last executing test programs: 16.120898881s ago: executing program 0 (id=103): unshare(0x66000080) r0 = socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[], 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'netdevsim0\x00', 0x2}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'netdevsim0\x00', 0x0}) r3 = gettid() sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="2800000010000100"/20, @ANYRES32=r2, @ANYBLOB="6d3082610000000008001300", @ANYRES32=r3], 0x28}}, 0x0) 5.02687544s ago: executing program 0 (id=116): r0 = io_uring_setup(0x6dde, &(0x7f0000000440)={0x0, 0xd612, 0x10, 0x10000, 0x28e}) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r0, 0xd, &(0x7f0000000140)={0x7, 0x0, 0x0, 0x0}, 0x20) io_uring_register$IORING_UNREGISTER_FILES(r0, 0x3, 0x0, 0x0) 3.937679998s ago: executing program 1 (id=117): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x14, 0x25, 0x9, 0x70bd2a, 0x25dfdbfd, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x4000002}, 0x4004080) 3.814787329s ago: executing program 0 (id=118): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) bpf$PROG_LOAD(0x5, 0x0, 0xf70dc44c952f9e8f) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) 3.209732744s ago: executing program 1 (id=119): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, &(0x7f0000000400)={0x0, 0x200000}) 2.955612926s ago: executing program 1 (id=120): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') fchdir(r2) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0) syz_open_procfs(r1, &(0x7f0000000000)='maps\x00') syz_usb_connect(0x2, 0xb3, &(0x7f0000000080)=ANY=[], 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2.890366726s ago: executing program 0 (id=121): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x3bf, 0x8, 0x802}}) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f0000000080)={0xfffe7527, 0xcd, 0x6a31, 0x7f9, 0x3, "bd00", 0x10, 0x200008}) ioctl$TIOCL_PASTESEL(r0, 0x541c, &(0x7f0000000000)) 1.810074885s ago: executing program 1 (id=122): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x2b, 0xfeffffffffffffff, &(0x7f0000000300)="5456f932731045fecca2245b7bbfb04539020c40f5fcaad5346e21faf67b4664841fe8edfe34cf0ea6daef"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 1.068816861s ago: executing program 0 (id=123): openat(0xffffffffffffff9c, 0x0, 0x2c41, 0x20) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x100, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000d40)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0xfff5, 0xfff3}, {}, {0x8, 0xc}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x5, 0x9, 0xffffffffffffffff, 0xfffffff9, 0x3eb}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20000890}, 0x20000000) 508.793836ms ago: executing program 1 (id=124): accept4$vsock_stream(0xffffffffffffffff, 0x0, 0x0, 0x80800) r0 = syz_ublk_setup_io_uring(0x3888, &(0x7f0000000500)={0x0, 0x6171, 0x2, 0x3, 0x1d4}, &(0x7f0000000580), &(0x7f00000005c0), &(0x7f0000000600)) io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000002e40)="420312b3709a37c9a8b03ad9f455c3ab9fb7bc8370eb9a110213367b8d7058faa792a8cf62adbe3b9ce905c6ae1d67e3ac21", 0x32) 118.584848ms ago: executing program 1 (id=125): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCGICOUNT(r0, 0x545d, 0x0) 0s ago: executing program 0 (id=126): r0 = syz_open_dev$dri(&(0x7f0000000000), 0xabd7, 0x0) ioctl$DRM_IOCTL_GET_CAP(r0, 0xc010640c, &(0x7f0000000040)={0x1}) kernel console output (not intermixed with test programs): [ 209.975487][ T30] audit: type=1400 audit(209.550:82): avc: denied { write } for pid=3360 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=932 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 211.037746][ T30] audit: type=1400 audit(210.610:83): avc: denied { write } for pid=3365 comm="rm" name="hook-state" dev="tmpfs" ino=932 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:37789' (ED25519) to the list of known hosts. [ 250.889476][ T30] audit: type=1400 audit(250.460:84): avc: denied { name_bind } for pid=3376 comm="sshd-session" src=30002 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 251.336840][ T30] audit: type=1400 audit(250.900:85): avc: denied { execute } for pid=3377 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 251.339605][ T30] audit: type=1400 audit(250.910:86): avc: denied { execute_no_trans } for pid=3377 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 259.719870][ T30] audit: type=1400 audit(259.290:87): avc: denied { mounton } for pid=3377 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1868 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 259.780782][ T30] audit: type=1400 audit(259.350:88): avc: denied { mount } for pid=3377 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 259.817709][ T3377] cgroup: Unknown subsys name 'net' [ 259.872130][ T30] audit: type=1400 audit(259.440:89): avc: denied { unmount } for pid=3377 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 260.275067][ T3377] cgroup: Unknown subsys name 'cpuset' [ 260.356957][ T3377] cgroup: Unknown subsys name 'rlimit' [ 260.694169][ T30] audit: type=1400 audit(260.260:90): avc: denied { setattr } for pid=3377 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 260.701499][ T30] audit: type=1400 audit(260.270:91): avc: denied { mounton } for pid=3377 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 260.708792][ T30] audit: type=1400 audit(260.270:92): avc: denied { mount } for pid=3377 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 261.438859][ T3380] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 261.446908][ T30] audit: type=1400 audit(261.010:93): avc: denied { relabelto } for pid=3380 comm="mkswap" name="swap-file" dev="vda" ino=1871 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 261.458277][ T30] audit: type=1400 audit(261.020:94): avc: denied { write } for pid=3380 comm="mkswap" path="/swap-file" dev="vda" ino=1871 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 261.587574][ T30] audit: type=1400 audit(261.160:95): avc: denied { read } for pid=3377 comm="syz-executor" name="swap-file" dev="vda" ino=1871 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 261.596476][ T30] audit: type=1400 audit(261.160:96): avc: denied { open } for pid=3377 comm="syz-executor" path="/swap-file" dev="vda" ino=1871 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 261.636962][ T3377] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 278.255959][ T30] audit: type=1400 audit(277.820:97): avc: