last executing test programs: 4.809651498s ago: executing program 0 (id=943): mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mkdir(&(0x7f0000000100)='./dev\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='./dev\x00', &(0x7f0000000700)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0\x00', 0x42, 0x1ff) ftruncate(r0, 0x1000000) r1 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) ftruncate(r1, 0x1000000) r2 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) ftruncate(r2, 0x1000000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='file3\x00', 0x42, 0x1ff) ftruncate(r3, 0x1000000) r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/loop0\x00', 0x2, 0x0) ioctl$LOOP_SET_FD(r4, 0x4c00, r0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./dev/loop2\x00', 0x2, 0x0) ioctl$LOOP_SET_FD(r5, 0x4c00, r2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./dev/loop3\x00', 0x2, 0x0) ioctl$LOOP_SET_FD(r6, 0x4c00, r3) r7 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r7, &(0x7f0000001100)='md0\x00', 0x4) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./dev/md0\x00', 0x2, 0x0) ioctl(r8, 0x40480923, &(0x7f0000001300)="000000005a00000003000000000000000500000000040000040000000300000000000000") ioctl(r8, 0x40140921, &(0x7f0000001400)="0000000007000000000000000000000006000000") 4.58801565s ago: executing program 0 (id=944): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000400), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r4], 0x1c}}, 0x4008054) write$nci(r1, &(0x7f0000000440)=@NCI_OP_RF_DISCOVER_NTF={0x1, 0x1, 0x3, 0x3, 0x8, @a={0x5, 0x5, 0x0, 0x8, {0x3a, 0x4, "1c982fb0", 0x9, 0x80}}}, 0x10) ioctl$TIOCCONS(r0, 0x541d) ioctl$TCXONC(r0, 0x540a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x187) ioctl$PIO_SCRNMAP(r0, 0x4b41, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000040), 0x82402, 0x0) umount2(0x0, 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, 0x0, 0x2000000c) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r8, r9, &(0x7f0000fe5000/0x18000)=nil, 0x0, 0x0, 0xa640627c52febdf5, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) 4.359865927s ago: executing program 1 (id=947): r0 = mq_open(&(0x7f0000000100)='\x00\x00\x00\x00\x00', 0x2, 0xd2, 0x0) fcntl$getown(r0, 0x9) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi4\x00', 0x8000, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000200), 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="8400000000010104000000000000000002000000240001801400018008000100ac1414bb08000200ac0314bb0c0002800500010000000000240002801400018008000100ac1414aa08000200ac1414000c0002800500010000000000080007400000000010001700"/116], 0x84}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) sendmsg$IPCTNL_MSG_CT_GET_DYING(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{0x0}], 0x1}, 0x48043) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="30000000100001000000000000000071ff9aee24", @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000006000008001b"], 0x30}}, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2a}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r10, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r9, 0x0, r2, 0x0, 0x317e, 0x4) close_range(r1, 0xffffffffffffffff, 0x0) 1.530156211s ago: executing program 2 (id=949): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797afc3c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000010b615cd89f1b3621c000340000000022c00b3120e0a1f0200000000000000000a0000000900010073797a31000000000900020073797a310000000014000000110001"], 0xcc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = dup(r1) ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000180)={0x2, {0x2, 0x6, 0x8, 0x5, 0x1ff}}) listen(0xffffffffffffffff, 0x400008) shutdown(0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_VENDOR(r0, 0x0, 0x44011) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) r4 = syz_open_dev$sg(0x0, 0x0, 0x0) ioctl$SG_BLKTRACESTOP(r4, 0x1275, 0x0) bind$can_j1939(r3, 0x0, 0x0) sendmsg$can_j1939(r3, 0x0, 0xee) r5 = socket$kcm(0x23, 0x5, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0xa, &(0x7f0000000180), 0x4) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x541b, &(0x7f0000000640)) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000004c0), 0x48100) open(0x0, 0x400, 0x1) openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r6, 0xc08c5335, &(0x7f00000001c0)={0x0, 0x80, 0x0, 'queue0\x00'}) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, 0x0, 0x10) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000340)=ANY=[@ANYBLOB], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) 1.529660253s ago: executing program 1 (id=950): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x7) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000740)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x6c, 0x6c, 0x2, [@type_tag={0x8, 0x0, 0x0, 0x12, 0x1}, @union={0xa, 0x6, 0x0, 0x5, 0x1, 0x3, [{0x6, 0x3, 0x5cfd}, {0x4, 0x3, 0xe2}, {0x1, 0x0, 0x401}, {0x2, 0x0, 0xd}, {0xc, 0x0, 0x9}, {0x5, 0x0, 0xc}]}, @volatile={0x0, 0x0, 0x0, 0x9, 0x3}]}}, &(0x7f0000001b80)=""/4090, 0x86, 0xffa, 0xa}, 0x28) ioctl$BTRFS_IOC_DEFRAG(r1, 0x50009402, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_POWER_SAVE(r0, &(0x7f0000000700)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0xffffffffffffff22, 0x0, 0x4, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x20048001) socket$alg(0x26, 0x5, 0x0) r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmsg$802154_raw(r3, &(0x7f0000001080)={&(0x7f0000000f80)={0x24, @long={0x3, 0x1}}, 0x14, 0x0, 0x1, 0x0, 0x0, 0x44040}, 0x40042) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000640)={0x0, &(0x7f0000000600)=""/31, 0x0, 0x1f, 0x0, 0x8001}, 0x28) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = socket(0x1e, 0x4, 0x0) setsockopt$sock_timeval(r5, 0x1, 0x14, &(0x7f0000454ff0)={0x0, 0x2710}, 0x10) recvmsg(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000440)=""/119, 0x77}], 0x1}, 0x21) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004074}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_RINGS_GET(0xffffffffffffffff, 0x0, 0x4000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x1, 0x7}, 0x28) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r0, &(0x7f0000000500)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {{}, {}, {0x4c, 0x18, {0x5, @link='syz1\x00'}}}, ["", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x44}, 0x4000800) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x4000810) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc01cf509, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000000280)) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x48, 0x2, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}]}, 0x48}}, 0x0) sendmsg$IPSET_CMD_DEL(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000300)={0x44, 0xa, 0x6, 0x101, 0xd000000, 0x0, {0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_ADT={0x14, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_NAME={0x9, 0x12, 'syz2\x00'}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_LINENO={0x8}]}, 0x44}}, 0x0) 1.52866619s ago: executing program 0 (id=952): socket$nl_netfilter(0x10, 0x3, 0xc) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001b40), 0x20341, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000000)={0x3, 0x407, 0x8, 0x801003e, 0x80, '\v\b\x00', 0x9, 0xfffffff5}) r1 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x12) dup(r1) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x4000000145802, 0x0) syz_open_dev$usbfs(0x0, 0x76, 0x103381) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1) r3 = socket(0x2c, 0x803, 0xffffffff) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000005b80)={'ip6gre0\x00', 0x0}) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$cont(0x21, r4, 0x8, 0xffff) r5 = dup(r2) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r5, 0xc1105517, &(0x7f0000000480)={{0x6, 0x6, 0x4a7, 0x6, 'syz1\x00', 0x6}, 0x5, 0x3, 0xb4, r4, 0x4, 0x3, 'syz1\x00', &(0x7f0000000180)=['#\x00', '\x00', ':]))', '\x00\x00\x01\x00\x00\x00\x00\x00\x00'], 0x10}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r5, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) write$binfmt_aout(r5, 0x0, 0xffffffdb) timer_create(0x0, 0x0, 0x0) mprotect(&(0x7f000088f000/0x3000)=nil, 0x3000, 0x0) setpriority(0x2, 0x0, 0x8) socket$pppoe(0x18, 0x1, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 1.528235106s ago: executing program 2 (id=953): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'macvtap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001c000100000000000000000007000000", @ANYRES32=r4, @ANYBLOB="000002000a0002cc864d1e94"], 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x11, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xd, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x5, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r6, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file1\x00'}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000034c0)=@bpf_lsm={0x1d, 0x5, &(0x7f00000006c0)=ANY=[@ANYBLOB], &(0x7f0000000180)='GPL\x00', 0x2a0d, 0x0, &(0x7f0000000200), 0x41100, 0x5, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x0, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000003400)=[r0, r7, r7, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000003440)=[{0x2, 0x4, 0xf}, {0x2, 0x3, 0x7, 0x2}, {0x5, 0x2, 0xd, 0x6}, {0x2, 0xa0000000, 0x1, 0xa}], 0x10, 0xd}, 0x94) mmap$snddsp_control(&(0x7f0000ffa000/0x3000)=nil, 0x1000, 0x1, 0x10, 0xffffffffffffffff, 0x83000000) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$FIOCLEX(r8, 0x5451) close(r5) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0xc, 0x2, [@TCA_GRED_LIMIT={0x8, 0x5, 0x2848000}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x2004c090) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) fstatfs(r8, &(0x7f00000005c0)=""/191) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r10) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000500)=@IORING_OP_FILES_UPDATE={0x14, 0x40, 0x0, 0x0, 0x1, &(0x7f0000000280)=[0xffffffffffffffff], 0x1}) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000bc0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r11, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="01002cbd7000ffdbdf250200000014000180060005004e2200000500020001"], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x14) 1.527925455s ago: executing program 1 (id=954): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000000580)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) shutdown(r0, 0x1) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000200)={&(0x7f0000708000/0x4000)=nil, &(0x7f000081f000/0x3000)=nil, 0x4000, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x4d, 0x400c080) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) bpf$PROG_LOAD(0x5, 0x0, 0x27) socket$nl_rdma(0x10, 0x3, 0x14) add_key$keyring(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xfffffffffffffffd) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYRES32=0x0], 0x50) r4 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r4, 0x4020565a, &(0x7f00000000c0)={0x3, 0x980900}) r5 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r5, 0x4020565a, &(0x7f00000000c0)={0x3, 0x980900, 0x3}) ioctl$VIDIOC_QUERYMENU(r5, 0xc008561c, &(0x7f0000000100)={0x980900, 0x3, @name="6c14f9104c575323652bb05c9764e27d0235e28510452c132c1eaa54d11e47a7"}) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000180), 0x4) 1.468487033s ago: executing program 2 (id=956): setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e22, 0x3, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3}}, 0x0, 0x0, 0x1d, 0x0, "bb02a3c364ca41d6357e54451cb740000076a8a20122e4dbbe00000000000000000000000000000008000000000000000000fe1605b105000000040000000000000020004615a8284d49017c00"}, 0xd8) r0 = socket$kcm(0x23, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) listen(r0, 0x800) accept4(r0, 0x0, 0x0, 0x80000) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff000000"], 0x78) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) 1.210508063s ago: executing program 3 (id=958): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @ipv4={'\x00', '\xff\xff', @local}, 0x4}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x1}, 0x1c) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000f59ffc)=0x92, 0x4) bind$inet6(r3, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @loopback, 0x5}, 0x1c) r6 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x6}, 0x1c) r7 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe20, 0x0, @empty}, 0x1c) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f0000000080)=0x5, 0x4) bind$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r9 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r9, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) r10 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r10, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast2, 0x2}, 0x1c) r11 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) 1.209926926s ago: executing program 3 (id=959): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001180)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000380)="c4f6567b42428c351d0eb7e00adfac40f6f3c6ddfeee4f9b47f2ae534b00a80cf8bfe9952dadad722784be00d5e05f8aa568711892567737d85ade9858ea72a66a3a417d6fbdfe0c98a369e4e8de7139ea726aa8fd9e2b80cf70a64914c3cc12d10db3f785dcc90135afb89c4f917aba8da3dafa45a3ce5c98ad8d4e6528e2210d206b85f15e5eb55355d2acc609a1cc4df8ff5011ac509e40cc0ebded6b2781a05df6b38f458fe8a98d5ec9117cf4d25825b441b2e49dd32aca0852c7d7387a5452972ebde3fa90be5547e19b635d3b468d8cb58dd8d5e5aa5a917104c3", 0xde}, {&(0x7f0000000640)="18f2539a86f4267acf60e40dadcc211bb18670", 0x13}, {&(0x7f0000000800)="1c98baccf3c4dda10bf3823360bf673a13af18c90ee53a5b0ab6833eee1edc56059d6fdc", 0x24}], 0x3}}, {{0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000ac0)="a19168e24152c670ecff4e", 0xb}], 0x1}}], 0x2, 0x4000000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x4, 0x6, 0x5, 0x0, 0x0, {0xa}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x58010}, 0x800) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000140)={0x6}, 0x10) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xc, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r2, 0x89f8, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'ip_vti0\x00', 0x0, 0x10, 0x700, 0x2, 0x47da, {{0x11, 0x4, 0x0, 0x2d, 0x44, 0x66, 0x0, 0x6, 0x4, 0x0, @empty, @multicast1, {[@end, @generic={0x83, 0xd, "7d98a7e189020c2142d2b9"}, @rr={0x7, 0xf, 0x3a, [@private=0xa010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010101]}, @timestamp={0x44, 0x10, 0xff, 0x0, 0xc, [0x6, 0x7, 0xf]}]}}}}}) getuid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000340), 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4000851) getpeername$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x4c094) write(r2, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) r5 = socket$netlink(0x10, 0x3, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000000)="3900000013000b4700bb65e1c3e4ffff0100000035390000560000022500000019000a00100000ad07fd17e5ffff080c380000000000", 0x36}], 0x1) close(0x4) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001240)=@gettaction={0x34, 0x32, 0x6dd711a25f4cb68b, 0x70bd2a, 0x0, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}]}]}, 0x34}}, 0x0) 760.129875ms ago: executing program 0 (id=960): socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r8, r7, &(0x7f0000000180)={0x0, 0x3e0e, 0x8, 0x3, 0x28e, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb8bf, 0x1, 0x4, 0x1af, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9, 0x2, 0x0, 0x3b2, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1313, 0x4, 0x4, 0x2db, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5027, 0x20000, 0x3, 0x1fc}}], 0x4, &(0x7f0000001f40)={0x2e, 0x5, 0x0, r8, 0xc0107526, 0x0, 0x0, 0x0, 0x0, {0x10}, 0x0, r6, '\x00', {0x3, 0xc46, 0x100104, 0x0}}, &(0x7f0000000280)) socket$kcm(0x29, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x5, 0x2) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r9 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @private=0xa010101}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x36}}, {0x2, 0x4e24, @rand_addr=0x64010100}, 