last executing test programs: 52.595922266s ago: executing program 0 (id=25): openat$cdrom(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}}) 52.497980043s ago: executing program 0 (id=28): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3a8, 0x0, 0x148, 0x1e0, 0x278, 0x310, 0xb0, 0x148, 0x1e0, 0x278, 0x310, 0x6, 0x0, {[{{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x11}, 0x0, 0x70, 0xb0}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x1000000, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x408) 52.444802717s ago: executing program 0 (id=29): r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/cache_bypass\x00', 0x2, 0x0) fchmod(r0, 0xa1) mount(&(0x7f0000000040)=@sg0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x840002, &(0x7f0000000100)='^+\x00') r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000180)={'sit0\x00', &(0x7f0000000140)={@dev={0xfe, 0x80, '\x00', 0x25}, @empty, 0x16, 0x14}}) ioctl$VIDIOC_G_SELECTION(r0, 0xc040565e, &(0x7f00000001c0)={0xd, 0x2, 0x0, {0x1, 0x2, 0x4, 0x57146232}}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000200)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r2}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f00000002c0)={0x48, 0x7, r0, 0x0, 0x0, 0x0, 0x7, 0x30c255, 0x2d0e94}) mknodat(r0, &(0x7f0000000340)='./file0\x00', 0x0, 0xfffffffb) getsockopt$inet_opts(r1, 0x0, 0x9, &(0x7f0000000380)=""/83, &(0x7f0000000400)=0x53) write$char_usb(r0, &(0x7f0000000440)="ee1bd37b23efaab2deebbec28185a9445f5ddfe0c06585d934b8619cbaa5e662f28b93d43f2424f3def33dca130fad1644ce8c130ac2807a59016b4f57fc9123db71e908dda1c9da93f9e7e481fd48a14df0e357cc4d96beb9c5c677f145cebb6ad5249ef699502598673a44e10f16cdbe4552dc2ed2c7753b5f49a44b585926247365fdff0d25932be90d8dea4e439d35b3a697bca56e8f1f7c925a3cd1501a54fb946365da96e460e4af714f", 0xad) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000500), 0x80000, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000540)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x34}}, 0x10) ioctl$PTP_PIN_GETFUNC(r0, 0xc0603d06, &(0x7f0000000580)={'\x00', 0x2, 0x6, 0xc47a}) lsetxattr$trusted_overlay_upper(&(0x7f0000000600)='./file0\x00', &(0x7f0000000640), &(0x7f0000000680)={0x0, 0xfb, 0x4c, 0x4, 0x8e, "2322d04d91f6429a6e0afc53b7ae91af", "3e33ac2bfb47dd465e248f8d79dd14aa5c40d5e5c04cc76182171065a1c21bbd0d448f29836a318a978ff093197f16f376adfceeaf5c47"}, 0x4c, 0x1) recvmsg$unix(r0, &(0x7f0000001a00)={0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000700)=""/177, 0xb1}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f0000000880)=""/4096, 0x1000}, {&(0x7f0000001880)=""/198, 0xc6}], 0x4, &(0x7f00000019c0)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x2005) rmdir(&(0x7f0000001a40)='./file0\x00') ioctl$INCFS_IOC_PERMIT_FILL(r3, 0x40046721, &(0x7f0000001a80)={r0}) ioctl(r3, 0x1, &(0x7f0000001ac0)="80fae4772caca092c031aa7bcae1cbad6376ec3372fa47c6050bd513e631e5f04fb9a6c87a0dc7fa4ae1ae025e5b81b8a93a8d5ad2795aa2ea66a6ba9b4d6b465634b0cdaf622c2e2d8a684f47c5bc5bb262d2d7beec57ec7245a6b4f58b35b34f7300f59684711e4755a15d98616042aa4be5784af656d97fbc6e5a42e80d58581dbbbc3eae48d67e8c87a0b499bae17d9f19ffd1e13785aac40e3d6fc0a65498bab031e2f1f67eb92dec8a1eaec66d557cfae692d969a66e778d3f445903418a7d7ca87d480d823bef78d0ce8c3178b3a556a234313ed5c275c5f22396b2495f") ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000001bc0)={'ip6gre0\x00'}) read$nci(r0, &(0x7f0000001c00)=""/204, 0xcc) write$fb(r0, &(0x7f0000001d00)="86d2c506262ea989ef75f6977004d781b6987d79aba391b955c1056de114e29aca281cf5de4513dcf440e19c59acdd80a21967edcbc3e69741371b0727cfec7fcccc3c7a18d56d43f9f481ef70e5ef114564cb6cb7749bace85542fef2ecb6ceb717b859670fd426a12254ddade4198fbe08cff1f518ca539549d8b761877d6707f7111ccddaf0171ac38b52353da19ba4e28dde4734325f400e374bdb551f3cde44ad2d4add6fc15ce2739950c3d72df0fdf934e854a2e9a19ad8274bca430a005f1ee8dcb2938ddbd1c1a1370f88", 0xcf) truncate(&(0x7f0000001e00)='./file0\x00', 0x8000) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000001e80)={0x0, &(0x7f0000001e40)}, 0x10) r4 = mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0x4, 0x2000000, 0x50, r0, 0x20000000) r5 = mmap$IORING_OFF_SQ_RING(0x0, 0x7f, 0x2, 0x80010, r0, 0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r4, r5, 0x0, &(0x7f0000001ec0)=@IORING_OP_FALLOCATE={0x11, 0x29, 0x0, @fd=r0, 0x3, 0x0, 0x7ff, 0x0, 0x1, {0x0, r6}}) 52.396023577s ago: executing program 0 (id=30): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) (async) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) (async) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000240)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x26, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @empty, @empty}, {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0) mount$bind(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005c48, 