last executing test programs: 50.859090136s ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='./file0/file0/../file0\x00', 0x0, 0xa1c08, 0x0) mount$fuse(0x0, &(0x7f0000000380)='./file0/file0\x00', 0x0, 0x88000, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x22081, 0x0) write(r0, 0x0, 0x0) mount$bind(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00', 0x0, 0x2125099, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000440), 0x88, &(0x7f0000002540)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) 50.681514976s ago: executing program 0 (id=6): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000500)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000540)=[@text64={0x40, &(0x7f0000000580)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000080)={0x7, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000006c0)={[0x9, 0x0, 0xe9b, 0x22, 0x20000008, 0x7, 0x911d, 0x7, 0x8, 0xafa, 0x5, 0x1006, 0xc, 0x8, 0x8000, 0xffffffffffffffff], 0x1000, 0x200}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000780)=@x86={0x40, 0x1, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x0, 0x0, 0x1, 0xfffffff8, 0x0, 0xff, 0xff, 0x0, '\x00', 0x0, 0x6}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 49.821267005s ago: executing program 0 (id=11): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r1 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r0}, 0x8) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r2, @ANYBLOB="0100000002"], 0x40) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{r3}, &(0x7f00000000c0), &(0x7f0000000140)='%+9llu \x00'}, 0x20) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{r4}, &(0x7f00000000c0), &(0x7f0000000140)='%+9llu \x00'}, 0x20) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r5) close(0x4) 49.788569311s ago: executing program 32 (id=11): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r1 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r0}, 0x8) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r2, @ANYBLOB="0100000002"], 0x40) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{r3}, &(0x7f00000000c0), &(0x7f0000000140)='%+9llu \x00'}, 0x20) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{r4}, &(0x7f00000000c0), &(0x7f0000000140)='%+9llu \x00'}, 0x20) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r5) close(0x4) 44.719784491s ago: executing program 1 (id=76): mkdirat(0xffffffffffffffff, 0x0, 0x1ff) setns(0xc9, 0x0) socket$packet(0x11, 0x3, 0x300) mount(0x0, 0x0, 0x0, 0x0, 0x0) write$cgroup_pressure(0xffffffffffffffff, 0x0, 0x0) r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) write(r0, &(0x7f0000000000)="4ef782", 0x3) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl(0xffffffffffffffff, 0x404c4701, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f00000003c0)=0x1c) openat$procfs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/meminfo\x00', 0x0, 0x0) 44.672057026s ago: executing program 1 (id=78): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000009c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a80)=@setlink={0x3c, 0x13, 0x1, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'syz_tun\x00'}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x3c}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000b40)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0xd4}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000cc0)={0x28, 0x2, 0x3, 0x1, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xffff, 0x2}}]}, 0x28}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000d00)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x7e, @private1={0xfc, 0x1, '\x00', 0xfd}, @local, {[], {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000d80)={'vcan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000001000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r6, {0xb, 0xfff2}, {0xfff1, 0x9}, {0x2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050) 44.438485177s ago: executing program 1 (id=82): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r1, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0x1a000}], 0x1}, 0x0) sendmsg$rds(r1, &(0x7f0000000140)={&(0x7f0000000240)={0x2, 0xce21, @private=0xa010102}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x8c0}, 0x0) 43.408443939s ago: executing program 1 (id=91): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x123) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000280)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000002c0)='./bus\x00', &(0x7f0000000300), 0x8, &(0x7f0000000340)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r1 = open(&(0x7f0000000380)='./file0\x00', 0x400, 0x43) mknodat$loop(r1, &(0x7f00000003c0)='./file1\x00', 0x800, 0x1) r2 = open(&(0x7f0000000400)='./file0\x00', 0x0, 0x718bb647156ec3b7) chdir(&(0x7f0000000440)='./bus\x00') linkat(r2, &(0x7f00000004c0)='./file1\x00', r2, &(0x7f0000000500)='./file0\x00', 0x1000) write(r0, &(0x7f0000000600)='r:s/p ./file0:0', 0xf) 43.323868014s ago: executing program 1 (id=92): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x4c, 0x2c, 0xd3f, 0x4070bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x5, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x9, 0xffffffff}]}}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x24000804) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x20004014) 43.113173878s ago: executing program 1 (id=94): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000018c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88400, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) openat$tun(0xffffffffffffff9c, &(0x7f0000001a40), 0x1c1341, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, 0xffffffffffffffff, 0x0) syz_pidfd_open(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000200)=@assoc_value={0x0}, 0x0) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000280)={r3, 0x1}, 0x8) move_mount(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x12) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x2241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000340)={'pimreg\x00', 0x5005}) write$tun(r4, &(0x7f0000001a00)=ANY=[@ANYBLOB="01000900060016000c0063d3"], 0x40) r5 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000440), 0x88841, 0x0) ioctl$DM_TABLE_LOAD(r5, 0xc138fd09, &(0x7f0000000480)={0x4, 0x0, 0x0, 0x278, 0x138, 0x1, 0x0, 0x25411, 0x0, 0x0, @by_dev={r1}, [@verity={0x0, 0xc48, 0x0, 0x140, 'verity\x00', {'1', 0x20, @ram_num={'1:', 0x0}, 0x20, @ram_num={'1:', 0x0}, 0x20, '1024', 0x20, '4096', 0x20, 0x200000000061, 0x20, 0xfa, 0x20, 'sha512', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, @none, ' 2 ignore_zero_blocks check_at_most_once'}}]}) 42.99547813s ago: executing program 33 (id=94): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000018c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88400, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) openat$tun(0xffffffffffffff9c, &(0x7f0000001a40), 0x1c1341, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, 0xffffffffffffffff, 0x0) syz_pidfd_open(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000200)=@assoc_value={0x0}, 0x0) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000280)={r3, 0x1}, 0x8) move_mount(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x12) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x2241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000340)={'pimreg\x00', 0x5005}) write$tun(r4, &(0x7f0000001a00)=ANY=[@ANYBLOB="01000900060016000c0063d3"], 0x40) r5 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000440), 0x88841, 0x0) ioctl$DM_TABLE_LOAD(r5, 0xc138fd09, &(0x7f0000000480)={0x4, 0x0, 0x0, 0x278, 0x138, 0x1, 0x0, 0x25411, 0x0, 0x0, @by_dev={r1}, [@verity={0x0, 0xc48, 0x0, 0x140, 'verity\x00', {'1', 0x20, @ram_num={'1:', 0x0}, 0x20, @ram_num={'1:', 0x0}, 0x20, '1024', 0x20, '4096', 0x20, 0x200000000061, 0x20, 0xfa, 0x20, 'sha512', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, @none, ' 2 ignore_zero_blocks check_at_most_once'}}]}) 29.640714521s ago: executing program 5 (id=120): mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000540)='./proc\x00', &(0x7f0000000580)='proc\x00', 0x4000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x100010, 0xffffffffffffffff, 0xc369d000) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3, &(0x7f0000000000)=0xb, 0x8, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) r0 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000600)='100', 0x3) r1 = syz_open_dev$dvb_demux(&(0x7f0000000040), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_FILTER(r1, 0x403c6f2b, &(0x7f0000000080)={0x158f, {"d0e3c8a07bbe0c023789be3754ce08d4", "9a685d70b150df7e75922146fce3707b", "928f407a52aee446873acf64f69f5bbb"}, 0x200, 0x6}) r2 = syz_open_dev$dvb_demux(&(0x7f00000000c0), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r2, 0x403c6f2b, &(0x7f0000000100)={0xfffc, {"4772ffacff04856ec9e8776f8ee906be", "2dfad303e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, 0x0, 0x20000840) 29.631436541s ago: executing program 5 (id=121): socket$inet6(0xa, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f00000000c0)=0x33, 0x8) socket(0xa, 0x3, 0x87) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r2 = accept4(r0, 0x0, 0x0, 0x0) sendto(r2, &(0x7f0000000000), 0xfeb5, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000000)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x8000000000000000}, 0x0, 0x0) 29.546448652s ago: executing program 5 (id=129): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) close(r1) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x81}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf, 0xf}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4894}, 0x2) r6 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000340), 0x56) sendmsg$kcm(r6, &(0x7f0000000380)={&(0x7f00000003c0)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000540)="27030200dc0f14000e0007000024c1020000ff3207c2fb7fe0406e52534b4f6b3d00000000000000892f3c35d5a8", 0x2e}], 0x1}, 0x0) 29.380668497s ago: executing program 5 (id=135): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x44, 0x2c, 0xd3f, 0x4070bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x5, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x9, 0xffffffff}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x24000804) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x20004014) 29.230229318s ago: executing program 5 (id=136): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="7fff0000000100002800128009000100766c616e000000001800028006000100340200000c0002001f0000001e00000008000500", @ANYRES32=r3], 0x50}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="500000001000210400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a000000060001000001000008000500", @ANYRES32=r7], 0x50}}, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'hsr0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r8, {0x0, 0xa}, {0x10}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) 28.951543654s ago: executing program 5 (id=140): ioperm(0x0, 0x80, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000780), 0x6000, 0x0) fsopen(&(0x7f0000000940)='sockfs\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000a40)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000a80)='./dev\x00', &(0x7f0000000ac0)='devtmpfs\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000b40)=@filename='./dev/sda1\x00', &(0x7f0000000b80)='./mnt\x00', &(0x7f0000000bc0)='ext4\x00', 0x8410, 0x0) chdir(&(0x7f0000000c00)='./mnt\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000c40)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000c80), 0x208e24b) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000cc0)=ANY=[]) write$tun(r0, &(0x7f0000000d00)=ANY=[], 0x1c) llistxattr(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)=""/14, 0xe) 27.818074521s ago: executing program 4 (id=151): syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000680)='./proc\x00', &(0x7f00000006c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000740)='27', 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="00010000410001000800000000000000030100000f000000d700010010112233445566090099aabb86ddc0fb624dccd184cbe236099f36a6ea92c2b963489b08119ae6fcf67d02ab9930f82f51de0a22223177d6c26e368d430d01b5192332b0398c459c6b65d665c2941082a85b1138de78def5a0bbd2e1a452c7685e095903c43c2c876863df8e63750806be0d000000dc72ea3b0ad2cd932ae33adee9391333a0ebe9582b887cc505749df6725c7ad00b2783094fa9d6b43a4da0cc11caf3e009f23261c187535230732d21dda24c5aab32cbb356f113ad57cf9006ff7ef0be428a9026109bba43cae7629eea8900040002800c0003"], 0x100}}, 0x0) syz_usb_connect$uac1(0x0, 0x72, &(0x7f0000000000)=ANY=[], 0x0) pread64(r1, &(0x7f0000000080), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r2, 0x0, 0x40) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) 25.226297452s ago: executing program 2 (id=165): r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000040)="38000000240001050100000000000000000000000100000000000100ffffffff0000000008000100657473000c0002000500010003000000", 0x38) write(r0, &(0x7f00000001c0)="240000002a00010002000000000000000000000001000000010001000000010000000000", 0x24) write(r0, &(0x7f0000000200)="240000002a0001030300000000000000000000000100"/36, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./proc\x00', 0x1ff) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000380)='./proc\x00', &(0x7f00000003c0)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/thread-self/fail-nth\x00', 0x202, 0x150) write(r1, &(0x7f0000000500)='27', 0x2) setns(r1, 0x4000000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000540)='./cgroup.net/syz1\x00', 0x1ff) capset(0x0, 0x0) 25.18452643s ago: executing program 2 (id=166): ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0xc, 0x8, 0x2, 0xff, 0xff, 0x0, '\x00', 0xfc, 0x1}) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000026c0)=[@code={0xa, 0x70, {"b805000000b9000000000f01d96467f3250000000066b811010f00d866b80e010f00d0460f0848b804000000000000000f23d00f21f8350000000c0f23f84281bc0800a00000907c0000c4e221936457e565650f1c860000c0fec401557623"}}], 0x70}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x77, 0x2, 0x2, 0x4002004c4, 0x1004, 0x8000000000000004, 0xc595, 0x0, 0x5, 0xffffffffffffffff, 0x2000000000000000, 0x5, 0x8d], 0xeeee8000, 0x2010d3}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101000, 0x0) r0 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x80000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000580)={[0x2, 0x9, 0xfffffffffffffffd, 0x77, 0x2, 0x2, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x2000, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0x5, 0x90], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 25.023389675s ago: executing program 2 (id=168): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', 0x40003, 0x128) r1 = io_uring_setup(0x57fe, &(0x7f00000000c0)={0x0, 0x6c33, 0x1, 0x26, 0x2a9}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$BTRFS_IOC_SNAP_DESTROY(r1, 0x5000940f, &(0x7f0000001a80)={{r2}, "66275df7d11fd0a748f8a1570b60b76a64daada5337b2f490a9bae5fab5dd8f6f109ab855f06a386728a3839e08403f2f4bf5910f6acc37d4b4ada0ab7f58de9a7fe802b62a7a2444e649dc9a5056c7f25feb747b9753403b999b0684bfeed1b6743422b99b8a45fcde0fe3b33a68faa49c9f1e3714b10135e2f9dddf9088eb1dd3f7b70195bf59ebfcee8a9aa155ed7cef18ec15b86780daf17962296e2eb3952d472ccf788397ee6922fd2030e1aee7e6729167d0887909cb4775214e4fc2be3b8ea93fa6bc09beb3bd1d0bcb1f0bffcf5de532bb9ad85c6460e7eca81694b8b0a9066a274ae4603bc5fca9258acff5d56c2443cb50e21d49dc4db05462ddfac5cd81bd7a7835b4f6dd67b7268fd24c40a13e05e5d5a4d4ab67d709d33d8ae511d9bc16437fe0af2ca3a3569f753326abbf8fe14d80890d83ef6860cf80c16f4bae3adb59a09f4a515a2f2dd13064badbcd107bfdd3b29861d49bcb30f29048487b7d64d63f7f841827aa43227eb3d7735810427eddc90e409b0f75822b160986032a8a0c5dd372a48d8dc0c67ada7fed42f6bc46a2171c56193582d13461f34882559f717d538397ecdef032da49251803d68a69381c4177e9624fa91cfc7c270c1e8aac552e67e5ec747023f22fe4fe5cd3af87a537a13f9205b98bac27b9ca5dc3f4b2d6323c02cbc56e5604532b36234b483af3a6fc41b729784df9a4e7bd357604025fb31c16447484c34c4bb59edb1b0c5340f9b05c1a665d1acea75adc53768148702650f2fd658b03237da52505cfeedaa69b4d93bc1bf216ed107ebd54334ac6c308bc004321a3f87bf72a77acab5225d35463261510109d9406d730bb3a2268f8584212775551d6a798dde312dea527cac0293efe126010a1edd4723bae00acb734f1b1c43917b5b14a51ff27028556343288105528fd1995055a67f00911366ae6fd6632a395d99926c1decd0dfcf2b1a8fd1e9e719edf1490cd593acd7204bf24fa415b9cacb8a3c1891b4533333bad8b0151c3cc14f91f1003ecb56e696ee181348fba3ca70f791906d2b6738c6c33a133a564f5339d19a9707262e2b3cbc2d2102f4ed75a69ece19b6a5e9d468c8b698e539b65c2c4960a8734381ac1b86d0fbd6d7926317c16ce76a8c186321c10dc9ab1eaea0d9197dc3e4e2b7ff739cf06d7139055317ce6d2e5dad1a80eabb8e052985df38606d666bce8096a15da5b985b309ddc36a06fe057886eb120080ddcf3a9f981288f518caab7af3922150879ecdce254b1d553d88983f21ceb9125c4c8d11a34f898872095f03a025c25f57e93d24f72fa2d8e5fd117786c06f4e8f348d1f20de48869d17f4d5c21d42c6245b114c8e1941d92ec1415797d3c4fddbd658540d12ec7cead578c35cf3f811f203f9eef84828fd39f0d56d361a50b75fde74dc53d0deb716c61993855e4f9bfc739108465281dd64eb18458fd5bebe81459f9818e70775659089788d949abbae34f7ad80b99c4f48af8e407e79276e00e3f4f6322b1dd93d098c47cc639185e5cdf5687594001f4c312519973aafad0bb488e3d08933b21ce802b40e5ba5e6ed4f6971cd2c6d2528bf5880305bd56d41bf475a6faf70547baccaafeeff9903e6ecff10f74944bfcf6b1b0778e13c8b0461da8e8e46b9ef5c285edc74ce3be99e1c51c02be3d648fa198429b9c383f8a58a4b8e260009e3455808c51aad50f4d3b15c03753e48c2147c4922bf159aefc9b84bf3728f245fb676e4fb38a29f384cf7f39be5896d01220ac7e8ebb1563b3974084b7dcae17852df6fd5ff4a81ff2735429f15b16a712434b2e972548a692ace5d79223443cae93a7ec41cb020b10d255b5962e471448df644dcabc04f726cc451336ed04a8d4f867ae5271467408248df98c1a322af6aab34f4809227cb98202445bcae669ab654575344d4f7dcce0ea97659762701cbd38dec8976235b7ed28920cdfa76cdce9c03da2c4ce1a6681796d9be8671dc3ce638e21310c1a6cc910baeb0d063c282b44dd306ec7d2cf9769ae0e1a514261eb9d6795c5e8ac9eec7a131f98c503db3c89a1aca17683c7d58932952900708e9bddef3d71b2d2dc40d50f515fd33618dbff63db5e165218e9686713e90e461e84fb506caf1b4fb85d90897ea6f11df0b810e680eae10ae247799ff7b20a3c6756456f6956e991134b554637e5e38078818097506b51bafc53c1aeb93640e728b2a911698e1adfc88657a686b4f605c1906baa1cfa4d2427665b34a7c97ce837e24f4b0ff78ccc61ff7243269a05a3975833eb953d02d243f2a286a973d8bca86cf99e628029278226ea6c25e60eb8d91544b1a802332d29076800ad96a49be7c5cdd825353bbe28a5d0ec904dc60afe5c92e0446a496a674c2fa8042b1f0aff3a8cde50eb59a89e182596a6a1457310e206ee4d40144771958386f5d67b279fd0c48cb76a084aafcc4b302d8c3e583b4b36dcdf3701e1319c31e473e5abd02cca9c76e1ef16d6a82682415b7f77f418a462b2ad405db5317d69a347ac1b80bf98faac82b92a6b6397006bf008504e81f7e2971a3e5636cc291b8c9a1c7204c83d13bc98aa0a4e467112f8c7bb7c4c5e87026cab83719f9f37c0160f1d8518267e0efa65326e00bb67fb130145d0f2062edfaf4fb8177f3fb61973ae4d3117e6d286cb10edd3958f29ca34b9fdb0775050493b59749b49f9e7dc709a6d0a47984d631f7dbd0969e96e1aaefda24f89945f7410497ba933d2b69f5d06c278bcb5a1abdae976e702fc69807b62fa94ca6044bfb11b9069269978bf8b2e0921523049c0cf75bf75cc34aa2780669d334801500e675175846ecc1939e7189499f216aec9681deb417eaa52572cf18a11c40b71a7ccd5b9c1e66e01c4906bbcc1e9efa60c088895ecfc91ab90793c0cafe6cd494aa75df94cf240ecd995950088deda6fe72008cd112277a1286cec7d528ae0c790ff0aaf0c2327aee826e1d6018ac149e76f0bb6d329fd3fb13ebcf02b85c047649fd5464d505834f7e2d51b7248584b9e490629492aca850c515981cdb9997779e7366298cff950d8836afad4e939f971b2b9644453c0518e63258072cbe7f3e78009bad120c04492b2686a9a776bd39a7417c6381b2344f9c5e70c760014e98d4107ec593af5aef039ff3bb74d2769d3224144b7fb5d73e4d5613cc1fa77750b78d1a8dc9ec3acaac5170b292b1dcf2833ac9d23ad04ad05ca34eeaf885ea99f1dd26745a8baca0a6b58108510fe884ff8b83f52500e83a87b31a12fe2cbf69459489cdd5e822522865fa7344fb781d5f2016633ecbe9c2d0711c358c41a114cb6571aae42ceb985ac52885d7f557d3e82de2185a449b9e033a659da1a3f340c94bf696c04a756d308dac870eb2ebaf3e7490fa1a0e75890f7fb255a04403ae2a8876c600553d611a67dcb9695f6bd24029140b0df411c49a04ee73723703c561d462b03e38b80678d70baa8a949f6ee5cb277bb9c98bb57a3f8496c90a63b82da3c2f4577d14cb8a80328245ce2abb49e2eeb81e854cfd3aa27bfb3079d70952c96ec9eb1d329f47f426b845a47ea847925db02c60cee4ba8775684bd7a81ef71af55d10653a40a1c9cadab553a0a847894c96a32124b357d55eab17a24ee496b891165ebd8be1ec6746303602c9cc60a08be6911f8b9a5991382ff359fc5f9377785c50005e87345abbbc57f62e3795a91989948a525e68726744c68f0fd4a143c9007e3b61e5a4be07833b9c03b3c952aac560db037c00f158abf3e34695241d085f1f29dc0ee35f873f43474275afb65989ee7a68c32fe23c056776d87ac3eb19d63e88e29433b764062087d67ab61d41954f1134cbf248dac4068e0ae86c392ffc803c180ae2ccf7a91b4ec44849903754a000cedae1229d0d1bdd45c92fb00b7bb8b393d534ea50c98ecf10f235e90db305f03519d2a0fc5376c4e3f6a9e2406fbd30aaf90a41301dde0911505f747e760f44b5d69e12902adb03eb74b8c64edf46fd1027524a90d29f25f38d09ab0310cb35fbd938003466d8ad5380597b2e55d3cbea38ecc944cbe1d04c7f9a5c4ab32d9ad0bb2b8244b442428f2015bc1e7415402bf813e97bb854ae140f5f2538ef006775e899bfd105b0fb054847522080ae822e2ce1fb649ca66c01a6b63a80462b08ebac80ff951381e45b0ddb21603eb6da13c289576814fabe4ac1a8a504731bd926e5cf985405aa13c89fc6adb302dfc57f64599fd0e976f13e485cfc344a0bf5c6288a942298ed1ffdefd0bf5637a9de61e941bddb076c87af86f243bb196fca782dd9235dc300929572c6989a4becbef7aef0dd4a86e81533c8c2d05df93948e525398ed7fa2842c23ef32268d5f424103f57d194d6f906bf3556a77f6c6593fb4bcacd46c04c762f45567774ee2dfed443ce5fb8790a57569a13b72b5ab6a1afa5bf623290a289ee439a8fb95a1968da7284f55cf907e2ead7a96153c29639f482ce72b62a0eaf93abc7f03c97ac8c486150dff007087ac766e9d339b1a0391d87bd1a2a57f6a2cc941e2e97d046899020063bbbec0aaf1cf1b7f5aaf5c808387b35f09c2ea30a92ec0572a582af7cbfcba3d61c90a2adc791f1707314dde2428055b14ac3cdbd876366655c5373e703a98811d465df2f95aca6294945b211a290cc7dc3437d450273720b1afaa1515eabe43d2a7e4bd60c4c8f082de95d208ae9f6cba25015f3fe9f01f1cdde365153c8f13037f349ed8a0bcf2b7609d5c3fef162f4deb0b33fcfeee66222381ff86830351a97d4905d69652f642b7adf6317a7e3cab22f3eee4dff7c5327e98b609abae6f080109ab3da4eb81806c99fce3e7984152038fdf357a39ef74199bfa66047cc5e445550013d9d56cb0108cca86580618445c9b45b6d4c7f1b0b6fae6671095002e50b27422266f168e2c56b1744bba24aeffd2f9ad031add66abf36f4014b64b0a9f0ddb71af1113e61a6ea2465588b74dccd8ba8f60fe412f021970b0e247bba4ef030ce643d9ee6ac875c5f9484a91d25564a3b3d70cd0667ff1fc5d42be83491be01c806aa18767f35d3c8372d443943d4911476d2f9420b0dafdd85e488c6b51842533c7800363bd9d3fd7add5d13c9241246dc5acb266320e736ac3faf3dfb4a3763c5c232a27b92029725415393de976626cf30fdc9b01739d61108842d519b4471b60fd0da4d60317186d348beeba8535df2ce7020edfaedaf0e954a18eb193fbd28ad4a1e63a62dbbf12a15121f91cc80479315cbba2e07a1eb33df1afe50200bf60dd80d72dfad2d30316c839388951686bcf5aac3fb2d4589c9b0ff44f7e019717993009800f92a76cfbd1adbb7a07163e2e24ed50e323385b5377c7ce547520ee0e31dc4915bb493cc3ea5124493fd63826c35b7f211ec7f9abf640a3005662cf46678fc30085741091b846335c994b40c1cbef92eb29394db0461c9e58158a668436c57e8f0f15dda95d28a82d6cab6a2c0f889afc1d7a702ef3279a954a8f28284156b15328ac779bd7280798f39d638cd4d9c1ce361430a7e7d11296e73725e382bb30e37c4bf07d4267e678e4310b8019eb884b28539770480b13495dd68c1fae72ac2beeca1708a28c89f580eac0f0f6c56839f95ec2645ace7b0ee36e577f840469a921f48cefe92493c3e6e0a7261fff6fe4048e71622ec932d3b70643ed4fc7363ca6cbe0eded13842ea37bc0f70d49a58a65972432e02702bb9de0eb9ade356a2b798b3e7"}) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x83, &(0x7f0000001140)=@assoc_value={0x0}, &(0x7f0000001180)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f00000011c0)={r3, 