0x1d7, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x4, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r9], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r10, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r10, &(0x7f0000000000), 0xd) 648.740989ms ago: executing program 0 (id=961): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @ipv4={'\x00', '\xff\xff', @local}, 0x4}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x1}, 0x1c) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000f59ffc)=0x92, 0x4) bind$inet6(r3, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @loopback, 0x5}, 0x1c) r6 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x6}, 0x1c) r7 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe20, 0x0, @empty}, 0x1c) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f0000000080)=0x5, 0x4) bind$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r9 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r9, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) r10 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r10, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast2, 0x2}, 0x1c) r11 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0xe20, @loopback}, 0x10) 648.329908ms ago: executing program 0 (id=962): r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x44732}}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000180)={0x1, 0xfeaf, 0xfa00, {&(0x7f0000000140)}}, 0x18) r1 = socket(0x10, 0x3, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r1, 0x111, 0x2, 0x1, 0x4) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc00000009"], 0x0) r3 = syz_open_dev$I2C(&(0x7f0000000000), 0xc, 0x0) ioctl$I2C_RDWR(r3, 0x707, &(0x7f00000007c0)={&(0x7f0000000240)=[{0x8001, 0x10, 0x0, 0x0}], 0x1}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$SIOCSIFHWADDR(r2, 0x8924, 0x0) mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, &(0x7f0000000400)='\x00') mkdir(&(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000080)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ff) symlink(&(0x7f0000000900)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', &(0x7f0000000a00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlink(&(0x7f0000000b00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/ss/h\x00') mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ff) mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ff) mkdir(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ff) symlink(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') symlink(&(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001300)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') symlink(&(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/ss/h\x00') symlink(&(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0\x00', &(0x7f0000001900)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00') openat(0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) 550.124287ms ago: executing program 2 (id=963): socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r8, r7, &(0x7f0000000180)={0x0, 0x3e0e, 0x8, 0x3, 0x28e, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb8bf, 0x1, 0x4, 0x1af, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9, 0x2, 0x0, 0x3b2, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1313, 0x4, 0x4, 0x2db, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5027, 0x20000, 0x3, 0x1fc}}], 0x4, &(0x7f0000001f40)={0x2e, 0x5, 0x0, r8, 0xc0107526, 0x0, 0x0, 0x0, 0x0, {0x10}, 0x0, r6, '\x00', {0x3, 0xc46, 0x100104, 0x0}}, 0x0) socket$kcm(0x29, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x5, 0x2) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r9 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @private=0xa010101}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x36}}, {0x2, 0x4e24, @rand_addr=0x64010100}, 0x1d7, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x4, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r9], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r10, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r10, &(0x7f0000000000), 0xd) 549.788721ms ago: executing program 1 (id=964): r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000b00)='/dev/bsg/0:0:0:0\x00', 0x40040, 0x0) ioctl$BSG_IO(r0, 0x2285, &(0x7f0000000dc0)={0x51, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc30, 0x30, 0x0, 0x4}) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x81004, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) rename(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180)='./file3\x00') r1 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'dummy0\x00'}) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/62, 0x328000, 0x800, 0x9, 0x3}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000300)=0x2, 0x4) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000240)={'pcl812\x00', [0x100, 0x4, 0x13600, 0x6, 0x0, 0x10005, 0x79, 0x3, 0x80008, 0x5, 0x2, 0x64, 0x7, 0x1, 0x6, 0xfd, 0x6, 0x9, 0x3, 0x7fffffff, 0xb740, 0xca9f, 0x9, 0x20001e58, 0x8, 0xf39e, 0x3, 0x1539b804, 0x7, 0x1, 0x2]}) ioctl$COMEDI_INSN(r5, 0x8028640c, 0x0) bind$xdp(r4, 0x0, 0x0) r6 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000005a00), 0x0, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffe1c) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) sendto$inet(r1, 0x0, 0x0, 0xe61e2840a154b0c0, &(0x7f0000000000)={0x2, 0x4e22, @remote}, 0x10) 549.568934ms ago: executing program 2 (id=965): syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_tables_matches\x00') r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = fsopen(&(0x7f0000000080)='msdos\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) dup(r2) socket$inet_tcp(0x2, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x40) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) syz_open_dev$midi(&(0x7f0000000080), 0x3, 0x8ac02) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) socket$inet6(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) socket$kcm(0x2, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) memfd_create(&(0x7f0000002b40)='/$!}\\\x00', 0x4) socket$l2tp(0x2, 0x2, 0x73) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) epoll_create1(0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="043e1d", @ANYRES16=r3], 0x22) 420.443831ms ago: executing program 1 (id=966): socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/netdevsim/del_device\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='0', 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e22, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000140)={0x100000011, @multicast2, 0x0, 0x0, 'rr\x00', 0x9, 0xf, 0x5b}, 0x2c) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x3f, &(0x7f0000000380)=0x4, 0x4) openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000180)=@bpf_lsm={0x6, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5800000055003d07000000000001000007000000", @ANYRES32=r5, @ANYBLOB="20000280", @ANYRES32=r4], 0x58}}, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r3, 0x1f, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000072c0), r6) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000007300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_START_P2P_DEVICE(r6, &(0x7f0000008180)={0x0, 0x0, &(0x7f0000008140)={&(0x7f0000008100)={0x1c, r7, 0x1, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8884}, 0x4800) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8481f0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 290.415173ms ago: executing program 3 (id=967): socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x80}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r8, r7, &(0x7f0000000180)={0x0, 0x3e0e, 0x8, 0x3, 0x28e, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb8bf, 0x1, 0x4, 0x1af}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9, 0x2, 0x4, 0x207, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1313, 0x40, 0x4, 0x2db, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5027, 0x20000, 0x3, 0x1fc}}], 0x4, &(0x7f0000001f40)={0x2e, 0x76, 0x0, r8, 0xc0107526, 0x0, 0x0, 0x0, 0x0, {0x10}, 0x0, r6, '\x00', {0x3, 0xc46, 0x100104, 0x0}}, 0x0) socket$kcm(0x29, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x5, 0x2) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r9 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @private=0xa010101}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x36}}, {0x2, 0x4e24, @rand_addr=0x64010100}, 0x1d7, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x4, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r9], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r10, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r10, &(0x7f0000000000), 0xd) 289.905594ms ago: executing program 3 (id=968): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1e) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000140)={0xcf47, 0x19, 0x7, 0x9dff, 0x7, "8003e3ffff072000"}) write$binfmt_aout(r0, &(0x7f0000000140)=ANY=[], 0xff2e) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) sendmmsg$inet(r1, &(0x7f0000000100)=[{{&(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x64010101}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000680)="fa61", 0x2}], 0x1}}], 0x1, 0x20040804) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000140)=0xffff0000, 0x4) sendmsg$NL80211_CMD_GET_MPATH(0xffffffffffffffff, 0x0, 0x48) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000880)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x38, [0xb, 0xc95a, 0x1, 0x8, 0x7ffffffb, 0x2, 0x80007, 0x83, 0x20000006, 0xcc, 0x6, 0x5f, 0x8, 0x5, 0x1, 0xffffff00, 0x4, 0x3, 0x0, 0x5, 0x6, 0x9, 0x7, 0x3c5b, 0x1, 0x24, 0x1, 0x1, 0x5, 0xffffffff, 0x5, 0x4, 0x3, 0x89d2, 0x9, 0x4c74, 0x80000000, 0x40000, 0x0, 0xe, 0xfffffffc, 0x80008071, 0x7, 0x17, 0xd, 0x3, 0xfffffa01, 0x42, 0x8f, 0x4006, 0x6, 0x80000000, 0x0, 0x7, 0x8, 0x400, 0x80, 0x0, 0x4, 0x3, 0x6, 0x4, 0x7, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0x11, 0x400, 0x6c7, 0x2, 0xfffffffc, 0x3, 0x0, 0x84, 0x6, 0x2f, 0x10, 0x312, 0xd, 0xffff, 0x800002, 0x4, 0x7, 0x7fff, 0x5a7c, 0x7ffe, 0x401, 0x5, 0x7, 0x0, 0x1, 0x4, 0x5f31, 0xd, 0x7f, 0x2, 0x4, 0xb, 0x3ff, 0x2000c, 0x8, 0x9, 0x9, 0x47, 0x60f6, 0xffffffff, 0xfe000000, 0xfffe, 0xfffffffe, 0x4, 0x9, 0x5, 0x3, 0x8, 0xa6d, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x3, 0x1], [0x7, 0x408, 0x8004, 0x6, 0xffffffff, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x2000000, 0x1ef, 0x5, 0x8, 0x30000, 0x3, 0x30f0, 0x7, 0xb, 0x5, 0x2, 0x0, 0x5a9c, 0x20000008, 0x4, 0x9c2cf8d, 0x6, 0x1, 0x6, 0x1fe, 0x7c, 0x7, 0x7, 0x0, 0xffe, 0xa2, 0x7, 0x4000a9, 0x5, 0x7, 0x6, 0x2000af, 0xfffffffe, 0x1000, 0x7ff, 0x125, 0x4, 0x7, 0xfff, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x6, 0x0, 0x27], [0x9, 0xbb33, 0x9, 0x81, 0x8, 0x3, 0x3, 0x6, 0x0, 0xb9, 0x4e7, 0x5, 0x2, 0x8007, 0x4, 0x8000003, 0x101, 0x10000, 0x4, 0x7ffc, 0x81, 0x2000a620, 0x2, 0x7, 0x1, 0x2, 0xfffffffc, 0xe7, 0x8, 0x10000018, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x9, 0xfffff000, 0x10000, 0x1, 0x101, 0x9000, 0x20009602, 0x7, 0xaf, 0x8, 0x4, 0xffffffff, 0x5, 0x45, 0xc, 0x30b1d693, 0x5, 0x1f40, 0x4, 0x41, 0x6c1b, 0x0, 0x804, 0xac1, 0xb1e, 0xd7, 0x9, 0xffff3441, 0x7ff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x300}], 0x20000000000000dc, 0x0, 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = dup(r2) ioctl$TIOCSSOFTCAR(r3, 0x541a, &(0x7f00000001c0)=0xb4800000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x5}}]}, 0x40}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xfff3, 0x7}, {}, {0xa, 0xc}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x14, 0x2, [@TCA_CGROUP_EMATCHES={0x10, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x7}}, @TCA_EMATCH_TREE_LIST={0x4}]}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x40010) ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000180)={0x2, {0x2, 0x6, 0x8, 0x5, 0x1ff}}) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x7fff, 0x16, "b0bfac0000000003000018bfff4000"}) r8 = syz_open_pts(r0, 0x200) dup3(r8, r0, 0x0) r9 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r9, 0x40345410, &(0x7f00000083c0)={{0x3}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r9, 0x54a2) 289.512339ms ago: executing program 1 (id=969): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x44732}}, 0x10) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000180)={0x1, 0xfeaf, 0xfa00, {&(0x7f0000000140)}}, 0x18) r1 = socket(0x10, 0x3, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r1, 0x111, 0x2, 0x1, 0x4) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) r3 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc0000000904"], 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0xc, 0x0) ioctl$I2C_RDWR(r4, 0x707, &(0x7f00000007c0)={&(0x7f0000000240)=[{0x8001, 0x10, 0x0, 0x0}], 0x1}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000000)={'veth1\x00', @multicast}) mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, &(0x7f0000000400)='\x00') mkdir(&(0x7f0000000500)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000080)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ff) symlink(&(0x7f0000000900)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', &(0x7f0000000a00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlink(&(0x7f0000000b00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/ss/h\x00') mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ff) mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ff) mkdir(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ff) symlink(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') symlink(&(0x7f0000001400)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001500)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') symlink(&(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x0) symlink(&(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0\x00', &(0x7f0000001900)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00') openat(0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) 169.382586ms ago: executing program 3 (id=970): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)={0xd}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x4, 0x8000007, 0x3, 0x180, 0x2, 0xc, 0xf1, 0xfab3, 0x5, 0x5, 0x0, 0xd, 0x0, 0x6, 0x0, 0xbd9], 0x1000, 0x43102}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000100)='./file0\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) pwritev2(r2, &(0x7f0000000980)=[{&(0x7f0000000500)}], 0x1, 0x5, 0xa, 0x14) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x7, 0x7, 0x582b04d7, 0x0, 0x1, 0xfffffff9}) ioctl$KVM_SET_FPU(r3, 0x41a0ae8d, &(0x7f0000000540)={'\x00', 0x200, 0x2, 0xf7, 0x0, 0x2583, 0x4000, 0xc000, '\x00', 0x4}) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDFONTOP_SET_DEF(r4, 0x4b72, &(0x7f00000013c0)={0x2, 0x1, 0x3, 0x15, 0xc4, 0x0}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r9, 0xc048aeca, &(0x7f0000000400)={0x8, 0x0, [{0x0, 0x0, 0x7}, {0x400000b3, 0x0, 0x1}, {0x2c, 0x0, 0x100000000}, {0x9bd, 0x0, 0x66}, {0x9a7, 0x0, 0x2000000f0a}, {0x809, 0x0, 0x3}, {0x879, 0x0, 0x8}, {0xb7a}]}) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) ioctl$KVM_CAP_X2APIC_API(r6, 0x4068aea3, &(0x7f0000002a80)={0x81, 0x0, 0x3}) ioctl$KVM_SIGNAL_MSI(r6, 0x4020aea5, &(0x7f0000000180)={0xeeee8000, 0x1000, 0xb3, 0x0, 0x5}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000300)={[0x7, 0x1000000000, 0x0, 0x200000000000043, 0x7, 0x0, 0x2004cb, 0x0, 0xa7c, 0x68ff, 0x7, 0x8000000009, 0x803, 0x0, 0x9], 0x8003000, 0x202}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0xc, 0x8, 0xb, 0xe6, 0xb, 0x0, 0x0, 0x83, 0x80}, {0x5000, 0x7000, 0x10, 0xff, 0x42, 0x5, 0x75, 0x3, 0x36, 0xfd, 0x2, 0x8f}, {0x0, 0xdddf1000, 0xe, 0x10, 0x3, 0x1, 0x0, 0x9, 0x1, 0xa4, 0x20, 0x8}, {0x1, 0xeeee0000, 0x1c, 0x6, 0x2, 0x42, 0x0, 0xff, 0x3, 0x7, 0x9}, {0xf000, 0xd000, 0xb, 0x3, 0x12, 0x7, 0xa9, 0x8, 0x9, 0x9, 0xfa, 0x97}, {0xeeefa000, 0xdddd0000, 0x8, 0xa0, 0x1, 0x8, 0x1, 0xa0, 0x82, 0x2f, 0x4, 0x9}, {0x3000, 0xb000, 0x4, 0x5, 0x7, 0x6, 0x7, 0x3, 0x8, 0x1, 0x40, 0x70}, {0x7000, 0x4000, 0xa, 0x4, 0xcd, 0x7, 0xb, 0x9, 0x2, 0x5, 0xb0, 0x81}, {0xeeef0000, 0x30}, {0xffffffff, 0x9}, 0x80000031, 0x0, 0xdddd1000, 0x2024, 0x800000a, 0xc501, 0x100000, [0xe5b5, 0x4, 0x3, 0x8]}) 241.874µs ago: executing program 3 (id=971): setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e22, 0x3, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3}}, 0x0, 0x0, 0x1d, 0x0, "bb02a3c364ca41d6357e54451cb740000076a8a20122e4dbbe00000000000000000000000000000008000000000000000000fe1605b105000000040000000000000020004615a8284d49017c00"}, 0xd8) r0 = socket$kcm(0x23, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) listen(r0, 0x800) accept4(r0, 0x0, 0x0, 0x80000) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff000000"], 0x78) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) 0s ago: executing program 2 (id=972): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f00000002c0), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x2, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='Test Gadget\x00', 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)='Conf 1\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1\x00', 0x0, 0x0) symlinkat(0x0, r2, &(0x7f00000005c0)='midi.