0x0) mount(0x0, &(0x7f0000000d40)='./file0/../file0/../file0\x00', &(0x7f0000000040)='sysfs\x00', 0x10, 0x0) umount2(&(0x7f00000002c0)='./file0/../file0/../file0\x00', 0x0) 52.395613303s ago: executing program 0 (id=31): r0 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$setperm(0x5, r0, 0x0) keyctl$set_timeout(0xf, r0, 0x100000000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) pwritev2(r1, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfb}], 0x1, 0x5412, 0x8000000, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f00000003c0)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@xino_auto}]}) 52.106513775s ago: executing program 0 (id=36): setns(0xc9, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000016000008001b"], 0x30}}, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r1, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x7}) ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000080)={'team0\x00', @ifru_ivalue=0x1}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r2, 0x8949, &(0x7f0000000000)) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x90340, 0x0) 52.092502685s ago: executing program 32 (id=36): setns(0xc9, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000016000008001b"], 0x30}}, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r1, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x7}) ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000080)={'team0\x00', @ifru_ivalue=0x1}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r2, 0x8949, &(0x7f0000000000)) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x90340, 0x0) 33.066383293s ago: executing program 2 (id=309): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000006000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000080)="36450f6fe3c74424020600000088442406000000000f01142466b87a000f00d066b876000f00d0400f9ce4660f38823d00300000410f01dfb9800000c00f3235000400000f3045f7b300000000430f21e3420f00d5", 0x56}], 0x1, 0x0, 0x0, 0xb7) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000000bc0)=[{{&(0x7f00000084c0)={0xa, 0x4e21, 0x7, @private0={0xfc, 0x0, '\x00', 0x1}}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000008500)="88", 0x1}], 0x1}}], 0x1, 0x24040040) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e21, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}, 0xc}}, 0x6, 0x7, 0x0, 0xc7b, 0x0, 0x9, 0xc}, &(0x7f0000000100)=0x9c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40280, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x0, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x3) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text64={0x40, 0x0}], 0x1, 0x6b, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 32.936522103s ago: executing program 2 (id=311): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r0, &(0x7f0000001040)={0x27, 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3c}, 0x60) r1 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000000)=@id, &(0x7f0000000040)=0x10, 0x80000) listen(r1, 0x9) socket$netlink(0x10, 0x3, 0xa) accept(r0, 0x0, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) (async) bind$nfc_llcp(r0, &(0x7f0000001040)={0x27, 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3c}, 0x60) (async) accept4$tipc(0xffffffffffffffff, &(0x7f0000000000)=@id, &(0x7f0000000040)=0x10, 0x80000) (async) listen(r1, 0x9) (async) socket$netlink(0x10, 0x3, 0xa) (async) accept(r0, 0x0, 0x0) (async) 32.935992277s ago: executing program 2 (id=312): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r4 = socket$inet(0x2, 0x2, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) r5 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10) r6 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) recvmmsg(r5, &(0x7f0000000480)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)=""/43, 0x2b}], 0x1}, 0x1}], 0x1, 0x40000182, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) close(r6) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/ipv4/ip_forward\x00', 0x1, 0x0) write(r7, &(0x7f0000000100)='1', 0x1) socket$inet(0x2, 0x2, 0x0) syz_emit_ethernet(0x86, &(0x7f0000000140)={@local, @remote, @void, {@ipv4={0x800, @udp={{0x1c, 0x4, 0x0, 0x0, 0x78, 0x1236, 0x4000, 0x40, 0x11, 0x0, @rand_addr=0x1020304, @rand_addr=0x8080808, {[@timestamp={0x44, 0x18, 0x27, 0x0, 0x0, [0x2, 0x3ff, 0xffffffff, 0x4, 0x2]}, @timestamp_addr={0x44, 0x44, 0xda, 0x1, 0x3, [{@multicast2, 0xfffffffc}, {@remote, 0x5e}, {@loopback, 0x3}, {@rand_addr=0x64010100, 0x9}, {@loopback, 0x6}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x2c}, {@multicast1, 0x200}, {@initdev={0xac, 0x1e, 0xb, 0x0}, 0x8}]}]}}, {0x1234, 0x5678, 0x8}}}}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)=@newtfilter={0x3c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xd, 0xfff2}, {0xa, 0xffff}, {0x300, 0xe}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_CT_ZONE={0x6, 0x5d, 