denied { execmem } for pid=3381 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 278.380553][ T30] audit: type=1400 audit(277.950:98): avc: denied { read } for pid=3383 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 278.389719][ T30] audit: type=1400 audit(277.960:99): avc: denied { open } for pid=3383 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 278.408101][ T30] audit: type=1400 audit(277.980:100): avc: denied { mounton } for pid=3383 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 278.479635][ T30] audit: type=1400 audit(278.050:101): avc: denied { module_request } for pid=3383 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 278.798483][ T30] audit: type=1400 audit(278.370:102): avc: denied { sys_module } for pid=3383 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 287.312246][ T3383] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 287.450768][ T3383] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 287.478544][ T3384] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 287.581208][ T3384] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 291.786692][ T3383] hsr_slave_0: entered promiscuous mode [ 291.805994][ T3383] hsr_slave_1: entered promiscuous mode [ 291.910362][ T3384] hsr_slave_0: entered promiscuous mode [ 291.925037][ T3384] hsr_slave_1: entered promiscuous mode [ 291.931949][ T3384] debugfs: 'hsr0' already exists in 'hsr' [ 291.938601][ T3384] Cannot create hsr debugfs directory [ 294.574152][ T30] audit: type=1400 audit(294.140:103): avc: denied { create } for pid=3383 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 294.575230][ T30] audit: type=1400 audit(294.140:104): avc: denied { write } for pid=3383 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 294.580882][ T30] audit: type=1400 audit(294.150:105): avc: denied { read } for pid=3383 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 294.611963][ T3383] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 294.694787][ T3383] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 294.709475][ T3383] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 294.779233][ T3383] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 294.788826][ T3383] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 294.824344][ T3383] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 294.839204][ T3383] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 294.880028][ T3383] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 295.625384][ T3384] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 295.689313][ T3384] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 295.699670][ T3384] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 295.728217][ T3384] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 295.789339][ T3384] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 295.831438][ T3384] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 295.866828][ T3384] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 295.927372][ T3384] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 298.369916][ T3383] 8021q: adding VLAN 0 to HW filter on device bond0 [ 299.441723][ T3384] 8021q: adding VLAN 0 to HW filter on device bond0 [ 310.120172][ T3383] veth0_vlan: entered promiscuous mode [ 310.240431][ T3383] veth1_vlan: entered promiscuous mode [ 310.674805][ T3383] veth0_macvtap: entered promiscuous mode [ 310.796334][ T3383] veth1_macvtap: entered promiscuous mode [ 311.271003][ T2095] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.276072][ T2095] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.333946][ T2174] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.334650][ T2174] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.901736][ T30] audit: type=1400 audit(311.450:106): avc: denied { mounton } for pid=3383 comm="syz-executor" path="/syzkaller.AyLfce/syz-tmp" dev="vda" ino=1876 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 311.916838][ T30] audit: type=1400 audit(311.490:107): avc: denied { mount } for pid=3383 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 311.949479][ T30] audit: type=1400 audit(311.520:108): avc: denied { mounton } for pid=3383 comm="syz-executor" path="/syzkaller.AyLfce/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 311.977555][ T30] audit: type=1400 audit(311.550:109): avc: denied { mount } for pid=3383 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 312.032146][ T30] audit: type=1400 audit(311.600:110): avc: denied { mounton } for pid=3383 comm="syz-executor" path="/syzkaller.AyLfce/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 312.136538][ T30] audit: type=1400 audit(311.670:111): avc: denied { mounton } for pid=3383 comm="syz-executor" path="/syzkaller.AyLfce/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=4175 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 312.274133][ T30] audit: type=1400 audit(311.840:112): avc: denied { unmount } for pid=3383 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 312.299108][ T30] audit: type=1400 audit(311.870:113): avc: denied { mounton } for pid=3383 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1548 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 312.311705][ T30] audit: type=1400 audit(311.880:114): avc: denied { mount } for pid=3383 comm="syz-executor" name="/" dev="gadgetfs" ino=3777 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 312.404852][ T3384] veth0_vlan: entered promiscuous mode [ 312.437475][ T30] audit: type=1400 audit(312.010:115): avc: denied { mount } for pid=3383 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 312.581317][ T3384] veth1_vlan: entered promiscuous mode [ 312.787285][ T3383] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 312.876097][ T3384] veth0_macvtap: entered promiscuous mode [ 312.900543][ T3384] veth1_macvtap: entered promiscuous mode [ 313.668571][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 313.734623][ T2174] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 313.757066][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 313.764092][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.977243][ T3530] nci: __nci_request: wait_for_completion_interruptible_timeout failed 0 [ 321.585626][ T3540] ======================================================= [ 321.585626][ T3540] WARNING: The mand mount option has been deprecated and [ 321.585626][ T3540] and is ignored by this kernel. Remove the mand [ 321.585626][ T3540] option from the mount to silence this warning. [ 321.585626][ T3540] ======================================================= [ 321.604341][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 321.605991][ T30] audit: type=1400 audit(321.170:124): avc: denied { mount } for pid=3539 comm="syz.1.3" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 321.657609][ T3540] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 321.661525][ T3540] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 321.790514][ T30] audit: type=1400 audit(321.360:125): avc: denied { create } for pid=3541 comm="syz.0.4" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 321.811660][ T30] audit: type=1400 audit(321.380:126): avc: denied { ioctl } for pid=3541 comm="syz.0.4" path="socket:[3839]" dev="sockfs" ino=3839 ioctlcmd=0x894b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 322.133194][ T30] audit: type=1400 audit(321.700:127): avc: denied { create } for pid=3544 comm="syz.0.