last executing test programs: 23.729590572s ago: executing program 0 (id=978): r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)=0xe) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$gtp(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)={0x2c, r5, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@GTPA_FAMILY={0x5, 0xd, 0x1f}, @GTPA_VERSION={0x8}, @GTPA_LINK={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x84}, 0x10) r6 = syz_open_procfs$namespace(0x0, &(0x7f0000000400)='ns/mnt\x00') sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x82820000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x58, r5, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_MS_ADDR6={0x14, 0xc, @private2={0xfc, 0x2, '\x00', 0x1}}, @GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_NET_NS_FD={0x8, 0x7, r6}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x58}, 0x1, 0x0, 0x0, 0x804}, 0x800) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x5c, r2, 0x1, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x3f, 0x33, @beacon={{{}, {0xff}, @broadcast}, 0x0, @default, 0x88b, @void, @val={0x1, 0x1, [{0x48, 0x1}]}, @val={0x3, 0x1, 0xe}, @void, @void, @void, @void, @val={0x2a, 0x1, {0x1, 0x1, 0x1}}, @val={0x3c, 0x4, {0x0, 0x0, 0xab, 0x3a}}, @void, @val={0x72, 0x6}, @void, @void}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x880}, 0x0) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000340)="aefdda9d240040005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000140)="99746fd6240020005da6a2786bc091866e068d151c32264c688e0ebee1cba7f88de369e56600000000005f68af62c344", 0x30}], 0x2) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000010b80)) 23.660275224s ago: executing program 0 (id=980): r0 = openat$fault_inject(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/fail_iommufd/probability\x00', 0x1, 0x0) ioctl$BTRFS_IOC_SYNC(r0, 0x9408, 0x0) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000000) (async) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x89800) r2 = openat(r1, &(0x7f0000000080)='./file0\x00', 0x48000, 0x80) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r2, 0xc080661a, &(0x7f00000000c0)={@id={0x2, 0x0, @d}}) (async) write$P9_RRENAMEAT(r1, &(0x7f0000000140)={0x7, 0x4b, 0x1}, 0x7) (async) r3 = openat$cgroup_ro(r1, &(0x7f0000000180)='cgroup.stat\x00', 0x0, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r3, 0x1, &(0x7f00000001c0)={0x24, r0}, 0x0) (async) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000000200)={0x2, {0x2, 0x5, 0x9, 0x7, 0x6}}) (async) sendto$inet(0xffffffffffffffff, &(0x7f0000000240)="8eea5156d5966adb51cb4d782293672be4498a24cbb087ec35c53a6b694f9521a319e104767dfbb96488b71eb9bc6f7c935612cee83a7448fa17939fb1870b25c5ea55914471cb7a06b0101d64e4a843b311f214fd9be6d26f26e0b4e7bcf34af4b1e6cc77bbae9212e78d0b404da5b7b0724544d0777ae443a92a1ca82a5593b002ef024ad40d3e7857b99645815258acdada4733b570936320322ecfa36ee92f9ae60dfafbb980d9f490da6195ae09e5f779de6f06800a2b2e00c3b0237fc912d8311c187a8fec26043b980d423c2f8b73e927d87ce430c06a35684c2f2e03f1b58aa28c544324f1d9278ac99933f3743ca42af8da092911914985f4ba000efde8ab1bfee6bcbc681b47a4d1064d078d6232bff5ab958cd14fc41872695290759673ccda9f9b0b2cda77b3af16986ebf25ab87a9a75a6e8c6b56c666cda34953f1ae45ab2325ce612e57b1fd6c3b8b3e35050b43e9ad6156bad50059bab54144fd3f05f8c6d399a694c374d8b8e0f39a3b3fc89809bdf72bebe880a0f1b4c7de3b7995a354bd579f56f0d07b62774fc81815c5bea17c67476b5a5b1b349e57a102714ebe3faf21645b00de4a71927add00dfd918ebfb361153d49b059068a719713c00cf4fe51a7e982aad5a5e6a10454df86dfda0c239b42a6b80eea8b0b11758db69fa9e9f38725ecaba897124b27aadd5aacf9b8a4b352e8a8ab21fb0e07b98657aea59f38d35c73b320a422ed851cd2e27cb87d18ac497ce7aeed71ff14bc9ed6ee4033c9cbe46d5a6a5e0b544bda0cc3419f50706506de1e8a9de9ba82ebc9482a5854d72b91b14d14abf76fcd8e63bdd2694d7ec5d05ac8c2c90efca768f8bdba2adc5ff2da433f894c1e69a8bce210bb680b3085fe1ff2cc36eda830c7b40b54693c2217fe20aa13d0f6e471df10961cf189cb86e33f5a25787873d3a1ea959378a1c82185788be3fc378516993166ee9a5111f474410e89a3dbc862cc3cc5795c77d0e1e9f5f14e9aa47191a5eb50c78493328c3a8b4d2d7aff11a13344f43420bde3b916dc0b00241015d8cf29f0e1e6b310359a48d9a5ef85b534d61bad0a5891b6340c608eb20602995d7f477d4816b631ebb358bec568a0c40b083ea47a25a73f88eff30dbbc2a06aa6535f1c6eac834fd06f3ae22d5d3e3a7fa474358895c19f9df77f8aa81ddd10fe5d3e68c5dafaf5f0403a1098b4bce74e5840139c3e2513f07a4a97d9379987c2ca94f81873739964ff1bca661e7525b31fe9afcaa528be0e3d694af425cdd99a9b803e95ca1024e8dd6a9706fe059c239cc36b585f5e6fee6c6e5f30f9213c6723f2aed42e4eb723ded58e179f505bc4fa9990f35bc3eb8b30bb9e9a07b3057c26b8c656053bea9f9072000069d72265493f3596135a0d37eb4792f354efeba3228fa0ee5be7326a6ecc9dbe5a099a25ffd405e4ece8c955e5a83d70bf07238532d3bd2bba0bf2cb614610d7b8807420714f546246685e2b6e6e2e64ac09b528ea9f0e8e764942823fa801f836ddc1e02409eec648a01a65cd1ae3893f9865e55cff112f313a84e276902aaca32bd4da84b4dd1e5503ce4264036ac4cba231f4213accdc1956d15d7d51e9855b26be3461a173385c3d3f8dc24976286172b0ffcfd33b4f1b258dc4dc4be3e8ddd040b563d3aa96faa13bc6aa2a7f32fe6dd31a874a95d4a5ce2440392531184fe5c8a56fe1acc9a07e3181771e6eca35f90908a71b4508fe8c59e99b3377c577aff3cd30221d2f923753e8c03a95d0f75e48f185ef5c371feed0f067456d0b7bd8c39d8dc81329801418b7e2eaa099e5ef20235766c2a0360edd4da6f421e15c8779ffc2084d19939aedecc16284ab8c3a222a0bc216d90578e488b6ab9ba953cdbae87deec33f3c69f2696e3ab826085cb6910a24ebd57968d5a4be96b0d30ef4dd3c00f9f979b0e77e8143054220af3c795422020ce3c496ff819b22c8c3658fbd3a32c5b4e28358efb1507b1dbc35b5dd01837e002fcb9c1daec8b466c356abf26573f56bc100bab3753456e401b5fedeade3cca98581e0918bf0cab323efd5ac2b6aaae6d409c9ce9e8ac10e68b1c7a8933a57fa203d49e3209d41748d3f5bac18f256e5ea21bc8a9742e627ad93514a8f5d7ec7e73fb7202143573183e68371d5c4e147ab957fcd3d5ec676563cb83fe7902c9c41684747e79d61023fea31a42abcf85a1e74218a0df9358e39a45203a0b8886e52458e2a8e5ec162fe72aeaf6b5941582a3302b0cfc049aee0994f60ed782ecd2f167ed45125fbe9022fa272b6751019d8be42cecb4cfc177fda327a100fbe15b385b3b2efc763dd0aa1235cea937664434c12b26defc98774cd1ab897d931443b2bc5db1f695273449a07a6010b623448dfd601dac9ac3da66bcc914f6495249d0b85ad2a055ef3872d9ac95352c0eb0e895023058f5b8f7ec621d9cd662776f02adb273bf07456599f6ffc0a34bd80566d6cc7a57a1369d5fff05b6bfc2d96010faf7166d336cf058de416be62f805b2987b7dca4bb28a3fe1b9ae09105ab5ed69b9bff6628fdeb63c055d9fd94cf64ccfa9c8bef5fc2b3838e34a5b3601f1489ace0b2531610b05e9982f33d2c5b7f0999966eac8e4926a4ccb90254aa5887809140328152d552ab95cdcfea59b485d333f26b74bd685dee15fd5da1d37b05fd78b8065bf7eed640754224c285cc7b94e739074425c0f5934c34d68bcba5f79cc30ab69098b72eb3288033676ac7080a52e2f494a11887ba14098b025f747bdb1a58ac0618a8f4c9b48f892396e1ed5848a16e03f578f92c3a6eeeb555fb4bf9588d1ce38482ee50e835c0c831b09fa490a9c77b70e308c1f6c617f7834dd5bf27b1b9069e0e6c081f265cf6157fea6bbc324b5bdc74884f45c820a8b1c7d97933a076e950ee67a058dd508a4072ecfa738584ac760f8807de4a887e7c36d2386a2da65f06a796a93d50c3cb21bec130525655e0b691e9e5734277ca29abcf7a7b9caba41fa6878fdbe91651692411df7d64151ee8b8391d2f9346d2b41dcb0947b16c4184e067010957a92c2674634715199899b4da881b60b04dad486bf1d3778f1ff45b54a7207d43e96aa14e4928c7d006bb2b86c0c2aa3657b5543cb970f798f55453313b82e14071dc03fcff5f07070d7cc78fa598f155908505f1194894769de440c5220b610918261c99300c247e6c197cfccfc0fc71b354dd74635c02419f5da2a52ca83c56d7ce1bc8dbd31f445d54c9797428d2341ca6485f50a3c58fd3a14b15e761fcdbfd4cb661b06e7c64f86ca147dbc9bef5b3b202af7499ace7448bf1dba87e079eedd457829ca905e5844796a40796aef41085a581cfbc2768c3894da7e9c726de29a74b85d55732584166ccc2a5a329bb7b1bfcc7fbad7a7ccb3e1bd41cfa730890daa118eac6a6d2a1cb043863f635ae0b094b3bfe1028c76dafaa6439229e54ed7a09c7758a6ae63bae3d81f973da7f9894c228cfda68fa5159917d3255907a21b06ada0fec63620cb2bcb020507f3ee1445808f978180d62046a9ecf1bdb15171651818601829cbbc2a536586f3f3795e3cc1435f317db0f04d0abb0f7402fd91d1be67eb63ff6d640752a5f41b1c759364397a3f52bcc4b75fcbe4228b85b58b28735b798443492c819454122cfea915348025a09fc98477dee9097c3ff7ebee463a15405427462b56ff99d9f451f9670222d41c35bbfeb225502ad27bc0bea25058fed8cee73c4a0fed5f62e904686da6f25fe08f7a94191553463fe807a46bb8de8c26e32ff29414da4dbfa44fc870d11745154f34c32a7739ae1a146f87a2cc80d6b50667ea82340934aac64151e1726d842f126158a5b54c510d55df0d001b8d4074c3f7d183911ca9b61e9d74cd5ce36e3569dcfa3919324b22aa7286a07b9bc500f91b0a717dff3b930cb29c360824254fd91a29017174d57d6b329a23732153cfdc31d973a8b906e5b2d97e52d59d456754e344a2971b0ad418222a45d3242f6aafc39481305a257347e48e15da4a17e4b0fe119d38e3c51a32ce711aeed780e7f8769b2c479bd509334b2d39b59c6fe5647e1d1055a9ca1d9f61cedb239fd006008b813b59bca2b7f5bd8b132845532b21bc2140fb5e536f30a8e933d3b20937b6df015e3d930fe21f3342d486b02826f55778b1a1df623e29831d0df90ad1e57397794c84c7b318f95567e1fae97c993b92907f5ca295b718a8dbd6a9cfc307449687b561efa683a91d90bcdc9b48282c90abb340d2ec40e6a7ab2eeeeb8fc8a293e9aa7c9f71ae7d9b232b642b7cc79d7ff5f517b18155784b9a4cc28f7cdbee3cc50cd9811c131564bbd655f01f0a4f7147728b8bde5fed54f47500769c0b9d75be707da92002c7f6367fd662cbb0eb85f3eb3b1d5bd324a965f33df2aa201e7caa4be0ae7ac91dbc1cbddc2226b265b966d826f2ab590c30dd0ef82d77d3d4d1e214730bade53a04f523149dcf32c2d542e0f74def2e3dbb38b39683cee76e6ad8a2d55f70806de9be1db3f95299014b56e047370f4fda0b11891eabf08c4e4b82dfa14ba9568012ea2f20cd1717916259ae9cbfaa2ed9b807c83af9b23b8067dca05cac158ebb811672c8f9b05281d8bf9d18b81f8e9b5d79599b68c23b582f24c09d9e928090af188c362400cf0d75ce60e42aa9861e053dffac3ae0832f77f229fe5c6c47a6da3d0caa56ae8f4d36d28a593a9e61e21274c763a674e2f21104e88f2541fcfd622241686ebc05e887aec7a2c8dbca855ea6b20b9b63b4dbf5f761da76b05895b0df6e176332733a478e1bc0b61bd5fba7df8fdf3fe202f43f2d1f913dd85e328a83b29c4d94ccb72984793f7ddfb607645ac85734086ef65766833b1cb13702cbc112fdae788fd58ff81196aa69a34eeef49ce534e14b0f9c679e8c2c40429b0744d7258e81650a6b6be8797b6948b85efe1dcef0d327a312ada35b3f679fdc64cb301d9e14e3f7a1b8d7feb01b4627a4b4fa24d23167219336ed20189a3ec1de220009c38fb792d0d0d6afffcccc03bdbd11871819846676b243389733a2eb85f728e918c42c15cff74edc841374f072a0e6dc7d5df325c4fc4469ffbe478f82df5152abce9173add455cb7b7638949881113ce8375e99d2322b6714774955b87a1aed8852f134c1eb1f236bcc38943ffd91ed943f20b00f4467acdcc9214aa77e258ffe3a21844ba1a89b7f9dc5b3270f8429384932426599f2226f80a7bc3dd4213b12f4f3f4fa3291a086ffd5d068bf0f05a7ce870c8fcbe8b00163775f6b9cd0cf1bf7470476749e9127755c7378063d049d525636ec7fdee42750934dbd8202ab8e2395fce5f394e14a6d955b051851b3dc75834ed0549e277f30792fe5b278f3876b42b278737e243f687439d36730ac0a5fde0325a0822259565ceefdecddee9e2faaf6b0254ef2d2b61d5ae35e3222ab545493e26053faf212def616f579e08ccfefcbd562150c898e5994f8dc6aca14d716c0a86e71e45dfc16e7bd14c7454da734c46843265600aa855e93b81645ce0b727926fbd96b9fa37312c14ca7e88c237c6782899d924b4ebb33cf7ee1dbf4d13c42892430dded6c8b27d56867f2e53e31c9e13d3ccafe3a15f662efefcc9ed7c0e9ec6c0d0860df9586bfd6d662482b08de8aab8caecbe75f1f3efb7c10a11efb86218605cc6985a7d7072aa27a996a097fbb55bf5cc3dd5807a885d946a3fd29ed53793eb1927170612c1815f02c5c4b0346e1eb3881228f582482a", 0x1000, 0x88c1, 0x0, 0x0) (async) ioctl$FITHAW(r1, 0xc0045878) (async) getpeername$unix(r1, &(0x7f0000001240), &(0x7f00000012c0)=0x6e) ioctl$VHOST_VDPA_GET_AS_NUM(r3, 0x8004af7a, &(0x7f0000001300)) r4 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000001340), 0x606043, 0x0) (async) writev(r3, &(0x7f00000016c0)=[{&(0x7f0000001380)="17f1e71b11a0fc494de9bdf5ec21dbb86ab7bcd99b3961b45bc913f19ea11426075d86d8f04a3f5c3b81915467f494163d6f39d5082ce4e0310c18d9a9644da26deffac54160113b8f6a5403a43d813fc1c945132478fde707dcd781f900c92c4fb8f78d49973c58451b47a9168db0812e2486977ed22069d6", 0x79}, {&(0x7f0000001400)="ac2a33727da21755a3f38cee69b53dac3cbac7f19bd881eed6b9995ebd9b0fc4b97e2242ff519b5a17851e9202b2dbdceb358dadf2f91ec9bf871eaf50541b3b52bd6e153a8a8271fc1056b81abbf1a0183a636b94df2414e2eefcc3defb72a0247a2a8c13954cafbffcda78a77d74835cace1c4adae1de448f7820263404b1b764a659e680f6d1960af2138ef7a4f08e27ef9f9813a167c80e090db172bd29fef9c8cdd0d", 0xa5}, {&(0x7f00000014c0)="3a71e896977ef4c836e7e03a2b460ca805e0acaeb3d98a5d5264b2eb378d37d1baa17c71a7ddae664b156fd4898c34da87afdce28803be2f77f1830572272a4fbc796138686c39b739209338eae671f1c47bc45022c3a409e1dc06d91b08483a83320e1757f30704b87152c6b68b80ee1d5571e374e9e3908f5859dac46788648f351fc85cb964fc40c81de803cfd7a95370f01bff68d65d8c781e3766bde5dc3fb17b0d67115e2d2a0b20877696501acc7a81c86242658741af3619c689ab62ea626884207365b273c350621ffeae74c6c60e9bfa078039480ce14fe361362f0d3e79ca2cde1e98", 0xe8}, {&(0x7f00000015c0)="060e62b6b53898660de0bb6c25fe8614e9db2012d09d6b9d6195d516eefc1b75d31615418c1161934acd54816cbdf64cabe01c87702cac1c5dc1589b", 0x3c}, {&(0x7f0000001600)="94de155a67a356bc1dec000bc24c2dea8f87c670a7467a83f829cc45f8ab5053a9edbd2e00c5881d2ebd027b5ed8584e479a9571be623c04d7ffd1b4180cfd76f3434854dd51676713402470cdb1690613c0b5b151c24e2e91004ec8ed87cd10981aa3097bacdd8d1d27", 0x6a}, {&(0x7f0000001680)="5efd0af56ca1fa5d214090c835374711eceb3dfa4c5bec5463af5f1b51551eb60b575d7e9d2a8decf30d5968ea7da0eea14108a1d1f14878811b83", 0x3b}], 0x6) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) pipe2$9p(&(0x7f0000001740)={0xffffffffffffffff, 0xffffffffffffffff}, 0x880) write$P9_RREMOVE(r5, &(0x7f0000001780)={0x7, 0x7b, 0x1}, 0x7) (async) pipe(&(0x7f00000017c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat(r6, &(0x7f0000001800)='./file1\x00', 0x109802, 0x61) (async) close(r6) (async) mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4058587a, &(0x7f0000001a00)={{r4, &(0x7f0000001840)='~\xb8\n\xf3\xf2N\xf0\x86rjL\xea:\x15L\xe0', 0x200402, &(0x7f0000001880)={@align=0x4, {0x2, 0x9, 0x0, 0x6}}, 0x3, &(0x7f00000018c0)={@_ha_fsid}, &(0x7f0000001900)=0x10000}, {[0x6, 0xff, 0x10000, 0x2]}, 0x2, 0x85, &(0x7f0000001940)=""/133}) getsockopt$inet_sctp6_SCTP_REMOTE_UDP_ENCAPS_PORT(r2, 0x84, 0x84, &(0x7f0000001a80)={0x1, @in={{0x2, 0x4e21, @empty}}, 0x4e20}, &(0x7f0000001b40)=0x90) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r8, 0x84, 0x76, &(0x7f0000001b80)={r9, 0x4}, 0x8) ioctl$VHOST_NET_SET_BACKEND(r7, 0x4008af30, &(0x7f0000001bc0)={0x3, r7}) add_key$user(&(0x7f0000001c00), &(0x7f0000001c40)={'syz', 0x0}, &(0x7f0000001c80)="3370e58d0c20912ede6aa8323a55da7d75447c7639af0de1aba12d4757b3c42d599d3496", 0x24, 0xfffffffffffffffc) (async) r10 = syz_open_dev$vcsu(&(0x7f0000001cc0), 0x7, 0x202800) syz_kvm_setup_syzos_vm$x86(r10, &(0x7f0000c00000/0x400000)=nil) 23.59937124s ago: executing program 0 (id=982): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='.\x00', 0x0, 0x0) fcntl$notify(r2, 0x402, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./sys\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r3, &(0x7f0000000340)="70302cf844d1e41f3cc2b514cfcd7838303052304d692c00", 0x18) (async) r4 = dup(r1) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) (async) write$tun(r0, &(0x7f00000001c0)={@val={0x0, 0x4}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x26, 0x68, 0x0, 0x3, 0x2f, 0x0, @private=0x1fe1, @multicast1}, {0xa000, 0x6558, 0x12, 0x0, @gue={{0x1, 0x0, 0x0, 0x9, 0x0, @void}, "a09c171a5cef"}}}}}}}, 0x38) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/uprobe_events\x00', 0x601, 0xd) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a01040000000000000000070000000900010073797a300000000040000000030a01040000000000000000070000000900010073797a30000000000900030073797a300000000014000480080001400000000408000240ffffff3854000000060a01040000000000000000070000000900010073797a30000000000900020073797a30000000002800048024000180090001006d65746100000000140002800800014000000001080002"], 0xdc}}, 0x0) 23.420469518s ago: executing program 0 (id=985): r0 = io_uring_setup(0x4a86, &(0x7f0000000280)={0x0, 0x4178, 0x40, 0x8001002, 0x3d7}) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x50c}) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg$inet(r2, &(0x7f0000000000)=[{{&(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) r3 = landlock_create_ruleset(&(0x7f0000003480)={0x10, 0x0, 0x3}, 0x18, 0x0) landlock_restrict_self(r3, 0x1f) ioctl$OCFS2_IOC_UNRESVSP(r2, 0x40305829, &(0x7f0000000080)={0x2, 0x2, 0xcf, 0x1, 0x9}) io_setup(0x2ae1, &(0x7f0000000340)) (async) io_setup(0x2ae1, &(0x7f0000000340)=0x0) r5 = eventfd2(0xfff9, 0x801) io_submit(r4, 0x1, &(0x7f0000000380)=[&(0x7f00000003c0)={0x0, 0x0, 0x0, 0x7, 0x4fff, r0, &(0x7f0000003600)="20520fdd26bf4a7ce6cdcbc4af39000000000000b4f10500a30113796bf1e07088e49fed50aa030b448cf347cb531391de5dcbcd3efab20f46b599d48f472867e5942272132a2c55eaa4e2575aa4359a3f6d5b5bcd84a0a8af99ca99395babd68f9061e62fafda81d2253fc4aef40d15762da9c4558848c821b571887f761ba955c5e51f0981bf5cccd1cd9236389618b81e34e5eaf0f0f8921df9142f1d52", 0xffee, 0x1, 0x0, 0x3, r5}]) (async) io_submit(r4, 0x1, &(0x7f0000000380)=[&(0x7f00000003c0)={0x0, 0x0, 0x0, 0x7, 0x4fff, r0, &(0x7f0000003600)="20520fdd26bf4a7ce6cdcbc4af39000000000000b4f10500a30113796bf1e07088e49fed50aa030b448cf347cb531391de5dcbcd3efab20f46b599d48f472867e5942272132a2c55eaa4e2575aa4359a3f6d5b5bcd84a0a8af99ca99395babd68f9061e62fafda81d2253fc4aef40d15762da9c4558848c821b571887f761ba955c5e51f0981bf5cccd1cd9236389618b81e34e5eaf0f0f8921df9142f1d52", 0xffee, 0x1, 0x0, 0x3, r5}]) socket$inet_udp(0x2, 0x2, 0x0) (async) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x41, &(0x7f00000000c0)=0x40, 0x4) (async) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x41, &(0x7f00000000c0)=0x40, 0x4) connect$inet(r6, &(0x7f0000000140)={0x2, 0x0, @multicast1}, 0x10) newfstatat(0xffffffffffffff9c, 0x0, &(0x7f00000034c0), 0x1000) (async) newfstatat(0xffffffffffffff9c, 0x0, &(0x7f00000034c0)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000) setresuid(r7, r7, 0x0) (async) setresuid(r7, r7, 0x0) setreuid(r7, 0x0) (async) setreuid(r7, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f00000001c0)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000400)={0x1f, 0xffff, 0x3}, 0x6) write(r8, &(0x7f0000003540)="1b00000008001122334455660014", 0xe) openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/bonding/bond0\x00', 0x0, 0x0) (async) r9 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/bonding/bond0\x00', 0x0, 0x0) read(r9, &(0x7f0000000440)=""/4096, 0x1000) read$FUSE(r9, &(0x7f0000001440)={0x2020}, 0x2020) sendmmsg(r6, &(0x7f0000000180), 0x800001d, 0x300) setsockopt$inet_int(r6, 0x0, 0x14, 0x0, 0x0) recvmmsg(r6, &(0x7f00000001c0), 0x291962b, 0x45833af92e4b39ff, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 23.243837372s ago: executing program 0 (id=990): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001540)='./sys\x00', &(0x7f0000001580)='sysfs\x00', 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001640), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_MPATH(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010300000000000000001500000008000300", @ANYRES32=r2, @ANYRES16=r1], 0x1c}}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000015c0)='./sys/class/net/syz_tun/gro_flush_timeout\x00', 0x1, 0x0) write(r3, &(0x7f0000001600)='2_', 0x2) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r5 = syz_io_uring_setup(0x7729, &(0x7f00000002c0)={0x0, 0x2715, 0x10100, 0x3, 0xc001bf}, 0x0, 0x0, 0x0) setregid(0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x0, 0x2}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0xdabc3000) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x19) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_PTRACER(0x59616d61, r8) prctl$PR_SET_PTRACER(0x59616d61, r8) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000005430765d404000000fedbdf250200004c0000000000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x2400c040}, 0x20) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0xc4, 0x0, &(0x7f0000001a80)=[@reply={0x40406301, {0x1, 0x0, 0x3, 0x1, 0x71, 0x0, 0x0, 0x68, 0x18, &(0x7f00000019c0)={@ptr={0x70742a85, 0x0, &(0x7f0000001880)=[0xffffffffffffffff, 0xffffffffffffffff, r7, r0, 0xffffffffffffffff, r7, r3, r0], 0x20}, @child_ptr={0x70742a85, 0x1, &(0x7f0000001900)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0xc, 0xfffffffffffffffc, 0x8}, @fd}, &(0x7f0000001a40)={0x0, 0x28, 0x50}}}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f00000017c0)={@flat=@binder={0x73622a85, 0x0, 0x2, 0x3}, @child_ptr={0x70742a85, 0x1, &(0x7f0000000240)=[r6, r5, r3], 0xc, 0x0, 0x18}, @child_ptr={0x70742a85, 0x1, &(0x7f0000001780)=[r4, r7, r6, r0, r5, 0xffffffffffffffff, r4, r7, 0xffffffffffffffff], 0x24, 0x0, 0x10}}, &(0x7f0000001840)={0x0, 0x18, 0x40}}, 0x400}, @increfs, @register_looper, @acquire_done={0x40106309, 0x2, 0x2}, @increfs_done={0x40106308, 0x3, 0x3}]}) r9 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0), 0x1110c0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000340)='./sys\x00', &(0x7f0000001400)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000) fstat(0xffffffffffffffff, &(0x7f0000001940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r9, 0xc018937b, &(0x7f0000001480)={{0x1, 0x1, 0x18, r4, {r10, r11}}, './file0\x00'}) openat$kvm(0xffffffffffffff9c, &(0x7f00000014c0), 0x101100, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) 23.069355986s ago: executing program 0 (id=994): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x34, 0x0, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_OURS={0x8, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x34}}, 0x0) mkdir(&(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x1) write(r1, &(0x7f0000000240)='0', 0x1) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32, @ANYBLOB="01000000010000001c0012000c000100"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x34, 0x0, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_OURS={0x8, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x34}}, 0x0) (async) mkdir(&(0x7f0000000080)='./config\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x1) (async) write(r1, &(0x7f0000000240)='0', 0x1) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32, @ANYBLOB="01000000010000001c0012000c000100"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) (async) 7.546704231s ago: executing program 32 (id=994): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x34, 0x0, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_OURS={0x8, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x34}}, 0x0) mkdir(&(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x1) write(r1, &(0x7f0000000240)='0', 0x1) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32, @ANYBLOB="01000000010000001c0012000c000100"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x34, 0x0, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_OURS={0x8, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x34}}, 0x0) (async) mkdir(&(0x7f0000000080)='./config\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x1) (async) write(r1, &(0x7f0000000240)='0', 0x1) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32, @ANYBLOB="01000000010000001c0012000c000100"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) (async) 1.756116741s ago: executing program 3 (id=1243): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000040)={0x34, 0x41, 0x1, 0x7fffc, 0x4, {0x1}, [@nested={0x4, 0x48}, @nested={0x14, 0x1, 0x0, 0x1, [@nested={0x10, 0x10, 0x0, 0x1, [@nested={0xc, 0xb, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @ipv4=@multicast2}]}]}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd=r0}]}, 