last executing test programs: 33.725587208s ago: executing program 1 (id=16): mknodat$null(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2000, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x101100, 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = fcntl$dupfd(r3, 0x0, r2) getpeername$packet(r4, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000340)={'syzkaller0\x00', 0x1001}) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000640)='/dev/bsg/2:0:0:0\x00', 0x2000, 0x0) ioctl$BSG_SET_COMMAND_Q(r5, 0x2271, &(0x7f0000000680)=0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) lremovexattr(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)=@known='system.posix_acl_access\x00') 32.835009755s ago: executing program 1 (id=22): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)={0x14, r1, 0x721, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x8004) chdir(&(0x7f0000000000)='./file0\x00') ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000040)={0x2, "94c492eb0165203d36bec70800890100000000000000e1100a0000005900"}) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW2(r2, 0x402c542c, &(0x7f0000000180)={0x5, 0x0, 0xfffffe3f, 0xfffffffe, 0x0, "4d6b55f67e02bfc6aafbd98ec07c05a8765ccb", 0x388, 0x900}) readv(r2, &(0x7f00000001c0)=[{&(0x7f0000000380)=""/214, 0xd6}], 0x1) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000480)) mkdirat(0xffffffffffffff9c, &(0x7f0000001740)='./file0\x00', 0x0) mount$bind(&(0x7f0000001780)='.\x00', &(0x7f00000017c0)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000001800)='./file0\x00', 0x0, 0x100000, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001880)={&(0x7f0000000080)=ANY=[@ANYRES16=0x0], 0x7c}}, 0x0) close(0xffffffffffffffff) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, &(0x7f0000001940)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r4, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r5, &(0x7f0000001980)={0x2, 0x4e22, @empty}, 0x10) r6 = accept(r4, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r6, &(0x7f00000019c0)={0x0, 0x0, &(0x7f0000001a00)={&(0x7f0000001a40)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x24008840}, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x1, &(0x7f0000001b80)=0x783a, 0x4) 31.945017068s ago: executing program 1 (id=28): r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000400)={0x0, @bt={0xe, 0x6, 0x1, 0x3, 0x7ff, 0x1, 0x5, 0xf, 0x3, 0x36d, 0x10000, 0x7, 0x9b23, 0xfff, 0x15, 0x10, {0x6, 0x3}, 0x38, 0x9e}}) ioctl$VIDIOC_S_TUNER(r0, 0x4054561e, &(0x7f00000004c0)={0x0, "1647e9378c1297d87cd35dfcf2639cd490617944f2709ac28df91f41d902b896", 0x1, 0x200, 0x1, 0x3, 0x1, 0x0, 0x10001, 0xfffffff8}) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r0, 0x4020565b, &(0x7f0000000540)={0x6, 0x4}) mount(&(0x7f0000000640)=@nullb, &(0x7f0000000680)='./tracefs\x00', &(0x7f00000006c0)='bpf\x00', 0x840, &(0x7f0000000700)=' \x01\x00') r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) ptrace$getregset(0x4204, r1, 0x204, &(0x7f0000000140)={0x0}) syz_emit_ethernet(0x66, &(0x7f0000000080)={@link_local, @random="86082b9827c1", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "b83e02", 0x30, 0x3a, 0x0, @private2, @rand_addr=' \x01\x00', {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "974367", 0x6, 0x11, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local}}}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./tracefs\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./tracefs/current_tracer\x00', 0x1, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000580), 0x2, 0x141102) writev(r3, &(0x7f00000005c0)=[{&(0x7f0000000600)="94", 0xf000}, {0x0, 0x100000}], 0x2) write(r2, &(0x7f0000000380)='nop', 0x3) r4 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@ieee802154={0x24, @long}, &(0x7f0000000100)=0x80, 0x80000) sendmsg$NFNL_MSG_CTHELPER_NEW(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x7c, 0x0, 0x9, 0x201, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFCTH_TUPLE={0x68, 0x2, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0xbd}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x44001}, 0x20008008) 31.875413121s ago: executing program 1 (id=31): mknodat$null(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2000, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x101100, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = fcntl$dupfd(r2, 0x0, r1) getpeername$packet(r3, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000640)='/dev/bsg/2:0:0:0\x00', 0x2000, 0x0) ioctl$BSG_SET_COMMAND_Q(r5, 0x2271, &(0x7f0000000680)=0x1) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) lremovexattr(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)=@known='system.posix_acl_access\x00') 31.015397561s ago: executing program 1 (id=45): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SG_BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./proc_mnt\x00', &(0x7f0000000240)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc_mnt/kcore\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000500)={0x2020}, 0xffffffa0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = epoll_create1(0x0) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/comedi3\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000400)={0xa, 0x4e22}, 0x1c) listen(r5, 0x10040) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000440)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f0000000480)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010001, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2, 0x5, 0x0, 0x6}}}}}}, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000002540)={@local, @empty, @val={@void, {0x8100, 0x0, 0x0, 0x4}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010001, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2}}}}}}, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1022}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)=@bridge_dellink={0x74, 0x11, 0x100, 0x70bd2b, 0x25dfdbfe, {0x7, 0x0, 0x0, 0x0, 0x20, 0x100}, [@IFLA_TARGET_NETNSID={0x8, 0x2e, 0x2}, @IFLA_CARRIER_CHANGES={0x8, 0x23, 0x4}, @IFLA_CARRIER_CHANGES={0x8, 0x23, 0x49e}, @IFLA_MTU={0x8, 0x4, 0xca4}, @IFLA_TARGET_NETNSID={0x8, 0x2e, 0x1}, @IFLA_PROTO_DOWN={0x5, 0x27, 0xff}, @IFLA_MAP={0x24, 0xe, {0xffffffffffff8000, 0xe0, 0x4, 0x6, 0x4e, 0x58}}]}, 0x74}, 0x1, 0x0, 0x0, 0x20000080}, 0x4000) r6 = fanotify_init(0xef0, 0x2) readv(r6, &(0x7f0000000080)=[{&(0x7f00000000c0)=""/141, 0x8d}], 0x1) setsockopt$inet_msfilter(r4, 0x0, 0x29, &(0x7f0000000180)={@private=0xa010100, @multicast1, 0x1, 0x4, [@dev={0xac, 0x14, 0x14, 0xc}, @multicast2, @rand_addr=0x64010102, @broadcast]}, 0x20) fanotify_mark(r6, 0x105, 0x40009965, r4, 0x0) syz_clone(0x40000, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000000)={0x90000010}) 30.753306199s ago: executing program 1 (id=50): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./sys\x00', 0x1ff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), r0) sendmsg$NLBL_MGMT_C_REMOVEDEF(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x14, r1, 0x1, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x84) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x1c}}, 0x0) mount(0x0, &(0x7f00000002c0)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x2033008, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/kernel/reboot/type\x00', 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_PROBE_CLIENT(r3, &(0x7f00000010c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001080)={&(0x7f0000000740)={0x68, r4, 0x300, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x53}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x68}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) write(r2, &(0x7f0000000380)='triple\n\x00', 0x7) r5 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/kernel/reboot/force\x00', 0x2, 0x0) write(r5, &(0x7f0000000400)='1\n\x00', 0x2) r6 = socket$phonet(0x23, 0x2, 0x1) sendto$phonet(r6, 0x0, 0x0, 0x0, &(0x7f00000004c0)={0x23, 0x1}, 0x10) r7 = socket(0x10, 0x80002, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r7, 0x89f0, &(0x7f0000000700)={'gre0\x00', &(0x7f0000000640)={'sit0\x00', 0x0, 0x80, 0x1, 0xb, 0x0, {{0x1c, 0x4, 0x2, 0xb, 0x70, 0x68, 0x0, 0xff, 0x2f, 0x0, @multicast1, @loopback, {[@timestamp_addr={0x44, 0x34, 0xe, 0x1, 0x2, [{@empty, 0x1}, {@remote, 0x1}, {@multicast1, 0x8}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e0}, {@empty, 0x7608000}, {@multicast2, 0xd}]}, @rr={0x7, 0x7, 0xc0, [@dev={0xac, 0x14, 0x14, 0x41}]}, @generic={0x82, 0x6, "41d58026"}, @rr={0x7, 0x17, 0xe8, [@multicast2, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x38}, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000007c0)=@delchain={0x8b8, 0x65, 0x0, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {0x9, 0xfff1}, {0xb, 0xfff1}, {0x5, 0xc}}, [@TCA_CHAIN={0x8, 0xb, 0x8415}, @TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_CHAIN={0x8, 0xb, 0x3}, @filter_kind_options=@f_u32={{0x8}, {0x85c, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x7, 0xfd}}, @TCA_U32_DIVISOR={0x8, 0x4, 0xa7}, @TCA_U32_POLICE={0x838, 0x6, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x54}, @TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RESULT={0x8, 0x5, 0x200}, @TCA_POLICE_RATE64={0xc, 0x8, 0x156f}, @TCA_POLICE_RATE={0x404, 0x2, [0x5d, 0x0, 0xfffffffd, 0x1, 0x2, 0x81, 0x5, 0x3, 0x7, 0xffff, 0xfd1, 0x2, 0x8, 0xc, 0x8001, 0x8, 0x5, 0x6, 0x9, 0x0, 0x10, 0xfff, 0x3, 0x2, 0x400, 0x7, 0x5, 0x7, 0x2, 0xae0, 0x4, 0x6, 0x363, 0x400, 0x4, 0x5, 0x6, 0x4, 0x9, 0xe, 0x6, 0x1000, 0xffffff7f, 0x4, 0x3, 0x15, 0x800, 0x8, 0x9, 0xf9, 0x401, 0x2, 0x2, 0x2, 0x7, 0x71, 0x7, 0x401, 0x10, 0x7, 0xff, 0x400, 0xd, 0x1000, 0x8, 0x3, 0x5, 0x3ff, 0x2, 0x9, 0x8001, 0x4, 0x1ff, 0x7, 0xfff, 0x2, 0x9, 0xfffffffe, 0x8, 0xff, 0x9, 0x7, 0xffffff36, 0x7fff, 0x3, 0x1, 0x1, 0xfffffff8, 0x80000, 0x5b, 0x7fff, 0x7, 0x80, 0x94, 0x7, 0x5, 0x0, 0x2, 0x4, 0x8, 0x45b, 0x8, 0x5a, 0x7, 0x1, 0x6, 0x10000, 0x7, 0x80, 0x6, 0x9, 0x9, 0x1, 0x2, 0xfff, 0x2, 0x100, 0x6, 0x5, 0x3, 0x8b0b, 0x7fff, 0xfffffffa, 0x6, 0xfffffffd, 0x8000, 0x4, 0x5, 0x100, 0x4, 0x4f0, 0x9, 0x3, 0x7, 0x8001, 0xb24, 0x80000000, 0xd, 0x7e80, 0x0, 0x7fffffff, 0x71a, 0x0, 0x89, 0x3d, 0x7, 0x1000, 0x3, 0x5, 0x2, 0x6, 0x7f, 0x400, 0x800, 0x2, 0x8, 0xa, 0x7eec, 0x2, 0xe0, 0x3, 0x0, 0xcc, 0x7, 0xe, 0xffffff80, 0xffffffff, 0x7, 0x40, 0xb7, 0x0, 0xb, 0x401, 0x80000000, 0x7d54, 0x800, 0x5, 0x2ec, 0x81e, 0x2ec8, 0x3, 0x8, 0xffff, 0x5, 0xfffffff7, 0x4, 0x3, 0x3, 0x7, 0x9, 0xfffffffe, 0x5, 0x10000, 0xffffffff, 0x9, 0x7, 0x2, 0x1, 0x7, 0x9, 0xb, 0x944, 0x7f, 0x7, 0x0, 0xf, 0x3, 0x40, 0x2, 0x2da2, 0x1, 0x1c, 0x7b, 0x3, 0x80000000, 0x1, 0x8, 0x9, 0x3, 0x6, 0xf4, 0xc, 0x2, 0xfffffff9, 0x80000001, 0x1, 0x4, 0x80000001, 0x9, 0x4, 0x0, 0x8, 0xffffff7f, 0x8d, 0x3, 0x0, 0xffffffff, 0x7, 0x9, 0xff, 0x11, 0x2, 0x4, 0x20000, 0x2, 0xffff, 0xd0d9, 0x5, 0x3ff, 0x2, 0x12, 0xfee, 0x6, 0x7, 0xffff389d, 0x4]}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x74, 0x15c5, 0x6, 0x9, 0x8, 0x6, 0x6, 0xd, 0x0, 0x18, 0x8, 0x1, 0x4, 0xeedc, 0x9, 0x9, 0x753, 0x0, 0x80, 0x6, 0x819, 0x4, 0x5, 0x7, 0x5, 0x5747, 0x5, 0x2, 0x1, 0x1, 0x1, 0x0, 0x4, 0xa, 0x3765, 0x6092d495, 0xa9, 0x0, 0xfffffff8, 0x1, 0x0, 0x6, 0x5, 0xa, 0x1b0, 0x8, 0x7ff, 0x5, 0x7, 0x91a5cbc, 0x60, 0x946b, 0xc7, 0x8000, 0xefbb, 0x3, 0x1ff, 0x626a, 0x7, 0x2, 0x479, 0x7fff, 0x0, 0x2, 0x7, 0x1000, 0x8, 0x1, 0x2, 0x6, 0x7, 0xb, 0x5, 0x6, 0x1, 0x1, 0x8, 0x200, 0x6, 0x91b6, 0x1, 0xd, 0x5, 0x8, 0x2, 0x0, 0x6, 0x3, 0x0, 0x8, 0xd4ab, 0x0, 0x3ff, 0x83a3, 0x3, 0x48, 0x9, 0x769, 0xf, 0xffffffff, 0xee33, 0x6, 0x5, 0xd, 0x5, 0x7fffffff, 0x7f0, 0x5, 0xfffffffa, 0xbf19, 0x0, 0x3, 0x1, 0xff, 0x7, 0x1ff, 0x20, 0x9, 0x3, 0x101, 0x7, 0x4, 0x8, 0x3c68, 0xf9, 0x2, 0x80000001, 0x7, 0x3, 0x101, 0x1, 0x1, 0x9, 0x89, 0x6, 0x800, 0x384c, 0xffff, 0x6, 0xf, 0x80000000, 0x7, 0x40000000, 0x0, 0x49, 0x3, 0x50, 0x14, 0x10001, 0x7, 0x9, 0x8, 0x1, 0x7, 0x4, 0x7, 0x0, 0x2dc0, 0x6, 0x5, 0xfdb, 0x2, 0x6, 0x7, 0x1, 0x0, 0xffff8000, 0x401, 0xc00, 0x2, 0xd7e8, 0x2, 0x6, 0x5, 0x0, 0xf, 0x793b, 0x0, 0x3b0, 0x5f, 0x5, 0x4806, 0x8, 0x80000001, 0x3, 0x3, 0x1, 0x3dfc, 0x5, 0x568, 0x0, 0x40, 0x9, 0x3, 0x1, 0x20, 0x16, 0x0, 0x8001, 0x1, 0x3f00000, 0x4d8c, 0x9, 0xfffffffb, 0x7, 0x4, 0x7fffffff, 0x491d81f8, 0x68, 0x7, 0x7, 0x6, 0x62f, 0x1, 0x1, 0x0, 0x5, 0x80000000, 0x4, 0x9, 0x8, 0x1, 0x7, 0x0, 0x6, 0x40, 0x5, 0x3, 0x3, 0x9, 0x4, 0x40, 0x1d, 0xffffff01, 0x540, 0x10, 0x8, 0xc, 0x2, 0xc, 0x80000001, 0x0, 0x100, 0x1, 0x7, 0x0, 0x1, 0x1, 0x600, 0x5, 0x40, 0x3, 0x200, 0x8, 0x6]}]}, @TCA_U32_HASH={0x8, 0x2, 0x7fffffff}]}}, @TCA_CHAIN={0x8, 0xb, 0x8}, @TCA_CHAIN={0x8, 0xb, 0x9}, @TCA_RATE={0x6, 0x5, {0x9a, 0x2}}]}, 0x8b8}}, 0x80) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x48, r9, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc3ca1f07ffecab3c}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}]]}, 0x48}, 0x1, 0x0, 0x0, 0x4811}, 0x80) 15.636759814s ago: executing program 32 (id=50): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./sys\x00', 0x1ff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), r0) sendmsg$NLBL_MGMT_C_REMOVEDEF(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x14, r1, 0x1, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x84) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x1c}}, 0x0) mount(0x0, &(0x7f00000002c0)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x2033008, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/kernel/reboot/type\x00', 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_PROBE_CLIENT(r3, &(0x7f00000010c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001080)={&(0x7f0000000740)={0x68, r4, 0x300, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x53}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x68}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) write(r2, &(0x7f0000000380)='triple\n\x00', 0x7) r5 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/kernel/reboot/force\x00', 0x2, 0x0) write(r5, &(0x7f0000000400)='1\n\x00', 0x2) r6 = socket$phonet(0x23, 0x2, 0x1) sendto$phonet(r6, 0x0, 0x0, 0x0, &(0x7f00000004c0)={0x23, 0x1}, 0x10) r7 = socket(0x10, 0x80002, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r7, 0x89f0, &(0x7f0000000700)={'gre0\x00', &(0x7f0000000640)={'sit0\x00', 0x0, 0x80, 0x1, 0xb, 0x0, {{0x1c, 0x4, 0x2, 0xb, 0x70, 0x68, 0x0, 0xff, 0x2f, 0x0, @multicast1, @loopback, {[@timestamp_addr={0x44, 0x34, 0xe, 0x1, 0x2, [{@empty, 0x1}, {@remote, 0x1}, {@multicast1, 0x8}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e0}, {@empty, 0x7608000}, {@multicast2, 0xd}]}, @rr={0x7, 0x7, 0xc0, [@dev={0xac, 0x14, 0x14, 0x41}]}, @generic={0x82, 0x6, "41d58026"}, @rr={0x7, 0x17, 0xe8, [@multicast2, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x38}, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000007c0)=@delchain={0x8b8, 0x65, 0x0, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {0x9, 0xfff1}, {0xb, 0xfff1}, {0x5, 0xc}}, [@TCA_CHAIN={0x8, 0xb, 0x8415}, @TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_CHAIN={0x8, 0xb, 0x3}, @filter_kind_options=@f_u32={{0x8}, {0x85c, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x7, 0xfd}}, @TCA_U32_DIVISOR={0x8, 0x4, 0xa7}, @TCA_U32_POLICE={0x838, 0x6, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x54}, @TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RESULT={0x8, 0x5, 0x200}, @TCA_POLICE_RATE64={0xc, 0x8, 0x156f}, @TCA_POLICE_RATE={0x404, 0x2, [0x5d, 0x0, 0xfffffffd, 0x1, 0x2, 0x81, 0x5, 0x3, 0x7, 0xffff, 0xfd1, 0x2, 0x8, 0xc, 0x8001, 0x8, 0x5, 0x6, 0x9, 0x0, 0x10, 0xfff, 0x3, 0x2, 0x400, 0x7, 0x5, 0x7, 0x2, 0xae0, 0x4, 0x6, 0x363, 0x400, 0x4, 0x5, 0x6, 0x4, 0x9, 0xe, 0x6, 0x1000, 0xffffff7f, 0x4, 0x3, 0x15, 0x800, 0x8, 0x9, 0xf9, 0x401, 0x2, 0x2, 0x2, 0x7, 0x71, 0x7, 0x401, 0x10, 0x7, 0xff, 0x400, 0xd, 0x1000, 0x8, 0x3, 0x5, 0x3ff, 0x2, 0x9, 0x8001, 0x4, 0x1ff, 0x7, 0xfff, 0x2, 0x9, 0xfffffffe, 0x8, 0xff, 0x9, 0x7, 0xffffff36, 0x7fff, 0x3, 0x1, 0x1, 0xfffffff8, 0x80000, 0x5b, 0x7fff, 0x7, 0x80, 0x94, 0x7, 0x5, 0x0, 0x2, 0x4, 0x8, 0x45b, 0x8, 0x5a, 0x7, 0x1, 0x6, 0x10000, 0x7, 0x80, 0x6, 0x9, 0x9, 0x1, 0x2, 0xfff, 0x2, 0x100, 0x6, 0x5, 0x3, 0x8b0b, 0x7fff, 0xfffffffa, 0x6, 0xfffffffd, 0x8000, 0x4, 0x5, 0x100, 0x4, 0x4f0, 0x9, 0x3, 0x7, 0x8001, 0xb24, 0x80000000, 0xd, 0x7e80, 0x0, 0x7fffffff, 0x71a, 0x0, 0x89, 0x3d, 0x7, 0x1000, 0x3, 0x5, 0x2, 0x6, 0x7f, 0x400, 0x800, 0x2, 0x8, 0xa, 0x7eec, 0x2, 0xe0, 0x3, 0x0, 0xcc, 0x7, 0xe, 0xffffff80, 0xffffffff, 0x7, 0x40, 0xb7, 0x0, 0xb, 0x401, 0x80000000, 0x7d54, 0x800, 0x5, 0x2ec, 0x81e, 0x2ec8, 0x3, 0x8, 0xffff, 0x5, 0xfffffff7, 0x4, 0x3, 0x3, 0x7, 0x9, 0xfffffffe, 0x5, 0x10000, 0xffffffff, 0x9, 0x7, 0x2, 0x1, 0x7, 0x9, 0xb, 0x944, 0x7f, 0x7, 0x0, 0xf, 0x3, 0x40, 0x2, 0x2da2, 0x1, 0x1c, 0x7b, 0x3, 0x80000000, 0x1, 0x8, 0x9, 0x3, 0x6, 0xf4, 0xc, 0x2, 0xfffffff9, 0x80000001, 0x1, 0x4, 0x80000001, 0x9, 0x4, 0x0, 0x8, 0xffffff7f, 0x8d, 0x3, 0x0, 0xffffffff, 0x7, 0x9, 0xff, 0x11, 0x2, 0x4, 0x20000, 0x2, 0xffff, 0xd0d9, 0x5, 0x3ff, 0x2, 0x12, 0xfee, 0x6, 0x7, 0xffff389d, 0x4]}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x74, 0x15c5, 0x6, 0x9, 0x8, 0x6, 0x6, 0xd, 0x0, 0x18, 0x8, 0x1, 0x4, 0xeedc, 0x9, 0x9, 0x753, 0x0, 0x80, 0x6, 0x819, 0x4, 0x5, 0x7, 0x5, 0x5747, 0x5, 0x2, 0x1, 0x1, 0x1, 0x0, 0x4, 0xa, 0x3765, 0x6092d495, 0xa9, 0x0, 0xfffffff8, 0x1, 0x0, 0x6, 0x5, 0xa, 0x1b0, 0x8, 0x7ff, 0x5, 0x7, 0x91a5cbc, 0x60, 0x946b, 0xc7, 0x8000, 0xefbb, 0x3, 0x1ff, 0x626a, 0x7, 0x2, 0x479, 0x7fff, 0x0, 0x2, 0x7, 0x1000, 0x8, 0x1, 0x2, 0x6, 0x7, 0xb, 0x5, 0x6, 0x1, 0x1, 0x8, 0x200, 0x6, 0x91b6, 0x1, 0xd, 0x5, 0x8, 0x2, 0x0, 0x6, 0x3, 0x0, 0x8, 0xd4ab, 0x0, 0x3ff, 0x83a3, 0x3, 0x48, 0x9, 0x769, 0xf, 0xffffffff, 0xee33, 0x6, 0x5, 0xd, 0x5, 0x7fffffff, 0x7f0, 0x5, 0xfffffffa, 0xbf19, 0x0, 0x3, 0x1, 0xff, 0x7, 0x1ff, 0x20, 0x9, 0x3, 0x101, 0x7, 0x4, 0x8, 0x3c68, 0xf9, 0x2, 0x80000001, 0x7, 0x3, 0x101, 0x1, 0x1, 0x9, 0x89, 0x6, 0x800, 0x384c, 0xffff, 0x6, 0xf, 0x80000000, 0x7, 0x40000000, 0x0, 0x49, 0x3, 0x50, 0x14, 0x10001, 0x7, 0x9, 0x8, 0x1, 0x7, 0x4, 0x7, 0x0, 0x2dc0, 0x6, 0x5, 0xfdb, 0x2, 0x6, 0x7, 0x1, 0x0, 0xffff8000, 0x401, 0xc00, 0x2, 0xd7e8, 0x2, 0x6, 0x5, 0x0, 0xf, 0x793b, 0x0, 0x3b0, 0x5f, 0x5, 0x4806, 0x8, 0x80000001, 0x3, 0x3, 0x1, 0x3dfc, 0x5, 0x568, 0x0, 0x40, 0x9, 0x3, 0x1, 0x20, 0x16, 0x0, 0x8001, 0x1, 0x3f00000, 0x4d8c, 0x9, 0xfffffffb, 0x7, 0x4, 0x7fffffff, 0x491d81f8, 0x68, 0x7, 0x7, 0x6, 0x62f, 0x1, 0x1, 0x0, 0x5, 0x80000000, 0x4, 0x9, 0x8, 0x1, 0x7, 0x0, 0x6, 0x40, 0x5, 0x3, 0x3, 0x9, 0x4, 0x40, 0x1d, 0xffffff01, 0x540, 0x10, 0x8, 0xc, 0x2, 0xc, 0x80000001, 0x0, 0x100, 0x1, 0x7, 0x0, 0x1, 0x1, 0x600, 0x5, 0x40, 0x3, 0x200, 0x8, 0x6]}]}, @TCA_U32_HASH={0x8, 0x2, 0x7fffffff}]}}, @TCA_CHAIN={0x8, 0xb, 0x8}, @TCA_CHAIN={0x8, 0xb, 0x9}, @TCA_RATE={0x6, 0x5, {0x9a, 0x2}}]}, 0x8b8}}, 0x80) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x48, r9, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc3ca1f07ffecab3c}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}]]}, 0x48}, 0x1, 0x0, 0x0, 0x4811}, 0x80) 3.425929633s ago: executing program 3 (id=350): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000001a00010027bd7000fedbdf251c101402ff00c8030016000008000100eaff01"], 0x24}, 0x1, 0x0, 0x0, 0x2000c894}, 0x4002) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c000000780001040200000000000000070000006400000014000180080001006400000008000200c8"], 0x2c}}, 0x0) mount(&(0x7f0000000440)=@nullb, &(0x7f0000000480)='./cgroup\x00', &(0x7f00000004c0)='romfs\x00', 0x200000, 0x0) 3.354738895s ago: executing program 3 (id=351): r0 = msgget$private(0x0, 0x100) msgctl$IPC_STAT(r0, 0x2, &(0x7f0000001740)=""/4071) msgctl$MSG_INFO(r0, 0xc, &(0x7f0000001600)=""/134) capset(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./dev\x00', &(0x7f00000002c0)='devtmpfs\x00', 0x2, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/meminfo\x00', 0x0, 0x0) read$rfkill(r1, &(0x7f0000000400), 0x8) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) syz_emit_vhci(&(0x7f0000000440)=ANY=[@ANYBLOB="042f6880"], 0x7) write(r2, &(0x7f0000000540)="616464726573735f67726f7570207e72703120302e302e302e302d3235352e3235a6defd881d22713e1cda457960352e3235352e3235350a616464726573735f67726f75702067727031203a3a2d666666663ae60500003a666666663a666666663a666666663a666666663a666666663a666666660a61", 0x77) move_mount(r1, &(0x7f00000004c0)='./dev/sda1\x00', r2, &(0x7f00000005c0)='./sec/tomoyo/exception_policy\x00', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./loop0\x00', 0x6180, 0x700) mount(&(0x7f0000000040)=@filename='./loop0\x00', &(0x7f0000000080)='./loop0\x00', &(0x7f00000000c0)='xfs\x00', 0x1, &(0x7f0000000100)='rtdev=./loop0\x00\xa3O;\x9bN\xf2\x86l\xbfF,\x7f\x8fJ<\xff\xa8\x01_\xf2\x81\xd4\xec\x83z\xc5\xdc\xc7\x81b\xfc Ae\x9c5\x9c\x03\xeb\xad\xd9&\x8fp\x9f\xea@T@\xff\x98\xf7\x86\xb8R\xd9\x84\f<\x9c5\x18\x1d\x85\xe5\xdd\xee\xb9\x1eN\a\xa5\x8b\xfe\xff\x89\xe6U\x99\xca]\xe9Fv\xdeo%\xf9\xcf\xdcL\xf8\x84\x1c\xc8w\x1cM\x9a\x82\xfc\x03i\xf3\xa0f\x95J\xc9\xc3\x8b<\'\x89\t\xde\x89BT\xadr\x1a\x19w9+i$\xc4&\x9f\x02\x94z\xf6\xd6\f\xf6\xbe2d\t=\xe6\xf3\xec\xfb\xc6\xfb\x1d\xb8\x18:\xe6\xfelX!