 [ 85.696678][ T7083] Dev loop3: unable to read RDB block 7 [ 85.701299][ T7083] loop3: AHDI p1 p2 p3 [ 85.703215][ T7083] loop3: partition table partially beyond EOD, truncated [ 85.706355][ T7083] loop3: p1 start 1601398130 is beyond EOD, truncated [ 85.709223][ T7083] loop3: p2 start 1702059890 is beyond EOD, truncated [ 85.760777][ T7091] IPVS: sync thread started: state = MASTER, mcast_ifn = batadv0, syncid = 0, id = 0 [ 85.777470][ T7092] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 85.788075][ T7092] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 85.832545][ T7094] SELinux: policydb version 432414857 does not match my version range 15-35 [ 85.841010][ T7094] SELinux: failed to load policy [ 85.868035][ T7103] syzkaller0: entered promiscuous mode [ 85.876103][ T7103] syzkaller0: entered allmulticast mode [ 85.952672][ T34] dvb-usb: bulk message failed: -22 (3/0) [ 85.960112][ T34] dw2102: command 0x0e transfer failed. [ 85.969171][ T34] dvb-usb: bulk message failed: -22 (3/0) [ 85.975951][ T34] dw2102: command 0x0e transfer failed. [ 85.983848][ T34] dvb-usb: bulk message failed: -22 (1/0) [ 85.991639][ T34] dw2102: command 0x51 transfer failed. [ 86.017854][ T7131] netlink: 8 bytes leftover after parsing attributes in process `syz.1.360'. [ 86.019609][ T7129] netlink: 'syz.2.359': attribute type 12 has an invalid length. [ 86.039337][ T34] DVB: Unable to find symbol ds3000_attach() [ 86.047381][ T34] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 86.053996][ T7135] syzkaller0: entered promiscuous mode [ 86.059204][ T7135] syzkaller0: entered allmulticast mode [ 86.105407][ T7139] overlayfs: conflicting options: nfs_export=on,index=off [ 86.113654][ T7141] overlayfs: overlapping lowerdir path [ 86.120674][ T7139] netlink: 4 bytes leftover after parsing attributes in process `syz.1.362'. [ 86.129078][ T7139] bridge0: port 4(macvlan2) entered blocking state [ 86.133161][ T7139] bridge0: port 4(macvlan2) entered disabled state [ 86.137291][ T7139] macvlan2: entered allmulticast mode [ 86.140279][ T34] rc_core: IR keymap rc-su3000 not found [ 86.142186][ T34] Registered IR keymap rc-empty [ 86.147578][ T34] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.3/usb8/8-1/rc/rc0 [ 86.155852][ T34] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.3/usb8/8-1/rc/rc0/input8 [ 86.158215][ T7139] macvlan2: left allmulticast mode [ 86.172113][ T34] dvb-usb: schedule remote query interval to 150 msecs. [ 86.176558][ T34] dw2102: su3000_power_ctrl: 0, initialized 1 [ 86.182865][ T34] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 86.191938][ T34] usb 8-1: USB disconnect, device number 12 [ 86.221654][ T5749] udevd[5749]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 86.259933][ T34] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 86.319798][ T7159] syzkaller0: entered promiscuous mode [ 86.324376][ T7159] syzkaller0: entered allmulticast mode [ 86.459989][ T7172] netlink: 'syz.1.373': attribute type 4 has an invalid length. [ 86.463891][ T7172] netlink: 152 bytes leftover after parsing attributes in process `syz.1.373'. [ 86.477035][ T7172] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 86.489052][ T7172] netlink: 8 bytes leftover after parsing attributes in process `syz.1.373'. [ 86.494927][ T7172] netlink: 8 bytes leftover after parsing attributes in process `syz.1.373'. [ 86.496961][ T7176] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 86.517449][ T7168] can: request_module (can-proto-0) failed. [ 86.569761][ T7179] evm: overlay not supported [ 86.569792][ T7181] netlink: 8 bytes leftover after parsing attributes in process `syz.1.375'. [ 86.570016][ T7168] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.372'. [ 86.570036][ T7168] veth0_to_bond: default FDB implementation only supports local addresses [ 86.572042][ T7168] batman_adv: batadv0: Adding interface: dummy0 [ 86.572054][ T7168] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.572082][ T7168] batman_adv: batadv0: Interface activated: dummy0 [ 86.578850][ T7174] batadv0: mtu less than device minimum [ 86.606618][ T7174] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 86.611275][ T7174] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 86.616214][ T7174] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 86.624917][ T7167] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 86.625062][ T7174] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 86.627931][ T7167] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 86.632068][ T7174] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 86.634004][ T7167] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 86.638403][ T7174] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 86.644936][ T7174] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 