0x9, 0x400, 0xf, 0x2, 0x7}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF_FLAGS(r0, 0x84, 0x7a, &(0x7f0000001200)={r3, 0xffffffffffffffff, 0x80000}, &(0x7f0000001240)=0xc) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001280)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000012c0)='./sys\x00', &(0x7f0000001300)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000001340)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r4, &(0x7f0000001380)='add 1', 0x5) write(r4, &(0x7f00000013c0), 0x0) write(r4, &(0x7f0000001400)='add 3', 0x5) 24.9784007s ago: executing program 2 (id=169): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 24.819006224s ago: executing program 2 (id=170): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x10, 0x803, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006140)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x25ffdbfd, {0x0, 0x0, 0x0, r6, {0xf, 0xf}, {}, {0x7, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000006100)=@delchain={0x24, 0x65, 0x1, 0x70bd2e, 0x25dfdbff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff3}, {}, {0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x4c898}, 0x20004804) 24.799449332s ago: executing program 4 (id=171): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000640)={'batadv0\x00', 0x0}) syz_genetlink_get_family_id$batadv(0x0, r1) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r3) syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$FE_SET_TONE(0xffffffffffffffff, 0x6f42, &(0x7f0000000100)=0x1) syz_emit_ethernet(0x46, &(0x7f0000000280)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000300)={@link_local, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x48, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, "f19f00", 0x0, 0x0, 0x0, @private1, @private2, [@hopopts={0x3a, 0x1, '\x00', [@calipso={0x7, 0x8, {0x0, 0x0, 0x0, 0x80}}]}]}}}}}}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x600}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x100, {0x0, 0x0, 0x0, r2, {0xffe0, 0x1}, {0xe, 0xfff3}, {0xfff1}}}, 0x24}}, 0x4) 24.717795682s ago: executing program 2 (id=172): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./dev\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = open(&(0x7f0000000040)='./bus\x00', 0x1c527e, 0x10) r1 = open(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', 0x1a1342, 0x0) fallocate(r0, 0x0, 0x0, 0x1000f4) sendfile(r0, r0, 0x0, 0x40000000800) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendfile(r1, r0, 0x0, 0x7ffff000) 24.580343541s ago: executing program 4 (id=173): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff5656d, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x8}, {0x1, 0xb}, {0x7, 0x3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4, 0x13, 0x7, 0x8, 0xfbee}, 0x8000002, 0x1, 0x3, 0x5, 0xe, 0x6, 0xd, 0x18, 0x5, 0x2, {0x6, 0xc, 0xfffffffc, 0x0, 0xffffffff, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240048e4}, 0x44890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000004c0)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000500), 0x56) sendmsg$kcm(r4, &(0x7f0000000540)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000640)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 24.45637971s ago: executing program 4 (id=174): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000002e80)=@assoc_value, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000003040)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000003100)={0xd, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) r0 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000003400)=@generic={0x0, r0}, 0x18) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) connect$bt_l2cap(r1, &(0x7f0000003480)={0x1f, 0x21, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r2, &(0x7f00000034c0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x1}, 0x10) socket$inet(0x2, 0x3, 0xd) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x12, 0x6, 0x4, 0x2}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 23.594325348s ago: executing program 4 (id=177): ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)=0x4}) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0xc, 0x8, 0x0, 0xff, 0xff, 0x0, '\x00', 0x0, 0x1}) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000026c0)=[@code={0xa, 0x70, {"b805000000b9000000000f01d96467f3250000000066b811010f00d866b80e010f00d0460f0848b804000000000000000f23d00f21f8350000000c0f23f84281bc0800a00000907c0000c4e221936457e565650f1c860000c0fec401557623"}}], 0x70}) r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x77, 0x2, 0x2, 0x4002004c4, 0x1004, 0x9, 0xc595, 0x0, 0x5, 0xffffffffffffffff, 0x2000000000000000, 0x5, 0x8d], 0xeeee8000, 0x2010d3}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=@ipv4_delrule={0x28, 0x21, 0x105, 0x0, 0x25dfdbfd, {0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1, 0x10001}, [@FRA_GENERIC_POLICY=@FRA_UID_RANGE={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x880}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x42282, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 23.45146403s ago: executing program 4 (id=178): r0 = syz_open_dev$mtd(&(0x7f0000000040), 0x0, 0x2) ioctl$BLKPG(r0, 0x800c4d10, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002600)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000002640)='./dev\x00', &(0x7f0000002680)='devtmpfs\x00', 0x2, 0x0) clock_getres(0xfffffffffffffff1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002700)='./mnt\x00', 0x1ff) bind$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e21}, 0x6e) mount(&(0x7f0000002740)=@filename='./dev/sda1\x00', &(0x7f0000002780)='./mnt\x00', &(0x7f00000027c0)='ext4\x00', 0x8410, 0x0) chdir(&(0x7f0000002800)='./mnt\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000002880), 0x4) lseek(r1, 0x1, 0x3) 18.398236793s ago: executing program 3 (id=201): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket(0x10, 0x803, 0x0) r4 = socket(0x10, 0x803, 0x2) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000500), r4) getsockname$packet(r4, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) sendmsg$nl_route(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYRES16=r5], 0x3c}, 0x1, 0x0, 0x0, 0x40020c1}, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r7, 0x8916, &(0x7f0000000680)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2}) sendmsg$nl_route(r1, &(0x7f0000000700)={0x0, 0xfffffffffffffd67, &(0x7f0000000740)={&(0x7f0000000780)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 18.299504148s ago: executing program 3 (id=202): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x4, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000030000000000000010000000cd0000000000000095"], &(0x7f0000000500)='syzkaller\x00'}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) close(0x3) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000580)={'syzkaller0\x00', 0x2}) ioctl$TUNSETFILTEREBPF(r1, 0x800454e1, &(0x7f00000005c0)=r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x40480, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000640)={'syzkaller0\x00', @multicast}) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000680)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f00000006c0), 0x56) sendmsg$kcm(r3, &(0x7f0000000700)={&(0x7f0000000740)=@xdp={0x2c, 0x0, r5, 0x3e}, 0x80, &(0x7f00000007c0)=[{&(0x7f0000000800)="27030200e61114120600602fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 18.141991769s ago: executing program 3 (id=203): sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x200040c4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000280), 0x9) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) recvmsg$unix(r3, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000200)=0x1, 0x12) 17.292495833s ago: executing program 3 (id=204): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x7f, 0x4d, 0x2ba8, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000140), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000180)={0x200, 0x4f, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000001c0)={0x1, 0x3, 0x9}) r3 = syz_open_dev$dri(&(0x7f0000000240), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000280)={0x8, 0x4d, 0x2ba8}) r4 = syz_open_dev$dri(&(0x7f0000000300), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000340)={0x200, 0x51, 0x4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000380)={r5}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f00000003c0)={r1}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000400)={0xf, 0x52a1, 0x1e}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000440)={0x1, &(0x7f0000000480)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000004c0)={0x1, 0x4, 0xe608}) close_range(r6, 0xffffffffffffffff, 0x0) 17.200504707s ago: executing program 3 (id=205): setns(0xc9, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) write(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x7, &(0x7f0000000200)=[{0x1, 0x3, 0xbf, 0x7}, {0x3, 0x6, 0x2, 0x9}, {0x3, 0x5, 0x3, 0x1}, {0x0, 0x3, 0x1e, 0x8579}, {0x678, 0x1, 0x3}, {0x2, 0xc1, 0x6}, {0x9, 0x1d, 0x7, 0x8}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000240)) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nullb/nullb1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/nullb1/size\x00', 0x2, 0x0) write(r2, &(0x7f0000000340)='256', 0x3) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nullb/nullb1/zoned\x00', 0x2, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r3, 0x4068aea3, &(0x7f00000003c0)={0x8f, 0x0, 0x1}) write(r3, &(0x7f0000000440)='1', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nullb/nullb1/power\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='1', 0x1) 17.171596356s ago: executing program 3 (id=206): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./mnt\x00', 0x1ff) mount(&(0x7f00000001c0)=@filename='./dev/sda1\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000240)='ext4\x00', 0x8410, 0x0) chdir(&(0x7f0000000280)='./mnt\x00') r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt\x00', 0x0, 0x21) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000300)=@v2={0x2, @aes128, 0x4, '\x00', @a}) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f00000008c0)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi3\x00', 0x40400, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000040)={0xa000006, 0x1, 0x0, 0x0, 0x9}) 13.489870544s ago: executing program 34 (id=140): ioperm(0x0, 0x80, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000780), 0x6000, 0x0) fsopen(&(0x7f0000000940)='sockfs\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000a40)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000a80)='./dev\x00', &(0x7f0000000ac0)='devtmpfs\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000b40)=@filename='./dev/sda1\x00', &(0x7f0000000b80)='./mnt\x00', &(0x7f0000000bc0)='ext4\x00', 0x8410, 0x0) chdir(&(0x7f0000000c00)='./mnt\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000c40)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000c80), 0x208e24b) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000cc0)=ANY=[]) write$tun(r0, &(0x7f0000000d00)=ANY=[], 0x1c) llistxattr(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)=""/14, 0xe) 9.485994402s ago: executing program 35 (id=172): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./dev\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = open(&(0x7f0000000040)='./bus\x00', 0x1c527e, 0x10) r1 = open(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', 0x1a1342, 0x0) fallocate(r0, 0x0, 0x0, 0x1000f4) sendfile(r0, r0, 0x0, 0x40000000800) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendfile(r1, r0, 0x0, 0x7ffff000) 8.382321596s ago: executing program 36 (id=178): r0 = syz_open_dev$mtd(&(0x7f0000000040), 0x0, 0x2) ioctl$BLKPG(r0, 0x800c4d10, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002600)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000002640)='./dev\x00', &(0x7f0000002680)='devtmpfs\x00', 0x2, 0x0) clock_getres(0xfffffffffffffff1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002700)='./mnt\x00', 0x1ff) bind$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e21}, 0x6e) mount(&(0x7f0000002740)=@filename='./dev/sda1\x00', &(0x7f0000002780)='./mnt\x00', &(0x7f00000027c0)='ext4\x00', 0x8410, 0x0) chdir(&(0x7f0000002800)='./mnt\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000002880), 0x4) lseek(r1, 0x1, 0x3) 3.445279164s ago: executing program 6 (id=242): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x3c, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0xffffffff, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0xfffffffe, 0x4, 0x1c, 0x0, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x9, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xeb00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x2, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0x8, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0xbbd6, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0xab6b]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000001c0)={'rose0\x00', 0x112}) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000280)={0x2, &(0x7f0000000300)=[{0x30, 0xc, 0x3, 0xfffff030}, {0x6, 0x0, 0x2, 0x50ab}]}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 3.247060048s ago: executing program 6 (id=246): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1d, 0x3, &(0x7f00000004c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x81}}, &(0x7f0000000500)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @lsm=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0xb, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x3c, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0xffffffff, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0xfffffffe, 0x4, 0x1c, 0x0, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x9, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xeb00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0x8, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x2, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0x8, 0x5, 0xfffffffe], [0xa76f, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0xbbd6, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0xab6b]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x2002c0c4}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.992624963s ago: executing program 6 (id=248): r0 = openat$md_new_array(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) write$md_new_array(r0, &(0x7f0000000080)={'md', @num=0x0}, 0x3) r1 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f00000000c0)={'/sys/block/md', @num=0x0, '/md/', @array='level\x00'}, 0x1, 0x0) write$md_sysfs(r1, &(0x7f0000000100)=@str='raid1', 0x5) r2 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f0000000140)={'/sys/block/md', @num=0x0, '/md/', @array='raid_disks\x00'}, 0x1, 0x0) write$md_sysfs(r2, &(0x7f0000000180)=@str='2', 0x1) r3 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f00000001c0)={'/sys/block/md', @num=0x0, '/md/', @array='component_size\x00'}, 0x1, 0x0) write$md_sysfs(r3, &(0x7f0000000200)=@str='512', 0x3) r4 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f0000000240)={'/sys/block/md', @num=0x0, '/md/', @array='new_dev\x00'}, 0x1, 0x0) write$md_sysfs(r4, &(0x7f0000000280)=@dev={'1:', 0x0}, 0x16) write$md_sysfs(r4, &(0x7f00000002c0)=@dev={'1:', 0x1}, 0x16) write$md_sysfs(0xffffffffffffffff, &(0x7f0000000340)=@str='0', 0x1) openat$md_sysfs(0xffffffffffffff9c, &(0x7f0000000380)={'/sys/block/md', @num=0x0, '/md/', @rdev={@ram={'dev-ram', 0x1}, 'slot\x00'}}, 0x1, 0x0) r5 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f0000000400)={'/sys/block/md', @num=0x0, '/md/', @array='array_state\x00'}, 0x1, 0x0) write$md_sysfs(r5, &(0x7f0000000440)=@str='active', 0x6) r6 = openat$md(0xffffffffffffff9c, &(0x7f0000000480)={'/dev/md', @num=0x0}, 0x2, 0x0) pwrite64(r6, &(0x7f00000004c0)="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 0x20, 0x1000) close(r6) write$md_sysfs(r5, &(0x7f0000000500)=@str='clear', 0x5) 2.117893214s ago: executing program 37 (id=206): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./mnt\x00', 0x1ff) mount(&(0x7f00000001c0)=@filename='./dev/sda1\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000240)='ext4\x00', 0x8410, 0x0) chdir(&(0x7f0000000280)='./mnt\x00') r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt\x00', 0x0, 0x21) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000300)=@v2={0x2, @aes128, 0x4, '\x00', @a}) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f00000008c0)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi3\x00', 0x40400, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000040)={0xa000006, 0x1, 0x0, 0x0, 0x9}) 2.032285386s ago: executing program 6 (id=253): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000005b00)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) socket$inet_udp(0x2, 0x2, 0x0) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000005b40)={0x2, 0x4e22, @empty}, 0x10) accept(r1, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000005c40), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000005c80)={0x0, 0x0, &(0x7f0000005cc0)={&(0x7f0000005d00)={0x30, r4, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}]}, 0x30}, 0x1, 0x900}, 0x0) 1.869213843s ago: executing program 6 (id=254): bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000007e00)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000007e40)={0xa, 0x4e22, 0xfffffffd, @empty, 0x7}, 0x1c) socket$inet6_sctp(0xa, 0x5, 0x84) listen(r1, 0xfffffffc) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000007ec0), 0xffffffffffffffff) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000007f00)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000007f40)={0x0, 0x0, &(0x7f0000007f80)={&(0x7f0000007fc0)={0x28, r3, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) 1.793295332s ago: executing program 6 (id=255): getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x169802, 0x0) r1 = dup(r0) pselect6(0x0, 0x0, &(0x7f0000000080)={0xe, 0x48000000, 0x8, 0x0, 0xffff, 0x9, 0x1, 0x4}, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x13, r1, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = syz_usb_connect(0x0, 