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 322.144509][ T30] audit: type=1400 audit(321.720:128): avc: denied { ioctl } for pid=3544 comm="syz.0.5" path="socket:[4236]" dev="sockfs" ino=4236 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 322.158586][ T30] audit: type=1400 audit(321.730:129): avc: denied { bind } for pid=3544 comm="syz.0.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 322.174530][ T30] audit: type=1400 audit(321.740:130): avc: denied { write } for pid=3544 comm="syz.0.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 322.197138][ T30] audit: type=1400 audit(321.770:131): avc: denied { unmount } for pid=3384 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 322.484820][ T30] audit: type=1400 audit(322.050:132): avc: denied { create } for pid=3546 comm="syz.1.6" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 322.506339][ T30] audit: type=1400 audit(322.080:133): avc: denied { bind } for pid=3546 comm="syz.1.6" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 325.321524][ T3560] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 326.833930][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 326.834712][ T30] audit: type=1400 audit(326.400:142): avc: denied { write } for pid=3549 comm="syz.1.7" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 326.854349][ T30] audit: type=1400 audit(326.430:143): avc: denied { create } for pid=3549 comm="syz.1.7" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 327.465630][ T30] audit: type=1400 audit(327.040:144): avc: denied { read } for pid=3565 comm="syz.0.12" name="rtc0" dev="devtmpfs" ino=710 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 327.476779][ T30] audit: type=1400 audit(327.050:145): avc: denied { open } for pid=3565 comm="syz.0.12" path="/dev/rtc0" dev="devtmpfs" ino=710 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 327.491691][ T30] audit: type=1400 audit(327.060:146): avc: denied { ioctl } for pid=3565 comm="syz.0.12" path="/dev/rtc0" dev="devtmpfs" ino=710 ioctlcmd=0x7009 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 328.060801][ T30] audit: type=1400 audit(327.630:147): avc: denied { write } for pid=3567 comm="syz.0.13" name="ip6_mr_vif" dev="proc" ino=4026532676 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 329.207506][ T30] audit: type=1400 audit(328.780:148): avc: denied { allowed } for pid=3571 comm="syz.0.15" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 329.253319][ T30] audit: type=1400 audit(328.810:149): avc: denied { create } for pid=3571 comm="syz.0.15" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 330.323496][ T30] audit: type=1400 audit(329.880:150): avc: denied { bpf } for pid=3575 comm="syz.0.17" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 330.502058][ T30] audit: type=1400 audit(330.060:151): avc: denied { create } for pid=3575 comm="syz.0.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 331.942308][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 331.947018][ T30] audit: type=1400 audit(331.500:154): avc: denied { create } for pid=3585 comm="syz.1.21" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 331.966114][ T30] audit: type=1400 audit(331.540:155): avc: denied { setopt } for pid=3585 comm="syz.1.21" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 332.278885][ T30] audit: type=1400 audit(331.850:156): avc: denied { read write } for pid=3384 comm="syz-executor" name="loop1" dev="devtmpfs" ino=639 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 332.297005][ T30] audit: type=1400 audit(331.870:157): avc: denied { open } for pid=3384 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=639 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 332.310065][ T30] audit: type=1400 audit(331.880:158): avc: denied { ioctl } for pid=3384 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=639 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 333.687661][ T30] audit: type=1400 audit(333.260:159): avc: denied { mount } for pid=3592 comm="syz.1.23" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 334.076690][ T3594] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 334.323613][ T30] audit: type=1400 audit(333.880:160): avc: denied { unmount } for pid=3384 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 334.648232][ T30] audit: type=1400 audit(334.220:161): avc: denied { create } for pid=3596 comm="syz.0.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 334.670790][ T30] audit: type=1400 audit(334.240:162): avc: denied { bind } for pid=3596 comm="syz.0.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 334.754342][ T30] audit: type=1400 audit(334.320:163): avc: denied { write } for pid=3596 comm="syz.0.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 335.499511][ T3602] xt_hashlimit: size too large, truncated to 1048576 [ 337.828123][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 337.829521][ T30] audit: type=1400 audit(337.400:166): avc: denied { ioctl } for pid=3613 comm="syz.0.30" path="socket:[3952]" dev="sockfs" ino=3952 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 340.138006][ T30] audit: type=1400 audit(339.710:167): avc: denied { create } for pid=3626 comm="syz.1.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 340.161019][ T30] audit: type=1400 audit(339.730:168): avc: denied { write } for pid=3626 comm="syz.1.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 340.172177][ T30] audit: type=1400 audit(339.740:169): avc: denied { nlmsg_write } for pid=3626 comm="syz.1.