0x34}, 0x1, 0x0, 0x0, 0x404c005}, 0x4008094) 1.680331144s ago: executing program 3 (id=1245): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000000)=0x8, 0x4) fsetxattr$security_capability(r0, &(0x7f0000000080), &(0x7f00000000c0)=@v2={0x2000000, [{0xe7, 0x10001}, {0x7, 0xafe}]}, 0x14, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) 1.619163468s ago: executing program 3 (id=1246): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f0000000100)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) chdir(&(0x7f00000001c0)='./file0\x00') r1 = open(&(0x7f0000000200)='./bus\x00', 0x1c527e, 0x11b) r2 = open(&(0x7f0000000240)='./cgroup.cpu/cpuset.cpus\x00', 0x1a1342, 0x0) fallocate(r1, 0x0, 0x0, 0x1000f4) sendfile(r1, r1, 0x0, 0x40000000800) ioctl$XFS_IOC_OPEN_BY_HANDLE(0xffffffffffffffff, 0xc038586b, 0x0) sendfile(r2, r1, 0x0, 0x7ffff000) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000540)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000600)={0x2, 0x0, @ioapic={0x1ffe, 0x2, 0x10004, 0xfffffffe, 0x0, [{0x2, 0x1, 0x87, '\x00', 0x8}, {0xb, 0x8, 0x40, '\x00', 0x3}, {0xff, 0x7f, 0xd3, '\x00', 0x68}, {0x0, 0x9, 0xf5, '\x00', 0xf}, {0x7, 0x5, 0x6}, {0x0, 0x3, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7b}, {0x3, 0x3, 0xc}, {0x7f, 0x5, 0xb, '\x00', 0x7}, {0xbc, 0xd, 0xa, '\x00', 0x6}, {0x0, 0x3, 0x7c, '\x00', 0xdc}, {0xff, 0x1, 0xfe, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xcf, 0x3, 0x1, '\x00', 0xa}, {0xf, 0xee, 0x7, '\x00', 0x3}, {0x39, 0x6, 0x6, '\x00', 0xb}, {0x9, 0x6, 0x4, '\x00', 0x8}, {0x5, 0xc, 0x4, '\x00', 0xd}, {0x7, 0xe1, 0x7, '\x00', 0xc2}, {0x0, 0x83, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x6}, {0x10, 0x1, 0x3, '\x00', 0x10}, {0xd, 0x23, 0xf3, '\x00', 0x4}, {0x0, 0x6, 0x4}]}}) 1.160619016s ago: executing program 2 (id=1260): socketpair$unix(0x1, 0x2, 0x0, 0x0) setns(0xc9, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000040)=0x4f4e, 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x34, 0x13, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x24000810}, 0x4000010) (async) sendmsg$NFT_MSG_GETOBJ(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x34, 0x13, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x24000810}, 0x4000010) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f00000000c0), 0x800001d, 0x0) ioctl$AUTOFS_IOC_PROTOVER(r1, 0x80049363, &(0x7f0000000380)) (async) ioctl$AUTOFS_IOC_PROTOVER(r1, 0x80049363, &(0x7f0000000380)) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000003b00010300b100000009000001"], 0x14}}, 0x0) (async) sendmsg$nl_generic(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000003b00010300b100000009000001"], 0x14}}, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r2) r3 = getpgid(0x0) fcntl$lock(r1, 0x26, &(0x7f0000000340)={0x2, 0x0, 0x3, 0x5922, r3}) (async) fcntl$lock(r1, 0x26, &(0x7f0000000340)={0x2, 0x0, 0x3, 0x5922, r3}) sendmsg$NL80211_CMD_GET_SCAN(r2, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, 0x0, 0x2, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, ["", "", "", ""]}, 0x1c}}, 0x800) 1.16033733s ago: executing program 2 (id=1261): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x8000}, 0x50) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c040, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000002480)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, &(0x7f0000000040), 0xfffffffffffffeff}, 0x0) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000040), 0x4) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000080)='tmpfs\x00', 0x24002, &(0x7f00000001c0)='\x01') 1.080374587s ago: executing program 2 (id=1262): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffff9c, &(0x7f0000000000), 0x8000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="40030000000037040000000000000000000000002c1633d2bbed71b1768cb746416f20a2eb8cbfec2773de22487663a56a5f1377485b4d9cea9f2275c353f2e01a9b1c2facb34ba8d7cfdaa2036baf1174a0c873a89ce9f4c5", @ANYRES32=0x0, @ANYBLOB="0001040000000000200012800800010067747000140002800500050000000000080007000a010102"], 0x40}}, 0x50) r5 = syz_ublk_setup_io_uring(0x1b1d, &(0x7f0000000200)={0x0, 0x1c3f, 0x10000, 0x2, 0x2bf}, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f0000000300)) mmap$IORING_OFF_CQ_RING(0x0, 0x782, 0x1000002, 0x12, r5, 0x8000000) r6 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r6, &(0x7f0000000340)={0x27, 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1a}, 0x60) getsockopt$nfc_llcp(r6, 0x118, 0x0, &(0x7f00000003c0)=""/203, 0xcb) ioctl$KVM_GET_MSRS_cpu(r3, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x400000f3, 0x0, 0x9}]}) r7 = syz_genetlink_get_family_id$batadv(&(0x7f00000009c0), r0) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a80)={0x14, r7, 0x331, 0x70bd28, 0x25dfdbfb, {0xb}}, 0x14}, 0x1, 0x0, 0x0, 0x2004c0c1}, 0x20000000) 958.31802ms ago: executing program 2 (id=1263): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000001c0)=@nat={'nat\x00', 0x19, 0x1, 0x21e, [0x200000002300, 0x0, 0x0, 0x2000000024be, 0x2000000024ee], 0x20, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000050000006b0000000016636169663000000000000000e3ff00007665746831000000000000000000000073797a5f74756e0039da0000f8ff0000000076657468310000000000000000001000aaaaaaaaaa3d000000ff00000180c2000003ff00ffffff00ae000000560100008e0100006f776e6572000000000000000000000000000000000000000000000000000000180000000000", @ANYRES32, @ANYRES32, @ANYRES32=0xee00, @ANYRES32, @ANYBLOB="02040000000000004e464c4f4700000000000000000000000000000000000000000000000000000050000000000000000100000007000300000000005cae641872319dfae5a988272763a36abcf1f74cfd4bf988531a30a528c1c044813d8205fd8b1fdf1c2ccd79b5fb7f9e096fbd1c7eeee4b6646c0b2fc39d3fe20000000072656469726563740000000000000000000000000000000000000000000000000800000000000000feffffff00000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000ffffffffffff0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x296) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="5d060000100081044e81f782db56b904021d006a0f000000e8fe55a1290015000600142603600e1209000400440000ffffffff00000000402e60000000000000b94dcf5c0453c53d8d6f94007134cf6ee08000a0e408e8d8ef52a985162f7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d3220a7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad9562d2fec2205a8e6044174166d67e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef", 0xd8}], 0x1, 0x0, 0xfffffffffffffd2e}, 0x60044084) 955.217766ms ago: executing program 2 (id=1264): write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0xfffffffffffffffe, 0x0, {0x7, 0x1f, 0x4, 0xffffffffdf350f4e, 0x200, 0x5, 0x200, 0xffeffffa, 0x0, 0x0, 0x2, 0x800}}, 0x50) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000c00000/0x400000)=nil) socket$inet_sctp(0x2, 0x5, 0x84) (async) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 32) r5 = gettid() (rerun: 32) timer_create(0x2, &(0x7f00000001c0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000000200)) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) clock_nanosleep(0x2, 0x0, &(0x7f0000000280)={0x0, 0x989680}, 0x0) (async) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000002c0)={[0x100, 0x0, 0x30a30b42, 0x6, 0x1000, 0x2, 0x208000000001002, 0xfffffffffffffffc, 0x4, 0x80, 0x9, 0x2372, 0x8bd6, 0x4, 0x7f, 0x20], 0x26000, 0x216146}) (async) ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text32={0x20, 0x0}], 0x1, 0x9, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000000c0)={[0x224, 0x1, 0x80000000000008, 0x38010000000000, 0x5, 0x6, 0x4000000004, 0xf0, 0x1, 0x4000000000010, 0xffff, 0x6, 0x1, 0x103, 0xb08, 0xfff], 0x0, 0x80}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 760.034187ms ago: executing program 1 (id=1265): setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEAUTHENTICATE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="f30023bd7000fddbdf2527000000", @ANYRES32=r2, @ANYBLOB="0a0006005050505050500000060036000100000004005f"], 0x34}}, 0x20000004) 758.817309ms ago: executing program 1 (id=1267): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x80000001, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xa, 0x1c, &(0x7f0000000640)=ANY=[@ANYBLOB="18080000000000800000000000000000182a0000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bc0900000000000035090100000000009500000000000000b7020000000000007b9af8ff00000000b5090b00000000007baaf0ff00000000bf8700000000000007080000fffdffffbca4000000000000a7040000f0ffffff740200001d00000018290000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000cf4900000000000056070000000000008500000000010000b70000000000000095"], &(0x7f0000000740)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x2e, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) 709.062906ms ago: executing program 2 (id=1269): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000200), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000140)=0x2000) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newlink={0x44, 0x10, 0x409, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8, 0x3, 0x1000}, @IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x6a21}]}}}]}, 0x44}}, 0x0) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000000064101"], 0x14}}, 0x40) (async) recvfrom(r1, &(0x7f0000000100), 0x0, 0x40000000, 0x0, 0x0) (async, rerun: 32) ppoll(&(0x7f0000000040)=[{r0, 0x20}], 0x1, 0x0, 0x0, 0x0) (rerun: 32) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f00000002c0)=0x1) read$dsp(r0, &(0x7f0000000180)=""/67, 0x43) 708.341199ms ago: executing program 1 (id=1270): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x2, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mq_open(0x0, 0x42, 0x54, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000080)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f00009ef000/0x3000)=nil, 0x3000, 0x65) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/test\x00', 0x777) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) r2 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r2, 0x0, 0x2400c804) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f0000000400), 0x0, &(0x7f0000000440)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000480)='./file0/file1\x00', 0x20400, 0x20) setxattr$security_capability(&(0x7f00000004c0)='./file0/file1\x00', &(0x7f0000000500), 0x0, 0x0, 0x1) fdatasync(r3) close(0x3) bpf$BPF_PROG_DETACH(0x1c, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="2c0000006800010003001000fdffff7f00000000000000000c0002000100000a15000000080010"], 0x2c}, 0x1, 0x0, 0x0, 0x4008018}, 0x4004080) write(r1, &(0x7f0000000240)='0', 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@arena={0x21, 0x0, 0x0, 0x34, 0x60400, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x2, 0x4}, 0x50) connect$netlink(r0, &(0x7f0000000300)=@kern={0x10, 0x0, 0x0, 0x1}, 0xc) openat$nvram(0xffffffffffffff9c, 0x0, 0x105b00, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mbind(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x4003, 0x0, 0x44, 0x0) 650.450588ms ago: executing program 3 (id=1271): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x400452c9, &(0x7f0000000140)) r1 = inotify_init() inotify_init() fsetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000200000002000000004000000000000000000000104000000200000000000000000000001"], 0x0, 0x3c, 0x0, 0x0, 0x1}, 0x28) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000680)=0x3) syz_emit_vhci(&(0x7f00000006c0)=ANY=[@ANYBLOB="04ff03"], 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x1, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x79, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f00000007c0), 0x1a01, 0x0) ioctl$EVIOCGPROP(r4, 0x40047438, &(0x7f0000000800)=""/246) writev(r2, &(0x7f0000000900)=[{&(0x7f00000010c0)="da95571f36c59daf33116e5f3e1a6d2cec530dc9b9a511308845c360fb2191feb9569b6e46cce94c8d30502c49eff1b389d7094a18a6f21a44067287c866c49c6d6bbad82f9a0c855bd44ed03289918afbb5aa051f10969b9e13e0aff885f0cfe9fd7534add7fbd08e14b20bafe1191a7ae33e59258c6fba95a3f99fb4aa1378180cece6d0c130e62cc874d91cc2ecd701329cf54434f6084daeeee99fd04b4dd4b6595306ae175df3826e30861b3f6673c077e2218bfca803daabb667155736b6fc23782cdcd2e9a395010f0a14281134149df69178bc5e962b783c11faac80ea6d9d9235b237f2dbbaa4fe5ebd87b6fc3339aa4404bca734f2caad11efc8b90eaf508948e9ea8be2786f7b9edc152871f47542ebab028a8c62f72a0a95edb299ab0f163e7b810b6c9cdac140a550", 0xfffffffffffffdcd}], 0x1) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000280)=0x7, &(0x7f0000000440)=0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffffff, &(0x7f0000000400)='./sys/module/sunrpc/parameters/max_resvport\x00', 0x200801, 0x0) write(r5, &(0x7f00000002c0)='800\x00', 0x3) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000980)=@mangle={'mangle\x00', 0x2, 0x6, 0x598, 0x0, 0x210, 0x3d0, 0x0, 0x2e0, 0x4c8, 0x4c8, 0x4c8, 0x4c8, 0x4c8, 0x6, 0x0, {[{{@ipv6={@mcast1, @dev={0xfe, 0x80, '\x00', 0xb}, [], [], 'pimreg0\x00', 'macvtap0\x00', {}, {0xff}, 0x21}, 0x0, 0xf8, 0x120, 0x0, {0x7a00000010000000}, [@common=@unspec=@cpu={{0x28}, {0x8}}, @inet=@rpfilter={{0x28}, {0x6}}]}, @HL={0x28}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x36}, [0x0, 0xffffffff, 0x0, 0xff], [], 'veth1_macvtap\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@rand_addr=0x64010100, @ipv4=@multicast1, 0x36, 0xe, 0x5}}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0xb96, 0x2}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv4=@multicast2}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5f8) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x1c1842, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000003c0)={'syzkaller0\x00', 0x4801}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x42, 0x0) close(r8) socket$inet_udp(0x2, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000540)={'syzkaller0\x00', @broadcast}) write$cgroup_devices(r7, &(0x7f0000000580)=ANY=[@ANYBLOB="1b23000d"], 0xffdd) r9 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/sunrpc/parameters/max_resvport\x00', 0x1, 0x0) write(r9, &(0x7f0000000340)='900\x00', 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYRESOCT, @ANYRESHEX=r9, @ANYRES64=r1], 0x48) 533.876826ms ago: executing program 1 (id=1274): r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x10083, 0x6, 0x8}, 0x18) r1 = open_tree(r0, &(0x7f0000000080)='./file0\x00', 0x9000) (async) r2 = fsopen(&(0x7f00000000c0)='ocfs2\x00', 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f0000000180)={0x8, 0x120, 0xfa00, {0x0, {0xc2, 0x3, "ac5aedf3a91a6cdd634fbc022a22d87011fb737600914110ea053bc36cb64de4d2994542827fc7170fb7968d8fc3fa96af2119298d7f0d938b8760bafbbd12975c8a9acf840db5ac916de67d25e7f04e2a343d19b726b55b2afff8e63475805de9edd5d69e22d73dd4d8ec9948294a23caa2197f218b4303e62af234b53dac69fa3a5eab74ef02e7d9b03fff20fa5693b882ed26546269249203c21dc6712f89e7f01bd63b997a2c6e9eb40add858b5bc7f1bb77de90edb209272a0e4e907ff8678d490eca1e4a332d0ec24ba6f2ea247137580f818af310506bcc018151436382785b5218eb41926d56003cccc49adffa1634c9bc460a08e732acb06ecd0f0e", 0x8, 0x3, 0x9, 0x80, 0x9, 0x3, 0x4, 0x1}, r3}}, 0x128) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r1, 0x5760, 0x12) (async) r4 = syz_clone3(&(0x7f0000000540)={0x0, &(0x7f00000002c0), &(0x7f0000000300), &(0x7f0000000340), {0x28}, &(0x7f0000000380)=""/98, 0x62, &(0x7f0000000400)=""/223, &(0x7f0000000500)=[0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x9, {r1}}, 0x58) ptrace$setopts(0x4206, r4, 0x2, 0x10004e) (async) ioctl$VIDIOC_G_CTRL(r1, 0xc008561b, &(0x7f00000005c0)={0x3ff, 0x80000001}) (async, rerun: 32) socket$inet_udp(0x2, 0x2, 0x0) (rerun: 32) r5 = syz_open_dev$dvb_frontend(&(0x7f0000000600), 0x46f4, 0x62082) ioctl$FE_GET_INFO(r1, 0x80a86f3d, &(0x7f0000000640)) (async) ioctl$F2FS_IOC_MOVE_RANGE(r5, 0xc020f509, &(0x7f0000000700)={r5, 0x86, 0xa7, 0x2}) read$watch_queue(r6, &(0x7f0000000740)=""/99, 0x63) (async, rerun: 64) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f00000007c0)="ee41bffd46dbfd5de1202b58ed0adc095ebdcd6572bfabaa6c434feaf6f6f6290bd11f898f57ecf4f17c2f3b21de4863ff339019bd6cb7c2fc726fe1de4454154a15199689a9635acdd65558d6a680a11776ecd3bbd068516a5fbda9be9bfc8046a6d5a51e9ede972172ab7e2b308413fe4cc2d3fb611851165d6cbb8e9e1b9619f1d876630743e3be1ea99d9842ab0a65e624d2d6f74669324a9828d023ba516038dbc66372c6d9d75c164ea6d7fd1e56b399c4fe018b3f06f9cc4ba58b235481bac9c45b5438ee72ceb4436bc622607cb7c094067cf2a43c16d37a1ad1ba2e8b8cdace58b7ab241d62abe1fb6075a707b39f85ff20cabd0ea35dfaa369b728") (async, rerun: 64) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x25, &(0x7f00000008c0)=""/180, &(0x7f0000000980)=0xb4) r7 = accept$inet(r6, &(0x7f00000009c0)={0x2, 0x0, @remote}, &(0x7f0000000a00)=0x10) setsockopt$SO_TIMESTAMPING(r7, 0x1, 0x25, &(0x7f0000000a40)=0x200, 0x4) (async) flock(r6, 0x1) (async) ioctl$FS_IOC_ENABLE_VERITY(r2, 0x40806685, &(0x7f0000000c00)={0x1, 0x1, 0x1000, 0xfb, &(0x7f0000000a80)="fa63f410d622868224db9e25271ac7de01c281dc8c5a80992ba47565cbbb7615407157fca7cb1a6c2ab505fc065e93718513db9a68b1703397fe0d0c51c1619426ccc5e11f6feb44b0611146cd2b9b520265ed9dd6084b7a852821ab9d4fb8ba7558aa84e2f8d0e00ac7ce774e2d2ecec0607e537aeeaba3803cfcd22cfd9634b99a68c1688d713f67fdbfe77cf4e697e1082bc0001f72be3e71860e7d3f767de7937be3abd7bccc0529d95b8be36ac27d1ed72069e6353acc0a044694e41261f6d042031b985e8f8137ae6256356f2ec7bf4da00e632a3474f954b513e618f9f79ba5ae0524c47768cef61dd9919e68ffedd080df44d934978071", 0x54, 0x0, &(0x7f0000000b80)="8ac0125035f125ff6f248e7168d42479320eb3bc606780b800cbd63a25b43ebea370425c905831e5302619ccbbeb529e77467e92dcb7ba5189b669aafcacd1ac7d324f1c344e46e7dca0b7aafd5ace25bcc3ac77"}) (async) ioctl$HIDIOCGREPORT(r6, 0x400c4807, &(0x7f0000000c80)={0x2, 0x100, 0x9}) (async, rerun: 64) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000cc0)='vegas', 0x5) (async, rerun: 64) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r6, 0x84009422, &(0x7f0000000d00)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}}) sendto$inet6(r6, &(0x7f0000001100)="7bfa74448b39e19eed3ecf1246f2708cd091b725f28d8734b56535593c226da23b3acb4ae196af7311b8e51ae3322bb4dee660163bc846a917720303b884843b094b5b74616a36f0f04ffb441c59827803bba8998656d43af74ed2703be340f7ee17a8bc541e17abe557bc3752e73eb2885fb0b89fd117374ec7df6b9ab66cff48dd88b39ef0314a8e0e865cb7e134d0365c2e9e71f5be7ad8e818fbf2bbaabb22369bf8f1df1c265fc7a63ad2d975c512f89c8c2ceb09583e5ece7020b626a188ba45d55d2265fe6ca21de721906417", 0xd0, 0x20000055, &(0x7f0000001200)={0xa, 0x4e23, 0x1, @loopback, 0x7}, 0x1c) (async) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r5, 0x5760, 0x4) (async) r8 = add_key$fscrypt_provisioning(&(0x7f0000001240), &(0x7f0000001280)={'syz', 0x3}, &(0x7f00000012c0)={0x1, 0x0, @auto=[0x14, 0x36, 0x35, 0x1b, 0x30, 0x35, 0x39, 0x39]}, 0x10, 0x0) keyctl$revoke(0x3, r8) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x23, &(0x7f00000014c0)={&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000001300)=""/163, 0xa3, 0x1, &(0x7f00000013c0)=""/198, 0xc6}, &(0x7f0000001500)=0x40) (async) pipe(&(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) read$watch_queue(r9, &(0x7f0000001580)=""/233, 0xe9) 467.992996ms ago: executing program 1 (id=1277): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x48, 0x10, 0x503, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21111, 0x8831}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_MACSEC_CIPHER_SUITE={0xc, 0x4, 0x80c20001000003}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x48}, 0x1, 0x0, 0x0, 0x48890}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x31, 0xffffffffffffffff, 0xffffe000) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000001000/0x4000)=nil) remap_file_pages(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0) 410.399866ms ago: executing program 1 (id=1279): ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180), 0x8) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) r1 = fsopen(&(0x7f0000000200)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='uid', &(0x7f0000000280)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\bb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xd7\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0, 0x1, 0x3}, 0x50) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e24, @private=0xa010100}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f00000000c0)={0x1, [0x0]}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000140)={0xfffe, 0x1, 0x0, 0x40, 0x4, 0x40, 0x8de, 0x80000001, r5}, 0x20) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700), &(0x7f0000000740), 0x407f, r2, 0x4}, 0x38) 335.863221ms ago: executing program 4 (id=1282): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000180)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000001c0)={0x28, 0x7, r1, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000280)={0x48, 0x7, r2, 0x0, 0x10001, 0x0, 0x40a, 0x2b7907, 0x10003}) ioctl$IOMMU_TEST_OP_ACCESS_RW(r0, 0x3ba0, &(0x7f0000000300)={0x48, 0x8, r2, 0x0, 0xffff, 0x1100, &(0x7f0000000380)='|0', 0x5}) 238.839965ms ago: executing program 4 (id=1283): r0 = syz_open_dev$dri(&(0x7f0000000040), 0x78, 0xa02) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x6776, 0x1}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x9, 0x11, r0, 0x2995f000) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000400)}, 0x4004800) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000200)={'virt_wifi0\x00', 0x6}) ioctl(r1, 0x8b22, &(0x7f0000000240)) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000180)=0xf3f, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x4076cbba9945d516, &(0x7f0000000240)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newlink={0x50, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x49a73}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @empty}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @empty}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x13}}, @IFLA_IPTUN_COLLECT_METADATA={0x4}]}}}]}, 0x50}}, 0x0) sendto$packet(r2, &(0x7f0000000400)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc9", 0x26, 0x40, &(0x7f0000000440)={0xc9, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.empty_time\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0x208e24b) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) syz_open_dev$dri(&(0x7f0000000040), 0x78, 0xa02) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000080)={0x7, 0x6776, 0x1}) (async) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x9, 0x11, r0, 0x2995f000) (async) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000400)}, 0x4004800) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000200)={'virt_wifi0\x00', 0x6}) (async) ioctl(r1, 0x8b22, &(0x7f0000000240)) (async) socket$packet(0x11, 0x3, 0x300) (async) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000180)=0xf3f, 