0x32, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) ioctl$BLKROSET(r0, 0x125d, &(0x7f0000000300)=0x1000000010) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x10, 0xffffffffffffffff, 0xf154b000) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x23, 0x0, &(0x7f0000001480)) setns(0xc9, 0x0) shutdown(0xffffffffffffffff, 0x0) ioctl$BLKRRPART(r1, 0x125f, 0x0) 362.098874ms ago: executing program 7 (id=260): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket(0x11, 0x1, 0x800) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) getsockopt$kcm_KCM_RECV_DISABLE(r0, 0x11e, 0x1, 0x0, 0xfffffffffffffd61) r1 = syz_open_dev$vim2m(0x0, 0x10002, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000006c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000880)='./config\x00', 0x1c0) mount(0x0, &(0x7f0000000900)='./config\x00', &(0x7f0000000940)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000980)='./config/usb_gadget/g1\x00', 0x1c0) r2 = openat(0xffffffffffffff9c, &(0x7f00000009c0)='./config/usb_gadget/g1/idVendor\x00', 0x80200, 0x0) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000a40)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1c0) symlinkat(&(0x7f0000000a80)='./config/usb_gadget/g1/configs/c.1/../../functions/ncm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000ac0)='./config/usb_gadget/g1/configs/c.1/ncm.usb0\x00') write(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000b40)='./config/usb_gadget/g1/os_desc/qw_sign\x00', 0x1, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000d40)='dummy_udc.0', 0xb) 246.909294ms ago: executing program 7 (id=261): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/dlm/cluster\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/dlm/cluster/comms/2\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/dlm/cluster/comms/2/addr\x00', 0x1, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r1, 0x8910, &(0x7f00000011c0)={0x6, 0xffff, 0x0, 0xd, 0x0, "5dee0000ea584000"}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000240)={'batadv_slave_0\x00', &(0x7f00000000c0)=@ethtool_dump={0x3e, 0xffffff00, 0xfc17a14}}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x52, '\x00', 0x0, @fallback=0x9af8dba271b76fd5, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$alg(0xffffffffffffffff, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x27}, 0x62) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x198fb580ea88f23a, 0x0, &(0x7f0000000280)) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1a, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) r5 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/dlm/cluster/comms/2/addr\x00', 0x1, 0x0) write(r5, &(0x7f0000000400)="020030397f00090100"/128, 0x80) 213.169976ms ago: executing program 7 (id=262): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000180)={0x1, &(0x7f00000001c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_open_dev$loop(&(0x7f00000002c0), 0x1, 0x40000) openat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0x0, 0x83) inotify_init() userfaultfd(0x801) r1 = fsopen(&(0x7f0000000340)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsmount(r1, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r5, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES8=r3], 0x3c}, 0x1, 0x0, 0x0, 0x20004800}, 0x8010) 146.061244ms ago: executing program 7 (id=263): openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x8000, 0x1f7) fanotify_init(0x200, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) syz_io_uring_setup(0xd3a, &(0x7f0000000040)={0x0, 0x8000002, 0x3a10, 0x3, 0x3}, 0x0, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000002c0), 0x80000005, 0x20040) socket$inet(0x2, 0x2, 0x1) syz_open_dev$loop(&(0x7f0000000400), 0x5, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x78}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 33.453489ms ago: executing program 7 (id=264): socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000100)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000180)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000200)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000240)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000280)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000002c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000540)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000580)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000005c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000600)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000640)) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) r1 = socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000700)={0x43, 0x0, 0x3, 0x3}, 0x10) write(r0, &(0x7f0000000780)="580000001400010300000000000000001e000000ffffffff00"/88, 0x58) 0s ago: executing program 7 (id=265): socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x400) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000000)="8ee8c9b8ee088ed8660f3801b2d6352ed9ff660f3882040f01cf0fc72d2626652e0f01ca0fc7386635002000000f22e0", 0xffffffffffffff8b}], 0x1, 0x50, 0x0, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x158) open_tree(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x800) open_tree(0xffffffffffffff9c, &(0x7f0000000180)='\x00', 0x89901) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) pipe(&(0x7f0000000240)) ioctl$KVM_RUN(r3, 0xae80, 0x0) kernel console output (not intermixed with test programs): 1794132640.747:172): avc: denied { mounton } for pid=5796 comm="syz-executor" path="/syzkaller.SjUbgI/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=9354 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 90.906534][ T43] audit: type=1400 audit(1794132640.757:173): avc: denied { unmount } for pid=5796 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 90.919236][ T5789] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.919348][ T5793] veth0_vlan: entered promiscuous mode [ 90.922323][ T43] audit: type=1400 audit(1794132640.767:174): avc: denied { mounton } for pid=5796 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2861 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 90.922790][ T5863] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.922812][ T5863] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.922829][ T5863] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.922846][ T5863] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.922862][ T5863] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.922879][ T5863] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.922896][ T5863] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.923860][ T43] audit: type=1400 audit(1794132640.777:175): avc: denied { mount } for pid=5796 comm="syz-executor" name="/" dev="gadgetfs" ino=9361 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 90.927133][ T5789] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.945259][ T5793] veth1_vlan: entered promiscuous mode [ 90.993449][ T1284] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.993467][ T1284] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.010157][ T43] audit: type=1400 audit(1794132640.857:176): avc: denied { mounton } for pid=5796 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 91.011032][ T43] audit: type=1400 audit(1794132640.857:177): avc: denied { mount } for pid=5796 comm="syz-executor" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 91.043311][ T220] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.043330][ T220] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.045554][ T5796] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 91.067896][ T4476] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.067917][ T4476] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.075273][ T5793] veth0_macvtap: entered promiscuous mode [ 91.089010][ T5793] veth1_macvtap: entered promiscuous mode [ 91.104535][ T5837] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.113933][ T4476] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.114005][ T4476] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.114576][ T5793] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.126271][ T5793] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.142873][ T5837] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.143080][ T5837] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.143221][ T5837] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.143363][ T5837] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.172914][ T5837] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.172940][ T5837] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.172957][ T5837] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.203720][ T5952] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2'. [ 91.210766][ T4476] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.210784][ T4476] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.233193][ T5952] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=5952 comm=syz.1.2 [ 91.247310][ T220] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.247325][ T220] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.415640][ T5963] FAULT_INJECTION: forcing a failure. [ 91.415640][ T5963] name failslab, interval 1, probability 0, space 0, times 1 [ 91.415665][ T5963] CPU: 3 UID: 0 PID: 5963 Comm: syz.1.7 Not tainted syzkaller #0 PREEMPT(full) [ 91.415683][ T5963] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 91.415693][ T5963] Call Trace: [ 91.415700][ T5963] [ 91.415707][ T5963] dump_stack_lvl+0x100/0x190 [ 91.415744][ T5963] should_fail_ex.cold+0x5/0xa [ 91.415775][ T5963] should_failslab+0xc2/0x120 [ 91.415797][ T5963] __kmalloc_cache_noprof+0x91/0x6d0 [ 91.415824][ T5963] ? gadgetfs_bind+0x5fe/0x940 [ 91.415876][ T5963] gadgetfs_bind+0x5fe/0x940 [ 91.415916][ T5963] gadget_bind_driver+0x28c/0xbf0 [ 91.415936][ T5963] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 91.415964][ T5963] ? __pfx_gadget_bind_driver+0x10/0x10 [ 91.415984][ T5963] really_probe+0x241/0xa60 [ 91.416010][ T5963] __driver_probe_device+0x210/0x460 [ 91.416032][ T5963] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 91.416055][ T5963] driver_probe_device+0x4a/0x140 [ 91.416079][ T5963] __driver_attach+0x231/0x5b0 [ 91.416103][ T5963] ? __pfx___driver_attach+0x10/0x10 [ 91.416124][ T5963] bus_for_each_dev+0x13e/0x1d0 [ 91.416141][ T5963] ? __pfx_bus_for_each_dev+0x10/0x10 [ 91.416157][ T5963] ? bus_add_driver+0x306/0x620 [ 91.416184][ T5963] bus_add_driver+0x4bf/0x620 [ 91.416207][ T5963] driver_register+0x1e2/0x360 [ 91.416235][ T5963] usb_gadget_register_driver_owner+0x132/0x210 [ 91.416257][ T5963] dev_config+0xdce/0x1610 [ 91.416286][ T5963] ? lock_acquire+0x50/0x380 [ 91.416312][ T5963] ? __pfx_dev_config+0x10/0x10 [ 91.416347][ T5963] vfs_write+0x2aa/0x1050 [ 91.416368][ T5963] ? __pfx_dev_config+0x10/0x10 [ 91.416395][ T5963] ? lock_acquire+0x1d1/0x380 [ 91.416418][ T5963] ? __fget_files+0x34/0x3d0 [ 91.416441][ T5963] ? __pfx_vfs_write+0x10/0x10 [ 91.416457][ T5963] ? find_held_lock+0x2b/0x80 [ 91.416477][ T5963] ? __fget_files+0x215/0x3d0 [ 91.416504][ T5963] ? __fget_files+0x21f/0x3d0 [ 91.416535][ T5963] ksys_write+0x12a/0x250 [ 91.416553][ T5963] ? __pfx_ksys_write+0x10/0x10 [ 91.416580][ T5963] do_syscall_64+0x123/0x790 [ 91.416605][ T5963] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.416624][ T5963] RIP: 0033:0x7fb4d2d9fb19 [ 91.416641][ T5963] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.416658][ T5963] RSP: 002b:00007fb4d3c12028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 91.416675][ T5963] RAX: ffffffffffffffda RBX: 00007fb4d3025fa0 RCX: 00007fb4d2d9fb19 [ 91.416687][ T5963] RDX: 000000000000001f RSI: 0000200000008f80 RDI: 0000000000000006 [ 91.416698][ T5963] RBP: 00007fb4d2e37b70 R08: 0000000000000000 R09: 0000000000000000 [ 91.416708][ T5963] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 91.416717][ T5963] R13: 00007fb4d3026038 R14: 00007fb4d3025fa0 R15: 00007fff88f56f98 [ 91.416742][ T5963] [ 91.418253][ T5963] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 91.418267][ T5963] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 91.420078][ T5963] gadgetfs: bound to dummy_udc driver [ 91.506653][ T5967] rxe_eth0 speed is unknown, defaulting to 1000 [ 91.646215][ T5973] process 'syz.1.9' launched './file0' with NULL argv: empty string added [ 91.744049][ T5975] syzkaller0: entered promiscuous mode [ 91.744063][ T5975] syzkaller0: entered allmulticast mode [ 92.158715][ T5837] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.312435][ T5978] syzkaller0: entered promiscuous mode [ 92.312447][ T5978] syzkaller0: entered allmulticast mode [ 92.328768][ T5794] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 92.330037][ T5794] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 92.330396][ T5794] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 92.331399][ T5794] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 92.331956][ T5794] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 92.432908][ T5141] Bluetooth: hci0: command tx timeout [ 92.432935][ T5141] Bluetooth: hci2: command tx timeout [ 92.432950][ T5141] Bluetooth: hci1: command tx timeout [ 92.466384][ T5989] syzkaller0: entered promiscuous mode [ 92.466397][ T5989] syzkaller0: entered allmulticast mode [ 92.538789][ T5979] rxe_eth0 speed is unknown, defaulting to 1000 [ 92.835519][ T693] cfg80211: failed to load regulatory.db [ 92.908066][ T5979] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.908160][ T5979] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.908215][ T5979] bridge_slave_0: entered allmulticast mode [ 92.908956][ T5979] bridge_slave_0: entered promiscuous mode [ 92.910200][ T5979] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.910263][ T5979] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.910345][ T5979] bridge_slave_1: entered allmulticast mode [ 92.911047][ T5979] bridge_slave_1: entered promiscuous mode [ 92.925179][ T5979] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 92.926955][ T5979] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 92.941202][ T5979] team0: Port device team_slave_0 added [ 92.942370][ T5979] team0: Port device team_slave_1 added [ 92.964212][ T5979] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.964227][ T5979] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.964244][ T5979] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.965786][ T5979] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.965797][ T5979] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.965816][ T5979] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 93.015532][ T5837] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.036948][ T5979] hsr_slave_0: entered promiscuous mode [ 93.037372][ T5979] hsr_slave_1: entered promiscuous mode [ 93.037657][ T5979] debugfs: 'hsr0' already exists in 'hsr' [ 93.037665][ T5979] Cannot create hsr debugfs directory [ 93.114150][ T6014] netlink: 'syz.2.16': attribute type 3 has an invalid length. [ 93.114169][ T6014] netlink: 24 bytes leftover after parsing attributes in process `syz.2.16'. [ 93.114355][ T6014] Zero length message leads to an empty skb [ 93.187101][ T5979] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 93.191920][ T5979] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 93.198629][ T5979] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 93.202078][ T5979] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 93.208756][ T5979] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 93.211832][ T5979] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 93.218915][ T5979] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 93.225007][ T5979] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 93.248288][ T5979] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.248536][ T5979] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.249021][ T5979] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.249138][ T5979] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.308306][ T5979] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.315237][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.315799][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.325112][ T5979] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.335547][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.335601][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.338306][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.338349][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.504406][ T10] hid-generic 0005:4C4A:0002.0002: unknown main item tag 0x0 [ 93.504431][ T10] hid-generic 0005:4C4A:0002.0002: unknown main item tag 0x0 [ 93.504443][ T10] hid-generic 0005:4C4A:0002.0002: unknown main item tag 0x0 [ 93.504453][ T10] hid-generic 0005:4C4A:0002.0002: unknown main item tag 0x0 [ 93.504464][ T10] hid-generic 0005:4C4A:0002.0002: unknown main item tag 0x0 [ 93.504475][ T10] hid-generic 0005:4C4A:0002.0002: unknown main item tag 0x0 [ 93.504486][ T10] hid-generic 0005:4C4A:0002.0002: unknown main item tag 0x0 [ 93.504497][ T10] hid-generic 0005:4C4A:0002.0002: unknown main item tag 0x0 [ 93.504508][ T10] hid-generic 0005:4C4A:0002.0002: unknown main item tag 0x0 [ 93.504518][ T10] hid-generic 0005:4C4A:0002.0002: unknown main item tag 0x0 [ 93.510121][ T10] hid-generic 0005:4C4A:0002.0002: hidraw1: BLUETOOTH HID v0.09 Device [syz0] on aa:aa:aa:aa:aa:aa [ 93.624206][ T5979] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.646088][ T5837] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.676890][ T6072] rxe_eth0 speed is unknown, defaulting to 1000 [ 93.719413][ T5837] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.780176][ T5979] veth0_vlan: entered promiscuous mode [ 93.786604][ T5979] veth1_vlan: entered promiscuous mode [ 93.871681][ T5837] bridge_slave_1: left allmulticast mode [ 93.871703][ T5837] bridge_slave_1: left promiscuous mode [ 93.872435][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.881216][ T5837] bridge_slave_0: left allmulticast mode [ 93.881232][ T5837] bridge_slave_0: left promiscuous mode [ 93.881326][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.019529][ T5837] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 94.027243][ T5837] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 94.029843][ T5837] bond0 (unregistering): Released all slaves [ 94.060164][ T5979] veth0_macvtap: entered promiscuous mode [ 94.065648][ T5979] veth1_macvtap: entered promiscuous mode [ 94.088228][ T5979] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.098970][ T5979] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.153533][ T6040] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 94.164686][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.164875][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.164893][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.164908][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.238234][ T6083] syz.1.25 uses obsolete (PF_INET,SOCK_PACKET) [ 94.283374][ T220] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.283387][ T220] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.290569][ T6090] FAULT_INJECTION: forcing a failure. [ 94.290569][ T6090] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 94.290588][ T6090] CPU: 2 UID: 0 PID: 6090 Comm: syz.2.26 Tainted: G L syzkaller #0 PREEMPT(full) [ 94.290602][ T6090] Tainted: [L]=SOFTLOCKUP [ 94.290605][ T6090] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.290612][ T6090] Call Trace: [ 94.290616][ T6090] [ 94.290620][ T6090] dump_stack_lvl+0x100/0x190 [ 94.290642][ T6090] should_fail_ex.cold+0x5/0xa [ 94.290660][ T6090] should_fail_alloc_page+0xeb/0x140 [ 94.290674][ T6090] prepare_alloc_pages+0x1f0/0x5b0 [ 94.290689][ T6090] __alloc_frozen_pages_noprof+0x1ae/0x31e0 [ 94.290712][ T6090] ? __pfx_vmap_small_pages_range_noflush+0x10/0x10 [ 94.290729][ T6090] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 94.290743][ T6090] ? __split_page_owner+0x1d8/0x340 [ 94.290759][ T6090] ? __vmap_pages_range_noflush+0x3db/0x660 [ 94.290770][ T6090] ? is_vmalloc_addr+0x86/0xa0 [ 94.290783][ T6090] ? is_vmalloc_or_module_addr+0x47/0x60 [ 94.290797][ T6090] ? kasan_unpoison+0x27/0x60 [ 94.290814][ T6090] ? __kasan_unpoison_vmalloc+0x22/0x30 [ 94.290835][ T6090] ? __vmalloc_node_range_noprof+0x83f/0x1440 [ 94.290858][ T6090] ? comedi_buf_alloc+0x2fe/0xa00 [ 94.290878][ T6090] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 94.290903][ T6090] ? policy_nodemask+0xed/0x5e0 [ 94.290922][ T6090] alloc_pages_mpol+0x201/0x560 [ 94.290936][ T6090] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 94.290953][ T6090] alloc_pages_noprof+0x1a/0x160 [ 94.290968][ T6090] get_zeroed_page_noprof+0x18/0xb0 [ 94.290979][ T6090] comedi_buf_alloc+0x648/0xa00 [ 94.290997][ T6090] comedi_device_postconfig+0x3dc/0xbc0 [ 94.291014][ T6090] comedi_device_attach+0x42a/0x6b0 [ 94.291031][ T6090] do_devconfig_ioctl+0x1b3/0x6d0 [ 94.291042][ T6090] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 94.291058][ T6090] ? kasan_quarantine_put+0x104/0x240 [ 94.291069][ T6090] ? find_held_lock+0x2b/0x80 [ 94.291084][ T6090] comedi_unlocked_ioctl+0x860/0x3310 [ 94.291096][ T6091] input: syz1 as /devices/virtual/input/input5 [ 94.291103][ T6090] ? tomoyo_path_number_perm+0x188/0x580 [ 94.291125][ T6090] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 94.291140][ T6090] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 94.291160][ T6090] ? do_vfs_ioctl+0x226/0x13e0 [ 94.291172][ T6090] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 94.291183][ T6090] ? ioctl_has_perm.constprop.0.isra.0+0x37d/0x530 [ 94.291196][ T6090] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 94.291209][ T6090] ? __fget_files+0x34/0x3d0 [ 94.291228][ T6090] ? selinux_file_ioctl+0x1e0/0x290 [ 94.291238][ T6090] ? selinux_file_ioctl+0x1e7/0x290 [ 94.291248][ T6090] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 94.291261][ T6090] __x64_sys_ioctl+0x18e/0x210 [ 94.291273][ T6090] do_syscall_64+0x123/0x790 [ 94.291288][ T6090] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.291299][ T6090] RIP: 0033:0x7f3be0d9fb19 [ 94.291309][ T6090] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.291319][ T6090] RSP: 002b:00007f3be1d27028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.291329][ T6090] RAX: ffffffffffffffda RBX: 00007f3be1025fa0 RCX: 00007f3be0d9fb19 [ 94.291335][ T6090] RDX: 0000200000002480 RSI: 0000000040946400 RDI: 0000000000000004 [ 94.291342][ T6090] RBP: 00007f3be0e37b70 R08: 0000000000000000 R09: 0000000000000000 [ 94.291349][ T6090] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.291355][ T6090] R13: 00007f3be1026038 R14: 00007f3be1025fa0 R15: 00007fff87799288 [ 94.291370][ T6090] [ 94.294880][ T6090] comedi comedi2: Buffer allocation failed [ 94.353122][ T5794] Bluetooth: hci3: command tx timeout [ 94.442267][ T5496] 8021q: adding VLAN 0 to HW filter on device eth2 [ 94.449991][ T220] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.450004][ T220] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.499276][ T5794] Bluetooth: hci1: SCO packet too small [ 94.513318][ T5794] Bluetooth: hci2: command tx timeout [ 94.513340][ T5794] Bluetooth: hci0: command tx timeout [ 94.522957][ T5141] Bluetooth: hci1: command tx timeout [ 94.605308][ T5837] hsr_slave_0: left promiscuous mode [ 94.605762][ T5837] hsr_slave_1: left promiscuous mode [ 94.606154][ T5837] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 94.606294][ T5837] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 94.607450][ T5837] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 94.607463][ T5837] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 94.623585][ T5837] veth1_macvtap: left promiscuous mode [ 94.623634][ T5837] veth0_macvtap: left promiscuous mode [ 94.623678][ T5837] veth1_vlan: left promiscuous mode [ 94.623713][ T5837] veth0_vlan: left promiscuous mode [ 94.642863][ T6118] netlink: 20 bytes leftover after parsing attributes in process `syz.2.33'. [ 94.717619][ T6118] netlink: 8 bytes leftover after parsing attributes in process `syz.2.33'. [ 94.833810][ T5837] team0 (unregistering): Port device team_slave_1 removed [ 94.839783][ T5837] team0 (unregistering): Port device team_slave_0 removed [ 94.898977][ T5496] 8021q: adding VLAN 0 to HW filter on device eth3 [ 94.996804][ T6130] nvmet: adding nsid 1 to subsystem testsubsys [ 95.126278][ T6147] netlink: 14 bytes leftover after parsing attributes in process `syz.1.39'. [ 95.164275][ T5496] 8021q: adding VLAN 0 to HW filter on device eth4 [ 95.172105][ T6151] netlink: 12 bytes leftover after parsing attributes in process `syz.3.40'. [ 95.175920][ T6143] netlink: 4 bytes leftover after parsing attributes in process `syz.2.37'. [ 95.176009][ T6143] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 95.187940][ T6143] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 95.386734][ T5496] 8021q: adding VLAN 0 to HW filter on device eth5 [ 95.712208][ T4476] IPVS: starting estimator thread 0... [ 95.756470][ T6192] netlink: 8 bytes leftover after parsing attributes in process `syz.3.49'. [ 95.756489][ T6192] netlink: 4 bytes leftover after parsing attributes in process `syz.3.49'. [ 95.776190][ T6192] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.776666][ T6195] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -834, delta: 1 [ 95.776684][ T6195] ref_ctr increment failed for inode: 0x6c offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff8880244ea4c0 [ 95.778056][ T6192] bond1: (slave bond0): making interface the new active one [ 95.779034][ T6192] bond1: (slave bond0): Enslaving as an active interface with an up link [ 95.779401][ T6195] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -834, delta: -1 [ 95.779417][ T6195] ref_ctr decrement failed for inode: 0x6c offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff8880244ea4c0 [ 95.779448][ T6195] uprobe: syz.2.50:6195 failed to unregister, leaking uprobe [ 95.786346][ T6192] netlink: 'syz.3.49': attribute type 4 has an invalid length. [ 95.786361][ T6192] netlink: 152 bytes leftover after parsing attributes in process `syz.3.49'. [ 95.788805][ T6192] .`: renamed from bond0 (while UP) [ 95.802787][ T6190] IPVS: using max 44 ests per chain, 105600 per kthread [ 95.907840][ T43] kauditd_printk_skb: 121 callbacks suppressed [ 95.907857][ T43] audit: type=1400 audit(1794132645.757:299): avc: denied { mount } for pid=6199 comm="syz.2.51" name="/" dev="9p" ino=71827601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 95.911638][ T43] audit: type=1400 audit(1794132645.757:300): avc: denied { bind } for pid=6203 comm="syz.4.53" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 95.914612][ T43] audit: type=1400 audit(1794132645.767:301): avc: denied { name_bind } for pid=6203 comm="syz.4.53" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 95.914638][ T43] audit: type=1400 audit(1794132645.767:302): avc: denied { node_bind } for pid=6203 comm="syz.4.53" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 95.929113][ T43] audit: type=1400 audit(1794132645.787:303): avc: denied { unmount } for pid=5789 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 95.955657][ T43] audit: type=1400 audit(1794132645.807:304): avc: denied { mount } for pid=6205 comm="syz.3.54" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 95.962718][ T6206] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 95.975158][ T43] audit: type=1400 audit(1794132645.827:305): avc: denied { search } for pid=6205 comm="syz.3.54" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 95.975333][ T43] audit: type=1400 audit(1794132645.827:306): avc: denied { search } for pid=6205 comm="syz.3.54" name="instances" dev="tracefs" ino=3954 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 95.976110][ T43] audit: type=1400 audit(1794132645.827:307): avc: denied { write search } for pid=6205 comm="syz.3.54" name="instances" dev="tracefs" ino=3954 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 95.976273][ T43] audit: type=1400 audit(1794132645.827:308): avc: denied { add_name } for pid=6205 comm="syz.3.54" name="foo" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 96.433220][ T5141] Bluetooth: hci3: command tx timeout [ 96.592753][ T5141] Bluetooth: hci1: command tx timeout [ 96.602831][ T5141] Bluetooth: hci0: command tx timeout [ 97.138334][ T6256] netlink: 24 bytes leftover after parsing attributes in process `syz.2.72'. [ 97.140826][ T6256] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=6256 comm=syz.2.72 [ 97.341895][ T6269] ieee802154 phy0 wpan0: encryption failed: -22 [ 97.405834][ T6275] bridge0: port 3(syz_tun) entered blocking state [ 97.405885][ T6275] bridge0: port 3(syz_tun) entered disabled state [ 97.405960][ T6275] syz_tun: entered allmulticast mode [ 97.406758][ T6275] syz_tun: entered promiscuous mode [ 97.407040][ T6275] bridge0: port 3(syz_tun) entered blocking state [ 97.407082][ T6275] bridge0: port 3(syz_tun) entered forwarding state [ 97.418351][ T6275] netlink: 4 bytes leftover after parsing attributes in process `syz.1.78'. [ 97.568008][ T6281] xt_hashlimit: size too large, truncated to 1048576 [ 97.768712][ T6299] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 97.897244][ T6306] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 97.897256][ T6306] IPv6: NLM_F_CREATE should be set when creating new route [ 98.112797][ T1372] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 98.164414][ T6311] ip6t_REJECT: ECHOREPLY is not supported [ 98.171156][ T6311] FAULT_INJECTION: forcing a failure. [ 98.171156][ T6311] name failslab, interval 1, probability 0, space 0, times 0 [ 98.171182][ T6311] CPU: 3 UID: 0 PID: 6311 Comm: syz.3.89 Tainted: G L syzkaller #0 PREEMPT(full) [ 98.171195][ T6311] Tainted: [L]=SOFTLOCKUP [ 98.171199][ T6311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.171205][ T6311] Call Trace: [ 98.171208][ T6311] [ 98.171231][ T6311] dump_stack_lvl+0x100/0x190 [ 98.171279][ T6311] should_fail_ex.cold+0x5/0xa [ 98.171313][ T6311] should_failslab+0xc2/0x120 [ 98.171335][ T6311] kmem_cache_alloc_noprof+0x92/0x6a0 [ 98.171353][ T6311] ? inet_bind2_bucket_create+0x36/0x5f0 [ 98.171378][ T6311] inet_bind2_bucket_create+0x36/0x5f0 [ 98.171396][ T6311] __inet_hash_connect+0x1578/0x2060 [ 98.171417][ T6311] ? __pfx___inet6_check_established+0x10/0x10 [ 98.171436][ T6311] ? __pfx___inet_hash_connect+0x10/0x10 [ 98.171453][ T6311] ? inet6_ehashfn+0x25/0x3e0 [ 98.171470][ T6311] ? inet6_hash_connect+0xe7/0x180 [ 98.171487][ T6311] tcp_v6_connect+0x16a7/0x2770 [ 98.171502][ T6311] ? __pfx_tcp_v6_connect+0x10/0x10 [ 98.171518][ T6311] __inet_stream_connect+0x208/0xff0 [ 98.171541][ T6311] ? __pfx___inet_stream_connect+0x10/0x10 [ 98.171561][ T6311] ? kasan_save_track+0x14/0x30 [ 98.171578][ T6311] ? __kasan_kmalloc+0xaa/0xb0 [ 98.171594][ T6311] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 98.171617][ T6311] ? tcp_sendmsg_fastopen+0x24d/0x750 [ 98.171645][ T6311] tcp_sendmsg_fastopen+0x3ed/0x750 [ 98.171673][ T6311] tcp_sendmsg_locked+0x28ba/0x46b0 [ 98.171695][ T6311] ? __lock_acquire+0x5c0/0x1f40 [ 98.171732][ T6311] ? __lock_acquire+0x5c0/0x1f40 [ 98.171760][ T6311] ? reacquire_held_locks+0xdd/0x1f0 [ 98.171783][ T6311] ? release_sock+0x21/0x280 [ 98.171815][ T6311] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 98.171839][ T6311] ? lock_acquire+0x1d1/0x380 [ 98.171862][ T6311] ? do_raw_spin_lock+0x128/0x260 [ 98.171877][ T6311] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 98.171890][ T6311] ? __local_bh_enable_ip+0xa5/0x120 [ 98.171905][ T6311] tcp_sendmsg+0x2e/0x50 [ 98.171918][ T6311] ? __pfx_tcp_sendmsg+0x10/0x10 [ 98.171932][ T6311] inet6_sendmsg+0xb9/0x140 [ 98.171952][ T6311] __sys_sendto+0x36d/0x4e0 [ 98.171972][ T6311] ? __pfx___sys_sendto+0x10/0x10 [ 98.171998][ T6311] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 98.172038][ T6311] ? xfd_validate_state+0x129/0x190 [ 98.172067][ T6311] __x64_sys_sendto+0xe0/0x1c0 [ 98.172086][ T6311] ? do_syscall_64+0xae/0x790 [ 98.172104][ T6311] ? lockdep_hardirqs_on+0x7d/0x110 [ 98.172122][ T6311] do_syscall_64+0x123/0x790 [ 98.172143][ T6311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.172166][ T6311] RIP: 0033:0x7f410c59fb19 [ 98.172181][ T6311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.172198][ T6311] RSP: 002b:00007f410d3ee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 98.172215][ T6311] RAX: ffffffffffffffda RBX: 00007f410c825fa0 RCX: 00007f410c59fb19 [ 98.172226][ T6311] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 [ 98.172235][ T6311] RBP: 00007f410c637b70 R08: 0000200000001ac0 R09: 000000000000001c [ 98.172245][ T6311] R10: 0000000020000075 R11: 0000000000000246 R12: 0000000000000000 [ 98.172254][ T6311] R13: 00007f410c826038 R14: 00007f410c825fa0 R15: 00007ffeab3aa048 [ 98.172277][ T6311] [ 98.282927][ T1372] usb 9-1: Using ep0 maxpacket: 32 [ 98.284470][ T1372] usb 9-1: New USB device found: idVendor=03f0, idProduct=6c17, bcdDevice=0.40 [ 98.285947][ T1372] usb 9-1: config index 0 descriptor too short (expected 29220, got 36) [ 98.285960][ T1372] usb 9-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 98.285969][ T1372] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 98.285990][ T1372] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 98.286014][ T1372] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 98.286025][ T1372] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 98.286043][ T1372] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.289660][ T1372] usb 9-1: config 0 descriptor?? [ 98.506749][ T1372] usblp 9-1:0.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 98.512640][ T5141] Bluetooth: hci3: command tx timeout [ 98.731377][ T5796] bridge0: port 3(syz_tun) entered disabled state [ 98.745166][ T5796] syz_tun (unregistering): left allmulticast mode [ 98.745187][ T5796] syz_tun (unregistering): left promiscuous mode [ 98.745240][ T5796] bridge0: port 3(syz_tun) entered disabled state [ 98.760817][ T6319] netlink: 4 bytes leftover after parsing attributes in process `syz.2.93'. [ 98.815298][ T6321] overlayfs: workdir and upperdir must be separate subtrees [ 98.945365][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.019212][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.071117][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.118404][ T5794] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 99.120405][ T5794] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 99.121150][ T5794] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 99.134745][ T5794] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 99.135615][ T5794] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 99.136699][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.272516][ T13] bridge_slave_1: left allmulticast mode [ 99.272533][ T13] bridge_slave_1: left promiscuous mode [ 99.273179][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.278907][ T13] bridge_slave_0: left allmulticast mode [ 99.278921][ T13] bridge_slave_0: left promiscuous mode [ 99.279068][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.381588][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 99.390978][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 99.393187][ T13] bond0 (unregistering): Released all slaves [ 99.501317][ T6328] rxe_eth0 speed is unknown, defaulting to 1000 [ 99.612239][ T5496] 8021q: adding VLAN 0 to HW filter on device eth6 [ 99.910014][ T6328] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.910151][ T6328] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.910370][ T6328] bridge_slave_0: entered allmulticast mode [ 99.923574][ T6328] bridge_slave_0: entered promiscuous mode [ 99.925628][ T6328] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.925780][ T6328] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.925867][ T6328] bridge_slave_1: entered allmulticast mode [ 99.927690][ T6328] bridge_slave_1: entered promiscuous mode [ 99.930062][ T5496] 8021q: adding VLAN 0 to HW filter on device eth7 [ 99.954418][ T13] hsr_slave_0: left promiscuous mode [ 99.955444][ T13] hsr_slave_1: left promiscuous mode [ 99.956084][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 99.956160][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 99.956905][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 99.956920][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 99.963631][ T13] veth1_macvtap: left promiscuous mode [ 99.963660][ T13] veth0_macvtap: left promiscuous mode [ 99.963737][ T13] veth1_vlan: left promiscuous mode [ 99.963790][ T13] veth0_vlan: left promiscuous mode [ 100.098379][ T4476] IPVS: starting estimator thread 0... [ 100.172464][ T13] team0 (unregistering): Port device team_slave_1 removed [ 100.189478][ T13] team0 (unregistering): Port device team_slave_0 removed [ 100.192918][ T6374] IPVS: using max 28 ests per chain, 67200 per kthread [ 100.293188][ T6328] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.306427][ T30] rxe_eth0 speed is unknown, defaulting to 1000 [ 100.307664][ T6328] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.334382][ T6328] team0: Port device team_slave_0 added [ 100.337137][ T6328] team0: Port device team_slave_1 added [ 100.353886][ T6328] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.353896][ T6328] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.353907][ T6328] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.357624][ T6328] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.357634][ T6328] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.357645][ T6328] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.393384][ T6328] hsr_slave_0: entered promiscuous mode [ 100.393811][ T6328] hsr_slave_1: entered promiscuous mode [ 100.577807][ T6328] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 100.581728][ T6328] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 100.582305][ T6328] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 100.593136][ T5141] Bluetooth: hci3: command tx timeout [ 100.594364][ T6328] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 100.594978][ T6328] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 100.597626][ T6328] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 100.598175][ T6328] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 100.604986][ T6328] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 100.653732][ T6328] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.669872][ T6328] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.677342][ T4476] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.677387][ T4476] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.682122][ T4476] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.682166][ T4476] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.815594][ T5496] 8021q: adding VLAN 0 to HW filter on device eth8 [ 100.907882][ T1044] usb 9-1: USB disconnect, device number 2 [ 100.937783][ T1044] usblp0: removed [ 101.004385][ T43] kauditd_printk_skb: 87 callbacks suppressed [ 101.004404][ T43] audit: type=1400 audit(1794132650.847:396): avc: denied { write } for pid=6411 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.095287][ T43] audit: type=1400 audit(1794132650.947:397): avc: denied { write } for pid=6419 comm="rm" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.146098][ T43] audit: type=1400 audit(1794132650.997:398): avc: denied { read } for pid=6425 comm="syz.2.109" name="loop-control" dev="devtmpfs" ino=655 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 101.146562][ T43] audit: type=1400 audit(1794132650.997:399): avc: denied { open } for pid=6425 comm="syz.2.109" path="/dev/loop-control" dev="devtmpfs" ino=655 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 101.149287][ T43] audit: type=1400 audit(1794132650.997:400): avc: denied { ioctl } for pid=6425 comm="syz.2.109" path="/dev/loop-control" dev="devtmpfs" ino=655 ioctlcmd=0x4c81 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 101.149367][ T6426] deleting an unspecified loop device is not supported. [ 101.162009][ T6328] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.162676][ T5141] Bluetooth: hci2: command tx timeout [ 101.178604][ T5496] 8021q: adding VLAN 0 to HW filter on device eth9 [ 101.298901][ T6436] FAULT_INJECTION: forcing a failure. [ 101.298901][ T6436] name failslab, interval 1, probability 0, space 0, times 0 [ 101.298933][ T6436] CPU: 3 UID: 0 PID: 6436 Comm: syz.2.110 Tainted: G L syzkaller #0 PREEMPT(full) [ 101.298959][ T6436] Tainted: [L]=SOFTLOCKUP [ 101.298966][ T6436] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.298977][ T6436] Call Trace: [ 101.298983][ T6436] [ 101.298989][ T6436] dump_stack_lvl+0x100/0x190 [ 101.299034][ T6436] should_fail_ex.cold+0x5/0xa [ 101.299064][ T6436] should_failslab+0xc2/0x120 [ 101.299086][ T6436] __kmalloc_cache_node_noprof+0x94/0x710 [ 101.299107][ T6436] ? blkg_alloc+0xbd/0xf80 [ 101.299164][ T6436] blkg_alloc+0xbd/0xf80 [ 101.299188][ T6436] ? mark_held_locks+0x40/0x70 [ 101.299214][ T6436] ? _raw_spin_unlock_irq+0x23/0x50 [ 101.299236][ T6436] blkg_conf_prep+0x46e/0xf10 [ 101.299267][ T6436] tg_set_conf.isra.0+0x1ed/0x510 [ 101.299298][ T6436] ? __pfx_tg_set_conf.isra.0+0x10/0x10 [ 101.299331][ T6436] ? kernfs_root+0xf8/0x2a0 [ 101.299363][ T6436] cgroup_file_write+0x1e6/0x8a0 [ 101.299383][ T6436] ? __pfx_tg_set_conf_uint+0x10/0x10 [ 101.299409][ T6436] ? __pfx_cgroup_file_write+0x10/0x10 [ 101.299429][ T6436] ? __kmalloc_noprof+0x350/0x840 [ 101.299464][ T6436] kernfs_fop_write_iter+0x3e0/0x5f0 [ 