0x1b}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008040}, 0x4000000) fsmount(r7, 0x0, 0x84) write$tun(r1, &(0x7f00000004c0)=ANY=[], 0x40) 32.846564598s ago: executing program 2 (id=313): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c020000190001000000000000000000fc020000000000000000000000000000ff02000000000000000000000000000100000003000000000200002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000005000000000000000000000000000000000084010500ac1414aa000000000000000000000000000000002b00000000000000ac14140f000000000000000000000000000000000000ff00000000000000000000000000fc020000000000000000000000000001000000003200000000000000ff02000000000000000000000000000102350000000000000000000000000000a7e7e81803710c2c000000000000000000000001000000003c00000002000000ac1414bb0000000000000000000000000000000001030000000000000700000000000000ff020000000000000000000000000001000000003c00000002000000200100000000000000000000000000000000000000000000000000000300000000000000ac1414aa00000000000000000000000000000000330000000200000000000000000000000000000000000000ffffffff0001000000000000000000000000000020010000000000000000000000000001000000003c0000000a000000ff0100000000000000000000000000010000000001"], 0x23c}}, 0x0) 32.845610035s ago: executing program 2 (id=314): pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="0a000806bbbbbbbbbbbbaaaaaaaaaa2986dd6d00d854043a19603c45889493a71154222048001011ff20010000000000000000000000000000ff0200000000000000000000000070d909ace6f4927f907882080001167bb59e"], 0x4a) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) write$tun(r0, &(0x7f0000000380)=ANY=[], 0xfdef) setns(0xc9, 0x0) r4 = fsopen(&(0x7f0000000000)='nfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000040)='source\x00', &(0x7f0000000080)='127.0.0.1:/export\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000140)='vers\x00', &(0x7f0000000180)='4.0\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x3, 0x0, 0x810, r0, 0x0) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x7b9, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsmount(r1, 0x0, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/ima/policy\x00', 0x1, 0x0) mmap$snddsp_status(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000000, 0x1010, r0, 0x82000000) write(r5, &(0x7f00000002c0)='measure uid>1', 0xd) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setitimer(0x0, &(0x7f0000000040)={{0x6, 0x9}, {0x1ff, 0x32e3}}, 0x0) alarm(0x38) sendmsg$NFT_MSG_GETTABLE(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000000126010100000300000000000300000207000600f190b200"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x840) r6 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi1\x00', 0x2, 0x0) ioctl(r6, 0x40946400, &(0x7f0000000100)='pc212e') 32.73584363s ago: executing program 2 (id=315): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3a8, 0x0, 0x148, 0x1e0, 0x278, 0x310, 0xb0, 0x148, 0x1e0, 0x278, 0x310, 0x6, 0x0, {[{{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x11}, 0x0, 0x70, 0xb0}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98, 0x0, {0x1d00}}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x408) 17.611421554s ago: executing program 33 (id=315): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3a8, 0x0, 0x148, 0x1e0, 0x278, 0x310, 0xb0, 0x148, 0x1e0, 0x278, 0x310, 0x6, 0x0, {[{{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x11}, 0x0, 0x70, 0xb0}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98, 0x0, {0x1d00}}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x408) 4.786373224s ago: executing program 3 (id=615): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=@newlink={0x5c, 0x10, 0x439, 0x3, 0x1, {0x0, 0x0, 0x0, 0x0, 0x9801, 0x1303}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x30, 0x2, 0x0, 0x1, [@IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0x8}, @IFLA_GTP_CREATE_SOCKETS={0x5}, @IFLA_GTP_LOCAL6={0x14, 0x8, @private2={0xfc, 0x2, '\x00', 0x1}}, @IFLA_GTP_ROLE={0x8, 0x4, 0x1}]}}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x40000) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000080)) 4.786139908s ago: executing program 3 (id=616): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$PNPIPE_ENCAP(r2, 0x113, 0x1, 0x0, 0x0) 4.646275983s ago: executing program 3 (id=617): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x40000001, &(0x7f0000000200)={0xffffffffffffffff}, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_CONNECT(r0, &(0x7f0000000300)={0x6, 0x118, 0xfa00, {{0x6, 0x5, "5be0e718c449817f6eb756a9b56779df21bf21638acdedd3b7ce6429a34661f34c6e4492de517aa56960429fcd107e90bda40b4163eea61107fa2f735deea106d1d898fb2ddd080b1a3662c0f4d52a774f34fe07e82ddcc955509f0408a94e76215ccfa4b3511452c67fd857b08a0e502f0b3770895a51cafc64da93733875636b6d7997dc13ea91a4737f57f849b3177d4aa1d22830967130c69736cb24d6145e2088aa757aea53ce1d99b163820c80930ccacad59922f082f5c2ed80302c16969afbe11c243f5deb3ab8c2db565327bc7492a371f3612ba2a715f8124e2a428d8edd2a99712e6e6b09573e1ccc815b51429c973fd4b9e0f839cdb11e89e60a", 