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.2\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs/c.2/strings/0x409\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.2/strings/0x409/configuration\x00', 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.2\x00', 0x0, 0x0) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', r3, &(0x7f0000000740)='midi.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r4, &(0x7f00000007c0)='dummy_udc.0\x00', 0xb) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/usb/devices/2-1/bConfigurationValue\x00', 0x2, 0x0) write(r5, &(0x7f00000008c0)='2\x00', 0x2) write(r4, &(0x7f0000000920)='\n\x00', 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:15081' (ED25519) to the list of known hosts. [ 53.876249][ T42] kauditd_printk_skb: 17 callbacks suppressed [ 53.876262][ T42] audit: type=1400 audit(1785492680.712:138): avc: denied { name_bind } for pid=5722 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 53.913489][ T42] audit: type=1400 audit(1785492680.742:139): avc: denied { execute } for pid=5723 comm="sh" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 53.921821][ T42] audit: type=1400 audit(1785492680.752:140): avc: denied { execute_no_trans } for pid=5723 comm="sh" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 56.533932][ T42] audit: type=1400 audit(1785492683.362:141): avc: denied { mounton } for pid=5723 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 56.542574][ T42] audit: type=1400 audit(1785492683.372:142): avc: denied { mount } for pid=5723 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 56.545684][ T5723] cgroup: Unknown subsys name 'net' [ 56.554104][ T42] audit: type=1400 audit(1785492683.382:143): avc: denied { unmount } for pid=5723 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 56.738803][ T5723] cgroup: Unknown subsys name 'cpuset' [ 56.745173][ T5723] cgroup: Unknown subsys name 'rlimit' [ 56.900983][ T42] audit: type=1400 audit(1785492683.732:144): avc: denied { setattr } for pid=5723 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=850 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 56.910634][ T42] audit: type=1400 audit(1785492683.732:145): avc: denied { create } for pid=5723 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 56.919222][ T42] audit: type=1400 audit(1785492683.732:146): avc: denied { write } for pid=5723 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 56.927791][ T42] audit: type=1400 audit(1785492683.732:147): avc: denied { read } for pid=5723 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 56.973460][ T5728] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 57.821719][ T5723] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 61.972834][ T42] kauditd_printk_skb: 10 callbacks suppressed [ 61.972846][ T42] audit: type=1400 audit(1785492688.802:158): avc: denied { execmem } for pid=5733 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 62.182783][ T42] audit: type=1400 audit(1785492689.012:159): avc: denied { create } for pid=5736 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 62.192532][ T42] audit: type=1400 audit(1785492689.012:160): avc: denied { read write } for pid=5736 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 62.203835][ T42] audit: type=1400 audit(1785492689.012:161): avc: denied { open } for pid=5736 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 62.213753][ T42] audit: type=1400 audit(1785492689.032:162): avc: denied { ioctl } for pid=5736 comm="syz-executor" path="socket:[5466]" dev="sockfs" ino=5466 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 62.239278][ T5749] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 62.239868][ T5751] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 62.240288][ T5752] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 62.240937][ T5752] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 62.243651][ T5754] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 62.245149][ T5749] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 62.245959][ T5749] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 62.247185][ T5749] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 62.248049][ T5751] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 62.248747][ T5751] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 62.249546][ T5751] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 62.250504][ T5754] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 62.250546][ T5752] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 62.251533][ T5751] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 62.252513][ T5751] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 62.254649][ T5751] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 62.254883][ T5749] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 62.259919][ T5754] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 62.261251][ T5752] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 62.262206][ T5752] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 62.267278][ T42] audit: type=1400 audit(1785492689.102:163): avc: denied { read } for pid=5737 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 62.308393][ T42] audit: type=1400 audit(1785492689.102:164): avc: denied { open } for pid=5737 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 62.317795][ T42] audit: type=1400 audit(1785492689.102:165): avc: denied { mounton } for pid=5737 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 62.326567][ T42] audit: type=1400 audit(1785492689.102:166): avc: denied { module_request } for pid=5737 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 62.334390][ T42] audit: type=1400 audit(1785492689.142:167): avc: denied { sys_module } for pid=5737 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 63.019558][ T5738] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.023086][ T5738] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.026206][ T5738] bridge_slave_0: entered allmulticast mode [ 63.030037][ T5738] bridge_slave_0: entered promiscuous mode [ 63.035427][ T5738] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.038317][ T5738] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.041123][ T5738] bridge_slave_1: entered allmulticast mode [ 63.045296][ T5738] bridge_slave_1: entered promiscuous mode [ 63.163247][ T5738] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 63.198101][ T5738] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 63.221910][ T5737] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.225165][ T5737] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.228326][ T5737] bridge_slave_0: entered allmulticast mode [ 63.232543][ T5737] bridge_slave_0: entered promiscuous mode [ 63.238376][ T5737] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.241482][ T5737] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.244783][ T5737] bridge_slave_1: entered allmulticast mode [ 63.248673][ T5737] bridge_slave_1: entered promiscuous mode [ 63.272722][ T5736] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.276041][ T5736] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.280078][ T5736] bridge_slave_0: entered allmulticast mode [ 63.284095][ T5736] bridge_slave_0: entered promiscuous mode [ 63.289483][ T5736] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.292601][ T5736] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.296235][ T5736] bridge_slave_1: entered allmulticast mode [ 63.300219][ T5736] bridge_slave_1: entered promiscuous mode [ 63.341752][ T5738] team0: Port device team_slave_0 added [ 63.344404][ T5739] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.347505][ T5739] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.350655][ T5739] bridge_slave_0: entered allmulticast mode [ 63.355145][ T5739] bridge_slave_0: entered promiscuous mode [ 63.360257][ T5739] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.363333][ T5739] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.366946][ T5739] bridge_slave_1: entered allmulticast mode [ 63.371012][ T5739] bridge_slave_1: entered promiscuous mode [ 63.377536][ T5737] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 63.391053][ T5738] team0: Port device team_slave_1 added [ 63.410630][ T5737] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 63.416533][ T5736] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 63.424376][ T5736] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 63.448116][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.451057][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.461793][ T5738] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 63.475649][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 63.478662][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.490127][ T5738] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.508153][ T5739] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 63.524623][ T5739] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 63.549423][ T5737] team0: Port device team_slave_0 added [ 63.561569][ T5737] team0: Port device team_slave_1 added [ 63.565949][ T5736] team0: Port device team_slave_0 added [ 63.570988][ T5736] team0: Port device team_slave_1 added [ 63.601511][ T5739] team0: Port device team_slave_0 added [ 63.614616][ T5739] team0: Port device team_slave_1 added [ 63.634476][ T5736] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.637404][ T5736] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.648086][ T5736] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 63.675277][ T5737] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.677664][ T5737] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.686707][ T5737] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 63.690973][ T5736] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 63.693874][ T5736] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.704457][ T5736] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.713266][ T5738] hsr_slave_0: entered promiscuous mode [ 63.717048][ T5738] hsr_slave_1: entered promiscuous mode [ 63.729996][ T5737] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 63.732240][ T5737] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.740418][ T5737] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.754379][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.757099][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.765240][ T5739] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 63.786352][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 63.789265][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.799153][ T5739] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.851950][ T5736] hsr_slave_0: entered promiscuous mode [ 63.855342][ T5736] hsr_slave_1: entered promiscuous mode [ 63.859137][ T5736] debugfs: 'hsr0' already exists in 'hsr' [ 63.861609][ T5736] Cannot create hsr debugfs directory [ 63.928543][ T5737] hsr_slave_0: entered promiscuous mode [ 63.931647][ T5737] hsr_slave_1: entered promiscuous mode [ 63.934595][ T5737] debugfs: 'hsr0' already exists in 'hsr' [ 63.936926][ T5737] Cannot create hsr debugfs directory [ 63.950161][ T5739] hsr_slave_0: entered promiscuous mode [ 63.953230][ T5739] hsr_slave_1: entered promiscuous mode [ 63.956450][ T5739] debugfs: 'hsr0' already exists in 'hsr' [ 63.958786][ T5739] Cannot create hsr debugfs directory [ 64.284900][ T5748] Bluetooth: hci2: command tx timeout [ 64.285969][ T5738] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 64.294503][ T5748] Bluetooth: hci3: command tx timeout [ 64.294599][ T5746] Bluetooth: hci1: command tx timeout [ 64.295394][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 64.300104][ T5738] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 64.308775][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 64.312503][ T5738] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 64.318982][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 64.322739][ T5738] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 64.327323][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 64.374889][ T5746] Bluetooth: hci0: command tx timeout [ 64.385915][ T5736] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 64.390425][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 64.395031][ T5736] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 64.400222][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 64.418340][ T5736] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 64.422423][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 64.425758][ T5736] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 64.431038][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 64.479168][ T5739] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 64.483657][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 64.491706][ T5739] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 64.497859][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 64.501466][ T5739] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 64.507759][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 64.511464][ T5739] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 64.518591][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 64.573921][ T5737] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 64.578657][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 64.582652][ T5737] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 64.587446][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 64.590862][ T5737] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 64.594833][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 64.597732][ T5737] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 64.601496][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 64.653678][ T5738] 8021q: adding VLAN 0 to HW filter on device bond0 [ 64.681991][ T5736] 8021q: adding VLAN 0 to HW filter on device bond0 [ 64.688120][ T5738] 8021q: adding VLAN 0 to HW filter on device team0 [ 64.698352][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.701743][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.725536][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.728072][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.737254][ T5736] 8021q: adding VLAN 0 to HW filter on device team0 [ 64.747324][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.750335][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.768500][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.771522][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.783222][ T5739] 8021q: adding VLAN 0 to HW filter on device bond0 [ 64.808791][ T5739] 8021q: adding VLAN 0 to HW filter on device team0 [ 64.838326][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.841403][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.858145][ T5737] 8021q: adding VLAN 0 to HW filter on device bond0 [ 64.871601][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.874717][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.902806][ T5737] 8021q: adding VLAN 0 to HW filter on device team0 [ 64.928848][ T1166] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.931997][ T1166] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.952093][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.955212][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.171330][ T5738] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.212301][ T5738] veth0_vlan: entered promiscuous mode [ 65.223030][ T5738] veth1_vlan: entered promiscuous mode [ 65.244404][ T5736] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.282970][ T5738] veth0_macvtap: entered promiscuous mode [ 65.295203][ T5738] veth1_macvtap: entered promiscuous mode [ 65.306164][ T5739] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.339467][ T5736] veth0_vlan: entered promiscuous mode [ 65.346770][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.353952][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.377964][ T5737] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.380610][ T5736] veth1_vlan: entered promiscuous mode [ 65.426553][ T5739] veth0_vlan: entered promiscuous mode [ 65.463127][ T5739] veth1_vlan: entered promiscuous mode [ 65.465100][ T1166] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.469036][ T1166] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.472793][ T5736] veth0_macvtap: entered promiscuous mode [ 65.499700][ T5736] veth1_macvtap: entered promiscuous mode [ 65.509813][ T1168] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.516753][ T1168] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.523010][ T5737] veth0_vlan: entered promiscuous mode [ 65.538357][ T5737] veth1_vlan: entered promiscuous mode [ 65.546781][ T5736] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.556817][ T5739] veth0_macvtap: entered promiscuous mode [ 65.562010][ T5736] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.577693][ T5738] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 65.578474][ T5739] veth1_macvtap: entered promiscuous mode [ 65.620762][ T5737] veth0_macvtap: entered promiscuous mode [ 65.634494][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.648587][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.652179][ T5737] veth1_macvtap: entered promiscuous mode [ 65.670623][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.691013][ T1168] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.694456][ T1168] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.699673][ T5737] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.719511][ T5737] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.741536][ T100] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.745673][ T100] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.775086][ T5817] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.778403][ T5817] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.818038][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.828623][ T100] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.834438][ T100] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.863684][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.869812][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.902101][ T1166] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.908806][ T5894] pimreg3: entered allmulticast mode [ 65.909167][ T1166] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.935926][ T5789] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.951393][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.966391][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.006524][ T5817] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.021078][ T5817] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.047162][ T5789] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.055052][ T5789] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.068854][ T5902] netlink: 'syz.2.7': attribute type 1 has an invalid length. [ 66.125365][ T5817] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.129166][ T5817] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.131574][ T5907] netlink: 'syz.1.2': attribute type 1 has an invalid length. [ 66.131778][ T5908] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=5908 comm=syz.2.7 [ 66.151782][ T5907] bridge1: entered promiscuous mode [ 66.174407][ T5789] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.178317][ T5789] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.183471][ T5789] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.188306][ T5789] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.192165][ T5789] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.364881][ T5746] Bluetooth: hci1: command tx timeout [ 66.366377][ T5748] Bluetooth: hci2: command tx timeout [ 66.366418][ T5095] Bluetooth: hci3: command tx timeout [ 66.454780][ T5748] Bluetooth: hci0: command tx timeout [ 66.546940][ T5929] Zero length message leads to an empty skb [ 66.751686][ T1352] IPVS: starting estimator thread 0... [ 66.832670][ T5945] syzkaller0: entered promiscuous mode [ 66.836507][ T5945] syzkaller0: entered allmulticast mode [ 66.854825][ T5940] IPVS: using max 46 ests per chain, 110400 per kthread [ 67.028227][ T42] kauditd_printk_skb: 69 callbacks suppressed [ 67.028239][ T42] audit: type=1400 audit(1785492693.862:237): avc: denied { allowed } for pid=5953 comm="syz.1.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 67.040967][ T42] audit: type=1400 audit(1785492693.872:238): avc: denied { create } for pid=5953 comm="syz.1.23" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 67.046655][ T5952] netlink: 'syz.3.22': attribute type 1 has an invalid length. [ 67.166723][ T42] audit: type=1400 audit(1785492694.002:239): avc: denied { bind } for pid=5957 comm="syz.1.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 67.173065][ T5960] netlink: 24 bytes leftover after parsing attributes in process `syz.3.25'. [ 67.173287][ T42] audit: type=1400 audit(1785492694.002:240): avc: denied { setopt } for pid=5957 comm="syz.1.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 67.184084][ T42] audit: type=1400 audit(1785492694.002:241): avc: denied { create } for pid=5957 comm="syz.1.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 67.190691][ T42] audit: type=1400 audit(1785492694.012:242): avc: denied { connect } for pid=5957 comm="syz.1.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 67.210540][ T5960] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=5960 comm=syz.3.25 [ 67.220228][ T42] audit: type=1400 audit(1785492694.052:243): avc: denied { read } for pid=5961 comm="syz.1.26" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 67.228432][ T42] audit: type=1400 audit(1785492694.052:244): avc: denied { open } for pid=5961 comm="syz.1.26" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 67.237478][ T42] audit: type=1400 audit(1785492694.072:245): avc: denied { ioctl } for pid=5961 comm="syz.1.26" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 67.253409][ T42] audit: type=1400 audit(1785492694.072:246): avc: denied { set_context_mgr } for pid=5961 comm="syz.1.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 67.271567][ T5965] netlink: 4 bytes leftover after parsing attributes in process `syz.3.27'. [ 67.298258][ T5965] netlink: 4 bytes leftover after parsing attributes in process `syz.3.27'. [ 67.301878][ T5965] netlink: 4 bytes leftover after parsing attributes in process `syz.3.27'. [ 67.345092][ T5817] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 67.349211][ T5817] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 67.353197][ T5817] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 67.357880][ T5817] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 67.785276][ T5982] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.787588][ T5984] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -22341, delta: 1 [ 67.793413][ T5984] ref_ctr increment failed for inode: 0x45 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff888039e61980 [ 67.805559][ T5984] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -22341, delta: -1 [ 67.809293][ T5984] ref_ctr decrement failed for inode: 0x45 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff888039e61980 [ 67.813795][ T5984] uprobe: syz.2.36:5984 failed to unregister, leaking uprobe [ 68.225589][ T5982] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.241097][ T6005] syzkaller0: entered promiscuous mode [ 68.243492][ T6005] syzkaller0: entered allmulticast mode [ 68.252920][ T6007] syzkaller0: entered promiscuous mode [ 68.256414][ T6007] syzkaller0: entered allmulticast mode [ 68.321341][ T5982] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.445312][ T5748] Bluetooth: hci2: command tx timeout [ 68.445402][ T5746] Bluetooth: hci3: command tx timeout [ 68.445499][ T5095] Bluetooth: hci1: command tx timeout [ 68.473409][ T5982] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.524761][ T5746] Bluetooth: hci0: command tx timeout [ 68.598268][ T5789] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.609596][ T5817] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.631495][ T5817] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.637167][ T5817] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.760868][ T6029] netlink: 12 bytes leftover after parsing attributes in process `syz.2.52'. [ 68.779192][ T6029] tipc: Started in network mode [ 68.780970][ T6029] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 68.786137][ T6029] tipc: Enabled bearer , priority 10 [ 68.799913][ T6031] syzkaller0: entered promiscuous mode [ 68.802273][ T6031] syzkaller0: entered allmulticast mode [ 68.917746][ T6039] kvm: pic: level sensitive irq not supported [ 69.042126][ T6054] netlink: 24 bytes leftover after parsing attributes in process `syz.0.61'. [ 69.171071][ T6062] netlink: 112 bytes leftover after parsing attributes in process `syz.2.64'. [ 69.331106][ T6074] netlink: 'syz.3.68': attribute type 1 has an invalid length. [ 69.342658][ T6074] gretap1: entered allmulticast mode [ 69.905403][ T5741] tipc: Node number set to 1 [ 70.159660][ T6107] netlink: 12 bytes leftover after parsing attributes in process `syz.1.81'. [ 70.164369][ T6105] oom_control is deprecated and will be removed. Please report your usecase to linux-mm-@kvack.org if you depend on this functionality. [ 70.524639][ T5746] Bluetooth: hci3: command tx timeout [ 70.525305][ T5748] Bluetooth: hci1: command tx timeout [ 70.525349][ T5095] Bluetooth: hci2: command tx timeout [ 70.616327][ T5748] Bluetooth: hci0: command tx timeout [ 70.747931][ T6124] netlink: 68 bytes leftover after parsing attributes in process `syz.2.88'. [ 70.820509][ T6128] Illegal XDP return value 32768 on prog (id 12) dev N/A, expect packet loss! [ 70.927108][ T6131] bond1: (slave ip6gretap1): making interface the new active one [ 70.930729][ T6131] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 71.012815][ T6134] sctp: [Deprecated]: syz.1.92 (pid 6134) Use of struct sctp_assoc_value in delayed_ack socket option. [ 71.012815][ T6134] Use struct sctp_sack_info instead [ 71.178673][ T6138] ======================================================= [ 71.178673][ T6138] WARNING: The mand mount option has been deprecated and [ 71.178673][ T6138] and is ignored by this kernel. Remove the mand [ 71.178673][ T6138] option from the mount to silence this warning. [ 71.178673][ T6138] ======================================================= [ 71.415000][ T5817] netdevsim netdevsim10 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.436194][ T5817] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.966336][ T1445] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.969851][ T1445] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.007298][ T6163] netlink: 20 bytes leftover after parsing attributes in process `syz.3.101'. [ 72.022261][ T6163] netlink: 'syz.3.101': attribute type 6 has an invalid length. [ 72.103209][ T6165] netlink: 'syz.3.102': attribute type 3 has an invalid length. [ 72.186250][ T42] kauditd_printk_skb: 174 callbacks suppressed [ 72.186266][ T42] audit: type=1400 audit(1785492699.022:421): avc: denied { unmount } for pid=5736 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 72.469847][ T6177] vlan2: entered promiscuous mode [ 72.472660][ T6177] hsr0: entered promiscuous mode [ 72.478000][ T6177] vlan2: entered allmulticast mode [ 72.480067][ T6177] hsr0: entered allmulticast mode [ 72.481918][ T6177] hsr_slave_0: entered allmulticast mode [ 72.483967][ T6177] hsr_slave_1: entered allmulticast mode [ 72.531852][ T42] audit: type=1400 audit(1785492699.362:422): avc: denied { map } for pid=6184 comm="syz.1.110" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=11982 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 72.541796][ T42] audit: type=1400 audit(1785492699.362:423): avc: denied { read write } for pid=6184 comm="syz.1.110" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=11982 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 72.551523][ T42] audit: type=1400 audit(1785492699.372:424): avc: denied { map } for pid=6184 comm="syz.1.110" path="socket:[11983]" dev="sockfs" ino=11983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 72.568374][ T42] audit: type=1400 audit(1785492699.402:425): avc: denied { create } for pid=6186 comm="syz.2.111" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 72.918274][ T6195] gadgetfs: bound to dummy_udc driver [ 73.031146][ T42] audit: type=1400 audit(1785492699.862:426): avc: denied { cmd } for pid=6198 comm="syz.3.114" path="socket:[10935]" dev="sockfs" ino=10935 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 73.107949][ T6195] gadgetfs: suspended from state 2 [ 73.145115][ T42] audit: type=1400 audit(1785492699.982:427): avc: denied { unmount } for pid=5736 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 73.175490][ T1044] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 73.276815][ T42] audit: type=1400 audit(1785492700.102:428): avc: denied { unmount } for pid=6214 comm="syz.1.118" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 73.306593][ T42] audit: type=1400 audit(1785492700.132:429): avc: denied { mount } for pid=6205 comm="syz.2.117" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 73.346184][ T42] audit: type=1400 audit(1785492700.182:430): avc: denied { rename } for pid=6222 comm="syz.3.119" name="file0" dev="tmpfs" ino=154 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 73.380142][ T6225] syz_tun: entered allmulticast mode [ 73.397494][ T6225] lo: entered allmulticast mode [ 73.430127][ T6224] syz_tun: left allmulticast mode [ 73.452550][ T6230] syz_tun: entered promiscuous mode [ 73.464415][ T6230] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 73.561623][ T6232] 9pnet: p9_errstr2errno: server reported unknown error 0x0000000000 [ 73.578211][ T6237] syz.0.125 uses obsolete (PF_INET,SOCK_PACKET) [ 74.996876][ T6278] __nla_validate_parse: 2 callbacks suppressed [ 74.996893][ T6278] netlink: 24 bytes leftover after parsing attributes in process `syz.3.140'. [ 75.043641][ T6276] netlink: 4 bytes leftover after parsing attributes in process `syz.1.139'. [ 75.075654][ T6278] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=6278 comm=syz.3.140 [ 75.266989][ T6250] Set syz1 is full, maxelem 65536 reached [ 75.511757][ T6299] syzkaller0: entered promiscuous mode [ 75.514289][ T6299] syzkaller0: entered allmulticast mode [ 75.996348][ T6317] tipc: Enabling of bearer rejected, failed to enable media [ 76.288558][ T6340] syzkaller0: entered promiscuous mode [ 76.290990][ T6340] syzkaller0: entered allmulticast mode [ 76.513433][ T6354] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 76.517057][ T6356] fuse: fd is not a fuse device [ 76.517271][ T6354] @0Ù: renamed from bond_slave_1 (while UP) [ 76.637855][ T6362] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 76.690359][ T6364] Bluetooth: MGMT ver 1.23 [ 77.027383][ T6379] netlink: 12 bytes leftover after parsing attributes in process `syz.0.179'. [ 77.056220][ T6379] 8021q: adding VLAN 0 to HW filter on device bond1 [ 77.129709][ T6379] bond1: (slave veth3): Enslaving as an active interface with an up link [ 77.160842][ T6382] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 77.379231][ T42] kauditd_printk_skb: 25 callbacks suppressed [ 77.379271][ T42] audit: type=1400 audit(1785492704.212:456): avc: denied { read write } for pid=6394 comm="syz.3.185" name="vbi2" dev="devtmpfs" ino=991 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 77.449464][ T42] audit: type=1400 audit(1785492704.212:457): avc: denied { open } for pid=6394 comm="syz.3.185" path="/dev/vbi2" dev="devtmpfs" ino=991 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 77.511282][ T6401] netlink: 'syz.3.188': attribute type 1 has an invalid length. [ 77.595993][ T6401] bond1: entered promiscuous mode [ 77.602395][ T6401] 8021q: adding VLAN 0 to HW filter on device bond1 [ 77.803392][ T6405] veth5: entered allmulticast mode [ 77.813975][ T6405] bond1: (slave veth5): making interface the new active one [ 