101.299485][ T6436] ? __pfx_cgroup_file_write+0x10/0x10 [ 101.299507][ T6436] vfs_write+0x6af/0x1050 [ 101.299527][ T6436] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 101.299551][ T6436] ? __pfx_vfs_write+0x10/0x10 [ 101.299567][ T6436] ? find_held_lock+0x2b/0x80 [ 101.299605][ T6436] ksys_write+0x12a/0x250 [ 101.299624][ T6436] ? __pfx_ksys_write+0x10/0x10 [ 101.299651][ T6436] do_syscall_64+0x123/0x790 [ 101.299677][ T6436] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.299696][ T6436] RIP: 0033:0x7f3be0d9fb19 [ 101.299714][ T6436] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.299730][ T6436] RSP: 002b:00007f3be1d27028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 101.299749][ T6436] RAX: ffffffffffffffda RBX: 00007f3be1025fa0 RCX: 00007f3be0d9fb19 [ 101.299761][ T6436] RDX: 0000000000000006 RSI: 0000200000001940 RDI: 0000000000000004 [ 101.299773][ T6436] RBP: 00007f3be0e37b70 R08: 0000000000000000 R09: 0000000000000000 [ 101.299786][ T6436] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.299797][ T6436] R13: 00007f3be1026038 R14: 00007f3be1025fa0 R15: 00007fff87799288 [ 101.299826][ T6436] [ 101.420135][ T6443] FAULT_INJECTION: forcing a failure. [ 101.420135][ T6443] name failslab, interval 1, probability 0, space 0, times 0 [ 101.420173][ T6443] CPU: 1 UID: 0 PID: 6443 Comm: syz.2.111 Tainted: G L syzkaller #0 PREEMPT(full) [ 101.420200][ T6443] Tainted: [L]=SOFTLOCKUP [ 101.420207][ T6443] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.420218][ T6443] Call Trace: [ 101.420225][ T6443] [ 101.420233][ T6443] dump_stack_lvl+0x100/0x190 [ 101.420270][ T6443] should_fail_ex.cold+0x5/0xa [ 101.420299][ T6443] should_failslab+0xc2/0x120 [ 101.420322][ T6443] kmem_cache_alloc_noprof+0x92/0x6a0 [ 101.420351][ T6443] ? __proc_create+0xc1/0x8f0 [ 101.420371][ T6443] ? __proc_create+0x247/0x8f0 [ 101.420395][ T6443] __proc_create+0x247/0x8f0 [ 101.420413][ T6443] ? __pfx___proc_create+0x10/0x10 [ 101.420435][ T6443] ? _raw_write_unlock+0x28/0x50 [ 101.420454][ T6443] ? proc_register+0x56d/0x910 [ 101.420477][ T6443] proc_create_reg+0x75/0x170 [ 101.420500][ T6443] proc_create_data+0x86/0x110 [ 101.420521][ T6443] ? __pfx_proc_create_data+0x10/0x10 [ 101.420540][ T6443] ? cache_register_net+0x137/0x5e0 [ 101.420580][ T6443] ? cache_register_net+0x137/0x5e0 [ 101.420607][ T6443] cache_register_net+0x2d6/0x5e0 [ 101.420631][ T6443] ip_map_cache_create+0x8b/0x130 [ 101.420652][ T6443] ? __pfx_sunrpc_init_net+0x10/0x10 [ 101.420675][ T6443] sunrpc_init_net+0x55/0x1b0 [ 101.420703][ T6443] ops_init+0x1e2/0x5f0 [ 101.420731][ T6443] setup_net+0x118/0x3a0 [ 101.420755][ T6443] ? __pfx_setup_net+0x10/0x10 [ 101.420779][ T6443] ? bpf_lsm_namespace_init+0x9/0x10 [ 101.420804][ T6443] copy_net_ns+0x340/0x7a0 [ 101.420832][ T6443] create_new_namespaces+0x3ea/0xac0 [ 101.420864][ T6443] unshare_nsproxy_namespaces+0xf6/0x210 [ 101.420892][ T6443] ksys_unshare+0x44f/0x980 [ 101.420941][ T6443] ? __pfx_ksys_unshare+0x10/0x10 [ 101.420980][ T6443] __x64_sys_unshare+0x31/0x40 [ 101.421005][ T6443] do_syscall_64+0x123/0x790 [ 101.421029][ T6443] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.421048][ T6443] RIP: 0033:0x7f3be0d9fb19 [ 101.421066][ T6443] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.421084][ T6443] RSP: 002b:00007f3be1d27028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 101.421105][ T6443] RAX: ffffffffffffffda RBX: 00007f3be1025fa0 RCX: 00007f3be0d9fb19 [ 101.421117][ T6443] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 101.421128][ T6443] RBP: 00007f3be0e37b70 R08: 0000000000000000 R09: 0000000000000000 [ 101.421139][ T6443] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.421149][ T6443] R13: 00007f3be1026038 R14: 00007f3be1025fa0 R15: 00007fff87799288 [ 101.421183][ T6443] [ 101.433970][ T6328] veth0_vlan: entered promiscuous mode [ 101.441016][ T6328] veth1_vlan: entered promiscuous mode [ 101.467096][ T6328] veth0_macvtap: entered promiscuous mode [ 101.477050][ T6328] veth1_macvtap: entered promiscuous mode [ 101.495945][ T6328] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.501591][ T6328] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.534434][ T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.553966][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.553983][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.579250][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.579264][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.582811][ T5879] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.582848][ T5879] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.582875][ T5879] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.589917][ T43] audit: type=1400 audit(1794132651.437:401): avc: denied { ioctl } for pid=6447 comm="syz.2.113" path="socket:[14208]" dev="sockfs" ino=14208 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 101.590607][ T6448] netlink: 'syz.2.113': attribute type 11 has an invalid length. [ 101.614132][ T43] audit: type=1400 audit(1794132651.467:402): avc: denied { mounton } for pid=6328 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2861 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 101.665481][ T43] audit: type=1400 audit(1794132651.517:403): avc: denied { mounton } for pid=6328 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 101.760578][ T43] audit: type=1400 audit(1794132651.607:404): avc: denied { ioctl } for pid=6452 comm="syz.2.114" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=15492 ioctlcmd=0xc018aa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 101.871707][ T43] audit: type=1400 audit(1794132651.717:405): avc: denied { prog_run } for pid=6459 comm="syz.4.117" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 102.021638][ T6471] netlink: 'syz.5.119': attribute type 3 has an invalid length. [ 102.083209][ T5878] e1000 0000:00:07.0 eth0: Reset adapter [ 102.173756][ T6464] e1000e 0000:00:02.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 102.261033][ T6478] FAULT_INJECTION: forcing a failure. [ 102.261033][ T6478] name fail_futex, interval 1, probability 0, space 0, times 1 [ 102.261055][ T6478] CPU: 1 UID: 0 PID: 6478 Comm: syz.5.120 Tainted: G L syzkaller #0 PREEMPT(full) [ 102.261071][ T6478] Tainted: [L]=SOFTLOCKUP [ 102.261075][ T6478] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.261082][ T6478] Call Trace: [ 102.261087][ T6478] [ 102.261092][ T6478] dump_stack_lvl+0x100/0x190 [ 102.261133][ T6478] should_fail_ex.cold+0x5/0xa [ 102.261156][ T6478] get_futex_key+0x1c9/0x13e0 [ 102.261176][ T6478] ? __pfx_get_futex_key+0x10/0x10 [ 102.261186][ T6478] ? wakeup_preempt_fair+0x4fc/0xf60 [ 102.261208][ T6478] futex_wait_setup+0x91/0x540 [ 102.261228][ T6478] __futex_wait+0x19f/0x360 [ 102.261245][ T6478] ? __pfx___futex_wait+0x10/0x10 [ 102.261261][ T6478] ? __pfx_try_to_wake_up+0x10/0x10 [ 102.261276][ T6478] ? futex_hash+0x311/0x400 [ 102.261289][ T6478] ? __pfx_futex_wake_mark+0x10/0x10 [ 102.261306][ T6478] ? find_held_lock+0x2b/0x80 [ 102.261317][ T6478] ? futex_wake+0x4ea/0x5e0 [ 102.261335][ T6478] futex_wait+0xe6/0x370 [ 102.261349][ T6478] ? __pfx_futex_wait+0x10/0x10 [ 102.261366][ T6478] ? dvb_usercopy+0x1c0/0x340 [ 102.261388][ T6478] ? rcu_is_watching+0x13/0xc0 [ 102.261400][ T6478] ? dvb_usercopy+0x1c0/0x340 [ 102.261415][ T6478] ? kfree+0x1e5/0x6d0 [ 102.261436][ T6478] do_futex+0x265/0x440 [ 102.261450][ T6478] ? __pfx_do_futex+0x10/0x10 [ 102.261480][ T6478] ? __fget_files+0x34/0x3d0 [ 102.261500][ T6478] __x64_sys_futex+0x34f/0x4d0 [ 102.261516][ T6478] ? __pfx___x64_sys_futex+0x10/0x10 [ 102.261536][ T6478] do_syscall_64+0x123/0x790 [ 102.261558][ T6478] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.261571][ T6478] RIP: 0033:0x7f85a899fb19 [ 102.261582][ T6478] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.261592][ T6478] RSP: 002b:00007f85a97c70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 102.261604][ T6478] RAX: ffffffffffffffda RBX: 00007f85a8c25fa8 RCX: 00007f85a899fb19 [ 102.261611][ T6478] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f85a8c25fa8 [ 102.261616][ T6478] RBP: 00007f85a8c25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 102.261622][ T6478] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.261628][ T6478] R13: 00007f85a8c26038 R14: 00007ffdbe8f3c40 R15: 00007ffdbe8f3d28 [ 102.261642][ T6478] [ 102.266019][ T6478] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 102.266031][ T6478] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 102.333019][ T5878] e1000 0000:00:07.0 eth0: Reset adapter [ 102.661768][ T30] e1000e 0000:00:02.0 eth1: NIC Link is Up 1000 Mbps Full Duplex, Flow Control: Rx/Tx [ 102.716957][ T6500] FAULT_INJECTION: forcing a failure. [ 102.716957][ T6500] name failslab, interval 1, probability 0, space 0, times 0 [ 102.717005][ T6500] CPU: 1 UID: 0 PID: 6500 Comm: syz.2.124 Tainted: G L syzkaller #0 PREEMPT(full) [ 102.717028][ T6500] Tainted: [L]=SOFTLOCKUP [ 102.717034][ T6500] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.717043][ T6500] Call Trace: [ 102.717048][ T6500] [ 102.717055][ T6500] dump_stack_lvl+0x100/0x190 [ 102.717089][ T6500] should_fail_ex.cold+0x5/0xa [ 102.717117][ T6500] should_failslab+0xc2/0x120 [ 102.717138][ T6500] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 102.717164][ T6500] ? __kasan_kmalloc+0xaa/0xb0 [ 102.717180][ T6500] ? create_filter_start.constprop.0+0x15b/0x310 [ 102.717205][ T6500] kstrdup+0x51/0xe0 [ 102.717226][ T6500] create_filter_start.constprop.0+0x15b/0x310 [ 102.717247][ T6500] apply_subsystem_event_filter+0x188/0x17a0 [ 102.717266][ T6500] ? __might_fault+0xc5/0x140 [ 102.717288][ T6500] ? __might_fault+0xc5/0x140 [ 102.717309][ T6500] ? __pfx_apply_subsystem_event_filter+0x10/0x10 [ 102.717331][ T6500] ? _copy_from_user+0x59/0xd0 [ 102.717374][ T6500] subsystem_filter_write+0x95/0x120 [ 102.717396][ T6500] vfs_write+0x2aa/0x1050 [ 102.717414][ T6500] ? __pfx_subsystem_filter_write+0x10/0x10 [ 102.717431][ T6500] ? lock_acquire+0x1d1/0x380 [ 102.717454][ T6500] ? __fget_files+0x34/0x3d0 [ 102.717473][ T6500] ? __pfx_vfs_write+0x10/0x10 [ 102.717488][ T6500] ? find_held_lock+0x2b/0x80 [ 102.717508][ T6500] ? __fget_files+0x215/0x3d0 [ 102.717533][ T6500] ? __fget_files+0x21f/0x3d0 [ 102.717559][ T6500] ksys_write+0x12a/0x250 [ 102.717575][ T6500] ? __pfx_ksys_write+0x10/0x10 [ 102.717601][ T6500] do_syscall_64+0x123/0x790 [ 102.717634][ T6500] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.717653][ T6500] RIP: 0033:0x7f3be0d9fb19 [ 102.717669][ T6500] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.717686][ T6500] RSP: 002b:00007f3be1d27028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 102.717703][ T6500] RAX: ffffffffffffffda RBX: 00007f3be1025fa0 RCX: 00007f3be0d9fb19 [ 102.717714][ T6500] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 102.717723][ T6500] RBP: 00007f3be0e37b70 R08: 0000000000000000 R09: 0000000000000000 [ 102.717734][ T6500] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.717743][ T6500] R13: 00007f3be1026038 R14: 00007f3be1025fa0 R15: 00007fff87799288 [ 102.717768][ T6500] [ 103.038026][ T6516] netlink: 'syz.3.126': attribute type 1 has an invalid length. [ 103.242880][ T5141] Bluetooth: hci2: command tx timeout [ 104.595853][ T58] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX [ 105.312679][ T5141] Bluetooth: hci2: command tx timeout [ 106.235409][ T43] kauditd_printk_skb: 24 callbacks suppressed [ 106.235424][ T43] audit: type=1400 audit(1794132656.087:430): avc: denied { write } for pid=6531 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.280147][ T43] audit: type=1400 audit(1794132656.127:431): avc: denied { write } for pid=6534 comm="rm" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.569468][ T43] audit: type=1400 audit(1794132656.417:432): avc: denied { write } for pid=6540 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.637117][ T43] audit: type=1400 audit(1794132656.487:433): avc: denied { write } for pid=6543 comm="rm" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.826419][ T43] audit: type=1400 audit(1794132656.677:434): avc: denied { write } for pid=6547 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.869315][ T43] audit: type=1400 audit(1794132656.717:435): avc: denied { write } for pid=6550 comm="rm" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 107.021724][ T43] audit: type=1400 audit(1794132656.867:436): avc: denied { write } for pid=6553 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 107.077773][ T43] audit: type=1400 audit(1794132656.927:437): avc: denied { write } for pid=6556 comm="rm" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 107.402838][ T5141] Bluetooth: hci2: command tx timeout [ 108.780887][ T43] audit: type=1400 audit(1794132658.627:438): avc: denied { write } for pid=6561 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 108.833767][ T43] audit: type=1400 audit(1794132658.687:439): avc: denied { write } for pid=6564 comm="rm" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 111.395618][ T43] audit: type=1400 audit(1794132661.247:440): avc: denied { write } for pid=6568 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 111.452844][ T43] audit: type=1400 audit(1794132661.307:441): avc: denied { write } for pid=6571 comm="rm" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 112.007079][ T43] audit: type=1400 audit(1794132661.857:442): avc: denied { write } for pid=6574 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 112.054802][ T43] audit: type=1400 audit(1794132661.907:443): avc: denied { write } for pid=6578 comm="rm" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 112.128996][ T43] audit: type=1400 audit(1794132661.977:444): avc: denied { write } for pid=6581 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 112.187887][ T43] audit: type=1400 audit(1794132662.037:445): avc: denied { write } for pid=6584 comm="rm" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 112.471508][ T6589] syzkaller0: entered promiscuous mode [ 112.471521][ T6589] syzkaller0: entered allmulticast mode [ 112.473282][ T6590] syzkaller0: entered promiscuous mode [ 112.473296][ T6590] syzkaller0: entered allmulticast mode [ 112.488629][ T6590] tipc: Started in network mode [ 112.488645][ T6590] tipc: Node identity 76d29cd4687, cluster identity 4711 [ 112.489364][ T6590] tipc: Enabled bearer , priority 0 [ 112.501966][ T6588] tipc: Resetting bearer [ 112.511189][ T6588] tipc: Disabling bearer [ 112.516618][ T6594] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 112.584146][ T6594] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 112.585913][ T43] audit: type=1400 audit(1794132662.437:446): avc: denied { write } for pid=6598 comm="syz.2.132" name="raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 112.586827][ T43] audit: type=1400 audit(1794132662.437:447): avc: denied { ioctl } for pid=6598 comm="syz.2.132" path="/dev/raw-gadget" dev="devtmpfs" ino=848 ioctlcmd=0x41015500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 112.749962][ T43] audit: type=1400 audit(1794132662.597:448): avc: denied { write } for pid=6609 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1857 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 112.761891][ T43] audit: type=1326 audit(1794132662.607:449): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6601 comm="syz.3.133" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f410c59fb19 code=0x7ffc0000 [ 112.845205][ T6614] vlan2: entered promiscuous mode [ 112.845220][ T6614] hsr0: entered promiscuous mode [ 112.853517][ T6336] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 112.868264][ T6617] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 112.868283][ T6617] device-mapper: raid: Choosing default region size of 4MiB [ 112.869535][ T6617] device-mapper: raid: Superblocks created for new raid set [ 112.871752][ T6614] netlink: 4 bytes leftover after parsing attributes in process `syz.5.136'. [ 112.883653][ T6614] hsr_slave_0: left promiscuous mode [ 112.886460][ T6614] hsr_slave_1: left promiscuous mode [ 112.922071][ T6617] md/raid1:mdX: active with 1 out of 1 mirrors [ 112.994552][ T6627] ip_tables: iptables: counters copy to user failed while replacing table [ 113.013796][ T6336] usb 7-1: New USB device found: idVendor=0644, idProduct=8047, bcdDevice=1.00 [ 113.014617][ T6336] usb 7-1: config 1 has an invalid interface number: 3 but max is 0 [ 113.014630][ T6336] usb 7-1: config 1 has no interface number 0 [ 113.016540][ T6336] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.016552][ T6336] usb 7-1: Product: syz [ 113.016559][ T6336] usb 7-1: Manufacturer: syz [ 113.016565][ T6336] usb 7-1: SerialNumber: syz [ 113.021538][ T6336] usb 7-1: 3:0 : does not exist [ 113.021549][ T6336] usb 7-1: 3:0 : does not exist [ 113.329113][ T1044] usb 7-1: USB disconnect, device number 2 [ 113.350203][ T6643] Bluetooth: MGMT ver 1.23 qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000) [ 113.602379][ T6647] 9pnet: p9_errstr2errno: server reported unknown error 0x0000000000 [ 113.884524][ T6655] 9pnet: p9_errstr2errno: server reported unknown error 0x000000000 [ 113.992189][ T6663] netlink: 'syz.4.149': attribute type 1 has an invalid length. [ 114.035468][ T6663] bond1 (unregistering): Released all slaves [ 114.087209][ T6666] bond1 (unregistering): Released all slaves [ 114.289942][ T6679] bond1: (slave .`): Releasing active interface [ 114.300472][ T6679] bridge_slave_0: left allmulticast mode [ 114.300487][ T6679] bridge_slave_0: left promiscuous mode [ 114.301499][ T6679] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.312449][ T6679] bridge_slave_1: left allmulticast mode [ 114.312472][ T6679] bridge_slave_1: left promiscuous mode [ 114.313246][ T6679] bridge0: port 2(bridge_slave_1) entered disabled state [ 114.338219][ T6679] .`: (slave bond_slave_0): Releasing backup interface [ 114.340223][ T6679] .