0x81, 0x1, 0x5, 0x0, 0x40, 0xd3, 0x9, 0x1}, r1}}, 0x120) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x800, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000180)=0x15) ioctl(r2, 0x404c4701, &(0x7f00000001c0)="0100000000000000000000000100000001000000010000000000000020000000200000000100000001") ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000240)=0xf9) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000241)=0x3) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000242)=0x3f) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000280)=0x1) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000244)=0x1c) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000245)=0xf9) 4.282432899s ago: executing program 3 (id=618): r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) prctl$PR_SET_TSC(0x1a, 0x1) open_by_handle_at(r0, 0x0, 0x513300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x5, &(0x7f0000000080)=[{0x45, 0x2, 0x2}, {0x60}, {}, {0x6}, {0x1, 0xa, 0x0, 0x3}]}) ioctl$TUNGETDEVNETNS(r0, 0x54e3, 0x0) 4.282004093s ago: executing program 3 (id=619): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f0000000480)) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) ioctl$int_in(r1, 0x40000000af01, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000600)) r3 = dup(r2) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000300), 0x222200, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) setsockopt$bt_hci_HCI_FILTER(r5, 0x0, 0x2, &(0x7f0000000080)={0xfffd, [0x92e, 0x746ffec1], 0x4}, 0x10) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r6, 0x400455c8, 0x0) r7 = fcntl$dupfd(r1, 0x0, r4) ioctl$VHOST_SET_VRING_ADDR(r7, 0x4028af11, &(0x7f0000000440)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/251, 0x0, 0xe000}) ioctl$VHOST_NET_SET_BACKEND(r7, 0x4008af30, &(0x7f0000000080)={0x0, r3}) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f00000002c0)) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=@newtaction={0x68, 0x30, 0xb, 0x2, 0x25dfdbfc, {0x0, 0x0, 0x6a00}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x6, 0xff, 0x4, 0x6, 0x6}, 0x4}}]}, {0x4, 0xa}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f0000000000)={0x6, 'bridge0\x00', {0x1}, 0xdd3c}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000040)={0x0, 'veth0_vlan\x00', {0xffd}}) 3.525359247s ago: executing program 4 (id=622): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r2) sendmsg$NL80211_CMD_SET_PMKSA(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x44, r4, 0x1, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x2}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PMKID={0x14, 0x55, "d5551870c832d483ac85bec6efbb47a2"}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000880}, 0x400d4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}}, [0xfffffffffffffffa, 0x3, 0x7, 0x3, 0x4, 0x3, 0xc, 0x8, 0x3, 0x5, 0x7, 0x100000000, 0x6, 0x2, 0x6]}, &(0x7f00000007c0)=0x100) 3.456292229s ago: executing program 4 (id=624): r0 = socket(0x10, 0x3, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x1104000, 0x800, 0x1}, 0x20) (async) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000200)=0x1, 0x4) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) (async) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000002c0)={'wg2\x00', 0x0}) bind$xdp(r1, &(0x7f0000000100)={0x2c, 0xa, r3}, 0x10) r4 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(r5, 0x0) (async) setresuid(0x0, r5, r5) (async) bind$xdp(r0, &(0x7f0000000080)={0x2c, 0xa, r3, 0xb, r0}, 0x10) (async) recvmmsg(r1, &(0x7f000000a340)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x30140, 0x0) 3.455131129s ago: executing program 4 (id=627): sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) (async) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0xfff, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x8, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x8000, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x8, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x5, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0x5, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RGETLOCK(r1, &(0x7f00000002c0)=ANY=[], 0x200002e6) (async) read$FUSE(r0, &(0x7f0000006200)={0x2020}, 0x2020) fcntl$setpipe(r0, 0x407, 0x8011) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) getsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, &(0x7f00000002c0), &(0x7f0000000400)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/class/net/bond0/bonding/slaves\x00', 0x1, 0x0) write(r4, &(0x7f0000000300)='-v', 0x2) (async) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x44}}, 0x8004) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f000000c280)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="14030000300001000001000004"], 