86.665223][ T7167] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 86.673014][ T7167] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 86.774175][ T7184] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 86.782170][ T7189] e1000e 0000:00:02.0 eth1: removed PHC [ 86.919530][ T7189] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 87.136234][ T7218] FAULT_INJECTION: forcing a failure. [ 87.136234][ T7218] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 87.143450][ T7218] CPU: 2 UID: 0 PID: 7218 Comm: syz.3.383 Not tainted syzkaller #0 PREEMPT(full) [ 87.143467][ T7218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.143474][ T7218] Call Trace: [ 87.143478][ T7218] [ 87.143483][ T7218] dump_stack_lvl+0x100/0x190 [ 87.143544][ T7218] should_fail_ex.cold+0x5/0xa [ 87.143577][ T7218] _copy_from_user+0x2e/0xd0 [ 87.143616][ T7218] input_event_from_user+0x123/0x310 [ 87.143641][ T7218] ? __pfx_input_event_from_user+0x10/0x10 [ 87.143659][ T7218] ? __pfx___might_resched+0x10/0x10 [ 87.143682][ T7218] ? input_inject_event+0x198/0x380 [ 87.143700][ T7218] evdev_write+0x342/0x610 [ 87.143720][ T7218] ? __pfx_evdev_write+0x10/0x10 [ 87.143737][ T7218] ? bpf_lsm_file_permission+0x9/0x10 [ 87.143761][ T7218] ? security_file_permission+0x76/0x210 [ 87.143780][ T7218] ? rw_verify_area+0xce/0x6d0 [ 87.143799][ T7218] vfs_write+0x2aa/0x1050 [ 87.143817][ T7218] ? __pfx_evdev_write+0x10/0x10 [ 87.143835][ T7218] ? __pfx_vfs_write+0x10/0x10 [ 87.143851][ T7218] ? find_held_lock+0x2b/0x80 [ 87.143874][ T7218] ? __fget_files+0x215/0x3d0 [ 87.143886][ T7218] ? __fget_files+0x215/0x3d0 [ 87.143900][ T7218] ? __fget_files+0x21f/0x3d0 [ 87.143932][ T7218] ksys_write+0x1f8/0x250 [ 87.143950][ T7218] ? __pfx_ksys_write+0x10/0x10 [ 87.143972][ T7218] do_syscall_64+0x115/0x870 [ 87.143995][ T7218] ? clear_bhb_loop+0x40/0x90 [ 87.144009][ T7218] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.144021][ T7218] RIP: 0033:0x7fd5e139df99 [ 87.144032][ T7218] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.144043][ T7218] RSP: 002b:00007fd5e22c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 87.144055][ T7218] RAX: ffffffffffffffda RBX: 00007fd5e1625fa0 RCX: 00007fd5e139df99 [ 87.144061][ T7218] RDX: 00000000000012d8 RSI: 0000200000000040 RDI: 0000000000000009 [ 87.144068][ T7218] RBP: 00007fd5e22c8090 R08: 0000000000000000 R09: 0000000000000000 [ 87.144074][ T7218] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 87.144080][ T7218] R13: 00007fd5e1626038 R14: 00007fd5e1625fa0 R15: 00007ffc99738158 [ 87.144094][ T7218] [ 87.208743][ T7194] usb_phy_generic usb_phy_generic.2.auto: dummy supplies not allowed for exclusive requests (id=vbus) [ 87.233673][ T7194] dwc2 dwc2.3.auto: supply vusb_d not found, using dummy regulator [ 87.247833][ T7194] dwc2 dwc2.3.auto: supply vusb_a not found, using dummy regulator [ 87.261870][ T7194] dwc2 dwc2.3.auto: Configuration mismatch. dr_mode forced to host [ 87.264836][ T7194] dwc2 dwc2.3.auto: Bad value for GSNPSID: 0x52540012 [ 87.447864][ T7234] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 87.453421][ T7232] syz_tun: entered allmulticast mode [ 87.537124][ T7242] syzkaller0: entered promiscuous mode [ 87.539481][ T7242] syzkaller0: entered allmulticast mode [ 87.616515][ T7244] syzkaller1: entered promiscuous mode [ 87.619024][ T7244] syzkaller1: entered allmulticast mode [ 87.694119][ T7198] syz.1.380 (7198) used greatest stack depth: 19120 bytes left [ 87.977295][ T7269] kvm: pic: level sensitive irq not supported [ 88.304286][ T7293] netlink: 60 bytes leftover after parsing attributes in process `syz.4.397'. [ 88.591061][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 88.661282][ T64] Bluetooth: hci4: command 0x0419 tx timeout [ 88.748549][ T7310] netlink: 16 bytes leftover after parsing attributes in process `syz.2.403'. [ 88.750356][ T64] Bluetooth: hci1: command 0x0c1a tx timeout [ 88.967005][ T7326] netlink: 16 bytes leftover after parsing attributes in process `syz.3.408'. [ 89.041061][ T7331] random: crng reseeded on system resumption [ 89.074880][ T7333] netlink: 'syz.3.411': attribute type 8 has an invalid length. [ 89.239705][ T7346] syz_tun: entered allmulticast mode [ 89.311808][ T7351] binder: 7349:7351 ioctl c018620c 2000000005c0 returned -1 [ 89.415608][ T7357] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 89.619257][ T43] kauditd_printk_skb: 69 callbacks suppressed [ 89.619276][ T43] audit: type=1400 audit(1785365606.743:595): avc: denied { ioctl } for pid=7370 comm="syz.4.424" path="socket:[21851]" dev="sockfs" ino=21851 ioctlcmd=0x8971 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 89.646392][ T43] audit: type=1400 audit(1785365606.773:596): avc: denied { read } for pid=7372 