`: (slave bond_slave_1): Releasing backup interface [ 114.345867][ T6679] team0: Port device team_slave_0 removed [ 114.350617][ T6679] team0: Port device team_slave_1 removed [ 114.351040][ T6679] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 114.351051][ T6679] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 114.352112][ T6679] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 114.352122][ T6679] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 114.355004][ T6679] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 114.361115][ T6683] team0: Port device xfrm0 added [ 114.385788][ T6679] tipc: Started in network mode [ 114.385806][ T6679] tipc: Node identity e62e2f776007, cluster identity 4711 [ 114.385954][ T6679] tipc: Enabled bearer , priority 0 [ 114.399695][ T6682] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 114.472638][ T1044] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 114.603852][ T1044] usb 9-1: device descriptor read/64, error -71 [ 114.662767][ T11] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 114.813210][ T11] usb 8-1: New USB device found: idVendor=06cd, idProduct=010f, bcdDevice=1.00 [ 114.814130][ T11] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 114.814170][ T11] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 114.814182][ T11] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 114.814192][ T11] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 114.814202][ T11] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 114.814217][ T11] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 114.814228][ T11] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 114.814238][ T11] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 114.814248][ T11] usb 8-1: config 1 interface 0 altsetting 0 has a duplicate endpoint with address 0x1, skipping [ 114.814257][ T11] usb 8-1: config 1 interface 0 altsetting 0 has 8 endpoint descriptors, different from the interface descriptor's value: 14 [ 114.816246][ T11] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.816258][ T11] usb 8-1: Product: syz [ 114.816264][ T11] usb 8-1: Manufacturer: syz [ 114.816271][ T11] usb 8-1: SerialNumber: syz [ 114.824568][ T6689] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 114.824698][ T6689] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 114.824772][ T6689] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 114.824898][ T6689] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 114.824998][ T6689] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 114.825044][ T6689] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 114.825088][ T6689] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 114.826658][ T11] keyspan 8-1:1.0: Keyspan 2 port adapter converter detected [ 114.827596][ T11] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 7 [ 114.829776][ T11] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 1 [ 114.829818][ T11] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 2 [ 114.829890][ T11] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 5 [ 114.833189][ T11] usb 8-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 114.835432][ T11] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 3 [ 114.835488][ T11] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 4 [ 114.835557][ T11] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 6 [ 114.837126][ T11] usb 8-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 114.862709][ T1044] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 114.992773][ T1044] usb 9-1: device descriptor read/64, error -71 [ 115.037239][ T10] usb 8-1: USB disconnect, device number 2 [ 115.045732][ T10] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 115.050804][ T10] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 115.051331][ T10] keyspan 8-1:1.0: device disconnected [ 115.102980][ T1044] usb usb9-port1: attempt power cycle [ 115.398699][ T6703] netlink: 8 bytes leftover after parsing attributes in process `syz.2.156'. [ 115.398714][ T6703] netlink: 8 bytes leftover after parsing attributes in process `syz.2.156'. [ 115.405105][ T6702] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.405378][ T6702] bridge0: port 1(bridge_slave_0) entered disabled state [ 115.472959][ T1044] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 115.479234][ T6702] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 115.503268][ T1044] usb 9-1: device descriptor read/8, error -71 [ 115.604909][ T58] tipc: Node number set to 2250846071 [ 115.622725][ T13] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.622753][ T13] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.622770][ T13] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.622787][ T13] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.742672][ T1044] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 115.764753][ T1044] usb 9-1: device descriptor read/8, error -71 [ 115.874979][ T1044] usb usb9-port1: unable to enumerate USB device [ 116.439908][ T6718] device-mapper: raid: Choosing default region size of 4MiB [ 116.440264][ T6718] device-mapper: table: 248:3: raid: Not enough devices to satisfy specification (-EINVAL) [ 116.440276][ T6718] device-mapper: ioctl: error adding target to table [ 116.480536][ T6721] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 116.481343][ T6721] tipc: Enabled bearer , priority 10 [ 116.510916][ T6723] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 116.585333][ T43] kauditd_printk_skb: 31 callbacks suppressed [ 116.585357][ T43] audit: type=1400 audit(1794132666.437:481): avc: denied { read } for pid=6722 comm="syz.3.161" name="trace" dev="tracefs" ino=3856 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 116.590785][ T6725] bridge0: port 3(syz_tun) entered blocking state [ 116.590849][ T6725] bridge0: port 3(syz_tun) entered disabled state [ 116.590979][ T6725] syz_tun: entered allmulticast mode [ 116.592323][ T6725] syz_tun: entered promiscuous mode [ 116.598154][ T43] audit: type=1400 audit(1794132666.447:482): avc: denied { ioctl } for pid=6724 comm="syz.2.162" path="time:[4026531834]" dev="nsfs" ino=4026531834 ioctlcmd=0xb701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 116.723956][ T43] audit: type=1400 audit(1794132666.577:483): avc: denied { allowed } for pid=6731 comm="syz.3.164" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 116.837828][ T6734] futex_wake_op: syz.3.164 tries to shift op by 144; fix this program [ 116.841552][ T6737] FAULT_INJECTION: forcing a failure. [ 116.841552][ T6737] name failslab, interval 1, probability 0, space 0, times 0 [ 116.841572][ T6737] CPU: 3 UID: 0 PID: 6737 Comm: syz.2.165 Tainted: G L syzkaller #0 PREEMPT(full) [ 116.841587][ T6737] Tainted: [L]=SOFTLOCKUP [ 116.841592][ T6737] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.841599][ T6737] Call Trace: [ 116.841609][ T6737] [ 116.841613][ T6737] dump_stack_lvl+0x100/0x190 [ 116.841648][ T6737] should_fail_ex.cold+0x5/0xa [ 116.841672][ T6737] should_failslab+0xc2/0x120 [ 116.841692][ T6737] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 116.841713][ T6737] ? kstrdup_const+0x63/0x80 [ 116.841728][ T6737] kstrdup+0x51/0xe0 [ 116.841742][ T6737] kstrdup_const+0x63/0x80 [ 116.841754][ T6737] __kernfs_new_node+0x9b/0xa10 [ 116.841764][ T6737] ? lock_acquire+0x1d1/0x380 [ 116.841784][ T6737] ? kernfs_link_sibling+0x379/0x6f0 [ 116.841802][ T6737] ? __pfx___kernfs_new_node+0x10/0x10 [ 116.841814][ T6737] ? lock_acquire+0x1d1/0x380 [ 116.841828][ T6737] ? kernfs_root+0x23/0x2a0 [ 116.841843][ T6737] ? find_held_lock+0x2b/0x80 [ 116.841854][ T6737] ? kernfs_root+0xee/0x2a0 [ 116.841869][ T6737] ? kernfs_root+0xee/0x2a0 [ 116.841888][ T6737] kernfs_new_node+0x194/0x200 [ 116.841900][ T6737] ? __pfx_kernfs_new_node+0x10/0x10 [ 116.841913][ T6737] ? kernfs_add_one+0x213/0xb40 [ 116.841927][ T6737] __kernfs_create_file+0x53/0x350 [ 116.841944][ T6737] cgroup_addrm_files+0x48e/0xd30 [ 116.841963][ T6737] ? __pfx_cgroup_addrm_files+0x10/0x10 [ 116.841979][ T6737] ? css_next_child+0xcf/0x2e0 [ 116.841993][ T6737] ? css_next_descendant_pre+0x58/0x1a0 [ 116.842009][ T6737] css_populate_dir+0x343/0x590 [ 116.842022][ T6737] cgroup_mkdir+0x975/0x13a0 [ 116.842040][ T6737] ? __pfx_cgroup_mkdir+0x10/0x10 [ 116.842057][ T6737] kernfs_iop_mkdir+0x111/0x190 [ 116.842073][ T6737] ? security_inode_mkdir+0xc9/0x2b0 [ 116.842094][ T6737] vfs_mkdir+0x36d/0x8a0 [ 116.842108][ T6737] filename_mkdirat+0x4c4/0x630 [ 116.842123][ T6737] ? __pfx_filename_mkdirat+0x10/0x10 [ 116.842138][ T6737] ? strncpy_from_user+0x19d/0x2d0 [ 116.842161][ T6737] ? do_getname+0x191/0x390 [ 116.842179][ T6737] __x64_sys_mkdirat+0x89/0xc0 [ 116.842194][ T6737] do_syscall_64+0x123/0x790 [ 116.842217][ T6737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.842230][ T6737] RIP: 0033:0x7f3be0d9fb19 [ 116.842247][ T6737] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 116.842257][ T6737] RSP: 002b:00007f3be1d27028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 116.842269][ T6737] RAX: ffffffffffffffda RBX: 00007f3be1025fa0 RCX: 00007f3be0d9fb19 [ 116.842276][ T6737] RDX: 00000000000001ff RSI: 0000200000000540 RDI: ffffffffffffff9c [ 116.842283][ T6737] RBP: 00007f3be0e37b70 R08: 0000000000000000 R09: 0000000000000000 [ 116.842290][ T6737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 116.842297][ T6737] R13: 00007f3be1026038 R14: 00007f3be1025fa0 R15: 00007fff87799288 [ 116.842313][ T6737] [ 116.842318][ T6737] cgroup: cgroup_addrm_files: failed to add notify_on_release, err=-12 [ 117.101578][ T43] audit: type=1400 audit(1794132666.947:484): avc: denied { map } for pid=6746 comm="syz.2.169" path="socket:[15748]" dev="sockfs" ino=15748 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 117.292009][ T6751] netlink: 4 bytes leftover after parsing attributes in process `syz.4.171'. [ 117.292027][ T6751] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 117.292036][ T6751] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 117.292878][ T6751] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 117.292888][ T6751] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 117.340353][ T43] audit: type=1400 audit(1794132667.187:485): avc: denied { mounton } for pid=6752 comm="syz.2.172" path="/60/dev" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 117.343105][ T43] audit: type=1800 audit(1794132667.187:486): pid=6753 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.172" name=08 dev="sda1" ino=2041 res=0 errno=-22 [ 117.486995][ T6757] syzkaller0: entered promiscuous mode [ 117.487009][ T6757] syzkaller0: entered allmulticast mode [ 118.612680][ T43] audit: type=1400 audit(1794132668.447:487): avc: denied { read write } for pid=6771 comm="syz.4.178" name="mtd0" dev="devtmpfs" ino=714 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 118.612731][ T43] audit: type=1400 audit(1794132668.447:488): avc: denied { open } for pid=6771 comm="syz.4.178" path="/dev/mtd0" dev="devtmpfs" ino=714 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 118.612766][ T43] audit: type=1400 audit(1794132668.447:489): avc: denied { ioctl } for pid=6771 comm="syz.4.178" path="/dev/mtd0" dev="devtmpfs" ino=714 ioctlcmd=0x800c4d10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 119.174224][ T43] audit: type=1400 audit(1794132669.027:490): avc: denied { write } for pid=6778 comm="syz.3.180" name="functions" dev="configfs" ino=13032 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 119.218643][ T6781] netlink: ct family unspecified [ 119.249048][ T6783] overlay: Unknown parameter 'fsmagic' [ 119.257477][ T6783] FAULT_INJECTION: forcing a failure. [ 119.257477][ T6783] name failslab, interval 1, probability 0, space 0, times 0 [ 119.257497][ T6783] CPU: 3 UID: 0 PID: 6783 Comm: syz.3.182 Tainted: G L syzkaller #0 PREEMPT(full) [ 119.257519][ T6783] Tainted: [L]=SOFTLOCKUP [ 119.257522][ T6783] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 119.257529][ T6783] Call Trace: [ 119.257533][ T6783] [ 119.257537][ T6783] dump_stack_lvl+0x100/0x190 [ 119.257571][ T6783] should_fail_ex.cold+0x5/0xa [ 119.257605][ T6783] should_failslab+0xc2/0x120 [ 119.257640][ T6783] kmem_cache_alloc_noprof+0x92/0x6a0 [ 119.257668][ T6783] ? __asan_memcpy+0x3c/0x60 [ 119.257686][ T6783] ? __kernfs_new_node+0xd2/0xa10 [ 119.257700][ T6783] __kernfs_new_node+0xd2/0xa10 [ 119.257712][ T6783] ? __pfx___kernfs_new_node+0x10/0x10 [ 119.257724][ T6783] ? lock_acquire+0x1d1/0x380 [ 119.257746][ T6783] ? kernfs_root+0x23/0x2a0 [ 119.257763][ T6783] ? find_held_lock+0x2b/0x80 [ 119.257774][ T6783] ? kernfs_root+0xee/0x2a0 [ 119.257789][ T6783] ? kernfs_root+0xee/0x2a0 [ 119.257807][ T6783] kernfs_new_node+0x194/0x200 [ 119.257820][ T6783] ? __pfx_kernfs_new_node+0x10/0x10 [ 119.257836][ T6783] __kernfs_create_file+0x53/0x350 [ 119.257853][ T6783] sysfs_add_file_mode_ns+0x207/0x3c0 [ 119.257873][ T6783] internal_create_group+0x593/0xfb0 [ 119.257895][ T6783] ? __pfx_internal_create_group+0x10/0x10 [ 119.257912][ T6783] ? __pfx_kobject_add+0x10/0x10 [ 119.257941][ T6783] internal_create_groups+0x9d/0x150 [ 119.257960][ T6783] ib_setup_port_attrs+0x41f/0x600 [ 119.257989][ T6783] ? __pfx_ib_setup_port_attrs+0x10/0x10 [ 119.258009][ T6783] ? rdma_counter_init+0x209/0x400 [ 119.258027][ T6783] ib_register_device+0x8a7/0xdd0 [ 119.258047][ T6783] siw_newlink+0xb44/0xe70 [ 119.258072][ T6783] nldev_newlink+0x3b0/0x630 [ 119.258089][ T6783] ? __pfx_nldev_newlink+0x10/0x10 [ 119.258145][ T6783] ? cred_has_capability.isra.0+0x186/0x300 [ 119.258168][ T6783] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 119.258181][ T6783] ? lock_acquire+0x1d1/0x380 [ 119.258196][ T6783] ? hook_capable+0x1bc/0x500 [ 119.258213][ T6783] ? cap_capable+0x107/0x430 [ 119.258230][ T6783] ? security_capable+0x80/0x260 [ 119.258245][ T6783] ? ns_capable+0xcd/0xf0 [ 119.258257][ T6783] ? __pfx_nldev_newlink+0x10/0x10 [ 119.258272][ T6783] rdma_nl_rcv_msg+0x392/0x6f0 [ 119.258287][ T6783] ? __pfx_rdma_nl_rcv_msg+0x10/0x10 [ 119.258304][ T6783] ? __lock_acquire+0x5c0/0x1f40 [ 119.258321][ T6783] rdma_nl_rcv_skb.constprop.0.isra.0+0x2cb/0x410 [ 119.258338][ T6783] ? __pfx_rdma_nl_rcv_skb.constprop.0.isra.0+0x10/0x10 [ 119.258376][ T6783] ? netlink_deliver_tap+0x1ae/0xb50 [ 119.258422][ T6783] netlink_unicast+0x668/0x950 [ 119.258440][ T6783] ? __pfx_netlink_unicast+0x10/0x10 [ 119.258459][ T6783] netlink_sendmsg+0x9ac/0x10c0 [ 119.258476][ T6783] ? __pfx_netlink_sendmsg+0x10/0x10 [ 119.258495][ T6783] ? selinux_socket_sendmsg+0x198/0x2f0 [ 119.258522][ T6783] ? ____sys_sendmsg+0xa99/0xc30 [ 119.258538][ T6783] ____sys_sendmsg+0xa99/0xc30 [ 119.258554][ T6783] ? __pfx_netlink_sendmsg+0x10/0x10 [ 119.258571][ T6783] ? __pfx_____sys_sendmsg+0x10/0x10 [ 119.258590][ T6783] ? plist_check_list+0x1b8/0x280 [ 119.258601][ T6783] ? plist_del+0x308/0x510 [ 119.258613][ T6783] ___sys_sendmsg+0x190/0x1e0 [ 119.258632][ T6783] ? __pfx____sys_sendmsg+0x10/0x10 [ 119.258649][ T6783] ? futex_wake+0x220/0x5e0 [ 119.258669][ T6783] ? find_held_lock+0x2b/0x80 [ 119.258690][ T6783] __sys_sendmsg+0x160/0x210 [ 119.258705][ T6783] ? __pfx___sys_sendmsg+0x10/0x10 [ 119.258727][ T6783] do_syscall_64+0x123/0x790 [ 119.258741][ T6783] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.258757][ T6783] RIP: 0033:0x7f410c59fb19 [ 119.258768][ T6783] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.258778][ T6783] RSP: 002b:00007f410d3ee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 119.258791][ T6783] RAX: ffffffffffffffda RBX: 00007f410c825fa0 RCX: 00007f410c59fb19 [ 119.258801][ T6783] RDX: 000000000000c000 RSI: 0000200000000700 RDI: 0000000000000006 [ 119.258808][ T6783] RBP: 00007f410c637b70 R08: 0000000000000000 R09: 0000000000000000 [ 119.258815][ T6783] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.258821][ T6783] R13: 00007f410c826038 R14: 00007f410c825fa0 R15: 00007ffeab3aa048 [ 119.258837][ T6783] [ 119.260420][ T6783] infiniband syz2: Couldn't register device with driver model [ 119.261680][ T6783] siw: device registration error -12 [ 119.704159][ T6795] Driver unsupported XDP return value 0 on prog (id 14) dev N/A, expect packet loss! [ 119.712175][ T6790] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 119.762253][ T6797] syzkaller0: entered promiscuous mode [ 119.762267][ T6797] syzkaller0: entered allmulticast mode [ 119.877138][ T6799] syzkaller0: entered promiscuous mode [ 119.877153][ T6799] syzkaller0: entered allmulticast mode [ 119.964178][ T6801] warning: `syz.3.188' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 119.999893][ T6803] syzkaller0: entered promiscuous mode [ 119.999913][ T6803] syzkaller0: entered allmulticast mode [ 120.373987][ T6809] capability: warning: `syz.3.191' uses deprecated v2 capabilities in a way that may be insecure [ 120.379839][ T6809] FAULT_INJECTION: forcing a failure. [ 120.379839][ T6809] name failslab, interval 1, probability 0, space 0, times 0 [ 120.379858][ T6809] CPU: 3 UID: 0 PID: 6809 Comm: syz.3.191 Tainted: G L syzkaller #0 PREEMPT(full) [ 120.379872][ T6809] Tainted: [L]=SOFTLOCKUP [ 120.379875][ T6809] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 120.379881][ T6809] Call Trace: [ 120.379885][ T6809] [ 120.379890][ T6809] dump_stack_lvl+0x100/0x190 [ 120.379930][ T6809] should_fail_ex.cold+0x5/0xa [ 120.379966][ T6809] should_failslab+0xc2/0x120 [ 120.379994][ T6809] __kvmalloc_node_noprof+0x113/0x9b0 [ 120.380014][ T6809] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 120.380031][ T6809] ? ceph_msg_new2+0x370/0x4f0 [ 120.380054][ T6809] ceph_msg_new2+0x370/0x4f0 [ 120.380066][ T6809] msgpool_alloc+0xa8/0x200 [ 120.380079][ T6809] ? __pfx_msgpool_alloc+0x10/0x10 [ 120.380091][ T6809] ? __pfx_msgpool_alloc+0x10/0x10 [ 120.380103][ T6809] mempool_init_node+0x2f7/0x6f0 [ 120.380118][ T6809] ? __pfx_msgpool_free+0x10/0x10 [ 120.380131][ T6809] mempool_create_node_noprof+0xe9/0x1b0 [ 120.380143][ T6809] ? __pfx_msgpool_alloc+0x10/0x10 [ 120.380158][ T6809] ceph_msgpool_init+0xdc/0x1d0 [ 120.380172][ T6809] ceph_osdc_init+0x539/0xa00 [ 120.380190][ T6809] ceph_create_client+0x281/0x370 [ 120.380206][ T6809] ceph_get_tree+0x1a4/0x2020 [ 120.380239][ T6809] ? bpf_lsm_capable+0x9/0x10 [ 120.380257][ T6809] ? security_capable+0x80/0x260 [ 120.380274][ T6809] vfs_get_tree+0x92/0x320 [ 120.380291][ T6809] path_mount+0x7d0/0x2850 [ 120.380310][ T6809] ? __pfx_path_mount+0x10/0x10 [ 120.380326][ T6809] ? lockdep_hardirqs_on+0x7d/0x110 [ 120.380340][ T6809] ? putname+0xb1/0x110 [ 120.380352][ T6809] ? kmem_cache_free+0x127/0x6c0 [ 120.380371][ T6809] ? __x64_sys_mount+0x293/0x310 [ 120.380386][ T6809] __x64_sys_mount+0x293/0x310 [ 120.380402][ T6809] ? __pfx___x64_sys_mount+0x10/0x10 [ 120.380422][ T6809] do_syscall_64+0x123/0x790 [ 120.380435][ T6809] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.380446][ T6809] RIP: 0033:0x7f410c59fb19 [ 120.380456][ T6809] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.380465][ T6809] RSP: 002b:00007f410d3ee028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 120.380476][ T6809] RAX: ffffffffffffffda RBX: 00007f410c825fa0 RCX: 00007f410c59fb19 [ 120.380482][ T6809] RDX: 0000200000025e00 RSI: 0000200000025dc0 RDI: 0000200000025d80 [ 120.380488][ T6809] RBP: 00007f410c637b70 R08: 0000000000000000 R09: 0000000000000000 [ 120.380494][ T6809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 120.380500][ T6809] R13: 00007f410c826038 R14: 00007f410c825fa0 R15: 00007ffeab3aa048 [ 120.380515][ T6809] [ 120.426529][ T6811] input: syz0 as /devices/virtual/input/input6 [ 120.617744][ T6813] netlink: 4 bytes leftover after parsing attributes in process `syz.3.193'. [ 120.619036][ T6813] syzkaller0: entered promiscuous mode [ 120.619054][ T6813] syzkaller0: entered allmulticast mode [ 120.737650][ T6815] team0: Port device xfrm0 removed [ 120.738551][ T6815] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 120.738814][ T37] tipc: Resetting bearer [ 120.770296][ T6815] team0: Mode changed to "loadbalance" [ 120.773587][ T6815] vlan0: entered promiscuous mode [ 120.777815][ T6815] team0: Port device vlan0 added [ 120.782403][ T6815] tipc: Enabling of bearer rejected, already enabled [ 121.294328][ T5141] Bluetooth: hci1: unexpected cc 0x080d length: 9 > 3 [ 121.872449][ T43] kauditd_printk_skb: 16 callbacks suppressed [ 121.872467][ T43] audit: type=1400 audit(1794132671.717:507): avc: denied { name_bind } for pid=6827 comm="syz.3.199" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 121.873736][ T43] audit: type=1400 audit(1794132671.717:508): avc: denied { node_bind } for pid=6827 comm="syz.3.199" saddr=::1 src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 121.875247][ T43] audit: type=1400 audit(1794132671.727:509): avc: denied { name_connect } for pid=6827 comm="syz.3.199" dest=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 121.879287][ T43] audit: type=1400 audit(1794132671.727:510): avc: denied { ioctl } for pid=6827 comm="syz.3.199" path="socket:[17713]" dev="sockfs" ino=17713 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 122.720654][ T6829] syz.3.199 (6829) used greatest stack depth: 19448 bytes left [ 123.656694][ T6835] netlink: 'syz.3.201': attribute type 1 has an invalid length. [ 123.670537][ T6835] bond0: entered promiscuous mode [ 123.670853][ T6835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 123.685198][ T6835] netlink: 28 bytes leftover after parsing attributes in process `syz.3.201'. [ 123.685281][ T6835] bond0: entered allmulticast mode [ 123.698590][ T6835] bond0: (slave bridge1): making interface the new active one [ 123.698605][ T6835] bridge1: entered promiscuous mode [ 123.698693][ T6835] bridge1: entered allmulticast mode [ 123.699674][ T6835] bond0: (slave bridge1): Enslaving as an active interface with an up link [ 123.753015][ T6838] syzkaller0: entered promiscuous mode [ 123.753029][ T6838] syzkaller0: entered allmulticast mode [ 124.769635][ T43] audit: type=1400 audit(1794132674.617:511): avc: denied { read } for pid=6843 comm="syz.3.204" name="card0" dev="devtmpfs" ino=635 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 124.769803][ T43] audit: type=1400 audit(1794132674.617:512): avc: denied { open } for pid=6843 comm="syz.3.204" path="/dev/dri/card0" dev="devtmpfs" ino=635 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 124.773521][ T6844] faux_driver vgem: [drm] Unknown color mode 11176; guessing buffer size. [ 124.773891][ T43] audit: type=1400 audit(1794132674.627:513): avc: denied { ioctl } for pid=6843 comm="syz.3.204" path="/dev/dri/card0" dev="devtmpfs" ino=635 ioctlcmd=0xc02064b2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 124.818526][ T43] audit: type=1400 audit(1794132674.667:514): avc: denied { ioctl } for pid=6845 comm="syz.3.205" path="/78/config/nullb/nullb1/zoned" dev="configfs" ino=15825 ioctlcmd=0x4068aea3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 124.820635][ T6846] null_blk: nullb1: using native zone append [ 124.841893][ T6846] null_blk: disk nullb1 created [ 125.182769][ T10] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 125.332802][ T10] usb 8-1: Using ep0 maxpacket: 32 [ 125.333258][ T10] usb 8-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 125.334102][ T10] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 125.336599][ T10] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 125.336617][ T10] usb 8-1: Product: syz [ 125.336628][ T10] usb 8-1: Manufacturer: syz [ 125.336640][ T10] usb 8-1: SerialNumber: syz [ 125.339574][ T10] usb 8-1: config 0 descriptor?? [ 125.340148][ T6853] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 125.343652][ T10] hub 8-1:0.0: bad descriptor, ignoring hub [ 125.343673][ T10] hub 8-1:0.0: probe with driver hub