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 343.627489][ T30] audit: type=1400 audit(343.200:170): avc: denied { map } for pid=3641 comm="syz.1.39" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=4382 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 343.631215][ T30] audit: type=1400 audit(343.200:171): avc: denied { read write } for pid=3641 comm="syz.1.39" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=4382 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 346.350035][ T30] audit: type=1400 audit(345.910:172): avc: denied { open } for pid=3657 comm="syz.1.45" path="/dev/ptyq6" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 346.468694][ T30] audit: type=1400 audit(346.040:173): avc: denied { map_create } for pid=3658 comm="syz.0.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 346.491928][ T30] audit: type=1400 audit(346.060:174): avc: denied { map_read map_write } for pid=3658 comm="syz.0.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 346.501721][ T30] audit: type=1400 audit(346.070:175): avc: denied { prog_load } for pid=3658 comm="syz.0.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 346.526916][ T30] audit: type=1400 audit(346.100:176): avc: denied { perfmon } for pid=3658 comm="syz.0.46" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 346.784521][ T30] audit: type=1400 audit(346.350:177): avc: denied { prog_run } for pid=3658 comm="syz.0.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 346.837574][ T30] audit: type=1400 audit(346.400:178): avc: denied { create } for pid=3658 comm="syz.0.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 346.864153][ T30] audit: type=1400 audit(346.420:179): avc: denied { setopt } for pid=3658 comm="syz.0.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 347.557650][ T804] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 347.872184][ T804] usb 1-1: New USB device found, idVendor=008d, idProduct=0000, bcdDevice= 0.00 [ 347.876265][ T804] usb 1-1: no configurations [ 347.876473][ T804] usb 1-1: can't read configurations, error -22 [ 348.085517][ T804] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 348.290273][ T804] usb 1-1: New USB device found, idVendor=008d, idProduct=0000, bcdDevice= 0.00 [ 348.291232][ T804] usb 1-1: no configurations [ 348.292028][ T804] usb 1-1: can't read configurations, error -22 [ 348.295936][ T804] usb usb1-port1: attempt power cycle [ 348.735438][ T804] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 348.889601][ T804] usb 1-1: New USB device found, idVendor=008d, idProduct=0000, bcdDevice= 0.00 [ 348.890593][ T804] usb 1-1: no configurations [ 348.894192][ T804] usb 1-1: can't read configurations, error -22 [ 349.074460][ T804] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 349.211120][ T804] usb 1-1: New USB device found, idVendor=008d, idProduct=0000, bcdDevice= 0.00 [ 349.212161][ T804] usb 1-1: no configurations [ 349.212312][ T804] usb 1-1: can't read configurations, error -22 [ 349.270157][ T804] usb usb1-port1: unable to enumerate USB device [ 350.351339][ T30] audit: type=1400 audit(349.920:180): avc: denied { write } for pid=3665 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=932 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 350.367927][ T30] audit: type=1400 audit(349.920:181): avc: denied { create } for pid=3665 comm="dhcpcd-run-hook" name="resolv.conf.eth0.ra" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 350.387478][ T30] audit: type=1400 audit(349.960:182): avc: denied { write open } for pid=3665 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.eth0.ra" dev="tmpfs" ino=1096 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 350.453801][ T30] audit: type=1400 audit(349.990:183): avc: denied { append } for pid=3665 comm="dhcpcd-run-hook" name="resolv.conf.eth0.ra" dev="tmpfs" ino=1096 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 350.479955][ T30] audit: type=1400 audit(350.050:184): avc: denied { getattr } for pid=3665 comm="dhcpcd-run-hook" path="/tmp/resolv.conf" dev="tmpfs" ino=2 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 351.513991][ T30] audit: type=1400 audit(351.080:185): avc: denied { read } for pid=3668 comm="cmp" name="resolv.conf" dev="tmpfs" ino=2 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 352.251996][ T30] audit: type=1400 audit(351.820:186): avc: denied { unmount } for pid=3384 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 352.806324][ T30] audit: type=1400 audit(352.350:187): avc: denied { write } for pid=3672 comm="rm" name="hook-state" dev="tmpfs" ino=932 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 352.823718][ T30] audit: type=1400 audit(352.390:188): avc: denied { unlink } for pid=3672 comm="rm" name="resolv.conf.eth0.ra" dev="tmpfs" ino=1096 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 355.325799][ T30] audit: type=1400 audit(354.900:189): avc: denied { append } for pid=3682 comm="syz.1.54" name="rtc0" dev="devtmpfs" ino=710 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 355.661119][ T30] audit: type=1400 audit(355.230:190): avc: denied { read } for pid=3684 comm="syz.1.55" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 355.668466][ T30] audit: type=1400 audit(355.240:191): avc: denied { open } for pid=3684 comm="syz.1.55" path="/dev/binderfs/binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 357.659161][ T30] audit: type=1400 audit(357.230:192): avc: denied { read } for pid=3692 comm="syz.0.59" name="card1" dev="devtmpfs" ino=619 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 357.686614][ T30] audit: type=1400 audit(357.250:193): avc: denied { open } for pid=3692 comm="syz.0.59" path="/dev/dri/card1" dev="devtmpfs" ino=619 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 357.738864][ T30] audit: type=1400 audit(357.310:194): avc: denied { ioctl } for pid=3692 comm="syz.0.59" path="/dev/dri/card1" dev="devtmpfs" ino=619 ioctlcmd=0x640d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 358.849701][ T30] audit: type=1400 audit(358.420:195): avc: denied { watch_mount watch_reads } for pid=3698 comm="syz.0.61" path="/29" dev="tmpfs" ino=158 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 359.129379][ T30] audit: type=1400 audit(358.690:196): avc: denied { read write } for pid=3700 comm="syz.1.62" name="uinput" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 359.141178][ T30] audit: type=1400 audit(358.710:197): avc: denied { open } for pid=3700 