0x4) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x4076cbba9945d516, &(0x7f0000000240)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r4, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) (async) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newlink={0x50, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x49a73}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @empty}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @empty}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x13}}, @IFLA_IPTUN_COLLECT_METADATA={0x4}]}}}]}, 0x50}}, 0x0) (async) sendto$packet(r2, &(0x7f0000000400)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc9", 0x26, 0x40, &(0x7f0000000440)={0xc9, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.empty_time\x00', 0x275a, 0x0) (async) write$binfmt_script(r6, &(0x7f0000000100), 0x208e24b) (async) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) (async) 119.787503ms ago: executing program 4 (id=1284): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f0000000040)=@filename='mtd0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.swap.events\x00', 0x26e1, 0x0) close(r0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="d8000000580081044e81f782db44b904021d0800090002", 0x17}], 0x1}, 0x24044880) ioctl$SIOCSIFHWADDR(r0, 0x8b32, &(0x7f0000000340)={'virt_wifi0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) ioctl$NILFS_IOCTL_GET_VINFO(r0, 0xc0186e86, &(0x7f00000003c0)={&(0x7f0000000380), 0x0, 0x20, 0x5, 0xe4a5}) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), 0x8, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r2 = syz_open_dev$dri(&(0x7f0000000380), 0x1, 0x400400) ioctl$DRM_IOCTL_SET_UNIQUE(r2, 0x40106410, &(0x7f00000004c0)={0x86, &(0x7f0000000400)="30f388857b29fd36cb2a1e0af632bb951a258062fe042c777b2425f1d23aa0801d2160c947e1f517691ae88afe1bc2b40590aa737a49b9a609f157ba05f082b23b086c95795ce933f08df02d33f8c92f7a212dc0fb5b7154c9d38fc34948fe7b93340e236ca02c91d32ed1d255d5ba28c99ae5134de761fb3bfff8ce99cfd2a59be1f09c8ae2"}) 50.36995ms ago: executing program 4 (id=1285): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = gettid() timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000240)) r2 = syz_open_procfs(r1, &(0x7f0000000880)='fd/3\x00') write$vhost_msg_v2(r2, &(0x7f0000000040)={0x2, 0x0, {0x0, 0x0, 0x0, 0x2, 0x4}}, 0x48) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x8, 0x3, 0x390, 0x1d0, 0x43, 0xa0, 0x1d0, 0x98, 0x2f8, 0x178, 0x178, 0x2f8, 0x178, 0x49, 0x0, {[{{@ip={@broadcast, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'geneve1\x00'}, 0x12a, 0x1b0, 0x1d0, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@helper={{0x48}, {0x0, 'ftp-20000\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xe8, 0x128, 0x0, {}, [@common=@unspec=@connbytes={{0x38}, {[{0xb}]}}, @common=@set={{0x40}, {{0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x302]}}}]}, @common=@unspec=@ERROR={0x20, 'ERROR\x00', 0x0, "f1c098b60204ed02d82cf440fef5497b80c206000000116d00"}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x40b) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x15, 0x3, &(0x7f0000000400)=ANY=[@ANYRESOCT=r4], &(0x7f0000000280)='syzkaller\x00', 0x1, 0xcc, &(0x7f00000002c0)=""/204, 0x41100, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) unshare(0x8010300) setsockopt$sock_attach_bpf(r3, 0x1, 0x34, &(0x7f00000003c0)=r5, 0x4) bind$bt_rfcomm(r2, &(0x7f00000000c0)={0x1f, @none, 0x2}, 0xa) getsockopt$bt_BT_VOICE(r0, 0x112, 0x13, 0x0, &(0x7f00000001c0)) 50.028961ms ago: executing program 3 (id=1286): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) sendto$inet6(r1, &(0x7f0000000280)="2994e1210594d91cff674c1e9ef299f86e12d3a7fecd9fa4cab24abe25117cb22e1f1854505816914bac0d8c5ab76433cc94fdc624fc78ee980bdcf6b855522a178a4bb853a2d00166cd70b790a7f65dfd252c69bae22ddfda88505ad81e446e6e54bac2d05de22fd16f60d770b6a12a0e033496e74d611dbfa47fcd550797d9edf9d73d566184fb69edb48af7aed1985f41a88f0afbc4de2fd59375eff7329965a6393f47a20ccc4d2ce15fc3576b9107f369aabfe843ae8b9b3aba1a035ea5bbc31b2fc2cd1103d561b516332e5ba6beb25a623369", 0xd6, 0x0, &(0x7f0000000380)={0xa, 0x4e21, 0x1, @dev={0xfe, 0x80, '\x00', 0x3d}, 0x5}, 0x1c) (async) sendto$inet6(r1, &(0x7f0000000280)="2994e1210594d91cff674c1e9ef299f86e12d3a7fecd9fa4cab24abe25117cb22e1f1854505816914bac0d8c5ab76433cc94fdc624fc78ee980bdcf6b855522a178a4bb853a2d00166cd70b790a7f65dfd252c69bae22ddfda88505ad81e446e6e54bac2d05de22fd16f60d770b6a12a0e033496e74d611dbfa47fcd550797d9edf9d73d566184fb69edb48af7aed1985f41a88f0afbc4de2fd59375eff7329965a6393f47a20ccc4d2ce15fc3576b9107f369aabfe843ae8b9b3aba1a035ea5bbc31b2fc2cd1103d561b516332e5ba6beb25a623369", 0xd6, 0x0, &(0x7f0000000380)={0xa, 0x4e21, 0x1, @dev={0xfe, 0x80, '\x00', 0x3d}, 0x5}, 0x1c) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x4}}, @TCA_MPLS_LABEL={0x8}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) 49.8414ms ago: executing program 4 (id=1287): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x700, &(0x7f00000003c0)={&(0x7f0000000040)={0x34, 0x41, 0x1, 0x7fffc, 0x4, {0x1}, [@nested={0x4, 0x48}, @nested={0x14, 0x1, 0x0, 0x1, [@nested={0x10, 0x10, 0x0, 0x1, [@nested={0xc, 0xb, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @ipv4=@multicast2}]}]}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd=r0}]}, 0x34}, 0x1, 0x0, 0x0, 0x404c005}, 0x4008094) 248.883µs ago: executing program 4 (id=1288): munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000000)={&(0x7f00006d6000/0x400000)=nil, &(0x7f0000528000/0x2000)=nil, 0x400000, 0x1}) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION2(r3, 0x40a0ae49, &(0x7f00000004c0)={0x101ff, 0x0, 0xe000, 0x2000, &(0x7f00002e3000/0x2000)=nil}) ioctl$KVM_RUN(r4, 0xae80, 0x0) write$dsp(r1, &(0x7f0000000100)="5cba91a4", 0xffffffd9) r5 = syz_open_dev$sndctrl(&(0x7f0000000140), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r5, 0x40045532, &(0x7f0000000580)) r6 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r6, 0xc0884123, &(0x7f0000000200)={0x0, "72a59baeb6c10b67b134a5f267418d0000000000000000000000820f2cf9ff6c8d2600", {0x800000000000004, 0x50000000000}}) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r6, 0xc0884113, &(0x7f00000002c0)={0x1, 0x0, 0xffff5f0f, 0xfffd, 0xfffffffffffffffb, 0xb, 0xfffffffffffffffa, 0x1fe, 0x4a, 0x28, 0x4, 0x2}) r7 = landlock_create_ruleset(&(0x7f0000000380)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r7, 0xe) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) 0s ago: executing program 3 (id=1289): ftruncate(0xffffffffffffffff, 0xffffffffffffe16b) pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x101042, 0x15) mount$9p_fd(0x0, &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@posixacl}]}}) r2 = socket$nl_route(0x10, 0x3, 0x0) io_uring_enter(r1, 0x5e94, 0x4591, 0x10, &(0x7f00000002c0)={[0x2bb6]}, 0x8) r3 = epoll_create1(0x0) r4 = epoll_create1(0x0) r5 = fcntl$dupfd(r4, 0x406, r4) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000300)={0x20000001}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r4, &(0x7f0000000340)={0x20000000}) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = dup(r7) write$UHID_INPUT(r8, &(0x7f00000003c0)={0x18, {"a2e3ad2119c752f91b5e09091bf70e0dd038e7ff7fc6e5539b324d078b089b3b0838721a0890e0878f0e1ac6e7049b3d63959b509a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31320d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70d998ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f0000000c558cdc0a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5af098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000108000e0a37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b2fc652c54e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d3a6df40babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f794c9eee1198751adaa13d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f39a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60559516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2dc19a3a375e71e078342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb0100008051fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d8872fe174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0559be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f980000000203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r6, &(0x7f0000000380)={0xa0002008}) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000ffff27bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="100a0500231a05002c0012800e02010069703665727370616e0000001800028004001200050016000100000008001500ed0c0e00"], 0x4c}}, 0x20040040) kernel console output (not intermixed with test programs): .168920][ T8247] xt_hl: Unknown Hop Limit match mode: 206 [ 97.171039][ T8246] netlink: 8 bytes leftover after parsing attributes in process `syz.2.713'. [ 97.171105][ T8246] netlink: 8 bytes leftover after parsing attributes in process `syz.2.713'. [ 97.171162][ T8246] netlink: 8 bytes leftover after parsing attributes in process `syz.2.713'. [ 97.175344][ T8247] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 97.175651][ T8247] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.176241][ T8247] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 97.203040][ T10] usb 8-1: USB disconnect, device number 10 [ 97.372539][ T42] audit: type=1400 audit(1792743247.459:11156): avc: denied { write } for pid=8252 comm="syz.1.714" name="sg4" dev="devtmpfs" ino=1297 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 97.460925][ T8257] xt_check_table_hooks: 23 callbacks suppressed [ 97.460944][ T8257] x_tables: duplicate underflow at hook 1 [ 97.476119][ T8261] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 97.516869][ T10] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 97.666598][ T10] usb 8-1: device descriptor read/64, error -71 [ 97.705961][ T8275] FAULT_INJECTION: forcing a failure. [ 97.705961][ T8275] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 97.705992][ T8275] CPU: 2 UID: 0 PID: 8275 Comm: syz.0.723 Tainted: G L syzkaller #0 PREEMPT(full) [ 97.706015][ T8275] Tainted: [L]=SOFTLOCKUP [ 97.706021][ T8275] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.706032][ T8275] Call Trace: [ 97.706038][ T8275] [ 97.706045][ T8275] dump_stack_lvl+0x100/0x190 [ 97.706074][ T8275] should_fail_ex.cold+0x5/0xa [ 97.706098][ T8275] ? prepare_alloc_pages+0x16d/0x5b0 [ 97.706145][ T8275] should_fail_alloc_page+0xeb/0x140 [ 97.706176][ T8275] prepare_alloc_pages+0x1f0/0x5b0 [ 97.706205][ T8275] ? __memcg_kmem_charge_page+0x373/0x4d0 [ 97.706231][ T8275] __alloc_frozen_pages_noprof+0x1e8/0x32e0 [ 97.706257][ T8275] ? stack_trace_save+0x8e/0xc0 [ 97.706278][ T8275] ? __pfx_stack_trace_save+0x10/0x10 [ 97.706298][ T8275] ? stack_depot_save_flags+0x27/0x9f0 [ 97.706330][ T8275] ? kasan_save_stack+0x3f/0x50 [ 97.706373][ T8275] ? kasan_save_stack+0x30/0x50 [ 97.706399][ T8275] ? kasan_save_track+0x14/0x30 [ 97.706429][ T8275] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 97.706451][ T8275] ? mmu_topup_memory_caches+0xbc/0x1a0 [ 97.706471][ T8275] ? vcpu_run+0x419f/0x61a0 [ 97.706490][ T8275] ? kvm_vcpu_ioctl+0x730/0x1770 [ 97.706513][ T8275] ? __x64_sys_ioctl+0x18e/0x210 [ 97.706534][ T8275] ? do_syscall_64+0x123/0x790 [ 97.706568][ T8275] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.706608][ T8275] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 97.706634][ T8275] ? policy_nodemask+0xed/0x4f0 [ 97.706664][ T8275] alloc_pages_mpol+0x201/0x550 [ 97.706693][ T8275] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 97.706721][ T8275] ? __kvmalloc_node_noprof+0x377/0x9b0 [ 97.706751][ T8275] alloc_pages_noprof+0x1a/0x160 [ 97.706770][ T8275] get_free_pages_noprof+0x10/0xb0 [ 97.706794][ T8275] __kvm_mmu_topup_memory_cache+0x278/0x5f0 [ 97.706830][ T8275] mmu_topup_memory_caches+0xbc/0x1a0 [ 97.706854][ T8275] kvm_mmu_load+0xe8/0x2580 [ 97.706878][ T8275] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 97.706905][ T8275] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 97.706936][ T8275] ? __pfx_kvm_mmu_load+0x10/0x10 [ 97.706956][ T8275] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 97.706975][ T8275] ? kvm_check_and_inject_events+0x896/0x1050 [ 97.707000][ T8275] vcpu_run+0x419f/0x61a0 [ 97.707021][ T8275] ? vmx_vcpu_load_vmcs+0x21d/0x760 [ 97.707058][ T8275] ? __pfx_vcpu_run+0x10/0x10 [ 97.707110][ T8275] ? lock_acquire+0x1d1/0x380 [ 97.707133][ T8275] ? kvm_arch_vcpu_ioctl_run+0x2e9/0x1e20 [ 97.707160][ T8275] ? fpu_swap_kvm_fpstate+0x25e/0x4b0 [ 97.707188][ T8275] ? __local_bh_enable_ip+0xa5/0x120 [ 97.707223][ T8275] ? kvm_arch_vcpu_ioctl_run+0xf8a/0x1e20 [ 97.707246][ T8275] kvm_arch_vcpu_ioctl_run+0xf8a/0x1e20 [ 97.707276][ T8275] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 97.707298][ T8275] ? lock_acquire+0x1d1/0x380 [ 97.707319][ T8275] ? do_raw_write_lock+0x11e/0x260 [ 97.707339][ T8275] ? find_held_lock+0x2b/0x80 [ 97.707360][ T8275] ? kvm_vcpu_ioctl+0x1591/0x1770 [ 97.707376][ T8275] ? kvm_vcpu_ioctl+0x1591/0x1770 [ 97.707402][ T8275] kvm_vcpu_ioctl+0x730/0x1770 [ 97.707429][ T8275] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 97.707456][ T8275] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 97.707482][ T8275] ? do_vfs_ioctl+0x226/0x13e0 [ 97.707507][ T8275] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 97.707528][ T8275] ? ioctl_has_perm.constprop.0.isra.0+0x37d/0x530 [ 97.707550][ T8275] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 97.707573][ T8275] ? __fget_files+0x34/0x3d0 [ 97.707612][ T8275] ? selinux_file_ioctl+0x1e0/0x290 [ 97.707629][ T8275] ? selinux_file_ioctl+0x1e7/0x290 [ 97.707647][ T8275] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 97.707674][ T8275] __x64_sys_ioctl+0x18e/0x210 [ 97.707699][ T8275] do_syscall_64+0x123/0x790 [ 97.707730][ T8275] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.707748][ T8275] RIP: 0033:0x7f384c39f559 [ 97.707766][ T8275] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.707783][ T8275] RSP: 002b:00007f384d191028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 97.707801][ T8275] RAX: ffffffffffffffda RBX: 00007f384c625fa0 RCX: 00007f384c39f559 [ 97.707812][ T8275] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 97.707823][ T8275] RBP: 00007f384c436b20 R08: 0000000000000000 R09: 0000000000000000 [ 97.707834][ T8275] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.707845][ T8275] R13: 00007f384c626038 R14: 00007f384c625fa0 R15: 00007ffe006fc518 [ 97.707871][ T8275] [ 97.718643][ T8275] netlink: 'syz.0.723': attribute type 30 has an invalid length. [ 97.732584][ T8275] netlink: 'syz.0.723': attribute type 30 has an invalid length. [ 97.741876][ T5881] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 97.741901][ T5881] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 97.741919][ T5881] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 97.741936][ T5881] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 97.926554][ T10] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 97.942960][ T8297] 9pnet_virtio: no channels available for device éq‰Y’3aK [ 98.048397][ T10] usb 8-1: device descriptor read/64, error -71 [ 98.167567][ T10] usb usb8-port1: attempt power cycle [ 98.179022][ T5858] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 98.232273][ T8306] openvswitch: netlink: Missing key (keys=c0, expected=20100) [ 98.338957][ T5858] usb 7-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 98.341066][ T5858] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 98.341087][ T5858] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 98.345451][ T5858] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.345470][ T5858] usb 7-1: Product: syz [ 98.345482][ T5858] usb 7-1: Manufacturer: syz [ 98.345494][ T5858] usb 7-1: SerialNumber: syz [ 98.408987][ T8308] JFS: discard option not supported on device [ 98.410055][ T8308] Mount JFS Failure: -5 [ 98.410108][ T8308] jfs_mount failed w/return code = -5 [ 98.516677][ T10] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 98.537433][ T10] usb 8-1: device descriptor read/8, error -71 [ 98.556842][ T5858] usblp 7-1:1.0: usblp0: USB Bidirectional printer dev 4 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 98.754906][ T952] usb 7-1: USB disconnect, device number 4 [ 98.761790][ T952] usblp0: removed [ 98.787694][ T10] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 98.807005][ T10] usb 8-1: device descriptor read/8, error -71 [ 98.928633][ T10] usb usb8-port1: unable to enumerate USB device [ 99.156415][ T8337] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0001 with DS=0xf [ 99.168207][ T8337] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 99.168229][ T8337] overlayfs: failed to set xattr on upper [ 99.168236][ T8337] overlayfs: ...falling back to redirect_dir=nofollow. [ 99.168241][ T8337] overlayfs: ...falling back to index=off. [ 99.168247][ T8337] overlayfs: ...falling back to uuid=null. [ 99.168254][ T8337] overlayfs: ...falling back to xino=off. [ 99.205824][ T8339] veth1_macvtap: entered promiscuous mode [ 99.326017][ T8349] __nla_validate_parse: 65 callbacks suppressed [ 99.326030][ T8349] netlink: 8 bytes leftover after parsing attributes in process `syz.2.749'. [ 99.326128][ T8349] netlink: 28 bytes leftover after parsing attributes in process `syz.2.749'. [ 99.326199][ T8350] netlink: 28 bytes leftover after parsing attributes in process `syz.2.749'. [ 99.347861][ T8349] bond3: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 99.348481][ T8349] bond3 (unregistering): Released all slaves [ 99.575522][ T8361] Config c/1 of g1 needs at least one function. [ 99.575748][ T8361] udc dummy_udc.0: failed to start g1: -22 [ 99.575768][ T8361] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 99.577876][ T8361] UDC core: g1: couldn't find an available UDC or it's busy [ 99.681851][ T8375] IPVS: sync thread started: state = BACKUP, mcast_ifn = wg2, syncid = 1, id = 0 [ 99.816543][ T5873] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 99.850810][ T8385] tipc: Enabled bearer , priority 0 [ 99.880688][ T8385] syzkaller0: entered promiscuous mode [ 99.880710][ T8385] syzkaller0: entered allmulticast mode [ 99.881060][ T8385] tipc: Resetting bearer [ 99.892299][ T8385] usb 1-1: USB disconnect, device number 2 [ 99.895530][ T8388] device-mapper: ioctl: Unable to rename non-existent device, to syza2 [ 99.964448][ T8385] hub 1-0:1.0: USB hub found [ 99.964620][ T8385] hub 1-0:1.0: 6 ports detected [ 99.976564][ T5873] usb 7-1: Using ep0 maxpacket: 16 [ 99.977121][ T5873] usb 7-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 99.978188][ T5873] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 99.978206][ T5873] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 99.982232][ T5873] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.982250][ T5873] usb 7-1: Product: syz [ 99.982261][ T5873] usb 7-1: Manufacturer: syz [ 99.982272][ T5873] usb 7-1: SerialNumber: syz [ 99.982279][ T8384] tipc: Resetting bearer [ 99.990037][ T5873] r8152-cfgselector 7-1: Unknown version 0x0000 [ 99.990050][ T5873] r8152-cfgselector 7-1: config 0 descriptor?? [ 100.146561][ T952] usb 1-1: new high-speed USB device number 3 using ehci-pci [ 100.213159][ T8370] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 100.213360][ T8370] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 100.251530][ T7463] r8152-cfgselector 7-1: USB disconnect, device number 5 [ 100.327640][ T952] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 100.341590][ T952] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 100.341615][ T952] usb 1-1: Product: QEMU USB Tablet [ 100.341629][ T952] usb 1-1: Manufacturer: QEMU [ 100.341643][ T952] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 100.395331][ T952] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0006/input/input13 [ 100.490181][ T952] hid-generic 0003:0627:0001.0006: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 100.774540][ T42] kauditd_printk_skb: 150 callbacks suppressed [ 100.774558][ T42] audit: type=1400 audit(1792743506.860:11307): avc: denied { unmount } for pid=5766 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 100.903431][ T8411] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 100.908837][ T8411] xt_HMARK: spi-set and port-set can't be combined [ 100.917905][ T42] audit: type=1400 audit(1792743507.010:11308): avc: denied { read } for pid=8408 comm="syz.2.768" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 100.924636][ T42] audit: type=1400 audit(1792743507.010:11309): avc: denied { ioctl } for pid=8408 comm="syz.2.768" path="/dev/fuse" dev="devtmpfs" ino=105 ioctlcmd=0x40309410 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 100.936138][ T42] audit: type=1400 audit(1792743507.020:11310): avc: denied { setattr } for pid=8408 comm="syz.2.768" name="PPPOE" dev="sockfs" ino=25266 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 101.252717][ T8384] tipc: Disabling bearer [ 101.364617][ T42] audit: type=1400 audit(1792743507.450:11311): avc: denied { ioctl } for pid=8437 comm="syz.3.770" path="socket:[27155]" dev="sockfs" ino=27155 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 101.385618][ T42] audit: type=1400 audit(1792743507.470:11312): avc: denied { setopt } for pid=8439 comm="syz.1.771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 101.406275][ T42] audit: type=1400 audit(1792743507.490:11313): avc: denied { setopt } for pid=8443 comm="syz.3.772" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 101.409013][ T42] audit: type=1400 audit(1792743507.500:11314): avc: denied { create } for pid=8443 comm="syz.3.772" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 101.409632][ T42] audit: type=1400 audit(1792743507.500:11315): avc: denied { ioctl } for pid=8443 comm="syz.3.772" path="socket:[27163]" dev="sockfs" ino=27163 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 101.410536][ T42] audit: type=1400 audit(1792743507.500:11316): avc: denied { write } for pid=8443 comm="syz.3.772" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 101.532171][ T8462] ip_tables: iptables: counters copy to user failed while replacing table [ 101.573235][ T8467] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=8467 comm=syz.1.774 [ 101.575160][ T8467] netlink: 4 bytes leftover after parsing attributes in process `syz.1.774'. [ 101.596043][ T8467] bond0: (slave bond_slave_0): Releasing backup interface [ 101.785328][ T8488] xt_LOG: level 127 >= 8 [ 101.798775][ T8490] netlink: 52 bytes leftover after parsing attributes in process `syz.0.780'. [ 101.801126][ T8490] netlink: 76 bytes leftover after parsing attributes in process `syz.0.780'. [ 101.801945][ T8490] netlink: 52 bytes leftover after parsing attributes in process `syz.0.780'. [ 101.857959][ T8495] netlink: 4 bytes leftover after parsing attributes in process `syz.0.782'. [ 101.858024][ T8495] gretap0: left allmulticast mode [ 101.858039][ T8495] gretap0: left promiscuous mode [ 101.858224][ T8495] bridge0: port 3(gretap0) entered disabled state [ 101.861417][ T8495] bridge_slave_1: left allmulticast mode [ 101.861436][ T8495] bridge_slave_1: left promiscuous mode [ 101.861719][ T8495] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.863846][ T8495] bridge_slave_0: left allmulticast mode [ 101.863864][ T8495] bridge_slave_0: left promiscuous mode [ 101.864026][ T8495] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.864203][ T8496] netdevsim netdevsim3: Direct firmware load for . [ 101.864203][ T8496] failed with error -2 [ 101.865646][ T8496] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 101.865646][ T8496] [ 102.233157][ T8510] netlink: 4 bytes leftover after parsing attributes in process `syz.0.788'. [ 102.281530][ T8514] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 102.281879][ T8514] CIFS: Attempting to mount //127.0.0.1/share [ 102.285067][ T8514] CIFS: VFS: Error connecting to socket. Aborting operation. [ 102.285162][ T8514] CIFS: VFS: cifs_mount failed w/return code = -101 [ 102.286771][ T7463] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 102.446748][ T7463] usb 7-1: Using ep0 maxpacket: 8 [ 102.448095][ T7463] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 102.450772][ T7463] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.450789][ T7463] usb 7-1: Product: syz [ 102.450796][ T7463] usb 7-1: Manufacturer: syz [ 102.450804][ T7463] usb 7-1: SerialNumber: syz [ 102.452319][ T7463] usb 7-1: config 0 descriptor?? [ 102.596645][ T8529] ip6erspan0: entered allmulticast mode [ 102.651050][ T8530] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 102.651050][ T8530] The task syz.0.796 (8530) triggered the difference, watch for misbehavior. [ 102.655640][ T7463] usb 7-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 102.673382][ T8532] lo: Master is either lo or non-ether device [ 102.745402][ T7463] dvb_usb_rtl28xxu 7-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 102.752496][ T7463] usb 7-1: USB disconnect, device number 6 [ 102.780911][ T8542] netlink: 20 bytes leftover after parsing attributes in process `syz.3.798'. [ 102.819940][ T8542] bond_slave_0: entered promiscuous mode [ 102.819954][ T8542] bond_slave_0: entered allmulticast mode [ 103.216594][ T10] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 103.346047][ T8583] iommufd_mock iommufd_mock0: Adding to iommu group 10 [ 103.376697][ T10] usb 8-1: Using ep0 maxpacket: 32 [ 103.378609][ T10] usb 8-1: unable to get BOS descriptor or descriptor too short [ 103.378646][ T10] usb 8-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 103.382380][ T10] usb 8-1: string descriptor 0 read error: -22 [ 103.382524][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.389734][ T10] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 103.389766][ T10] dw2102: su3000_power_ctrl: 1, initialized 0 [ 103.392346][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 103.395868][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 103.397626][ T10] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 103.397664][ T10] usb 8-1: media controller created [ 103.398722][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 103.398735][ T10] dw2102: i2c transfer failed. [ 103.398747][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 103.398757][ T10] dw2102: i2c transfer failed. [ 103.398766][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 103.398776][ T10] dw2102: i2c transfer failed. [ 103.398785][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 103.398795][ T10] dw2102: i2c transfer failed. [ 103.398804][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 103.398813][ T10] dw2102: i2c transfer failed. [ 103.398822][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 103.398831][ T10] dw2102: i2c transfer failed. [ 103.398838][ T10] dvb-usb: MAC address: 02:02:02:02:02:02 [ 103.410779][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 103.430498][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 103.430509][ T10] dw2102: command 0x0e transfer failed. [ 103.430514][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 103.430520][ T10] dw2102: command 0x0e transfer failed. [ 103.657636][ T8600] bond5: entered promiscuous mode [ 103.697783][ T8606] ebt_limit: overflow, try lower: 0/0 [ 103.743194][ T8612] SELinux: policydb version 0 does not match my version range 15-35 [ 103.743477][ T8612] SELinux: failed to load policy [ 103.758060][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 103.758081][ T10] dw2102: command 0x0e transfer failed. [ 103.758089][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 103.758099][ T10] dw2102: command 0x0e transfer failed. [ 103.758106][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 103.758116][ T10] dw2102: command 0x51 transfer failed. [ 103.760650][ T8558] dw2102: i2c rd: len=4096 is too big! [ 103.760650][ T8558] [ 103.792665][ T10] DVB: Unable to find symbol ds3000_attach() [ 103.792678][ T10] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 103.860245][ T10] rc_core: IR keymap rc-su3000 not found [ 103.860260][ T10] Registered IR keymap rc-empty [ 103.861520][ T10] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.3/usb8/8-1/rc/rc0 [ 103.865763][ T10] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.3/usb8/8-1/rc/rc0/input14 [ 103.898367][ T10] dvb-usb: schedule remote query interval to 150 msecs. [ 103.898387][ T10] dw2102: su3000_power_ctrl: 0, initialized 1 [ 103.898397][ T10] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 103.902396][ T10] usb 8-1: USB disconnect, device number 15 [ 103.956562][ T10] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 104.367339][ T8663] overlay: ./file0 is not a directory [ 104.372319][ T8665] __nla_validate_parse: 2 callbacks suppressed [ 104.372331][ T8665] netlink: 8 bytes leftover after parsing attributes in process `syz.3.819'. [ 104.373159][ T8659] netlink: 'syz.3.819': attribute type 1 has an invalid length. [ 104.426043][ T8672] bridge1: entered promiscuous mode [ 104.426056][ T8672] bridge1: entered allmulticast mode [ 104.435278][ T8674] overlay: ./file0 is not a directory [ 104.435838][ T8674] overlay: ./file0 is not a directory [ 104.436267][ T8674] overlay: ./file0 is not a directory [ 104.439409][ T8674] overlay: ./file0 is not a directory [ 104.445368][ T8674] overlay: ./file0 is not a directory [ 104.453277][ T8674] overlay: ./file0 is not a directory [ 104.453934][ T8674] overlay: ./file0 is not a directory [ 104.454840][ T8674] overlay: ./file0 is not a directory [ 104.456016][ T8674] overlay: ./file0 is not a directory [ 104.457109][ T8674] overlay: ./file0 is not a directory [ 104.459245][ T8680] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 104.460687][ T8674] overlay: ./file0 is not a directory [ 104.462961][ T8674] overlay: ./file0 is not a directory [ 104.464752][ T8674] overlay: ./file0 is not a directory [ 104.467986][ T8674] overlay: ./file0 is not a directory [ 104.474790][ T8674] overlay: ./file0 is not a directory [ 104.478052][ T8674] overlay: ./file0 is not a directory [ 104.480010][ T8674] overlay: ./file0 is not a directory [ 104.481105][ T8674] overlay: ./file0 is not a directory [ 104.483689][ T8674] overlay: ./file0 is not a directory [ 104.484449][ T8674] overlay: ./file0 is not a directory [ 104.491606][ T8683] syz_tun: entered allmulticast mode [ 104.492794][ T8674] overlay: ./file0 is not a directory [ 104.499107][ T8674] overlay: ./file0 is not a directory [ 104.504224][ T8674] overlay: ./file0 is not a directory [ 104.506989][ T8674] overlay: ./file0 is not a directory [ 104.512825][ T5873] logitech-hidpp-device 0005:046D:B012.0007: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 104.514521][ T8674] overlay: ./file0 is not a directory [ 104.515102][ T8674] overlay: ./file0 is not a directory [ 104.521696][ T8674] overlay: ./file0 is not a directory [ 104.529578][ T8674] overlay: ./file0 is not a directory [ 104.530155][ T8674] overlay: ./file0 is not a directory [ 104.532021][ T8674] overlay: ./file0 is not a directory [ 104.534132][ T8674] overlay: ./file0 is not a directory [ 104.534890][ T8674] overlay: ./file0 is not a directory [ 104.542185][ T8674] overlay: ./file0 is not a directory [ 104.544712][ T8674] overlay: ./file0 is not a directory [ 104.544902][ T8683] dvmrp6: entered allmulticast mode [ 104.547833][ T8683] dvmrp6: left allmulticast mode [ 104.550653][ T8674] overlay: ./file0 is not a directory [ 104.553493][ T8684] fido_id[8684]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 104.554282][ T8674] overlay: ./file0 is not a directory [ 104.560101][ T8674] overlay: ./file0 is not a directory [ 104.560868][ T8674] overlay: ./file0 is not a directory [ 104.561903][ T8674] overlay: ./file0 is not a directory [ 104.562817][ T8674] overlay: ./file0 is not a directory [ 104.563686][ T8674] overlay: ./file0 is not a directory [ 104.564599][ T8674] overlay: ./file0 is not a directory [ 104.565336][ T8674] overlay: ./file0 is not a directory [ 104.566035][ T8674] overlay: ./file0 is not a directory [ 104.567190][ T8674] overlay: ./file0 is not a directory [ 104.569064][ T8674] overlay: ./file0 is not a directory [ 104.570615][ T8674] overlay: ./file0 is not a directory [ 104.573689][ T8674] overlay: ./file0 is not a directory [ 104.575122][ T8674] overlay: ./file0 is not a directory [ 104.577261][ T8674] overlay: ./file0 is not a directory [ 104.581010][ T8674] overlay: ./file0 is not a directory [ 104.583009][ T8674] overlay: ./file0 is not a directory [ 104.588109][ T8674] overlay: ./file0 is not a directory [ 104.594439][ T8689] dvmrp6: entered allmulticast mode [ 104.594551][ T8685] dvmrp6: left allmulticast mode [ 104.601893][ T8674] overlay: ./file0 is not a directory [ 104.603027][ T8674] overlay: ./file0 is not a directory [ 104.603992][ T8674] overlay: ./file0 is not a directory [ 104.607400][ T8674] overlay: ./file0 is not a directory [ 104.610982][ T8674] overlay: ./file0 is not a directory [ 104.612991][ T8674] overlay: ./file0 is not a directory [ 104.614654][ T8674] overlay: ./file0 is not a directory [ 104.615242][ T8691] ipvlan0: left promiscuous mode [ 104.617165][ T8674] overlay: ./file0 is not a directory [ 104.618754][ T8674] overlay: ./file0 is not a directory [ 104.620001][ T8674] overlay: ./file0 is not a directory [ 104.621724][ T8674] overlay: ./file0 is not a directory [ 104.624323][ T8674] overlay: ./file0 is not a directory [ 104.630892][ T8682] syz_tun: left allmulticast mode [ 104.666770][ T8698] netlink: 4 bytes leftover after parsing attributes in process `syz.0.831'. [ 104.759968][ T8698] netlink: 28 bytes leftover after parsing attributes in process `syz.0.831'. [ 104.793762][ T8717] netlink: 12 bytes leftover after parsing attributes in process `syz.1.836'. [ 104.936304][ T8729] device-mapper: table: 248:1: crypt: Error allocating crypto tfm (-EINVAL) [ 104.936326][ T8729] device-mapper: ioctl: error adding target to table [ 104.994488][ T8730] device-mapper: table: 248:1: crypt: Error allocating crypto tfm (-EINVAL) [ 104.994511][ T8730] device-mapper: ioctl: error adding target to table [ 105.038392][ T8751] jffs2: notice: (8751) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 105.124337][ T8756] kvm: apic: phys broadcast and lowest prio [ 105.124472][ T8763] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 105.126617][ T8763] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 105.135526][ T8765] FAULT_INJECTION: forcing a failure. [ 105.135526][ T8765] name failslab, interval 1, probability 0, space 0, times 0 [ 105.135546][ T8765] CPU: 1 UID: 0 PID: 8765 Comm: syz.0.851 Tainted: G L syzkaller #0 PREEMPT(full) [ 105.135562][ T8765] Tainted: [L]=SOFTLOCKUP [ 105.135567][ T8765] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.135581][ T8765] Call Trace: [ 105.135585][ T8765] [ 105.135591][ T8765] dump_stack_lvl+0x100/0x190 [ 105.135618][ T8765] should_fail_ex.cold+0x5/0xa [ 105.135635][ T8765] should_failslab+0xc2/0x120 [ 105.135657][ T8765] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 105.135672][ T8765] ? start_dirop+0x79/0xb0 [ 105.135686][ T8765] ? alloc_inode+0x68/0x250 [ 105.135700][ T8765] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 105.135717][ T8765] alloc_inode+0x68/0x250 [ 105.135730][ T8765] new_inode+0x22/0x1c0 [ 105.135745][ T8765] debugfs_create_dir+0xbe/0x440 [ 105.135763][ T8765] ptp_open+0x2fd/0x510 [ 105.135783][ T8765] ? __pfx_ptp_open+0x10/0x10 [ 105.135801][ T8765] ? __pfx_ptp_open+0x10/0x10 [ 105.135814][ T8765] posix_clock_open+0x17b/0x290 [ 105.135830][ T8765] ? __pfx_posix_clock_open+0x10/0x10 [ 105.135844][ T8765] chrdev_open+0x234/0x6a0 [ 105.135863][ T8765] ? __pfx_chrdev_open+0x10/0x10 [ 105.135903][ T8765] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 105.135922][ T8765] do_dentry_open+0x674/0x1470 [ 105.135945][ T8765] ? __pfx_chrdev_open+0x10/0x10 [ 105.135964][ T8765] vfs_open_consume+0xcc/0x460 [ 105.135978][ T8765] path_openat+0x1547/0x23f0 [ 105.135998][ T8765] ? __pfx_path_openat+0x10/0x10 [ 105.136019][ T8765] do_file_open+0x20e/0x430 [ 105.136038][ T8765] ? __pfx_do_file_open+0x10/0x10 [ 105.136067][ T8765] ? _raw_spin_unlock+0x28/0x50 [ 105.136085][ T8765] ? alloc_fd+0x471/0x7a0 [ 105.136106][ T8765] do_sys_openat2+0x163/0x1d0 [ 105.136117][ T8765] ? __pfx_do_sys_openat2+0x10/0x10 [ 105.136129][ T8765] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 105.136151][ T8765] __x64_sys_openat+0x12d/0x210 [ 105.136163][ T8765] ? __pfx___x64_sys_openat+0x10/0x10 [ 105.136179][ T8765] do_syscall_64+0x123/0x790 [ 105.136199][ T8765] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.136212][ T8765] RIP: 0033:0x7f384c39f559 [ 105.136221][ T8765] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.136231][ T8765] RSP: 002b:00007f384d191028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 105.136243][ T8765] RAX: ffffffffffffffda RBX: 00007f384c625fa0 RCX: 00007f384c39f559 [ 105.136250][ T8765] RDX: 0000000000088000 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 105.136256][ T8765] RBP: 00007f384c436b20 R08: 0000000000000000 R09: 0000000000000000 [ 105.136263][ T8765] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.136269][ T8765] R13: 00007f384c626038 R14: 00007f384c625fa0 R15: 00007ffe006fc518 [ 105.136283][ T8765] [ 105.136295][ T8765] debugfs: out of free dentries, can not create directory '0xffff88802b510000' [ 105.212351][ T8772] ip_tables: iptables: counters copy to user failed while replacing table [ 105.281621][ T8778] netlink: 36 bytes leftover after parsing attributes in process `syz.2.856'. [ 105.362192][ T8783] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 105.362205][ T8783] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 105.362213][ T8783] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 105.362219][ T8783] One or more global auth toks could not properly register; rc = [-22] [ 105.362235][ T8783] Error validating options; rc = [-22] [ 105.536698][ T7463] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 105.676986][ T7463] usb 7-1: device descriptor read/64, error -71 [ 105.926569][ T7463] usb 7-1: new full-speed USB device number 8 using dummy_hcd [ 105.939914][ T42] kauditd_printk_skb: 120 callbacks suppressed [ 105.939931][ T42] audit: type=1400 audit(1792743510.025:11437): avc: denied { read } for pid=8810 comm="syz.1.866" name="card1" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 105.940001][ T42] audit: type=1400 audit(1792743510.025:11438): avc: denied { open } for pid=8810 comm="syz.1.866" path="/dev/dri/card1" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 105.940723][ T42] audit: type=1400 audit(1792743510.025:11439): avc: denied { ioctl } for pid=8810 comm="syz.1.866" path="/dev/dri/card1" dev="devtmpfs" ino=637 ioctlcmd=0xc04464b8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 106.018355][ T42] audit: type=1400 audit(1792743510.105:11440): avc: denied { mounton } for pid=8818 comm="syz.3.867" path="/syzcgroup/unified/syz3" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 106.020835][ T8820] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 106.021022][ T8820] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 106.021038][ T8820] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 106.021048][ T8820] UDF-fs: Scanning with blocksize 512 failed [ 106.022447][ T8820] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 106.022761][ T8820] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 106.022779][ T8820] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 106.022790][ T8820] UDF-fs: Scanning with blocksize 1024 failed [ 106.023360][ T8820] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 106.023446][ T8820] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 106.023516][ T8820] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 106.023528][ T8820] UDF-fs: Scanning with blocksize 2048 failed [ 106.024004][ T8820] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=256, location=256 [ 106.024079][ T8820] UDF-fs: error (device nbd3): udf_read_tagged: read failed, block=512, location=512 [ 106.024094][ T8820] UDF-fs: warning (device nbd3): udf_load_vrs: No anchor found [ 106.024105][ T8820] UDF-fs: Scanning with blocksize 4096 failed [ 106.024113][ T8820] UDF-fs: warning (device nbd3): udf_fill_super: No partition found (1) [ 106.061970][ T7463] usb 7-1: device descriptor read/64, error -71 [ 106.067246][ T42] audit: type=1400 audit(1792743510.155:11441): avc: denied { bind } for pid=8823 comm="syz.3.868" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 106.067704][ T42] audit: type=1400 audit(1792743510.155:11442): avc: denied { setopt } for pid=8823 comm="syz.3.868" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 106.068448][ T8824] netlink: 8 bytes leftover after parsing attributes in process `syz.3.868'. [ 106.078857][ T8824] db_root: cannot open: ./m [ 106.152635][ T42] audit: type=1400 audit(1792743510.235:11443): avc: denied { write } for pid=8827 comm="syz.3.870" name="nbd3" dev="devtmpfs" ino=691 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 106.176891][ T7463] usb usb7-port1: attempt power cycle [ 106.327137][ T8833] netlink: 20 bytes leftover after parsing attributes in process `syz.0.871'. [ 106.447965][ T8842] netlink: 24 bytes leftover after parsing attributes in process `syz.0.874'. [ 106.448000][ T8842] netlink: 24 bytes leftover after parsing attributes in process `syz.0.874'. [ 106.477776][ T8844] netlink: 'syz.0.875': attribute type 14 has an invalid length. [ 106.477797][ T8844] netlink: 4 bytes leftover after parsing attributes in process `syz.0.875'. [ 106.528439][ T8844] netlink: 'syz.0.875': attribute type 14 has an invalid length. [ 106.536582][ T7463] usb 7-1: new full-speed USB device number 9 using dummy_hcd [ 106.557566][ T7463] usb 7-1: device descriptor read/8, error -71 [ 106.639943][ T42] audit: type=1400 audit(1792743510.725:11444): avc: denied { listen } for pid=8848 comm="syz.0.877" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 106.672192][ T8849] netlink: 'syz.0.877': attribute type 1 has an invalid length. [ 106.826611][ T7463] usb 7-1: new full-speed USB device number 10 using dummy_hcd [ 106.849300][ T7463] usb 7-1: device descriptor read/8, error -71 [ 106.966716][ T7463] usb usb7-port1: unable to enumerate USB device [ 107.013375][ T8862] Invalid logical block size (128) [ 107.072623][ T42] audit: type=1400 audit(1792743511.155:11445): avc: denied { setattr } for pid=8868 comm="syz.1.883" name="/" dev="configfs" ino=3101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 107.149012][ T8871] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 107.150542][ T8871] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 107.256577][ T952] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 107.266574][ T8873] netlink: 'syz.0.885': attribute type 1 has an invalid length. [ 107.266896][ T8873] 8021q: VLANs not supported on tunl0 [ 107.320624][ T42] audit: type=1400 audit(1792743511.405:11446): avc: denied { read write } for pid=8875 comm="syz.0.886" name="mtrr" dev="proc" ino=4026531995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 107.417722][ T952] usb 8-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 107.418552][ T952] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 107.419301][ T952] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 107.421116][ T952] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.421128][ T952] usb 8-1: Product: syz [ 107.421135][ T952] usb 8-1: Manufacturer: syz [ 107.421142][ T952] usb 8-1: SerialNumber: syz [ 107.424474][ T952] ti_usb_3410_5052 8-1:2.0: TI USB 5052 2 port adapter converter detected [ 107.427073][ T952] usb 8-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 107.428868][ T952] usb 8-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 107.607404][ T5881] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 108.034367][ C3] usb 8-1: ti_interrupt_callback - nonzero urb status, -71 [ 108.034599][ C3] usb 8-1: ti_interrupt_callback - nonzero urb status, -71 [ 108.034778][ C3] usb 8-1: ti_interrupt_callback - nonzero urb status, -71 [ 108.034954][ C3] usb 8-1: ti_interrupt_callback - nonzero urb status, -71 [ 108.034963][ C3] usb 8-1: ti_interrupt_callback - resubmit interrupt urb failed, -19 [ 108.034971][ T10] usb 8-1: USB disconnect, device number 16 [ 108.035785][ T8864] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot clear input buffers, -71 [ 108.036819][ T952] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 108.043349][ T10] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 108.051517][ T10] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 108.052216][ T10] ti_usb_3410_5052 8-1:2.0: device disconnected [ 108.196568][ T952] usb 6-1: Using ep0 maxpacket: 32 [ 108.198125][ T952] usb 6-1: unable to get BOS descriptor or descriptor too short [ 108.198148][ T952] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 108.201050][ T952] usb 6-1: string descriptor 0 read error: -22 [ 108.201102][ T952] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.207396][ T952] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 108.207425][ T952] dw2102: su3000_power_ctrl: 1, initialized 0 [ 108.207438][ T952] dvb-usb: bulk message failed: -22 (2/0) [ 108.225151][ T952] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 108.228205][ T952] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 108.228244][ T952] usb 6-1: media controller created [ 108.228263][ T952] dvb-usb: bulk message failed: -22 (6/0) [ 108.228274][ T952] dw2102: i2c transfer failed. [ 108.228285][ T952] dvb-usb: bulk message failed: -22 (6/0) [ 108.228294][ T952] dw2102: i2c transfer failed. [ 108.228305][ T952] dvb-usb: bulk message failed: -22 (6/0) [ 108.228314][ T952] dw2102: i2c transfer failed. [ 108.228323][ T952] dvb-usb: bulk message failed: -22 (6/0) [ 108.228332][ T952] dw2102: i2c transfer failed. [ 108.228342][ T952] dvb-usb: bulk message failed: -22 (6/0) [ 108.228351][ T952] dw2102: i2c transfer failed. [ 108.228359][ T952] dvb-usb: bulk message failed: -22 (6/0) [ 108.228370][ T952] dw2102: i2c transfer failed. [ 108.228376][ T952] dvb-usb: MAC address: 02:02:02:02:02:02 [ 