0x314}], 0x1}, 0x800) (async) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x9, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000}) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r8 = dup(r7) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) (async) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) (async, rerun: 64) ioctl$KVM_RUN(r9, 0xae80, 0x0) (rerun: 64) 3.045553363s ago: executing program 1 (id=632): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast1}}}, 0x88) ioctl$DRM_IOCTL_GET_CAP(0xffffffffffffffff, 0xc010640c, &(0x7f0000000000)={0x3}) accept4(r0, &(0x7f0000000040)=@pptp={0x18, 0x2, {0x0, @loopback}}, &(0x7f00000000c0)=0x80, 0x80800) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000240), 0xc040, 0x0) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f00000004c0)={0x5, {{0x2, 0x4e21, @broadcast}}, 0x1, 0x8, [{{0x2, 0x4e21, @multicast2}}, {{0x2, 0x4e23, @rand_addr=0x64010102}}, {{0x2, 0x4e22, @private=0xa010102}}, {{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {{0x2, 0x4e22, @private=0xa010101}}, {{0x2, 0x4e24, @empty}}, {{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xa}}}, {{0x2, 0x4e22, @empty}}]}, 0x490) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x32, &(0x7f0000000f00)=0x1000000, 0x4) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='mountinfo\x00') r6 = syz_open_dev$vivid(&(0x7f0000000280), 0x3, 0x2) pwrite64(r6, &(0x7f0000000380), 0x0, 0x9) mount$9p_virtio(&(0x7f0000000000), &(0x7f00000002c0)='.\x00', &(0x7f0000001b00), 0x10000, &(0x7f0000000640)=ANY=[@ANYBLOB='trans=virtio,posixacl,noxattr,']) read$FUSE(r5, &(0x7f00000045c0)={0x2020}, 0x2020) r7 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r7, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r7, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f0000000340)={0xa00000, 0x3, 0x7, 0xffffffffffffffff, 0x0, &(0x7f0000000300)={0x990a6a, 0x2, '\x00', @ptr=0xffffffffffffff7d}}) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r8, 0x0, 0x60, &(0x7f0000000800)={'filter\x00', 0x104, 0x4, 0x3c8, 0x110, 0x110, 0x110, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@arp={@empty, @broadcast, 0x0, 0x0, 0x0, 0x0, {@mac}, {@empty, {[0x0, 0x0, 0x0, 0xff]}}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 'dvmrp0\x00', 'netdevsim0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @empty, @dev={0xac, 0x14, 0x14, 0x41}, @rand_addr=0x64010101, 0x8, 0x1}}}, {{@arp={@loopback, @local, 0x0, 0x0, 0x0, 0x0, {@mac=@local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg0\x00', 'veth0\x00', {}, {}, 0x0, 0x20}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0x80ca, 0x8}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f00000000c0)={[0x8, 0x100000f, 0x9, 0x0, 0x5, 0x0, 0x2, 0x87b, 0x2, 0xffffffffffffffff, 0x0, 0x4, 0x6, 0x6, 0x1, 0x3], 0x0, 0x8340}) ioctl$KVM_RUN(r7, 0xae80, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="680000001000ffff2bbd7000bbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="100a0500a31f0500480012800e00010069703665727370616e00000034000280060003003000000014009a6ad03c0700fc02000200000000000000000000000014000600fc0200000000080000000000"], 0x68}, 0x1, 0x20000, 0x0, 0x240440d5}, 0x9080) 2.884929741s ago: executing program 1 (id=634): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc409541aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d7e083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e684fe16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f149319f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000014c0)={0x2c, 0x41, 0x1, 0x70bd29, 0x4, {0x1}, [@nested={0x4, 0x47}, @nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x10, 0x0, 0x1, [@nested={0x4, 0x4}]}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd=r3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x400c801}, 0x24008094) 2.745785003s ago: executing program 1 (id=635): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200), 0x1, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000180)=0x2000000c) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000002c0)=0x7e) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000240)=0xd9) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000700)=@newqdisc={0x3c, 0x24, 0x405, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x2, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_ECN={0x8}]}}]}, 0x3c}}, 0x0) ioctl$F2FS_IOC_RESIZE_FS(r1, 0x4008f510, &(0x7f0000000140)) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e, 0x2}, 0x18, 0x0) landlock_restrict_self(r2, 0xe) r3 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r3, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev}, 0x80, 0x0}, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000540)=0x9) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000040)=0xa4) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000080)=0xc) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x7e) r4 