77.819281][ T6405] veth5: entered promiscuous mode [ 77.821911][ T6405] bond1: (slave veth5): Enslaving as an active interface with an up link [ 77.838815][ T6401] bond1: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 77.855719][ T6401] bond1: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 77.975084][ T6422] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 78.045202][ T6424] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 78.069587][ T42] audit: type=1400 audit(1785492704.892:458): avc: denied { transfer } for pid=6423 comm="syz.3.196" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 78.110412][ T6427] tipc: Started in network mode [ 78.110577][ T6428] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 78.112311][ T6427] tipc: Node identity ac14140f, cluster identity 4711 [ 78.118855][ T6427] tipc: New replicast peer: 255.255.255.255 [ 78.121623][ T6427] tipc: Enabled bearer , priority 10 [ 78.354618][ T42] audit: type=1400 audit(1785492705.182:459): avc: denied { mounton } for pid=6435 comm="syz.3.200" path="/46/file0" dev="tmpfs" ino=270 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 78.583358][ T42] audit: type=1400 audit(1785492705.412:460): avc: denied { create } for pid=6440 comm="syz.3.202" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 78.606213][ T6443] netlink: 'syz.2.203': attribute type 1 has an invalid length. [ 78.618150][ T42] audit: type=1400 audit(1785492705.452:461): avc: denied { bind } for pid=6440 comm="syz.3.202" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 78.634788][ T6443] 8021q: adding VLAN 0 to HW filter on device bond1 [ 78.640956][ T42] audit: type=1400 audit(1785492705.472:462): avc: denied { listen } for pid=6440 comm="syz.3.202" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 78.649434][ T5748] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 78.653191][ T5748] CPU: 0 UID: 0 PID: 5748 Comm: kworker/u34:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 78.653210][ T5748] Tainted: [L]=SOFTLOCKUP [ 78.653214][ T5748] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.653222][ T5748] Workqueue: hci3 hci_rx_work [ 78.653291][ T5748] Call Trace: [ 78.653308][ T5748] [ 78.653313][ T5748] dump_stack_lvl+0x100/0x190 [ 78.653352][ T5748] sysfs_warn_dup.cold+0x1c/0x28 [ 78.653371][ T5748] sysfs_create_dir_ns+0x24b/0x2b0 [ 78.653395][ T5748] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 78.653412][ T5748] ? find_held_lock+0x2b/0x80 [ 78.653428][ T5748] ? kobject_add_internal+0x25f/0x930 [ 78.653451][ T5748] ? kobject_add_internal+0x25f/0x930 [ 78.653468][ T5748] ? do_raw_spin_unlock+0x145/0x1e0 [ 78.653484][ T5748] kobject_add_internal+0x2c8/0x930 [ 78.653503][ T5748] kobject_add+0x16a/0x1e0 [ 78.653519][ T5748] ? __pfx_kobject_add+0x10/0x10 [ 78.653535][ T5748] ? class_to_subsys+0x10f/0x150 [ 78.653566][ T5748] ? kobject_put+0xb9/0x640 [ 78.653580][ T5748] ? _raw_spin_unlock+0x28/0x50 [ 78.653594][ T5748] device_add+0x294/0x1970 [ 78.653610][ T5748] ? __pfx_dev_set_name+0x10/0x10 [ 78.653628][ T5748] ? __pfx_device_add+0x10/0x10 [ 78.653644][ T5748] ? mgmt_send_event_skb+0x2fb/0x460 [ 78.653661][ T5748] hci_conn_add_sysfs+0x1a3/0x260 [ 78.653678][ T5748] le_conn_complete_evt+0x11eb/0x1f60 [ 78.653693][ T5748] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 78.653704][ T5748] ? hci_event_packet+0x186/0xcd0 [ 78.653719][ T5748] hci_le_conn_complete_evt+0x23c/0x3a0 [ 78.653731][ T5748] ? skb_pull_data+0x15f/0x1e0 [ 78.653755][ T5748] hci_le_meta_evt+0x34a/0x5f0 [ 78.653769][ T5748] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 78.653782][ T5748] hci_event_packet+0x51c/0xcd0 [ 78.653794][ T5748] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 78.653807][ T5748] ? __pfx_hci_event_packet+0x10/0x10 [ 78.653820][ T5748] ? kcov_remote_start+0x384/0x670 [ 78.653838][ T5748] ? lockdep_hardirqs_on+0x78/0x100 [ 78.653853][ T5748] hci_rx_work+0x451/0xfc0 [ 78.653867][ T5748] process_one_work+0xa23/0x1940 [ 78.653885][ T5748] ? __pfx_process_one_work+0x10/0x10 [ 78.653901][ T5748] ? __pfx_hci_rx_work+0x10/0x10 [ 78.653919][ T5748] worker_thread+0x5ef/0xe50 [ 78.653938][ T5748] ? kthread+0x13a/0x450 [ 78.653949][ T5748] ? __pfx_worker_thread+0x10/0x10 [ 78.653960][ T5748] kthread+0x370/0x450 [ 78.653970][ T5748] ? __pfx_kthread+0x10/0x10 [ 78.653982][ T5748] ret_from_fork+0x72b/0xd50 [ 78.654001][ T5748] ? __pfx_ret_from_fork+0x10/0x10 [ 78.654018][ T5748] ? __switch_to+0x800/0x10f0 [ 78.654030][ T5748] ? __pfx_kthread+0x10/0x10 [ 78.654042][ T5748] ret_from_fork_asm+0x1a/0x30 [ 78.654073][ T5748] [ 78.654096][ T5748] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 78.738275][ T42] audit: type=1400 audit(1785492705.572:463): avc: denied { mount } for pid=6450 comm="syz.1.206" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 78.740738][ T5748] Bluetooth: hci3: failed to register connection device [ 78.769480][ T6443] veth3: entered promiscuous mode [ 78.775441][ T6443] bond1: (slave veth3): Enslaving as an active interface with a down link [ 78.787866][ T6449] bond1: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 78.902515][ T1044] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 78.919950][ T42] audit: type=1400 audit(1785492705.752:464): avc: denied { write } for pid=6455 comm="syz.2.207" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 78.971663][ T42] audit: type=1400 audit(1785492705.802:465): avc: denied { read } for pid=6455 comm="syz.2.207" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 79.054303][ T1044] usb 8-1: Using ep0 maxpacket: 8 [ 79.060218][ T1044] usb 8-1: config 0 has no interfaces? [ 79.068133][ T1044] usb 8-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 79.074259][ T1044] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.084299][ T1044] usb 8-1: Product: syz [ 79.085706][ T1044] usb 8-1: Manufacturer: syz [ 79.087370][ T1044] usb 8-1: SerialNumber: syz [ 79.097533][ T1044] usb 8-1: config 0 descriptor?? [ 79.234326][ T1044] tipc: Node number set to 2886997007 [ 79.352198][ T9] usb 8-1: USB disconnect, device number 2 [ 79.678726][ T6470] bridge0: port 3(wlan1) entered blocking state [ 79.684023][ T6470] bridge0: port 3(wlan1) entered disabled state [ 79.688139][ T6470] mac80211_hwsim hwsim5 wlan1: entered allmulticast mode [ 79.693597][ T6470] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode [ 79.699870][ T6470] bridge0: port 3(wlan1) entered blocking state [ 79.702707][ T6470] bridge0: port 3(wlan1) entered forwarding state [ 79.881910][ T6479] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 79.886780][ T6479] udc usbip-vudc.0: failed to start g1: -19 [ 79.891633][ T6479] UDC core: g1: couldn't find an available UDC or it's busy [ 80.019703][ T6490] syzkaller0: entered promiscuous mode [ 80.021543][ T6490] syzkaller0: entered allmulticast mode [ 80.048750][ T6491] syzkaller0: entered promiscuous mode [ 80.051194][ T6491] syzkaller0: entered allmulticast mode [ 80.168011][ T6210] bridge0: port 3(wlan1) entered disabled state [ 80.192027][ T6502] process 'syz.0.223' launched './file0' with NULL argv: empty string added [ 80.201533][ T6502] ªªªªªªI¡§å!qƒú: renamed from lo (while UP) [ 80.264012][ T6508] team0 (unregistering): Port device team_slave_0 removed [ 80.272920][ T6508] team0 (unregistering): Port device team_slave_1 removed [ 80.451534][ T6514] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 80.483342][ T6517] netlink: 4 bytes leftover after parsing attributes in process `syz.2.228'. [ 80.567468][ T6521] Bluetooth: (null): Invalid header checksum [ 80.679721][ T6524] binder: 6523:6524 ioctl c0306201 200000000680 returned -14 [ 80.737003][ T6526] syzkaller0: entered promiscuous mode [ 80.739454][ T6526] syzkaller0: entered allmulticast mode [ 80.858362][ T6528] ubi0: attaching mtd0 [ 80.870990][ T6528] ubi0: scanning is finished [ 80.875755][ T6528] ubi0: empty MTD device detected [ 80.909921][ T6533] fuse: fd is not a fuse device [ 80.960635][ T6534] UBIFS error (pid: 6534): cannot open "ubi0_0", error -19 [ 81.124267][ T6528] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 81.130118][ T6528] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 81.132468][ T6528] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 81.134906][ T6528] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 81.137353][ T6528] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 81.139828][ T6528] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 81.142362][ T6528] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 411010597 [ 81.146106][ T6528] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 81.149812][ T6546] ubi0: background thread "ubi_bgt0d" started, PID 6546 [ 81.360254][ T6558] file system registered [ 81.371307][ T6558] read descriptors [ 81.388867][ T5738] ffs_data_put(): freeing [ 82.602804][ T42] kauditd_printk_skb: 38 callbacks suppressed [ 82.602820][ T42] audit: type=1400 audit(1785492709.432:504): avc: denied { connect } for pid=6581 comm="syz.2.251" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 82.741394][ T42] audit: type=1400 audit(1785492709.572:505): avc: denied { bind } for pid=6587 comm="syz.2.254" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 82.755637][ T42] audit: type=1400 audit(1785492709.582:506): avc: denied { listen } for pid=6587 comm="syz.2.254" laddr=172.20.20.38 lport=20001 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 82.837176][ T6595] netlink: 156 bytes leftover after parsing attributes in process `syz.2.257'. [ 82.881401][ T42] audit: type=1400 audit(1785492709.712:507): avc: denied { search } for pid=6598 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.901085][ T42] audit: type=1400 audit(1785492709.712:508): avc: denied { search } for pid=6598 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=1837 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.920870][ T42] audit: type=1400 audit(1785492709.712:509): avc: denied { search } for pid=6598 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.930747][ T42] audit: type=1400 audit(1785492709.712:510): avc: denied { search } for pid=6598 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1842 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.941806][ T42] audit: type=1400 audit(1785492709.722:511): avc: denied { read } for pid=6601 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1842 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.952998][ T42] audit: type=1400 audit(1785492709.722:512): avc: denied { read open } for pid=6601 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1842 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.962229][ T42] audit: type=1400 audit(1785492709.722:513): avc: denied { getattr } for pid=6601 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1842 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.981044][ T6600] netlink: 14 bytes leftover after parsing attributes in process `syz.1.259'. [ 83.079469][ T6595] bridge0: port 3(wlan1) entered disabled state [ 83.938479][ T6668] binder_alloc: 6667: pid 6667 spamming oneway? 1 buffers allocated for a total size of 4096 [ 84.018759][ T6671] netlink: 8 bytes leftover after parsing attributes in process `syz.2.275'. [ 84.375610][ T6679] netlink: 12 bytes leftover after parsing attributes in process `syz.2.278'. [ 85.304486][ T6724] netlink: 36 bytes leftover after parsing attributes in process `syz.3.293'. [ 85.485982][ T5746] Bluetooth: hci3: command 0x0406 tx timeout [ 85.599378][ T6741] netlink: 4 bytes leftover after parsing attributes in process `syz.2.298'. [ 85.805775][ T6754] bridge0: port 3(syz_tun) entered blocking state [ 85.808547][ T6754] bridge0: port 3(syz_tun) entered disabled state [ 85.810859][ T6754] syz_tun: entered allmulticast mode [ 85.813549][ T6754] syz_tun: entered promiscuous mode [ 85.818910][ T6754] bridge0: port 3(syz_tun) entered blocking state [ 85.821862][ T6754] bridge0: port 3(syz_tun) entered forwarding state [ 85.837819][ T6754] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 86.463161][ T6774] netlink: 4 bytes leftover after parsing attributes in process `syz.0.308'. [ 86.690946][ T6789] fuse: fd is not a fuse device [ 86.725153][ T6782] netlink: 36 bytes leftover after parsing attributes in process `syz.2.313'. [ 86.962523][ T6801] netlink: 'syz.2.319': attribute type 1 has an invalid length. [ 86.983477][ T6801] 8021q: adding VLAN 0 to HW filter on device bond2 [ 87.015700][ T6801] vlan2: entered allmulticast mode [ 87.018050][ T6801] macsec0: entered allmulticast mode [ 87.020457][ T6801] veth1_macvtap: entered allmulticast mode [ 87.023931][ T6801] bond2: (slave vlan2): Error -34 calling dev_set_mtu [ 87.373229][ T34] cfg80211: failed to load regulatory.db [ 87.491651][ T6811] syzkaller0: entered promiscuous mode [ 87.494094][ T6811] syzkaller0: entered allmulticast mode [ 87.700193][ T6813] netlink: 'syz.2.324': attribute type 39 has an invalid length. [ 87.940078][ T6816] netlink: 24 bytes leftover after parsing attributes in process `syz.0.326'. [ 87.972848][ T42] kauditd_printk_skb: 90 callbacks suppressed [ 87.972864][ T42] audit: type=1400 audit(1785492714.802:604): avc: denied { name_bind } for pid=6817 comm="syz.2.325" src=28416 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 88.027033][ T6816] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=6816 comm=syz.0.326 [ 88.583234][ T42] audit: type=1400 audit(1785492715.412:605): avc: denied { read } for pid=6832 comm="syz.0.331" name="trace" dev="tracefs" ino=2933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 88.668470][ T6835] 0: reclassify loop, rule prio 0, protocol 03 [ 88.953880][ T6845] geneve2: entered promiscuous mode [ 89.007351][ T5746] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 89.011851][ T5746] Bluetooth: hci0: Injecting HCI hardware error event [ 89.016129][ T5746] Bluetooth: hci0: hardware error 0x00 [ 89.037319][ T6848] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 89.043435][ T6848] udc usbip-vudc.0: failed to start g1: -19 [ 89.065747][ T6848] UDC core: g1: couldn't find an available UDC or it's busy [ 89.691482][ T42] audit: type=1400 audit(1785492716.522:606): avc: denied { write } for pid=6869 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.787618][ T42] audit: type=1400 audit(1785492716.622:607): avc: denied { write } for pid=6874 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.111305][ T42] audit: type=1400 audit(1785492716.942:608): avc: denied { rename } for pid=6884 comm="syz.2.350" name="file0" dev="tmpfs" ino=572 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 90.207371][ T6887] 9pnet: p9_errstr2errno: server reported unknown error 0x000000000 [ 90.580462][ T6918] netlink: 14 bytes leftover after parsing attributes in process `syz.0.361'. [ 90.593567][ T6918] bond1: (slave dummy0): Releasing backup interface [ 91.021434][ T6937] 9pnet: p9_errstr2errno: server reported unknown error 0x0000000000 [ 91.031466][ T6939] syzkaller0: entered promiscuous mode [ 91.034270][ T6939] syzkaller0: entered allmulticast mode [ 91.079860][ T42] audit: type=1400 audit(1785492717.912:609): avc: denied { write } for pid=6943 comm="syz.0.371" name="functions" dev="configfs" ino=12445 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 91.086415][ T5746] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 91.242637][ T6949] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 91.257734][ T6949] @0Ù: renamed from bond_slave_1 (while UP) [ 91.466703][ T6956] netlink: 24 bytes leftover after parsing attributes in process `syz.1.377'. [ 91.510349][ T6952] netlink: 14 bytes leftover after parsing attributes in process `syz.3.375'. [ 91.527914][ T6954] syzkaller0: entered promiscuous mode [ 91.532789][ T6954] syzkaller0: entered allmulticast mode [ 91.547367][ T6956] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=6956 comm=syz.1.377 [ 91.830049][ T42] audit: type=1400 audit(1785492718.662:610): avc: denied { mount } for pid=6966 comm="syz.3.380" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 91.830817][ T6967] ubi: mtd0 is already attached to ubi0 [ 91.901638][ T6971] ubi0 error: ubi_open_volume: cannot open device 0, volume 0, error -19 [ 91.906833][ T6971] UBIFS error (pid: 6971): cannot open "ubi0_0", error -19 [ 92.730813][ T6976] syzkaller0: entered promiscuous mode [ 92.736447][ T6976] syzkaller0: entered allmulticast mode [ 92.769967][ T6974] gadgetfs: bound to dummy_udc driver [ 92.929701][ T6985] syz_tun: entered