108.243647][ T952] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 108.255048][ T952] dvb-usb: bulk message failed: -22 (3/0) [ 108.255063][ T952] dw2102: command 0x0e transfer failed. [ 108.255068][ T952] dvb-usb: bulk message failed: -22 (3/0) [ 108.255080][ T952] dw2102: command 0x0e transfer failed. [ 108.436857][ T8911] block nbd2: NBD_DISCONNECT [ 108.444599][ T8911] netlink: 'syz.2.896': attribute type 1 has an invalid length. [ 108.444853][ T8911] 8021q: VLANs not supported on tunl0 [ 108.479437][ T8916] VFS: Mount too revealing [ 108.566792][ T952] dvb-usb: bulk message failed: -22 (3/0) [ 108.566811][ T952] dw2102: command 0x0e transfer failed. [ 108.566817][ T952] dvb-usb: bulk message failed: -22 (3/0) [ 108.566826][ T952] dw2102: command 0x0e transfer failed. [ 108.566831][ T952] dvb-usb: bulk message failed: -22 (1/0) [ 108.566840][ T952] dw2102: command 0x51 transfer failed. [ 108.569518][ T8899] dvb-usb: bulk message failed: -22 (30/0) [ 108.569531][ T8899] dw2102: i2c transfer failed. [ 108.590002][ T952] DVB: Unable to find symbol ds3000_attach() [ 108.590011][ T952] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 108.591915][ T8921] FAULT_INJECTION: forcing a failure. [ 108.591915][ T8921] name failslab, interval 1, probability 0, space 0, times 0 [ 108.591944][ T8921] CPU: 2 UID: 0 PID: 8921 Comm: syz.0.899 Tainted: G L syzkaller #0 PREEMPT(full) [ 108.591969][ T8921] Tainted: [L]=SOFTLOCKUP [ 108.591975][ T8921] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 108.591985][ T8921] Call Trace: [ 108.591991][ T8921] [ 108.591999][ T8921] dump_stack_lvl+0x100/0x190 [ 108.592029][ T8921] should_fail_ex.cold+0x5/0xa [ 108.592057][ T8921] should_failslab+0xc2/0x120 [ 108.592085][ T8921] kmem_cache_alloc_noprof+0x92/0x6a0 [ 108.592109][ T8921] ? __pfx_map_id_range_down+0x10/0x10 [ 108.592131][ T8921] ? rcu_is_watching+0x13/0xc0 [ 108.592157][ T8921] ? security_inode_alloc+0x3b/0x2c0 [ 108.592188][ T8921] security_inode_alloc+0x3b/0x2c0 [ 108.592213][ T8921] inode_init_always_gfp+0xc6f/0xfb0 [ 108.592245][ T8921] alloc_inode+0x8e/0x250 [ 108.592268][ T8921] sock_alloc+0x42/0x240 [ 108.592292][ T8921] __sock_create+0xc2/0x860 [ 108.592321][ T8921] __sys_socketpair+0x261/0x5b0 [ 108.592351][ T8921] ? __pfx___sys_socketpair+0x10/0x10 [ 108.592380][ T8921] ? xfd_validate_state+0x129/0x190 [ 108.592407][ T8921] __x64_sys_socketpair+0x96/0x100 [ 108.592432][ T8921] ? lockdep_hardirqs_on+0x7d/0x110 [ 108.592459][ T8921] do_syscall_64+0x123/0x790 [ 108.592496][ T8921] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.592516][ T8921] RIP: 0033:0x7f384c39f559 [ 108.592531][ T8921] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.592550][ T8921] RSP: 002b:00007f384d191028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 108.592569][ T8921] RAX: ffffffffffffffda RBX: 00007f384c625fa0 RCX: 00007f384c39f559 [ 108.592582][ T8921] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 108.592593][ T8921] RBP: 00007f384c436b20 R08: 0000000000000000 R09: 0000000000000000 [ 108.592604][ T8921] R10: 0000200000000300 R11: 0000000000000246 R12: 0000000000000000 [ 108.592616][ T8921] R13: 00007f384c626038 R14: 00007f384c625fa0 R15: 00007ffe006fc518 [ 108.592640][ T8921] [ 108.592660][ T8921] socket: no more sockets [ 108.646656][ T952] rc_core: IR keymap rc-su3000 not found [ 108.646666][ T952] Registered IR keymap rc-empty [ 108.650863][ T952] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.1/usb6/6-1/rc/rc0 [ 108.651709][ T952] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.1/usb6/6-1/rc/rc0/input15 [ 108.655371][ T952] dvb-usb: schedule remote query interval to 150 msecs. [ 108.655383][ T952] dw2102: su3000_power_ctrl: 0, initialized 1 [ 108.655389][ T952] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 108.730211][ T8938] jffs2: notice: (8938) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 3 of xref (0 dead, 0 orphan) found. [ 108.809225][ T952] dvb-usb: bulk message failed: -22 (1/0) [ 108.809247][ T952] dw2102: i2c transfer failed. [ 108.976544][ T64] dvb-usb: bulk message failed: -22 (1/0) [ 108.976560][ T64] dw2102: i2c transfer failed. [ 109.012416][ T64] usb 6-1: USB disconnect, device number 5 [ 109.035357][ T64] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 109.114928][ T8941] nvme_fabrics: found same hostid cbf9f5a7-4696-4279-ba96-52cbeced05d2 but different hostnqn n [ 109.160187][ T8944] netlink: 'syz.1.905': attribute type 1 has an invalid length. [ 109.199328][ T8944] bridge1: entered promiscuous mode [ 109.205738][ T8944] bond3: (slave bridge1): making interface the new active one [ 109.206566][ T8944] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 109.300277][ T8951] batman_adv: batadv0: Adding interface: syzkaller0 [ 109.300294][ T8951] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.300318][ T8951] batman_adv: batadv0: Interface activated: syzkaller0 [ 109.318176][ T8950] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 109.334916][ T8950] batman_adv: batadv0: Removing interface: syzkaller0 [ 109.383611][ T8957] __nla_validate_parse: 12 callbacks suppressed [ 109.383623][ T8957] netlink: 24 bytes leftover after parsing attributes in process `syz.3.910'. [ 109.385682][ T8957] netlink: 12 bytes leftover after parsing attributes in process `syz.3.910'. [ 109.395390][ T8961] netlink: 52 bytes leftover after parsing attributes in process `syz.0.912'. [ 109.457949][ T8970] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=3 sclass=netlink_route_socket pid=8970 comm=syz.3.915 [ 109.508264][ T8980] block nbd2: shutting down sockets [ 109.566390][ T8996] netlink: 12 bytes leftover after parsing attributes in process `syz.2.920'. [ 109.566418][ T8996] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 109.616229][ T9002] sctp: [Deprecated]: syz.3.921 (pid 9002) Use of struct sctp_assoc_value in delayed_ack socket option. [ 109.616229][ T9002] Use struct sctp_sack_info instead [ 109.680818][ T9014] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=6 sclass=netlink_route_socket pid=9014 comm=syz.2.923 [ 109.681206][ T9014] netlink: 20 bytes leftover after parsing attributes in process `syz.2.923'. [ 109.685136][ T9014] fuse: Bad value for 'fd' [ 109.685998][ T9014] fuse: Bad value for 'fd' [ 109.735634][ T9016] syz.1.927 (9016) used greatest stack depth: 19224 bytes left [ 109.799288][ T9020] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.893540][ T9031] program syz.1.932 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 109.897559][ T9031] program syz.1.932 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 109.992346][ T5481] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 110.232606][ T9057] hugetlbfs: syz.1.938 (9057): Using mlock ulimits for SHM_HUGETLB is obsolete [ 110.645102][ T9068] netlink: 44 bytes leftover after parsing attributes in process `syz.3.942'. [ 110.669301][ T9068] rxe_eth0 speed is unknown, defaulting to 1000 [ 110.819996][ T9068] wg2 speed is unknown, defaulting to 1000 [ 111.297273][ T42] kauditd_printk_skb: 39 callbacks suppressed [ 111.297292][ T42] audit: type=1400 audit(1792743515.385:11486): avc: denied { create } for pid=9087 comm="syz.1.946" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 111.297877][ T42] audit: type=1400 audit(1792743515.385:11487): avc: denied { write } for pid=9087 comm="syz.1.946" path="socket:[27959]" dev="sockfs" ino=27959 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 111.301143][ T9088] tipc: Started in network mode [ 111.301158][ T9088] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 111.301298][ T9088] tipc: Enabled bearer , priority 0 [ 111.390013][ T9092] netlink: 28 bytes leftover after parsing attributes in process `syz.1.947'. [ 111.390531][ T42] audit: type=1326 audit(1792743515.475:11488): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9089 comm="syz.1.947" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f097f79f559 code=0x0 [ 111.635385][ T42] audit: type=1400 audit(1792743515.715:11489): avc: denied { create } for pid=9106 comm="syz.2.953" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 111.650633][ T9113] netlink: 12 bytes leftover after parsing attributes in process `syz.1.952'. [ 111.670486][ T9113] bond5: entered promiscuous mode [ 111.670536][ T9113] bond5: entered allmulticast mode [ 111.670854][ T9113] 8021q: adding VLAN 0 to HW filter on device bond5 [ 111.680636][ T9113] erspan1: entered allmulticast mode [ 111.682724][ T9113] erspan1: entered promiscuous mode [ 111.684613][ T9113] bond5: (slave erspan1): Enslaving as an active interface with an up link [ 111.695511][ T9107] kvm [9106]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 111.696191][ T9107] kvm [9106]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 111.759769][ T42] audit: type=1400 audit(1792743515.845:11490): avc: denied { ioctl } for pid=9120 comm="syz.1.955" path="socket:[29988]" dev="sockfs" ino=29988 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 111.760596][ T42] audit: type=1400 audit(1792743515.845:11491): avc: denied { write } for pid=9120 comm="syz.1.955" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=socket permissive=1 [ 111.918887][ T9138] netlink: 32 bytes leftover after parsing attributes in process `syz.3.960'. [ 111.923210][ T9145] netlink: 32 bytes leftover after parsing attributes in process `syz.3.960'. [ 111.966112][ T42] audit: type=1400 audit(1792743516.045:11492): avc: denied { read } for pid=9148 comm="syz.3.962" name="fb0" dev="devtmpfs" ino=638 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 111.966214][ T42] audit: type=1400 audit(1792743516.045:11493): avc: denied { open } for pid=9148 comm="syz.3.962" path="/dev/fb0" dev="devtmpfs" ino=638 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 111.970317][ T42] audit: type=1400 audit(1792743516.055:11494): avc: denied { ioctl } for pid=9148 comm="syz.3.962" path="/dev/fb0" dev="devtmpfs" ino=638 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 112.416624][ T5873] tipc: Node number set to 11578026 [ 112.795679][ T9172] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 112.796109][ T9167] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 112.798421][ T9172] VFS: Can't find a romfs filesystem on dev nullb0. [ 112.798421][ T9172] [ 112.814308][ T9167] VFS: Can't find a romfs filesystem on dev nullb0. [ 112.814308][ T9167] [ 112.846970][ T42] audit: type=1400 audit(1792743516.935:11495): avc: denied { mounton } for pid=9175 comm="syz.2.969" path="/syzcgroup/unified/syz2" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 112.849654][ T9176] gfs2: error -5 reading superblock [ 112.882312][ T9179] netlink: 'syz.3.968': attribute type 11 has an invalid length. [ 112.915331][ T9181] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 112.963893][ T9184] tipc: Enabling of bearer rejected, failed to enable media [ 112.966993][ T9187] tipc: Enabling of bearer rejected, failed to enable media [ 113.052560][ T9203] lo: entered allmulticast mode [ 113.281803][ T9201] kvm_intel: kvm [9200]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x1d9) = 0x51ed [ 113.290043][ T9201] kvm [9200]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x187) = 0x2c2f [ 113.290251][ T9201] kvm [9200]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x186) = 0xa9c7 [ 113.300809][ T9201] kvm [9200]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x11e) = 0xbb8d [ 113.685173][ T9238] phram: illegal start address [ 113.885494][ T9202] lo: left allmulticast mode [ 114.012764][ T9258] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=10000 sclass=netlink_route_socket pid=9258 comm=syz.3.987 [ 114.079555][ T9267] binder: 9264:9267 ioctl 4018620d 200000000040 returned -22 [ 114.151811][ T9271] netlink: 'syz.3.992': attribute type 10 has an invalid length. [ 114.159939][ T5881] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.446662][ T9286] __nla_validate_parse: 4 callbacks suppressed [ 114.446680][ T9286] netlink: 8 bytes leftover after parsing attributes in process `syz.1.997'. [ 114.447625][ T9286] netlink: 8 bytes leftover after parsing attributes in process `syz.1.997'. [ 114.447844][ T9286] netlink: 8 bytes leftover after parsing attributes in process `syz.1.997'. [ 114.448065][ T9286] netlink: 8 bytes leftover after parsing attributes in process `syz.1.997'. [ 114.448225][ T9286] netlink: 8 bytes leftover after parsing attributes in process `syz.1.997'. [ 114.448377][ T9286] netlink: 8 bytes leftover after parsing attributes in process `syz.1.997'. [ 114.448624][ T9286] netlink: 8 bytes leftover after parsing attributes in process `syz.1.997'. [ 114.448776][ T9286] netlink: 8 bytes leftover after parsing attributes in process `syz.1.997'. [ 114.448931][ T9286] netlink: 8 bytes leftover after parsing attributes in process `syz.1.997'. [ 114.449080][ T9286] netlink: 8 bytes leftover after parsing attributes in process `syz.1.997'. [ 114.488117][ T9286] rxe_eth0 speed is unknown, defaulting to 1000 [ 114.640159][ T9291] x_tables: duplicate underflow at hook 2 [ 114.655630][ T9286] wg2 speed is unknown, defaulting to 1000 [ 114.883211][ T9299] usb usb8: usbfs: process 9299 (syz.2.999) did not claim interface 0 before use [ 114.885472][ T9299] x_tables: ip6_tables: sctp match: only valid for protocol 132 [ 115.279430][ T9306] openvswitch: netlink: IP tunnel dst address not specified [ 115.885008][ T9315] fuse: Unknown parameter 'Jro“p_iñùd' [ 115.946720][ T9317] virtio-fs: tag not found [ 116.252707][ T9326] netlink: 'syz.1.1009': attribute type 10 has an invalid length. [ 116.252760][ T9326] tipc: Resetting bearer [ 116.261206][ T9326] tipc: Disabling bearer [ 116.274480][ T9326] team0 (unregistering): Port device team_slave_0 removed [ 116.285039][ T9326] team0 (unregistering): Port device team_slave_1 removed [ 116.309410][ T9327] pimreg0: tun_chr_ioctl cmd 1074025676 [ 116.309425][ T9327] pimreg0: owner set to 0 [ 116.311303][ T42] kauditd_printk_skb: 17 callbacks suppressed [ 116.311317][ T42] audit: type=1400 audit(1792743520.395:11513): avc: denied { ioctl } for pid=9325 comm="syz.1.1009" path="socket:[28234]" dev="sockfs" ino=28234 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 116.367733][ T9331] rxe_eth0 speed is unknown, defaulting to 1000 [ 116.428462][ T42] audit: type=1400 audit(1792743520.515:11514): avc: denied { getopt } for pid=9335 comm="syz.1.1013" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 116.429687][ T42] audit: type=1326 audit(1792743520.515:11515): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9335 comm="syz.1.1013" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f097f79f559 code=0x0 [ 116.435523][ T42] audit: type=1326 audit(1792743520.515:11516): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9335 comm="syz.1.1013" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f097f79f559 code=0x0 [ 116.490775][ T9331] wg2 speed is unknown, defaulting to 1000 [ 116.656581][ T7463] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 116.826666][ T7463] usb 8-1: Using ep0 maxpacket: 16 [ 116.827367][ T7463] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 116.827913][ T7463] usb 8-1: config 0 has no interfaces? [ 116.828821][ T7463] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 116.828838][ T7463] usb 8-1: Manufacturer: syz [ 116.830977][ T7463] usb 8-1: config 0 descriptor?? [ 117.033364][ T42] audit: type=1326 audit(1792743521.115:11517): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9330 comm="syz.3.1011" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc0d4d9f559 code=0x0 [ 117.138829][ T5770] usb 8-1: USB disconnect, device number 17 [ 117.225339][ T42] audit: type=1326 audit(1792743521.305:11518): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9330 comm="syz.3.1011" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc0d4d9f559 code=0x0 [ 117.254349][ T9343] rxe_eth0 speed is unknown, defaulting to 1000 [ 117.395705][ T42] audit: type=1400 audit(1792743521.542:11519): avc: denied { append } for pid=9361 comm="syz.2.1017" name="001" dev="devtmpfs" ino=763 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 117.491040][ T9343] wg2 speed is unknown, defaulting to 1000 [ 117.584189][ T9370] syzkaller1: entered promiscuous mode [ 117.584212][ T9370] syzkaller1: entered allmulticast mode [ 117.591084][ T42] audit: type=1400 audit(1792743521.742:11520): avc: denied { write } for pid=9369 comm="syz.2.1020" name="fb0" dev="devtmpfs" ino=638 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 118.078873][ T42] audit: type=1400 audit(1792743522.232:11521): avc: denied { read } for pid=9379 comm="syz.1.1022" path="socket:[30433]" dev="sockfs" ino=30433 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 118.130542][ T42] audit: type=1400 audit(1792743522.282:11522): avc: denied { shutdown } for pid=9379 comm="syz.1.1022" lport=4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 118.259090][ T9387] Invalid argument reading file caps for ./file0 [ 119.027947][ T9396] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 119.085188][ T9401] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 119.085848][ T9394] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 119.312019][ T9411] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 119.410759][ T9418] netlink: 'syz.3.1032': attribute type 1 has an invalid length. [ 119.516848][ T9422] __nla_validate_parse: 25 callbacks suppressed [ 119.516866][ T9422] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1034'. [ 119.609284][ T9413] syz.1.1031 (9413): drop_caches: 2 [ 119.712875][ T9434] netlink: 6024 bytes leftover after parsing attributes in process `syz.3.1037'. [ 119.802245][ T9442] team0: Device ipip0 is up. Set it down before adding it as a team port [ 120.638757][ T9483] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1049'. [ 120.642064][ T9484] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1049'. [ 121.116639][ T5858] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 121.121042][ T9503] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 121.176594][ T5859] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 121.286560][ T5858] usb 6-1: Using ep0 maxpacket: 8 [ 121.289500][ T5858] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 121.290542][ T5858] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 121.290578][ T5858] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 121.290596][ T5858] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 121.290616][ T5858] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 121.290635][ T5858] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 121.290666][ T5858] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.358421][ T5859] usb 7-1: Using ep0 maxpacket: 32 [ 121.361299][ T5859] usb 7-1: unable to get BOS descriptor or descriptor too short [ 121.361336][ T5859] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 121.366677][ T5859] usb 7-1: string descriptor 0 read error: -22 [ 121.366851][ T5859] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.380666][ T5859] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 121.380699][ T5859] dw2102: su3000_power_ctrl: 1, initialized 0 [ 121.380711][ T5859] dvb-usb: bulk message failed: -22 (2/0) [ 121.386739][ T5859] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 121.388228][ T5859] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 121.388265][ T5859] usb 7-1: media controller created [ 121.388285][ T5859] dvb-usb: bulk message failed: -22 (6/0) [ 121.388295][ T5859] dw2102: i2c transfer failed. [ 121.388305][ T5859] dvb-usb: bulk message failed: -22 (6/0) [ 121.388315][ T5859] dw2102: i2c transfer failed. [ 121.388372][ T5859] dvb-usb: bulk message failed: -22 (6/0) [ 121.388384][ T5859] dw2102: i2c transfer failed. [ 121.388392][ T5859] dvb-usb: bulk message failed: -22 (6/0) [ 121.388402][ T5859] dw2102: i2c transfer failed. [ 121.388411][ T5859] dvb-usb: bulk message failed: -22 (6/0) [ 121.388420][ T5859] dw2102: i2c transfer failed. [ 121.388429][ T5859] dvb-usb: bulk message failed: -22 (6/0) [ 121.388438][ T5859] dw2102: i2c transfer failed. [ 121.388444][ T5859] dvb-usb: MAC address: 02:02:02:02:02:02 [ 121.416803][ T5859] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 121.441926][ T5859] dvb-usb: bulk message failed: -22 (3/0) [ 121.441943][ T5859] dw2102: command 0x0e transfer failed. [ 121.441950][ T5859] dvb-usb: bulk message failed: -22 (3/0) [ 121.441963][ T5859] dw2102: command 0x0e transfer failed. [ 121.499132][ T5858] usb 6-1: GET_CAPABILITIES returned 0 [ 121.499171][ T5858] usbtmc 6-1:16.0: can't read capabilities [ 121.703745][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.704304][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.704341][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.704372][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.704580][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.704617][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.704651][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.704686][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.704890][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.704925][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.705133][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.705170][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.705204][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.705239][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.705438][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.705469][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 121.746804][ T5859] dvb-usb: bulk message failed: -22 (3/0) [ 121.746820][ T5859] dw2102: command 0x0e transfer failed. [ 121.746827][ T5859] dvb-usb: bulk message failed: -22 (3/0) [ 121.746837][ T5859] dw2102: command 0x0e transfer failed. [ 121.746843][ T5859] dvb-usb: bulk message failed: -22 (1/0) [ 121.746853][ T5859] dw2102: command 0x51 transfer failed. [ 121.772555][ T5859] DVB: Unable to find symbol ds3000_attach() [ 121.772568][ T5859] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 121.780315][ T9508] ./dev/sda1: Can't open blockdev [ 121.826696][ T5859] rc_core: IR keymap rc-su3000 not found [ 121.826711][ T5859] Registered IR keymap rc-empty [ 121.829068][ T5859] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0 [ 121.830963][ T5859] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0/input16 [ 121.847559][ T5859] dvb-usb: schedule remote query interval to 150 msecs. [ 121.847577][ T5859] dw2102: su3000_power_ctrl: 0, initialized 1 [ 121.847586][ T5859] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 121.858517][ T5859] usb 7-1: USB disconnect, device number 11 [ 121.896539][ T5873] usb 6-1: USB disconnect, device number 6 [ 121.920290][ T5859] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 121.968719][ T42] kauditd_printk_skb: 19 callbacks suppressed [ 121.968736][ T42] audit: type=1400 audit(1792743526.122:11542): avc: denied { unmount } for pid=5776 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 121.997400][ T42] audit: type=1400 audit(1792743526.152:11543): avc: denied { map } for pid=9509 comm="syz.3.1059" path="pipe:[29252]" dev="pipefs" ino=29252 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 122.111171][ T9521] FAULT_INJECTION: forcing a failure. [ 122.111171][ T9521] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 122.111203][ T9521] CPU: 2 UID: 0 PID: 9521 Comm: syz.2.1061 Tainted: G L syzkaller #0 PREEMPT(full) [ 122.111227][ T9521] Tainted: [L]=SOFTLOCKUP [ 122.111233][ T9521] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 122.111245][ T9521] Call Trace: [ 122.111251][ T9521] [ 122.111258][ T9521] dump_stack_lvl+0x100/0x190 [ 122.111291][ T9521] should_fail_ex.cold+0x5/0xa [ 122.111328][ T9521] _copy_from_user+0x2e/0xd0 [ 122.111355][ T9521] copy_from_sockptr_offset.constprop.0+0x12c/0x150 [ 122.111383][ T9521] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 122.111417][ T9521] do_sock_getsockopt+0x530/0x6e0 [ 122.111446][ T9521] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 122.111475][ T9521] ? __fget_files+0x34/0x3d0 [ 122.111504][ T9521] ? find_held_lock+0x2b/0x80 [ 122.111538][ T9521] ? __fget_files+0x21f/0x3d0 [ 122.111570][ T9521] __sys_getsockopt+0x148/0x260 [ 122.111597][ T9521] ? __x64_sys_getsockopt+0xbd/0x160 [ 122.111619][ T9521] __x64_sys_getsockopt+0xbd/0x160 [ 122.111637][ T9521] ? do_syscall_64+0xae/0x790 [ 122.111664][ T9521] ? lockdep_hardirqs_on+0x7d/0x110 [ 122.111692][ T9521] do_syscall_64+0x123/0x790 [ 122.111721][ T9521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.111740][ T9521] RIP: 0033:0x7f7d3eb9f559 [ 122.111756][ T9521] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.111774][ T9521] RSP: 002b:00007f7d3fb2f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 122.111816][ T9521] RAX: ffffffffffffffda RBX: 00007f7d3ee25fa0 RCX: 00007f7d3eb9f559 [ 122.111828][ T9521] RDX: 000000000000000b RSI: 0000000000000112 RDI: 0000000000000004 [ 122.111839][ T9521] RBP: 00007f7d3fb2f090 R08: 00002000000001c0 R09: 0000000000000000 [ 122.111850][ T9521] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 122.111860][ T9521] R13: 00007f7d3ee26038 R14: 00007f7d3ee25fa0 R15: 00007ffe7491f518 [ 122.111887][ T9521] [ 122.163320][ T9525] netlink: 'syz.2.1063': attribute type 2 has an invalid length. [ 122.163341][ T9525] netlink: 'syz.2.1063': attribute type 2 has an invalid length. [ 122.182910][ T9527] netlink: 'syz.3.1064': attribute type 39 has an invalid length. [ 122.221674][ T42] audit: type=1400 audit(1792743526.372:11544): avc: denied { write } for pid=9528 comm="syz.2.1065" name="renderD128" dev="devtmpfs" ino=634 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 122.380032][ T9540] EXT4-fs warning (device sda1): verify_group_input:166: Cannot read last block (265231) [ 122.418298][ T9540] EXT4-fs warning (device sda1): verify_group_input:166: Cannot read last block (265231) [ 122.418391][ T9540] EXT4-fs warning (device sda1): verify_group_input:166: Cannot read last block (265231) [ 122.418471][ T9540] EXT4-fs warning (device sda1): verify_group_input:166: Cannot read last block (265231) [ 122.418558][ T9540] EXT4-fs warning (device sda1): verify_group_input:166: Cannot read last block (265231) [ 122.418674][ T9540] EXT4-fs warning (device sda1): verify_group_input:166: Cannot read last block (265231) [ 122.418755][ T9540] EXT4-fs warning (device sda1): verify_group_input:166: Cannot read last block (265231) [ 122.418834][ T9540] EXT4-fs warning (device sda1): verify_group_input:166: Cannot read last block (265231) [ 122.418913][ T9540] EXT4-fs warning (device sda1): verify_group_input:166: Cannot read last block (265231) [ 122.418997][ T9540] EXT4-fs warning (device sda1): verify_group_input:166: Cannot read last block (265231) [ 122.505538][ T42] audit: type=1400 audit(1792743526.652:11545): avc: denied { create } for pid=9546 comm="syz.3.1070" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 122.509473][ T9547] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2573 sclass=netlink_route_socket pid=9547 comm=syz.3.1070 [ 122.510335][ T42] audit: type=1400 audit(1792743526.662:11546): avc: denied { connect } for pid=9546 comm="syz.3.1070" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 122.526514][ T9549] FAULT_INJECTION: forcing a failure. [ 122.526514][ T9549] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 122.526547][ T9549] CPU: 0 UID: 0 PID: 9549 Comm: syz.1.1071 Tainted: G L syzkaller #0 PREEMPT(full) [ 122.526571][ T9549] Tainted: [L]=SOFTLOCKUP [ 122.526578][ T9549] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 122.526589][ T9549] Call Trace: [ 122.526595][ T9549] [ 122.526602][ T9549] dump_stack_lvl+0x100/0x190 [ 122.526632][ T9549] should_fail_ex.cold+0x5/0xa [ 122.526657][ T9549] _copy_from_user+0x2e/0xd0 [ 122.526706][ T9549] copy_from_sockptr_offset.constprop.0+0x12c/0x150 [ 122.526736][ T9549] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 122.526770][ T9549] do_sock_getsockopt+0x2d0/0x6e0 [ 122.526799][ T9549] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 122.526827][ T9549] ? __fget_files+0x34/0x3d0 [ 122.526854][ T9549] ? find_held_lock+0x2b/0x80 [ 122.526887][ T9549] ? __fget_files+0x21f/0x3d0 [ 122.526919][ T9549] __sys_getsockopt+0x148/0x260 [ 122.526946][ T9549] ? __x64_sys_getsockopt+0xbd/0x160 [ 122.526965][ T9549] __x64_sys_getsockopt+0xbd/0x160 [ 122.526983][ T9549] ? do_syscall_64+0xae/0x790 [ 122.527009][ T9549] ? lockdep_hardirqs_on+0x7d/0x110 [ 122.527034][ T9549] do_syscall_64+0x123/0x790 [ 122.527062][ T9549] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.527080][ T9549] RIP: 0033:0x7f097f79f559 [ 122.527095][ T9549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.527111][ T9549] RSP: 002b:00007f0980609028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 122.527129][ T9549] RAX: ffffffffffffffda RBX: 00007f097fa25fa0 RCX: 00007f097f79f559 [ 122.527141][ T9549] RDX: 000000000000000b RSI: 0000000000000112 RDI: 0000000000000004 [ 122.527151][ T9549] RBP: 00007f0980609090 R08: 00002000000001c0 R09: 0000000000000000 [ 122.527162][ T9549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 122.527173][ T9549] R13: 00007f097fa26038 R14: 00007f097fa25fa0 R15: 00007ffcb30bb3a8 [ 122.527198][ T9549] [ 122.566267][ T42] audit: type=1400 audit(1792743526.712:11547): avc: denied { write } for pid=9546 comm="syz.3.1070" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 122.631232][ T5558] rxe_eth0 speed is unknown, defaulting to 1000 [ 122.675762][ T42] audit: type=1400 audit(1792743526.822:11548): avc: denied { ioctl } for pid=9559 comm="syz.2.1076" path="/dev/input/event1" dev="devtmpfs" ino=941 ioctlcmd=0x40284504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 122.675981][ T9560] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1076'. [ 122.689114][ T9560] bond3: entered promiscuous mode [ 122.692624][ T9560] 8021q: adding VLAN 0 to HW filter on device bond3 [ 122.695758][ T9560] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1076'. [ 122.707145][ T9560] 8021q: adding VLAN 0 to HW filter on device bond3 [ 122.707482][ T9560] bond3: (slave wireguard0): The slave device specified does not support setting the MAC address [ 122.708032][ T9560] bond3: (slave wireguard0): Error -95 calling set_mac_address [ 122.731695][ T42] audit: type=1400 audit(1792743526.882:11549): avc: denied { execute } for pid=9557 comm="syz.1.1075" path="/cgroup.freeze" dev="ramfs" ino=31761 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 122.790576][ T42] audit: type=1400 audit(1792743526.942:11550): avc: denied { map } for pid=9557 comm="syz.1.1075" path="/dev/bus/usb/002/001" dev="devtmpfs" ino=744 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 122.869449][ T9572] overlay: Bad value for 'workdir' [ 123.028756][ T42] audit: type=1326 audit(1792743527.182:11551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9571 comm="syz.2.1077" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d3eb9f559 code=0x7fc00000 [ 123.780046][ T9586] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1080'. [ 123.788906][ T9588] FAULT_INJECTION: forcing a failure. [ 123.788906][ T9588] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 123.788934][ T9588] CPU: 2 UID: 0 PID: 9588 Comm: syz.3.1081 Tainted: G L syzkaller #0 PREEMPT(full) [ 123.788956][ T9588] Tainted: [L]=SOFTLOCKUP [ 123.788962][ T9588] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 123.788972][ T9588] Call Trace: [ 123.788978][ T9588] [ 123.788985][ T9588] dump_stack_lvl+0x100/0x190 [ 123.789014][ T9588] should_fail_ex.cold+0x5/0xa [ 123.789040][ T9588] _copy_to_user+0x32/0xd0 [ 123.789062][ T9588] do_sock_getsockopt+0x631/0x6e0 [ 123.789088][ T9588] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 123.789115][ T9588] ? __fget_files+0x34/0x3d0 [ 123.789140][ T9588] ? find_held_lock+0x2b/0x80 [ 123.789170][ T9588] ? __fget_files+0x21f/0x3d0 [ 123.789199][ T9588] __sys_getsockopt+0x148/0x260 [ 123.789225][ T9588] ? __x64_sys_getsockopt+0xbd/0x160 [ 123.789243][ T9588] __x64_sys_getsockopt+0xbd/0x160 [ 123.789260][ T9588] ? do_syscall_64+0xae/0x790 [ 123.789284][ T9588] ? lockdep_hardirqs_on+0x7d/0x110 [ 123.789308][ T9588] do_syscall_64+0x123/0x790 [ 123.789333][ T9588] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.789350][ T9588] RIP: 0033:0x7fc0d4d9f559 [ 123.789364][ T9588] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.789380][ T9588] RSP: 002b:00007fc0d5c18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 123.789397][ T9588] RAX: ffffffffffffffda RBX: 00007fc0d5025fa0 RCX: 00007fc0d4d9f559 [ 123.789408][ T9588] RDX: 000000000000000b RSI: 0000000000000112 RDI: 0000000000000004 [ 123.789418][ T9588] RBP: 00007fc0d5c18090 R08: 00002000000001c0 R09: 0000000000000000 [ 123.789426][ T9588] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 123.789433][ T9588] R13: 00007fc0d5026038 R14: 00007fc0d5025fa0 R15: 00007fffb9d75518 [ 123.789450][ T9588] [ 123.789639][ T9586] macvtap1: entered promiscuous mode [ 123.792092][ T9586] macvtap1: entered allmulticast mode [ 123.792103][ T9586] gretap0: entered allmulticast mode [ 123.812165][ T9586] gretap0: left allmulticast mode [ 123.813506][ T9586] macvtap1: left promiscuous mode [ 123.813517][ T9586] macvtap1: left allmulticast mode [ 124.117677][ T952] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 124.148912][ T9604] FAULT_INJECTION: forcing a failure. [ 124.148912][ T9604] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 124.148944][ T9604] CPU: 2 UID: 0 PID: 9604 Comm: syz.3.1088 Tainted: G L syzkaller #0 PREEMPT(full) [ 124.148970][ T9604] Tainted: [L]=SOFTLOCKUP [ 124.148977][ T9604] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 124.148988][ T9604] Call Trace: [ 124.148995][ T9604] [ 124.149003][ T9604] dump_stack_lvl+0x100/0x190 [ 124.149034][ T9604] should_fail_ex.cold+0x5/0xa [ 124.149062][ T9604] copy_fpstate_to_sigframe+0x871/0xb60 [ 124.149088][ T9604] ? do_raw_spin_lock+0x128/0x260 [ 124.149115][ T9604] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 124.149149][ T9604] ? posixtimer_deliver_signal+0x1a0/0x6e0 [ 124.149181][ T9604] ? x86_task_fpu+0x5f/0x90 [ 124.149209][ T9604] get_sigframe+0x3fb/0x940 [ 124.149241][ T9604] ? __pfx_get_sigframe+0x10/0x10 [ 124.149266][ T9604] ? rcu_is_watching+0x13/0xc0 [ 124.149293][ T9604] ? siginfo_layout+0x156/0x290 [ 124.149325][ T9604] x64_setup_rt_frame+0x12f/0xce0 [ 124.149358][ T9604] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 124.149393][ T9604] arch_do_signal_or_restart+0x5ee/0x7e0 [ 124.149422][ T9604] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 124.149449][ T9604] ? __pfx_restore_altstack+0x10/0x10 [ 124.149486][ T9604] exit_to_user_mode_loop+0x139/0x700 [ 124.149511][ T9604] ? rcu_is_watching+0x13/0xc0 [ 124.149537][ T9604] do_syscall_64+0x661/0x790 [ 124.149569][ T9604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.149588][ T9604] RIP: 0033:0x7fc0d4d9f559 [ 124.149604][ T9604] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.149621][ T9604] RSP: 002b:00007fc0d5c180e8 EFLAGS: 00000246 [ 124.149636][ T9604] RAX: fffffffffffffffc RBX: 00007fc0d5025fa8 RCX: 00007fc0d4d9f559 [ 124.149648][ T9604] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc0d5025fa8 [ 124.149660][ T9604] RBP: 00007fc0d5025fa0 R08: 0000000000000000 R09: 0000000000000000 [ 124.149671][ T9604] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.149682][ T9604] R13: 00007fc0d5026038 R14: 00007fffb9d75430 R15: 00007fffb9d75518 [ 124.149709][ T9604] [ 124.156380][ T9606] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 124.282052][ T9611] FAULT_INJECTION: forcing a failure. [ 124.282052][ T9611] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 124.282073][ T9611] CPU: 2 UID: 0 PID: 9611 Comm: syz.2.1091 Tainted: G L syzkaller #0 PREEMPT(full) [ 124.282088][ T9611] Tainted: [L]=SOFTLOCKUP [ 124.282092][ T9611] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 124.282099][ T9611] Call Trace: [ 124.282102][ T9611] [ 124.282107][ T9611] dump_stack_lvl+0x100/0x190 [ 124.282126][ T9611] should_fail_ex.cold+0x5/0xa [ 124.282143][ T9611] _copy_to_user+0x32/0xd0 [ 124.282157][ T9611] simple_read_from_buffer+0xcb/0x170 [ 124.282175][ T9611] proc_fail_nth_read+0x1af/0x230 [ 124.282195][ T9611] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 124.282213][ T9611] ? rw_verify_area+0xce/0x6d0 [ 124.282226][ T9611] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 124.282243][ T9611] vfs_read+0x1e4/0xb40 [ 124.282257][ T9611] ? lock_acquire+0x1d1/0x380 [ 124.282269][ T9611] ? __fget_files+0x34/0x3d0 [ 124.282286][ T9611] ? __pfx_vfs_read+0x10/0x10 [ 124.282298][ T9611] ? find_held_lock+0x2b/0x80 [ 124.282314][ T9611] ? __fget_files+0x215/0x3d0 [ 124.282333][ T9611] ? __fget_files+0x21f/0x3d0 [ 124.282354][ T9611] ksys_read+0x12a/0x250 [ 124.282368][ T9611] ? __pfx_ksys_read+0x10/0x10 [ 124.282387][ T9611] do_syscall_64+0x123/0x790 [ 124.282406][ T9611] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.282418][ T9611] RIP: 0033:0x7f7d3eb5fd8e [ 124.282427][ T9611] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 124.282438][ T9611] RSP: 002b:00007f7d3fb2efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 124.282449][ T9611] RAX: ffffffffffffffda RBX: 00007f7d3fb2f6c0 RCX: 00007f7d3eb5fd8e [ 124.282456][ T9611] RDX: 000000000000000f RSI: 00007f7d3fb2f0a0 RDI: 0000000000000003 [ 124.282462][ T9611] RBP: 00007f7d3fb2f090 R08: 0000000000000000 R09: 0000000000000000 [ 124.282469][ T9611] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 124.282475][ T9611] R13: 00007f7d3ee26038 R14: 00007f7d3ee25fa0 R15: 00007ffe7491f518 [ 124.282489][ T9611] [ 124.297346][ T952] usb 6-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 124.298475][ T952] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 124.299530][ T952] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 124.303842][ T952] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.303860][ T952] usb 6-1: Product: syz [ 124.303871][ T952] usb 6-1: Manufacturer: syz [ 124.303882][ T952] usb 6-1: SerialNumber: syz [ 124.313027][ T952] ti_usb_3410_5052 6-1:2.0: TI USB 5052 2 port adapter converter detected [ 124.318872][ T9613] No source specified [ 124.319455][ T952] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 124.322264][ T952] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 124.436597][ T5770] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 124.587405][ T5770] usb 8-1: New USB device found, idVendor=054c, idProduct=024b, bcdDevice= 0.00 [ 124.588355][ T5770] usb 8-1: config 0 interface 0 has no altsetting 0 [ 124.588384][ T5770] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.590300][ T5770] usb 8-1: config 0 descriptor?? [ 124.716583][ T5873] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 124.867281][ T5873] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 124.868378][ T5873] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 124.868400][ T5873] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 124.868419][ T5873] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 124.870287][ T5873] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 124.870305][ T5873] usb 7-1: Product: syz [ 124.870317][ T5873] usb 7-1: Manufacturer: syz [ 124.870329][ T5873] usb 7-1: SerialNumber: syz [ 125.078410][ T5873] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 12 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 125.338078][ T9627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.338553][ T9627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 126.229319][ T9592] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot clear input buffers, -110 [ 126.233634][ T5873] usb 6-1: USB disconnect, device number 7 [ 126.246744][ T5873] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 126.252146][ T5873] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 126.259382][ T5873] ti_usb_3410_5052 6-1:2.0: device disconnected [ 126.791442][ T9631] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 127.060688][ T9634] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 127.060714][ T9634] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 127.063426][ T9634] vhci_hcd vhci_hcd.0: Device attached [ 127.215792][ T5770] usbhid 8-1:0.0: can't add hid device: -71 [ 127.215877][ T5770] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 127.225971][ T5770] usb 8-1: USB disconnect, device number 18 [ 127.236640][ T952] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 127.251319][ T42] kauditd_printk_skb: 14 callbacks suppressed [ 127.251334][ T42] audit: type=1400 audit(1792743531.402:11566): avc: denied { accept } for pid=9637 comm="syz.3.1097" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 127.299332][ T9642] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1098'. [ 127.304544][ T9642] syzkaller1: entered promiscuous mode [ 127.304561][ T9642] syzkaller1: entered allmulticast mode [ 127.306577][ T952] usb 39-1: new full-speed USB device number 2 using vhci_hcd [ 127.312478][ T9643] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1098'. [ 127.472508][ T5873] usb 7-1: USB disconnect, device number 12 [ 127.491163][ T5873] usblp0: removed [ 127.531222][ T42] audit: type=1400 audit(1792743531.682:11567): avc: denied { mount } for pid=9655 comm="syz.2.1101" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 127.753634][ T9656] netlink: 'syz.2.1101': attribute type 10 has an invalid length. [ 127.753658][ T9656] netdevsim netdevsim2 netdevsim1: left promiscuous mode [ 127.754082][ T9656] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 127.754451][ T9656] netdevsim netdevsim2 netdevsim1: entered promiscuous mode [ 127.754931][ T9656] team0: Port device netdevsim1 added [ 127.776522][ T42] audit: type=1400 audit(1792743531.922:11568): avc: denied { unmount } for pid=5766 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 127.833975][ T9635] vhci_hcd: connection reset by peer [ 127.848381][ T12] vhci_hcd vhci_hcd.1: stop threads [ 127.849051][ T12] vhci_hcd vhci_hcd.1: release socket [ 127.850549][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 127.877040][ T42] audit: type=1400 audit(1792743532.032:11569): avc: denied { mounton } for pid=9658 comm="syz.2.1102" path="/350/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 127.877389][ T9659] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 128.116718][ T5859] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 128.267252][ T5859] usb 7-1: New USB device found, idVendor=0552, idProduct=5510, bcdDevice= 0.00 [ 128.269938][ T5859] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 128.269958][ T5859] usb 7-1: Product: syz [ 128.269970][ T5859] usb 7-1: Manufacturer: syz [ 128.426121][ T9661] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1103'. [ 128.438390][ T9663] FAULT_INJECTION: forcing a failure. [ 128.438390][ T9663] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 128.438423][ T9663] CPU: 3 UID: 0 PID: 9663 Comm: syz.3.1104 Tainted: G L syzkaller #0 PREEMPT(full) [ 128.438438][ T9663] Tainted: [L]=SOFTLOCKUP [ 128.438442][ T9663] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 128.438454][ T9663] Call Trace: [ 128.438458][ T9663] [ 128.438478][ T9663] dump_stack_lvl+0x100/0x190 [ 128.438510][ T9663] should_fail_ex.cold+0x5/0xa [ 128.438527][ T9663] _copy_from_user+0x2e/0xd0 [ 128.438544][ T9663] copy_from_sockptr_offset.constprop.0+0x12c/0x150 [ 128.438565][ T9663] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 128.438586][ T9663] do_sock_getsockopt+0x2d0/0x6e0 [ 128.438604][ T9663] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 128.438622][ T9663] ? __fget_files+0x34/0x3d0 [ 128.438639][ T9663] ? find_held_lock+0x2b/0x80 [ 128.438659][ T9663] ? __fget_files+0x21f/0x3d0 [ 128.438678][ T9663] __sys_getsockopt+0x148/0x260 [ 128.438695][ T9663] ? __x64_sys_getsockopt+0xbd/0x160 [ 128.438707][ T9663] __x64_sys_getsockopt+0xbd/0x160 [ 128.438719][ T9663] ? do_syscall_64+0xae/0x790 [ 128.438738][ T9663] ? lockdep_hardirqs_on+0x7d/0x110 [ 128.438754][ T9663] do_syscall_64+0x123/0x790 [ 128.438772][ T9663] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.438784][ T9663] RIP: 0033:0x7fc0d4d9f559 [ 128.438793][ T9663] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.438803][ T9663] RSP: 002b:00007fc0d5c18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 128.438814][ T9663] RAX: ffffffffffffffda RBX: 00007fc0d5025fa0 RCX: 00007fc0d4d9f559 [ 128.438821][ T9663] RDX: 0000000000000013 RSI: 0000000000000112 RDI: 0000000000000004 [ 128.438828][ T9663] RBP: 00007fc0d5c18090 R08: 00002000000001c0 R09: 0000000000000000 [ 128.438834][ T9663] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 128.438841][ T9663] R13: 00007fc0d5026038 R14: 00007fc0d5025fa0 R15: 00007fffb9d75518 [ 128.438855][ T9663] [ 128.551516][ T42] audit: type=1400 audit(1792743532.702:11570): avc: denied { sqpoll } for pid=9668 comm="syz.3.1108" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 128.679175][ T9659] netlink: 136 bytes leftover after parsing attributes in process `syz.2.1102'. [ 128.679197][ T9659] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1102'. [ 128.681767][ T9659] xt_hashlimit: size too large, truncated to 1048576 [ 128.733617][ T9710] Bluetooth: hci0: unsupported parameter 5135 [ 128.733636][ T9710] Bluetooth: hci0: unsupported parameter 8192 [ 128.733646][ T9710] Bluetooth: hci0: unsupported parameter 5135 [ 128.733657][ T9710] Bluetooth: hci0: unsupported parameter 8192 [ 128.736273][ T42] audit: type=1400 audit(1792743532.882:11571): avc: denied { getopt } for pid=9709 comm="syz.1.1106" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 128.759165][ T5859] scsi host7: uas [ 128.771737][ T42] audit: type=1400 audit(1792743532.922:11572): avc: denied { accept } for pid=9714 comm="syz.1.1109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 