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) r5 = syz_open_dev$dvb_frontend(&(0x7f0000000300), 0x6, 0x20000) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000340)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) ioctl$VIDIOC_S_EXT_CTRLS(r4, 0xc0205647, &(0x7f0000000200)={0x4, 0x1, 0xfffffffe, 0xffffffffffffffff, 0x0, &(0x7f00000001c0)={0x98f909, 0x7fff, '\x00', @value64=0x2}}) r6 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x2, 0x20a00) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = socket$inet6(0xa, 0x3, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) setsockopt$inet6_tcp_int(r7, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r7, &(0x7f00000003c0)="a6", 0x1, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) ioctl$USBDEVFS_CLAIMINTERFACE(r6, 0x8004550f, &(0x7f0000000100)=0xffffffff) socket$nl_xfrm(0x10, 0x3, 0x6) 2.644201226s ago: executing program 1 (id=636): syz_emit_ethernet(0x68, &(0x7f0000000140)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaa0086dd6075e70000323a00fe800000000000000000000000000000ff020000000000000000000000000001040090780000000060a3579e00002c00fe880000000000000000004bc9710000000001fe8000000000000000000000000000bb6be2e1362594219ec2246e2e8a2813813f4c2dd95b8347291aba6dfbbc9708efd0df59e05b199cb3a034c62650a0a91fb93ba1b9907c3c464d73b383c37def2a9e30f3f8b2588862754d69ef1901772e34212a3727329443ff1f0473a29c239d62e5fde2cf69e5ac23083801a70bb068ee476d282e948b1e5fd3111999c92ac6b78270"], 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000040)=@ipv6_newrule={0x58, 0x20, 0x1, 0x0, 0x25dfdbff, {0xa, 0x80, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x10018}, [@FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0x2d}}, @FRA_DST={0x14, 0x1, @mcast1}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0xfe, 0x0}}]}, 0x58}}, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000240), 0x101402, 0x0) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r0) ioctl$VIDIOC_SUBDEV_G_FMT(0xffffffffffffffff, 0xc0585604, &(0x7f0000000100)={0x0, 0x0, {0x653e, 0x5, 0x201d, 0x3, 0x7, 0x2, 0x2, 0x7}}) set_mempolicy(0x2, &(0x7f00000000c0)=0x10, 0x2a2b) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x2a532d1, 0x0) mount$bind(&(0x7f0000000200)='.\x00', &(0x7f0000000500)='./file0/../file0/file0\x00', 0x0, 0x2127099, 0x0) umount2(&(0x7f0000000080)='./file0/../file0/file0\x00', 0x2) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="6c0000000206050000000000000000000000fffc120003006269746d61703a69702c6d616300000005000400000000000900020073797a310000000020000780050003001f0000000c000180080001e20f0000ff08000840000000ed05000500020000000500010006"], 0x6c}, 0x1, 0x0, 0x0, 0x4010}, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000805000100070000000900020073797a30000000001400078008001240001500000500150000100000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}}, 0x0) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES32=r2, @ANYRES64=r2], 0x14}}, 0x24000800) 2.640845742s ago: executing program 1 (id=637): r0 = fsopen(&(0x7f0000000040)='smb3\x00', 0x1) fsmount(r0, 0x1, 0x70) mmap$IORING_OFF_SQ_RING(0x0, 0xc00001, 0x1000005, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000000)='cgroup\x00', 0x101101, 0x0, 0xf, 0x0, 0x0}) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f00000000c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000240), 0x12) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0) ioctl$VIDIOC_S_INPUT(r5, 0xc0045627, 0x0) 2.386342289s ago: executing program 1 (id=638): inotify_init1(0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x400441, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x34, 0x64, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xffe0}, {0x10, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x4040004) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r6, 0xc2604111, &(0x7f0000000680)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0x1, 0xffffffff, 0xfffffffc, 0xffffffff, 0xffffffff], [0xffffffff, 0x2, 0xfffffffd, 0x80a, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0x83, 0xffffffff, 0xffffffff, 0xffffffff, 0x3, 0x3ff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x103, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0xffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r6, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_START(r6, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r6, 0x40044145, &(0x7f00000000c0)=0xf73f) ioctl$SNDRV_PCM_IOCTL_DRAIN(r6, 0x4144, 0x0) r7 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r7) getsockname$packet(r7, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) write(r7, &(0x7f00000003c0)="b289fc537dbcbac9303f46712c47e14f827c8d8063787dbf28339210371313c3efb0b51e6017aaa5acc96b2a897b4751ea27bf4cf659334e39373ce1b9a876773d427d674e4c986f5351527b75295c2a3d376cd1a434c0f692095dda666c", 