promiscuous mode [ 92.936598][ T6985] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 92.949072][ T42] audit: type=1400 audit(1785492719.782:611): avc: denied { write } for pid=6981 comm="syz.0.386" name="snmp" dev="proc" ino=4026532912 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 92.974782][ T6974] gadgetfs: suspended from state 2 [ 93.004460][ T9] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 93.043691][ T6988] netlink: 24 bytes leftover after parsing attributes in process `syz.3.388'. [ 93.081689][ T6988] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=6988 comm=syz.3.388 [ 93.712094][ T42] audit: type=1400 audit(1785492720.542:612): avc: denied { write } for pid=6989 comm="syz.3.390" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 93.722250][ T42] audit: type=1400 audit(1785492720.542:613): avc: denied { nlmsg_write } for pid=6989 comm="syz.3.390" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 93.794793][ T6995] geneve2: entered promiscuous mode [ 93.867393][ T7004] netlink: 'syz.0.397': attribute type 1 has an invalid length. [ 93.881701][ T7004] 8021q: adding VLAN 0 to HW filter on device bond2 [ 93.922888][ T7007] ubi0 error: ubi_open_volume: cannot open device 0, volume 0, error -19 [ 93.927903][ T7007] UBIFS error (pid: 7007): cannot open "ubi0_0", error -19 [ 93.965001][ T7004] veth7: entered promiscuous mode [ 93.977025][ T7004] bond2: (slave veth7): Enslaving as an active interface with a down link [ 93.994380][ T7011] bond2: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 94.139589][ T7016] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 95.036290][ T7000] Set syz1 is full, maxelem 65536 reached [ 95.150026][ T7025] syzkaller0: entered promiscuous mode [ 95.151957][ T7025] syzkaller0: entered allmulticast mode [ 95.206823][ T7030] netlink: 'syz.2.406': attribute type 1 has an invalid length. [ 95.229793][ T7030] bond3: entered promiscuous mode [ 95.232080][ T7030] 8021q: adding VLAN 0 to HW filter on device bond3 [ 95.269836][ T42] audit: type=1400 audit(1785492722.102:614): avc: denied { create } for pid=7034 comm="syz.0.407" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 95.282222][ T42] audit: type=1400 audit(1785492722.112:615): avc: denied { mounton } for pid=7034 comm="syz.0.407" path="/89/file0" dev="tmpfs" ino=487 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 95.303275][ T7030] veth5: entered allmulticast mode [ 95.307827][ T7030] bond3: (slave veth5): making interface the new active one [ 95.311099][ T7030] veth5: entered promiscuous mode [ 95.313901][ T7030] bond3: (slave veth5): Enslaving as an active interface with an up link [ 95.343271][ T7030] bond3: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 95.347901][ T7030] bond3: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 95.398537][ T6241] IPVS: starting estimator thread 0... [ 95.485390][ T7044] IPVS: using max 28 ests per chain, 67200 per kthread [ 96.942880][ T7065] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7065 comm=syz.2.424 [ 96.952306][ T7065] netlink: 'syz.2.424': attribute type 1 has an invalid length. [ 96.982623][ T7065] macvtap1: entered allmulticast mode [ 96.993812][ T7065] macvtap2: entered allmulticast mode [ 97.011315][ T7065] bond4: (slave bridge1): making interface the new active one [ 97.015356][ T7065] bond4: (slave bridge1): Enslaving as an active interface with an up link [ 97.319999][ T7077] netlink: 'syz.1.418': attribute type 1 has an invalid length. [ 97.352647][ T7077] bond2: (slave ip6gretap2): Enslaving as a backup interface with an up link [ 97.359043][ T7077] netlink: 28 bytes leftover after parsing attributes in process `syz.1.418'. [ 97.364040][ T5789] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 97.370886][ T7077] 8021q: adding VLAN 0 to HW filter on device bond2 [ 97.378819][ T7080] loop0: detected capacity change from 0 to 131072 [ 97.486069][ T5789] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 97.500906][ T7082] tipc: Enabling of bearer rejected, failed to enable media [ 98.033567][ T7100] netlink: 'syz.2.427': attribute type 1 has an invalid length. [ 98.046248][ T7100] 8021q: adding VLAN 0 to HW filter on device bond5 [ 98.057928][ T7100] gretap1: entered promiscuous mode [ 98.063285][ T7100] bond5: (slave gretap1): making interface the new active one [ 98.067200][ T7100] bond5: (slave gretap1): Enslaving as an active interface with an up link [ 98.078213][ T7100] macvlan2: entered promiscuous mode [ 98.079912][ T7100] macvlan2: entered allmulticast mode [ 98.082156][ T7100] bond5: entered promiscuous mode [ 98.088094][ T7100] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 98.090818][ T7100] bond5: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 98.096888][ T7100] bond5: left promiscuous mode [ 98.352269][ T7103] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 98.404501][ T42] audit: type=1400 audit(1785492725.232:616): avc: denied { unlink } for pid=5738 comm="syz-executor" name="file0" dev="tmpfs" ino=487 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 98.415151][ T7105] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 98.449472][ T7109] netlink: 24 bytes leftover after parsing attributes in process `syz.0.429'. [ 98.476023][ T7112] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 98.583569][ T7119] binder_alloc: 7117: pid 7117 spamming oneway? 1 buffers allocated for a total size of 4096 [ 98.595728][ T7119] binder_alloc: 7117: pid 7117 spamming oneway? 2 buffers allocated for a total size of 5120 [ 98.664942][ T7062] Set syz1 is full, maxelem 65536 reached [ 98.842007][ T7129] netlink: 4 bytes leftover after parsing attributes in process `syz.0.436'. [ 98.984503][ T42] audit: type=1400 audit(1785492725.822:617): avc: denied { audit_write } for pid=7140 comm="syz.1.441" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 98.986992][ T7141] fuse: fd is not a fuse device [ 99.160899][ T7154] netlink: 36 bytes leftover after parsing attributes in process `syz.0.444'. [ 99.165126][ T7154] netlink: 16 bytes leftover after parsing attributes in process `syz.0.444'. [ 99.168816][ T7154] netlink: 36 bytes leftover after parsing attributes in process `syz.0.444'. [ 99.289467][ T7157] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.292524][ T7157] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.374777][ T7157] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 99.386897][ T7157] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 99.714888][ T5817] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.718033][ T5817] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.720697][ T5817] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.723482][ T5817] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.837850][ T7194] gsmld_receive_buf: 00000000: f9 . [ 99.852931][ T7194] gsmld_receive_buf: 00000000: 03 . [ 99.858804][ T7194] gsmld_receive_buf: 00000000: 3f ? [ 99.862384][ T7194] gsmld_receive_buf: 00000000: 01 . [ 99.866803][ T7194] gsmld_receive_buf: 00000000: 1c . [ 99.868925][ T7197] ªªªªªªI¡§å!qƒú: renamed from lo [ 99.871664][ T7194] gsmld_receive_buf: 00000000: f9 . [ 99.879200][ T7195] syzkaller0: entered promiscuous mode [ 99.881779][ T7195] syzkaller0: entered allmulticast mode [ 99.889840][ T7195] tipc: Started in network mode [ 99.892185][ T7195] tipc: Node identity aeafc6b76e1c, cluster identity 4711 [ 99.895966][ T7195] tipc: Enabled bearer , priority 0 [ 99.912369][ T7193] tipc: Resetting bearer [ 99.951644][ T7193] tipc: Disabling bearer [ 100.078168][ T7206] syzkaller0: entered promiscuous mode [ 100.080320][ T7206] syzkaller0: entered allmulticast mode [ 100.131676][ T7208] syzkaller0: entered promiscuous mode [ 100.134112][ T7208] syzkaller0: entered allmulticast mode [ 100.293722][ T7217] netlink: 'syz.1.463': attribute type 1 has an invalid length. [ 100.306660][ T7217] bond3: entered promiscuous mode [ 100.308593][ T7217] 8021q: adding VLAN 0 to HW filter on device bond3 [ 100.327790][ T7217] netlink: 28 bytes leftover after parsing attributes in process `syz.1.463'. [ 100.333837][ T7217] bond3: entered allmulticast mode [ 100.353766][ T7217] bond3: (slave bridge1): making interface the new active one [ 100.356647][ T7217] bridge1: entered promiscuous mode [ 100.358672][ T7217] bridge1: entered allmulticast mode [ 100.362924][ T7217] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 100.494855][ T7224] binder: 7223:7224 ioctl c0306201 200000002580 returned -14 [ 100.553998][ T7230] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 100.556629][ T7230] sock: sock_set_timeout: `syz.0.468' (pid 7230) tries to set negative timeout [ 100.628315][ T42] audit: type=1400 audit(1785492727.462:618): avc: denied { write } for pid=7235 comm="syz.0.471" name="functions" dev="configfs" ino=12445 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 100.640413][ T42] audit: type=1400 audit(1785492727.472:619): avc: denied { write } for pid=7235 comm="syz.0.471" name="c.1" dev="configfs" ino=10234 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 100.643484][ T7237] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 100.649197][ T42] audit: type=1400 audit(1785492727.472:620): avc: denied { write } for pid=7235 comm="syz.0.471" name="c.1" dev="configfs" ino=10234 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 100.665653][ T7237] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 100.669252][ T7237] udc dummy_udc.0: failed to start g1: -22 [ 100.671738][ T7237] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 100.677207][ T7237] UDC core: g1: couldn't find an available UDC or it's busy [ 100.731153][ T7239] netlink: 'syz.1.472': attribute type 4 has an invalid length. [ 100.950540][ T7251] fuse: fd is not a fuse device [ 101.671555][ T7264] syzkaller0: entered promiscuous mode [ 101.673438][ T7264] syzkaller0: entered allmulticast mode [ 102.260786][ T42] audit: type=1400 audit(1785492729.092:621): avc: denied { create } for pid=7302 comm="syz.1.497" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 102.271125][ T42] audit: type=1400 audit(1785492729.092:622): avc: denied { ioctl } for pid=7302 comm="syz.1.497" path="socket:[18511]" dev="sockfs" ino=18511 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 102.362449][ T7311] fuse: fd is not a fuse device [ 103.256269][ T5736] ffs_data_put(): freeing [ 103.277966][ T42] audit: type=1326 audit(1785492730.112:623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7341 comm="syz.1.509" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc81a19e019 code=0x0 [ 103.311295][ T34] IPVS: starting estimator thread 0... [ 103.375101][ T7354] netlink: 'syz.2.512': attribute type 1 has an invalid length. [ 103.404573][ T7350] IPVS: using max 31 ests per chain, 74400 per kthread [ 103.624414][ T7357] syzkaller0: entered promiscuous mode [ 103.626459][ T7357] syzkaller0: entered allmulticast mode [ 104.160785][ T42] audit: type=1804 audit(1785492730.992:624): pid=7390 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.1.527" name="file0" dev="tmpfs" ino=833 res=1 errno=0 [ 104.161105][ T7390] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -22341, delta: 1 [ 104.178124][ T7390] ref_ctr increment failed for inode: 0x341 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88802c1d0cc0 [ 104.209498][ T7390] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -22341, delta: -1 [ 104.213183][ T7390] ref_ctr decrement failed for inode: 0x341 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88802c1d0cc0 [ 104.217801][ T7392] netlink: 4 bytes leftover after parsing attributes in process `syz.2.528'. [ 104.219796][ T7390] uprobe: syz.1.527:7390 failed to unregister, leaking uprobe [ 104.240712][ T7392] netlink: 4 bytes leftover after parsing attributes in process `syz.2.528'. [ 104.244361][ T5789] netdevsim netdevsim10 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.249281][ T5789] netdevsim netdevsim10 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.259699][ T7392] netlink: 4 bytes leftover after parsing attributes in process `syz.2.528'. [ 104.264531][ T5789] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.267584][ T5789] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.271405][ T5789] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.274357][ T5789] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.419171][ T42] audit: type=1400 audit(1785492731.252:625): avc: denied { search } for pid=7398 comm="syz.3.531" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 104.428403][ T42] audit: type=1400 audit(1785492731.252:626): avc: denied { search } for pid=7398 comm="syz.3.531" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 104.440228][ T42] audit: type=1400 audit(1785492731.252:627): avc: denied { read } for pid=7398 comm="syz.3.531" name="usbmon3" dev="devtmpfs" ino=747 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 104.450254][ T42] audit: type=1400 audit(1785492731.252:628): avc: denied { open } for pid=7398 comm="syz.3.531" path="/dev/usbmon3" dev="devtmpfs" ino=747 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 104.460235][ T42] audit: type=1400 audit(1785492731.262:629): avc: denied { ioctl } for pid=7398 comm="syz.3.531" path="/dev/usbmon3" dev="devtmpfs" ino=747 ioctlcmd=0x9206 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 104.830215][ T7406] syzkaller0: entered promiscuous mode [ 104.832676][ T7406] syzkaller0: entered allmulticast mode [ 104.867026][ T7408] 0: reclassify loop, rule prio 0, protocol 700 [ 105.040690][ T42] audit: type=1400 audit(1785492731.872:630): avc: denied { read write } for pid=7414 comm="syz.3.537" name="ppp" dev="devtmpfs" ino=731 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 105.050418][ T42] audit: type=1400 audit(1785492731.872:631): avc: denied { open } for pid=7414 comm="syz.3.537" path="/dev/ppp" dev="devtmpfs" ino=731 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 105.052027][ T7415] pimreg3: entered allmulticast mode [ 105.108865][ T42] audit: type=1326 audit(1785492731.942:632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7416 comm="syz.3.538" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44d799e019 code=0x7ffc0000 [ 105.117111][ T42] audit: type=1326 audit(1785492731.942:633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7416 comm="syz.3.538" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44d799e019 code=0x7ffc0000 [ 105.558544][ T7447] tipc: Started in network mode [ 105.560506][ T7447] tipc: Node identity 080211, cluster identity 4711 [ 105.563224][ T7447] tipc: Enabled bearer , priority 0 [ 105.567386][ T7447] netlink: 44 bytes leftover after parsing attributes in process `syz.1.550'. [ 105.633740][ T7453] netlink: 12 bytes leftover after parsing attributes in process `syz.3.553'. [ 105.668847][ T7453] bond2: entered promiscuous mode [ 105.671107][ T7453] bond2: entered allmulticast mode [ 105.763709][ T7462] syzkaller0: entered promiscuous mode [ 105.766784][ T7462] syzkaller0: entered allmulticast mode [ 105.897678][ T7470] netlink: 12 bytes leftover after parsing attributes in process `syz.3.560'. [ 105.904109][ T7470] tipc: Enabled bearer , priority 10 [ 106.056905][ T7477] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 106.061316][ T7477] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.144052][ T7484] netlink: 'syz.3.563': attribute type 1 has an invalid length. [ 106.160311][ T7484] 8021q: adding VLAN 0 to HW filter on device bond3 [ 106.182831][ T7484] bridge1: entered promiscuous mode [ 106.189283][ T7484] bond3: (slave bridge1): making interface the new active one [ 106.193970][ T7484] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 106.218979][ T7477] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 106.223755][ T7477] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.305874][ T7477] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 106.310185][ T7477] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.376039][ T7496] syzkaller0: entered promiscuous mode [ 106.378143][ T7496] syzkaller0: entered allmulticast mode [ 106.413827][ T7477] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 106.418266][ T7477] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.533853][ T5789] netdevsim netdevsim2 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 106.538789][ T5789] netdevsim netdevsim2 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.545798][ T5789] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 