\xe0\x8f{A\xe0\x1e\x1a\xbbz\xf9\x9dpU\x05\x19\x88\xa5\x8dc\xb7U\x9dM\xf8\x0f):\xa5\x83\rg}\xdf\xfa\xbf\xa2\x9b\xc0\xe0[\xa9\x8d\xbf\x1d\xdf\xe0\xe8\xca7\x1a-j\x8da\x01%\x86\xb4^>\b\x1d:\x1d9ot\xdf\'G\x19\xc7_\xa5') r3 = shmget$private(0x0, 0x4000, 0x4, &(0x7f0000ffc000/0x4000)=nil) shmat(r3, &(0x7f0000ff9000/0x1000)=nil, 0x5000) shmctl$SHM_UNLOCK(r3, 0xc) openat2$dir(0xffffffffffffff9c, &(0x7f00000016c0)='./dev/sda1\x00', &(0x7f0000001700)={0x8002, 0x0, 0xe}, 0x18) 2.823741965s ago: executing program 3 (id=354): ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, &(0x7f0000000140)={0xa20000, 0x6, 0x9, 0xffffffffffffffff, 0x0, &(0x7f0000000100)={0x9b0907, 0xafb, '\x00', @p_u32=&(0x7f00000000c0)=0x48000}}) 2.823175079s ago: executing program 3 (id=355): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000500), 0x400000000a882, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c00000046000900000000000000000003000000080002"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x24000044) syz_emit_ethernet(0x3e, &(0x7f0000000600)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x68, 0x4000, 0x0, 0x2f, 0x0, @private=0xa010101, @local}, @time_exceeded={0x80, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @loopback}}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./bus\x00', 0x180) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x81c0, 0x80000001) mount$overlay(0x0, &(0x7f0000000380)='./bus\x00', &(0x7f00000003c0), 0x8, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) linkat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file0/file0\x00', 0x400) chdir(&(0x7f00000004c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000540)='./file1\x00', 0x8042, 0x34) unlink(&(0x7f00000005c0)='./file0\x00') r2 = dup(r0) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0x4e00, 0x0) ioctl$CDROMPLAYTRKIND(r3, 0x5304, &(0x7f0000000080)={0x0, 0xfe, 0xb, 0x3}) openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x500, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/devices/virtual/net/bridge0/bridge/no_linklocal_learn\x00', 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f0000000280)={0x30, 0x5, 0x0, {0x0, 0x6, 0x100000001, 0x4}}, 0x30) r5 = syz_open_procfs(0x0, &(0x7f0000000580)='pagemap\x00') pread64(r5, &(0x7f000001b900)=""/102389, 0x18ff5, 0xa8) 2.605275633s ago: executing program 3 (id=356): mknodat$null(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2000, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x101100, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = fcntl$dupfd(r2, 0x0, r1) getpeername$packet(r3, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000340)={'syzkaller0\x00', 0x1001}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000640)='/dev/bsg/2:0:0:0\x00', 0x2000, 0x0) ioctl$BSG_SET_COMMAND_Q(r5, 0x2271, &(0x7f0000000680)=0x1) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) lremovexattr(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)=@known='system.posix_acl_access\x00') 2.505370169s ago: executing program 3 (id=357): r0 = socket(0x2b, 0x80801, 0x1) socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x2a) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x84) r2 = io_uring_setup(0xadc, &(0x7f0000000280)={0x0, 0xca72, 0x1cc90, 0x0, 0x20002fb}) socket$inet(0x2, 0x80001, 0x84) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a40, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000ffb000/0x4000)=nil, 0x4000) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000900)={0xaa, 0x40a}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000940)={{&(0x7f0000e1f000/0x1000)=nil, 0x1000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, &(0x7f0000000540)={{&(0x7f00004f2000/0x4000)=nil, 0x4000}, 0x14a8adee0998b997}) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f00000005c0)=[@text32={0x20, &(0x7f0000000980)="3e65f30fa6d0d9ee0f01ca66ba6100b076ee0f00500066baf80cb86c4cb985ef66bafc0cb800000000ef66baf80cb8ace06386ef66bafc0cedc4e1adf98dfd4f000066b8d7008ee8c4e27d17ce", 0x4d}], 0x1, 0x74, 0x0, 0x0) r6 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000340)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_control_io(r6, 0x0, &(0x7f00000006c0)={0x84, &(0x7f0000000780)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r7, 0xc0145b0d, &(0x7f00000007c0)) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x130, 0xfffffffffffffffe, 0x3, {0x1, 0x44, 0x0, '\x00', {0x20, 0xf602, 0x6, 0x1, 0x0, 0x0, 0x0, '\x00', 0xfffffffffffffffe, 0x0, 0x1ff, 0x0, {}, {0x200005, 0x100004}, {0xffffffffffeffffa, 0x40}, {0xfffc}, 0x64, 0x0, 0x81}}}}) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000300)=@assoc_value, &(0x7f0000000080)=0x8) fchmodat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0xfffffefb) io_uring_enter(r2, 0x2218, 0x7521, 0x16, 0x0, 0x0) r8 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000880)={0x80, 0x0, 0x33}, 0x18) fchmodat(r8, &(0x7f00000000c0)='./file0\x00', 0x0) getsockopt(r0, 0x3, 0x33, &(0x7f0000000a00)=""/133, &(0x7f0000000140)=0x85) ioctl$XFS_IOC_START_COMMIT(r7, 0x80585882, &(0x7f0000000800)) socket$nl_sock_diag(0x10, 0x3, 0x4) 2.444366504s ago: executing program 33 (id=357): r0 = socket(0x2b, 0x80801, 0x1) socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x2a) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x84) r2 = io_uring_setup(0xadc, &(0x7f0000000280)={0x0, 0xca72, 0x1cc90, 0x0, 0x20002fb}) socket$inet(0x2, 0x80001, 0x84) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a40, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000ffb000/0x4000)=nil, 0x4000) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000900)={0xaa, 0x40a}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000940)={{&(0x7f0000e1f000/0x1000)=nil, 0x1000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, &(0x7f0000000540)={{&(0x7f00004f2000/0x4000)=nil, 0x4000}, 0x14a8adee0998b997}) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f00000005c0)=[@text32={0x20, &(0x7f0000000980)="3e65f30fa6d0d9ee0f01ca66ba6100b076ee0f00500066baf80cb86c4cb985ef66bafc0cb800000000ef66baf80cb8ace06386ef66bafc0cedc4e1adf98dfd4f000066b8d7008ee8c4e27d17ce", 0x4d}], 0x1, 0x74, 0x0, 0x0) r6 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000340)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_control_io(r6, 0x0, &(0x7f00000006c0)={0x84, &(0x7f0000000780)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r7, 0xc0145b0d, &(0x7f00000007c0)) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x130, 0xfffffffffffffffe, 0x3, {0x1, 0x44, 0x0, '\x00', {0x20, 0xf602, 0x6, 0x1, 0x0, 0x0, 0x0, '\x00', 0xfffffffffffffffe, 0x0, 0x1ff, 0x0, {}, {0x200005, 0x100004}, {0xffffffffffeffffa, 0x40}, {0xfffc}, 0x64, 0x0, 0x81}}}}) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000300)=@assoc_value, &(0x7f0000000080)=0x8) fchmodat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0xfffffefb) io_uring_enter(r2, 0x2218, 0x7521, 0x16, 0x0, 0x0) r8 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000880)={0x80, 0x0, 0x33}, 0x18) fchmodat(r8, &(0x7f00000000c0)='./file0\x00', 0x0) getsockopt(r0, 0x3, 0x33, &(0x7f0000000a00)=""/133, &(0x7f0000000140)=0x85) ioctl$XFS_IOC_START_COMMIT(r7, 0x80585882, &(0x7f0000000800)) socket$nl_sock_diag(0x10, 0x3, 0x4) 1.779573832s ago: executing program 4 (id=359): pipe2$9p(&(0x7f0000000480)={0x0, 0x0}, 0x0) sendfile(r1, r0, 0x0, 0x7) socket$inet6_tcp(0xa, 0x1, 0x0) landlock_create_ruleset(&(0x7f00000001c0)={0x0, 0x3}, 0x10, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) r4 = socket$netlink(0x10, 0x3, 0x4) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x14}}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000240)={0x34, 0x0, 0x5, 0x0, 0x2, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x6, 0x59}}}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_CONFIRM_TIMEOUT={0x6, 0x2, 0xb7}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000810}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000940)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r3, &(0x7f0000000a80)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000980)={0x88, 0x0, 0x20, 0x70bd23, 0x8, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_CHANNELS={0xa, 0xbd, [0x202, 0x1, 0x8]}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x1}, @NL80211_ATTR_STA_SUPPORTED_CHANNELS={0xc, 0xbd, [0x8001, 0x4, 0x2, 0x26]}, @NL80211_ATTR_STA_FLAGS={0x20, 0x11, 0x0, 0x1, [@NL80211_STA_FLAG_AUTHORIZED={0x4}, @NL80211_STA_FLAG_AUTHORIZED={0x4}, @NL80211_STA_FLAG_AUTHENTICATED={0x4}, @NL80211_STA_FLAG_TDLS_PEER={0x4}, @NL80211_STA_FLAG_AUTHORIZED={0x4}, @NL80211_STA_FLAG_AUTHORIZED={0x4}, @NL80211_STA_FLAG_SHORT_PREAMBLE={0x4}]}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x21, 0x13, [{0x18}, {0x18}, {0x1, 0x1}, {0x48, 0x1}, {0x3, 0x1}, {0x48}, {0x6, 0x1}, {0x24, 0x1}, {0x30}, {0x24}, {0x2, 0x1}, {0x48, 0x1}, {0x48, 0x1}, {0x5}, {0x4, 0x1}, {0x3, 0x1}, {0x4}, {0x36}, {}, {0x4}, {0xc}, {0x16}, {0x60, 0x1}, {0x48, 0x1}, {0x1b, 0x1}, {0x70, 0x1}, {0xb}, {0x2, 0x1}, {0x6c}]}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0xfff9}]}, 0x88}, 0x1, 0x0, 0x0, 0x20000001}, 0x40) openat$hpet(0xffffffffffffff9c, 0x0, 0x80080, 0x0) r7 = syz_open_dev$radio(&(0x7f00000005c0), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r7, 0xc0205647, &(0x7f0000000600)={0x980000, 0x1, 0xfffffffe, 0xffffffffffffffff, 0x0, &(0x7f0000000640)={0x98f909, 0x300, '\x00', @value64=0x400006}}) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x1c, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, 0x0) setsockopt$inet_sctp6_SCTP_RTOINFO(r8, 0x84, 0x0, &(0x7f00000002c0)={0x0, 0x7fff, 0x6, 0xfffffff7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000300)={0x0, 0x3, 0x10, 0xe, 0xe}, &(0x7f0000000380)=0x18) getsockname$packet(r3, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./sys\x00', 0x152) mount(0x0, &(0x7f00000006c0)='./sys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r11 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./sys/bus/usb/devices/usb1/bConfigurationValue\x00', 0x2, 0x15d) write(r11, &(0x7f0000000780)='1', 0x1) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r10, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r3], 0x3c}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000800)=@newnexthop={0x54, 0x68, 0x200, 0x70bd25, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x39}, [@NHA_OIF={0x8, 0x5, r10}, @NHA_ENCAP={0xc, 0x8, 0x0, 0x1, @SEG6_LOCAL_NH4={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x1b}}}, @NHA_GATEWAY={0x14, 0x6, @in6_addr=@mcast2}, @NHA_GATEWAY={0x14, 0x6, @in6_addr=@mcast2}]}, 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c000000100003040004000000000094fe9ca000", @ANYRES8, @ANYBLOB="a428040000000000140035006d6163766c616e30000000000000000008000a00", @ANYRES32=r10], 0x3c}}, 0x400880f4) 1.779193258s ago: executing program 2 (id=360): socket$inet_sctp(0x2, 0x5, 0x84) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000001040)=[@in6={0xa, 0x4e24, 0x80000001, @private0, 0x5}]}, &(0x7f0000001280)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={r1, @in6={{0xa, 0x3, 0x4, @mcast1, 0x1000000}}}, &(0x7f0000000040)=0x84) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000600)={0x7}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000440)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=@newqdisc={0xc8, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x4}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xf4240}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0x3, 0x8, 0x8, 0x0, 0x4, 0x6}}, {0x4}}]}]}, 0xc8}}, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000180)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000240)={[0x100000000005, 0x4, 0xe9b, 0x22, 0x20000008, 0x7, 0x1000, 0x7, 0x8, 0x10009c2, 0xd, 0x0, 0xc, 0xb, 0x8000, 0xffffffffffffffff], 0x100000, 0xc2302}) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4400ae8f, &(0x7f0000000300)=@x86={0x40, 0x1, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x0, 0x0, 0x5, 0xfffffff8, 0x0, 0xff, 0xff}) setns(0xc9, 0x0) r7 = socket(0x1f, 0x3, 0x1) bind(r7, &(0x7f0000000640)=@hci={0x1f, 0xffff, 0x3}, 0x6) write(r7, &(0x7f00000006c0)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) syz_emit_vhci(&(0x7f0000000700)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0xc}, @hci_rp_read_local_features={{0x1}, {0x0, "ffffffffffffffff"}}}}, 0xf) syz_emit_vhci(&(0x7f0000000740)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0xc}, @hci_rp_le_read_local_features={{0x1}, {0x0, "ffffffffffffffff"}}}}, 0xf) nanosleep(&(0x7f0000000780)={0x0, 0x5f5e100}, 0x0) setns(0xc9, 0x0) nanosleep(&(0x7f00000007c0)={0x0, 0x2faf080}, 0x0) r8 = socket(0x1f, 0x5, 0x8) bind(r8, &(0x7f0000000800)=@generic={0x1f, "0000000000000100"}, 0xa) 1.20056213s ago: executing program 4 (id=362): openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x28240, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00'}) syz_open_dev$dvb_dvr(&(0x7f0000000080), 0x80, 0x40e00) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000100), 0x1080, 0x0) ioctl$SW_SYNC_IOC_INC(r1, 0x40045701, &(0x7f0000000140)=0x5) r2 = io_uring_setup(0x8, &(0x7f00000001c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000004c0)='./proc\x00', &(0x7f0000000500)='proc\x00', 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000540), 0x0, 0x206100) r3 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r3, &(0x7f00000005c0)='270', 0x3) mount$tmpfs(0x0, &(0x7f0000000600)='./cgroup\x00', &(0x7f0000000640), 0x0, 0x0) syz_open_dev$mtd(&(0x7f0000000680), 0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) openat$binderfs_log(0xffffffffffffff9c, &(0x7f00000006c0)='./binderfs/binder_logs/state\x00', 0x0, 0x0) r4 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000700), r4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000740), 0x2080, 0x0) close(r5) getsockname$packet(r4, &(0x7f0000000780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000007c0)=0x14) r6 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)={0x0, 0x14}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)=ANY=[@ANYBLOB="6c00000010001fff109e00008000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f0000440012800b00010067656e657665000034000280050003000300", @ANYRES32], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x0) io_uring_register$IORING_REGISTER_NAPI(r2, 0x1b, &(0x7f0000000240)={0x3e8, 0x1, 0x0, '\x00', 0x1}, 0x1) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x129c81, 0x0) ioctl$TCSETS(r8, 0x40045431, &(0x7f00000003c0)={0xfffffffc, 0x5, 0x400007e, 0xfffffffc, 0x5, "42301f9b101df4b7ccdb293a6c025e0900"}) syz_open_pts(r8, 0x0) 1.095414395s ago: executing program 4 (id=363): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./dev\x00', 0x1ff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)={0x34, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x34}}, 0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001500), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000001640)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001600)={&(0x7f0000001540)={0x9c, r3, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_LINKMODES_DUPLEX={0x5, 0x6, 0x8}, @ETHTOOL_A_LINKMODES_LANES={0x8, 0x9, 0x8}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x7}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0xfa}, @ETHTOOL_A_LINKMODES_OURS={0x68, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0x31, 0x5, "c531cbe27302c8becebb72c2d8a9eef5fb746d142119b5a0bc0051e98b459d4a8cfcc44fb94d3d2580d4021b2f"}, @ETHTOOL_A_BITSET_MASK={0x2f, 0x5, "baa18e3e0d1782d06a0124d9a048492b887fead191b41a8b5b9c51c8e3a459a4fd4fe80339197d2c11e557"}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x2c048000}, 0x4048810) mount(0x0, &(0x7f0000000280)='./dev\x00', &(0x7f00000002c0)='devtmpfs\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff) mount(&(0x7f0000000340)=@filename='./dev/sda1\x00', &(0x7f0000000380)='./mnt\x00', &(0x7f00000003c0)='ext4\x00', 0x8410, 0x0) r4 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)='syz', r4) keyctl$read(0xb, r4, &(0x7f00000004c0)=""/4096, 0x1000) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x0, 0x21) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r5, 0x800c6613, &(0x7f0000000480)=@v1={0x0, @aes128, 0x3, @desc4}) 915.203673ms ago: executing program 4 (id=364): ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, &(0x7f0000000140)={0xa20000, 0x6, 0x9, 0xffffffffffffffff, 0x0, &(0x7f0000000100)={0x9b0907, 0xafb, '\x00', @p_u32=&(0x7f00000000c0)=0x48000}}) 864.609898ms ago: executing program 4 (id=365): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0x5001}) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000000c0)=0xc) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x1, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x20e6, 0x0, @empty}, 0x1c) r2 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xfff80000, 0x1, 0x30, r2, 0x0) socket$inet6(0xa, 0x2, 0x0) write$tun(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="010530000a00280006000000600000000030114020010000000000000000000000000001ff02000000000000000000000000000120e620e6"], 0x64) 743.339759ms ago: executing program 4 (id=366): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYRES16=r0, @ANYRES16, @ANYRES64=r0, @ANYRESOCT=r0], 0x7) r1 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b0001000000000904", @ANYRES16=r0], 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0xc8080, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x1f, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000005080000000000008200000018010000", @ANYRES32, @ANYBLOB="0000000000000000b7080000048000007b8af8ff00000000bfa200000000000007020000f8ffffffb703c8136cc8000008000000b70400000200000085000000a6000000850000005000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35}, 0x94) syz_open_dev$sndctrl(&(0x7f0000000200), 0x3, 0x103000) syz_usb_disconnect(r1) setns(0xc9, 0x0) r2 = socket(0x8, 0x5, 0x5) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x6e24, @empty}, 0x10) ioctl$VFAT_IOCTL_READDIR_BOTH(r2, 0x400261f2, &(0x7f0000000340)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000005c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x29}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000600)={0x24, 0x0, 0x0, 0x0, &(0x7f0000000700)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000740)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$hiddev(&(0x7f0000000780), 0x0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r4 = fsopen(&(0x7f0000000580)='ceph\x00', 0x0) r5 = fsopen(&(0x7f0000000640)='ceph\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000680)='source', &(0x7f00000006c0)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000280)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x8000000000000000}, 0x0, 0x0) r6 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000800)='/dev/comedi0\x00', 0x0, 0x0) ioctl$COMEDI_INSN(r6, 0x8028640c, &(0x7f0000000980)={0x4000000, 0x5c, 0x0, 0x2, 0x2}) 743.065415ms ago: executing program 0 (id=367): bind$bt_hci(0xffffffffffffffff, &(0x7f0000000540)={0x1f, 0xffff, 0x3}, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./security\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000002c0)='coda\x00', 0xa2400, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ifreq(r0, 0x8991, &(0x7f0000000300)={'bond0\x00', @ifru_names='bond_slave_0\x00'}) ioctl$sock_ifreq(r0, 0x8991, &(0x7f0000000340)={'bond0\x00', @ifru_names='bond_slave_1\x00'}) ioctl$sock_ifreq(r0, 0x8914, 0x0) ioctl$DRM_IOCTL_MODE_GETPROPBLOB(0xffffffffffffffff, 0xc01064ac, &(0x7f0000000380)={0x0, 0x0, 0x0}) sendmsg$nl_route(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@ipv6_delrule={0x8c, 0x21, 0x100, 0x70bd28, 0x25dfdbfc, {0xa, 0x14, 0x0, 0xf, 0xfb, 0x0, 0x0, 0x1, 0x2}, [@FIB_RULE_POLICY=@FRA_SUPPRESS_IFGROUP={0x8, 0xd, 0x9}, @FRA_SRC={0x14, 0x2, @local}, @FIB_RULE_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e23, 0x4e24}}, @FRA_DST={0x14, 0x1, @mcast1}, @FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x10}, @FRA_DST={0x14, 0x1, @private2}, @FRA_DST={0x14, 0x1, @empty}, @FIB_RULE_POLICY=@FRA_SUPPRESS_PREFIXLEN={0x8, 0xe, 0xf}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x4044090) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, &(0x7f0000000580)={0x0, [[0xc07c, 0xffffffff, 0xffffffff, 0x1, 0x1, 0xfffffffc, 0x3f60f1d7, 0xffffffff], [0xffffffff, 0x2, 0xfffffffd, 0xa, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0x83, 0xffffffff, 0xffffffff, 0xffffffff, 0x3, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x103, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0xffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000800)={0x2020}, 0x2020) nanosleep(0x0, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000200)={{0xffffffffffffffff, &(0x7f0000000040)='\x00', 0x400000, &(0x7f0000000080)={@align=0x8000000, {0xf, 0x4, 0x1, 0x6}}, 0x40, &(0x7f00000000c0), &(0x7f0000000100)=0x56}, {[0x6, 0x2c4c, 0x9, 0x2]}, 0x1ff, 0x99, &(0x7f0000000140)=""/153}) write(r2, &(0x7f0000000000)="01020304050679", 0x7) 395.241421ms ago: executing program 0 (id=368): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x80002, 0x0) syz_emit_ethernet(0xe, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000002dd61bc4a0600462f00fe8000000000000000000000000000bbfe8000000000000000000000000000aa0c2088be0000000101008100db05000086dd88a888be000000008ad3868c758ba3cd00007b40080022eb0000000223022309020000000000000300ebb41b0800655800000003"], 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000000)="0f20e06635400000000f22e00f237e3e660f124bfab853058ec80f01ca0f20d86635080000000f22d80f01cad838ddeff20f58f3", 0xfffffffffffffe3c}], 0x1, 0x2, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x5) ioctl$KVM_RUN(r5, 0xae80, 0x0) 264.227801ms ago: executing program 2 (id=369): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r0, 0xc0106441, &(0x7f0000000180)={0x0, 0x0, 0x8}) (fail_nth: 5) 174.689017ms ago: executing program 2 (id=370): mknodat$null(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2000, 0x103) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x101100, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = fcntl$dupfd(r2, 0x0, r1) getpeername$packet(r3, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000340)={'syzkaller0\x00', 0x1001}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000640)='/dev/bsg/2:0:0:0\x00', 0x2000, 0x0) ioctl$BSG_SET_COMMAND_Q(r5, 0x2271, &(0x7f0000000680)=0x1) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) lremovexattr(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)=@known='system.posix_acl_access\x00') 174.592914ms ago: executing program 5 (id=358): r0 = syz_open_dev$dri(&(0x7f00000012c0), 0x1f, 0x0) ioctl$DRM_IOCTL_PANTHOR_BO_MMAP_OFFSET(r0, 0xc0106446, 0x0) 172.643632ms ago: executing program 0 (id=371): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_UNLINK(0xffffffffffffffff, 0x40044160, 0x3) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r0, &(0x7f0000000100)='270', 0x3) mount$tmpfs(0x0, &(0x7f0000000400)='./cgroup\x00', &(0x7f0000000500), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='mpol=']) syz_open_dev$mtd(&(0x7f0000000140), 0x0, 0x2) r1 = socket(0x2, 0x5, 0x0) setsockopt$sock_linger(r1, 0x1, 0x3c, &(0x7f0000000300)={0x1, 0x5}, 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./sys\x00', &(0x7f00000004c0)='sysfs\x00', 0x0, 0x0) r2 = socket(0x2c, 0x6, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000780)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000007c0)={'gretap0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000d40)=@delqdisc={0x3c, 0x25, 0x300, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0xffff, 0xfff2}, {0x4, 0xc}, {0xfff3, 0x5}}, [@TCA_RATE={0x6, 0x5, {0x2, 0xc}}, @TCA_RATE={0x6, 0x5, {0xe, 0x2}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/nd/devices/dax0.0/namespace\x00', 0x1, 0x0) write(r5, &(0x7f0000000740)='namespace', 0x9) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xe2c65) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) r7 = openat$binderfs_log(0xffffffffffffff9c, &(0x7f0000000580)='./binderfs/binder_logs/state\x00', 0x0, 0x0) ioctl$FS_IOC_GETFLAGS(r6, 0x80086601, &(0x7f0000000340)) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYRES16=r0, @ANYBLOB, @ANYRESOCT=r2], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x15, 0x2000000000000216, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa10000000000000701"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x5, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1809000000ffffff00000000000000008510000002000000850000000f00000095"], 