failed with error -5 [ 128.604676][ T5794] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 128.606994][ T5794] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 128.610168][ T5794] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 128.611063][ T5794] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 128.611594][ T5794] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 128.836790][ T6857] rxe_eth0 speed is unknown, defaulting to 1000 [ 129.096469][ T6857] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.096534][ T6857] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.096592][ T6857] bridge_slave_0: entered allmulticast mode [ 129.097279][ T6857] bridge_slave_0: entered promiscuous mode [ 129.099034][ T6857] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.099103][ T6857] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.099248][ T6857] bridge_slave_1: entered allmulticast mode [ 129.099919][ T6857] bridge_slave_1: entered promiscuous mode [ 129.121932][ T6857] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 129.124028][ T6857] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 129.137284][ T6857] team0: Port device team_slave_0 added [ 129.138625][ T6857] team0: Port device team_slave_1 added [ 129.151465][ T6857] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 129.151476][ T6857] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 129.151488][ T6857] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 129.152356][ T6857] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 129.152364][ T6857] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 129.152375][ T6857] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 129.171887][ T6857] hsr_slave_0: entered promiscuous mode [ 129.172343][ T6857] hsr_slave_1: entered promiscuous mode [ 129.282382][ T6857] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 129.286995][ T6857] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 129.287483][ T6857] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 129.288879][ T6857] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 129.289353][ T6857] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 129.290901][ T6857] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 129.291344][ T6857] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 129.293122][ T6857] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 129.310753][ T6857] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.310843][ T6857] bridge0: port 2(bridge_slave_1) entered forwarding state [ 129.311035][ T6857] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.311113][ T6857] bridge0: port 1(bridge_slave_0) entered forwarding state [ 129.349535][ T6857] 8021q: adding VLAN 0 to HW filter on device bond0 [ 129.356133][ T220] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.356605][ T220] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.365552][ T6857] 8021q: adding VLAN 0 to HW filter on device team0 [ 129.372052][ T220] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.372133][ T220] bridge0: port 1(bridge_slave_0) entered forwarding state [ 129.376470][ T220] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.376559][ T220] bridge0: port 2(bridge_slave_1) entered forwarding state [ 129.596785][ T6857] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 129.747296][ T6857] veth0_vlan: entered promiscuous mode [ 129.750690][ T6857] veth1_vlan: entered promiscuous mode [ 129.767365][ T6857] veth0_macvtap: entered promiscuous mode [ 129.769832][ T6857] veth1_macvtap: entered promiscuous mode [ 129.778269][ T6857] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 129.783612][ T6857] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 129.787245][ T13] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.788346][ T5879] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.788370][ T5879] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.788388][ T5879] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.833210][ T220] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 129.833220][ T220] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 129.847985][ T220] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 129.847998][ T220] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 130.154161][ T43] audit: type=1400 audit(1794132680.007:515): avc: denied { read write } for pid=6908 comm="syz.6.208" name="rdma_cm" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 130.154318][ T43] audit: type=1400 audit(1794132680.007:516): avc: denied { open } for pid=6908 comm="syz.6.208" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 130.158967][ T43] audit: type=1400 audit(1794132680.007:517): avc: denied { append } for pid=6908 comm="syz.6.208" name="autofs" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 130.222010][ T6911] FAULT_INJECTION: forcing a failure. [ 130.222010][ T6911] name failslab, interval 1, probability 0, space 0, times 0 [ 130.222028][ T6911] CPU: 1 UID: 0 PID: 6911 Comm: syz.6.209 Tainted: G L syzkaller #0 PREEMPT(full) [ 130.222042][ T6911] Tainted: [L]=SOFTLOCKUP [ 130.222047][ T6911] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 130.222053][ T6911] Call Trace: [ 130.222057][ T6911] [ 130.222061][ T6911] dump_stack_lvl+0x100/0x190 [ 130.222082][ T6911] should_fail_ex.cold+0x5/0xa [ 130.222099][ T6911] should_failslab+0xc2/0x120 [ 130.222113][ T6911] __kmalloc_cache_noprof+0x91/0x6d0 [ 130.222129][ T6911] ? shmem_init_fs_context+0x47/0x2b0 [ 130.222147][ T6911] shmem_init_fs_context+0x47/0x2b0 [ 130.222162][ T6911] alloc_fs_context+0x607/0xf40 [ 130.222176][ T6911] fs_context_for_reconfigure+0xd3/0xf0 [ 130.222188][ T6911] devtmpfs_init_fs_context+0xd1/0x1f0 [ 130.222218][ T6911] alloc_fs_context+0x607/0xf40 [ 130.222231][ T6911] path_mount+0xf59/0x2850 [ 130.222250][ T6911] ? __pfx_path_mount+0x10/0x10 [ 130.222265][ T6911] ? lockdep_hardirqs_on+0x7d/0x110 [ 130.222280][ T6911] ? putname+0xb1/0x110 [ 130.222294][ T6911] ? kmem_cache_free+0x127/0x6c0 [ 130.222313][ T6911] ? __x64_sys_mount+0x293/0x310 [ 130.222328][ T6911] __x64_sys_mount+0x293/0x310 [ 130.222374][ T6911] ? __pfx___x64_sys_mount+0x10/0x10 [ 130.222395][ T6911] do_syscall_64+0x123/0x790 [ 130.222411][ T6911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.222423][ T6911] RIP: 0033:0x7f99d2f9fb19 [ 130.222434][ T6911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 130.222444][ T6911] RSP: 002b:00007f99d3ec0028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 130.222455][ T6911] RAX: ffffffffffffffda RBX: 00007f99d3225fa0 RCX: 00007f99d2f9fb19 [ 130.222461][ T6911] RDX: 00002000000002c0 RSI: 00002000000001c0 RDI: 0000000000000000 [ 130.222467][ T6911] RBP: 00007f99d3037b70 R08: 0000000000000000 R09: 0000000000000000 [ 130.222473][ T6911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 130.222479][ T6911] R13: 00007f99d3226038 R14: 00007f99d3225fa0 R15: 00007fff351fc128 [ 130.222492][ T6911] [ 130.238089][ T6911] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 130.258832][ T5879] smpboot: CPU 1 is now offline [ 130.349000][ T43] audit: type=1400 audit(1794132680.197:518): avc: denied { getopt } for pid=6914 comm="syz.6.210" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 130.351761][ T43] audit: type=1400 audit(1794132680.197:519): avc: denied { read } for pid=6914 comm="syz.6.210" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 130.392524][ T6917] syzkaller0: entered promiscuous mode [ 130.393730][ T6917] syzkaller0: entered allmulticast mode [ 130.508863][ T6919] syzkaller0: entered promiscuous mode [ 130.508882][ T6919] syzkaller0: entered allmulticast mode [ 130.672899][ T5141] Bluetooth: hci4: command tx timeout [ 132.665532][ T5794] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 132.666934][ T5794] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 132.667839][ T5794] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 132.675999][ T5794] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 132.676680][ T5794] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 132.731436][ T6930] syzkaller0: entered promiscuous mode [ 132.731457][ T6930] syzkaller0: entered allmulticast mode [ 132.752963][ T5141] Bluetooth: hci4: command tx timeout [ 132.928721][ T6925] rxe_eth0 speed is unknown, defaulting to 1000 [ 133.200422][ T6925] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.200554][ T6925] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.200939][ T6925] bridge_slave_0: entered allmulticast mode [ 133.202350][ T6925] bridge_slave_0: entered promiscuous mode [ 133.205657][ T6925] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.205698][ T6925] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.205954][ T6925] bridge_slave_1: entered allmulticast mode [ 133.206887][ T6925] bridge_slave_1: entered promiscuous mode [ 133.225580][ T6925] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 133.228109][ T6925] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 133.249750][ T6925] team0: Port device team_slave_0 added [ 133.252392][ T6925] team0: Port device team_slave_1 added [ 133.274011][ T6925] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 133.274041][ T6925] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 133.274060][ T6925] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 133.275948][ T6925] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 133.275961][ T6925] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 133.275980][ T6925] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 133.310985][ T6925] hsr_slave_0: entered promiscuous mode [ 133.312277][ T6925] hsr_slave_1: entered promiscuous mode [ 133.314216][ T6925] debugfs: 'hsr0' already exists in 'hsr' [ 133.314242][ T6925] Cannot create hsr debugfs directory [ 133.467880][ T6925] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 133.471195][ T6925] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 133.471967][ T6925] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 133.474954][ T6925] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 133.475573][ T6925] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 133.481808][ T6925] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 133.482533][ T6925] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 133.493051][ T6925] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 133.512895][ T6925] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.512991][ T6925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.513189][ T6925] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.513396][ T6925] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.555488][ T6925] 8021q: adding VLAN 0 to HW filter on device bond0 [ 133.563185][ T220] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.565358][ T220] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.576553][ T6925] 8021q: adding VLAN 0 to HW filter on device team0 [ 133.581671][ T220] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.581755][ T220] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.586270][ T220] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.586387][ T220] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.855984][ T5794] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 133.859300][ T5794] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 133.860392][ T5794] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 133.869258][ T5794] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 133.869870][ T5794] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 133.985391][ T6925] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 134.148244][ T6959] rxe_eth0 speed is unknown, defaulting to 1000 [ 134.153983][ T6925] veth0_vlan: entered promiscuous mode [ 134.157945][ T6925] veth1_vlan: entered promiscuous mode [ 134.183264][ T6925] veth0_macvtap: entered promiscuous mode [ 134.186699][ T6925] veth1_macvtap: entered promiscuous mode [ 134.197638][ T6925] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 134.206977][ T6925] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 134.252018][ T220] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 134.252032][ T220] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 134.278284][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 134.278298][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 134.324566][ T5837] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.324793][ T5837] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.363033][ T5837] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.372779][ T13] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.532083][ T43] audit: type=1400 audit(1794132684.377:520): avc: denied { read write } for pid=6990 comm="syz.7.219" name="nullb0" dev="devtmpfs" ino=705 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 134.532358][ T43] audit: type=1400 audit(1794132684.377:521): avc: denied { open } for pid=6990 comm="syz.7.219" path="/dev/nullb0" dev="devtmpfs" ino=705 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 134.753212][ T5141] Bluetooth: hci5: command tx timeout [ 134.765542][ T43] audit: type=1400 audit(1794132684.617:522): avc: denied { connect } for pid=6993 comm="syz.6.220" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 134.833095][ T5141] Bluetooth: hci4: command tx timeout [ 135.104652][ T6996] Console: switching to colour dummy device 80x25 [ 135.591513][ T7000] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 135.953074][ T5141] Bluetooth: hci6: command tx timeout [ 136.336018][ T7003] FAULT_INJECTION: forcing a failure. [ 136.336018][ T7003] name failslab, interval 1, probability 0, space 0, times 0 [ 136.336048][ T7003] CPU: 0 UID: 0 PID: 7003 Comm: syz.7.223 Tainted: G L syzkaller #0 PREEMPT(full) [ 136.336072][ T7003] Tainted: [L]=SOFTLOCKUP [ 136.336079][ T7003] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 136.336089][ T7003] Call Trace: [ 136.336111][ T7003] [ 136.336119][ T7003] dump_stack_lvl+0x100/0x190 [ 136.336160][ T7003] should_fail_ex.cold+0x5/0xa [ 136.336185][ T7003] should_failslab+0xc2/0x120 [ 136.336212][ T7003] __kmalloc_noprof+0xfc/0x840 [ 136.336238][ T7003] ? mempool_init_node+0x2f7/0x6f0 [ 136.336257][ T7003] ? __pfx_mempool_kmalloc+0x10/0x10 [ 136.336276][ T7003] mempool_init_node+0x2f7/0x6f0 [ 136.336301][ T7003] ? __pfx_mempool_kmalloc+0x10/0x10 [ 136.336317][ T7003] ? __pfx_mempool_kfree+0x10/0x10 [ 136.336332][ T7003] mempool_init_noprof+0x3a/0x50 [ 136.336355][ T7003] crypt_ctr+0x1465/0x3d10 [ 136.336413][ T7003] ? __pfx_crypt_ctr+0x10/0x10 [ 136.336443][ T7003] ? kasan_save_track+0x14/0x30 [ 136.336460][ T7003] ? __kasan_kmalloc+0xaa/0xb0 [ 136.336476][ T7003] ? dm_split_args+0xc1/0x570 [ 136.336493][ T7003] ? rcu_is_watching+0x13/0xc0 [ 136.336511][ T7003] ? dm_split_args+0xc1/0x570 [ 136.336526][ T7003] ? kfree+0x1e5/0x6d0 [ 136.336547][ T7003] ? skip_spaces+0xee/0x130 [ 136.336578][ T7003] ? dm_split_args+0x441/0x570 [ 136.336601][ T7003] dm_table_add_target+0x58b/0xee0 [ 136.336623][ T7003] ? __pfx_dm_table_add_target+0x10/0x10 [ 136.336644][ T7003] ? dm_table_create+0x2d3/0x3d0 [ 136.336665][ T7003] table_load+0x3b9/0x7b0 [ 136.336685][ T7003] ? __pfx_table_load+0x10/0x10 [ 136.336698][ T7003] ? __might_fault+0xc5/0x140 [ 136.336713][ T7003] ? __might_fault+0xc5/0x140 [ 136.336740][ T7003] ctl_ioctl+0x4d2/0xcc0 [ 136.336762][ T7003] ? __pfx_table_load+0x10/0x10 [ 136.336777][ T7003] ? __pfx_ctl_ioctl+0x10/0x10 [ 136.336824][ T7003] ? selinux_file_ioctl+0x1e0/0x290 [ 136.336844][ T7003] dm_ctl_ioctl+0x22/0x30 [ 136.336864][ T7003] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 136.336886][ T7003] __x64_sys_ioctl+0x18e/0x210 [ 136.336906][ T7003] do_syscall_64+0x123/0x790 [ 136.336936][ T7003] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.336959][ T7003] RIP: 0033:0x7face779fb19 [ 136.336983][ T7003] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.337000][ T7003] RSP: 002b:00007face86de028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 136.337019][ T7003] RAX: ffffffffffffffda RBX: 00007face7a25fa0 RCX: 00007face779fb19 [ 136.337031][ T7003] RDX: 0000200000000400 RSI: 00000000c138fd09 RDI: 0000000000000007 [ 136.337041][ T7003] RBP: 00007face7837b70 R08: 0000000000000000 R09: 0000000000000000 [ 136.337051][ T7003] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 136.337060][ T7003] R13: 00007face7a26038 R14: 00007face7a25fa0 R15: 00007ffeeeec1288 [ 136.337082][ T7003] [ 136.337568][ T7003] device-mapper: table: 248:4: crypt: Cannot allocate crypt request mempool (-ENOMEM) [ 136.337596][ T7003] device-mapper: ioctl: error adding target to table [ 136.429834][ T7000] md: pers->run() failed ... [ 136.515265][ T7007] jffs2: notice: (7007) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 136.529816][ T43] audit: type=1400 audit(1794132686.367:523): avc: denied { write } for pid=7006 comm="syz.6.224" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 136.539070][ T43] audit: type=1400 audit(1794132686.397:524): avc: denied { add_name } for pid=7006 comm="syz.6.224" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 136.551886][ T43] audit: type=1400 audit(1794132686.397:525): avc: denied { read append open } for pid=7006 comm="syz.6.224" path="/13/file0/file0/file0" dev="jffs2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 136.600394][ T43] audit: type=1400 audit(1794132686.447:526): avc: denied { ioctl } for pid=7006 comm="syz.6.224" path="/13/file0/file0/file0" dev="jffs2" ino=2 ioctlcmd=0x5409 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 136.654287][ T43] audit: type=1400 audit(1794132686.507:527): avc: denied { write } for pid=7006 comm="syz.6.224" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 136.816533][ T43] audit: type=1400 audit(1794132686.667:528): avc: denied { write } for pid=7006 comm="syz.6.224" name="file0" dev="jffs2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 136.832756][ T5141] Bluetooth: hci5: command tx timeout [ 136.838999][ T7016] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 136.913013][ T5141] Bluetooth: hci4: command tx timeout [ 137.107580][ T43] audit: type=1400 audit(1794132686.957:529): avc: denied { mount } for pid=7018 comm="syz.6.227" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 137.118114][ T43] audit: type=1400 audit(1794132686.977:530): avc: denied { mounton } for pid=7018 comm="syz.6.227" path="/file0" dev="bpf" ino=20602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 137.118639][ T7019] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 137.118653][ T7019] overlayfs: fs on '.' does not support file handles, falling back to index=off,nfs_export=off. [ 137.139236][ T7019] vivid-000: ================= START STATUS ================= [ 137.139344][ T7019] vivid-000: Test Pattern: 75% Colorbar [ 137.139358][ T7019] vivid-000: Fill Percentage of Frame: 100 [ 137.139369][ T7019] vivid-000: Horizontal Movement: No Movement [ 137.139393][ T7019] vivid-000: Vertical Movement: No Movement [ 137.139403][ T7019] vivid-000: OSD Text Mode: All [ 137.139413][ T7019] vivid-000: Show Border: false [ 137.139422][ T7019] vivid-000: Show Square: false [ 137.139433][ T7019] vivid-000: Sensor Flipped Horizontally: false [ 137.139443][ T7019] vivid-000: Sensor Flipped Vertically: false [ 137.139452][ T7019] vivid-000: Insert SAV Code in Image: false [ 137.139461][ T7019] vivid-000: Insert EAV Code in Image: false [ 137.139470][ T7019] vivid-000: Insert Video Guard Band: false [ 137.139480][ T7019] vivid-000: Reduced Framerate: false [ 137.139489][ T7019] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 137.139504][ T7019] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 137.139514][ T7019] vivid-000: Enable Capture Cropping: true [ 137.139523][ T7019] vivid-000: Enable Capture Composing: true [ 137.139531][ T7019] vivid-000: Enable Capture Scaler: true [ 137.139540][ T7019] vivid-000: Timestamp Source: End of Frame [ 137.139549][ T7019] vivid-000: Colorspace: sRGB [ 137.139557][ T7019] vivid-000: Transfer Function: Default [ 137.139566][ T7019] vivid-000: Y'CbCr Encoding: Default [ 137.139575][ T7019] vivid-000: HSV Encoding: Hue 0-179 [ 137.139583][ T7019] vivid-000: Quantization: Default [ 137.139592][ T7019] vivid-000: Apply Alpha To Red Only: false [ 137.139600][ T7019] vivid-000: Standard Aspect Ratio: 4x3 [ 137.139609][ T7019] vivid-000: DV Timings Signal Mode: Current DV Timings inactive [ 137.139621][ T7019] vivid-000: DV Timings: 640x480p59 inactive [ 137.139633][ T7019] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 137.139643][ T7019] vivid-000: Maximum EDID Blocks: 2 [ 137.139653][ T7019] vivid-000: Limited RGB Range (16-235): false [ 137.139663][ T7019] vivid-000: Rx RGB Quantization Range: Automatic [ 137.139673][ T7019] vivid-000: Power Present: 0x00000001 [ 137.139685][ T7019] tpg source WxH: 320x240 (Y'CbCr) [ 137.139691][ T7019] tpg field: 1 [ 137.139694][ T7019] tpg crop: (0,0)/320x240 [ 137.139700][ T7019] tpg compose: (0,0)/320x240 [ 137.139706][ T7019] tpg colorspace: 8 [ 137.139709][ T7019] tpg transfer function: 0/0 [ 137.139714][ T7019] tpg Y'CbCr encoding: 0/0 [ 137.139718][ T7019] tpg quantization: 0/0 [ 137.139722][ T7019] tpg RGB range: 0/2 [ 137.139726][ T7019] vivid-000: ================== END STATUS ================== [ 137.384601][ T7023] tc action pedit unable to extract header offset for header type (0x4) [ 137.384614][ T7023] tc action pedit unable to extract header offset for header type (0x4) [ 137.384620][ T7023] tc action pedit unable to extract header offset for header type (0x4) [ 137.384625][ T7023] tc action pedit unable to extract header offset for header type (0x4) [ 137.384630][ T7023] tc action pedit unable to extract header offset for header type (0x4) [ 137.384635][ T7023] tc action pedit unable to extract header offset for header type (0x4) [ 137.384640][ T7023] tc action pedit unable to extract header offset for header type (0x4) [ 137.384645][ T7023] tc action pedit unable to extract header offset for header type (0x4) [ 137.384650][ T7023] tc action pedit unable to extract header offset for header type (0x4) [ 137.384655][ T7023] tc action pedit unable to extract header offset for header type (0x4) [ 137.384666][ T7023] 0: reclassify loop, rule prio 0, protocol 800 [ 137.645563][ T1450] ieee802154 phy0 wpan0: encryption failed: -22 [ 137.645614][ T1450] ieee802154 phy1 wpan1: encryption failed: -22 [ 137.649164][ T43] audit: type=1400 audit(1794132687.497:531): avc: denied { create } for pid=7028 comm="syz.7.