106.550684][ T5789] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.550883][ T7504] netlink: 24 bytes leftover after parsing attributes in process `syz.1.573'. [ 106.554918][ T5789] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 106.561341][ T5789] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.604285][ T5789] netdevsim netdevsim2 eth5: set [0, 0] type 1 family 0 port 8472 - 0 [ 106.607100][ T5789] netdevsim netdevsim2 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.677499][ T7169] tipc: Node number set to 134353152 [ 107.047016][ T7536] netlink: 'syz.1.586': attribute type 1 has an invalid length. [ 107.076317][ T7536] gretap1: entered allmulticast mode [ 107.081269][ T7536] bond4: (slave gretap1): making interface the new active one [ 107.087214][ T7536] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 107.202216][ T7544] netlink: 24 bytes leftover after parsing attributes in process `syz.2.589'. [ 107.206349][ T7544] netlink: 24 bytes leftover after parsing attributes in process `syz.2.589'. [ 107.286776][ T7550] netlink: 24 bytes leftover after parsing attributes in process `syz.0.592'. [ 107.336501][ T7550] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=7550 comm=syz.0.592 [ 107.689043][ T7580] netlink: 'syz.3.598': attribute type 1 has an invalid length. [ 107.729106][ T7580] 8021q: adding VLAN 0 to HW filter on device bond4 [ 107.750542][ T7580] bond4: (slave gretap1): making interface the new active one [ 107.754116][ T7580] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 107.767041][ T7580] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=7580 comm=syz.3.598 [ 108.040519][ T7595] fuse: fd is not a fuse device [ 108.508672][ T7614] tipc: Cannot configure node identity twice [ 108.546124][ T7616] netlink: 'syz.0.610': attribute type 1 has an invalid length. [ 108.566905][ T7616] 8021q: adding VLAN 0 to HW filter on device bond3 [ 108.583815][ T7616] bond3: (slave geneve3): making interface the new active one [ 108.592733][ T7616] bond3: (slave geneve3): Enslaving as an active interface with an up link [ 108.697182][ T7628] netlink: 'syz.2.615': attribute type 1 has an invalid length. [ 108.763221][ T7628] bridge3: entered promiscuous mode [ 108.769455][ T7628] bond6: (slave bridge3): making interface the new active one [ 108.772452][ T7628] bond6: (slave bridge3): Enslaving as an active interface with an up link [ 108.786038][ T7628] bridge4: entered promiscuous mode [ 108.789660][ T7628] bond6: (slave bridge4): Enslaving as a backup interface with an up link [ 108.888475][ T7638] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.988872][ T7638] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.998694][ T5789] nci: nci_ntf_packet: unknown ntf opcode 0x10b [ 109.079111][ T7638] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.213841][ T7638] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.357213][ T13] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.365434][ T13] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.370152][ T13] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.375968][ T13] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.762884][ T7680] syzkaller0: entered promiscuous mode [ 109.766441][ T7680] syzkaller0: entered allmulticast mode [ 110.058610][ T7686] sctp: [Deprecated]: syz.3.634 (pid 7686) Use of struct sctp_assoc_value in delayed_ack socket option. [ 110.058610][ T7686] Use struct sctp_sack_info instead [ 110.137495][ T7688] bond5: (slave ip6gretap1): making interface the new active one [ 110.141368][ T7688] bond5: (slave ip6gretap1): Enslaving as an active interface with an up link [ 110.225238][ T7696] syzkaller0: entered promiscuous mode [ 110.227133][ T7696] syzkaller0: entered allmulticast mode [ 110.393681][ T7700] syzkaller0: entered promiscuous mode [ 110.396241][ T7700] syzkaller0: entered allmulticast mode [ 110.739286][ T7712] bond0: entered promiscuous mode [ 110.741071][ T7712] bond_slave_0: entered promiscuous mode [ 110.745411][ T7712] @0Ù: entered promiscuous mode [ 110.751495][ T7712] batadv0: entered promiscuous mode [ 110.759000][ T7712] netlink: 'syz.1.645': attribute type 10 has an invalid length. [ 110.765459][ T7712] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 110.862030][ T7719] netlink: 'syz.1.648': attribute type 3 has an invalid length. [ 110.867493][ T7719] __nla_validate_parse: 1 callbacks suppressed [ 110.867509][ T7719] netlink: 24 bytes leftover after parsing attributes in process `syz.1.648'. [ 110.915565][ T7722] netlink: 20 bytes leftover after parsing attributes in process `syz.1.649'. [ 110.925678][ T7722] ip6gre1: entered promiscuous mode [ 110.928114][ T7722] ip6gre1: entered allmulticast mode [ 110.938472][ T7722] netlink: 'syz.1.649': attribute type 6 has an invalid length. [ 110.941745][ T7722] netlink: 72 bytes leftover after parsing attributes in process `syz.1.649'. [ 111.038684][ T7727] fuse: fd is not a fuse device [ 111.930224][ T7642] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 112.005703][ T42] kauditd_printk_skb: 45 callbacks suppressed [ 112.005716][ T42] audit: type=1400 audit(1785492738.842:679): avc: denied { create } for pid=7756 comm="syz.2.658" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 112.014380][ T42] audit: type=1400 audit(1785492738.842:680): avc: denied { write } for pid=7756 comm="syz.2.658" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 112.059798][ T7761] rdma_rxe: rxe_newlink: failed to add syz_tun [ 112.176760][ T7757] infiniband syz1: set active [ 112.179512][ T7757] infiniband syz1: added syz_tun [ 112.197914][ T7757] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 112.204698][ T7757] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 112.211818][ T7757] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 112.245413][ T7757] RDS/IB: syz1: added [ 112.247635][ T7757] smc: adding ib device syz1 with port count 1 [ 112.251239][ T7757] smc: ib device syz1 port 1 has no pnetid [ 112.818142][ T7766] vlan2: entered promiscuous mode [ 112.819919][ T7766] hsr0: entered promiscuous mode [ 112.822088][ T7766] vlan2: entered allmulticast mode [ 112.823838][ T7766] hsr0: entered allmulticast mode [ 112.825535][ T7766] hsr_slave_0: entered allmulticast mode [ 112.827362][ T7766] hsr_slave_1: entered allmulticast mode [ 112.924033][ T7774] mmap: syz.3.662 (7774) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 113.088349][ T7789] fuse: fd is not a fuse device [ 113.258974][ T42] audit: type=1400 audit(1785492740.092:681): avc: denied { mount } for pid=7796 comm="syz.3.671" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 113.373822][ T42] audit: type=1400 audit(1785492740.202:682): avc: denied { link } for pid=7804 comm="syz.0.673" name="#15" dev="tmpfs" ino=756 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 113.480916][ T7813] netlink: 68 bytes leftover after parsing attributes in process `syz.3.678'. [ 113.622119][ T7828] netlink: 76 bytes leftover after parsing attributes in process `syz.1.684'. [ 114.476361][ T7860] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.481140][ T7860] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.495602][ T7860] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.533544][ T7860] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 114.538808][ T7860] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 114.548548][ T7860] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 114.552635][ T7860] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 114.562911][ T7860] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 114.582140][ T6212] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.585272][ T6212] bridge0: port 1(bridge_slave_0) entered forwarding state [ 114.595742][ T6212] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.598821][ T6212] bridge0: port 2(bridge_slave_1) entered forwarding state [ 114.620588][ T7862] syzkaller0: entered promiscuous mode [ 114.622695][ T7862] syzkaller0: entered allmulticast mode [ 114.898139][ T42] audit: type=1400 audit(1785492741.732:683): avc: denied { read } for pid=7887 comm="syz.0.706" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 114.909463][ T42] audit: type=1400 audit(1785492741.732:684): avc: denied { open } for pid=7887 comm="syz.0.706" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 114.979718][ T7905] syzkaller0: entered promiscuous mode [ 114.981620][ T7905] syzkaller0: entered allmulticast mode [ 115.505646][ T42] audit: type=1400 audit(1785492742.342:685): avc: denied { cmd } for pid=7932 comm="syz.0.718" path="socket:[22660]" dev="sockfs" ino=22660 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 115.734790][ T7949] netlink: 'syz.2.726': attribute type 10 has an invalid length. [ 115.866920][ T7964] netlink: 24 bytes leftover after parsing attributes in process `syz.0.730'. [ 115.913066][ T7964] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=7964 comm=syz.0.730 [ 115.986523][ T7972] syzkaller0: entered promiscuous mode [ 115.989165][ T7972] syzkaller0: entered allmulticast mode [ 116.092427][ T42] audit: type=1400 audit(1785492742.922:686): avc: denied { create } for pid=7977 comm="syz.2.735" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 116.180411][ T7984] IPVS: fo: SCTP 172.20.20.187:0 - no destination available [ 116.300643][ T7993] fuse: fd is not a fuse device [ 116.381510][ T7991] netlink: 4 bytes leftover after parsing attributes in process `syz.2.741'. [ 116.408149][ T8000] lo: entered allmulticast mode [ 116.781043][ T8033] tipc: Enabled bearer , priority 0 [ 116.819922][ T42] audit: type=1400 audit(1785492743.652:687): avc: denied { node_bind } for pid=8024 comm="syz.3.751" src=28196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 116.839651][ T8038] fuse: fd is not a fuse device [ 116.922902][ T42] audit: type=1400 audit(1785492743.752:688): avc: denied { getopt } for pid=8043 comm="syz.2.758" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 117.163004][ T5746] Bluetooth: hci3: unexpected event for opcode 0x040e [ 117.252184][ T8073] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 117.259099][ T42] audit: type=1400 audit(1785492744.092:689): avc: denied { create } for pid=8072 comm="syz.0.769" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 117.262270][ T8073] nbd: must specify at least one socket [ 117.271636][ T42] audit: type=1400 audit(1785492744.102:690): avc: denied { ioctl } for pid=8072 comm="syz.0.769" path="socket:[21956]" dev="sockfs" ino=21956 ioctlcmd=0x890c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 117.284252][ T42] audit: type=1400 audit(1785492744.102:691): avc: denied { write } for pid=8072 comm="syz.0.769" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 117.829146][ T42] audit: type=1400 audit(1785492744.662:692): avc: denied { write } for pid=8089 comm="syz.3.776" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 117.919562][ T8104] syzkaller0: entered promiscuous mode [ 117.922031][ T8104] syzkaller0: entered allmulticast mode [ 117.930012][ T8108] netlink: 44 bytes leftover after parsing attributes in process `syz.2.784'. [ 117.934048][ T8108] syz_tun: entered allmulticast mode [ 117.937216][ T8107] syz_tun: left allmulticast mode [ 117.981576][ T42] audit: type=1400 audit(1785492744.812:693): avc: denied { ioctl } for pid=8113 comm="syz.1.788" path="socket:[20868]" dev="sockfs" ino=20868 ioctlcmd=0x5873 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 117.992478][ T42] audit: type=1400 audit(1785492744.822:694): avc: denied { watch } for pid=8113 comm="syz.1.788" path="/236/file0" dev="tmpfs" ino=1274 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 118.001272][ T42] audit: type=1400 audit(1785492744.822:695): avc: denied { watch_sb watch_reads } for pid=8113 comm="syz.1.788" path="/236/file0" dev="tmpfs" ino=1274 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 118.053896][ T8124] fuse: fd is not a fuse device [ 118.117040][ T8128] tipc: Enabling of bearer rejected, already enabled [ 118.119687][ T42] audit: type=1400 audit(1785492744.952:696): avc: denied { bind } for pid=8129 comm="syz.0.794" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 118.172271][ T8133] syzkaller0: entered promiscuous mode [ 118.174078][ T8133] syzkaller0: entered allmulticast mode [ 118.182260][ T8133] tipc: Enabled bearer , priority 0 [ 118.187821][ T8133] tipc: Resetting bearer [ 118.194512][ T8131] tipc: Resetting bearer [ 118.212173][ T8131] tipc: Disabling bearer [ 118.296695][ T42] audit: type=1400 audit(1785492745.132:697): avc: denied { kexec_image_load } for pid=8140 comm="syz.0.798" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 118.304896][ T42] audit: type=1400 audit(1785492745.132:698): avc: denied { append } for pid=8140 comm="syz.0.798" name="card1" dev="devtmpfs" ino=636 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 118.745282][ T8157] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 118.748129][ T8157] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 118.751398][ T8157] udc dummy_udc.0: failed to start g1: -22 [ 118.753639][ T8157] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 118.761400][ T8157] UDC core: g1: couldn't find an available UDC or it's busy [ 118.814078][ T8165] tc action pedit offset must be on 32 bit boundaries [ 118.818741][ T8165] tc action pedit offset must be on 32 bit boundaries [ 118.821594][ T8165] tc action pedit offset must be on 32 bit boundaries [ 118.826103][ T8165] tc action pedit offset must be on 32 bit boundaries [ 118.828975][ T8165] tc action pedit offset must be on 32 bit boundaries [ 118.831834][ T8165] tc action pedit offset must be on 32 bit boundaries [ 118.834788][ T8165] tc action pedit offset must be on 32 bit boundaries [ 118.837766][ T8165] tc action pedit offset must be on 32 bit boundaries [ 118.840657][ T8165] tc action pedit offset must be on 32 bit boundaries [ 118.843463][ T8165] tc action pedit offset must be on 32 bit boundaries [ 118.846437][ T8165] 0: reclassify loop, rule prio 0, protocol 800 [ 119.130583][ T8172] block device autoloading is deprecated and will be removed. [ 119.295865][ T8184] netlink: 12 bytes leftover after parsing attributes in process `syz.2.812'. [ 119.329196][ T8184] 8021q: adding VLAN 0 to HW filter on device bond8 [ 119.388115][ T8184] bond8: (slave veth1): Enslaving as an active interface with an up link [ 119.420565][ T8184] bond8: (slave dummy0): Enslaving as an active interface with an up link [ 119.645409][ T8209] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=8209 comm=syz.2.822 [ 119.704248][ T8215] overlayfs: failed to resolve './file2': -2 [ 119.721877][ T8217] fuse: fd is not a fuse device [ 119.862715][ T5746] Bluetooth: hci3: hcon ffff888035690000 sent 1 < count 16 [ 119.866074][ T5746] Bluetooth: hci3: hcon ffff888035690000 sent 0 < count 9 [ 119.869054][ T5746] Bluetooth: hci3: hcon ffff888035690000 sent 0 < count 257 [ 119.872232][ T5746] Bluetooth: hci3: hcon ffff888035690000 sent 0 < count 1 [ 119.877035][ T5746] Bluetooth: hci3: hcon ffff888038174000 sent 1 < count 3 [ 120.278248][ T8246] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 120.283761][ T8246] IPv6: NLM_F_CREATE should be set when creating new route [ 120.365678][ T8249] netlink: 4 bytes leftover after parsing attributes in process `syz.0.835'. [ 120.370408][ T8251] warning: `syz.3.836' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 122.421222][ T8288] 0: reclassify loop, rule prio 0, protocol 700 [ 122.809384][ T8313] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 122.997900][ T8320] capability: warning: `syz.0.859' uses deprecated v2 capabilities in a way that may be insecure [ 123.480607][ T8324] overlayfs: failed to clone upperpath [ 124.171646][ T8369] syz_tun: entered allmulticast mode [ 124.177561][ T8368] ªªªªªª: renamed from vlan0 (while UP) [ 124.183301][ T8367] syz_tun: left allmulticast mode [ 124.269505][ T8377] syzkaller0: entered promiscuous mode [ 124.271762][ T8377] syzkaller0: entered allmulticast mode [ 124.336188][ T8380] netlink: 76 bytes leftover after parsing attributes in process `syz.3.880'. [ 124.733117][ T42] kauditd_printk_skb: 9 callbacks suppressed [ 124.733158][ T42] audit: type=1400 audit(1785492751.562:708): avc: denied { read append } for pid=8417 comm="syz.0.890" name="nvram" dev="devtmpfs" ino=631 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 124.745522][ T42] audit: type=1400 audit(1785492751.562:709): avc: denied { open } for pid=8417 comm="syz.0.890" path="/dev/nvram" dev="devtmpfs" ino=631 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 124.755038][ T42] audit: type=1400 audit(1785492751.562:710): avc: denied { ioctl } for pid=8417 comm="syz.0.890" path="/dev/nvram" dev="devtmpfs" ino=631 ioctlcmd=0x6440 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 124.818792][ T8422] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 124.821869][ T8422] IPv6: NLM_F_CREATE should be set when creating new route [ 124.874041][ T8422] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.877267][ T8422] bridge0: port 1(bridge_slave_0) entered disabled state [ 124.934109][ T8422] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 124.948119][ T8422] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 125.049652][ T8430] Mass Storage Function, version: 2009/09/11 [ 125.053990][ T42] audit: type=1400 audit(1785492751.882:711): avc: denied { write } for pid=8427 comm="syz.0.894" name="functions" dev="configfs" ino=12445 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 125.055116][ T8430] LUN: removable file: (no medium) [ 125.083821][ T42] audit: type=1800 audit(1785492751.912:712): pid=8430 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.894" name="cdrom" dev="configfs" ino=23239 res=0 errno=0 [ 125.097479][ T42] audit: type=1800 audit(1785492751.922:713): pid=8430 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.894" name="file" dev="configfs" ino=21025 res=0 errno=0 [ 125.097755][ T8430] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 125.106340][ T42] audit: type=1400 audit(1785492751.922:714): avc: denied { write } for pid=8427 comm="syz.0.894" name="c.1" dev="configfs" ino=10234 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 125.109180][ T8430] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 125.118442][ T42] audit: type=1400 audit(1785492751.932:715): avc: denied { write } for pid=8427 comm="syz.0.894" name="c.1" dev="configfs" ino=10234 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 125.118504][ T42] audit: type=1800 audit(1785492751.932:716): pid=8430 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.894" name="UDC" dev="configfs" ino=21027 res=0 errno=0 [ 125.140206][ T8430] udc dummy_udc.0: failed to start g1: -22 [ 125.143221][ T8430] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 125.149341][ T8430] UDC core: g1: couldn't find an available UDC or it's busy [ 125.259696][ T42] audit: type=1400 audit(1785492752.092:717): avc: denied { write } for pid=8440 comm="syz.2.900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 125.975416][ T8474] netlink: 48 bytes leftover after parsing attributes in process `syz.3.912'. [ 125.993906][ T8474] netlink: 4 bytes leftover after parsing attributes in process `syz.3.912'. [ 126.000745][ T8474] hsr_slave_0: left promiscuous mode [ 126.005073][ T8474] hsr_slave_1: left promiscuous mode [ 126.233267][ T5746] Bluetooth: hci3: unexpected event for opcode 0x0c25 [ 126.269459][ T5746] Bluetooth: hci3: unexpected subevent 0x12 length: 30 > 5 [ 126.344262][ T29] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 126.384969][ T8501] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 126.507634][ T29] usb 5-1: config 0 has no interfaces? [ 126.512348][ T29] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 126.516780][ T29] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.520298][ T29] usb 5-1: Product: syz [ 126.522173][ T29] usb 5-1: Manufacturer: syz [ 126.524409][ T29] usb 5-1: SerialNumber: syz [ 126.535471][ T29] usb 5-1: config 0 descriptor?? [ 126.752876][ T6180] usb 5-1: USB disconnect, device number 4 [ 126.765101][ T5746] Bluetooth: hci2: command 0x0406 tx timeout [ 127.461048][ T8544] netlink: 48 bytes leftover after parsing attributes in process `syz.0.940'. [ 127.467682][ T8544] netlink: 48 bytes leftover after parsing attributes in process `syz.0.940'. [ 127.772111][ T8552] loop0: detected capacity change from 0 to 32768 [ 127.785025][ T8552] loop3: detected capacity change from 0 to 32768 [ 127.849896][ T8552] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 127.857809][ T8553] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 127.863524][ T8553] block device autoloading is deprecated and will be removed. [ 127.936664][ T8553] md: invalid raid superblock magic on loop0 [ 127.940328][ T8553] md: loop0 does not have a valid v0.0 superblock, not importing! [ 127.944089][ T8553] md: md_import_device returned -22 [ 128.132621][ T8563] syz_tun: left allmulticast mode [ 128.134915][ T8563] syz_tun: left promiscuous mode [ 128.140686][ T8563] bridge0: port 3(syz_tun) entered disabled state [ 128.154901][ T8563] bridge_slave_0: left allmulticast mode [ 128.157369][ T8563] bridge_slave_0: left promiscuous mode [ 128.159868][ T8563] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.167740][ T8563] bridge_slave_1: left allmulticast mode [ 128.170160][ T8563] bridge_slave_1: left promiscuous mode [ 128.173128][ T8563] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.208738][ T8563] bond0: (slave bond_slave_0): Releasing backup interface [ 128.221846][ T8563] bond0: (slave bond_slave_1): Releasing backup interface [ 128.260170][ T8563] team0: Port device team_slave_0 removed [ 128.268761][ T8563] team0: Port device team_slave_1 removed [ 128.272059][ T8563] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.275380][ T8563] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 128.280188][ T8563] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 128.283405][ T8563] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 128.301340][ T8563] bond1: (slave veth5): Releasing backup interface [ 128.305561][ T8563] veth5: left promiscuous mode [ 128.319036][ T8563] bond3: (slave bridge1): Releasing active interface [ 128.323256][ T8570] netlink: 16 bytes leftover after parsing attributes in process `syz.1.947'. [ 128.341491][ T8563] bond4: (slave gretap1): Releasing active interface [ 128.352192][ T8563] bond5: (slave ip6gretap1): Releasing active interface [ 128.378186][ T8566] team0: Port device xfrm0 added [ 128.501341][ T8573] capability: warning: `syz.2.946' uses 32-bit capabilities (legacy support in use) [ 131.000625][ T8555] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 131.040698][ T42] kauditd_printk_skb: 12 callbacks suppressed [ 131.040715][ T42] audit: type=1400 audit(1785492757.872:730): avc: denied { setopt } for pid=8578 comm="syz.2.949" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 131.062939][ T29] IPVS: starting estimator thread 0... [ 131.085593][ T8589] netlink: 8 bytes leftover after parsing attributes in process `syz.2.953'. [ 131.091969][ T42] audit: type=1400 audit(1785492757.922:731): avc: denied { ioctl } for pid=8584 comm="syz.0.952" path="/dev/nullb0" dev="devtmpfs" ino=707 ioctlcmd=0x5517 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 131.127416][ T42] audit: type=1400 audit(1785492757.962:732): avc: denied { listen } for pid=8594 comm="syz.2.956" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 131.136249][ T42] audit: type=1400 audit(1785492757.962:733): avc: denied { accept } for pid=8594 comm="syz.2.956" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 131.154308][ T8585] IPVS: using max 45 ests per chain, 108000 per kthread [ 131.231401][ T8603] netlink: 28 bytes leftover after parsing attributes in process `syz.3.957'. [ 131.234409][ T8603] netlink: 28 bytes leftover after parsing attributes in process `syz.3.957'. [ 131.244646][ T8603] ifb0: entered promiscuous mode [ 131.259735][ T8603] ifb0: left promiscuous mode [ 131.814050][ T42] audit: type=1400 audit(1785492758.642:734): avc: denied { cmd } for pid=8616 comm="iou-wrk-8617" path="/dev/ublk-control" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 131.829078][ T42] audit: type=1400 audit(1785492758.662:735): avc: denied { map } for pid=8616 comm="syz.0.960" path="/dev/ublkc0" dev="devtmpfs" ino=2995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 131.981827][ T42] audit: type=1326 audit(1785492758.812:736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8624 comm="syz.0.962" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4470b9e019 code=0x0 [ 132.210235][ T8638] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 132.222326][ T8638] netlink: 32 bytes leftover after parsing attributes in process `syz.1.966'. [ 132.278761][ T8639] netlink: 'syz.1.966': attribute type 10 has an invalid length. [ 132.284911][ T8639] veth0_to_bond: entered promiscuous mode [ 132.287645][ T8639] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 132.306487][ T7170] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 132.323648][ T42] audit: type=1326 audit(1785492759.152:737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8646 comm="syz.1.969" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc81a19e019 code=0x0 [ 132.454356][ T7170] usb 5-1: Using ep0 maxpacket: 8 [ 132.457741][ T7170] usb 5-1: config 252 has 0 interfaces, different from the descriptor's value: 1 [ 132.461190][ T7170] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 132.465262][ T7170] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.681499][ T42] audit: type=1400 audit(1785492759.512:738): avc: denied { write } for pid=8624 comm="syz.0.962" name="header" dev="configfs" ino=11866 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 132.694503][ T42] audit: type=1400 audit(1785492759.522:739): avc: denied { write } for pid=8624 comm="syz.0.962" name="fs" dev="configfs" ino=11875 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 132.697730][ T8631] [ 132.703659][ T8631] ====================================================== [ 132.706249][ T8631] WARNING: possible circular locking dependency detected [ 132.708770][ T8631] syzkaller #0 Tainted: G L [ 132.711122][ T8631] ------------------------------------------------------ [ 132.713548][ T8631] syz.0.962/8631 is trying to acquire lock: [ 132.715623][ T8631] ffffffff901d0be8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_streaming_header_allow_link+0x7c/0x650 [ 132.719711][ T8631] [ 132.719711][ T8631] but task is already holding lock: [ 132.722368][ T8631] ffff8880386b2740 (&sb->s_type->i_mutex_key#26){++++}-{4:4}, at: configfs_symlink+0x3c0/0x11f0 [ 132.726175][ T8631] [ 132.726175][ T8631] which lock already depends on the new lock. [ 132.726175][ T8631] [ 132.729868][ T8631] [ 132.729868][ T8631] the existing dependency chain (in reverse order) is: [ 132.732909][ T8631] [ 132.732909][ T8631] -> #2 (&sb->s_type->i_mutex_key#26){++++}-{4:4}: [ 132.736066][ T8631] lock_acquire+0x1b9/0x370 [ 132.737912][ T8631] down_write+0x8b/0x1f0 [ 132.739732][ T8631] configfs_depend_item_unlocked+0xf3/0x6a0 [ 132.742042][ T8631] usbg_make_tpg+0x261/0x620 [ 132.743913][ T8631] target_fabric_make_tpg+0xab/0x8c0 [ 132.746053][ T8631] configfs_mkdir+0x51e/0xb70 [ 132.747955][ T8631] vfs_mkdir+0x361/0x850 [ 132.749729][ T8631] filename_mkdirat+0x48b/0x5e0 [ 132.751655][ T8631] __x64_sys_mkdir+0x6b/0x90 [ 132.753439][ T8631] do_syscall_64+0x115/0x870 [ 132.755195][ T8631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.757518][ T8631] [ 132.757518][ T8631] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 132.760262][ T8631] lock_acquire+0x1b9/0x370 [ 132.762090][ T8631] __mutex_lock+0x1a4/0x1bd0 [ 132.763959][ T8631] tcm_set_name+0x29/0xb0 [ 132.765783][ T8631] function_make+0x21c/0x3f0 [ 132.767652][ T8631] configfs_mkdir+0x51e/0xb70 [ 132.769552][ T8631] vfs_mkdir+0x361/0x850 [ 132.771319][ T8631] filename_mkdirat+0x48b/0x5e0 [ 132.773271][ T8631] __x64_sys_mkdir+0x6b/0x90 [ 132.775129][ T8631] do_syscall_64+0x115/0x870 [ 132.777016][ T8631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.779346][ T8631] [ 132.779346][ T8631] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 132.782303][ T8631] check_prev_add+0xeb/0xe60 [ 132.784173][ T8631] __lock_acquire+0x136c/0x1a40 [ 132.786167][ T8631] lock_acquire+0x1b9/0x370 [ 132.788019][ T8631] __mutex_lock+0x1a4/0x1bd0 [ 132.789886][ T8631] uvcg_streaming_header_allow_link+0x7c/0x650 [ 132.792307][ T8631] configfs_symlink+0x540/0x11f0 [ 132.794285][ T8631] vfs_symlink+0x178/0x4d0 [ 132.796116][ T8631] filename_symlinkat+0x2a6/0x560 [ 132.798134][ T8631] __x64_sys_symlink+0x79/0xb0 [ 132.800080][ T8631] do_syscall_64+0x115/0x870 [ 132.801944][ T8631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.804277][ T8631] [ 132.804277][ T8631] other info that might help us debug this: [ 132.804277][ T8631] [ 132.807940][ T8631] Chain exists of: [ 132.807940][ T8631] gadget_subsys.su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#26 [ 132.807940][ T8631] [ 132.813124][ T8631] Possible unsafe locking scenario: [ 132.813124][ T8631] [ 132.815835][ T8631] CPU0 CPU1 [ 132.817779][ T8631] ---- ---- [ 132.819735][ T8631] lock(&sb->s_type->i_mutex_key#26); [ 132.821599][ T8631] lock(&opts->dep_lock); [ 132.824089][ T8631] lock(&sb->s_type->i_mutex_key#26); [ 132.826968][ T8631] lock(gadget_subsys.su_mutex); [ 132.828805][ T8631] [ 132.828805][ T8631] *** DEADLOCK *** [ 132.828805][ T8631] [ 132.831708][ T8631] 2 locks held by syz.0.962/8631: [ 132.833543][ T8631] #0: ffff8880233e8450 (sb_writers#15){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 132.837017][ T8631] #1: ffff8880386b2740 (&sb->s_type->i_mutex_key#26){++++}-{4:4}, at: configfs_symlink+0x3c0/0x11f0 [ 132.840927][ T8631] [ 132.840927][ T8631] stack backtrace: [ 132.843074][ T8631] CPU: 0 UID: 0 PID: 8631 Comm: syz.0.962 Tainted: G L syzkaller #0 PREEMPT(full) [ 132.843095][ T8631] Tainted: [L]=SOFTLOCKUP [ 132.843100][ T8631] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 132.843109][ T8631] Call Trace: [ 132.843136][ T8631] [ 132.843144][ T8631] dump_stack_lvl+0x100/0x190 [ 132.843178][ T8631] print_circular_bug.cold+0x178/0x1c7 [ 132.843207][ T8631] check_noncircular+0x146/0x160 [ 132.843227][ T8631] ? audit_log_end+0x24/0x30 [ 132.843260][ T8631] check_prev_add+0xeb/0xe60 [ 132.843277][ T8631] __lock_acquire+0x136c/0x1a40 [ 132.843297][ T8631] lock_acquire+0x1b9/0x370 [ 132.843333][ T8631] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 132.843354][ T8631] ? __pfx___might_resched+0x10/0x10 [ 132.843384][ T8631] ? audit_inode_permission+0x1ea/0x2a0 [ 132.843412][ T8631] __mutex_lock+0x1a4/0x1bd0 [ 132.843432][ T8631] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 132.843449][ T8631] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 132.843466][ T8631] ? __lock_acquire+0x49f/0x1a40 [ 132.843483][ T8631] ? __pfx___mutex_lock+0x10/0x10 [ 132.843499][ T8631] ? selinux_inode_permission+0x14a/0x1130 [ 132.843520][ T8631] ? __pfx___might_resched+0x10/0x10 [ 132.843539][ T8631] ? make_vfsgid+0xf1/0x140 [ 132.843563][ T8631] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 132.843580][ T8631] ? security_inode_permission+0xbf/0x250 [ 132.843602][ T8631] uvcg_streaming_header_allow_link+0x7c/0x650 [ 132.843619][ T8631] ? inode_permission+0x374/0x620 [ 132.843639][ T8631] ? mntput_no_expire+0xe7/0x220 [ 132.843654][ T8631] configfs_symlink+0x540/0x11f0 [ 132.843675][ T8631] ? __pfx_configfs_symlink+0x10/0x10 [ 132.843697][ T8631] vfs_symlink+0x178/0x4d0 [ 132.843716][ T8631] filename_symlinkat+0x2a6/0x560 [ 132.843734][ T8631] ? __pfx_filename_symlinkat+0x10/0x10 [ 132.843750][ T8631] ? strncpy_from_user+0x19d/0x2d0 [ 132.843776][ T8631] ? do_getname+0x191/0x390 [ 132.843794][ T8631] __x64_sys_symlink+0x79/0xb0 [ 132.843810][ T8631] do_syscall_64+0x115/0x870 [ 132.843826][ T8631] ? clear_bhb_loop+0x40/0x90 [ 132.843845][ T8631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.843862][ T8631] RIP: 0033:0x7f4470b9e019 [ 132.843877][ T8631] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.843891][ T8631] RSP: 002b:00007f44719d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 132.843918][ T8631] RAX: ffffffffffffffda RBX: 00007f4470e26090 RCX: 00007f4470b9e019 [ 132.843930][ T8631] RDX: 0000000000000000 RSI: 0000200000001100 RDI: 0000200000001000 [ 132.843940][ T8631] RBP: 00007f4470c3500c R08: 0000000000000000 R09: 0000000000000000 [ 132.843949][ T8631] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 132.843957][ T8631] R13: 00007f4470e26128 R14: 00007f4470e26090 R15: 00007ffc77538dd8 [ 132.843978][ T8631] [ 133.415040][ T1445] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.976900][ T7170] usb 5-1: USB disconnect, device number 5