0x0, 0xfffffdfe, 0x0, 0x0, 0x727c45cd4283345, 0x41, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x20, 0x4, &(0x7f0000000bc0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x6, 0x14, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000b10e49b4ff00004f28d20a000000000000bb8f72e425a82690"], &(0x7f0000000d00)='GPL\x00', 0x6, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r9, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$SIOCX25SCUDMATCHLEN(r7, 0x89e7, &(0x7f00000005c0)={0x68}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=ANY=[@ANYBLOB="20000000040000002ebd3d638b8c1c2013462c39cafe39a690cdebaa85418770"], 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) 93.938467ms ago: executing program 5 (id=372): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff}) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f00000005c0)=0x80000000, 0x4) syz_open_dev$vim2m(&(0x7f0000000000), 0x7937, 0x2) 93.704857ms ago: executing program 0 (id=373): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0x5001}) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000000c0)=0xc) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x1, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x20e6, 0x0, @empty}, 0x1c) r2 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xfff80000, 0x1, 0x30, r2, 0x0) write$tun(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="010530000a00280006000000600000000030114020010000000000000000000000000001ff02000000000000000000000000000120e620e6"], 0x64) 93.341519ms ago: executing program 5 (id=374): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2000003, 0x31, 0xffffffffffffffff, 0xfffff000) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = gettid() r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x19}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0xffffffffffffffb1}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x12}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x7, 0x7, 0x1, 0x0, "1ab869"}]}], {0x2e, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x80}, 0x1, 0x0, 0x0, 0x4008091}, 0x6) syz_open_dev$audion(&(0x7f0000000080), 0x1, 0x180) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) syz_open_procfs(r2, 0x0) ioctl$EVIOCGBITKEY(r1, 0x80404521, &(0x7f0000000040)=""/36) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000280)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) epoll_create1(0x80000) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x4004804) ioctl$IOCTL_VMCI_GET_CONTEXT_ID(r1, 0x7b3, &(0x7f0000000580)) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f0000000140)={0x8, 0x80000000, 0x0, 'queue0\x00', 0x331}) r6 = syz_open_procfs(0x0, &(0x7f00000005c0)='net/igmp\x00') preadv(r6, &(0x7f0000000600)=[{&(0x7f0000000640)=""/150, 0x96}, {&(0x7f0000000700)=""/206, 0xce}], 0x2, 0x0, 0x0) write$sndseq(r5, &(0x7f0000000240)=[{0x1e, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x1001a) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000002c0)={{0x1, 0x0, 0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r4, 0x40505412, &(0x7f0000000300)={0x6, 0x20000006, 0x0, 0x0, 0xd}) ioctl$SNDRV_TIMER_IOCTL_START(r4, 0x54a0) close_range(r4, 0xffffffffffffffff, 0x400000000000000) mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil) 93.066792ms ago: executing program 2 (id=375): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ftruncate(r0, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x1b7c, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) r1 = syz_clone(0x8100000, &(0x7f0000000100)="e8885a692aefcdfc0c535644bc5221a21bd8f21c31eacb52bf00d3d24ad7a5597ccbac33aef499fef9c2683305eb3480c41fd884a24ff40a8fbaa8e383e8196cb3ae8276440a13ced8450a56297d03de1285945384baccca32291eca10beffb92f31e892cca1be1c4be1872a68aadfff9e5724699ec35742d81872af576581a6a61b284a5525ce078b70b30f1328f0669ed28b1fe22b603635f9d352a9ac00388b1e77283f84f0e2c1f948bed0c48c878ea98b49d8c27959d8cc7122b3ae7af29bbaac4d709e27bfe2cb2db8a6ee6ed26af14014c8ef180815ddad7653897c9e9dfea2aea681613ae46de64aaf3b3ed7", 0xf0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)="c9b7b0671918f2da007ef92d04dee5fe813ea06800ba371e4167ea04c51cb8eea4afd22baf96f8f273a230faab8c74fda28885264f41460e20751955d6ddbf5c29c053fa2a4a5f805a462bf76039519aeebcc904f9ef994381c3759a975866c16ae33331b284048d4e47e0eb7fa6b3b2d422c561b2c0304721db05fb71608997023a15cc7db29728a712a5e201691d6002739de579f9f75578123fabc886b4ebc9f99b774ad82100549d15cfbba17d80d6e1c55df104a658a055f33f3b9341086f4845164eb1501094da9bbfccfdbe941e005382fe07") fcntl$lock(r0, 0x7, &(0x7f0000000380)={0x1, 0x1, 0x15163634, 0xb4a, r1}) 5.290558ms ago: executing program 2 (id=376): syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) openat$kvm(0x0, &(0x7f0000000640), 0x0, 0x0) r0 = syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = syz_kvm_add_vcpu$x86(r0, &(0x7f0000000800)={0x0, &(0x7f0000000000)=[@wr_crn={0x67, 0x20, {0x8, 0x1f36}}, @nested_create_vm={0x12d, 0x18}, @in_dx={0x69, 0x20, {0x370d, 0x7}}], 0x58}) ioctl$KVM_RUN(r1, 0xae80, 0x0) 5.007975ms ago: executing program 0 (id=377): r0 = syz_open_dev$video4linux(0x0, 0x5, 0x200) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000140)={0xa20000, 0x6, 0x9, 0xffffffffffffffff, 0x0, &(0x7f0000000100)={0x9b0907, 0xafb, '\x00', @p_u32=&(0x7f00000000c0)=0x48000}}) 3.077235ms ago: executing program 2 (id=378): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x28100, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000b00), 0x200000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000165000/0x18000)=nil, &(0x7f0000000680)=[@text16={0x10, &(0x7f00000006c0)="0f01cb0f2226baf80c66b895cd308666ef8340730cec0f8500000f01c366b9750100000f326767660f382570a5360fc76a8726f30f6fc3660f38807d00", 0x3d}], 0x1, 0x40, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, 0x0, 0x0) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000700)=0x1, 0x4) setsockopt$SO_TIMESTAMP(r3, 0x1, 0x3f, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000940)='/sys/kernel/vmcoreinfo', 0x305200, 0x0) readv(r5, &(0x7f0000000980)=[{&(0x7f00000009c0)=""/237, 0xed}], 0x1) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x3d) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000003, 0x13, r6, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000007c0)='./sys\x00', &(0x7f0000000800)='sysfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/module/kvm/parameters/nx_huge_pages\x00', 0x2, 0x0) write(r7, &(0x7f0000000880)='1', 0x1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000ac0)={0x3b3, 0x4, 0xd}) r8 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./sys/module/kvm/parameters/nx_huge_pages_recovery_period_ms\x00', 0x2082, 0x0) write(r8, &(0x7f0000000900)='6', 0x1) tkill(0xffffffffffffffff, 0x1f) r9 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0) ioctl$BTRFS_IOC_ENCODED_READ(r9, 0x80809440, &(0x7f00000004c0)={&(0x7f0000000440)=[{&(0x7f0000000000)="d11b48560f20df76101891e59dfbdfddcce298097ea8f8c602a9e80aa2f9100ebd7d12ec3cce7224b9f94fded45c8c631fb178f3d94b08db8d101f0dd68dfd36c0e1fd23b0e2bf2f983ecbb7d0aef2c668fed897a511e44c8d317777f0f45143fc7c17765b03bb193864b81771a59a70953b1ae19e8cd43c1acb9ff472395d8f8c2c5bca8db1c95395730b311bcb8f4922be95a82e7dd293ec1e6532847cf29737c331", 0xa3}, {&(0x7f0000000100)="f67d4f06b1cd2e7aa29bd40a8571d81eb44b9792f5327cd6ecb1a7953c416a3b52eb6c06de4e1be521380799f69e88932e1e346b98ad946ed422b1a9fa35e71ef8d3e4af6c4852d67347c350f674d9182aa652adf668405315b4b9f2abf288aadfca7cfa5b22b5e5ec4ce3973011dab1964f8ef52e8381db65065368b808e599ebd803", 0x83}, {&(0x7f0000000540)="fe6db1b327b79a063af000fe118c9ff158051267f54d55717a8d3e5293fc40eb861aa3f98822195bc8ac79ed480c2eba1f3f1d794342434a2ccf86069b4458218afe60a6c7fc9c9767e767e5714b73ebd7c0a92ab26014e23ddef363e74452fc54e3e907ff75d76f9e8a225a38e54f45364a3d762a987d3300b6e6e3fbf1a960444be6f63c2155069d0ec7c503db63a10c44e154d911f8b17f345d74a71b04705314e4315cdefd992d99e64e67cd7eaffe1679cdf4cb0dcdac7fa81c4cba674544c7929919ea7051c82ffff7d87448bbfa4aaad1d8bd346803551ea0120cf36b5cb5df197675d7c177f4f7eacef7d73bada5da91de24e27485547a59392a9e9e6ecd6224ad1061f6f9de07faf65fe5c76a3d9078fa869792c4b5a2d5829a7c031b54a9", 0x123}, {&(0x7f00000002c0)="e47b6187f15ee898c9023f8661b173bd5501ddedd9a56a5eb8647988970a61c77feab83ff2677d76cddcad4385aedfe72d2c45aec57b2b24b3870f39e5f895d3267b76e4a5663f571d051d79fca394377325", 0x52}, {&(0x7f0000000340)="99ede5b554a3bd2127d56f0fae828635cddb1a29b13d3fc604a59cd39da65f72137558282154196a217b26f47019bfde44dbc85df1eeafb0eb0799d7e10ff0def5c44a040bdbacfa77aae9b320e07d038bee1dd90861710781e554c99c126dd7e052bf7da2a8dbf4a651a0f36d91418a89a3b3a5101eee16bd7414d079287ba8238905d9f2cbb5fe1cea5cdc4bc2f2249688af834ffa1bca88477b729303cb0ebb20e0b7c346a8004ff671211e8bac1dbecbef1371bdd14f33d7304f082b434720f6276381d3ee79281a7195eca6eed126329cd530546dd9da06dedef546bcfb0ca0e22ee54e52def5441a010fcbd2830296f6c3a7f948967485c22e", 0xfc}, {0x0}], 0x6, 0x1, 0x0, 0xffff, 0x9, 0x8001, 0x8, 0x1}) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ifreq(r10, 0x8927, &(0x7f00000001c0)={'veth0_to_batadv\x00', @ifru_flags=0x100}) write(r9, &(0x7f0000000200)='252:0 1', 0x7) 0s ago: executing program 0 (id=379): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r1 = dup(r0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f0000000080)={{0x1, 0x1, 0x18, r3, {0x9}}, './file0\x00'}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r1, &(0x7f0000000340)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) eventfd2(0xffffffff, 0x1) syz_io_uring_setup(0xf08, &(0x7f00000000c0)={0x0, 0xfffffffe, 0x800, 0xffffffff, 0x800000c4}, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r6, r7, r8, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x54}}) syz_ublk_setup_io_uring(0x5422, &(0x7f0000000280)={0x0, 0xbb07, 0x1, 0x3, 0x317, 0x0, r1}, &(0x7f0000000300), &(0x7f0000002380)=0x0, &(0x7f00000023c0)) r10 = mmap$IORING_OFF_SQES(0x0, 0x5, 0x4, 0x1010, r1, 0x10000000) r11 = syz_io_uring_setup(0xf00, &(0x7f0000002400)={0x0, 0x15961, 0x10000, 0x0, 0x1004e}, &(0x7f0000002480), &(0x7f00000024c0), &(0x7f0000002500)) r12 = io_uring_register$IORING_REGISTER_PERSONALITY(r11, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r11, 0xa, 0x0, r12) ioctl$UBLK_U_CMD_SET_PARAMS(r4, 0xc0207508, &(0x7f00000025c0)={0x0, 0xffff, 0x70, &(0x7f0000002540)={0x70, 0x4, {0xc, 0x9, 0xa, 0x1, 0x7, 0x2, 0x2c07, 0x2, 0xe4a}, {0x10000, 0x5, 0x64bf, 0xb, 0x11d}, {0x200, 0x8, 0x1, 0x92}, {0x2e3, 0x0, 0x4}}}) syz_io_uring_submit$UBLK(r6, r9, r10, &(0x7f0000002640)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, r1, 0xc0207506, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, r12, '\x00', {r13, 0xffff, 0x0, 0x0, r5}}) kernel console output (not intermixed with test programs): 017][ T43] audit: type=1400 audit(1792415455.082:359): avc: denied { write } for pid=6082 comm="syz.2.70" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 57.692749][ T43] audit: type=1400 audit(1792415455.082:360): avc: denied { read write } for pid=6082 comm="syz.2.70" name="vhost-vsock" dev="devtmpfs" ino=1298 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 57.692920][ T43] audit: type=1400 audit(1792415455.082:361): avc: denied { open } for pid=6082 comm="syz.2.70" path="/dev/vhost-vsock" dev="devtmpfs" ino=1298 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 57.693319][ T43] audit: type=1400 audit(1792415455.082:362): avc: denied { ioctl } for pid=6082 comm="syz.2.70" path="/dev/vhost-vsock" dev="devtmpfs" ino=1298 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 57.699006][ T5817] libceph: connect (1)[c::]:6789 error -101 [ 57.699101][ T5817] libceph: mon0 (1)[c::]:6789 connect error [ 57.700980][ T43] audit: type=1400 audit(1792415455.092:363): avc: denied { create } for pid=6082 comm="syz.2.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 57.701686][ T43] audit: type=1400 audit(1792415455.092:364): avc: denied { connect } for pid=6082 comm="syz.2.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 57.702748][ T43] audit: type=1400 audit(1792415455.092:365): avc: denied { setopt } for pid=6082 comm="syz.2.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 57.705094][ T43] audit: type=1400 audit(1792415455.092:366): avc: denied { map_create } for pid=6082 comm="syz.2.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 57.705916][ T6083] netlink: 8 bytes leftover after parsing attributes in process `syz.2.70'. [ 57.705927][ T6083] netlink: 8 bytes leftover after parsing attributes in process `syz.2.70'. [ 57.793734][ T6075] ceph: No mds server is up or the cluster is laggy [ 58.149748][ T50] rxe_eth0 speed is unknown, defaulting to 1000 [ 59.016737][ T6131] netlink: 12 bytes leftover after parsing attributes in process `syz.0.85'. [ 59.024720][ T6131] netlink: 536 bytes leftover after parsing attributes in process `syz.0.85'. [ 59.024742][ T6131] netlink: 32 bytes leftover after parsing attributes in process `syz.0.85'. [ 59.210193][ T6142] overlayfs: workdir and upperdir must reside under the same mount [ 59.220040][ T6142] openvswitch: netlink: IP tunnel attribute has 5413 unknown bytes. [ 59.338250][ T6148] netlink: 64 bytes leftover after parsing attributes in process `syz.0.92'. [ 59.338266][ T6148] netlink: 64 bytes leftover after parsing attributes in process `syz.0.92'. [ 59.393826][ T6155] netlink: 'syz.0.92': attribute type 1 has an invalid length. [ 59.405711][ T6155] 8021q: adding VLAN 0 to HW filter on device bond1 [ 59.408084][ T6148] netlink: 56 bytes leftover after parsing attributes in process `syz.0.92'. [ 59.408860][ T6148] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6148 comm=syz.0.92 [ 59.410923][ T6148] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 59.420961][ T6158] openvswitch: netlink: IP tunnel attribute has 5413 unknown bytes. [ 59.460535][ T6162] syz.2.96 uses obsolete (PF_INET,SOCK_PACKET) [ 59.462256][ T6162] netlink: 36 bytes leftover after parsing attributes in process `syz.2.96'. [ 59.525557][ T6167] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.637440][ T5727] Bluetooth: hci0: command 0x0c1a tx timeout [ 59.637464][ T5727] Bluetooth: hci2: command 0x0c1a tx timeout [ 59.637477][ T5727] Bluetooth: hci1: command 0x0c1a tx timeout [ 59.715548][ T6179] netlink: 28 bytes leftover after parsing attributes in process `syz.0.99'. [ 59.717197][ T5735] Bluetooth: hci3: command 0x0c1a tx timeout [ 59.723931][ T6179] syz_tun: entered promiscuous mode [ 59.725927][ T6179] syz_tun: left promiscuous mode [ 59.993888][ T6198] ip_tables: iptables: counters copy to user failed while replacing table [ 60.046998][ T6199] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 60.117063][ T1685] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 60.294303][ T1685] usb 8-1: Using ep0 maxpacket: 8 [ 60.295094][ T1685] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 60.296060][ T1685] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 60.296084][ T1685] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 60.296105][ T1685] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 60.296123][ T1685] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 60.296155][ T1685] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 60.383860][ T6203] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 60.383874][ T6203] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 60.383881][ T6203] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 60.383887][ T6203] One or more global auth toks could not properly register; rc = [-22] [ 60.383907][ T6203] Error validating options; rc = [-22] [ 60.490506][ T6207] jffs2: notice: (6207) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 60.509905][ T1685] usb 8-1: GET_CAPABILITIES returned 0 [ 60.509943][ T1685] usbtmc 8-1:16.0: can't read capabilities [ 60.714056][ T5817] usb 8-1: USB disconnect, device number 6 [ 60.817428][ T6198] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 60.817538][ T6198] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 60.817620][ T6198] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 60.817705][ T6198] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 60.904718][ T6219] FAULT_INJECTION: forcing a failure. [ 60.904718][ T6219] name failslab, interval 1, probability 0, space 0, times 0 [ 60.904740][ T6219] CPU: 2 UID: 0 PID: 6219 Comm: syz.0.117 Not tainted syzkaller #0 PREEMPT(full) [ 60.904753][ T6219] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 60.904760][ T6219] Call Trace: [ 60.904764][ T6219] [ 60.904769][ T6219] dump_stack_lvl+0x100/0x190 [ 60.904830][ T6219] should_fail_ex.cold+0x5/0xa [ 60.904853][ T6219] should_failslab+0xc2/0x120 [ 60.904877][ T6219] __kmalloc_noprof+0xfc/0x840 [ 60.904892][ T6219] ? tomoyo_encode2+0xfb/0x3c0 [ 60.904919][ T6219] tomoyo_encode2+0xfb/0x3c0 [ 60.904939][ T6219] tomoyo_encode+0x29/0x50 [ 60.904956][ T6219] tomoyo_realpath_from_path+0x18c/0x690 [ 60.904971][ T6219] tomoyo_path_number_perm+0x23c/0x580 [ 60.904986][ T6219] ? tomoyo_path_number_perm+0x22e/0x580 [ 60.905002][ T6219] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 60.905024][ T6219] ? __lock_acquire+0x5c0/0x1f40 [ 60.905051][ T6219] ? __fget_files+0x34/0x3d0 [ 60.905068][ T6219] ? find_held_lock+0x2b/0x80 [ 60.905085][ T6219] ? hook_file_ioctl_common+0x140/0x440 [ 60.905100][ T6219] ? __fget_files+0x21f/0x3d0 [ 60.905119][ T6219] security_file_ioctl+0xd3/0x230 [ 60.905137][ T6219] __x64_sys_ioctl+0xb7/0x210 [ 60.905152][ T6219] do_syscall_64+0x123/0x790 [ 60.905194][ T6219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.905206][ T6219] RIP: 0033:0x7ff0e959e559 [ 60.905238][ T6219] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 60.905248][ T6219] RSP: 002b:00007ff0e77f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 60.905267][ T6219] RAX: ffffffffffffffda RBX: 00007ff0e9825fa0 RCX: 00007ff0e959e559 [ 60.905274][ T6219] RDX: 0000200000002980 RSI: 0000000080685600 RDI: 0000000000000003 [ 60.905281][ T6219] RBP: 00007ff0e77f6090 R08: 0000000000000000 R09: 0000000000000000 [ 60.905288][ T6219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 60.905295][ T6219] R13: 00007ff0e9826038 R14: 00007ff0e9825fa0 R15: 00007ffd10ae1008 [ 60.905310][ T6219] [ 60.905344][ T6219] ERROR: Out of memory at tomoyo_realpath_from_path. [ 60.972638][ T6221] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(2969567236.2982385304.1789703653), cmd(18) [ 61.322248][ T6230] kvm [6229]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 61.323031][ T6230] kvm [6229]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 61.346488][ T24] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 61.497020][ T24] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 61.498335][ T24] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 61.498351][ T24] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 61.499079][ T24] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 61.499093][ T24] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 61.500562][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.500574][ T24] usb 5-1: Product: syz [ 61.500581][ T24] usb 5-1: Manufacturer: syz [ 61.500588][ T24] usb 5-1: SerialNumber: syz [ 61.505540][ T24] ti_usb_3410_5052 5-1:2.0: TI USB 5052 2 port adapter converter detected [ 61.509706][ T24] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 61.513116][ T24] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 61.605702][ T6238] netlink: 'syz.3.125': attribute type 5 has an invalid length. [ 61.705727][ T6228] ti_usb_3410_5052_2 ttyUSB0: ti_open - submit interrupt urb failed, -90 [ 61.708005][ T5817] usb 5-1: USB disconnect, device number 3 [ 61.725362][ T5817] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 61.731251][ T5817] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 61.731657][ T5817] ti_usb_3410_5052 5-1:2.0: device disconnected [ 61.796889][ T6247] FAULT_INJECTION: forcing a failure. [ 61.796889][ T6247] name failslab, interval 1, probability 0, space 0, times 0 [ 61.796909][ T6247] CPU: 0 UID: 0 PID: 6247 Comm: syz.2.130 Not tainted syzkaller #0 PREEMPT(full) [ 61.796921][ T6247] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 61.796927][ T6247] Call Trace: [ 61.796931][ T6247] [ 61.796936][ T6247] dump_stack_lvl+0x100/0x190 [ 61.796956][ T6247] should_fail_ex.cold+0x5/0xa [ 61.796972][ T6247] should_failslab+0xc2/0x120 [ 61.796989][ T6247] __kmalloc_noprof+0xfc/0x840 [ 61.797004][ T6247] ? tomoyo_encode2+0xfb/0x3c0 [ 61.797024][ T6247] tomoyo_encode2+0xfb/0x3c0 [ 61.797043][ T6247] tomoyo_encode+0x29/0x50 [ 61.797059][ T6247] tomoyo_realpath_from_path+0x18c/0x690 [ 61.797072][ T6247] tomoyo_path_number_perm+0x23c/0x580 [ 61.797087][ T6247] ? tomoyo_path_number_perm+0x22e/0x580 [ 61.797103][ T6247] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 61.797123][ T6247] ? __lock_acquire+0x5c0/0x1f40 [ 61.797144][ T6247] ? __fget_files+0x34/0x3d0 [ 61.797160][ T6247] ? find_held_lock+0x2b/0x80 [ 61.797175][ T6247] ? hook_file_ioctl_common+0x140/0x440 [ 61.797190][ T6247] ? __fget_files+0x21f/0x3d0 [ 61.797208][ T6247] security_file_ioctl+0xd3/0x230 [ 61.797243][ T6247] __x64_sys_ioctl+0xb7/0x210 [ 61.797258][ T6247] do_syscall_64+0x123/0x790 [ 61.797276][ T6247] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.797288][ T6247] RIP: 0033:0x7fa4be79e559 [ 61.797297][ T6247] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 61.797307][ T6247] RSP: 002b:00007fa4bf64c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 61.797318][ T6247] RAX: ffffffffffffffda RBX: 00007fa4bea25fa0 RCX: 00007fa4be79e559 [ 61.797330][ T6247] RDX: 00002000000001c0 RSI: 00000000c0585609 RDI: 0000000000000003 [ 61.797336][ T6247] RBP: 00007fa4bf64c090 R08: 0000000000000000 R09: 0000000000000000 [ 61.797343][ T6247] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 61.797349][ T6247] R13: 00007fa4bea26038 R14: 00007fa4bea25fa0 R15: 00007ffe424f1988 [ 61.797364][ T6247] [ 61.797397][ T6247] ERROR: Out of memory at tomoyo_realpath_from_path. [ 61.984872][ T6255] mmap: syz.3.129 (6255) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 62.126479][ T5735] Bluetooth: hci0: command 0x0c1a tx timeout [ 62.216315][ T1685] usb 7-1: new full-speed USB device number 5 using dummy_hcd [ 62.388409][ T1685] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 62.389205][ T1685] usb 7-1: config 0 interface 0 altsetting 255 endpoint 0x3 has invalid wMaxPacketSize 0 [ 62.389219][ T1685] usb 7-1: config 0 interface 0 has no altsetting 0 [ 62.390899][ T1685] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 62.390910][ T1685] usb 7-1: Product: syz [ 62.390918][ T1685] usb 7-1: Manufacturer: syz [ 62.390925][ T1685] usb 7-1: SerialNumber: syz [ 62.392594][ T1685] usb 7-1: config 0 descriptor?? [ 62.398841][ T1685] usb 7-1: selecting invalid altsetting 