comm="syz.3.425" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 89.694494][ T7376] libceph: resolve '0' (ret=-3): failed [ 89.701318][ T7376] comedi comedi4: bad chanlist[0]=0x00000008 chan=8 range length=2 [ 90.044233][ T43] audit: type=1400 audit(1785365607.173:597): avc: denied { lock } for pid=7396 comm="syz.4.432" path="/18/file1/file0" dev="9p" ino=82313411 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 90.257514][ T43] audit: type=1400 audit(1785365607.383:598): avc: denied { read write } for pid=7404 comm="syz.2.435" name="file0" dev="fuse" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 90.267473][ T43] audit: type=1400 audit(1785365607.383:599): avc: denied { open } for pid=7404 comm="syz.2.435" path="/115/file0/file0" dev="fuse" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 90.449055][ T43] audit: type=1400 audit(1785365607.573:600): avc: denied { read write } for pid=7419 comm="syz.3.440" name="ptp1" dev="devtmpfs" ino=1289 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 90.463183][ T43] audit: type=1400 audit(1785365607.573:601): avc: denied { open } for pid=7419 comm="syz.3.440" path="/dev/ptp1" dev="devtmpfs" ino=1289 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 90.488679][ T43] audit: type=1400 audit(1785365607.573:602): avc: denied { ioctl } for pid=7419 comm="syz.3.440" path="/dev/ptp1" dev="devtmpfs" ino=1289 ioctlcmd=0x3d05 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 90.686092][ T43] audit: type=1400 audit(1785365607.813:603): avc: denied { audit_read } for pid=7428 comm="syz.2.442" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 90.753359][ T64] Bluetooth: hci4: command 0x0419 tx timeout [ 90.898741][ T43] audit: type=1400 audit(1785365608.023:604): avc: denied { bind } for pid=7446 comm="syz.1.447" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 90.979575][ T7455] syzkaller0: entered promiscuous mode [ 90.984709][ T7455] syzkaller0: entered allmulticast mode [ 91.067350][ T7468] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 91.162600][ T7473] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 64993 [ 91.193274][ T7480] __nla_validate_parse: 4 callbacks suppressed [ 91.193330][ T7480] netlink: 20 bytes leftover after parsing attributes in process `syz.1.460'. [ 91.263025][ T7489] netlink: 484 bytes leftover after parsing attributes in process `syz.4.463'. [ 91.354702][ T7499] overlayfs: failed to verify upper (123/file1, ino=672, err=-116) [ 91.359308][ T7499] overlayfs: failed to verify index dir 'upper' xattr [ 91.362620][ T7499] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 91.381121][ T7500] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 91.397020][ T7499] kvm: kvm [7497]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x40000019) = 0x1 [ 91.654403][ T7518] 0x00000000001d-0x000000020000 : "" [ 91.687830][ T7518] ftl_cs: FTL header corrupt! [ 91.914490][ T7535] netlink: 'syz.3.477': attribute type 11 has an invalid length. [ 91.923540][ T7535] netlink: 'syz.3.477': attribute type 4 has an invalid length. [ 91.925987][ T7535] netlink: 224 bytes leftover after parsing attributes in process `syz.3.477'. [ 91.978113][ T7538] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 92.049512][ T7547] lo: entered allmulticast mode [ 92.088151][ T7554] syzkaller0: entered promiscuous mode [ 92.097346][ T7554] syzkaller0: entered allmulticast mode [ 92.171795][ T7566] netlink: 88 bytes leftover after parsing attributes in process `syz.3.489'. [ 92.223289][ T7574] 9pnet_fd: Insufficient options for proto=fd [ 92.341577][ T7591] netlink: 'syz.2.498': attribute type 1 has an invalid length. [ 92.345755][ T7591] netlink: 'syz.2.498': attribute type 1 has an invalid length. [ 92.356286][ T7595] syzkaller0: entered promiscuous mode [ 92.358465][ T7595] syzkaller0: entered allmulticast mode [ 92.543055][ T5887] usb 9-1: new full-speed USB device number 2 using dummy_hcd [ 92.658336][ T7621] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '@' [ 92.678980][ T7627] netlink: 68 bytes leftover after parsing attributes in process `syz.1.509'. [ 92.691879][ T5887] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 92.695040][ T5887] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 92.697733][ T5887] usb 9-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 92.700817][ T5887] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.705740][ T5887] usb 9-1: config 0 descriptor?? [ 92.709601][ T5887] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 92.712798][ T5887] dvb-usb: bulk message failed: -22 (3/0) [ 92.719977][ T5887] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 92.723718][ T5887] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 92.726130][ T5887] usb 9-1: media controller created [ 92.728577][ T5887] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 