0x5e) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@delchain={0x34, 0x2c, 0xf31, 0x8070bd27, 0x2000, {0x0, 0x0, 0x0, r8, {0x8}, {0xfff2, 0xffff}, {0xfff1, 0x4}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008854}, 0x4010) write(r0, &(0x7f0000000300)='1', 0x1) write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r9, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) listen(r9, 0x0) 2.381905492s ago: executing program 4 (id=639): r0 = socket(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0x6, 0x8, &(0x7f0000000a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff}, [@jmp={0x6, 0x0, 0xc, 0x0, 0x0, 0x1, 0x8}, @func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}]}, &(0x7f0000000100)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@newqdisc={0x3c, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x20000040) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x1000000) 2.35181251s ago: executing program 34 (id=638): inotify_init1(0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x400441, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x34, 0x64, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xffe0}, {0x10, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x4040004) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r6, 0xc2604111, &(0x7f0000000680)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0x1, 0xffffffff, 0xfffffffc, 0xffffffff, 0xffffffff], [0xffffffff, 0x2, 0xfffffffd, 0x80a, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0x83, 0xffffffff, 0xffffffff, 0xffffffff, 0x3, 0x3ff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x103, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0xffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r6, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_START(r6, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r6, 0x40044145, &(0x7f00000000c0)=0xf73f) ioctl$SNDRV_PCM_IOCTL_DRAIN(r6, 0x4144, 0x0) r7 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r7) getsockname$packet(r7, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) write(r7, &(0x7f00000003c0)="b289fc537dbcbac9303f46712c47e14f827c8d8063787dbf28339210371313c3efb0b51e6017aaa5acc96b2a897b4751ea27bf4cf659334e39373ce1b9a876773d427d674e4c986f5351527b75295c2a3d376cd1a434c0f692095dda666c", 0x5e) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@delchain={0x34, 0x2c, 0xf31, 0x8070bd27, 0x2000, {0x0, 0x0, 0x0, r8, {0x8}, {0xfff2, 0xffff}, {0xfff1, 0x4}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008854}, 0x4010) write(r0, &(0x7f0000000300)='1', 0x1) write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r9, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) listen(r9, 0x0) 2.306162257s ago: executing program 4 (id=641): ioctl$TIOCMBIC(0xffffffffffffffff, 0x5417, &(0x7f0000000000)=0x6b64) (async) r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x12000, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000080)={0x3, 0x0, 0x1}) (async) r1 = signalfd(r0, &(0x7f00000000c0)={[0x8a]}, 0x8) inotify_add_watch(r1, &(0x7f0000000100)='./file0\x00', 0x200) ioctl$DRM_IOCTL_VERSION(r0, 0xc0406400, &(0x7f0000000300)={0xfffffffc, 0x5, 0x8, 0x76, &(0x7f0000000140)=""/118, 0x30, &(0x7f00000001c0)=""/48, 0xf3, &(0x7f0000000200)=""/243}) (async, rerun: 32) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000340)={0x8, 0xfffe, 0x3}) (async, rerun: 32) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x101400, 0x10) fanotify_mark(r1, 0x1, 0x1008, r2, &(0x7f00000003c0)='./file0\x00') (async, rerun: 32) mmap$usbmon(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000000, 0x10, 0xffffffffffffffff, 0x200) (rerun: 32) ioctl$BTRFS_IOC_SPACE_INFO(r1, 0xc0109414, &(0x7f0000000400)={0x3b5, 0xdc4, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r1, 0x4140, 0x0) (async) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x12, r1, 0x84772000) (async, rerun: 32) r3 = ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) (async, rerun: 32) fanotify_init(0x1, 0x80000) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000005d40)='/#%,.