comm="syz.1.62" path="/dev/uinput" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 359.858515][ T3703] FAULT_INJECTION: forcing a failure. [ 359.858515][ T3703] name failslab, interval 1, probability 0, space 0, times 1 [ 359.877986][ T3703] CPU: 0 UID: 0 PID: 3703 Comm: syz.0.63 Tainted: G W syzkaller #0 PREEMPT [ 359.878248][ T3703] Tainted: [W]=WARN [ 359.878307][ T3703] Hardware name: linux,dummy-virt (DT) [ 359.878406][ T3703] Call trace: [ 359.878589][ T3703] show_stack+0x18/0x24 (C) [ 359.878783][ T3703] dump_stack_lvl+0x7c/0xb0 [ 359.878912][ T3703] dump_stack+0x1c/0x28 [ 359.879018][ T3703] should_fail_ex+0x6b4/0x6c4 [ 359.879145][ T3703] should_failslab+0xbc/0x120 [ 359.879260][ T3703] __kmalloc_cache_noprof+0x3ec/0x628 [ 359.879368][ T3703] sget_fc+0x174/0x16c4 [ 359.879491][ T3703] get_tree_nodev+0x2c/0x148 [ 359.879592][ T3703] mqueue_get_tree+0xc8/0x108 [ 359.879703][ T3703] vfs_get_tree+0x74/0x280 [ 359.879813][ T3703] fc_mount_longterm+0x18/0x1c4 [ 359.879941][ T3703] mq_init_ns+0x2a0/0x4b4 [ 359.880055][ T3703] copy_ipcs+0x230/0x440 [ 359.880163][ T3703] create_new_namespaces+0x194/0x7f4 [ 359.880294][ T3703] unshare_nsproxy_namespaces+0x88/0x184 [ 359.880423][ T3703] ksys_unshare+0x2ac/0x6e0 [ 359.880552][ T3703] __arm64_sys_unshare+0x34/0x50 [ 359.880667][ T3703] invoke_syscall+0x74/0x240 [ 359.880780][ T3703] el0_svc_common.constprop.0+0xac/0x230 [ 359.880894][ T3703] do_el0_svc+0x40/0x58 [ 359.881003][ T3703] el0_svc+0x58/0x2a4 [ 359.881119][ T3703] el0t_64_sync_handler+0xa0/0xe4 [ 359.881224][ T3703] el0t_64_sync+0x198/0x19c [ 364.596620][ T3724] FAULT_INJECTION: forcing a failure. [ 364.596620][ T3724] name failslab, interval 1, probability 0, space 0, times 0 [ 364.598480][ T3724] CPU: 1 UID: 0 PID: 3724 Comm: syz.0.73 Tainted: G W syzkaller #0 PREEMPT [ 364.598594][ T3724] Tainted: [W]=WARN [ 364.598622][ T3724] Hardware name: linux,dummy-virt (DT) [ 364.598655][ T3724] Call trace: [ 364.598683][ T3724] show_stack+0x18/0x24 (C) [ 364.598776][ T3724] dump_stack_lvl+0x7c/0xb0 [ 364.598833][ T3724] dump_stack+0x1c/0x28 [ 364.598894][ T3724] should_fail_ex+0x6b4/0x6c4 [ 364.598957][ T3724] should_failslab+0xbc/0x120 [ 364.599015][ T3724] __kmalloc_cache_noprof+0x3ec/0x628 [ 364.599070][ T3724] debugfs_init_fs_context+0x44/0xfc [ 364.599127][ T3724] alloc_fs_context+0x35c/0x750 [ 364.599183][ T3724] fs_context_for_mount+0x20/0x30 [ 364.599234][ T3724] __arm64_sys_fsopen+0x98/0x174 [ 364.599286][ T3724] invoke_syscall+0x74/0x240 [ 364.599367][ T3724] el0_svc_common.constprop.0+0xac/0x230 [ 364.599448][ T3724] do_el0_svc+0x40/0x58 [ 364.599501][ T3724] el0_svc+0x58/0x2a4 [ 364.599560][ T3724] el0t_64_sync_handler+0xa0/0xe4 [ 364.599611][ T3724] el0t_64_sync+0x198/0x19c [ 365.036486][ T3727] FAULT_INJECTION: forcing a failure. [ 365.036486][ T3727] name failslab, interval 1, probability 0, space 0, times 0 [ 365.044623][ T3727] CPU: 0 UID: 0 PID: 3727 Comm: syz.1.74 Tainted: G W syzkaller #0 PREEMPT [ 365.044825][ T3727] Tainted: [W]=WARN [ 365.044874][ T3727] Hardware name: linux,dummy-virt (DT) [ 365.044931][ T3727] Call trace: [ 365.044988][ T3727] show_stack+0x18/0x24 (C) [ 365.045267][ T3727] dump_stack_lvl+0x7c/0xb0 [ 365.045466][ T3727] dump_stack+0x1c/0x28 [ 365.045649][ T3727] should_fail_ex+0x6b4/0x6c4 [ 365.045913][ T3727] should_failslab+0xbc/0x120 [ 365.046130][ T3727] __kmalloc_noprof+0x4dc/0x74c [ 365.046329][ T3727] lsm_blob_alloc+0x60/0x80 [ 365.046477][ T3727] security_prepare_creds+0x30/0x200 [ 365.046576][ T3727] prepare_creds+0x358/0x6bc [ 365.046771][ T3727] lookup_user_key+0x9ac/0xc4c [ 365.047059][ T3727] keyctl_session_to_parent+0x20/0x7e4 [ 365.047357][ T3727] __arm64_sys_keyctl+0x2f4/0x43c [ 365.047562][ T3727] invoke_syscall+0x74/0x240 [ 365.047747][ T3727] el0_svc_common.constprop.0+0xac/0x230 [ 365.047846][ T3727] do_el0_svc+0x40/0x58 [ 365.048011][ T3727] el0_svc+0x58/0x2a4 [ 365.048313][ T3727] el0t_64_sync_handler+0xa0/0xe4 [ 365.048408][ T3727] el0t_64_sync+0x198/0x19c [ 365.293570][ T29] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 365.500466][ T29] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 365.520955][ T29] usb 1-1: config 0 has no interfaces? [ 365.571611][ T29] usb 1-1: New USB device strings: Mfr=1, Product=10, SerialNumber=0 [ 365.574272][ T29] usb 1-1: Product: syz [ 365.576863][ T29] usb 1-1: Manufacturer: syz [ 365.688694][ T29] usb 1-1: config 0 descriptor?? [ 367.995607][ T3527] usb 1-1: USB disconnect, device number 6 [ 374.194052][ T30] audit: type=1326 audit(373.760:198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3758 comm="syz.1.88" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff941782e8 code=0x7ffc0000 [ 374.217996][ T30] audit: type=1326 audit(373.790:199): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3758 comm="syz.1.88" exe="/syz-executor" sig=0 arch=c00000b7 syscall=167 compat=0 ip=0xffff941782e8 code=0x7ffc0000 [ 374.219196][ T30] audit: type=1326 audit(373.790:200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3758 comm="syz.1.88" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff941782e8 code=0x7ffc0000 [ 374.253964][ T30] audit: type=1326 audit(373.810:201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3758 comm="syz.1.88" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff941782e8 code=0x7ffc0000 [ 375.038613][ T30] audit: type=1400 audit(374.610:202): avc: denied { read } for pid=3760 comm="syz.0.89" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 375.948958][ T3775] netlink: 'syz.1.91': attribute type 4 has an invalid length. [ 377.620761][ T3780] netlink: 12 bytes leftover after parsing attributes in process `syz.1.93'. [ 379.784292][ T3787] ip_tables: iptables: counters copy to user failed while replacing table [ 381.868905][ T3781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 383.987048][ T12] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 383.989783][ T12] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 384.407717][ T12] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 384.415993][ T12] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.251941][ T3798] bridge_slave_0: entered promiscuous mode [ 385.340856][ T3798] Zero length message leads to an empty skb [ 386.290486][ T30] audit: type=1400 audit(385.860:203): avc: denied { mount } for pid=3800 comm="syz.0.100" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 386.667593][ T3802] gadgetfs: bound to dummy_udc driver [ 386.745494][ T3802] ip_tables: iptables: counters copy to user failed while replacing table [ 386.815773][ T30] audit: type=1400 audit(386.380:204): avc: denied { read write } for pid=3800 comm="syz.0.100" name="fuse" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 386.816729][ T30] audit: type=1400 audit(386.380:205): avc: denied { open } for pid=3800 comm="syz.0.100" path="/dev/fuse" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 387.004976][ T9] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 387.006281][ C0] gadgetfs: connected [ 387.009107][ T9] gadgetfs: disconnected [ 387.088355][ T30] audit: type=1400 audit(386.660:207): avc: denied { create } for pid=3803 comm="syz.1.101" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 387.097235][ T30] audit: type=1400 audit(386.650:206): avc: denied { search } for pid=3800 comm="syz.0.100" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 387.103452][ T30] audit: type=1400 audit(386.670:208): avc: denied { search } for pid=3800 comm="syz.0.100" name="instances" dev="tracefs" ino=1116 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 387.146393][ T30] audit: type=1400 audit(386.710:209): avc: denied { write search } for pid=3800 comm="syz.0.100" name="instances" dev="tracefs" ino=1116 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 387.157074][ T30] audit: type=1400 audit(386.730:210): avc: denied { add_name } for pid=3800 comm="syz.0.100" name="inst1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 387.170052][ T30] audit: type=1400 audit(386.740:211): avc: denied { create } for pid=3800 comm="syz.0.100" name="inst1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:tracefs_t tclass=dir permissive=1 [ 387.214981][ C0] gadgetfs: connected [ 387.225332][ T9] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 387.229365][ T9] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 387.239651][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 387.280772][ C0] gadgetfs: configuration #1 [ 387.533159][ T3802] Could not create tracefs 'set_event_pid' entry [ 387.707869][ T3802] Could not create tracefs 'set_event_notrace_pid' entry [ 387.904980][ T3802] Could not create tracefs 'events' directory [ 388.057183][ T3800] gadgetfs: suspended from state 3 [ 388.064618][ T3800] gadgetfs: disconnected [ 388.066892][ T23] usb 1-1: USB disconnect, device number 7 [ 388.414074][ T30] audit: type=1400 audit(387.980:212): avc: denied { unmount } for pid=3383 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 390.415467][ T23] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 390.604654][ T23] usb 1-1: device descriptor read/64, error -71 [ 390.874997][ T23] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 391.034349][ T23] usb 1-1: device descriptor read/64, error -71 [ 391.148018][ T23] usb usb1-port1: attempt power cycle [ 391.534443][ T23] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 391.605652][ T23] usb 1-1: device descriptor read/8, error -71 [ 391.874735][ T23] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 391.900858][ T23] usb 1-1: device descriptor read/8, error -71 [ 392.019583][ T23] usb usb1-port1: unable to enumerate USB device [ 393.196951][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 393.197597][ T30] audit: type=1400 audit(392.770:214): avc: denied { setopt } for pid=3821 comm="syz.1.108" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 393.514230][ T30] audit: type=1400 audit(393.070:215): avc: denied { read } for pid=3823 comm="syz.1.109" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 394.004465][ T30] audit: type=1400 audit(393.570:216): avc: denied { view } for pid=3825 comm="syz.1.110" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 397.261817][ T3829] 8021q: adding VLAN 0 to HW filter on device bond0 [ 397.675050][ T2174] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.675989][ T2174] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.676493][ T2174] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.676926][ T2174] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.705571][ T30] audit: type=1400 audit(398.280:217): avc: denied { create } for pid=3832 comm="syz.1.113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 398.727825][ T30] audit: type=1400 audit(398.300:218): avc: denied { write } for pid=3832 comm="syz.1.113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 399.127738][ T30] audit: type=1400 audit(398.700:219): avc: denied { mmap_zero } for pid=3834 comm="syz.1.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 399.190550][ T30] audit: type=1400 audit(398.760:220): avc: denied { map } for pid=3834 comm="syz.1.114" path="socket:[5351]" dev="sockfs" ino=5351 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 399.700076][ T3836] FAULT_INJECTION: forcing a failure. [ 399.700076][ T3836] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 399.700556][ T3836] CPU: 0 UID: 0 PID: 3836 Comm: syz.1.114 Tainted: G W syzkaller #0 PREEMPT [ 399.700639][ T3836] Tainted: [W]=WARN [ 399.700667][ T3836] Hardware name: linux,dummy-virt (DT) [ 399.700701][ T3836] Call trace: [ 399.700729][ T3836] show_stack+0x18/0x24 (C) [ 399.700823][ T3836] dump_stack_lvl+0x7c/0xb0 [ 399.700890][ T3836] dump_stack+0x1c/0x28 [ 399.700942][ T3836] should_fail_ex+0x6b4/0x6c4 [ 399.701004][ T3836] should_fail_alloc_page+0x70/0xc0 [ 399.701211][ T3836] prepare_alloc_pages+0x1cc/0x578 [ 399.701391][ T3836] __alloc_frozen_pages_noprof+0x1a4/0x3498 [ 399.701587][ T3836] alloc_pages_mpol+0xf8/0x41c [ 399.701886][ T3836] alloc_frozen_pages_noprof+0xb8/0x200 [ 399.702078][ T3836] alloc_pages_noprof+0x14/0x120 [ 399.702213][ T3836] __pte_alloc_one_noprof.constprop.0+0x24/0x208 [ 399.702345][ T3836] do_fault+0x55c/0xe28 [ 399.702508][ T3836] __handle_mm_fault+0x7c8/0x1b60 [ 399.702665][ T3836] handle_mm_fault+0x1e8/0x8ac [ 399.702809][ T3836] do_page_fault+0x48c/0xf50 [ 399.702987][ T3836] do_translation_fault+0xac/0xec [ 399.703183][ T3836] do_mem_abort+0x64/0x1a0 [ 399.703348][ T3836] el0_da+0x70/0x284 [ 399.703476][ T3836] el0t_64_sync_handler+0xd0/0xe4 [ 399.703532][ T3836] el0t_64_sync+0x198/0x19c [ 399.709108][ T3836] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 400.850232][ T30] audit: type=1400 audit(400.420:221): avc: denied { ioctl } for pid=3837 comm="syz.1.115" path="/dev/binderfs/binder0" dev="binder" ino=7 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 400.897969][ T30] audit: type=1400 audit(400.430:222): avc: denied { set_context_mgr } for