0 [ 62.526351][ T71] usb 5-1: new low-speed USB device number 4 using dummy_hcd [ 62.599657][ T24] usb 7-1: USB disconnect, device number 5 [ 62.678593][ T71] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 62.680402][ T71] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 62.680423][ T71] usb 5-1: config 0 has no interface number 0 [ 62.680453][ T71] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 62.680474][ T71] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 62.680506][ T71] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 62.683488][ T71] usb 5-1: config 0 descriptor?? [ 62.684188][ T6260] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 62.690062][ T71] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 62.786390][ T5817] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 62.838330][ T5735] Bluetooth: hci3: command 0x0c1a tx timeout [ 62.838358][ T5735] Bluetooth: hci2: command 0x0c1a tx timeout [ 62.838373][ T5735] Bluetooth: hci1: command 0x0c1a tx timeout [ 62.886898][ T6260] faux_driver vgem: [drm] Unknown color mode 6; guessing buffer size. [ 62.889637][ T71] usb 5-1: USB disconnect, device number 4 [ 62.936595][ T5817] usb 8-1: Using ep0 maxpacket: 8 [ 62.938321][ T5817] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 62.942405][ T5817] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 62.942430][ T5817] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 62.942450][ T5817] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 62.942468][ T5817] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 62.942499][ T5817] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 63.152310][ T5817] usb 8-1: GET_CAPABILITIES returned 0 [ 63.152349][ T5817] usbtmc 8-1:16.0: can't read capabilities [ 63.200980][ T6265] afs: Bad value for 'flock' [ 63.206358][ T71] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 63.355081][ T1685] usb 8-1: USB disconnect, device number 7 [ 63.477946][ T43] kauditd_printk_skb: 68 callbacks suppressed [ 63.477963][ T43] audit: type=1400 audit(1792415460.872:435): avc: denied { create } for pid=6269 comm="syz.0.137" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 63.495212][ T43] audit: type=1400 audit(1792415460.882:436): avc: denied { unlink } for pid=5725 comm="syz-executor" name="file0" dev="tmpfs" ino=283 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 63.547038][ T43] audit: type=1400 audit(1792415460.932:437): avc: denied { relabelfrom } for pid=6273 comm="syz.0.139" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 63.547165][ T43] audit: type=1400 audit(1792415460.952:438): avc: denied { relabelto } for pid=6273 comm="syz.0.139" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 63.876952][ T71] usb 5-1: device descriptor read/64, error -71 [ 63.880915][ T6280] tmpfs: Bad value for 'mpol' [ 63.886156][ T6280] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 63.886168][ T6280] audit: out of memory in audit_log_start [ 64.136371][ T71] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 64.287269][ T71] usb 5-1: Using ep0 maxpacket: 16 [ 64.288355][ T71] usb 5-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 64.289200][ T71] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 64.289215][ T71] usb 5-1: config 0 interface 0 has no altsetting 0 [ 64.290710][ T71] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 64.290722][ T71] usb 5-1: Product: syz [ 64.290728][ T71] usb 5-1: Manufacturer: syz [ 64.290735][ T71] usb 5-1: SerialNumber: syz [ 64.291975][ T71] usb 5-1: config 0 descriptor?? [ 64.297819][ T50] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 64.456926][ T50] usb 8-1: Using ep0 maxpacket: 8 [ 64.457383][ T50] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 64.458517][ T50] usb 8-1: config index 0 descriptor too short (expected 74, got 45) [ 64.458541][ T50] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 64.458553][ T50] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 64.458564][ T50] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 64.458576][ T50] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 64.458587][ T50] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 64.458605][ T50] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 64.499787][ C0] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 64.503756][ T71] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/input/input6 [ 64.518967][ T71] imon:send_packet: packet tx failed (-71) [ 64.537779][ T71] imon 5-1:0.0: panel buttons/knobs setup failed [ 64.586982][ T71] rc_core: IR keymap rc-imon-pad not found [ 64.586994][ T71] Registered IR keymap rc-empty [ 64.587042][ T71] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 64.587051][ T71] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 64.588332][ T71] imon:send_packet: packet tx failed (-71) [ 64.606373][ T71] imon 5-1:0.0: remote input dev register failed [ 64.606444][ T71] imon 5-1:0.0: imon_init_intf0: rc device setup failed [ 64.624018][ T71] imon 5-1:0.0: unable to initialize intf0, err 0 [ 64.624030][ T71] imon:imon_probe: failed to initialize context! [ 64.624036][ T71] imon 5-1:0.0: unable to register, err -19 [ 64.626063][ T71] usb 5-1: USB disconnect, device number 6 [ 64.673516][ T50] usb 8-1: GET_CAPABILITIES returned 0 [ 64.673552][ T50] usbtmc 8-1:16.0: can't read capabilities [ 64.757197][ T43] audit: type=1400 audit(1792415462.152:439): avc: denied { write } for pid=6295 comm="syz.2.145" name="sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 64.759440][ T43] audit: type=1400 audit(1792415462.152:440): avc: denied { connect } for pid=6295 comm="syz.2.145" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 64.811132][ T6297] netlink: 'syz.2.145': attribute type 21 has an invalid length. [ 64.811148][ T6297] IPv6: NLM_F_CREATE should be specified when creating new route [ 64.811332][ T6297] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 64.811338][ T6297] IPv6: NLM_F_CREATE should be set when creating new route [ 64.811357][ T6297] IPv6: NLM_F_CREATE should be set when creating new route [ 64.811367][ T6297] IPv6: NLM_F_CREATE should be set when creating new route [ 64.881137][ T6286] usbtmc 8-1:16.0: send_request_dev_dep_msg_in returned -71 [ 64.886692][ T50] usb 8-1: USB disconnect, device number 8 [ 64.946402][ T71] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 65.108595][ T71] usb 5-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 65.109398][ T71] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 65.109414][ T71] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 198, setting to 64 [ 65.109426][ T71] usb 5-1: config 0 interface 0 has no altsetting 0 [ 65.110906][ T71] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 65.110917][ T71] usb 5-1: Product: syz [ 65.110924][ T71] usb 5-1: Manufacturer: syz [ 65.110931][ T71] usb 5-1: SerialNumber: syz [ 65.112416][ T71] usb 5-1: config 0 descriptor?? [ 65.115455][ T6275] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 65.319455][ C0] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 65.321659][ T71] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/input/input8 [ 65.396388][ T71] rc_core: IR keymap rc-imon-pad not found [ 65.396400][ T71] Registered IR keymap rc-empty [ 65.396434][ T71] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 65.396442][ T71] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 65.463830][ T43] audit: type=1400 audit(1792415462.852:441): avc: denied { kexec_image_load } for pid=6300 comm="syz.3.146" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 65.479936][ T43] audit: type=1400 audit(1792415462.872:442): avc: denied { create } for pid=6300 comm="syz.3.146" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 65.531233][ T6274] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 65.531246][ T6274] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 65.535986][ T6274] erofs (device loop0): cannot find valid erofs superblock [ 65.538633][ T71] imon:send_packet: packet tx failed (-71) [ 65.556445][ T71] imon 5-1:0.0: remote input dev register failed [ 65.556522][ T71] imon 5-1:0.0: imon_init_intf0: rc device setup failed [ 65.565735][ T71] imon 5-1:0.0: unable to initialize intf0, err 0 [ 65.565748][ T71] imon:imon_probe: failed to initialize context! [ 65.565754][ T71] imon 5-1:0.0: unable to register, err -19 [ 65.567851][ T71] usb 5-1: USB disconnect, device number 7 [ 65.916380][ T1685] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 66.067173][ T1685] usb 7-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 66.070610][ T1685] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 66.070630][ T1685] usb 7-1: Product: syz [ 66.070642][ T1685] usb 7-1: Manufacturer: syz [ 66.070655][ T1685] usb 7-1: SerialNumber: syz [ 66.189106][ T6327] fuse: Unknown parameter 'Md' [ 66.282929][ T6316] FAULT_INJECTION: forcing a failure. [ 66.282929][ T6316] name failslab, interval 1, probability 0, space 0, times 0 [ 66.282950][ T6316] CPU: 2 UID: 0 PID: 6316 Comm: syz.2.149 Not tainted syzkaller #0 PREEMPT(full) [ 66.282962][ T6316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 66.282968][ T6316] Call Trace: [ 66.282972][ T6316] [ 66.282977][ T6316] dump_stack_lvl+0x100/0x190 [ 66.282999][ T6316] should_fail_ex.cold+0x5/0xa [ 66.283016][ T6316] should_failslab+0xc2/0x120 [ 66.283034][ T6316] __kmalloc_cache_noprof+0x91/0x6d0 [ 66.283048][ T6316] ? raw_ioctl+0x313/0x2b80 [ 66.283098][ T6316] raw_ioctl+0x313/0x2b80 [ 66.283116][ T6316] ? __pfx_raw_ioctl+0x10/0x10 [ 66.283131][ T6316] ? selinux_file_ioctl+0x13b/0x290 [ 66.283148][ T6316] ? selinux_file_ioctl+0xb6/0x290 [ 66.283164][ T6316] ? __pfx_raw_ioctl+0x10/0x10 [ 66.283180][ T6316] __x64_sys_ioctl+0x18e/0x210 [ 66.283194][ T6316] do_syscall_64+0x123/0x790 [ 66.283212][ T6316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.283223][ T6316] RIP: 0033:0x7fa4be79e559 [ 66.283232][ T6316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 66.283242][ T6316] RSP: 002b:00007fa4bf64c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 66.283253][ T6316] RAX: ffffffffffffffda RBX: 00007fa4bea25fa0 RCX: 00007fa4be79e559 [ 66.283259][ T6316] RDX: 000000000000001f RSI: 0000000083c0550b RDI: 0000000000000004 [ 66.283266][ T6316] RBP: 00007fa4bf64c090 R08: 0000000000000000 R09: 0000000000000000 [ 66.283272][ T6316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 66.283278][ T6316] R13: 00007fa4bea26038 R14: 00007fa4bea25fa0 R15: 00007ffe424f1988 [ 66.283292][ T6316] [ 66.285273][ T1685] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 66.285316][ T1685] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 66.285333][ T1685] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 66.306768][ T6332] capability: warning: `syz.3.154' uses deprecated v2 capabilities in a way that may be insecure [ 66.371064][ T1685] lan78xx 7-1:1.0: probe with driver lan78xx failed with error -71 [ 66.374830][ T1685] usb 7-1: USB disconnect, device number 6 [ 66.656328][ T50] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 66.817540][ T50] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 66.821021][ T50] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 66.821035][ T50] usb 8-1: Product: syz [ 66.821042][ T50] usb 8-1: Manufacturer: syz [ 66.821049][ T50] usb 8-1: SerialNumber: syz [ 66.849913][ T5840] usb 8-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 67.040816][ T6338] __nla_validate_parse: 2 callbacks suppressed [ 67.040830][ T6338] netlink: 4 bytes leftover after parsing attributes in process `syz.2.156'. [ 67.057244][ T6341] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 67.057795][ T6341] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 67.059837][ T6342] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 67.060039][ T6342] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 67.061497][ T6343] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 67.062187][ T6343] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 67.064541][ T6343] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 67.064718][ T6343] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 67.065229][ T6343] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 67.065420][ T6343] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 67.271804][ T50] usb 8-1: USB disconnect, device number 9 [ 67.813856][ T6369] rxe_eth0 speed is unknown, defaulting to 1000 [ 67.841192][ T6371] i2c i2c-0: delete_device: Can't find device in list [ 67.876574][ T5840] ath9k_htc 8-1:1.0: ath9k_htc: Target is unresponsive [ 67.876921][ T5840] ath9k_htc: Failed to initialize the device [ 67.881562][ T50] usb 8-1: ath9k_htc: USB layer deinitialized [ 68.010164][ T6377] lo: entered promiscuous mode [ 68.010186][ T6377] lo: entered allmulticast mode [ 68.012828][ T6377] tunl0: entered promiscuous mode [ 68.012848][ T6377] tunl0: entered allmulticast mode [ 68.014592][ T6377] gre0: entered promiscuous mode [ 68.014609][ T6377] gre0: entered allmulticast mode [ 68.022829][ T6377] gretap0: entered promiscuous mode [ 68.022848][ T6377] gretap0: entered allmulticast mode [ 68.027292][ T6377] erspan0: entered promiscuous mode [ 68.027310][ T6377] erspan0: entered allmulticast mode [ 68.030543][ T6377] ip_vti0: entered promiscuous mode [ 68.030562][ T6377] ip_vti0: entered allmulticast mode [ 68.032317][ T6377] ip6_vti0: entered promiscuous mode [ 68.032335][ T6377] ip6_vti0: entered allmulticast mode [ 68.034742][ T6377] sit0: entered promiscuous mode [ 68.034757][ T6377] sit0: entered allmulticast mode [ 68.038584][ T6377] ip6tnl0: entered promiscuous mode [ 68.038602][ T6377] ip6tnl0: entered allmulticast mode [ 68.040690][ T6377] ip6gre0: entered promiscuous mode [ 68.040706][ T6377] ip6gre0: entered allmulticast mode [ 68.045741][ T6377] syz_tun: entered promiscuous mode [ 68.045759][ T6377] syz_tun: entered allmulticast mode [ 68.052280][ T6377] ip6gretap0: entered promiscuous mode [ 68.052298][ T6377] ip6gretap0: entered allmulticast mode [ 68.054742][ T6377] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.055600][ T6377] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.059648][ T6377] bridge0: entered promiscuous mode [ 68.059666][ T6377] bridge0: entered allmulticast mode [ 68.062343][ T6377] vcan0: entered promiscuous mode [ 68.062359][ T6377] vcan0: entered allmulticast mode [ 68.065375][ T6377] bond0: entered promiscuous mode [ 68.065390][ T6377] bond_slave_0: entered promiscuous mode [ 68.065622][ T6377] bond_slave_1: entered promiscuous mode [ 68.065789][ T6377] bond0: entered allmulticast mode [ 68.065803][ T6377] bond_slave_0: entered allmulticast mode [ 68.065816][ T6377] bond_slave_1: entered allmulticast mode [ 68.071547][ T6377] team0: entered promiscuous mode [ 68.071562][ T6377] team_slave_0: entered promiscuous mode [ 68.071807][ T6377] team_slave_1: entered promiscuous mode [ 68.072037][ T6377] team0: entered allmulticast mode [ 68.072050][ T6377] team_slave_0: entered allmulticast mode [ 68.072064][ T6377] team_slave_1: entered allmulticast mode [ 68.074856][ T6377] dummy0: entered promiscuous mode [ 68.074873][ T6377] dummy0: entered allmulticast mode [ 68.082225][ T6377] nlmon0: entered promiscuous mode [ 68.082243][ T6377] nlmon0: entered allmulticast mode [ 68.083815][ T6377] batadv0: entered promiscuous mode [ 68.083934][ T6377] batadv0: entered allmulticast mode [ 68.089497][ T6377] vxcan0: entered promiscuous mode [ 68.089513][ T6377] vxcan0: entered allmulticast mode [ 68.090208][ T6377] vxcan1: entered promiscuous mode [ 68.090233][ T6377] vxcan1: entered allmulticast mode [ 68.091790][ T6377] veth0: entered promiscuous mode [ 68.091807][ T6377] veth0: entered allmulticast mode [ 68.094775][ T6377] veth1: entered promiscuous mode [ 68.094793][ T6377] veth1: entered allmulticast mode [ 68.104806][ T6377] wg0: entered promiscuous mode [ 68.104827][ T6377] wg0: entered allmulticast mode [ 68.109174][ T6377] wg1: entered promiscuous mode [ 68.109192][ T6377] wg1: entered allmulticast mode [ 68.111404][ T6377] wg2: entered promiscuous mode [ 68.111419][ T6377] wg2: entered allmulticast mode [ 68.113090][ T6377] veth0_to_bridge: entered promiscuous mode [ 68.113105][ T6377] veth0_to_bridge: entered allmulticast mode [ 68.119217][ T6377] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.125520][ T6377] veth1_to_bridge: entered promiscuous mode [ 68.125537][ T6377] veth1_to_bridge: entered allmulticast mode [ 68.131296][ T6377] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.135574][ T6377] veth0_to_bond: entered promiscuous mode [ 68.135591][ T6377] veth0_to_bond: entered allmulticast mode [ 68.145411][ T6377] bond0: (slave bond_slave_0): Releasing backup interface [ 68.154803][ T6377] veth1_to_bond: entered promiscuous mode [ 68.154824][ T6377] veth1_to_bond: entered allmulticast mode [ 68.167097][ T6377] bond0: (slave bond_slave_1): Releasing backup interface [ 68.172168][ T6377] veth0_to_team: entered promiscuous mode [ 68.172188][ T6377] veth0_to_team: entered allmulticast mode [ 68.178837][ T6377] team0: Port device team_slave_0 removed [ 68.179239][ T6377] veth1_to_team: entered promiscuous mode [ 68.179254][ T6377] veth1_to_team: entered allmulticast mode [ 68.186027][ T6377] team0: Port device team_slave_1 removed [ 68.186337][ T6377] veth0_to_batadv: entered promiscuous mode [ 68.186347][ T6377] veth0_to_batadv: entered allmulticast mode [ 68.187493][ T6377] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 68.187542][ T6377] batadv_slave_0: entered promiscuous mode [ 68.187551][ T6377] batadv_slave_0: entered allmulticast mode [ 68.188732][ T6377] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 68.191057][ T6377] veth1_to_batadv: entered promiscuous mode [ 68.191068][ T6377] veth1_to_batadv: entered allmulticast mode [ 68.192326][ T6377] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 68.192349][ T6377] batadv_slave_1: entered promiscuous mode [ 68.192428][ T6377] batadv_slave_1: entered allmulticast mode [ 68.193645][ T6377] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 68.194860][ T6377] xfrm0: entered promiscuous mode [ 68.194869][ T6377] xfrm0: entered allmulticast mode [ 68.195865][ T6377] veth0_to_hsr: entered promiscuous mode [ 68.195874][ T6377] veth0_to_hsr: entered allmulticast mode [ 68.197558][ T6377] hsr_slave_0: entered allmulticast mode [ 68.198361][ T6377] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 68.257311][ T6385] ufs: You didn't specify the type of your ufs filesystem [ 68.257311][ T6385] [ 68.257311][ T6385] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 68.257311][ T6385] [ 68.257311][ T6385] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 68.257330][ T6385] ufs: failed to set blocksize [ 68.335145][ T6387] ublk0: read batch cmd buffer failed [ 68.335242][ T6387] ublk0: read batch cmd buffer failed [ 68.347989][ T6387] ublk0: read batch cmd buffer failed [ 68.348085][ T6387] ublk0: read batch cmd buffer failed [ 68.584584][ T6389] netlink: 52 bytes leftover after parsing attributes in process `syz.0.170'. [ 68.584609][ T6389] netlink: 52 bytes leftover after parsing attributes in process `syz.0.170'. [ 68.584624][ T6389] netlink: 52 bytes leftover after parsing attributes in process `syz.0.170'. [ 68.599293][ T6392] netlink: 52 bytes leftover after parsing attributes in process `syz.0.170'. [ 68.599307][ T6392] netlink: 52 bytes leftover after parsing attributes in process `syz.0.170'. [ 68.599315][ T6392] netlink: 52 bytes leftover after parsing attributes in process `syz.0.170'. [ 68.644931][ T43] kauditd_printk_skb: 12 callbacks suppressed [ 68.644942][ T43] audit: type=1400 audit(1792415466.032:455): avc: denied { connect } for pid=6393 comm="syz.2.172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 68.645612][ T43] audit: type=1400 audit(1792415466.032:456): avc: denied { create } for pid=6393 comm="syz.2.172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 68.675967][ T43] audit: type=1400 audit(1792415466.062:457): avc: denied { mount } for pid=6396 comm="syz.0.171" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 68.695310][ T43] audit: type=1400 audit(1792415466.082:458): avc: denied { unmount } for pid=5725 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 68.711297][ T6400] ip_tables: iptables: counters copy to user failed while replacing table [ 68.712151][ T43] audit: type=1400 audit(1792415466.102:459): avc: denied { bind } for pid=6398 comm="syz.2.173" lport=6 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 68.712192][ T43] audit: type=1400 audit(1792415466.102:460): avc: denied { name_bind } for pid=6398 comm="syz.2.173" src=65530 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 68.712228][ T43] audit: type=1400 audit(1792415466.102:461): avc: denied { node_bind } for pid=6398 comm="syz.2.173" saddr=172.20.20.170 src=65530 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 69.339127][ T43] audit: type=1400 audit(1792415466.732:462): avc: denied { execute } for pid=6421 comm="syz-executor" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 69.342687][ T43] audit: type=1400 audit(1792415466.732:463): avc: denied { execute_no_trans } for pid=6421 comm="syz-executor" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 69.411501][ T5735] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 69.412541][ T5735] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 69.413228][ T5735] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 69.415195][ T5735] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 69.415931][ T5735] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 69.422845][ T43] audit: type=1400 audit(1792415466.812:464): avc: denied { mounton } for pid=6422 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 69.583896][ T6422] rxe_eth0 speed is unknown, defaulting to 1000 [ 69.613117][ T6433] FAULT_INJECTION: forcing a failure. [ 69.613117][ T6433] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 69.613139][ T6433] CPU: 1 UID: 0 PID: 6433 Comm: syz.0.181 Not tainted syzkaller #0 PREEMPT(full) [ 69.613151][ T6433] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 69.613158][ T6433] Call Trace: [ 69.613162][ T6433] [ 69.613167][ T6433] dump_stack_lvl+0x100/0x190 [ 69.613229][ T6433] should_fail_ex.cold+0x5/0xa [ 69.613254][ T6433] _copy_to_user+0x32/0xd0 [ 69.613280][ T6433] simple_read_from_buffer+0xcb/0x170 [ 69.613313][ T6433] proc_fail_nth_read+0x1af/0x230 [ 69.613331][ T6433] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 69.613349][ T6433] ? rw_verify_area+0xce/0x6d0 [ 69.613361][ T6433] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 69.613378][ T6433] vfs_read+0x1e4/0xb40 [ 69.613392][ T6433] ? lock_acquire+0x1d1/0x380 [ 69.613412][ T6433] ? __fget_files+0x34/0x3d0 [ 69.613428][ T6433] ? __pfx_vfs_read+0x10/0x10 [ 69.613440][ T6433] ? find_held_lock+0x2b/0x80 [ 69.613456][ T6433] ? __fget_files+0x215/0x3d0 [ 69.613474][ T6433] ? __fget_files+0x21f/0x3d0 [ 69.613494][ T6433] ksys_read+0x12a/0x250 [ 69.613507][ T6433] ? __pfx_ksys_read+0x10/0x10 [ 69.613525][ T6433] do_syscall_64+0x123/0x790 [ 69.613568][ T6433] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.613580][ T6433] RIP: 0033:0x7ff0e955ed8e [ 69.613589][ T6433] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 69.613600][ T6433] RSP: 002b:00007ff0e77f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 69.613617][ T6433] RAX: ffffffffffffffda RBX: 00007ff0e77f66c0 RCX: 00007ff0e955ed8e [ 69.613624][ T6433] RDX: 000000000000000f RSI: 00007ff0e77f60a0 RDI: 0000000000000004 [ 69.613630][ T6433] RBP: 00007ff0e77f6090 R08: 0000000000000000 R09: 0000000000000000 [ 69.613636][ T6433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 69.613642][ T6433] R13: 00007ff0e9826038 R14: 00007ff0e9825fa0 R15: 00007ffd10ae1008 [ 69.613657][ T6433] [ 69.753417][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 69.777730][ T6441] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 69.847402][ T6441] could not allocate digest TFM handle sha224-generic [ 69.851471][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 69.871202][ T6422] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.871313][ T6422] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.871373][ T6422] bridge_slave_0: entered allmulticast mode [ 69.872207][ T6422] bridge_slave_0: entered promiscuous mode [ 69.877040][ T6422] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.877080][ T6422] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.877136][ T6422] bridge_slave_1: entered allmulticast mode [ 69.877972][ T6422] bridge_slave_1: entered promiscuous mode [ 69.892259][ T6422] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.893754][ T6422] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.906955][ T6422] team0: Port device team_slave_0 added [ 69.908701][ T6422] team0: Port device team_slave_1 added [ 69.918981][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 69.942410][ T6422] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.942426][ T6422] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.942446][ T6422] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.944184][ T6422] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.944197][ T6422] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.944219][ T6422] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.992179][ T6422] hsr_slave_0: entered promiscuous mode [ 69.992941][ T6422] hsr_slave_1: entered promiscuous mode [ 69.993475][ T6422] debugfs: 'hsr0' already exists in 'hsr' [ 69.993493][ T6422] Cannot create hsr debugfs directory [ 70.014756][ T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.061302][ T6452] netlink: 8 bytes leftover after parsing attributes in process `syz.3.185'. [ 70.121642][ T6454] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -834, delta: 1 [ 70.121666][ T6454] ref_ctr increment failed for inode: 0x174 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff888038233d40 [ 70.122587][ T6453] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -834, delta: -1 [ 70.122606][ T6453] ref_ctr decrement failed for inode: 0x174 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff888038233d40 [ 70.122639][ T6453] uprobe: syz.2.186:6453 failed to unregister, leaking uprobe [ 70.195302][ T6458] veth0_macvtap: left promiscuous mode [ 70.196598][ T6458] macvtap0: entered allmulticast mode [ 70.218293][ T12] bridge_slave_1: left allmulticast mode [ 70.218319][ T12] bridge_slave_1: left promiscuous mode [ 70.218933][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.221048][ T12] bridge_slave_0: left allmulticast mode [ 70.221060][ T12] bridge_slave_0: left promiscuous mode [ 70.221147][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.310154][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 70.311767][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 70.312614][ T12] bond0 (unregistering): Released all slaves [ 70.340738][ T6422] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 70.342667][ T6422] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.343463][ T6422] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 70.344055][ T6466] CUSE: unknown device info "" [ 70.344063][ T6466] CUSE: unknown device info "" [ 70.344073][ T6466] CUSE: unknown device info "" [ 70.344077][ T6466] CUSE: unknown device info "" [ 70.344081][ T6466] CUSE: zero length info key specified [ 70.345936][ T6422] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.346678][ T6422] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 70.355576][ T6422] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.356045][ T6422] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 70.367354][ T6422] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.441984][ T6422] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.448347][ T6422] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.450848][ T113] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.450894][ T113] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.460703][ T113] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.460749][ T113] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.484053][ T5441] 8021q: adding VLAN 0 to HW filter on device eth2 [ 70.664410][ T5441] 8021q: adding VLAN 0 to HW filter on device eth3 [ 70.700057][ T6499] FAULT_INJECTION: forcing a failure. [ 70.700057][ T6499] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 70.700088][ T6499] CPU: 2 UID: 0 PID: 6499 Comm: syz.0.192 Not tainted syzkaller #0 PREEMPT(full) [ 70.700109][ T6499] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.700119][ T6499] Call Trace: [ 70.700125][ T6499] [ 70.700134][ T6499] dump_stack_lvl+0x100/0x190 [ 70.700168][ T6499] should_fail_ex.cold+0x5/0xa [ 70.700195][ T6499] _copy_to_user+0x32/0xd0 [ 70.700224][ T6499] simple_read_from_buffer+0xcb/0x170 [ 70.700253][ T6499] proc_fail_nth_read+0x1af/0x230 [ 70.700282][ T6499] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 70.700331][ T6499] ? rw_verify_area+0xce/0x6d0 [ 70.700351][ T6499] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 70.700378][ T6499] vfs_read+0x1e4/0xb40 [ 70.700401][ T6499] ? lock_acquire+0x1d1/0x380 [ 70.700422][ T6499] ? __fget_files+0x34/0x3d0 [ 70.700448][ T6499] ? __pfx_vfs_read+0x10/0x10 [ 70.700468][ T6499] ? find_held_lock+0x2b/0x80 [ 70.700496][ T6499] ? __fget_files+0x215/0x3d0 [ 70.700526][ T6499] ? __fget_files+0x21f/0x3d0 [ 70.700559][ T6499] ksys_read+0x12a/0x250 [ 70.700581][ T6499] ? __pfx_ksys_read+0x10/0x10 [ 70.700601][ T6499] ? v4l2_ioctl+0x1c5/0x250 [ 70.700655][ T6499] do_syscall_64+0x123/0x790 [ 70.700685][ T6499] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.700709][ T6499] RIP: 0033:0x7ff0e955ed8e [ 70.700724][ T6499] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 70.700742][ T6499] RSP: 002b:00007ff0e77f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 70.700760][ T6499] RAX: ffffffffffffffda RBX: 00007ff0e77f66c0 RCX: 00007ff0e955ed8e [ 70.700772][ T6499] RDX: 000000000000000f RSI: 00007ff0e77f60a0 RDI: 0000000000000004 [ 70.700782][ T6499] RBP: 00007ff0e77f6090 R08: 0000000000000000 R09: 0000000000000000 [ 70.700793][ T6499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 70.700804][ T6499] R13: 00007ff0e9826038 R14: 00007ff0e9825fa0 R15: 00007ffd10ae1008 [ 70.700830][ T6499] [ 70.820203][ T6422] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.855623][ T12] hsr_slave_0: left promiscuous mode [ 70.863994][ T12] hsr_slave_1: left promiscuous mode [ 70.866145][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 70.866459][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 70.870946][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 70.870958][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 70.889116][ T12] veth1_macvtap: left promiscuous mode [ 70.889150][ T12] veth0_macvtap: left promiscuous mode [ 70.889199][ T12] veth1_vlan: left promiscuous mode [ 70.889300][ T12] veth0_vlan: left promiscuous mode [ 70.934363][ T6513] netlink: 8 bytes leftover after parsing attributes in process `syz.0.194'. [ 71.015664][ T12] team0 (unregistering): Port device team_slave_1 removed [ 71.022890][ T12] team0 (unregistering): Port device team_slave_0 removed [ 71.128647][ T5441] 8021q: adding VLAN 0 to HW filter on device eth4 [ 71.162920][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.162982][ T1439] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.177560][ T6525] pimreg: entered allmulticast mode [ 71.192268][ T6525] SELinux: Context #! ./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 71.205228][ T1345] cfg80211: failed to load regulatory.db [ 71.294605][ T6519] futex_wake_op: syz.3.195 tries to shift op by -1; fix this program [ 71.317197][ T6422] veth0_vlan: entered promiscuous mode [ 71.321361][ T6422] veth1_vlan: entered promiscuous mode [ 71.343286][ T6422] veth0_macvtap: entered promiscuous mode [ 71.345516][ T6422] veth1_macvtap: entered promiscuous mode [ 71.354800][ T6422] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.360198][ T6422] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.363777][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.390881][ T5441] 8021q: adding VLAN 0 to HW filter on device eth5 [ 71.406423][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.406450][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.406469][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.439316][ T1161] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.439330][ T1161] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.446679][ T71] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 71.459283][ T75] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.459295][ T75] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.477471][ T5727] Bluetooth: hci4: command tx timeout [ 71.576676][ T71] usb 5-1: device descriptor read/64, error -71 [ 71.679577][ T5727] Bluetooth: hci4: Malformed Event: 0x2f [ 71.681152][ T6559] XFS (loop0): Cannot mount filesystem with identical rtdev and ddev/logdev. [ 71.816434][ T71] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 71.946351][ T71] usb 5-1: device descriptor read/64, error -71 [ 72.057189][ T71] usb usb5-port1: attempt power cycle [ 72.354843][ T6573] netlink: 16 bytes leftover after parsing attributes in process `syz.2.206'. [ 72.360592][ T6573] netlink: 16 bytes leftover after parsing attributes in process `syz.2.206'. [ 72.389469][ T6575] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 72.396479][ T71] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 72.416789][ T71] usb 5-1: device descriptor read/8, error -71 [ 72.458927][ T6578] kvm: user requested TSC rate below hardware speed [ 72.656463][ T71] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 72.678852][ T71] usb 5-1: device descriptor read/8, error -71 [ 72.786903][ T71] usb usb5-port1: unable to enumerate USB device [ 72.862844][ T6585] netlink: 'syz.3.209': attribute type 4 has an invalid length. [ 72.954084][ T6589] fuse: Unknown parameter 'ôÓƒk”š3m…¡ÂÔ³›ÈIåJu2•8©‹+ß"Ízú­ën 0x0000000000000003' [ 73.053610][ T6595] FAULT_INJECTION: forcing a failure. [ 73.053610][ T6595] name failslab, interval 1, probability 0, space 0, times 0 [ 73.053641][ T6595] CPU: 0 UID: 0 PID: 6595 Comm: syz.4.213 Not tainted syzkaller #0 PREEMPT(full) [ 73.053662][ T6595] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 73.053673][ T6595] Call Trace: [ 73.053679][ T6595] [ 73.053687][ T6595] dump_stack_lvl+0x100/0x190 [ 73.053767][ T6595] should_fail_ex.cold+0x5/0xa [ 73.053800][ T6595] should_failslab+0xc2/0x120 [ 73.053835][ T6595] kmem_cache_alloc_noprof+0x92/0x6a0 [ 73.053860][ T6595] ? skb_clone+0x190/0x400 [ 73.053901][ T6595] skb_clone+0x190/0x400 [ 73.053918][ T6595] netlink_deliver_tap+0xaed/0xcc0 [ 73.053951][ T6595] netlink_unicast+0x77b/0x950 [ 73.053973][ T6595] ? __pfx_netlink_unicast+0x10/0x10 [ 73.053997][ T6595] netlink_ack+0x655/0xb80 [ 73.054020][ T6595] netlink_rcv_skb+0x333/0x420 [ 73.054036][ T6595] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 73.054065][ T6595] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 73.054095][ T6595] ? ns_capable+0xd2/0xf0 [ 73.054128][ T6595] nfnetlink_rcv+0x1b3/0x440 [ 73.054148][ T6595] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 73.054170][ T6595] ? netlink_deliver_tap+0x1ae/0xcc0 [ 73.054223][ T6595] netlink_unicast+0x65f/0x950 [ 73.054246][ T6595] ? __pfx_netlink_unicast+0x10/0x10 [ 73.054268][ T6595] netlink_sendmsg+0x8b0/0xda0 [ 73.054290][ T6595] ? __pfx_netlink_sendmsg+0x10/0x10 [ 73.054310][ T6595] ? selinux_socket_sendmsg+0x198/0x2f0 [ 73.054351][ T6595] ____sys_sendmsg+0xa4d/0xbe0 [ 73.054370][ T6595] ? __pfx_netlink_sendmsg+0x10/0x10 [ 73.054389][ T6595] ? __pfx_____sys_sendmsg+0x10/0x10 [ 73.054418][ T6595] ? lock_acquire+0x1d1/0x380 [ 73.054438][ T6595] ? get_pid_task+0x2a/0x250 [ 73.054465][ T6595] ___sys_sendmsg+0x190/0x1e0 [ 73.054488][ T6595] ? __pfx____sys_sendmsg+0x10/0x10 [ 73.054512][ T6595] ? get_pid_task+0x106/0x250 [ 73.054547][ T6595] ? find_held_lock+0x2b/0x80 [ 73.054590][ T6595] __sys_sendmsg+0x160/0x210 [ 73.054608][ T6595] ? __pfx___sys_sendmsg+0x10/0x10 [ 73.054641][ T6595] do_syscall_64+0x123/0x790 [ 73.054704][ T6595] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.054722][ T6595] RIP: 0033:0x7fde5f79e559 [ 73.054738][ T6595] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 73.054756][ T6595] RSP: 002b:00007fde605ec028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 73.054783][ T6595] RAX: ffffffffffffffda RBX: 00007fde5fa25fa0 RCX: 00007fde5f79e559 [ 73.054796][ T6595] RDX: 0000000000000080 RSI: 00002000000004c0 RDI: 0000000000000007 [ 73.054806][ T6595] RBP: 00007fde605ec090 R08: 0000000000000000 R09: 0000000000000000 [ 73.054816][ T6595] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 73.054826][ T6595] R13: 00007fde5fa26038 R14: 00007fde5fa25fa0 R15: 00007fff7aba2e68 [ 73.054852][ T6595] [ 73.556459][ T5727] Bluetooth: hci4: command tx timeout [ 73.657982][ T6613] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 73.659422][ T5727] Bluetooth: latency 65520 > 499 [ 73.833810][ T6615] netlink: 'syz.3.220': attribute type 16 has an invalid length. [ 73.833824][ T6615] netlink: 'syz.3.220': attribute type 17 has an invalid length. [ 73.833869][ T6615] lo: left promiscuous mode [ 73.833878][ T6615] lo: left allmulticast mode [ 73.836190][ T6615] tunl0: left promiscuous mode [ 73.836201][ T6615] tunl0: left allmulticast mode [ 73.836945][ T6615] gre0: left promiscuous mode [ 73.836954][ T6615] gre0: left allmulticast mode [ 73.841962][ T6615] gretap0: left promiscuous mode [ 73.841973][ T6615] gretap0: left allmulticast mode [ 73.842882][ T6615] erspan0: left promiscuous mode [ 73.842895][ T6615] erspan0: left allmulticast mode [ 73.843676][ T6615] ip_vti0: left promiscuous mode [ 73.843685][ T6615] ip_vti0: left allmulticast mode [ 73.844487][ T6615] ip6_vti0: left promiscuous mode [ 73.844497][ T6615] ip6_vti0: left allmulticast mode [ 73.845174][ T6615] sit0: left promiscuous mode [ 73.845182][ T6615] sit0: left allmulticast mode [ 73.852633][ T6615] ip6tnl0: left promiscuous mode [ 73.852643][ T6615] ip6tnl0: left allmulticast mode [ 73.853333][ T6615] ip6gre0: left promiscuous mode [ 73.853341][ T6615] ip6gre0: left allmulticast mode [ 73.854288][ T6615] syz_tun: left promiscuous mode [ 73.854298][ T6615] syz_tun: left allmulticast mode [ 73.855253][ T6615] ip6gretap0: left promiscuous mode [ 73.855263][ T6615] ip6gretap0: left allmulticast mode [ 73.858412][ T6615] bridge0: left promiscuous mode [ 73.858433][ T6615] bridge0: left allmulticast mode [ 73.859072][ T6615] vcan0: left promiscuous mode [ 73.859081][ T6615] vcan0: left allmulticast mode [ 73.859700][ T6615] bond0: left promiscuous mode [ 73.859712][ T6615] bond0: left allmulticast mode [ 73.860021][ T6615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.860335][ T6615] team0: left promiscuous mode [ 73.860343][ T6615] team0: left allmulticast mode [ 73.860762][ T6615] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.861113][ T6615] dummy0: left promiscuous mode [ 73.861122][ T6615] dummy0: left allmulticast mode [ 73.862048][ T6615] nlmon0: left promiscuous mode [ 73.862057][ T6615] nlmon0: left allmulticast mode [ 73.862649][ T6615] batadv0: left promiscuous mode [ 73.862658][ T6615] batadv0: left allmulticast mode [ 73.863045][ T6615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.863952][ T6615] vxcan0: left promiscuous mode [ 73.863961][ T6615] vxcan0: left allmulticast mode [ 73.864430][ T6615] vxcan1: left promiscuous mode [ 73.864439][ T6615] vxcan1: left allmulticast mode [ 73.864962][ T6615] veth0: left promiscuous mode [ 73.864971][ T6615] veth0: left allmulticast mode [ 73.865566][ T6615] veth1: left promiscuous mode [ 73.865574][ T6615] veth1: left allmulticast mode [ 73.870438][ T6615] wg0: left promiscuous mode [ 73.870449][ T6615] wg0: left allmulticast mode [ 73.874404][ T6615] wg1: left promiscuous mode [ 73.874415][ T6615] wg1: left allmulticast mode [ 73.879818][ T6615] wg2: left promiscuous mode [ 73.879836][ T6615] wg2: left allmulticast mode [ 73.881074][ T6615] veth0_to_bridge: left promiscuous mode [ 73.881089][ T6615] veth0_to_bridge: left allmulticast mode [ 73.882124][ T6615] bridge_slave_0: left promiscuous mode [ 73.882139][ T6615] bridge_slave_0: left allmulticast mode [ 73.882638][ T6615] veth1_to_bridge: left promiscuous mode [ 73.882650][ T6615] veth1_to_bridge: left allmulticast mode [ 73.883245][ T6615] bridge_slave_1: left promiscuous mode [ 73.883255][ T6615] bridge_slave_1: left allmulticast mode [ 73.884027][ T6615] veth0_to_bond: left promiscuous mode [ 73.884041][ T6615] veth0_to_bond: left allmulticast mode [ 73.885112][ T6615] bond_slave_0: left promiscuous mode [ 73.885126][ T6615] bond_slave_0: left allmulticast mode [ 73.885930][ T6615] veth1_to_bond: left promiscuous mode [ 73.885944][ T6615] veth1_to_bond: left allmulticast mode [ 73.886776][ T6615] bond_slave_1: left promiscuous mode [ 73.886787][ T6615] bond_slave_1: left allmulticast mode [ 73.887050][ T6615] veth0_to_team: left promiscuous mode [ 73.887058][ T6615] veth0_to_team: left allmulticast mode [ 73.887922][ T6615] team_slave_0: left promiscuous mode [ 73.887935][ T6615] team_slave_0: left allmulticast mode [ 73.888511][ T6615] veth1_to_team: left promiscuous mode [ 73.888527][ T6615] veth1_to_team: left allmulticast mode [ 73.889075][ T6615] team_slave_1: left promiscuous mode [ 73.889084][ T6615] team_slave_1: left allmulticast mode [ 73.889369][ T6615] veth0_to_batadv: left promiscuous mode [ 73.889378][ T6615] veth0_to_batadv: left allmulticast mode [ 73.889976][ T6615] batadv_slave_0: left promiscuous mode [ 73.889985][ T6615] batadv_slave_0: left allmulticast mode [ 73.890462][ T6615] veth1_to_batadv: left promiscuous mode [ 73.890470][ T6615] veth1_to_batadv: left allmulticast mode [ 73.891013][ T6615] batadv_slave_1: left promiscuous mode [ 73.891022][ T6615] batadv_slave_1: left allmulticast mode [ 73.891534][ T6615] xfrm0: left promiscuous mode [ 73.891542][ T6615] xfrm0: left allmulticast mode [ 73.892401][ T6615] veth0_to_hsr: left promiscuous mode [ 73.892411][ T6615] veth0_to_hsr: left allmulticast mode [ 73.892941][ T6615] hsr_slave_0: left allmulticast mode [ 73.938607][ T6618] netlink: 'syz.3.220': attribute type 16 has an invalid length. [ 73.938629][ T6618] netlink: 'syz.3.220': attribute type 17 has an invalid length. [ 74.114489][ T6525] pimreg: left allmulticast mode [ 74.162610][ T43] kauditd_printk_skb: 52 callbacks suppressed [ 74.162630][ T43] audit: type=1400 audit(1792415471.552:517): avc: denied { setopt } for pid=6627 comm="syz.3.223" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 74.163767][ T6628] netlink: 'syz.3.223': attribute type 29 has an invalid length. [ 74.166955][ T6628] batman_adv: Routing algorithm '' is not supported [ 74.171573][ T43] audit: type=1400 audit(1792415471.562:518): avc: denied { rmdir } for pid=5725 comm="syz-executor" name="mnt" dev="tmpfs" ino=415 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon=2321202E2F6367726F75702F66696C65306161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616 [ 74.173343][ T43] audit: type=1400 audit(1792415471.562:519): avc: denied { accept } for pid=6627 comm="syz.3.223" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 74.218608][ T43] audit: type=1400 audit(1792415471.612:520): avc: denied { append } for pid=6629 comm="syz.0.224" name="sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 74.221350][ T6630] program syz.0.224 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 74.222037][ T6632] FAULT_INJECTION: forcing a failure. [ 74.222037][ T6632] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 74.222054][ T6632] CPU: 3 UID: 0 PID: 6632 Comm: syz.4.225 Not tainted syzkaller #0 PREEMPT(full) [ 74.222067][ T6632] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 74.222073][ T6632] Call Trace: [ 74.222077][ T6632] [ 74.222082][ T6632] dump_stack_lvl+0x100/0x190 [ 74.222102][ T6632] should_fail_ex.cold+0x5/0xa [ 74.222118][ T6632] _copy_from_user+0x2e/0xd0 [ 74.222148][ T6632] drm_ioctl+0x520/0xc60 [ 74.222170][ T6632] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 74.222186][ T6632] ? __pfx_drm_ioctl+0x10/0x10 [ 74.222196][ T6632] ? __fget_files+0x34/0x3d0 [ 74.222225][ T6632] ? selinux_file_ioctl+0x13b/0x290 [ 74.222247][ T6632] ? selinux_file_ioctl+0xb6/0x290 [ 74.222271][ T6632] ? __pfx_drm_ioctl+0x10/0x10 [ 74.222292][ T6632] __x64_sys_ioctl+0x18e/0x210 [ 74.222317][ T6632] do_syscall_64+0x123/0x790 [ 74.222349][ T6632] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.222367][ T6632] RIP: 0033:0x7fde5f79e559 [ 74.222379][ T6632] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.222390][ T6632] RSP: 002b:00007fde605ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 74.222401][ T6632] RAX: ffffffffffffffda RBX: 00007fde5fa25fa0 RCX: 00007fde5f79e559 [ 74.222408][ T6632] RDX: 0000200000000640 RSI: 00000000c01864cd RDI: 0000000000000003 [ 74.222415][ T6632] RBP: 00007fde605ec090 R08: 0000000000000000 R09: 0000000000000000 [ 74.222421][ T6632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 74.222427][ T6632] R13: 00007fde5fa26038 R14: 00007fde5fa25fa0 R15: 00007fff7aba2e68 [ 74.222442][ T6632] [ 74.239306][ T43] audit: type=1400 audit(1792415471.632:521): avc: denied { write } for pid=6633 comm="syz.3.