92.730557][ T29] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 92.737042][ T5887] dvb-usb: bulk message failed: -22 (6/0) [ 92.739745][ T5887] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 92.744553][ T5887] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb9/9-1/input/input11 [ 92.749563][ T5887] dvb-usb: schedule remote query interval to 150 msecs. [ 92.752072][ T5887] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 92.772983][ T24] bridge0: entered promiscuous mode [ 92.830365][ T64] Bluetooth: hci4: command 0x0419 tx timeout [ 92.842446][ T7638] netlink: 'syz.1.513': attribute type 1 has an invalid length. [ 92.855061][ T7638] bond1: entered promiscuous mode [ 92.857119][ T7638] 8021q: adding VLAN 0 to HW filter on device bond1 [ 92.867921][ T7638] 8021q: adding VLAN 0 to HW filter on device bond1 [ 92.870368][ T29] usb 7-1: device descriptor read/64, error -71 [ 92.870402][ T7638] bond1: (slave vti0): The slave device specified does not support setting the MAC address [ 92.876117][ T7638] bond1: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 92.882587][ T7638] bond1: (slave vti0): making interface the new active one [ 92.885033][ T7638] vti0: entered promiscuous mode [ 92.887783][ T7638] bond1: (slave vti0): Enslaving as an active interface with an up link [ 92.893826][ T7638] net_ratelimit: 12 callbacks suppressed [ 92.893836][ T7638] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 92.919010][ T5887] dvb-usb: bulk message failed: -22 (1/0) [ 92.921373][ T5887] dvb-usb: error while querying for an remote control event. [ 92.924848][ T5887] usb 9-1: USB disconnect, device number 2 [ 92.937628][ T7641] syzkaller0: entered promiscuous mode [ 92.938602][ T5887] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 92.939462][ T7641] syzkaller0: entered allmulticast mode [ 93.130314][ T29] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 93.275821][ T29] usb 7-1: device descriptor read/64, error -71 [ 93.383611][ T29] usb usb7-port1: attempt power cycle [ 93.498059][ T7666] syzkaller0: entered promiscuous mode [ 93.500369][ T7666] syzkaller0: entered allmulticast mode [ 93.649777][ T7671] use of bytesused == 0 is deprecated and will be removed in the future, [ 93.655052][ T7671] use the actual size instead. [ 93.730417][ T29] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 93.751430][ T29] usb 7-1: device descriptor read/8, error -71 [ 93.781207][ T7678] netlink: 4 bytes leftover after parsing attributes in process `syz.4.528'. [ 93.964384][ T7688] syz_tun: entered allmulticast mode [ 94.020804][ T29] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 94.043228][ T29] usb 7-1: device descriptor read/8, error -71 [ 94.160485][ T29] usb usb7-port1: unable to enumerate USB device [ 94.249119][ T7700] netlink: 4 bytes leftover after parsing attributes in process `syz.3.534'. [ 94.403045][ T64] Bluetooth: hci3: Malformed MSFT vendor event: 0x02 [ 94.566197][ T7728] bridge1: entered promiscuous mode [ 94.568456][ T7728] bridge1: entered allmulticast mode [ 94.675053][ T7734] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 94.743113][ T43] kauditd_printk_skb: 24 callbacks suppressed [ 94.743126][ T43] audit: type=1400 audit(1785365611.873:629): avc: denied { setopt } for pid=7735 comm="syz.3.547" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 94.791852][ T7742] (syz.3.549,7742,2):ocfs2_get_sector:1713 ERROR: status = -5 [ 94.797125][ T7742] (syz.3.549,7742,2):ocfs2_sb_probe:753 ERROR: status = -5 [ 94.800956][ T7742] (syz.3.549,7742,2):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 94.805954][ T7742] (syz.3.549,7742,2):ocfs2_fill_super:1177 ERROR: status = -5 [ 94.910370][ T64] Bluetooth: hci4: command 0x0419 tx timeout [ 95.005410][ T43] audit: type=1400 audit(1785365612.133:630): avc: denied { ioctl } for pid=7754 comm="syz.1.553" path="socket:[30761]" dev="sockfs" ino=30761 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 95.054617][ T7759] program syz.1.554 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 95.068865][ T7759] team0: Port device vlan2 added [ 95.235700][ T7769] 8021q: VLANs not supported on tunl0 [ 95.246854][ T7769] 8021q: VLANs not supported on tunl0 [ 95.358849][ T7780] syzkaller0: entered promiscuous mode [ 95.363200][ T7780] syzkaller0: entered allmulticast mode [ 95.466095][ T43] audit: type=1400 audit(1785365612.593:631): avc: denied { ioctl } for pid=7783 comm="syz.4.561" path="socket:[29861]" dev="sockfs" ino=29861 ioctlcmd=0x943c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 95.472765][ T7782] netlink: 8 bytes leftover after parsing attributes in process `syz.3.559'. [ 95.478093][ T7785] loop2: detected capacity change from 0 to 231 [ 95.483592][ T7782] netlink: 24 bytes leftover