128.817082][ T24] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 128.943830][ T9723] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 128.947340][ T9711] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 128.947537][ T9711] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 128.950699][ T9711] xt_hashlimit: size too large, truncated to 1048576 [ 128.952065][ T9659] netlink: 136 bytes leftover after parsing attributes in process `syz.2.1102'. [ 128.952083][ T9659] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1102'. [ 128.978722][ T24] usb 8-1: Using ep0 maxpacket: 32 [ 128.979433][ T24] usb 8-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 128.980398][ T24] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 128.980416][ T24] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 128.980448][ T24] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.982984][ T24] usb 8-1: config 0 descriptor?? [ 129.742617][ T42] audit: type=1400 audit(1792743533.892:11573): avc: denied { execute } for pid=9729 comm="syz-executor" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 129.744436][ T42] audit: type=1400 audit(1792743533.892:11574): avc: denied { execute_no_trans } for pid=9729 comm="syz-executor" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 129.820228][ T5781] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 129.821704][ T5781] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 129.825990][ T5781] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 129.829130][ T5781] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 129.829394][ T5781] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 129.851941][ T5771] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 129.852240][ T5771] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 129.853566][ T5771] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 129.854136][ T5771] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 129.854375][ T5771] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 129.875342][ T42] audit: type=1400 audit(1792743534.022:11575): avc: denied { mounton } for pid=9733 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 129.980551][ T9745] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1116'. [ 130.033586][ T9749] openvswitch: netlink: IP tunnel dst address not specified [ 130.084344][ T9752] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 130.113420][ T9733] rxe_eth0 speed is unknown, defaulting to 1000 [ 130.186207][ T9733] wg2 speed is unknown, defaulting to 1000 [ 130.331886][ T9733] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.331978][ T9733] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.332040][ T9733] bridge_slave_0: entered allmulticast mode [ 130.333068][ T9733] bridge_slave_0: entered promiscuous mode [ 130.334387][ T9733] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.334486][ T9733] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.334541][ T9733] bridge_slave_1: entered allmulticast mode [ 130.335157][ T9733] bridge_slave_1: entered promiscuous mode [ 130.346904][ T9733] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 130.349343][ T9733] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 130.363232][ T9733] team0: Port device team_slave_0 added [ 130.364526][ T9733] team0: Port device team_slave_1 added [ 130.375120][ T9733] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 130.375130][ T9733] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 130.375143][ T9733] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 130.376077][ T9733] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 130.376084][ T9733] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 130.376097][ T9733] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 130.393859][ T9733] hsr_slave_0: entered promiscuous mode [ 130.394265][ T9733] hsr_slave_1: entered promiscuous mode [ 130.394668][ T9733] debugfs: 'hsr0' already exists in 'hsr' [ 130.394680][ T9733] Cannot create hsr debugfs directory [ 130.488193][ T9733] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 130.492185][ T9733] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 130.493767][ T9733] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 130.496305][ T9733] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 130.496886][ T9733] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 130.500813][ T9733] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 130.501315][ T9733] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 130.503893][ T9733] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 130.518060][ T9733] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.518104][ T9733] bridge0: port 2(bridge_slave_1) entered forwarding state [ 130.518210][ T9733] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.518265][ T9733] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.544976][ T9733] 8021q: adding VLAN 0 to HW filter on device bond0 [ 130.553006][ T1164] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.553531][ T1164] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.558524][ T9733] 8021q: adding VLAN 0 to HW filter on device team0 [ 130.567664][ T1164] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.567708][ T1164] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.568239][ T1164] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.568278][ T1164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 130.820623][ T9733] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 130.895324][ C0] usb 7-1: stat urb: status -71 [ 130.895535][ C0] usb 7-1: cmd cmplt err -71 [ 130.895780][ T5859] usb 7-1: USB disconnect, device number 13 [ 130.902229][ T5859] scsi 7:0:0:0: tag#12 uas_zap_pending 0 uas-tag 1 inflight: CMD [ 130.903451][ T5859] scsi 7:0:0:0: tag#12 CDB: Inquiry 12 00 00 00 24 00 [ 130.941141][ T9791] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1122'. [ 130.958811][ T9733] veth0_vlan: entered promiscuous mode [ 130.963329][ T9733] veth1_vlan: entered promiscuous mode [ 130.975304][ T9733] veth0_macvtap: entered promiscuous mode [ 130.978005][ T9733] veth1_macvtap: entered promiscuous mode [ 130.984349][ T9733] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 130.988961][ T9733] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 130.992195][ T5881] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.992270][ T5881] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.992344][ T5881] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.992790][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.097348][ T1163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.097368][ T1163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 131.115157][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.115170][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 131.293691][ T9818] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2 sclass=netlink_route_socket pid=9818 comm=syz.1.1128 [ 131.293765][ T9818] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2 sclass=netlink_route_socket pid=9818 comm=syz.1.1128 [ 131.352298][ T9822] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 131.571070][ T34] usb 8-1: USB disconnect, device number 19 [ 131.588783][ T5819] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 131.589284][ T5819] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 131.589379][ T5819] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 131.589706][ T5819] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 131.630079][ T9844] openvswitch: netlink: IP tunnel dst address not specified [ 131.671824][ T9852] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=114 sclass=netlink_tcpdiag_socket pid=9852 comm=syz.3.1136 [ 131.765205][ T9861] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1139'. [ 131.866665][ T9870] overlayfs: failed lookup in lower (newroot/11, name='file1', err=-40): overlapping layers [ 131.908230][ T5771] Bluetooth: hci4: command tx timeout [ 131.911811][ T55] rpcbind: server 127.0.0.1 not responding, timed out [ 131.929770][ T9874] openvswitch: netlink: Flow key attr not present in new flow. [ 131.950822][ T9876] jffs2: notice: (9876) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 3 of xref (0 dead, 0 orphan) found. [ 132.246602][ T65] usb 7-1: new full-speed USB device number 14 using dummy_hcd [ 132.397207][ T65] usb 7-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 132.398340][ T65] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 132.400079][ T65] usb 7-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 132.400097][ T65] usb 7-1: Product: syz [ 132.400108][ T65] usb 7-1: Manufacturer: syz [ 132.400119][ T65] usb 7-1: SerialNumber: syz [ 132.402922][ T65] usb 7-1: config 0 descriptor?? [ 132.407843][ T65] keyspan 7-1:0.0: Keyspan 4 port adapter converter detected [ 132.408054][ T65] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 81 [ 132.408083][ T65] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 88 [ 132.409261][ T65] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 1 [ 132.410549][ T65] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 132.411782][ T65] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 2 [ 132.413137][ T65] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 132.414237][ T65] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 4 [ 132.415808][ T65] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 132.416792][ T65] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 6 [ 132.417811][ T65] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 132.457927][ T952] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 132.550837][ T1442] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.550891][ T1442] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.575422][ T42] kauditd_printk_skb: 21 callbacks suppressed [ 132.575486][ T42] audit: type=1400 audit(1792743536.722:11597): avc: denied { setopt } for pid=9903 comm="syz.3.1153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 132.622254][ T65] usb 7-1: USB disconnect, device number 14 [ 132.630414][ T65] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 132.633734][ T65] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 132.635011][ T65] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 132.636227][ T65] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 132.639525][ T65] keyspan 7-1:0.0: device disconnected [ 132.664183][ T9911] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9911 comm=syz.3.1155 [ 132.829668][ T9923] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 132.829702][ T9923] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 132.829735][ T9923] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 132.840288][ T9923] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 132.870192][ T9923] __nla_validate_parse: 1 callbacks suppressed [ 132.870223][ T9923] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1158'. [ 132.892359][ T9930] IPVS: set_ctl: invalid protocol: 12 172.20.20.187:0 [ 132.910943][ T29] infiniband syz1: ib_query_port failed (-19) [ 132.924823][ T1165] smbdirect: ib_dev[syz1] removed [ 132.930231][ T9930] FAULT_INJECTION: forcing a failure. [ 132.930231][ T9930] name failslab, interval 1, probability 0, space 0, times 0 [ 132.930274][ T9930] CPU: 1 UID: 0 PID: 9930 Comm: syz.4.1160 Tainted: G L syzkaller #0 PREEMPT(full) [ 132.930304][ T9930] Tainted: [L]=SOFTLOCKUP [ 132.930311][ T9930] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 132.930331][ T9930] Call Trace: [ 132.930337][ T9930] [ 132.930345][ T9930] dump_stack_lvl+0x100/0x190 [ 132.930385][ T9930] should_fail_ex.cold+0x5/0xa [ 132.930412][ T9930] should_failslab+0xc2/0x120 [ 132.930444][ T9930] kmem_cache_alloc_noprof+0x92/0x6a0 [ 132.930490][ T9930] ? mas_prev+0xa4/0x100 [ 132.930516][ T9930] ? vm_area_alloc+0x1f/0x160 [ 132.930539][ T9930] vm_area_alloc+0x1f/0x160 [ 132.930557][ T9930] __mmap_region+0x1025/0x32e0 [ 132.930585][ T9930] ? __pfx___mmap_region+0x10/0x10 [ 132.930604][ T9930] ? __lock_acquire+0x5c0/0x1f40 [ 132.930641][ T9930] ? __lock_acquire+0x5c0/0x1f40 [ 132.930666][ T9930] ? __lock_acquire+0x5c0/0x1f40 [ 132.930710][ T9930] ? hrtimer_start_range_ns_common+0x778/0x16f0 [ 132.930777][ T9930] ? avc_has_perm_noaudit+0x145/0x470 [ 132.930808][ T9930] mmap_region+0x3db/0x6d0 [ 132.930830][ T9930] ? rcu_is_watching+0x13/0xc0 [ 132.930856][ T9930] ? __pfx_mmap_region+0x10/0x10 [ 132.930880][ T9930] ? selinux_mmap_addr+0xdd/0x100 [ 132.930899][ T9930] ? bpf_lsm_mmap_addr+0x9/0x30 [ 132.930926][ T9930] ? security_mmap_addr+0x71/0x1e0 [ 132.930945][ T9930] ? __get_unmapped_area+0x255/0x3e0 [ 132.930973][ T9930] do_mmap+0x12c7/0x1c30 [ 132.931004][ T9930] ? lock_acquire+0x1d1/0x380 [ 132.931024][ T9930] ? __pfx_do_mmap+0x10/0x10 [ 132.931050][ T9930] ? __pfx___might_resched+0x10/0x10 [ 132.931087][ T9930] ? __pfx_down_write_killable+0x10/0x10 [ 132.931111][ T9930] vm_mmap_pgoff+0x28d/0x470 [ 132.931140][ T9930] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 132.931169][ T9930] ? __pfx_do_futex+0x10/0x10 [ 132.931201][ T9930] ksys_mmap_pgoff+0xe4/0x610 [ 132.931226][ T9930] ? __x64_sys_futex+0x358/0x4d0 [ 132.931253][ T9930] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 132.931294][ T9930] ? xfd_validate_state+0x129/0x190 [ 132.931320][ T9930] __x64_sys_mmap+0x125/0x190 [ 132.931343][ T9930] do_syscall_64+0x123/0x790 [ 132.931373][ T9930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.931392][ T9930] RIP: 0033:0x7faaa379f559 [ 132.931407][ T9930] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.931423][ T9930] RSP: 002b:00007faaa461b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 132.931442][ T9930] RAX: ffffffffffffffda RBX: 00007faaa3a25fa0 RCX: 00007faaa379f559 [ 132.931455][ T9930] RDX: 0000000004000002 RSI: 0000000000c00000 RDI: 0000000000000000 [ 132.931466][ T9930] RBP: 00007faaa3836b20 R08: ffffffffffffffff R09: 0000000000000000 [ 132.931477][ T9930] R10: 0000000000014032 R11: 0000000000000246 R12: 0000000000000000 [ 132.931488][ T9930] R13: 00007faaa3a26038 R14: 00007faaa3a25fa0 R15: 00007ffe402b8858 [ 132.931514][ T9930] [ 132.967909][ T42] audit: type=1400 audit(1792743537.122:11598): avc: denied { remount } for pid=9937 comm="syz.1.1163" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 133.011311][ T42] audit: type=1400 audit(1792743537.162:11599): avc: denied { bind } for pid=9943 comm="syz.1.1165" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 133.011676][ T42] audit: type=1400 audit(1792743537.162:11600): avc: denied { node_bind } for pid=9943 comm="syz.1.1165" saddr=224.0.0.1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 133.012658][ T42] audit: type=1400 audit(1792743537.162:11601): avc: denied { name_bind } for pid=9943 comm="syz.1.1165" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 133.163008][ T9955] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 133.169502][ T9957] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1170'. [ 133.328501][ T9976] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1179'. [ 133.329614][ T9977] netlink: 'syz.4.1178': attribute type 10 has an invalid length. [ 133.331984][ T9976] ip6tnl1: entered allmulticast mode [ 133.357291][ T9977] mac80211_hwsim hwsim12 wlan0: entered allmulticast mode [ 133.360665][ T9977] team0: Port device wlan0 added [ 133.360778][ T9977] netlink: 'syz.4.1178': attribute type 10 has an invalid length. [ 133.378466][ T9977] netlink: 'syz.4.1178': attribute type 10 has an invalid length. [ 133.378586][ T9977] netlink: 'syz.4.1178': attribute type 10 has an invalid length. [ 133.378689][ T9977] netlink: 'syz.4.1178': attribute type 10 has an invalid length. [ 133.378791][ T9977] netlink: 'syz.4.1178': attribute type 10 has an invalid length. [ 133.378895][ T9977] netlink: 'syz.4.1178': attribute type 10 has an invalid length. [ 133.379033][ T9977] netlink: 'syz.4.1178': attribute type 10 has an invalid length. [ 133.379111][ T9977] netlink: 'syz.4.1178': attribute type 10 has an invalid length. [ 133.379202][ T9977] netlink: 'syz.4.1178': attribute type 10 has an invalid length. [ 133.441243][ T9990] tmpfs: Using encoding : utf8-12.1.0 [ 133.468914][ T42] audit: type=1400 audit(1792743537.612:11602): avc: denied { read append } for pid=9991 comm="syz.1.1186" name="mice" dev="devtmpfs" ino=938 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 133.468945][ T42] audit: type=1400 audit(1792743537.612:11603): avc: denied { open } for pid=9991 comm="syz.1.1186" path="/dev/input/mice" dev="devtmpfs" ino=938 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 133.469042][ T9968] SELinux: policydb magic number 0x2 does not match expected magic number 0xf97cff8c [ 133.469081][ T9968] SELinux: failed to load policy [ 133.532591][ T9990] x_tables: duplicate underflow at hook 2 [ 133.557683][ T9990] overlayfs: missing 'lowerdir' [ 133.765561][T10028] ip_tables: iptables: counters copy to user failed while replacing table [ 133.771966][T10031] CIFS mount error: No usable UNC path provided in device string! [ 133.771966][T10031] [ 133.771992][T10031] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 133.777174][ T42] audit: type=1400 audit(1792743537.932:11604): avc: denied { write } for pid=10030 comm="syz.1.1199" name="uprobe_events" dev="tracefs" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 133.843734][ T42] audit: type=1400 audit(1792743537.992:11605): avc: denied { append } for pid=10035 comm="syz.3.1200" name="ppp" dev="devtmpfs" ino=729 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 133.858375][T10036] rxe_eth0 speed is unknown, defaulting to 1000 [ 133.925492][T10045] tmpfs: Bad value for 'mpol' [ 133.947455][T10036] wg2 speed is unknown, defaulting to 1000 [ 133.986915][ T5771] Bluetooth: hci4: command tx timeout [ 134.032528][ T42] audit: type=1400 audit(1792743538.182:11606): avc: denied { read } for pid=10053 comm="syz.2.1205" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 134.242425][T10068] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1211'. [ 134.242449][T10068] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1211'. [ 134.334768][T10077] xt_limit: Overflow, try lower: 0/0 [ 134.395304][T10071] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 134.401791][T10071] e1000e 0000:00:02.0 eth1: entered promiscuous mode [ 134.405455][T10071] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1212'. [ 134.406738][T10086] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1212'. [ 134.549985][T10105] smpboot: CPU 1 is now offline [ 134.574537][T10112] Trying to write to read-only block-device nullb0 [ 134.580219][T10108] 8021q: adding VLAN 0 to HW filter on device bond0 [ 134.581096][T10108] 8021q: adding VLAN 0 to HW filter on device team0 [ 134.587096][T10108] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 134.634314][T10111] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 134.655140][T10115] binder: 10110:10115 unknown command 0 [ 134.655152][T10115] binder: 10110:10115 ioctl c0306201 200000000800 returned -22 [ 134.684111][T10108] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 134.684133][T10108] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 134.717565][T10108] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 134.718930][T10108] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 134.720651][T10108] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 134.721949][T10108] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 134.723454][T10115] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10115 comm=syz.1.1222 [ 134.732353][T10108] bridge0: port 4(vlan2) entered blocking state [ 134.732438][T10108] bridge0: port 4(vlan2) entered forwarding state [ 134.738123][T10108] 8021q: adding VLAN 0 to HW filter on device bond1 [ 134.743953][T10108] 8021q: adding VLAN 0 to HW filter on device bond2 [ 134.837077][T10108] 8021q: adding VLAN 0 to HW filter on device bond3 [ 134.908204][ T5881] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 134.908260][ T5881] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 134.908370][ T5881] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 134.908523][ T5881] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 134.908644][ T5881] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 134.908667][ T5881] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.908770][ T5881] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 134.908792][ T5881] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.908894][ T5881] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 134.908922][ T5881] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.910221][ T5881] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 134.910245][ T5881] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 135.033032][T10126] syz.1.1223 (10126) used greatest stack depth: 18504 bytes left [ 135.065775][T10139] set match dimension is over the limit! [ 135.084605][T10145] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=257 sclass=netlink_route_socket pid=10145 comm=syz.3.1229 [ 135.091672][T10146] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=257 sclass=netlink_route_socket pid=10146 comm=syz.3.1229 [ 135.122929][T10156] FAULT_INJECTION: forcing a failure. [ 135.122929][T10156] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 135.122961][T10156] CPU: 2 UID: 0 PID: 10156 Comm: syz.3.1232 Tainted: G L syzkaller #0 PREEMPT(full) [ 135.122992][T10156] Tainted: [L]=SOFTLOCKUP [ 135.122999][T10156] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 135.123010][T10156] Call Trace: [ 135.123016][T10156] [ 135.123023][T10156] dump_stack_lvl+0x100/0x190 [ 135.123054][T10156] should_fail_ex.cold+0x5/0xa [ 135.123080][T10156] _copy_from_user+0x2e/0xd0 [ 135.123102][T10156] copy_msghdr_from_user+0x9f/0x4c0 [ 135.123139][T10156] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 135.123173][T10156] ? lock_acquire+0x1d1/0x380 [ 135.123192][T10156] ? get_pid_task+0x2a/0x250 [ 135.123218][T10156] ___sys_sendmsg+0x106/0x1e0 [ 135.123246][T10156] ? __pfx____sys_sendmsg+0x10/0x10 [ 135.123272][T10156] ? get_pid_task+0x106/0x250 [ 135.123306][T10156] ? find_held_lock+0x2b/0x80 [ 135.123347][T10156] __sys_sendmsg+0x160/0x210 [ 135.123369][T10156] ? __pfx___sys_sendmsg+0x10/0x10 [ 135.123404][T10156] do_syscall_64+0x123/0x790 [ 135.123455][T10156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.123473][T10156] RIP: 0033:0x7fc0d4d9f559 [ 135.123488][T10156] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.123504][T10156] RSP: 002b:00007fc0d5c18028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 135.123523][T10156] RAX: ffffffffffffffda RBX: 00007fc0d5025fa0 RCX: 00007fc0d4d9f559 [ 135.123535][T10156] RDX: 0000000004008094 RSI: 0000200000000380 RDI: 0000000000000003 [ 135.123546][T10156] RBP: 00007fc0d5c18090 R08: 0000000000000000 R09: 0000000000000000 [ 135.123558][T10156] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 