pid=3837 comm="syz.1.115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 400.909031][ T30] audit: type=1400 audit(400.480:223): avc: denied { write } for pid=3837 comm="syz.1.115" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 401.050265][ T3839] binder: 3837:3839 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 401.299746][ T805] binder: undelivered freeze notification, 0000000000000000 [ 402.169088][ T3845] FAULT_INJECTION: forcing a failure. [ 402.169088][ T3845] name failslab, interval 1, probability 0, space 0, times 0 [ 402.194658][ T3845] CPU: 1 UID: 0 PID: 3845 Comm: syz.0.118 Tainted: G W syzkaller #0 PREEMPT [ 402.194934][ T3845] Tainted: [W]=WARN [ 402.194993][ T3845] Hardware name: linux,dummy-virt (DT) [ 402.195065][ T3845] Call trace: [ 402.195123][ T3845] show_stack+0x18/0x24 (C) [ 402.195304][ T3845] dump_stack_lvl+0x7c/0xb0 [ 402.195424][ T3845] dump_stack+0x1c/0x28 [ 402.195533][ T3845] should_fail_ex+0x6b4/0x6c4 [ 402.195651][ T3845] should_failslab+0xbc/0x120 [ 402.195770][ T3845] __kmalloc_noprof+0x4dc/0x74c [ 402.195904][ T3845] lsm_blob_alloc+0x60/0x80 [ 402.196026][ T3845] security_key_alloc+0x3c/0x268 [ 402.196143][ T3845] key_alloc+0x688/0xf44 [ 402.196257][ T3845] keyring_alloc+0x58/0xc0 [ 402.196376][ T3845] lookup_user_key+0x804/0xc4c [ 402.196502][ T3845] __arm64_sys_add_key+0x1e0/0x398 [ 402.196635][ T3845] invoke_syscall+0x74/0x240 [ 402.196759][ T3845] el0_svc_common.constprop.0+0xac/0x230 [ 402.196885][ T3845] do_el0_svc+0x40/0x58 [ 402.196992][ T3845] el0_svc+0x58/0x2a4 [ 402.197107][ T3845] el0t_64_sync_handler+0xa0/0xe4 [ 402.197212][ T3845] el0t_64_sync+0x198/0x19c [ 402.350810][ T30] audit: type=1400 audit(401.920:224): avc: denied { read } for pid=3847 comm="syz.1.119" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 402.354785][ T30] audit: type=1400 audit(401.930:225): avc: denied { open } for pid=3847 comm="syz.1.119" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 402.363628][ T30] audit: type=1400 audit(401.930:226): avc: denied { ioctl } for pid=3847 comm="syz.1.119" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 403.395522][ T3851] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 403.414360][ T3851] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 403.910978][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 403.916600][ T30] audit: type=1400 audit(403.480:228): avc: denied { map } for pid=3854 comm="syz.1.122" path="/dev/binderfs/binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 403.945437][ T3855] binder: 3854:3855 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 403.948447][ T3855] binder: 3855 RLIMIT_NICE not set [ 404.487983][ T3856] binder: 3854:3856 tried to acquire reference to desc 0, got 1 instead [ 404.527017][ T30] audit: type=1400 audit(404.100:229): avc: denied { call } for pid=3854 comm="syz.1.122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 404.556149][ T3855] binder: 3855 RLIMIT_NICE not set [ 404.561573][ T3855] binder: send failed reply for transaction 7 to 3854:3856 [ 404.566869][ T3855] binder: 3854:3855 ioctl c0306201 20000480 returned -14 [ 404.609147][ T804] binder: undelivered TRANSACTION_COMPLETE [ 404.610372][ T804] binder: undelivered TRANSACTION_ERROR: 29201 [ 405.044062][ T30] audit: type=1400 audit(404.610:230): avc: denied { sqpoll } for pid=3859 comm="syz.1.124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 405.513972][ T633] ================================================================== [ 405.514324][ T633] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x1104/0x1d40 [ 405.514582][ T633] Write of size 8 at addr ffff80008ef09000 by task kworker/u8:4/633 [ 405.514655][ T633] [ 405.514746][ T633] CPU: 1 UID: 0 PID: 633 Comm: kworker/u8:4 Tainted: G W syzkaller #0 PREEMPT [ 405.514852][ T633] Tainted: [W]=WARN [ 405.514886][ T633] Hardware name: linux,dummy-virt (DT) [ 405.515070][ T633] Workqueue: events_power_efficient fb_flashcursor [ 405.515202][ T633] Call trace: [ 405.515230][ T633] show_stack+0x18/0x24 (C) [ 405.515292][ T633] dump_stack_lvl+0x7c/0xb0 [ 405.515340][ T633] print_report+0x18c/0x4e8 [ 405.515386][ T633] kasan_report+0xb8/0x15c [ 405.515434][ T633] __asan_report_store8_noabort+0x20/0x2c [ 405.515480][ T633] sys_imageblit+0x1104/0x1d40 [ 405.515523][ T633] drm_fbdev_shmem_defio_imageblit+0x1c/0x120 [ 405.515577][ T633] soft_cursor+0x40c/0x960 [ 405.515619][ T633] bit_cursor+0x8e0/0x1604 [ 405.515660][ T633] fb_flashcursor+0x230/0x360 [ 405.515700][ T633] process_one_work+0x830/0x1c00 [ 405.515748][ T633] worker_thread+0x42c/0xc90 [ 405.515791][ T633] kthread+0x2ec/0x384 [ 405.515835][ T633] ret_from_fork+0x10/0x20 [ 405.515906][ T633] [ 405.516015][ T633] The buggy address belongs to a vmalloc virtual mapping [ 405.516248][ T633] Memory state around the buggy address: [ 405.516648][ T633] ffff80008ef08f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 405.516774][ T633] ffff80008ef08f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 405.516808][ T633] >ffff80008ef09000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 405.516878][ T633] ^ [ 405.517008][ T633] ffff80008ef09080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 405.517038][ T633] ffff80008ef09100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 405.517177][ T633] ================================================================== [ 405.567186][ T633] Disabling lock debugging due to kernel taint [ 405.569861][ T633] Unable to handle kernel paging request at virtual address ffff80008ef09000 [ 405.570204][ T633] KASAN: probably user-memory-access in range [0x0000000477848000-0x0000000477848007] [ 405.570393][ T633] Mem abort info: [ 405.570559][ T633] ESR = 0x0000000096000047 [ 405.570766][ T633] EC = 0x25: DABT (current EL), IL = 32 bits [ 405.570937][ T633] SET = 0, FnV = 0 [ 405.571077][ T633] EA = 0, S1PTW = 0 [ 405.571232][ T633] FSC = 0x07: level 3 translation fault [ 405.571400][ T633] Data abort info: [ 405.571572][ T633] ISV = 0, ISS = 0x00000047, ISS2 = 0x00000000 [ 405.571729][ T633] CM = 0, WnR = 1, TnD = 0, TagAccess = 0 [ 405.571877][ T633] GCS = 0, Overlay = 0, DirtyBit = 0 [ 405.572157][ T633] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000047695000 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 405.572282][ T633] [ffff80008ef09000] pgd=0000000000000000, p4d=100000004dd69003 ** replaying previous printk message ** [ 405.572282][ T633] [ffff80008ef09000] pgd=0000000000000000, p4d=100000004dd69003, pud=100000004dd6a003, pmd=1000000052cb6403, pte=0000000000000000 [ 405.596237][ T633] Internal error: Oops: 0000000096000047 [#1] SMP [ 405.598407][ T633] Modules linked in: [ 405.598798][ T633] CPU: 0 UID: 0 PID: 633 Comm: kworker/u8:4 Tainted: G B W syzkaller #0 PREEMPT [ 405.599233][ T633] Tainted: [B]=BAD_PAGE, [W]=WARN [ 405.599503][ T633] Hardware name: linux,dummy-virt (DT) [ 405.599785][ T633] Workqueue: events_power_efficient fb_flashcursor [ 405.600197][ T633] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 405.600531][ T633] pc : sys_imageblit+0xda8/0x1d40 [ 405.600803][ T633] lr : sys_imageblit+0x1104/0x1d40 [ 405.601070][ T633] sp : ffff80008e8d76c0 [ 405.601335][ T633] x29: ffff80008e8d77a0 x28: ffff80008e8d7740 x27: 0000000000000004 [ 405.601806][ T633] x26: ffff80008ef09000 x25: ffff80008ef09000 x24: ffff0000144501d0 [ 405.602259][ T633] x23: 1ffff00011d1aee4 x22: 0000000000000004 x21: 0000000000000000 [ 405.602881][ T633] x20: dfff800000000000 x19: ffff0000144501d1 x18: 0000000000000000 [ 405.603343][ T633] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000877cb690 [ 405.603933][ T633] x14: 1ffff00010ef96d2 x13: 0000000000000001 x12: ffff700011269439 [ 405.604410][ T633] x11: 1ffff00011269438 x10: ffff700011269438 x9 : dfff800000000000 [ 405.604869][ T633] x8 : ffff80008934a1c7 x7 : 0000000000000001 x6 : ffff700011269438 [ 405.605329][ T633] x5 : ffff80008934a1c0 x4 : 0000000000000000 x3 : 0000000000000000 [ 405.605792][ T633] x2 : 0000000000000000 x1 : ffff000013b20000 x0 : 0000000000000001 [ 405.606506][ T633] Call trace: [ 405.606716][ T633] sys_imageblit+0xda8/0x1d40 (P) [ 405.607052][ T633] drm_fbdev_shmem_defio_imageblit+0x1c/0x120 [ 405.607378][ T633] soft_cursor+0x40c/0x960 [ 405.607648][ T633] bit_cursor+0x8e0/0x1604 [ 405.607949][ T633] fb_flashcursor+0x230/0x360 [ 405.608214][ T633] process_one_work+0x830/0x1c00 [ 405.608507][ T633] worker_thread+0x42c/0xc90 [ 405.608780][ T633] kthread+0x2ec/0x384 [ 405.609054][ T633] ret_from_fork+0x10/0x20 [ 405.609777][ T633] Code: d343ff40 38f46800 35001ac0 d34416a2 (f9000344) [ 405.611281][ T633] ---[ end trace 0000000000000000 ]--- [ 405.612457][ T633] Kernel panic - not syncing: Oops: Fatal exception [ 405.613417][ T633] SMP: stopping secondary CPUs [ 405.614904][ T633] Kernel Offset: disabled [ 405.615187][ T633] CPU features: 0x0,40400002,00340020,00100000,0800821b [ 405.615579][ T633] Memory Limit: none [ 405.616754][ T633] Rebooting in 86400 seconds.. VM DIAGNOSIS: 06:59:51 Registers: info registers vcpu 0 CPU#0 PC=ffff8000819a5310 X00=ffff00006975e800 X01=ffff00001845ba00 X02=000000000000001a X03=1fffe0000d7ef261 X04=dfff800000000000 X05=1fffe0000308b741 X06=ffff8000800103d4 X07=0000000000000000 X08=ffff80008db96a50 X09=00000000000000d0 X10=0000000000000078 X11=ffff800087763ed4 X12=ffff80008d8206c0 X13=ffff800089ead778 X14=1ffff00010ef96d2 X15=ffff8000877cb690 X16=0000000000000007 X17=0000000000000000 X18=0000000000000000 X19=ffff00001845ba00 X20=ffff00001845ba00 X21=ffff00001845ba00 X22=1ffff00011b72d8a X23=0000000000000000 X24=ffff00000ecbf3c0 X25=0000000000082820 X26=ffff8000877a3b40 X27=1ffff00011b72d8e X28=1fffe00002fcee3c X29=ffff80008db96b00 X30=ffff800080a96880 SP=ffff80008db96b30 PSTATE=80000005 N--- EL1h FPCR=00000000 FPSR=00000000 Q00=2525252525252525:2525252525252525 Q01=6572207265767265:730073250a0d0a0d Q02=3d3d3d3d3d3d3d3d:3d3d3d3d3d3d3d3d Q03=0000000000000000:00ff00ff00000000 Q04=0000000000000000:000000000f0f0000 Q05=3d3d3d3d3d3d3d3d:3d3d3d3d3d3d3d3d Q06=696154203831312e:302e7a7973203a6d Q07=5720202020202020:2047203a6465746e Q08=0000000000000000:0000000000000000 Q09=0000000000000000:0000000000000000 Q10=0000000000000000:0000000000000000 Q11=0000000000000000:0000000000000000 Q12=0000000000000000:0000000000000000 Q13=0000000000000000:0000000000000000 Q14=0000000000000000:0000000000000000 Q15=0000000000000000:0000000000000000 Q16=0000ffffd36afc30:0000ffffd36afc30 Q17=ffffff80ffffffd8:0000ffffd36afc00 Q18=0000000000000000:0000000000000000 Q19=0000000000000000:0000000000000000 Q20=0000000000000000:0000000000000000 Q21=0000000000000000:0000000000000000 Q22=0000000000000000:0000000000000000 Q23=0000000000000000:0000000000000000 Q24=0000000000000000:0000000000000000 Q25=0000000000000000:0000000000000000 Q26=0000000000000000:0000000000000000 Q27=0000000000000000:0000000000000000 Q28=0000000000000000:0000000000000000 Q29=0000000000000000:0000000000000000 Q30=0000000000000000:0000000000000000 Q31=0000000000000000:0000000000000000 info registers vcpu 1 CPU#1 PC=ffff800081ec5184 X00=0000000000000002 X01=0000000000000007 X02=0000000000000000 X03=1fffe00001e43832 X04=0000000000000018 X05=ffff80008e027a10 X06=ffff700011c04f42 X07=0000000000000001 X08=0000000000000003 X09=dfff800000000000 X10=ffff700011c04f42 X11=1ffff00011c04f42 X12=ffff700011c04f43 X13=205d333336542020 X14=3a38752f72656b72 X15=65746e6961542034 X16=2020202047203a64 X17=2020205720202020 X18=000000000000003a X19=ffff00000f21c080 X20=ffff80008db8d018 X21=ffff8000881215c0 X22=000000000000006c X23=dfff800000000000 X24=ffff00000f246065 X25=0000000000000004 X26=0000000000000075 X27=ffff800081ec5000 X28=ffff80008e027db8 X29=ffff80008e027a10 X30=ffff800081ec593c SP=ffff80008e027a10 PSTATE=800000c5 N--- EL1h FPCR=00000000 FPSR=00000000 Q00=0000000000000000:0000000000000000 Q01=0000ffff943d65d0:0000ffff943d6570 Q02=0000ffff943d6580:0000ffff943d65c0 Q03=0000ffff94f3c8d0:0000ffff943d6570 Q04=0000ffff943d6598:0000ffff943d65c8 Q05=0000ffff943d65b0:0000ffff943d6590 Q06=0000ffff943d65b0:0000ffff943d6590 Q07=0000ffff943d65a8:0000ffff943d6578 Q08=0000000000000000:0000000000000000 Q09=0000000000000000:0000000000000000 Q10=0000000000000000:0000000000000000 Q11=0000000000000000:0000000000000000 Q12=0000000000000000:0000000000000000 Q13=0000000000000000:0000000000000000 Q14=0000000000000000:0000000000000000 Q15=0000000000000000:0000000000000000 Q16=0000000000000000:0000000000000000 Q17=0000000000000000:0000000000000000 Q18=0000000000000000:0000000000000000 Q19=0000000000000000:0000000000000000 Q20=0000000000000000:0000000000000000 Q21=0000000000000000:0000000000000000 Q22=bb448243222c92da:e3914ed4e87380b0 Q23=43788d6f07084f17:4508b00c6052a10f Q24=b20fae707afde253:388e9c6c4fa85ca0 Q25=8e9f894b2581e79e:20c883c9819d5c97 Q26=57c93d417f4d0394:89cd11f6992873d1 Q27=6b69be1163cb6500:a4ac85c293540e63 Q28=6edc4d3a2914b135:d8e9c869e2695c88 Q29=0000000000000000:0009000700030001 Q30=0000000000000000:0000ffff94148674 Q31=0000000000000000:0000000000000000