after parsing attributes in process `syz.3.559'. [ 95.493034][ T7785] loop2: AHDI p1 p2 p3 [ 95.498167][ T7785] loop2: p1 start 1601398130 is beyond EOD, truncated [ 95.502984][ T7785] loop2: p2 start 1702059890 is beyond EOD, truncated [ 95.682175][ T7801] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 95.722527][ T43] audit: type=1400 audit(1785365612.853:632): avc: denied { write } for pid=7807 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 95.745694][ T7816] netlink: 24 bytes leftover after parsing attributes in process `syz.4.569'. [ 95.786140][ T43] audit: type=1400 audit(1785365612.913:633): avc: denied { write } for pid=7823 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 95.879472][ T7819] ================================================================== [ 95.882030][ T7819] BUG: KASAN: slab-use-after-free in __release_resource+0x276/0x2c0 [ 95.884598][ T7819] Read of size 8 at addr ffff88803cad0438 by task syz.2.570/7819 [ 95.885387][ T43] audit: type=1400 audit(1785365613.003:634): avc: denied { watch watch_reads } for pid=7826 comm="syz.4.571" path="/dev/pts/60" dev="devpts" ino=63 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_devpts_t tclass=chr_file permissive=1 [ 95.888353][ T7819] [ 95.888375][ T7819] CPU: 0 UID: 0 PID: 7819 Comm: syz.2.570 Not tainted syzkaller #0 PREEMPT(full) [ 95.888389][ T7819] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.888397][ T7819] Call Trace: [ 95.888402][ T7819] [ 95.888408][ T7819] dump_stack_lvl+0x100/0x190 [ 95.888440][ T7819] print_report+0x13d/0x4b0 [ 95.888468][ T7819] ? __virt_addr_valid+0x239/0x430 [ 95.888483][ T7819] ? __release_resource+0x276/0x2c0 [ 95.888499][ T7819] kasan_report+0xdf/0x1c0 [ 95.888521][ T7819] ? __release_resource+0x276/0x2c0 [ 95.888538][ T7819] __release_resource+0x276/0x2c0 [ 95.888555][ T7819] release_resource+0x26/0x40 [ 95.888571][ T7819] pci_remove_bus_device+0x2d3/0x3b0 [ 95.888610][ T7819] pci_stop_and_remove_bus_device_locked+0x1a/0x20 [ 95.888625][ T7819] remove_store+0x123/0x140 [ 95.888640][ T7819] ? __pfx_remove_store+0x10/0x10 [ 95.888654][ T7819] ? find_held_lock+0x2b/0x80 [ 95.888672][ T7819] ? sysfs_file_kobj+0xe4/0x290 [ 95.888690][ T7819] ? sysfs_file_kobj+0xe4/0x290 [ 95.888706][ T7819] ? __pfx_remove_store+0x10/0x10 [ 95.888720][ T7819] dev_attr_store+0x58/0x80 [ 95.888752][ T7819] ? __pfx_dev_attr_store+0x10/0x10 [ 95.888767][ T7819] sysfs_kf_write+0xf2/0x150 [ 95.888784][ T7819] kernfs_fop_write_iter+0x3e0/0x5f0 [ 95.888799][ T7819] ? __pfx_sysfs_kf_write+0x10/0x10 [ 95.888816][ T7819] vfs_write+0x6ac/0x1050 [ 95.888841][ T7819] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 95.888861][ T7819] ? __pfx_vfs_write+0x10/0x10 [ 95.888888][ T7819] ksys_write+0x12a/0x250 [ 95.888913][ T7819] ? __pfx_ksys_write+0x10/0x10 [ 95.888940][ T7819] do_syscall_64+0x115/0x870 [ 95.888966][ T7819] ? clear_bhb_loop+0x40/0x90 [ 95.888978][ T7819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.888990][ T7819] RIP: 0033:0x7f3dd739df99 [ 95.889001][ T7819] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.889012][ T7819] RSP: 002b:00007f3dd81c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.889024][ T7819] RAX: ffffffffffffffda RBX: 00007f3dd7625fa0 RCX: 00007f3dd739df99 [ 95.889032][ T7819] RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000003 [ 95.889038][ T7819] RBP: 00007f3dd7434ec4 R08: 0000000000000000 R09: 0000000000000000 [ 95.889051][ T7819] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.889057][ T7819] R13: 00007f3dd7626038 R14: 00007f3dd7625fa0 R15: 00007ffe90241248 [ 95.889067][ T7819] [ 95.889071][ T7819] [ 95.915686][ T43] audit: type=1400 audit(1785365613.003:635): avc: denied { write } for pid=7830 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 95.916367][ T7819] Allocated by task 7194: [ 95.916376][ T7819] kasan_save_stack+0x30/0x50 [ 95.916393][ T7819] kasan_save_track+0x14/0x30 [ 95.916405][ T7819] __kasan_kmalloc+0xaa/0xb0 [ 95.916417][ T7819] __kmalloc_node_track_caller_noprof+0x331/0x830 [ 95.973651][ T43] audit: type=1400 audit(1785365613.103:636): avc: denied { write } for pid=7835 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 95.975246][ T7819] kmemdup_noprof+0x29/0x60 [ 95.975276][ T7819] platform_device_add_resources+0x37/0x100 [ 96.003700][ T7819] dwc2_pci_probe+0x1d3/0x360 [ 96.005312][ T7819] local_pci_probe+0xdd/0x1b0 [ 96.006944][ T7819] pci_call_probe+0x176/0x800 [ 96.008489][ T7819] pci_device_probe+0x1cd/0x370 [ 96.010033][ T7819] really_probe+0x241/0xa60 [ 96.011650][ T7819] __driver_probe_device+0x20e/0x450 [ 96.013395][ T7819] device_driver_attach+0xd1/0x220 [ 96.015001][ T7819] bind_store+0xf4/0x190 [ 96.016324][ T7819] drv_attr_store+0x74/0xb0 [ 96.017733][ T7819] sysfs_kf_write+0xf2/0x150 [ 96.019199][ T7819] kernfs_fop_write_iter+0x3e0/0x5f0 [ 96.020905][ T7819] vfs_write+0x6ac/0x1050 [ 96.022225][ T7819] ksys_write+0x12a/0x250 [ 96.023608][ T7819] do_syscall_64+0x115/0x870 [ 96.025064][ T7819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.026917][ T7819] [ 96.027681][ T7819] Freed by task 7819: [ 96.028972][ T7819] kasan_save_stack+0x30/0x50 [ 96.030472][ T7819] kasan_save_track+0x14/0x30 [ 96.031973][ T7819] kasan_save_free_info+0x3b/0x70 [ 96.033465][ T7819] __kasan_slab_free+0x5f/0x80 [ 96.034890][ T7819] kfree+0x22b/0x6c0 [ 96.036090][ T7819] platform_device_release+0x8a/0xb0 [ 96.037715][ T7819] device_release+0xd2/0x270 [ 96.039102][ T7819] kobject_put+0x1f7/0x640 [ 96.040464][ T7819] put_device+0x1f/0x30 [ 96.041763][ T7819] platform_device_unregister+0x45/0x50 [ 96.043446][ T7819] dwc2_pci_remove+0x55/0xd0 [ 96.044819][ T7819] pci_device_remove+0xb2/0x1d0 [ 96.046265][ T7819] device_remove+0xcb/0x180 [ 96.047607][ T7819] device_release_driver_internal+0x44e/0x620 [ 96.049453][ T7819] pci_stop_bus_device+0x120/0x160 [ 96.051008][ T7819] pci_stop_and_remove_bus_device+0x58/0xa0 [ 96.052706][ T7819] pci_stop_and_remove_bus_device_locked+0x1a/0x20 [ 96.054587][ T7819] remove_store+0x123/0x140 [ 96.055965][ T7819] dev_attr_store+0x58/0x80 [ 96.057394][ T7819] sysfs_kf_write+0xf2/0x150 [ 96.058881][ T7819] kernfs_fop_write_iter+0x3e0/0x5f0 [ 96.060549][ T7819] vfs_write+0x6ac/0x1050 [ 96.061872][ T7819] ksys_write+0x12a/0x250 [ 96.063205][ T7819] do_syscall_64+0x115/0x870 [ 96.064596][ T7819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.066386][ T7819] [ 96.067131][ T7819] The buggy address belongs to the object at ffff88803cad0400 [ 96.067131][ T7819] which belongs to the cache kmalloc-128 of size 128 [ 96.069141][ T43] audit: type=1400 audit(1785365613.153:637): avc: denied { write } for pid=7838 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 96.071381][ T7819] The buggy address is located 56 bytes inside of [ 96.071381][ T7819] freed 128-byte region [ffff88803cad0400, ffff88803cad0480) [ 96.071396][ T7819] [ 96.071400][ T7819] The buggy address belongs to the physical page: [ 96.071405][ T7819] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3cad0 [ 96.071416][ T7819] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 96.071426][ T7819] page_type: f5(slab) [ 96.071437][ T7819] raw: 00fff00000000000 ffff88801bc42a00 dead000000000100 dead000000000122 [ 96.071447][ T7819] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 96.071453][ T7819] page dumped because: kasan: bad access detected [ 96.071459][ T7819] page_owner tracks the page as allocated [ 96.071463][ T7819] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5739, tgid 5739 (syz-executor), ts 69034696116, free_ts 68978438754 [ 96.071483][ T7819] post_alloc_hook+0xfd/0x120 [ 96.095611][ T43] audit: type=1400 audit(1785365613.203:638): avc: denied { read } for pid=5130 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 96.096187][ T7819] get_page_from_freelist+0xf48/0x3530 [ 96.118791][ T7819] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 96.120617][ T7819] new_slab+0xa2/0x640 [ 96.121904][ T7819] refill_objects+0xe3/0x410 [ 96.123323][ T7819] __pcs_replace_empty_main+0x376/0x680 [ 96.125051][ T7819] __kmalloc_cache_noprof+0x479/0x6c0 [ 96.126727][ T7819] kernfs_fop_open+0x9fa/0xd50 [ 96.128247][ T7819] do_dentry_open+0x6ab/0x14d0 [ 96.129744][ T7819] vfs_open+0x82/0x3f0 [ 96.131082][ T7819] path_openat+0x2873/0x4280 [ 96.132529][ T7819] do_file_open+0x20e/0x430 [ 96.133952][ T7819] do_sys_openat2+0x10f/0x1e0 [ 96.135442][ T7819] __x64_sys_openat+0x12d/0x210 [ 96.136963][ T7819] do_syscall_64+0x115/0x870 [ 96.138414][ T7819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.140262][ T7819] page last free pid 5739 tgid 5739 stack trace: [ 96.142157][ T7819] __free_frozen_pages+0x79f/0x1090 [ 96.143731][ T7819] qlist_free_all+0x47/0xf0 [ 96.145141][ T7819] kasan_quarantine_reduce+0x1a0/0x1f0 [ 96.146841][ T7819] __kasan_slab_alloc+0x69/0x90 [ 96.148298][ T7819] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 96.149794][ T7819] do_getname+0x35/0x390 [ 96.151172][ T7819] __x64_sys_unlink+0x36/0x70 [ 96.152647][ T7819] do_syscall_64+0x115/0x870 [ 96.154093][ T7819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.155875][ T7819] [ 96.156608][ T7819] Memory state around the buggy address: [ 96.158286][ T7819] ffff88803cad0300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 96.160666][ T7819] ffff88803cad0380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 96.163129][ T7819] >ffff88803cad0400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 96.165602][ T7819] ^ [ 96.167444][ T7819] ffff88803cad0480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 96.169972][ T7819] ffff88803cad0500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 96.172599][ T7819] ================================================================== [ 96.175619][ T7819] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 96.177888][ T7819] CPU: 0 UID: 0 PID: 7819 Comm: syz.2.570 Not tainted syzkaller #0 PREEMPT(full) [ 96.180781][ T7819] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.184565][ T7819] Call Trace: [ 96.185920][ T7819] [ 96.187106][ T7819] dump_stack_lvl+0x100/0x190 [ 96.188647][ T7819] vpanic+0x552/0x970 [ 96.189924][ T7819] ? __pfx_vpanic+0x10/0x10 [ 96.191437][ T7819] ? mark_held_locks+0x40/0x70 [ 96.193078][ T7819] ? irqentry_exit+0x24d/0xa00 [ 96.194646][ T7819] ? __release_resource+0x276/0x2c0 [ 96.196492][ T7819] panic+0xd1/0xe0 [ 96.197753][ T7819] ? __pfx_panic+0x10/0x10 [ 96.199279][ T7819] ? check_panic_on_warn+0x1f/0x90 [ 96.201068][ T7819] check_panic_on_warn.cold+0x19/0x34 [ 96.202899][ T7819] end_report.part.0+0x3a/0x90 [ 96.204427][ T7819] kasan_report.cold+0xe/0x18 [ 96.206032][ T7819] ? __release_resource+0x276/0x2c0 [ 96.207733][ T7819] __release_resource+0x276/0x2c0 [ 96.209314][ T7819] release_resource+0x26/0x40 [ 96.210865][ T7819] pci_remove_bus_device+0x2d3/0x3b0 [ 96.212634][ T7819] pci_stop_and_remove_bus_device_locked+0x1a/0x20 [ 96.214867][ T7819] remove_store+0x123/0x140 [ 96.216343][ T7819] ? __pfx_remove_store+0x10/0x10 [ 96.218038][ T7819] ? find_held_lock+0x2b/0x80 [ 96.219685][ T7819] ? sysfs_file_kobj+0xe4/0x290 [ 96.221805][ T7819] ? sysfs_file_kobj+0xe4/0x290 [ 96.223817][ T7819] ? __pfx_remove_store+0x10/0x10 [ 96.225639][ T7819] dev_attr_store+0x58/0x80 [ 96.227119][ T7819] ? __pfx_dev_attr_store+0x10/0x10 [ 96.229103][ T7819] sysfs_kf_write+0xf2/0x150 [ 96.230896][ T7819] kernfs_fop_write_iter+0x3e0/0x5f0 [ 96.232538][ T7819] ? __pfx_sysfs_kf_write+0x10/0x10 [ 96.234107][ T7819] vfs_write+0x6ac/0x1050 [ 96.235549][ T7819] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 96.237281][ T7819] ? __pfx_vfs_write+0x10/0x10 [ 96.238733][ T7819] ksys_write+0x12a/0x250 [ 96.240063][ T7819] ? __pfx_ksys_write+0x10/0x10 [ 96.241561][ T7819] do_syscall_64+0x115/0x870 [ 96.242973][ T7819] ? clear_bhb_loop+0x40/0x90 [ 96.244466][ T7819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.246326][ T7819] RIP: 0033:0x7f3dd739df99 [ 96.247667][ T7819] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.253354][ T7819] RSP: 002b:00007f3dd81c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 96.255878][ T7819] RAX: ffffffffffffffda RBX: 00007f3dd7625fa0 RCX: 00007f3dd739df99 [ 96.258275][ T7819] RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000003 [ 96.260625][ T7819] RBP: 00007f3dd7434ec4 R08: 0000000000000000 R09: 0000000000000000 [ 96.263048][ T7819] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.265497][ T7819] R13: 00007f3dd7626038 R14: 00007f3dd7625fa0 R15: 00007ffe90241248 [ 96.267910][ T7819] [ 96.269491][ T7819] Kernel Offset: disabled [ 96.270819][ T7819] Rebooting in 86400 seconds.. VM DIAGNOSIS: 22:53:33 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000061 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85a38b65 RDI=ffffffff9ba07b40 RBP=ffffffff9ba07b00 RSP=ffffc900037e7548 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=20666f2064616552 R12=0000000000000000 R13=0000000000000061 R14=ffffffff9b6fa218 R15=ffffffff85a38b00 RIP=ffffffff85a38b8f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f3dd81c16c0 ffffffff 00c00000 GS =0000 ffff8880d5ddc000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007fb9e3b8dff8 CR3=0000000038978000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=00000000000003ff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000004010010 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc99738646 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc99738646 00007ffc9973864c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd5e14354a7 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd5e14354e7 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd5e143564b ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd5e14354d9 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd5e15f1600 00007fd5e15f15e0 00007fd5e15f15e8 00007fd5e15f1618 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000004 0008000f0010000a ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd5e15f15f8 00007fd5e15f15c8 00007fd5e15f1600 00007fd5e15f15e0 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000048 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=1ffffffff1c8c9ea RBX=0000000000000008 RCX=ffffffff82870c0f RDX=dffffc0000000000 RSI=ffffffff8286fc40 RDI=0000000000000008 RBP=0000000000000000 RSP=ffffc900037f7440 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000000 R12=0000000000000000 R13=0000000000000001 