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 74.258791][ T43] audit: type=1400 audit(1792415471.652:522): avc: denied { create } for pid=6636 comm="syz.4.228" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 74.262364][ T43] audit: type=1400 audit(1792415471.652:523): avc: denied { connect } for pid=6636 comm="syz.4.228" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 74.262693][ T43] audit: type=1400 audit(1792415471.652:524): avc: denied { create } for pid=6636 comm="syz.4.228" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 74.263409][ T43] audit: type=1400 audit(1792415471.652:525): avc: denied { read write } for pid=6636 comm="syz.4.228" dev="sockfs" ino=15606 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 74.263986][ T43] audit: type=1400 audit(1792415471.652:526): avc: denied { connect } for pid=6636 comm="syz.4.228" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 74.309113][ T6637] [U] [ 74.309178][ T6637] [U] sWÇä{0^d›…!ú§O³ˆÿ,7¹)ç䀣˜ò [ 74.309194][ T6637] [U] ôÿ“xçë–Ž¬÷Ua)¦û)9ôám´BIýƹT¼¯^È<äü“*æý‹ÌYù«Êÿÿÿÿ [ 74.309204][ T6637] [U] [ 74.309209][ T6637] [U] 82 81 0:30 / /dev/pts rw,relatime - devpts devpts rw,seclabel,gid=5,mode=620,ptmxmode=666 [ 74.309217][ T6637] [U] 83 81 0:31 / /dev/shm rw,relatime - tmpfs tmpfs rw,seclabel,huge=advise [ 74.309223][ T6637] [U] 84 80 0:52 / /proc rw,relatime - proc syz-proc rw [ 74.309229][ T6637] [U] 85 80 0:26 / /selinux rw,nosuid,noexec,relatime - selinuxfs selinuxfs rw [ 74.309236][ T6637] [U] 162 80 0:29 / /sys rw,relatime - sysfs sysfs rw,seclabel [ 74.309248][ T6637] [U] 163 162 0:26 / /sys/fs/selinux rw,nosuid,noexec,relatime - selinuxfs selinuxfs rw [ 74.309255][ T6637] [U] 164 162 0:11 / /sys/kernel/debug rw,relatime - debugfs debugfs rw,seclabel [ 74.309262][ T6637] [U] 165 162 0:10 / /sys/kernel/security rw,relatime - securityfs securityfs rw [ 74.309269][ T6637] [U] 166 162 0:22 / /sys/kernel/config rw,relatime - configfs configfs rw [ 74.309275][ T6637] [U] 167 162 0:35 / /sys/fs/fuse/connections rw,relatime - fusectl fusectl rw [ 74.309359][ T6637] [U] 168 162 0:36 / /sys/fs/pstore rw,relatime - pstore none rw,seclabel [ 74.309366][ T6637] [U] 169 162 0:37 / /sys/fs/bpf rw,relatime - bpf bpf rw [ 74.309372][ T6637] [U] 170 162 0:16 / /sys/kernel/tracing rw,relatime - tracefs tracefs rw,seclabel [ 74.309397][ T6637] [U] 171 164 0:11 / /sys/kernel/debug rw,relatime - debugfs debugfs rw,seclabel [ 74.309404][ T6637] [U] 174 84 0:34 / /proc/sys/fs/binfmt_misc rw,relatime - binfmt_misc binfmt_misc rw [ 74.309412][ T6637] [U] 178 80 0:38 / /syzcgroup/unified rw,relatime - cgroup2 none rw,seclabel [ 74.309419][ T6637] [U] 179 80 0:40 / /syzcgroup/cpu rw,relatime - cgroup none rw,seclabel,cpuacct,memory,hugetlb,clone_children [ 74.309427][ T6637] [U] 180 80 0:39 / /syzcgroup/net rw,relatime - cgroup none rw,seclabel,blkio,devices,freezer,net_prio [ 74.309434][ T6637] [U] 54 81 0:47 / /dev/gadgetfs rw,relatime - gadgetfs gadgetfs rw [ 74.309441][ T6637] [U] 55 81 0:54 / /dev/binderfs rw,relatime - binder binder rw,max=1048576,stats=global [ 74.309458][ T6637] [U] [ 74.309472][ T6637] [U] [ 74.310101][ T6637] [U] [ 74.310117][ T6637] [U] [ 74.310138][ T6637] [U] [ 74.310159][ T6637] [U] [ 74.310258][ T6637] [U] [ 74.310273][ T6637] [U] [ 74.310288][ T6637] [U] [ 74.310302][ T6637] [U] [ 74.329508][ T6651] netlink: 64138 bytes leftover after parsing attributes in process `syz.3.231'. [ 74.333106][ T6648] FAULT_INJECTION: forcing a failure. [ 74.333106][ T6648] name failslab, interval 1, probability 0, space 0, times 0 [ 74.333128][ T6648] CPU: 3 UID: 0 PID: 6648 Comm: syz.4.230 Not tainted syzkaller #0 PREEMPT(full) [ 74.333143][ T6648] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 74.333163][ T6648] Call Trace: [ 74.333168][ T6648] [ 74.333174][ T6648] dump_stack_lvl+0x100/0x190 [ 74.333196][ T6648] should_fail_ex.cold+0x5/0xa [ 74.333213][ T6648] should_failslab+0xc2/0x120 [ 74.333232][ T6648] __kmalloc_cache_noprof+0x91/0x6d0 [ 74.333245][ T6648] ? xfd_validate_state+0x129/0x190 [ 74.333257][ T6648] ? __do_sys_memfd_create+0x170/0x3d0 [ 74.333271][ T6648] __do_sys_memfd_create+0x170/0x3d0 [ 74.333284][ T6648] do_syscall_64+0x123/0x790 [ 74.333303][ T6648] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.333315][ T6648] RIP: 0033:0x7fde5f79e559 [ 74.333326][ T6648] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.333337][ T6648] RSP: 002b:00007fde605ec028 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 74.333349][ T6648] RAX: ffffffffffffffda RBX: 00007fde5fa25fa0 RCX: 00007fde5f79e559 [ 74.333357][ T6648] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000002c0 [ 74.333364][ T6648] RBP: 00007fde5f835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 74.333370][ T6648] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 74.333377][ T6648] R13: 00007fde5fa26038 R14: 00007fde5fa25fa0 R15: 00007fff7aba2e68 [ 74.333394][ T6648] [ 74.385476][ T6642] [U] [ 74.478499][ T5727] Bluetooth: hci1: unexpected event for opcode 0x0c2d [ 74.510068][ T6667] netlink: 32 bytes leftover after parsing attributes in process `syz.0.238'. [ 74.540307][ T6669] program syz.3.239 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 74.722238][ T6683] device-mapper: ioctl: name not supplied when creating device [ 74.907375][ T6694] MINIX-fs: blocksize too small for device [ 74.963411][ T6699] Bluetooth: MGMT ver 1.23 [ 74.990986][ T6701] netlink: 20 bytes leftover after parsing attributes in process `syz.3.252'. [ 75.132245][ T6716] tmpfs: Bad value for 'mpol' [ 75.138506][ T6716] trusted_key: encrypted_key: insufficient parameters specified [ 75.241716][ T6724] netlink: 24 bytes leftover after parsing attributes in process `syz.2.260'. [ 75.637581][ T5727] Bluetooth: hci4: command tx timeout [ 75.665858][ T6750] netlink: 8 bytes leftover after parsing attributes in process `syz.4.268'. [ 75.670966][ T6750] batadv_slave_1: entered promiscuous mode [ 75.671134][ T6750] batadv_slave_1: left promiscuous mode [ 75.736643][ T6754] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 75.738509][ T6754] XFS (loop0): Cannot mount filesystem with identical rtdev and ddev/logdev. [ 75.764185][ T6756] ip_tables: iptables: counters copy to user failed while replacing table [ 75.772207][ T6756] ip_tables: iptables: counters copy to user failed while replacing table [ 75.772895][ T6756] netlink: 4 bytes leftover after parsing attributes in process `syz.4.270'. [ 75.796461][ T6758] binder: 6757:6758 ioctl c0306201 200000000ac0 returned -22 [ 76.053595][ T6774] ip_tables: iptables: counters copy to user failed while replacing table [ 76.251940][ T6782] A link change request failed with some changes committed already. Interface veth0_to_team may have been left with an inconsistent configuration, please check. [ 76.277462][ C3] Illegal XDP return value 16128 on prog (id 21) dev veth0, expect packet loss! [ 76.822630][ T6793] netlink: 24 bytes leftover after parsing attributes in process `syz.4.283'. [ 76.925970][ T6795] netlink: 36 bytes leftover after parsing attributes in process `syz.0.284'. [ 77.002445][ T234] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.002460][ T234] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.197472][ T6809] veth0_macvtap: left promiscuous mode [ 77.201849][ T6809] macvtap0: entered allmulticast mode [ 77.205339][ T6811] Invalid logical block size (1536) [ 77.212532][ T6811] Cannot find set identified by id 0 to match [ 77.221512][ T6814] bond0: Error: CAN devices cannot be enslaved [ 77.341858][ T6824] tmpfs: Bad value for 'mpol' [ 77.352950][ T6824] FAULT_INJECTION: forcing a failure. [ 77.352950][ T6824] name fail_futex, interval 1, probability 0, space 0, times 1 [ 77.352973][ T6824] CPU: 3 UID: 0 PID: 6824 Comm: syz.0.294 Not tainted syzkaller #0 PREEMPT(full) [ 77.352986][ T6824] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.352993][ T6824] Call Trace: [ 77.352998][ T6824] [ 77.353003][ T6824] dump_stack_lvl+0x100/0x190 [ 77.353063][ T6824] should_fail_ex.cold+0x5/0xa [ 77.353097][ T6824] get_futex_key+0x1c9/0x13e0 [ 77.353136][ T6824] ? __pfx_get_futex_key+0x10/0x10 [ 77.353158][ T6824] ? futex_wake+0x4ea/0x5e0 [ 77.353185][ T6824] futex_wake+0xf4/0x5e0 [ 77.353204][ T6824] ? futex_wait+0x11e/0x370 [ 77.353223][ T6824] ? __pfx_futex_wake+0x10/0x10 [ 77.353236][ T6824] ? lock_acquire+0x1d1/0x380 [ 77.353252][ T6824] ? find_held_lock+0x2b/0x80 [ 77.353268][ T6824] ? __fget_files+0x215/0x3d0 [ 77.353292][ T6824] ? __fget_files+0x215/0x3d0 [ 77.353311][ T6824] do_futex+0x2b2/0x440 [ 77.353329][ T6824] ? __pfx_do_futex+0x10/0x10 [ 77.353348][ T6824] ? fdget+0x18b/0x210 [ 77.353366][ T6824] __x64_sys_futex+0x34f/0x4d0 [ 77.353387][ T6824] ? __pfx___x64_sys_futex+0x10/0x10 [ 77.353410][ T6824] do_syscall_64+0x123/0x790 [ 77.353455][ T6824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.353468][ T6824] RIP: 0033:0x7ff0e959e559 [ 77.353479][ T6824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.353491][ T6824] RSP: 002b:00007ff0e77f60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 77.353509][ T6824] RAX: ffffffffffffffda RBX: 00007ff0e9825fa8 RCX: 00007ff0e959e559 [ 77.353517][ T6824] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007ff0e9825fac [ 77.353525][ T6824] RBP: 00007ff0e9825fa0 R08: 0000000000000001 R09: 0000000000000000 [ 77.353532][ T6824] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 77.353539][ T6824] R13: 00007ff0e9826038 R14: 00007ffd10ae0f20 R15: 00007ffd10ae1008 [ 77.353554][ T6824] [ 77.356410][ T6826] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 77.356425][ T6826] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 77.359271][ T6826] vhci_hcd vhci_hcd.0: Device attached [ 77.363354][ T6827] vhci_hcd: connection closed [ 77.365926][ T13] vhci_hcd vhci_hcd.3: stop threads [ 77.366329][ T13] vhci_hcd vhci_hcd.3: release socket [ 77.366347][ T13] vhci_hcd vhci_hcd.3: disconnect device [ 77.370976][ T6830] FAULT_INJECTION: forcing a failure. [ 77.370976][ T6830] name failslab, interval 1, probability 0, space 0, times 0 [ 77.370995][ T6830] CPU: 3 UID: 0 PID: 6830 Comm: syz.4.296 Not tainted syzkaller #0 PREEMPT(full) [ 77.371008][ T6830] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.371015][ T6830] Call Trace: [ 77.371019][ T6830] [ 77.371026][ T6830] dump_stack_lvl+0x100/0x190 [ 77.371047][ T6830] should_fail_ex.cold+0x5/0xa [ 77.371063][ T6830] should_failslab+0xc2/0x120 [ 77.371081][ T6830] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 77.371097][ T6830] ? __alloc_skb+0x140/0x710 [ 77.371132][ T6830] __alloc_skb+0x140/0x710 [ 77.371141][ T6830] ? __alloc_skb+0x5b7/0x710 [ 77.371151][ T6830] ? __pfx___alloc_skb+0x10/0x10 [ 77.371166][ T6830] netlink_ack+0x117/0xb80 [ 77.371177][ T6830] ? trace_contention_end+0x126/0x160 [ 77.371196][ T6830] netlink_rcv_skb+0x333/0x420 [ 77.371206][ T6830] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 77.371229][ T6830] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 77.371250][ T6830] xfrm_netlink_rcv+0x71/0x90 [ 77.371262][ T6830] netlink_unicast+0x65f/0x950 [ 77.371274][ T6830] ? __pfx_netlink_unicast+0x10/0x10 [ 77.371289][ T6830] netlink_sendmsg+0x8b0/0xda0 [ 77.371302][ T6830] ? __pfx_netlink_sendmsg+0x10/0x10 [ 77.371315][ T6830] ? selinux_socket_sendmsg+0x198/0x2f0 [ 77.371340][ T6830] ____sys_sendmsg+0xa4d/0xbe0 [ 77.371353][ T6830] ? __pfx_netlink_sendmsg+0x10/0x10 [ 77.371365][ T6830] ? __pfx_____sys_sendmsg+0x10/0x10 [ 77.371382][ T6830] ? lock_acquire+0x1d1/0x380 [ 77.371395][ T6830] ? get_pid_task+0x2a/0x250 [ 77.371412][ T6830] ___sys_sendmsg+0x190/0x1e0 [ 77.371428][ T6830] ? __pfx____sys_sendmsg+0x10/0x10 [ 77.371442][ T6830] ? get_pid_task+0x106/0x250 [ 77.371463][ T6830] ? find_held_lock+0x2b/0x80 [ 77.371511][ T6830] __sys_sendmsg+0x160/0x210 [ 77.371529][ T6830] ? __pfx___sys_sendmsg+0x10/0x10 [ 77.371549][ T6830] do_syscall_64+0x123/0x790 [ 77.371567][ T6830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.371578][ T6830] RIP: 0033:0x7fde5f79e559 [ 77.371588][ T6830] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.371599][ T6830] RSP: 002b:00007fde605ec028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 77.371610][ T6830] RAX: ffffffffffffffda RBX: 00007fde5fa25fa0 RCX: 00007fde5f79e559 [ 77.371617][ T6830] RDX: 0000000024000058 RSI: 0000200000000140 RDI: 0000000000000003 [ 77.371624][ T6830] RBP: 00007fde605ec090 R08: 0000000000000000 R09: 0000000000000000 [ 77.371630][ T6830] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.371637][ T6830] R13: 00007fde5fa26038 R14: 00007fde5fa25fa0 R15: 00007fff7aba2e68 [ 77.371652][ T6830] [ 77.459057][ T6832] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 77.459868][ T6832] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 77.459959][ T6832] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 77.459988][ T6832] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 77.474689][ T6832] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 77.543752][ T6840] syz.0.299: attempt to access beyond end of device [ 77.543752][ T6840] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 77.543778][ T6840] gfs2: error -5 reading superblock [ 77.571435][ T6843] openvswitch: netlink: Missing key (keys=c0, expected=20080) [ 77.628117][ T6847] __nla_validate_parse: 1 callbacks suppressed [ 77.628135][ T6847] netlink: 132 bytes leftover after parsing attributes in process `syz.0.304'. [ 77.707164][ T6855] binder: 6854:6855 ioctl c0306201 200000000a00 returned -14 [ 77.713249][ T6855] binder: 6854:6855 ioctl c0306201 200000000b00 returned -14 [ 77.857391][ T6865] FAULT_INJECTION: forcing a failure. [ 77.857391][ T6865] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 77.857430][ T6865] CPU: 1 UID: 0 PID: 6865 Comm: syz.0.313 Not tainted syzkaller #0 PREEMPT(full) [ 77.857449][ T6865] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.857460][ T6865] Call Trace: [ 77.857466][ T6865] [ 77.857473][ T6865] dump_stack_lvl+0x100/0x190 [ 77.857542][ T6865] should_fail_ex.cold+0x5/0xa [ 77.857574][ T6865] _copy_from_user+0x2e/0xd0 [ 77.857609][ T6865] drm_ioctl+0x520/0xc60 [ 77.857647][ T6865] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 77.857666][ T6865] ? __pfx_drm_ioctl+0x10/0x10 [ 77.857682][ T6865] ? __fget_files+0x34/0x3d0 [ 77.857723][ T6865] ? selinux_file_ioctl+0x13b/0x290 [ 77.857755][ T6865] ? selinux_file_ioctl+0xb6/0x290 [ 77.857780][ T6865] ? __pfx_drm_ioctl+0x10/0x10 [ 77.857798][ T6865] __x64_sys_ioctl+0x18e/0x210 [ 77.857822][ T6865] do_syscall_64+0x123/0x790 [ 77.857878][ T6865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.857895][ T6865] RIP: 0033:0x7ff0e959e559 [ 77.857909][ T6865] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.857925][ T6865] RSP: 002b:00007ff0e77f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 77.857948][ T6865] RAX: ffffffffffffffda RBX: 00007ff0e9825fa0 RCX: 00007ff0e959e559 [ 77.857959][ T6865] RDX: 00002000000010c0 RSI: 00000000c06864a2 RDI: 0000000000000003 [ 77.857969][ T6865] RBP: 00007ff0e77f6090 R08: 0000000000000000 R09: 0000000000000000 [ 77.857979][ T6865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.857989][ T6865] R13: 00007ff0e9826038 R14: 00007ff0e9825fa0 R15: 00007ffd10ae1008 [ 77.858013][ T6865] [ 77.919541][ T6872] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=35360 sclass=netlink_route_socket pid=6872 comm=syz.3.314 [ 77.922968][ T6870] XFS (loop0): Cannot mount filesystem with identical rtdev and ddev/logdev. [ 78.236367][ T2319] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 78.273136][ T6889] FAULT_INJECTION: forcing a failure. [ 78.273136][ T6889] name failslab, interval 1, probability 0, space 0, times 0 [ 78.273166][ T6889] CPU: 2 UID: 0 PID: 6889 Comm: syz.4.322 Not tainted syzkaller #0 PREEMPT(full) [ 78.273185][ T6889] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.273195][ T6889] Call Trace: [ 78.273201][ T6889] [ 78.273209][ T6889] dump_stack_lvl+0x100/0x190 [ 78.273242][ T6889] should_fail_ex.cold+0x5/0xa [ 78.273284][ T6889] should_failslab+0xc2/0x120 [ 78.273315][ T6889] kmem_cache_alloc_noprof+0x92/0x6a0 [ 78.273340][ T6889] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 78.273375][ T6889] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 78.273410][ T6889] mmu_topup_memory_caches+0x25/0x170 [ 78.273435][ T6889] kvm_mmu_load+0xe8/0x2580 [ 78.273459][ T6889] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 78.273488][ T6889] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 78.273520][ T6889] ? __pfx_kvm_mmu_load+0x10/0x10 [ 78.273541][ T6889] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 78.273568][ T6889] ? kvm_check_and_inject_events+0x896/0x1050 [ 78.273595][ T6889] vcpu_run+0x419f/0x61a0 [ 78.273616][ T6889] ? mark_held_locks+0x40/0x70 [ 78.273664][ T6889] ? __pfx_vcpu_run+0x10/0x10 [ 78.273691][ T6889] ? lock_acquire+0x1d1/0x380 [ 78.273712][ T6889] ? kvm_arch_vcpu_ioctl_run+0x2e9/0x1dd0 [ 78.273739][ T6889] ? fpu_swap_kvm_fpstate+0x217/0x460 [ 78.273766][ T6889] ? __local_bh_enable_ip+0xa5/0x120 [ 78.273792][ T6889] ? kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 78.273817][ T6889] kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 78.273848][ T6889] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 78.273871][ T6889] ? lock_acquire+0x1d1/0x380 [ 78.273893][ T6889] ? do_raw_write_lock+0x11e/0x260 [ 78.273918][ T6889] ? find_held_lock+0x2b/0x80 [ 78.273946][ T6889] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 78.273971][ T6889] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 78.274002][ T6889] kvm_vcpu_ioctl+0x730/0x1700 [ 78.274032][ T6889] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 78.274059][ T6889] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 78.274087][ T6889] ? do_vfs_ioctl+0x226/0x13e0 [ 78.274111][ T6889] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 78.274131][ T6889] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 78.274162][ T6889] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 78.274195][ T6889] ? __fget_files+0x34/0x3d0 [ 78.274234][ T6889] ? selinux_file_ioctl+0x13b/0x290 [ 78.274259][ T6889] ? selinux_file_ioctl+0xb6/0x290 [ 78.274287][ T6889] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 78.274315][ T6889] __x64_sys_ioctl+0x18e/0x210 [ 78.274339][ T6889] do_syscall_64+0x123/0x790 [ 78.274370][ T6889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.274390][ T6889] RIP: 0033:0x7fde5f79e559 [ 78.274405][ T6889] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.274423][ T6889] RSP: 002b:00007fde605ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 78.274442][ T6889] RAX: ffffffffffffffda RBX: 00007fde5fa25fa0 RCX: 00007fde5f79e559 [ 78.274455][ T6889] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 78.274466][ T6889] RBP: 00007fde605ec090 R08: 0000000000000000 R09: 0000000000000000 [ 78.274477][ T6889] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 78.274489][ T6889] R13: 00007fde5fa26038 R14: 00007fde5fa25fa0 R15: 00007fff7aba2e68 [ 78.274513][ T6889] [ 78.357094][ T5878] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 78.406353][ T2319] usb 8-1: Using ep0 maxpacket: 16 [ 78.406984][ T2319] usb 8-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 78.407785][ T2319] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 78.407801][ T2319] usb 8-1: config 0 interface 0 has no altsetting 0 [ 78.412026][ T2319] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.412046][ T2319] usb 8-1: Product: syz [ 78.412058][ T2319] usb 8-1: Manufacturer: syz [ 78.412068][ T2319] usb 8-1: SerialNumber: syz [ 78.414298][ T2319] usb 8-1: config 0 descriptor?? [ 78.526392][ T5878] usb 7-1: Using ep0 maxpacket: 16 [ 78.527230][ T5878] usb 7-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 78.528350][ T5878] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 78.528366][ T5878] usb 7-1: config 0 interface 0 has no altsetting 0 [ 78.530594][ T5878] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.530653][ T5878] usb 7-1: Product: syz [ 78.530662][ T5878] usb 7-1: Manufacturer: syz [ 78.530669][ T5878] usb 7-1: SerialNumber: syz [ 78.530850][ T6899] usbcore.quirks: string doesn't fit in 127 chars. [ 78.538062][ T5878] usb 7-1: config 0 descriptor?? [ 78.629233][ C2] imon 8-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 78.631284][ T2319] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/input/input11 [ 78.642510][ T2319] imon:send_packet: packet tx failed (-71) [ 78.667294][ T2319] imon 8-1:0.0: panel buttons/knobs setup failed [ 78.703825][ T6907] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 78.726600][ T2319] rc_core: IR keymap rc-imon-pad not found [ 78.726618][ T2319] Registered IR keymap rc-empty [ 78.726674][ T2319] imon 8-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 78.726690][ T2319] imon 8-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 78.727092][ T2319] imon:send_packet: packet tx failed (-71) [ 78.748488][ C2] imon 7-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 78.755145][ T5878] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/input/input13 [ 78.757899][ T2319] imon 8-1:0.0: remote input dev register failed [ 78.758006][ T2319] imon 8-1:0.0: imon_init_intf0: rc device setup failed [ 78.760767][ T5878] imon:send_packet: packet tx failed (-71) [ 78.776938][ T5878] imon 7-1:0.0: panel buttons/knobs setup failed [ 78.778554][ T2319] imon 8-1:0.0: unable to initialize intf0, err 0 [ 78.778567][ T2319] imon:imon_probe: failed to initialize context! [ 78.778573][ T2319] imon 8-1:0.0: unable to register, err -19 [ 78.783068][ T2319] usb 8-1: USB disconnect, device number 10 [ 78.816623][ T5878] rc_core: IR keymap rc-imon-pad not found [ 78.816635][ T5878] Registered IR keymap rc-empty [ 78.816671][ T5878] imon 7-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 78.816681][ T5878] imon 7-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 78.816994][ T5878] imon:send_packet: packet tx failed (-71) [ 78.824808][ T6913] tmpfs: Bad value for 'mpol' [ 78.839499][ T5878] imon 7-1:0.0: remote input dev register failed [ 78.839567][ T5878] imon 7-1:0.0: imon_init_intf0: rc device setup failed [ 78.853809][ T5878] imon 7-1:0.0: unable to initialize intf0, err 0 [ 78.853821][ T5878] imon:imon_probe: failed to initialize context! [ 78.853828][ T5878] imon 7-1:0.0: unable to register, err -19 [ 78.855131][ T5878] usb 7-1: USB disconnect, device number 7 [ 78.886353][ T42] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 78.900864][ T6917] batman_adv: batadv0: Adding interface: syzkaller0 [ 78.900876][ T6917] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.900892][ T6917] batman_adv: batadv0: Interface activated: syzkaller0 [ 79.046354][ T42] usb 9-1: Using ep0 maxpacket: 8 [ 79.047154][ T42] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 79.048265][ T42] usb 9-1: config index 0 descriptor too short (expected 74, got 45) [ 79.048303][ T42] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 79.048323][ T42] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 79.048343][ T42] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 79.048364][ T42] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 79.048383][ T42] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 79.048415][ T42] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.156530][ T2319] usb 8-1: new full-speed USB device number 11 using dummy_hcd [ 79.254769][ T42] usb 9-1: GET_CAPABILITIES returned 0 [ 79.254793][ T42] usbtmc 9-1:16.0: can't read capabilities [ 79.296449][ T5878] usb 7-1: new full-speed USB device number 8 using dummy_hcd [ 79.299840][ T6916] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 79.312549][ T6916] batman_adv: batadv0: Removing interface: syzkaller0 [ 79.327137][ T2319] usb 8-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 79.328394][ T2319] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 79.328420][ T2319] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 198, setting to 64 [ 79.328441][ T2319] usb 8-1: config 0 interface 0 has no altsetting 0 [ 79.330264][ T2319] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.330283][ T2319] usb 8-1: Product: syz [ 79.330295][ T2319] usb 8-1: Manufacturer: syz [ 79.330307][ T2319] usb 8-1: SerialNumber: syz [ 79.332687][ T2319] usb 8-1: config 0 descriptor?? [ 79.333428][ T6876] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 79.399448][ T43] kauditd_printk_skb: 51 callbacks suppressed [ 79.399460][ T43] audit: type=1400 audit(1792415476.792:578): avc: denied { create } for pid=6919 comm="syz.0.333" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 79.416122][ T6920] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 79.458738][ T5878] usb 7-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 79.460126][ T5878] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 79.460152][ T5878] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 198, setting to 64 [ 79.460174][ T5878] usb 7-1: config 0 interface 0 has no altsetting 0 [ 79.463572][ T6904] usbtmc 9-1:16.0: send_request_dev_dep_msg_in returned -71 [ 79.465975][ T5878] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.465996][ T5878] usb 7-1: Product: syz [ 79.466008][ T5878] usb 7-1: Manufacturer: syz [ 79.466020][ T5878] usb 7-1: SerialNumber: syz [ 79.468644][ T5817] usb 9-1: USB disconnect, device number 2 [ 79.477875][ T5735] Bluetooth: hci4: command 0x2021 tx timeout [ 79.477905][ T5735] Bluetooth: hci3: command 0x0c1a tx timeout [ 79.477920][ T5735] Bluetooth: hci1: command 0x0c1a tx timeout [ 79.482976][ T5878] usb 7-1: config 0 descriptor?? [ 79.486182][ T6887] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 79.540061][ C2] imon 8-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 79.541779][ T2319] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/input/input15 [ 79.691681][ C2] imon 7-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 79.696615][ T5878] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/input/input17 [ 79.698815][ T6887] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=71 sclass=netlink_route_socket pid=6887 comm=syz.2.321 [ 79.699364][ T5878] imon:send_packet: packet tx failed (-71) [ 79.726370][ T5878] imon 7-1:0.0: panel buttons/knobs setup failed [ 79.766460][ T5878] rc_core: IR keymap rc-imon-pad not found [ 79.766471][ T5878] Registered IR keymap rc-empty [ 79.766499][ T5878] imon 7-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 79.766508][ T5878] imon 7-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 79.766728][ T5878] imon:send_packet: packet tx failed (-71) [ 79.786334][ T5878] imon 7-1:0.0: remote input dev register failed [ 79.786402][ T5878] imon 7-1:0.0: imon_init_intf0: rc device setup failed [ 79.801173][ T5878] imon 7-1:0.0: unable to initialize intf0, err 0 [ 79.801185][ T5878] imon:imon_probe: failed to initialize context! [ 79.801192][ T5878] imon 7-1:0.0: unable to register, err -19 [ 79.805281][ T5878] usb 7-1: USB disconnect, device number 8 [ 79.807597][ T2319] rc_core: IR keymap rc-imon-pad not found [ 79.807608][ T2319] Registered IR keymap rc-empty [ 79.807652][ T2319] imon 8-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 79.807666][ T2319] imon 8-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 79.968558][ T2319] rc rc1: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc1 [ 79.969911][ T2319] input: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc1/input16 [ 79.972687][ T2319] imon 8-1:0.0: iMON device (15c2:0045, intf0) on usb<8:11> initialized [ 80.035390][ T6935] netlink: 132 bytes leftover after parsing attributes in process `syz.4.336'. [ 81.285974][ T6964] FAULT_INJECTION: forcing a failure. [ 81.285974][ T6964] name failslab, interval 1, probability 0, space 0, times 0 [ 81.285995][ T6964] CPU: 3 UID: 0 PID: 6964 Comm: syz.4.347 Not tainted syzkaller #0 PREEMPT(full) [ 81.286008][ T6964] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 81.286014][ T6964] Call Trace: [ 81.286019][ T6964] [ 81.286024][ T6964] dump_stack_lvl+0x100/0x190 [ 81.286045][ T6964] should_fail_ex.cold+0x5/0xa [ 81.286061][ T6964] should_failslab+0xc2/0x120 [ 81.286078][ T6964] kmem_cache_alloc_noprof+0x92/0x6a0 [ 81.286093][ T6964] ? do_getname+0x35/0x390 [ 81.286107][ T6964] do_getname+0x35/0x390 [ 81.286120][ T6964] __x64_sys_mkdirat+0x78/0xc0 [ 81.286137][ T6964] do_syscall_64+0x123/0x790 [ 81.286157][ T6964] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.286168][ T6964] RIP: 0033:0x7fde5f79e559 [ 81.286178][ T6964] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 81.286189][ T6964] RSP: 002b:00007fde605ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 81.286200][ T6964] RAX: ffffffffffffffda RBX: 00007fde5fa25fa0 RCX: 00007fde5f79e559 [ 81.286207][ T6964] RDX: 0000000000000188 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 81.286214][ T6964] RBP: 00007fde5f835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 81.286221][ T6964] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 81.286227][ T6964] R13: 00007fde5fa26038 R14: 00007fde5fa25fa0 R15: 00007fff7aba2e68 [ 81.286254][ T6964] [ 81.288149][ T43] audit: type=1400 audit(1792415478.682:579): avc: denied { mounton } for pid=6963 comm="syz.4.347" path="/37/proc" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=dir permissive=1 [ 81.288987][ T43] audit: type=1400 audit(1792415478.682:580): avc: denied { mounton } for pid=6963 comm="syz.4.347" path="/37/proc" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 81.462211][ T6972] FAULT_INJECTION: forcing a failure. [ 81.462211][ T6972] name failslab, interval 1, probability 0, space 0, times 0 [ 81.462234][ T6972] CPU: 0 UID: 0 PID: 6972 Comm: syz.4.349 Not tainted syzkaller #0 PREEMPT(full) [ 81.462247][ T6972] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 81.462254][ T6972] Call Trace: [ 81.462258][ T6972] [ 81.462262][ T6972] dump_stack_lvl+0x100/0x190 [ 81.462283][ T6972] should_fail_ex.cold+0x5/0xa [ 81.462299][ T6972] should_failslab+0xc2/0x120 [ 81.462316][ T6972] kmem_cache_alloc_noprof+0x92/0x6a0 [ 81.462332][ T6972] ? ptlock_alloc+0x1f/0x70 [ 81.462345][ T6972] ptlock_alloc+0x1f/0x70 [ 81.462355][ T6972] pte_alloc_one+0x82/0x3d0 [ 81.462373][ T6972] do_fault+0x960/0x1830 [ 81.462388][ T6972] ? __pfx___thp_vma_allowable_orders+0x10/0x10 [ 81.462401][ T6972] ? __pfx_do_fault+0x10/0x10 [ 81.462415][ T6972] ? pgd_none+0x9f/0xe0 [ 81.462425][ T6972] ? __pfx_pgd_none+0x10/0x10 [ 81.462438][ T6972] __handle_mm_fault+0x150b/0x2f60 [ 81.462452][ T6972] ? __pfx___handle_mm_fault+0x10/0x10 [ 81.462463][ T6972] ? __pfx_folio_mark_accessed+0x10/0x10 [ 81.462476][ T6972] ? find_held_lock+0x2b/0x80 [ 81.462492][ T6972] ? find_held_lock+0x2b/0x80 [ 81.462508][ T6972] ? follow_page_pte+0x479/0x1050 [ 81.462531][ T6972] handle_mm_fault+0x363/0xa20 [ 81.462545][ T6972] __get_user_pages+0x8ae/0x2c30 [ 81.462563][ T6972] ? __pfx_mt_find+0x10/0x10 [ 81.462576][ T6972] ? __pfx___get_user_pages+0x10/0x10 [ 81.462596][ T6972] populate_vma_page_range+0x267/0x3f0 [ 81.462613][ T6972] ? __pfx_populate_vma_page_range+0x10/0x10 [ 81.462628][ T6972] ? __pfx_find_vma_intersection+0x10/0x10 [ 81.462647][ T6972] __mm_populate+0x107/0x3a0 [ 81.462663][ T6972] ? __pfx___mm_populate+0x10/0x10 [ 81.462684][ T6972] ? up_write+0x2dc/0x5b0 [ 81.462700][ T6972] __do_sys_mlockall+0x4f4/0x5d0 [ 81.462714][ T6972] do_syscall_64+0x123/0x790 [ 81.462731][ T6972] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.462742][ T6972] RIP: 0033:0x7fde5f79e559 [ 81.462752][ T6972] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 81.462764][ T6972] RSP: 002b:00007fde605ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000097 [ 81.462775][ T6972] RAX: ffffffffffffffda RBX: 00007fde5fa25fa0 RCX: 00007fde5f79e559 [ 81.462782][ T6972] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 81.462788][ T6972] RBP: 00007fde605ec090 R08: 0000000000000000 R09: 0000000000000000 [ 81.462794][ T6972] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 81.462801][ T6972] R13: 00007fde5fa26038 R14: 00007fde5fa25fa0 R15: 00007fff7aba2e68 [ 81.462816][ T6972] [ 81.507658][ T2319] usb 8-1: USB disconnect, device number 11 [ 81.549607][ T6974] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 81.550760][ T6974] VFS: Can't find a romfs filesystem on dev nullb0. [ 81.550760][ T6974] [ 81.564001][ T5727] Bluetooth: hci4: command 0x2021 tx timeout [ 81.587614][ T5727] Bluetooth: hci3: Malformed Event: 0x2f [ 81.588687][ T6976] XFS (loop0): Cannot mount filesystem with identical rtdev and ddev/logdev. [ 81.892673][ T43] audit: type=1400 audit(1792415479.282:581): avc: denied { write } for pid=6977 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.948821][ T43] audit: type=1400 audit(1792415479.342:582): avc: denied { write } for pid=6984 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.167283][ T6992] overlayfs: failed to get inode (-116) [ 82.167377][ T6992] overlayfs: failed to get inode (-116) [ 82.411356][ T43] audit: type=1400 audit(1792415479.802:583): avc: denied { write } for pid=6994 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.448662][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 82.471226][ T43] audit: type=1400 audit(1792415479.862:584): avc: denied { write } for pid=6997 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.499636][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 82.560054][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 82.598541][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 82.618111][ T5735] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 82.621935][ T5735] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 82.624157][ T5735] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 82.625408][ T5735] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 82.625644][ T5735] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 82.716440][ T43] audit: type=1400 audit(1792415480.102:585): avc: denied { read } for pid=5441 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 82.799827][ T1345] SELinux: failure in sel_netif_sid_slow(), invalid network interface (13) [ 82.846494][ T1345] SELinux: failure in sel_netif_sid_slow(), invalid network interface (13) [ 82.870917][ T13] bond0 (unregistering): Released all slaves [ 82.881252][ T43] audit: type=1400 audit(1792415480.272:586): avc: denied { read } for pid=5441 comm="dhcpcd" name="n37" dev="tmpfs" ino=2459 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 82.881463][ T43] audit: type=1400 audit(1792415480.272:587): avc: denied { open } for pid=5441 comm="dhcpcd" path="/run/udev/data/n37" dev="tmpfs" ino=2459 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 82.941965][ T7002] rxe_eth0 speed is unknown, defaulting to 1000 [ 83.174263][ T6940] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 83.178526][ T6983] FAULT_INJECTION: forcing a failure. [ 83.178526][ T6983] name failslab, interval 1, probability 0, space 0, times 0 [ 83.178554][ T6983] CPU: 1 UID: 0 PID: 6983 Comm: syz.4.353 Not tainted syzkaller #0 PREEMPT(full) [ 83.178574][ T6983] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 83.178586][ T6983] Call Trace: [ 83.178592][ T6983] [ 83.178600][ T6983] dump_stack_lvl+0x100/0x190 [ 83.178650][ T6983] should_fail_ex.cold+0x5/0xa [ 83.178681][ T6983] should_failslab+0xc2/0x120 [ 83.178709][ T6983] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 83.178736][ T6983] ? __alloc_skb+0x140/0x710 [ 83.178773][ T6983] __alloc_skb+0x140/0x710 [ 83.178790][ T6983] ? __alloc_skb+0x5b7/0x710 [ 83.178808][ T6983] ? __pfx___alloc_skb+0x10/0x10 [ 83.178827][ T6983] ? idr_get_next+0xec/0x150 [ 83.178849][ T6983] ? __pfx_idr_get_next+0x10/0x10 [ 83.178879][ T6983] ctrl_build_family_msg+0x36/0xa0 [ 83.178903][ T6983] ctrl_getfamily+0x361/0x550 [ 83.178919][ T6983] ? __pfx_ctrl_getfamily+0x10/0x10 [ 83.178938][ T6983] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 83.178959][ T6983] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 83.178985][ T6983] genl_family_rcv_msg_doit+0x214/0x300 [ 83.179004][ T6983] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 83.179017][ T6983] ? genl_get_cmd+0x3e7/0x760 [ 83.179037][ T6983] ? __dev_queue_xmit+0xa81/0x4a40 [ 83.179062][ T6983] ? __radix_tree_lookup+0x217/0x2b0 [ 83.179089][ T6983] genl_rcv_msg+0x560/0x800 [ 83.179112][ T6983] ? __pfx_genl_rcv_msg+0x10/0x10 [ 83.179132][ T6983] ? __lock_acquire+0x5c0/0x1f40 [ 83.179147][ T6983] ? __pfx_ctrl_getfamily+0x10/0x10 [ 83.179167][ T6983] netlink_rcv_skb+0x159/0x420 [ 83.179182][ T6983] ? __pfx_genl_rcv_msg+0x10/0x10 [ 83.179204][ T6983] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 83.179233][ T6983] ? netlink_deliver_tap+0x1ae/0xcc0 [ 83.179257][ T6983] genl_rcv+0x28/0x40 [ 83.179267][ T6983] netlink_unicast+0x65f/0x950 [ 83.179281][ T6983] ? __pfx_netlink_unicast+0x10/0x10 [ 83.179296][ T6983] netlink_sendmsg+0x8b0/0xda0 [ 83.179309][ T6983] ? __pfx_netlink_sendmsg+0x10/0x10 [ 83.179322][ T6983] ? selinux_socket_sendmsg+0x198/0x2f0 [ 83.179342][ T6983] __sys_sendto+0x48b/0x4e0 [ 83.179351][ T6983] ? __pfx_netlink_sendmsg+0x10/0x10 [ 83.179362][ T6983] ? __pfx___sys_sendto+0x10/0x10 [ 83.179383][ T6983] ? fd_install+0x223/0x580 [ 83.179413][ T6983] ? xfd_validate_state+0x129/0x190 [ 83.179439][ T6983] __x64_sys_sendto+0xe0/0x1c0 [ 83.179479][ T6983] ? do_syscall_64+0xae/0x790 [ 83.179505][ T6983] ? lockdep_hardirqs_on+0x7d/0x110 [ 83.179530][ T6983] do_syscall_64+0x123/0x790 [ 83.179554][ T6983] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.179578][ T6983] RIP: 0033:0x7fde5f75ed8e [ 83.179594][ T6983] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 83.179612][ T6983] RSP: 002b:00007fde605eae88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 83.179633][ T6983] RAX: ffffffffffffffda RBX: 00007fde605ec6c0 RCX: 00007fde5f75ed8e [ 83.179646][ T6983] RDX: 0000000000000020 RSI: 00007fde605eb000 RDI: 0000000000000005 [ 83.179658][ T6983] RBP: 0000000000000000 R08: 00007fde605eaf04 R09: 000000000000000c [ 83.179676][ T6983] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 83.179687][ T6983] R13: 00007fde605eaf58 R14: 00007fde605eb000 R15: 0000000000000000 [ 83.179714][ T6983] [ 83.224271][ T7018] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7018 comm=syz.4.359 [ 83.251794][ T7018] usb 1-1: USB disconnect, device number 2 [ 83.299789][ T7025] netlink: 'syz.4.359': attribute type 1 has an invalid length. [ 83.332432][ T13] hsr_slave_0: left promiscuous mode [ 83.333507][ T13] hsr_slave_1: left promiscuous mode [ 83.347137][ T13] veth1_macvtap: left promiscuous mode [ 83.347159][ T13] veth0_macvtap: left promiscuous mode [ 83.347234][ T13] veth1_vlan: left promiscuous mode [ 83.347264][ T13] veth0_vlan: left promiscuous mode [ 83.353609][ T7030] netlink: 28 bytes leftover after parsing attributes in process `syz.4.359'. [ 83.403296][ T7018] hub 1-0:1.0: USB hub found [ 83.404436][ T7018] hub 1-0:1.0: 6 ports detected [ 83.420734][ T7019] kvm: pic: non byte write [ 83.454455][ T6538] SELinux: failure in sel_netif_sid_slow(), invalid network interface (51) [ 83.510873][ T7037] Bluetooth: ISO socket layer initialized [ 83.511832][ T5735] Bluetooth: hci1: unexpected event for opcode 0x1003 [ 83.512093][ T5735] Bluetooth: hci1: unexpected event for opcode 0x2003 [ 83.576384][ T6367] usb 1-1: new high-speed USB device number 3 using ehci-pci [ 83.633451][ T7025] bond1: option mode: invalid value (8) [ 83.636664][ T7025] bond1 (unregistering): Released all slaves [ 83.647271][ T5735] Bluetooth: hci4: command 0x2021 tx timeout [ 83.660316][ T5441] 8021q: adding VLAN 0 to HW filter on device eth6 [ 83.690615][ T7002] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.690697][ T7002] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.690801][ T7002] bridge_slave_0: entered allmulticast mode [ 83.692195][ T7002] bridge_slave_0: entered promiscuous mode [ 83.694312][ T7002] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.694391][ T7002] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.696361][ T7002] bridge_slave_1: entered allmulticast mode [ 83.697166][ T7002] bridge_slave_1: entered promiscuous mode [ 83.720951][ T7002] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.722930][ T7002] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.773851][ T6367] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 83.778477][ T7002] team0: Port device team_slave_0 added [ 83.782613][ T7002] team0: Port device team_slave_1 added [ 83.783422][ T7043] netlink: 8 bytes leftover after parsing attributes in process `syz.4.362'. [ 83.783467][ T7043] netlink: 40 bytes leftover after parsing attributes in process `syz.4.362'. [ 83.790541][ T7043] FAULT_INJECTION: forcing a failure. [ 83.790541][ T7043] name failslab, interval 1, probability 0, space 0, times 0 [ 83.790559][ T7043] CPU: 0 UID: 0 PID: 7043 Comm: syz.4.362 Not tainted syzkaller #0 PREEMPT(full) [ 83.790574][ T7043] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 83.790581][ T7043] Call Trace: [ 83.790585][ T7043] [ 83.790591][ T7043] dump_stack_lvl+0x100/0x190 [ 83.790612][ T7043] should_fail_ex.cold+0x5/0xa [ 83.790629][ T7043] should_failslab+0xc2/0x120 [ 83.790648][ T7043] __kmalloc_noprof+0xfc/0x840 [ 83.790663][ T7043] ? kobject_get_path+0xcf/0x2c0 [ 83.790681][ T7043] kobject_get_path+0xcf/0x2c0 [ 83.790698][ T7043] kobject_uevent_env+0x287/0x18b0 [ 83.790719][ T7043] net_rx_queue_update_kobjects+0x1dd/0x760 [ 83.790740][ T7043] ? kset_register+0x1bb/0x290 [ 83.790755][ T7043] netdev_register_kobject+0x2c6/0x410 [ 83.790773][ T7043] register_netdevice+0x15b6/0x25a0 [ 83.790790][ T7043] ? __pfx_register_netdevice+0x10/0x10 [ 83.790804][ T7043] ? dst_cache_init+0x266/0x350 [ 83.790818][ T7043] geneve_newlink+0x9a2/0x1250 [ 83.790851][ T7043] ? __pfx_trace_kmalloc+0x10/0x10 [ 83.790871][ T7043] ? __pfx_geneve_newlink+0x10/0x10 [ 83.790898][ T7043] ? rtnl_create_link+0xa4b/0xf80 [ 83.790913][ T7043] ? __pfx_geneve_newlink+0x10/0x10 [ 83.790931][ T7043] rtnl_newlink+0x1697/0x2620 [ 83.790950][ T7043] ? __pfx_rtnl_newlink+0x10/0x10 [ 83.790963][ T7043] ? avc_has_perm_noaudit+0x56/0x470 [ 83.790977][ T7043] ? find_held_lock+0x2b/0x80 [ 83.790994][ T7043] ? avc_has_perm_noaudit+0x11e/0x470 [ 83.791006][ T7043] ? avc_has_perm_noaudit+0x11e/0x470 [ 83.791034][ T7043] ? lock_acquire+0x1d1/0x380 [ 83.791046][ T7043] ? rtnetlink_rcv_msg+0x1f6/0xe90 [ 83.791059][ T7043] ? find_held_lock+0x2b/0x80 [ 83.791075][ T7043] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 83.791087][ T7043] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 83.791102][ T7043] ? __pfx_rtnl_newlink+0x10/0x10 [ 83.791115][ T7043] rtnetlink_rcv_msg+0x95e/0xe90 [ 83.791131][ T7043] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 83.791148][ T7043] ? ref_tracker_free+0x37e/0x6c0 [ 83.791163][ T7043] netlink_rcv_skb+0x159/0x420 [ 83.791174][ T7043] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 83.791193][ T7043] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 83.791211][ T7043] ? netlink_deliver_tap+0x1ae/0xcc0 [ 83.791251][ T7043] netlink_unicast+0x65f/0x950 [ 83.791265][ T7043] ? __pfx_netlink_unicast+0x10/0x10 [ 83.791280][ T7043] netlink_sendmsg+0x8b0/0xda0 [ 83.791294][ T7043] ? __pfx_netlink_sendmsg+0x10/0x10 [ 83.791307][ T7043] ? selinux_socket_sendmsg+0x198/0x2f0 [ 83.791326][ T7043] ____sys_sendmsg+0xa4d/0xbe0 [ 83.791343][ T7043] ? __pfx_netlink_sendmsg+0x10/0x10 [ 83.791361][ T7043] ? __pfx_____sys_sendmsg+0x10/0x10 [ 83.791397][ T7043] ___sys_sendmsg+0x190/0x1e0 [ 83.791440][ T7043] ? __pfx____sys_sendmsg+0x10/0x10 [ 83.791488][ T7043] ? futex_wait+0x11e/0x370 [ 83.791523][ T7043] ? find_held_lock+0x2b/0x80 [ 83.791568][ T7043] __sys_sendmsg+0x160/0x210 [ 83.791584][ T7043] ? __pfx___sys_sendmsg+0x10/0x10 [ 83.791610][ T7043] do_syscall_64+0x123/0x790 [ 83.791637][ T7043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.791654][ T7043] RIP: 0033:0x7fde5f79e559 [ 83.791670][ T7043] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.791687][ T7043] RSP: 002b:00007fde605ec028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 83.791707][ T7043] RAX: ffffffffffffffda RBX: 00007fde5fa25fa0 RCX: 00007fde5f79e559 [ 83.791718][ T7043] RDX: 0000000000000000 RSI: 0000200000000880 RDI: 000000000000000e [ 83.791729][ T7043] RBP: 00007fde5f835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 83.791741][ T7043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.791752][ T7043] R13: 00007fde5fa26038 R14: 00007fde5fa25fa0 R15: 00007fff7aba2e68 [ 83.791776][ T7043] [ 83.796134][ T6367] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 83.796149][ T6367] usb 1-1: Product: QEMU USB Tablet [ 83.796158][ T6367] usb 1-1: Manufacturer: QEMU [ 83.796167][ T6367] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 83.821708][ T7002] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.821718][ T7002] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.821731][ T7002] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.822531][ T7002] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.822539][ T7002] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.822551][ T7002] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.861190][ T6367] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0003/input/input19 [ 83.864892][ T7002] hsr_slave_0: entered promiscuous mode [ 83.868548][ T7002] hsr_slave_1: entered promiscuous mode [ 83.869910][ T7002] debugfs: 'hsr0' already exists in 'hsr' [ 83.869923][ T7002] Cannot create hsr debugfs directory [ 83.948029][ T6367] hid-generic 0003:0627:0001.0003: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 84.062838][ T5441] 8021q: adding VLAN 0 to HW filter on device eth7 [ 84.073691][ T7002] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 84.075633][ T7002] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.076126][ T7002] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 84.088921][ T7002] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.089303][ T7002] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 84.092695][ T7002] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.103965][ T7002] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 84.106031][ T7002] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.131502][ T7002] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.131550][ T7002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.131651][ T7002] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.131694][ T7002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.158600][ T7002] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.164582][ T7002] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.165295][ T113] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.165700][ T113] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.185316][ T113] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.185363][ T113] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.191055][ T113] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.191098][ T113] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.199395][ T5735] Bluetooth: hci4: SCO packet for unknown connection handle 3840 [ 84.430654][ T7002] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.436077][ T43] kauditd_printk_skb: 14 callbacks suppressed [ 84.436088][ T43] audit: type=1400 audit(1792415481.822:602): avc: denied { write } for pid=7094 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 84.446385][ T6367] usb 9-1: new full-speed USB device number 3 using dummy_hcd [ 84.472234][ T5441] 8021q: adding VLAN 0 to HW filter on device eth8 [ 84.507052][ T7102] bond0: (slave bond_slave_0): Releasing backup interface [ 84.511631][ T7102] bond0: (slave bond_slave_1): Releasing backup interface [ 84.544304][ T43] audit: type=1400 audit(1792415481.932:603): avc: denied { write } for pid=7103 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 84.585085][ T43] audit: type=1400 audit(1792415481.972:604): avc: denied { write } for pid=7110 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 84.592103][ T7002] veth0_vlan: entered promiscuous mode [ 84.595784][ T7002] veth1_vlan: entered promiscuous mode [ 84.599037][ T6367] usb 9-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 84.599925][ T6367] usb 9-1: config 0 has an invalid interface number: 3 but max is 0 [ 84.599938][ T6367] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 84.599947][ T6367] usb 9-1: config 0 has no interface number 0 [ 84.603821][ T6367] usb 9-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 84.603834][ T6367] usb 9-1: Product: syz [ 84.603842][ T6367] usb 9-1: Manufacturer: syz [ 84.603849][ T6367] usb 9-1: SerialNumber: syz [ 84.611880][ T6367] usb 9-1: config 0 descriptor?? [ 84.621776][ T7002] veth0_macvtap: entered promiscuous mode [ 84.625957][ T7002] veth1_macvtap: entered promiscuous mode [ 84.635497][ T7002] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.656015][ T7002] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.660841][ T5441] 8021q: adding VLAN 0 to HW filter on device eth9 [ 84.689099][ T5735] Bluetooth: hci2: command tx timeout [ 84.713806][ T7115] FAULT_INJECTION: forcing a failure. [ 84.713806][ T7115] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 84.713835][ T7115] CPU: 2 UID: 0 PID: 7115 Comm: syz.2.369 Not tainted syzkaller #0 PREEMPT(full) [ 84.713855][ T7115] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 84.713866][ T7115] Call Trace: [ 84.713872][ T7115] [ 84.713880][ T7115] dump_stack_lvl+0x100/0x190 [ 84.713913][ T7115] should_fail_ex.cold+0x5/0xa [ 84.713941][ T7115] _copy_to_user+0x32/0xd0 [ 84.713971][ T7115] simple_read_from_buffer+0xcb/0x170 [ 84.714015][ T7115] proc_fail_nth_read+0x1af/0x230 [ 84.714042][ T7115] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 84.714069][ T7115] ? rw_verify_area+0xce/0x6d0 [ 84.714086][ T7115] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 84.714103][ T7115] vfs_read+0x1e4/0xb40 [ 84.714117][ T7115] ? lock_acquire+0x1d1/0x380 [ 84.714129][ T7115] ? __fget_files+0x34/0x3d0 [ 84.714145][ T7115] ? __pfx_vfs_read+0x10/0x10 [ 84.714157][ T7115] ? find_held_lock+0x2b/0x80 [ 84.714173][ T7115] ? __fget_files+0x215/0x3d0 [ 84.714192][ T7115] ? __fget_files+0x21f/0x3d0 [ 84.714211][ T7115] ksys_read+0x12a/0x250 [ 84.714229][ T7115] ? __pfx_ksys_read+0x10/0x10 [ 84.714261][ T7115] do_syscall_64+0x123/0x790 [ 84.714283][ T7115] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.714295][ T7115] RIP: 0033:0x7fa4be75ed8e [ 84.714304][ T7115] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 84.714315][ T7115] RSP: 002b:00007fa4bf64bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 84.714327][ T7115] RAX: ffffffffffffffda RBX: 00007fa4bf64c6c0 RCX: 00007fa4be75ed8e [ 84.714334][ T7115] RDX: 000000000000000f RSI: 00007fa4bf64c0a0 RDI: 0000000000000004 [ 84.714341][ T7115] RBP: 00007fa4bf64c090 R08: 0000000000000000 R09: 0000000000000000 [ 84.714347][ T7115] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 84.714354][ T7115] R13: 00007fa4bea26038 R14: 00007fa4bea25fa0 R15: 00007ffe424f1988 [ 84.714369][ T7115] [ 84.730579][ T75] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.730592][ T75] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.738747][ T13] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.738953][ T13] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.739073][ T13] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.739092][ T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.750528][ T75] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.750540][ T75] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.791697][ T43] audit: type=1400 audit(1792415482.182:605): avc: denied { setattr } for pid=7117 comm="syz.2.370" name="file0" dev="tmpfs" ino=573 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 84.823529][ T7124] tmpfs: Bad value for 'mpol' [ 84.825047][ T29] usb 9-1: USB disconnect, device number 3 [ 84.845481][ T43] audit: type=1400 audit(1792415482.232:606): avc: denied { setopt } for pid=7126 comm="syz.5.372" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 84.845526][ T7127] tipc: Trying to set illegal importance in message [ 84.870380][ T7129] netlink: 28 bytes leftover after parsing attributes in process `syz.5.374'. [ 84.870408][ T7129] netlink: 28 bytes leftover after parsing attributes in process `syz.5.374'. [ 84.871330][ T43] audit: type=1326 audit(1792415482.262:607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7128 comm="syz.5.374" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc0fe59e559 code=0x0 [ 84.982989][ T43] audit: type=1400 audit(1792415482.372:608): avc: denied { create } for pid=7143 comm="syz.0.379" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 85.001102][ T43] audit: type=1400 audit(1792415482.392:609): avc: denied { read } for pid=7143 comm="syz.0.379" path="socket:[17399]" dev="sockfs" ino=17399 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 85.017301][ T43] audit: type=1400 audit(1792415482.412:610): avc: denied { recv } for pid=28 comm="ksoftirqd/1" saddr=127.0.0.1 src=56470 daddr=127.0.0.1 dest=3 ** replaying previous printk message ** [ 85.017301][ T43] audit: type=1400 audit(1792415482.412:610): avc: denied { recv } for pid=28 comm="ksoftirqd/1" saddr=127.0.0.1 src=56470 daddr=127.0.0.1 dest=30000 netif=lo scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 85.031208][ T43] audit: type=1400 audit(1792415482.422:611): avc: denied { ioctl } for pid=7070 comm="syz.4.366" path="socket:[17967]" dev="sockfs" ino=17967 ioctlcmd=0x61f2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 85.032433][ T7142] [ 85.054620][ T7142] ====================================================== [ 85.057514][ T7142] WARNING: possible circular locking dependency detected [ 85.060392][ T7142] syzkaller #0 Not tainted [ 85.062299][ T7142] ------------------------------------------------------ [ 85.065173][ T7142] syz.2.378/7142 is trying to acquire lock: [ 85.067642][ T7142] ffffffff8ffcb300 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_noprof+0x63/0x6a0 [ 85.071555][ T7142] [ 85.071555][ T7142] but task is already holding lock: [ 85.074591][ T7142] ffff88802b269680 (&q->blkcg_mutex){+.+.}-{4:4}, at: blkg_conf_prep+0xbc/0xf10 [ 85.078340][ T7142] [ 85.078340][ T7142] which lock already depends on the new lock. [ 85.078340][ T7142] [ 85.081903][ T7142] [ 85.081903][ T7142] the existing dependency chain (in reverse order) is: [ 85.084659][ T7142] [ 85.084659][ T7142] -> #2 (&q->blkcg_mutex){+.+.}-{4:4}: [ 85.086987][ T7142] lock_acquire+0x1d1/0x380 [ 85.088565][ T7142] __mutex_lock+0x1a4/0x1bd0 [ 85.090134][ T7142] blkcg_activate_policy+0x34f/0xbf0 [ 85.091948][ T7142] blk_throtl_init+0x39a/0x5b0 [ 85.093571][ T7142] tg_set_conf.isra.0+0x252/0x500 [ 85.095268][ T7142] cgroup_file_write+0x1e6/0x8a0 [ 85.096936][ T7142] kernfs_fop_write_iter+0x3e0/0x5f0 [ 85.098708][ T7142] vfs_write+0x6af/0x1050 [ 85.100205][ T7142] ksys_write+0x12a/0x250 [ 85.101708][ T7142] do_syscall_64+0x123/0x790 [ 85.103321][ T7142] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.105323][ T7142] [ 85.105323][ T7142] -> #1 (&q->q_usage_counter(io)#65){++++}-{0:0}: [ 85.107954][ T7142] lock_acquire+0x1d1/0x380 [ 85.109510][ T7142] blk_alloc_queue+0x610/0x790 [ 85.111185][ T7142] __blk_alloc_disk+0xa0/0x170 [ 85.112840][ T7142] zram_add+0x1bf/0x5d0 [ 85.114326][ T7142] zram_init+0x11c/0x160 [ 85.115838][ T7142] do_one_initcall+0x11c/0x6f0 [ 85.117463][ T7142] kernel_init_freeable+0x6ea/0x7b0 [ 85.119188][ T7142] kernel_init+0x21/0x1e0 [ 85.120805][ T7142] ret_from_fork+0x730/0xd60 [ 85.122398][ T7142] ret_from_fork_asm+0x1a/0x30 [ 85.124808][ T7142] [ 85.124808][ T7142] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 85.126995][ T7142] check_prev_add+0xeb/0xe60 [ 85.128594][ T7142] __lock_acquire+0x1528/0x1f40 [ 85.130246][ T7142] lock_acquire+0x1d1/0x380 [ 85.131764][ T7142] fs_reclaim_acquire+0xc4/0x100 [ 85.133385][ T7142] kmem_cache_alloc_noprof+0x63/0x6a0 [ 85.135188][ T7142] __radix_tree_preload+0x333/0x820 [ 85.136936][ T7142] blkg_conf_prep+0x489/0xf10 [ 85.138523][ T7142] tg_set_conf.isra.0+0x1ed/0x500 [ 85.140204][ T7142] cgroup_file_write+0x1e6/0x8a0 [ 85.141859][ T7142] kernfs_fop_write_iter+0x3e0/0x5f0 [ 85.143654][ T7142] vfs_write+0x6af/0x1050 [ 85.145192][ T7142] ksys_write+0x12a/0x250 [ 85.146694][ T7142] do_syscall_64+0x123/0x790 [ 85.148302][ T7142] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.150305][ T7142] [ 85.150305][ T7142] other info that might help us debug this: [ 85.150305][ T7142] [ 85.153393][ T7142] Chain exists of: [ 85.153393][ T7142] fs_reclaim --> &q->q_usage_counter(io)#65 --> &q->blkcg_mutex [ 85.153393][ T7142] [ 85.157466][ T7142] Possible unsafe locking scenario: [ 85.157466][ T7142] [ 85.159692][ T7142] CPU0 CPU1 [ 85.161334][ T7142] ---- ---- [ 85.162998][ T7142] lock(&q->blkcg_mutex); [ 85.164399][ T7142] lock(&q->q_usage_counter(io)#65); [ 85.166780][ T7142] lock(&q->blkcg_mutex); [ 85.168900][ T7142] lock(fs_reclaim); [ 85.170116][ T7142] [ 85.170116][ T7142] *** DEADLOCK *** [ 85.170116][ T7142] [ 85.172563][ T7142] locks held by syz.2.378/7142: 6, last CPU#1: [ 85.174417][ T7142] #0: ffff88803aff29b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 85.177182][ T7142] #1: ffff888038eb2460 (sb_writers#11){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 85.179921][ T7142] #2: ffff888057644080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 85.182769][ T7142] #3: ffff888058932698 (kn->active#76){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 85.185971][ T7142] #4: ffff88802b269500 (&q->rq_qos_mutex){+.+.}-{4:4}, at: blkg_conf_open_bdev+0x253/0x410 [ 85.189062][ T7142] #5: ffff88802b269680 (&q->blkcg_mutex){+.+.}-{4:4}, at: blkg_conf_prep+0xbc/0xf10 [ 85.191913][ T7142] [ 85.191913][ T7142] stack backtrace: [ 85.193688][ T7142] CPU: 1 UID: 0 PID: 7142 Comm: syz.2.378 Not tainted syzkaller #0 PREEMPT(full) [ 85.196502][ T7142] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.199551][ T7142] Call Trace: [ 85.200611][ T7142] [ 85.201535][ T7142] dump_stack_lvl+0x100/0x190 [ 85.203014][ T7142] print_circular_bug.cold+0x178/0x1be [ 85.204702][ T7142] check_noncircular+0x146/0x160 [ 85.206221][ T7142] check_prev_add+0xeb/0xe60 [ 85.207663][ T7142] ? check_noncircular+0x97/0x160 [ 85.209224][ T7142] __lock_acquire+0x1528/0x1f40 [ 85.210784][ T7142] lock_acquire+0x1d1/0x380 [ 85.212182][ T7142] ? kmem_cache_alloc_noprof+0x63/0x6a0 [ 85.213865][ T7142] fs_reclaim_acquire+0xc4/0x100 [ 85.215421][ T7142] ? kmem_cache_alloc_noprof+0x63/0x6a0 [ 85.217107][ T7142] kmem_cache_alloc_noprof+0x63/0x6a0 [ 85.218738][ T7142] ? __radix_tree_preload+0x2f4/0x820 [ 85.220437][ T7142] ? __radix_tree_preload+0x333/0x820 [ 85.221998][ T7142] __radix_tree_preload+0x333/0x820 [ 85.223659][ T7142] blkg_conf_prep+0x489/0xf10 [ 85.225123][ T7142] tg_set_conf.isra.0+0x1ed/0x500 [ 85.226685][ T7142] ? __pfx_tg_set_conf.isra.0+0x10/0x10 [ 85.228409][ T7142] ? kernfs_root+0xf8/0x2a0 [ 85.229826][ T7142] cgroup_file_write+0x1e6/0x8a0 [ 85.231338][ T7142] ? __pfx_tg_set_conf_uint+0x10/0x10 [ 85.233016][ T7142] ? __pfx_cgroup_file_write+0x10/0x10 [ 85.234673][ T7142] ? __kmalloc_noprof+0x350/0x840 [ 85.236238][ T7142] kernfs_fop_write_iter+0x3e0/0x5f0 [ 85.237860][ T7142] ? __pfx_cgroup_file_write+0x10/0x10 [ 85.239557][ T7142] vfs_write+0x6af/0x1050 [ 85.240895][ T7142] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 85.242684][ T7142] ? __pfx_vfs_write+0x10/0x10 [ 85.244182][ T7142] ? find_held_lock+0x2b/0x80 [ 85.245658][ T7142] ksys_write+0x12a/0x250 [ 85.246996][ T7142] ? __pfx_ksys_write+0x10/0x10 [ 85.248536][ T7142] do_syscall_64+0x123/0x790 [ 85.249981][ T7142] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.251830][ T7142] RIP: 0033:0x7fa4be79e559 [ 85.253227][ T7142] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.258998][ T7142] RSP: 002b:00007fa4bf64c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 85.261555][ T7142] RAX: ffffffffffffffda RBX: 00007fa4bea25fa0 RCX: 00007fa4be79e559 [ 85.264020][ T7142] RDX: 0000000000000007 RSI: 0000200000000200 RDI: 000000000000000c [ 85.266452][ T7142] RBP: 00007fa4be835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 85.268852][ T7142] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.271288][ T7142] R13: 00007fa4bea26038 R14: 00007fa4bea25fa0 R15: 00007ffe424f1988 [ 85.273699][ T7142] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 85.316318][ T5817] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 85.413887][ T6467] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.451415][ T6467] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.559502][ T6467] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.649755][ T6467] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.742898][ T6467] bridge_slave_1: left allmulticast mode [ 85.742921][ T6467] bridge_slave_1: left promiscuous mode [ 85.743045][ T6467] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.744307][ T6467] bridge_slave_0: left allmulticast mode [ 85.744322][ T6467] bridge_slave_0: left promiscuous mode [ 85.744420][ T6467] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.791825][ T6467] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 85.793429][ T6467] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 85.794746][ T6467] bond0 (unregistering): Released all slaves [ 85.802804][ T6467] bond1 (unregistering): Released all slaves [ 85.849823][ T5441] 8021q: adding VLAN 0 to HW filter on device eth10 [ 85.864154][ T6467] tipc: Disabling bearer [ 85.864281][ T6467] tipc: Left network mode [ 85.952518][ T5441] 8021q: adding VLAN 0 to HW filter on device eth11 [ 86.040534][ T5441] 8021q: adding VLAN 0 to HW filter on device eth12 [ 86.078039][ T6467] hsr_slave_0: left promiscuous mode [ 86.078500][ T6467] hsr_slave_1: left promiscuous mode [ 86.078726][ T6467] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 86.078736][ T6467] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 86.079020][ T6467] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 86.079029][ T6467] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 86.080648][ T6467] veth1_macvtap: left promiscuous mode [ 86.080682][ T6467] veth1_vlan: left promiscuous mode [ 86.080704][ T6467] veth0_vlan: left promiscuous mode [ 86.144632][ T6467] team0 (unregistering): Port device team_slave_1 removed [ 86.149032][ T6467] team0 (unregistering): Port device team_slave_0 removed [ 86.173718][ T5441] 8021q: adding VLAN 0 to HW filter on device eth13 [ 86.509914][ T6467] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.540631][ T6467] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.580481][ T6467] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.629587][ T6467] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.701907][ T6467] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.749881][ T6467] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.790965][ T5441] 8021q: adding VLAN 0 to HW filter on device eth14 [ 86.802008][ T6467] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.859378][ T6467] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.890103][ T5441] 8021q: adding VLAN 0 to HW filter on device eth15 [ 86.918838][ T6467] dummy0: left allmulticast mode [ 86.918895][ T6467] dummy0: left promiscuous mode [ 86.918975][ T6467] bridge0: port 4(dummy0) entered disabled state [ 86.919837][ T6467] vlan2: left allmulticast mode [ 86.919848][ T6467] geneve0: left allmulticast mode [ 86.919856][ T6467] vlan2: left promiscuous mode [ 86.919862][ T6467] geneve0: left promiscuous mode [ 86.920004][ T6467] bridge0: port 3(vlan2) entered disabled state [ 86.920993][ T6467] bridge_slave_1: left allmulticast mode [ 86.921008][ T6467] bridge_slave_1: left promiscuous mode [ 86.921098][ T6467] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.922239][ T6467] bridge_slave_0: left allmulticast mode [ 86.922250][ T6467] bridge_slave_0: left promiscuous mode [ 86.922301][ T6467] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.924513][ T6467] bridge_slave_1: left allmulticast mode [ 86.924523][ T6467] bridge_slave_1: left promiscuous mode [ 86.924579][ T6467] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.925213][ T6467] bridge_slave_0: left allmulticast mode [ 86.925224][ T6467] bridge_slave_0: left promiscuous mode [ 86.925276][ T6467] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.983910][ T6467] bond0 (unregistering): Released all slaves [ 86.985000][ T6467] bond1 (unregistering): Released all slaves [ 87.003222][ T6467] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 87.004416][ T6467] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 87.005103][ T6467] bond0 (unregistering): Released all slaves [ 87.006721][ T5441] 8021q: adding VLAN 0 to HW filter on device eth16 [ 87.135389][ T5441] 8021q: adding VLAN 0 to HW filter on device eth17 [ 87.240365][ T5441] 8021q: adding VLAN 0 to HW filter on device eth18 [ 87.366655][ T5441] 8021q: adding VLAN 0 to HW filter on device eth19 [ 87.427930][ T6467] hsr_slave_0: left promiscuous mode [ 87.430807][ T6467] hsr_slave_1: left promiscuous mode [ 87.431183][ T6467] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 87.431197][ T6467] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 87.432545][ T6467] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 87.432558][ T6467] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 87.440667][ T6467] hsr_slave_0: left promiscuous mode [ 87.443765][ T6467] hsr_slave_1: left promiscuous mode [ 87.444190][ T6467] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 87.444204][ T6467] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 87.448690][ T6467] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 87.448705][ T6467] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 87.454518][ T6467] veth1_macvtap: left promiscuous mode [ 87.454574][ T6467] veth1_vlan: left promiscuous mode [ 87.454610][ T6467] veth0_vlan: left promiscuous mode [ 87.465539][ T6467] veth1_macvtap: left promiscuous mode [ 87.465565][ T6467] veth0_macvtap: left promiscuous mode [ 87.465614][ T6467] veth1_vlan: left promiscuous mode [ 87.465649][ T6467] veth0_vlan: left promiscuous mode [ 87.585731][ T6467] team0 (unregistering): Port device team_slave_1 removed [ 87.589909][ T6467] team0 (unregistering): Port device team_slave_0 removed [ 87.675161][ T6467] team0 (unregistering): Port device team_slave_1 removed [ 87.680683][ T6467] team0 (unregistering): Port device team_slave_0 removed [ 87.705706][ T5441] 8021q: adding VLAN 0 to HW filter on device eth20 [ 87.837937][ T5441] 8021q: adding VLAN 0 to HW filter on device eth21 [ 88.122291][ T6467] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.318878][ T6467] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.370124][ T6467] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.419519][ T6467] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.537758][ T6467] bridge_slave_1: left allmulticast mode [ 88.537774][ T6467] bridge_slave_1: left promiscuous mode [ 88.537855][ T6467] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.539123][ T6467] bridge_slave_0: left allmulticast mode [ 88.539141][ T6467] bridge_slave_0: left promiscuous mode [ 88.539248][ T6467] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.578409][ T6467] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 88.579302][ T6467] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 88.579918][ T6467] bond0 (unregistering): Released all slaves [ 88.695955][ T5441] 8021q: adding VLAN 0 to HW filter on device eth22 [ 88.732960][ T6467] hsr_slave_0: left promiscuous mode [ 88.733279][ T6467] hsr_slave_1: left promiscuous mode [ 88.733667][ T6467] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 88.733687][ T6467] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 88.734086][ T6467] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 88.734094][ T6467] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 88.735719][ T6467] veth1_macvtap: left promiscuous mode [ 88.735734][ T6467] veth0_macvtap: left promiscuous mode [ 88.735764][ T6467] veth1_vlan: left promiscuous mode [ 88.735785][ T6467] veth0_vlan: left promiscuous mode [ 88.805013][ T6467] team0 (unregistering): Port device team_slave_1 removed [ 88.810835][ T6467] team0 (unregistering): Port device team_slave_0 removed [ 88.837082][ T5441] 8021q: adding VLAN 0 to HW filter on device eth23 [ 88.946167][ T5441] 8021q: adding VLAN 0 to HW filter on device eth24 [ 89.057718][ T5441] 8021q: adding VLAN 0 to HW filter on device eth25