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 137.652518][ T7029] ALSA: seq fatal error: cannot create timer (-22) [ 137.725810][ T7032] syzkaller0: entered promiscuous mode [ 137.725845][ T7032] syzkaller0: entered allmulticast mode [ 137.745357][ T43] audit: type=1400 audit(1794132687.597:532): avc: denied { shutdown } for pid=7033 comm="syz.6.232" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 138.032867][ T5141] Bluetooth: hci6: command tx timeout [ 138.204669][ T7050] syzkaller0: entered promiscuous mode [ 138.204689][ T7050] syzkaller0: entered allmulticast mode [ 138.208666][ T7050] TC_ACT_REPEAT abuse ? [ 138.353442][ T7054] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 138.355687][ T7054] netlink: 'syz.6.239': attribute type 4 has an invalid length. [ 138.355699][ T7054] netlink: 17 bytes leftover after parsing attributes in process `syz.6.239'. [ 138.356603][ T7054] FAULT_INJECTION: forcing a failure. [ 138.356603][ T7054] name failslab, interval 1, probability 0, space 0, times 0 [ 138.356625][ T7054] CPU: 3 UID: 0 PID: 7054 Comm: syz.6.239 Tainted: G L syzkaller #0 PREEMPT(full) [ 138.356640][ T7054] Tainted: [L]=SOFTLOCKUP [ 138.356644][ T7054] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 138.356650][ T7054] Call Trace: [ 138.356665][ T7054] [ 138.356670][ T7054] dump_stack_lvl+0x100/0x190 [ 138.356705][ T7054] should_fail_ex.cold+0x5/0xa [ 138.356728][ T7054] should_failslab+0xc2/0x120 [ 138.356750][ T7054] kmem_cache_alloc_noprof+0x92/0x6a0 [ 138.356767][ T7054] ? fib_insert_alias+0x43e/0xe30 [ 138.356796][ T7054] fib_insert_alias+0x43e/0xe30 [ 138.356813][ T7054] ? lockdep_rtnl_is_held+0x26/0x40 [ 138.356832][ T7054] ? fib_find_node+0x209/0x280 [ 138.356848][ T7054] fib_trie_unmerge+0x2af/0xc00 [ 138.356862][ T7054] ? __pfx_fib_trie_unmerge+0x10/0x10 [ 138.356876][ T7054] ? lock_acquire+0x1d1/0x380 [ 138.356898][ T7054] fib_unmerge+0xee/0x510 [ 138.356909][ T7054] ? fib_nl2rule_locked+0x3ef/0x740 [ 138.356922][ T7054] fib4_rule_configure+0xaba/0x1160 [ 138.356936][ T7054] ? fib_nl2rule_locked+0x3fe/0x740 [ 138.356948][ T7054] fib_newrule+0x3c3/0x1e50 [ 138.356960][ T7054] ? avc_has_perm_noaudit+0x11e/0x470 [ 138.356981][ T7054] ? __pfx_fib_newrule+0x10/0x10 [ 138.356991][ T7054] ? avc_has_perm_noaudit+0x100/0x470 [ 138.357015][ T7054] ? rtnetlink_rcv_msg+0x1f6/0xe90 [ 138.357030][ T7054] ? find_held_lock+0x2b/0x80 [ 138.357042][ T7054] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 138.357057][ T7054] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 138.357074][ T7054] ? __pfx_fib_nl_newrule+0x10/0x10 [ 138.357085][ T7054] rtnetlink_rcv_msg+0x95e/0xe90 [ 138.357102][ T7054] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 138.357119][ T7054] ? __lock_acquire+0x5c0/0x1f40 [ 138.357157][ T7054] netlink_rcv_skb+0x159/0x420 [ 138.357173][ T7054] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 138.357189][ T7054] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 138.357209][ T7054] ? netlink_deliver_tap+0x1ae/0xb50 [ 138.357226][ T7054] netlink_unicast+0x668/0x950 [ 138.357242][ T7054] ? __pfx_netlink_unicast+0x10/0x10 [ 138.357260][ T7054] netlink_sendmsg+0x9ac/0x10c0 [ 138.357277][ T7054] ? __pfx_netlink_sendmsg+0x10/0x10 [ 138.357295][ T7054] ? selinux_socket_sendmsg+0x198/0x2f0 [ 138.357315][ T7054] ? ____sys_sendmsg+0xa99/0xc30 [ 138.357330][ T7054] ____sys_sendmsg+0xa99/0xc30 [ 138.357344][ T7054] ? __pfx_netlink_sendmsg+0x10/0x10 [ 138.357360][ T7054] ? __pfx_____sys_sendmsg+0x10/0x10 [ 138.357383][ T7054] ___sys_sendmsg+0x190/0x1e0 [ 138.357400][ T7054] ? __pfx____sys_sendmsg+0x10/0x10 [ 138.357416][ T7054] ? futex_wait+0x11e/0x370 [ 138.357437][ T7054] ? find_held_lock+0x2b/0x80 [ 138.357457][ T7054] __sys_sendmsg+0x160/0x210 [ 138.357470][ T7054] ? __pfx___sys_sendmsg+0x10/0x10 [ 138.357492][ T7054] do_syscall_64+0x123/0x790 [ 138.357516][ T7054] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.357532][ T7054] RIP: 0033:0x7f99d2f9fb19 [ 138.357548][ T7054] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 138.357558][ T7054] RSP: 002b:00007f99d3ec0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 138.357569][ T7054] RAX: ffffffffffffffda RBX: 00007f99d3225fa0 RCX: 00007f99d2f9fb19 [ 138.357576][ T7054] RDX: 0000000000004000 RSI: 0000200000000300 RDI: 0000000000000007 [ 138.357583][ T7054] RBP: 00007f99d3037b70 R08: 0000000000000000 R09: 0000000000000000 [ 138.357589][ T7054] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 138.357596][ T7054] R13: 00007f99d3226038 R14: 00007f99d3225fa0 R15: 00007fff351fc128 [ 138.357613][ T7054] [ 138.397673][ T7056] ip_tables: iptables: counters copy to user failed while replacing table [ 138.447879][ T180] IPVS: starting estimator thread 0... [ 138.532873][ T7059] IPVS: using max 43 ests per chain, 103200 per kthread [ 138.809410][ T7070] FAULT_INJECTION: forcing a failure. [ 138.809410][ T7070] name failslab, interval 1, probability 0, space 0, times 0 [ 138.809430][ T7070] CPU: 0 UID: 0 PID: 7070 Comm: syz.7.245 Tainted: G L syzkaller #0 PREEMPT(full) [ 138.809445][ T7070] Tainted: [L]=SOFTLOCKUP [ 138.809448][ T7070] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 138.809454][ T7070] Call Trace: [ 138.809458][ T7070] [ 138.809463][ T7070] dump_stack_lvl+0x100/0x190 [ 138.809490][ T7070] should_fail_ex.cold+0x5/0xa [ 138.809508][ T7070] should_failslab+0xc2/0x120 [ 138.809522][ T7070] __kmalloc_noprof+0xfc/0x840 [ 138.809539][ T7070] ? xfrm_hash_alloc+0xcf/0x100 [ 138.809555][ T7070] xfrm_hash_alloc+0xcf/0x100 [ 138.809568][ T7070] xfrm_net_init+0x35f/0xcf0 [ 138.809585][ T7070] ? __pfx_xfrm_net_init+0x10/0x10 [ 138.809598][ T7070] ops_init+0x1e2/0x5f0 [ 138.809614][ T7070] setup_net+0x118/0x3a0 [ 138.809628][ T7070] ? __pfx_setup_net+0x10/0x10 [ 138.809643][ T7070] ? bpf_lsm_namespace_init+0x9/0x10 [ 138.809658][ T7070] copy_net_ns+0x340/0x7a0 [ 138.809674][ T7070] create_new_namespaces+0x3ea/0xac0 [ 138.809693][ T7070] unshare_nsproxy_namespaces+0xf6/0x210 [ 138.809710][ T7070] ksys_unshare+0x44f/0x980 [ 138.809724][ T7070] ? __pfx_ksys_unshare+0x10/0x10 [ 138.809745][ T7070] __x64_sys_unshare+0x31/0x40 [ 138.809758][ T7070] do_syscall_64+0x123/0x790 [ 138.809773][ T7070] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.809784][ T7070] RIP: 0033:0x7face779fb19 [ 138.809794][ T7070] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 138.809803][ T7070] RSP: 002b:00007face86de028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 138.809814][ T7070] RAX: ffffffffffffffda RBX: 00007face7a25fa0 RCX: 00007face779fb19 [ 138.809820][ T7070] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 138.809826][ T7070] RBP: 00007face7837b70 R08: 0000000000000000 R09: 0000000000000000 [ 138.809832][ T7070] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 138.809838][ T7070] R13: 00007face7a26038 R14: 00007face7a25fa0 R15: 00007ffeeeec1288 [ 138.809852][ T7070] [ 138.915437][ T5141] Bluetooth: hci5: command tx timeout [ 139.044005][ T7078] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 139.148343][ T5141] Bluetooth: hci5: unexpected event 0x03 length: 1 < 11 [ 139.149479][ T7080] IPv6: NLM_F_CREATE should be specified when creating new route [ 139.149693][ T7080] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 139.149700][ T7080] IPv6: NLM_F_CREATE should be set when creating new route [ 139.149718][ T7080] IPv6: NLM_F_CREATE should be set when creating new route [ 139.149728][ T7080] IPv6: NLM_F_CREATE should be set when creating new route [ 139.150702][ T7080] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7080 comm=syz.7.249 [ 139.165021][ T7078] md: could not open device unknown-block(1,12). [ 139.213197][ T7078] md: could not open device unknown-block(1,13). [ 139.781882][ T7084] overlayfs: missing 'lowerdir' [ 139.911964][ T7078] md: pers->run() failed ... [ 139.914554][ T7082] md: md6 stopped. [ 140.065564][ T5794] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 140.066977][ T5794] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 140.067590][ T5794] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 140.068325][ T5794] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 140.068847][ T5794] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 140.112651][ T5794] Bluetooth: hci6: command tx timeout [ 140.332501][ T7098] Trying to write to read-only block-device nullb0 [ 140.672009][ T7100] tmpfs: Unknown parameter 'grpquota_block_hardlim' [ 140.676570][ T7100] jffs2: notice: (7100) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 141.002698][ T5794] Bluetooth: hci5: command tx timeout [ 141.708044][ T43] kauditd_printk_skb: 30 callbacks suppressed [ 141.708063][ T43] audit: type=1400 audit(1794132691.557:563): avc: denied { write } for pid=7110 comm="syz.7.260" name="functions" dev="configfs" ino=13032 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 141.713306][ T43] audit: type=1400 audit(1794132691.557:564): avc: denied { create } for pid=7110 comm="syz.7.260" name="ncm.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 141.716514][ T43] audit: type=1400 audit(1794132691.567:565): avc: denied { write } for pid=7110 comm="syz.7.260" name="c.1" dev="configfs" ino=13037 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 141.720034][ T43] audit: type=1400 audit(1794132691.567:566): avc: denied { write } for pid=7110 comm="syz.7.260" name="c.1" dev="configfs" ino=13037 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 141.744411][ T7111] configfs-gadget.g1 gadget.0: HOST MAC da:e6:84:0a:5b:f8 [ 141.744436][ T7111] configfs-gadget.g1 gadget.0: MAC aa:e8:9d:5c:83:be [ 141.797314][ T43] audit: type=1400 audit(1794132691.647:567): avc: denied { write } for pid=7113 comm="syz.7.261" name="dlm" dev="configfs" ino=2059 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 141.800524][ T43] audit: type=1400 audit(1794132691.647:568): avc: denied { write } for pid=7113 comm="syz.7.261" name="comms" dev="configfs" ino=21527 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 141.860660][ T43] audit: type=1400 audit(1794132691.707:569): avc: denied { mount } for pid=7116 comm="syz.7.262" name="/" dev="ramfs" ino=21538 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 141.993123][ T50] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 142.063360][ T43] audit: type=1400 audit(1794132691.917:570): avc: denied { append } for pid=7128 comm="syz.7.265" name="event2" dev="devtmpfs" ino=1076 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 142.123362][ T5794] Bluetooth: hci7: command tx timeout [ 142.142921][ T50] usb 5-1: New USB device found: idVendor=0000, idProduct=0000, bcdDevice=7.04 [ 142.143379][ T50] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 142.143393][ T50] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 142.143423][ T50] usb 5-1: Dual-Role OTG device on HNP port [ 142.143629][ T50] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.151685][ C3] ------------[ cut here ]------------ [ 142.151706][ C3] usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0 [ 142.151715][ C3] WARNING: drivers/usb/gadget/udc/core.c:124 at usb_ep_enable+0x3e6/0x490, CPU#3: syz.7.265/7128 [ 142.171300][ C3] Modules linked in: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 142.172655][ C3] CPU: 3 UID: 0 PID: 7128 Comm: syz.7.265 Tainted: G L syzkaller #0 PREEMPT(full) [ 142.176344][ C3] Tainted: [L]=SOFTLOCKUP [ 142.177758][ C3] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 142.180935][ C3] RIP: 0010:usb_ep_enable+0x3f8/0x490 [ 142.182646][ C3] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8d 3d 2a 0f 84 0a 48 8b 4b 08 40 0f b6 d5 4d 89 e0 48 c7 c6 60 b8 fb 8c <67> 48 0f b9 3a bd ea ff ff ff e9 8e fd ff ff 49 c7 c4 00 ab fb 8c [ 142.188993][ C3] RSP: 0000:ffffc900027a7940 EFLAGS: 00010046 [ 142.190892][ C3] RAX: dffffc0000000000 RBX: ffff88802c8d00e0 RCX: ffffffff8cfbef60 [ 142.193346][ C3] RDX: 0000000000000081 RSI: ffffffff8cfbb860 RDI: ffffffff927811b0 [ 142.195835][ C3] RBP: 0000000000000081 R08: ffffffff8cfbab40 R09: 0000000000000000 [ 142.198310][ C3] R10: ffffffff926ab35f R11: ffff88801e7da620 R12: ffffffff8cfbab40 [ 142.200825][ C3] R13: 0000000000000000 R14: ffff88802c8d00e0 R15: ffff88805f779520 [ 142.203296][ C3] FS: 0000555561a1c500(0000) GS:ffff8880d4775000(0000) knlGS:0000000000000000 [ 142.206096][ C3] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 142.208155][ C3] CR2: 00007fffe6a32ff8 CR3: 00000000387bd000 CR4: 0000000000352ef0 [ 142.210541][ C3] Call Trace: [ 142.211622][ C3] [ 142.212578][ C3] hidg_set_alt+0x190/0xa10 [ 142.214064][ C3] ? do_raw_spin_unlock+0x145/0x1e0 [ 142.215762][ C3] ? rcu_is_watching+0x13/0xc0 [ 142.217361][ C3] composite_setup+0x2ccf/0x9290 [ 142.218961][ C3] ? __lock_acquire+0x5c0/0x1f40 [ 142.220549][ C3] ? __pfx_composite_setup+0x10/0x10 [ 142.222226][ C3] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 142.223931][ C3] ? do_raw_spin_lock+0x128/0x260 [ 142.225520][ C3] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 142.227262][ C3] ? configfs_composite_setup+0xfb/0x130 [ 142.228987][ C3] configfs_composite_setup+0xfb/0x130 [ 142.230668][ C3] dummy_timer+0x20a0/0x3840 [ 142.232133][ C3] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 142.233998][ C3] ? debug_object_deactivate+0x2e4/0x3b0 [ 142.235798][ C3] ? __pfx_dummy_timer+0x10/0x10 [ 142.237382][ C3] ? rcu_is_watching+0x13/0xc0 [ 142.238923][ C3] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 142.240778][ C3] ? __pfx_dummy_timer+0x10/0x10 [ 142.242354][ C3] __hrtimer_run_queues+0x448/0x9a0 [ 142.244011][ C3] hrtimer_run_softirq+0x1ca/0x360 [ 142.245590][ C3] handle_softirqs+0x216/0xa20 [ 142.247273][ C3] ? __pfx_handle_softirqs+0x10/0x10 [ 142.248891][ C3] ? _raw_spin_unlock+0x28/0x50 [ 142.250375][ C3] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 142.252075][ C3] __irq_exit_rcu+0x178/0x220 [ 142.253483][ C3] irq_exit_rcu+0x9/0x30 [ 142.254784][ C3] sysvec_apic_timer_interrupt+0x56/0xc0 [ 142.256496][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 142.258295][ C3] RIP: 0033:0x7face766fd44 [ 142.259729][ C3] Code: 48 0f 7e ca 48 39 c2 73 65 48 39 f0 0f 82 2a 01 00 00 48 39 f2 72 65 66 0f c6 c0 01 0f 11 45 00 4c 89 e6 eb 09 90 48 8b 4b 08 <48> 83 c3 08 48 39 d1 72 f3 48 8d 46 f8 48 8b 76 f8 48 39 f2 73 13 [ 142.265728][ C3] RSP: 002b:00007ffeeeec1190 EFLAGS: 00000293 [ 142.267783][ C3] RAX: 00007face701dd58 RBX: 00007face701cb18 RCX: ffffffff826b058e [ 142.270293][ C3] RDX: ffffffff826b058e RSI: 00007face701dd58 RDI: 00007face701d3f8 [ 142.272736][ C3] RBP: 00007face701c870 R08: 00007face7a10000 R09: 00007face7a26128 [ 142.275207][ C3] R10: 0000000000000003 R11: 0000000000000009 R12: 00007face701df80 [ 142.277625][ C3] R13: 0000000000000019 R14: 00000000000002e2 R15: 0000000000000003 [ 142.280021][ C3] ? __zap_vma_range+0x22be/0x46c0 [ 142.281741][ C3] ? __zap_vma_range+0x22be/0x46c0 [ 142.283392][ C3] [ 142.284437][ C3] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 142.286810][ C3] CPU: 3 UID: 0 PID: 7128 Comm: syz.7.265 Tainted: G L syzkaller #0 PREEMPT(full) [ 142.290124][ C3] Tainted: [L]=SOFTLOCKUP [ 142.291454][ C3] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 142.294461][ C3] Call Trace: [ 142.295502][ C3] [ 142.296498][ C3] dump_stack_lvl+0x100/0x190 [ 142.297964][ C3] vpanic+0x2dc/0x6f8 [ 142.299224][ C3] panic+0xd1/0xe0 [ 142.300431][ C3] ? __pfx_panic+0x10/0x10 [ 142.301830][ C3] check_panic_on_warn.cold+0x19/0x34 [ 142.303505][ C3] ? usb_ep_enable+0x3e6/0x490 [ 142.304993][ C3] __warn.cold+0x191/0x321 [ 142.306444][ C3] __report_bug+0x30f/0x440 [ 142.307878][ C3] ? usb_ep_enable+0x3e6/0x490 [ 142.309360][ C3] ? __pfx___report_bug+0x10/0x10 [ 142.310964][ C3] ? try_to_wake_up+0x158/0x1ca0 [ 142.312531][ C3] report_bug_entry+0xe2/0x290 [ 142.314062][ C3] ? usb_ep_enable+0x3f8/0x490 [ 142.315568][ C3] handle_bug+0x1cd/0x2a0 [ 142.317249][ C3] exc_invalid_op+0x17/0x50 [ 142.318730][ C3] asm_exc_invalid_op+0x1a/0x20 [ 142.320290][ C3] RIP: 0010:usb_ep_enable+0x3f8/0x490 [ 142.321970][ C3] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8d 3d 2a 0f 84 0a 48 8b 4b 08 40 0f b6 d5 4d 89 e0 48 c7 c6 60 b8 fb 8c <67> 48 0f b9 3a bd ea ff ff ff e9 8e fd ff ff 49 c7 c4 00 ab fb 8c [ 142.327975][ C3] RSP: 0000:ffffc900027a7940 EFLAGS: 00010046 [ 142.329892][ C3] RAX: dffffc0000000000 RBX: ffff88802c8d00e0 RCX: ffffffff8cfbef60 [ 142.332365][ C3] RDX: 0000000000000081 RSI: ffffffff8cfbb860 RDI: ffffffff927811b0 [ 142.334830][ C3] RBP: 0000000000000081 R08: ffffffff8cfbab40 R09: 0000000000000000 [ 142.337321][ C3] R10: ffffffff926ab35f R11: ffff88801e7da620 R12: ffffffff8cfbab40 [ 142.339768][ C3] R13: 0000000000000000 R14: ffff88802c8d00e0 R15: ffff88805f779520 [ 142.342259][ C3] hidg_set_alt+0x190/0xa10 [ 142.343744][ C3] ? do_raw_spin_unlock+0x145/0x1e0 [ 142.345319][ C3] ? rcu_is_watching+0x13/0xc0 [ 142.346857][ C3] composite_setup+0x2ccf/0x9290 [ 142.348359][ C3] ? __lock_acquire+0x5c0/0x1f40 [ 142.349863][ C3] ? __pfx_composite_setup+0x10/0x10 [ 142.351521][ C3] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 142.353177][ C3] ? do_raw_spin_lock+0x128/0x260 [ 142.354788][ C3] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 142.356479][ C3] ? configfs_composite_setup+0xfb/0x130 [ 142.358230][ C3] configfs_composite_setup+0xfb/0x130 [ 142.359982][ C3] dummy_timer+0x20a0/0x3840 [ 142.361473][ C3] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 142.363323][ C3] ? debug_object_deactivate+0x2e4/0x3b0 [ 142.365087][ C3] ? __pfx_dummy_timer+0x10/0x10 [ 142.366895][ C3] ? rcu_is_watching+0x13/0xc0 [ 142.368419][ C3] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 142.370296][ C3] ? __pfx_dummy_timer+0x10/0x10 [ 142.371856][ C3] __hrtimer_run_queues+0x448/0x9a0 [ 142.373498][ C3] hrtimer_run_softirq+0x1ca/0x360 [ 142.375102][ C3] handle_softirqs+0x216/0xa20 [ 142.376658][ C3] ? __pfx_handle_softirqs+0x10/0x10 [ 142.378324][ C3] ? _raw_spin_unlock+0x28/0x50 [ 142.379854][ C3] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 142.381611][ C3] __irq_exit_rcu+0x178/0x220 [ 142.383121][ C3] irq_exit_rcu+0x9/0x30 [ 142.384460][ C3] sysvec_apic_timer_interrupt+0x56/0xc0 [ 142.386261][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 142.388032][ C3] RIP: 0033:0x7face766fd44 [ 142.389449][ C3] Code: 48 0f 7e ca 48 39 c2 73 65 48 39 f0 0f 82 2a 01 00 00 48 39 f2 72 65 66 0f c6 c0 01 0f 11 45 00 4c 89 e6 eb 09 90 48 8b 4b 08 <48> 83 c3 08 48 39 d1 72 f3 48 8d 46 f8 48 8b 76 f8 48 39 f2 73 13 [ 142.395410][ C3] RSP: 002b:00007ffeeeec1190 EFLAGS: 00000293 [ 142.397393][ C3] RAX: 00007face701dd58 RBX: 00007face701cb18 RCX: ffffffff826b058e [ 142.399870][ C3] RDX: ffffffff826b058e RSI: 00007face701dd58 RDI: 00007face701d3f8 [ 142.402323][ C3] RBP: 00007face701c870 R08: 00007face7a10000 R09: 00007face7a26128 [ 142.404784][ C3] R10: 0000000000000003 R11: 0000000000000009 R12: 00007face701df80 [ 142.407328][ C3] R13: 0000000000000019 R14: 00000000000002e2 R15: 0000000000000003 [ 142.409730][ C3] ? __zap_vma_range+0x22be/0x46c0 [ 142.411307][ C3] ? __zap_vma_range+0x22be/0x46c0 [ 142.412909][ C3] [ 142.414499][ C3] Kernel Offset: disabled [ 142.415866][ C3] Rebooting in 86400 seconds..