R14=0000000000000000 R15=dffffc0000000000 RIP=ffffffff820a6040 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d5edc000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000000000000 CR3=000000002cd19000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000fefffc00 Opmask01=0000000000000054 Opmask02=00000000000000ff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055558e7d5520 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3d933f1e80 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3d933f1e80 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000003bf12 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055558e7d11b8 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff eb08018003180800 0610002010000600 74ca018002000726 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 05920303f8020005 9003060488000588 030c048400058403 1404000580030580 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 ae03000000000000 0000000000000001 ffffffffffffffff e508059403020200 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 080c80030c800406 800306800470a003 3808007090030808 0005b00300020005 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3e45e71a5d0fa5d4 16c96f9742f43bdc 67dab0ac22c9f18f 2b6fdb4cf0976750 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0106c084ac901000 7080040100001208 0606016bf6000800 70e00300100070d0 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 030fffffffffffff 0470c00302100070 b003501000069003 6dc5e66a4cca32c2 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 dd3e45e71a5d0fa5 d416c96f9742f43b dc67dab0ac22c9f1 8f2b6fdb4cf09767 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 50080c80030c8004 06800306800470a0 0338080070900308 080005b003000200 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6e206c6c61637379 7320746820737320 3265737320657373 207273786620786d ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6373745f746e6174 736e6f63206d6c20 7063737464722062 6731657064702078 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 706f74736e6f6e20 79676f6c6f706f74 78206c706f6e2064 6f6f675f70657220 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6973796870207374 6962203634203a09 73657a6973207373 65726464610a3436 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 67616e616d207265 776f700a6c617574 7269762073746962 203834202c6c6163 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000060000006f 666e697570632f63 6f72702f0000000d 0a0a3a746e656d65 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 01000000ffffffb0 0000000400000018 0000002c00000040 0000005400000070 info registers vcpu 2 CPU#2 RAX=0000000000000003 RBX=ffff88806a633c68 RCX=ffffffff91d27601 RDX=0000000000000000 RSI=ffffffff8c401600 RDI=ffffffff8e46d930 RBP=0000000000000002 RSP=ffffc9000630f650 R8 =0000000000000001 R9 =0000000000000007 R10=0000000000000200 R11=0000000000016c16 R12=ffffc9000630f728 R13=ffffc9000630f6d8 R14=ffffc9000630f9d0 R15=ffffc9000630f70c RIP=ffffffff81ee645d RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d5fdc000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f8f018d5ff8 CR3=00000000530ab000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000008000100 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 73746e6576652e70 6177732e79726f6d ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fffe9502036 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fffe9502036 00007fffe950203c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007efe3c0354a7 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007efe3c0354e7 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007efe3c03564b ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007efe3c0354d9 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000000020 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85a38b65 RDI=ffffffff9ba07b40 RBP=ffffffff9ba07b00 RSP=ffffc900007bf838 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=0000000000000000 R12=0000000000000000 R13=0000000000000020 R14=ffffffff9b6fa1f1 R15=ffffffff85a38b00 RIP=ffffffff85a38b8f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d60dc000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f0b8e9c07e8 CR3=0000000050d82000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000008000100 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 6c61636f6c2e7374 6e6576652e79726f ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe90241736 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe90241736 00007ffe9024173c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3dd74354a7 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3dd74354e7 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3dd743564b ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f3dd74354d9 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000