135.123568][T10156] R13: 00007fc0d5026038 R14: 00007fc0d5025fa0 R15: 00007fffb9d75518 [ 135.123594][T10156] [ 135.134658][T10158] openvswitch: netlink: IP tunnel dst address not specified [ 135.183785][T10164] SELinux: policydb version 0 does not match my version range 15-35 [ 135.183826][T10164] SELinux: failed to load policy [ 135.206014][T10166] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1235'. [ 135.316391][T10172] kvm [10171]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 135.321685][T10172] kvm [10171]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 135.357371][T10174] bridge0: port 1(bridge_slave_0) entered disabled state [ 135.426113][T10183] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2997606139 (47961698224 ns) > initial count (30752093728 ns). Using initial count to start timer. [ 135.439835][T10174] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 135.446575][T10174] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 135.504560][T10174] veth1_macvtap: left promiscuous mode [ 135.513571][T10185] FAULT_INJECTION: forcing a failure. [ 135.513571][T10185] name failslab, interval 1, probability 0, space 0, times 0 [ 135.513617][T10185] CPU: 1 UID: 0 PID: 10185 Comm: syz.3.1242 Tainted: G L syzkaller #0 PREEMPT(full) [ 135.513641][T10185] Tainted: [L]=SOFTLOCKUP [ 135.513647][T10185] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 135.513666][T10185] Call Trace: [ 135.513672][T10185] [ 135.513679][T10185] dump_stack_lvl+0x100/0x190 [ 135.513719][T10185] should_fail_ex.cold+0x5/0xa [ 135.513744][T10185] should_failslab+0xc2/0x120 [ 135.513776][T10185] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 135.513801][T10185] ? __alloc_skb+0x5b7/0x710 [ 135.513839][T10185] ? __alloc_skb+0x140/0x710 [ 135.513864][T10185] __alloc_skb+0x140/0x710 [ 135.513882][T10185] ? __alloc_skb+0x5b7/0x710 [ 135.513900][T10185] ? __pfx___alloc_skb+0x10/0x10 [ 135.513931][T10185] netlink_alloc_large_skb+0x69/0x150 [ 135.513953][T10185] netlink_sendmsg+0x755/0x10c0 [ 135.513976][T10185] ? __pfx_netlink_sendmsg+0x10/0x10 [ 135.514002][T10185] ? selinux_socket_sendmsg+0x198/0x2f0 [ 135.514030][T10185] ? ____sys_sendmsg+0xa4d/0xbe0 [ 135.514055][T10185] ____sys_sendmsg+0xa4d/0xbe0 [ 135.514078][T10185] ? __pfx_netlink_sendmsg+0x10/0x10 [ 135.514100][T10185] ? __pfx_____sys_sendmsg+0x10/0x10 [ 135.514131][T10185] ? lock_acquire+0x1d1/0x380 [ 135.514149][T10185] ? get_pid_task+0x2a/0x250 [ 135.514175][T10185] ___sys_sendmsg+0x190/0x1e0 [ 135.514203][T10185] ? __pfx____sys_sendmsg+0x10/0x10 [ 135.514229][T10185] ? get_pid_task+0x106/0x250 [ 135.514262][T10185] ? find_held_lock+0x2b/0x80 [ 135.514303][T10185] __sys_sendmsg+0x160/0x210 [ 135.514324][T10185] ? __pfx___sys_sendmsg+0x10/0x10 [ 135.514358][T10185] do_syscall_64+0x123/0x790 [ 135.514395][T10185] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.514412][T10185] RIP: 0033:0x7fc0d4d9f559 [ 135.514427][T10185] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.514445][T10185] RSP: 002b:00007fc0d5c18028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 135.514463][T10185] RAX: ffffffffffffffda RBX: 00007fc0d5025fa0 RCX: 00007fc0d4d9f559 [ 135.514474][T10185] RDX: 0000000004008094 RSI: 0000200000000380 RDI: 0000000000000003 [ 135.514486][T10185] RBP: 00007fc0d5c18090 R08: 0000000000000000 R09: 0000000000000000 [ 135.514496][T10185] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 135.514508][T10185] R13: 00007fc0d5026038 R14: 00007fc0d5025fa0 R15: 00007fffb9d75518 [ 135.514535][T10185] [ 135.534182][T10174] macsec0: left allmulticast mode [ 135.557961][T10187] openvswitch: netlink: IP tunnel dst address not specified [ 135.599214][T10174] bond1: left allmulticast mode [ 135.599351][T10174] bond2: left allmulticast mode [ 135.600052][T10174] bridge1: left promiscuous mode [ 135.605057][T10174] bond5: left promiscuous mode [ 135.605073][T10174] erspan1: left promiscuous mode [ 135.605212][T10174] bond5: left allmulticast mode [ 135.611558][T10174] erspan1: left allmulticast mode [ 135.630567][T10177] 8021q: adding VLAN 0 to HW filter on device bond0 [ 135.634470][T10177] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 135.657852][T10177] bridge0: port 1(bridge_slave_0) entered blocking state [ 135.657900][T10177] bridge0: port 1(bridge_slave_0) entered forwarding state [ 135.673784][T10177] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 135.676073][T10177] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 135.687655][T10177] veth1_vlan: left promiscuous mode [ 135.688541][T10177] veth0_vlan: left promiscuous mode [ 135.690239][T10177] veth0_vlan: entered promiscuous mode [ 135.693160][T10177] veth1_vlan: entered promiscuous mode [ 135.700836][T10177] veth0_macvtap: left promiscuous mode [ 135.701726][T10177] veth0_macvtap: entered promiscuous mode [ 135.702657][T10177] veth1_macvtap: entered promiscuous mode [ 135.708355][T10177] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 135.709682][T10177] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 135.710620][T10177] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 135.713331][T10177] 8021q: adding VLAN 0 to HW filter on device bond1 [ 135.716331][T10177] 8021q: adding VLAN 0 to HW filter on device bond2 [ 135.717646][T10177] 8021q: adding VLAN 0 to HW filter on device bond3 [ 135.723086][T10177] 8021q: adding VLAN 0 to HW filter on device bond4 [ 135.724221][T10177] 8021q: adding VLAN 0 to HW filter on device bond5 [ 135.742066][ T9838] bridge0: port 2(bridge_slave_1) entered blocking state [ 135.742115][ T9838] bridge0: port 2(bridge_slave_1) entered forwarding state [ 135.761108][T10195] bond1: entered promiscuous mode [ 135.761358][T10195] 8021q: adding VLAN 0 to HW filter on device bond1 [ 135.853387][T10217] 9pnet_virtio: no channels available for device mountinfo [ 135.887572][T10219] openvswitch: netlink: IP tunnel dst address not specified [ 136.067748][ T5781] Bluetooth: hci4: command tx timeout [ 136.511670][T10249] openvswitch: netlink: IP tunnel dst address not specified [ 136.513170][T10250] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1265'. [ 136.572303][T10257] bond4 (unregistering): Released all slaves [ 136.640962][T10266] syzkaller0: entered promiscuous mode [ 136.640976][T10266] syzkaller0: entered allmulticast mode [ 136.641907][T10266] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 65487 [ 136.719012][T10269] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1272'. [ 136.819896][T10282] openvswitch: netlink: IP tunnel dst address not specified [ 136.840153][T10284] mmap: syz.1.1277 (10284) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 136.871074][T10288] CIFS: enabling forceuid mount option implicitly because uid= option is specified [ 136.871100][T10288] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 136.928989][T10293] openvswitch: netlink: Flow key attr not present in new flow. [ 137.066112][T10297] ipip0: entered allmulticast mode [ 137.149206][T10308] jffs2: notice: (10308) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 3 of xref (0 dead, 0 orphan) found. [ 137.228802][T10313] openvswitch: netlink: IP tunnel dst address not specified [ 137.288066][T10321] ================================================================== [ 137.288092][T10321] BUG: KASAN: vmalloc-out-of-bounds in sys_fillrect+0x174a/0x1910 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 137.288136][T10321] Write of size 8 at addr ffffc90005451000 by task syz.3.1289/10321 [ 137.288153][T10321] [ 137.288173][T10321] CPU: 1 UID: 0 PID: 10321 Comm: syz.3.1289 Tainted: G L syzkaller #0 PREEMPT(full) [ 137.288198][T10321] Tainted: [L]=SOFTLOCKUP [ 137.288205][T10321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 137.288225][T10321] Call Trace: [ 137.288232][T10321] [ 137.288240][T10321] dump_stack_lvl+0x100/0x190 [ 137.288268][T10321] print_report+0x13d/0x4b0 [ 137.288301][T10321] ? _raw_spin_lock_irqsave+0x52/0x60 [ 137.288333][T10321] ? sys_fillrect+0x174a/0x1910 [ 137.288356][T10321] kasan_report+0xdf/0x1c0 [ 137.288384][T10321] ? sys_fillrect+0x174a/0x1910 [ 137.288411][T10321] sys_fillrect+0x174a/0x1910 [ 137.288440][T10321] drm_fbdev_shmem_defio_fillrect+0x22/0x140 [ 137.288468][T10321] bit_clear+0x17d/0x220 [ 137.288486][T10321] ? __pfx_bit_clear+0x10/0x10 [ 137.288505][T10321] ? fb_get_color_depth+0x120/0x250 [ 137.288520][T10321] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 137.288547][T10321] __fbcon_clear+0x633/0x760 [ 137.288597][T10321] ? __pfx_bit_clear+0x10/0x10 [ 137.288619][T10321] fbcon_scroll+0x48b/0x650 [ 137.288638][T10321] con_scroll+0x464/0x690 [ 137.288668][T10321] csi_ECMA.constprop.0+0x1238/0x3b60 [ 137.288697][T10321] ? find_held_lock+0x2b/0x80 [ 137.288725][T10321] ? __pfx_csi_ECMA.constprop.0+0x10/0x10 [ 137.288758][T10321] do_con_write+0x366b/0x4ae0 [ 137.288791][T10321] ? __pfx_do_con_write+0x10/0x10 [ 137.288820][T10321] ? add_softcursor+0x140/0x290 [ 137.288842][T10321] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 137.288867][T10321] con_write+0x23/0xb0 [ 137.288892][T10321] n_tty_write+0x440/0x1200 [ 137.288916][T10321] ? __pfx_n_tty_write+0x10/0x10 [ 137.288934][T10321] ? __kasan_kmalloc+0xaa/0xb0 [ 137.288958][T10321] ? __pfx_woken_wake_function+0x10/0x10 [ 137.288981][T10321] ? rcu_is_watching+0x13/0xc0 [ 137.289007][T10321] ? file_tty_write.isra.0+0x6ed/0x8f0 [ 137.289033][T10321] ? kfree+0x1e5/0x6d0 [ 137.289051][T10321] ? __pfx_n_tty_write+0x10/0x10 [ 137.289070][T10321] file_tty_write.isra.0+0x4ca/0x8f0 [ 137.289100][T10321] vfs_write+0x6af/0x1050 [ 137.289123][T10321] ? __pfx_tty_write+0x10/0x10 [ 137.289149][T10321] ? __pfx_vfs_write+0x10/0x10 [ 137.289170][T10321] ? find_held_lock+0x2b/0x80 [ 137.289204][T10321] ksys_write+0x12a/0x250 [ 137.289225][T10321] ? __pfx_ksys_write+0x10/0x10 [ 137.289251][T10321] do_syscall_64+0x123/0x790 [ 137.289285][T10321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.289304][T10321] RIP: 0033:0x7fc0d4d9f559 [ 137.289318][T10321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 137.289337][T10321] RSP: 002b:00007fc0d5c18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 137.289357][T10321] RAX: ffffffffffffffda RBX: 00007fc0d5025fa0 RCX: 00007fc0d4d9f559 [ 137.289371][T10321] RDX: 0000000000001006 RSI: 00002000000003c0 RDI: 000000000000000c [ 137.289383][T10321] RBP: 00007fc0d4e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 137.289394][T10321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 137.289405][T10321] R13: 00007fc0d5026038 R14: 00007fc0d5025fa0 R15: 00007fffb9d75518 [ 137.289425][T10321] [ 137.289432][T10321] [ 137.289437][T10321] The buggy address belongs to a vmalloc virtual mapping [ 137.289449][T10321] Memory state around the buggy address: [ 137.289458][T10321] ffffc90005450f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 137.289482][T10321] ffffc90005450f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 137.289494][T10321] >ffffc90005451000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 137.289504][T10321] ^ [ 137.289512][T10321] ffffc90005451080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 137.289525][T10321] ffffc90005451100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 137.289535][T10321] ================================================================== [ 137.289575][T10321] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 137.454916][T10321] CPU: 1 UID: 0 PID: 10321 Comm: syz.3.1289 Tainted: G L syzkaller #0 PREEMPT(full) [ 137.459239][T10321] Tainted: [L]=SOFTLOCKUP [ 137.461019][T10321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 137.465196][T10321] Call Trace: [ 137.466601][T10321] [ 137.467857][T10321] dump_stack_lvl+0x100/0x190 [ 137.469778][T10321] vpanic+0x553/0x970 [ 137.471468][T10321] ? __pfx_vpanic+0x10/0x10 [ 137.473375][T10321] ? mark_held_locks+0x40/0x70 [ 137.475355][T10321] ? irqentry_exit+0x202/0xab0 [ 137.477329][T10321] ? sys_fillrect+0x174a/0x1910 [ 137.479346][T10321] panic+0xd1/0xe0 [ 137.480833][T10321] ? __pfx_panic+0x10/0x10 [ 137.482684][T10321] check_panic_on_warn.cold+0x19/0x34 [ 137.484818][T10321] end_report.part.0+0x3a/0x90 [ 137.486755][T10321] kasan_report.cold+0xe/0x18 [ 137.488684][T10321] ? sys_fillrect+0x174a/0x1910 [ 137.490532][T10321] sys_fillrect+0x174a/0x1910 [ 137.492371][T10321] drm_fbdev_shmem_defio_fillrect+0x22/0x140 [ 137.494748][T10321] bit_clear+0x17d/0x220 [ 137.496412][T10321] ? __pfx_bit_clear+0x10/0x10 [ 137.498264][T10321] ? fb_get_color_depth+0x120/0x250 [ 137.500267][T10321] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 137.502585][T10321] __fbcon_clear+0x633/0x760 [ 137.504404][T10321] ? __pfx_bit_clear+0x10/0x10 [ 137.506248][T10321] fbcon_scroll+0x48b/0x650 [ 137.508050][T10321] con_scroll+0x464/0x690 [ 137.509833][T10321] csi_ECMA.constprop.0+0x1238/0x3b60 [ 137.512085][T10321] ? find_held_lock+0x2b/0x80 [ 137.514059][T10321] ? __pfx_csi_ECMA.constprop.0+0x10/0x10 [ 137.516127][T10321] do_con_write+0x366b/0x4ae0 [ 137.517617][T10321] ? __pfx_do_con_write+0x10/0x10 [ 137.519263][T10321] ? add_softcursor+0x140/0x290 [ 137.520901][T10321] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 137.522750][T10321] con_write+0x23/0xb0 [ 137.523997][T10321] n_tty_write+0x440/0x1200 [ 137.525373][T10321] ? __pfx_n_tty_write+0x10/0x10 [ 137.526974][T10321] ? __kasan_kmalloc+0xaa/0xb0 [ 137.528484][T10321] ? __pfx_woken_wake_function+0x10/0x10 [ 137.530319][T10321] ? rcu_is_watching+0x13/0xc0 [ 137.531847][T10321] ? file_tty_write.isra.0+0x6ed/0x8f0 [ 137.533571][T10321] ? kfree+0x1e5/0x6d0 [ 137.534845][T10321] ? __pfx_n_tty_write+0x10/0x10 [ 137.536405][T10321] file_tty_write.isra.0+0x4ca/0x8f0 [ 137.538058][T10321] vfs_write+0x6af/0x1050 [ 137.539368][T10321] ? __pfx_tty_write+0x10/0x10 [ 137.540832][T10321] ? __pfx_vfs_write+0x10/0x10 [ 137.542233][T10321] ? find_held_lock+0x2b/0x80 [ 137.543704][T10321] ksys_write+0x12a/0x250 [ 137.545074][T10321] ? __pfx_ksys_write+0x10/0x10 [ 137.546603][T10321] do_syscall_64+0x123/0x790 [ 137.548060][T10321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.549892][T10321] RIP: 0033:0x7fc0d4d9f559 [ 137.551313][T10321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 137.557072][T10321] RSP: 002b:00007fc0d5c18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 137.560119][T10321] RAX: ffffffffffffffda RBX: 00007fc0d5025fa0 RCX: 00007fc0d4d9f559 [ 137.563368][T10321] RDX: 0000000000001006 RSI: 00002000000003c0 RDI: 000000000000000c [ 137.566611][T10321] RBP: 00007fc0d4e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 137.569695][T10321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 137.572613][T10321] R13: 00007fc0d5026038 R14: 00007fc0d5025fa0 R15: 00007fffb9d75518 [ 137.575039][T10321] [ 137.576670][T10321] Kernel Offset: disabled [ 137.578323][T10321] Rebooting in 86400 seconds.. VM DIAGNOSIS: 08:14:47 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000007 RBX=0000000000000000 RCX=0000000000000002 RDX=8f5c28f5c28f5c29 RSI=0000000000000000 RDI=ffffffff8ffec5a0 RBP=ffffffff97baf2d8 RSP=ffffc90000127620 R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001 R12=ffff8880202ea580 R13=0000000000000002 R14=0000000000000000 R15=ffffffff8ffec5a0 RIP=ffffffff81e898cb RFL=00000803 [-O----C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d44be000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007fc0d5b5da08 CR3=0000000037fd5000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=000000000000003f Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7d3f95d560 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe7491fa06 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe7491fa06 00007ffe7491fa0c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7d3ec3714a ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7d3ec37184 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7d3ec372e8 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7d3ec37176 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7d3edf9600 00007f7d3edf95e0 00007f7d3edf95e8 00007f7d3edf9618 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000700080006 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7d3edf95f8 00007f7d3edf95c8 00007f7d3edf9600 00007f7d3edf95e0 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000003 0000000000000000 0000000000000000 00000000000000e4 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000030 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85b6ed65 RDI=ffffffff9cf08040 RBP=ffffffff9cf08000 RSP=ffffc90003ce6d88 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=3030303963666657 R12=0000000000000000 R13=0000000000000030 R14=000000000000000c R15=ffffc90003ce70a0 RIP=ffffffff85b6ed8f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007fc0d5c186c0 ffffffff 00c00000 GS =0000 ffff8880d45be000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000200000001000 CR3=000000005b08d000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000020100001 Opmask01=0000000001000003 Opmask02=00000000ff02fefd Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc0d5c17be0 0000003000000010 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 203a6b6361747320 6461657268747020 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fffb9d75a06 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fffb9d75a06 00007fffb9d75a0c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc0d4e3714a ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc0d4e37184 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc0d4e372e8 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc0d4e37176 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3a732520656c6261 7462650064656c69 61662029736e7465 6e28736e74657300 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1f56000540494744 514740004140494c 4443050c564b5140 4b0d564b51405600 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fc0d4ff95f8 00007fc0d4ff95c8 00007fc0d4ff9600 00007fc0d4ff95e0 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000003 0000000000000000 0000000000000000 0000000000000254 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000000 RBX=ffffc90003927d10 RCX=0000000000000000 RDX=ffff88802c704b00 RSI=ffffffff8bd99f5b RDI=ffffc90003927d10 RBP=ffff88802c704b00 RSP=ffffc90003927c50 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000000 R12=ffffffffffffffff R13=ffffc90003927d58 R14=dffffc0000000000 R15=ffff8880402d2f00 RIP=ffffffff8bd82ad0 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000555569ffb540 ffffffff 00c00000 GS =0000 ffff8880d46be000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007ff8ba757e20 CR3=0000000038b44000 CR4=00352ef0 DR0=ffffffffffffffff DR1=00000000000001f8 DR2=0000000000000083 DR3=ffffffffefffff15 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000002020004 Opmask01=0000000000000054 Opmask02=00000000000000ff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd20e06ec0 00007ffd20e06ec0 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff8b9bf9823 00007ff8b9bf9823 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff8b9bf9e80 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ff8b9bf9e80 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000003bf12 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055556a0140f8 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 5355424749530056 474553474953006c 616e676973206e77 6f6e6b6e75000a29 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 5355424749530056 4745534749530049 444b424c56054b52 4a4b4e4b50000a0c ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 84a608000100000c 0806060128f20000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0010000eb0030010 000ea0030010000e 900303fddc10000e 80030b80041888c2 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 01018004188285a8 9008000100000008 0606012ca8001000 01a0030c80808010 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0001900304808080 040180031c100001 00000e0806040144 860010003010000e ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 8004060e44820010 000ed0030010000e c0030010000eb003 0010000ea0030010 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000e900303fddc10 000e80030b800418 88c284a608000100 000c0806060128f2 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=00000000000ed80b RBX=ffff8880206da580 RCX=ffffffff8be11325 RDX=0000000000000001 RSI=ffffffff8e61b4ce RDI=ffffffff8c829880 RBP=ffffed10040db4b0 RSP=ffffc90000197e00 R8 =0000000000000001 R9 =ffffed100d466825 R10=ffff88806a33412b R11=0000000000000001 R12=0000000000000000 R13=0000000000000000 R14=1ffff92000032fc4 R15=dffffc0000000000 RIP=ffffffff8be0f7bf RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] FS =0000 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] GS =0000 ffff8880d47be000 ffffffff 00c09300 DPL=0 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000000000000 CR3=000000003eac4000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000feffc200 Opmask01=000000000000ffff Opmask02=00000000ffffffff Opmask03=0000000000001000 Opmask04=0000000000000000 Opmask05=00000000004007ff Opmask06=0000000007ffe7ff Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000001a4 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=c9b21a739bb817d8 543ef18b80774285 c9b21a739bb817d8 543ef18b80774285 c9b21a739bb817d8 543ef18b80774285 c9b21a739bb817d8 543ef18b80774285 ZMM18=7fb482b71bafd4ad 7328a3e4947637c7 7fb482b71bafd4ad 7328a3e4947637c7 7fb482b71bafd4ad 7328a3e4947637c7 7fb482b71bafd4ad 7328a3e4947637c7 ZMM19=f10a000000000000 0000000000000005 f10a000000000000 0000000000000004 f10a000000000000 0000000000000003 f10a000000000000 0000000000000002 ZMM20=0000000000000000 0000000000000004 0000000000000000 0000000000000004 0000000000000000 0000000000000004 0000000000000000 0000000000000004 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 c99368d2158d01ef 2ae0cc5da9f21c49 bd5ff62400000000 0000000053710000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2000d00023003001 fffffffffffffffa fd08088003646967 0464c201ffffffff ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 fffffffff3080180 0300100000040400 07bc0073666f7475 6101ffffffffffff ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 d8031c8080808404 880001d0030010b8 80840001ce030010 b080840001ce0302 ZMM25=f7b592fcf7b592fc f7b592fcf7b592fc f7b592fcf7b592fc f7b592fcf7b592fc f7b592fcf7b592fc f7b592fcf7b592fc f7b592fcf7b592fc f7b592fcf7b592fc ZMM26=9b09027a9b09027a 9b09027a9b09027a 9b09027a9b09027a 9b09027a9b09027a 9b09027a9b09027a 9b09027a9b09027a 9b09027a9b09027a 9b09027a9b09027a ZMM27=234dd3cb234dd3cb 234dd3cb234dd3cb 234dd3cb234dd3cb 234dd3cb234dd3cb 234dd3cb234dd3cb 234dd3cb234dd3cb 234dd3cb234dd3cb 234dd3cb234dd3cb ZMM28=000000100000000f 0000000e0000000d 0000000c0000000b 0000000a00000009 0000000800000007 0000000600000005 0000000400000003 0000000200000001 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=2707000027070000 2707000027070000 2707000027070000 2707000027070000 2707000027070000 2707000027070000 2707000027070000 2707000027070000