\x00', &(0x7f0000005d80)='./file0\x00', r2) (async, rerun: 32) ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611) (async, rerun: 32) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000005e00)={0x8, &(0x7f0000005dc0)=[{0x101, 0x5, 0x8, 0xffffff90}, {0x2, 0x20, 0xa6, 0x7fff}, {0x1, 0x6, 0x3, 0x7}, {0x76b, 0x5, 0x7, 0x4}, {0x5, 0xa, 0x9, 0x3}, {0x282, 0x6, 0x3, 0x7f}, {0x7, 0x2, 0x1}, {0x2, 0x2, 0x80, 0x1}]}) syz_emit_ethernet(0x42, &(0x7f0000005e40)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x2d}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x37}, @void, {@arp={0x806, @ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x2, @local, @mcast1, @broadcast, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2d}}}}}}, &(0x7f0000005ec0)={0x1, 0x3, [0x85d, 0xc3d, 0xe78, 0xf25]}) (async) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r1, 0xc0984124, &(0x7f0000005f00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}) (async, rerun: 32) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000005fc0)={0x54, 0x7, 0x5, {0x8, 0x3e}, {0x29, 0x4}, @const={0x83, {0x3, 0x6, 0x10, 0x80}}}) (rerun: 32) r4 = openat(r2, &(0x7f0000006000)='./file0\x00', 0x40400, 0x5c) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000006080), r1) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000060c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000006300)={&(0x7f0000006040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000062c0)={&(0x7f0000006100)={0x1ac, r5, 0x4, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "f0c237738f08c7464728c53da2e51b93a47325b80f538ff4"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "c0f1cc05c4fd45a7e3840306ca96134d26bc58b5db34b21c"}, @NL80211_ATTR_MNTR_FLAGS={0x10, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MNTR_FLAGS={0x24, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "53a41ae0b4efd46917ef1f0df01e88558d4d649ee0f80986"}], @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9d9847948c0ec978849962a3153a9b5db32d5fc955d71cce"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "df2b64c2d4c1a9da19d93daab139b5b066d4f79e3f1cbe7b"}], @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'veth0_vlan\x00'}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x10, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MNTR_FLAGS={0x20, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}]]}, 0x1ac}, 0x1, 0x0, 0x0, 0x4}, 0x8000) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NODE_GET(r7, &(0x7f0000006400)={&(0x7f0000006340)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000063c0)={&(0x7f0000006380)={0x34, 0x0, 0xc20, 0x70bd2a, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0xc0858) syz_emit_ethernet(0x1e, &(0x7f0000006440)={@random="41892c17a865", @multicast, @void, {@can={0xc, {{0x1, 0x1, 0x1}, 0x2, 0x3, 0x0, 0x0, "789255489e308c17"}}}}, &(0x7f0000006480)={0x1, 0x4, [0x8d4, 0x284, 0xc87, 0x65d]}) write$tun(r1, &(0x7f00000064c0)={@void, @void, @mpls={[{0x1, 0x0, 0x1}], @ipv6=@icmpv6={0x5, 0x6, "da83c2", 0x150, 0x3a, 0x0, @mcast1, @loopback, {[@routing={0x84, 0x10, 0x2, 0x1, 0x0, [@local, @private0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private0={0xfc, 0x0, '\x00', 0x1}, @local, @mcast2, @loopback, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}]}, @fragment={0x1d, 0x0, 0x6, 0x1, 0x0, 0x10, 0x67}, @srh={0x0, 0x14, 0x4, 0xa, 0x0, 0x20, 0x5, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, @remote, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private0, @loopback, @private1={0xfc, 0x1, '\x00', 0x1}]}], @mld={0x83, 0x0, 0x0, 0x9, 0x3, @remote}}}}}, 0x17c) close_range(r4, r0, 0x2) 2.304407173s ago: executing program 4 (id=642): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000), 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, 0xffffffffffffffff, 0x0) (async, rerun: 64) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (rerun: 64) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) (async, rerun: 64) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async, rerun: 64) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x4153) (async) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000a40)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d0, 0x0, 0x111, 0x4b4, 0x1e8, 0xd4feffff, 0x300, 0x20a, 0x278, 0x300, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @private1, [0xff000000, 0x0, 0xffffffff, 0xff000000], [0x0, 0xffffffff, 0xffffff00, 0xff000000], 'wg2\x00', 'veth0_macvtap\x00', {0xff}, {0x7f}, 0x51, 0x7, 0x0, 0x22}, 0x0, 0x1c0, 0x1e8, 0x0, {}, [@common=@inet=@multiport={{0x50}, {0x2, 0x9, [0x4e22, 0x4e23, 0x4e22, 0x4e21, 0x4e20, 0x4e23, 0x4e24, 0x4e22, 0x4e22, 0x4e20, 0x4e21, 0x4e24, 0x4e20, 0x4e20, 0x4e24], [0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1], 0x1}}, @common=@unspec=@conntrack3={{0xc8}, {{@ipv6=@remote, [0xffffffff, 0x0, 0x0, 0xffffff00], @ipv6=@remote, [0x0, 0x0, 0x0, 0xff], @ipv4=@remote, [0xffffffff, 0xffffff00, 0xffffffff, 0xff], @ipv6=@local, [0xffffffff, 0xffffffff, 0xff, 0xff000000], 0x1, 0x2, 0x32, 0x4e24, 0x4e21, 0x4e22, 0x4e22, 0x1000, 0x22}, 0x100, 0x1, 0x4e22, 0x4e20, 0x4e20, 0x4e21}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x3, 0x2, 0x4}, {0x3, 0x5, 0x6}}}}, {{@ipv6={@remote, @private0, [0x0, 0x0, 0xff000000], [0xff, 0x0, 0x0, 0xffffffff], 'veth1_to_hsr\x00', 'veth0_to_bond\x00', {}, {0xff}}, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x5}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@ipv4={'\x00', '\xff\xff', @loopback}, 'wlan1\x00', {0x7}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x430) (async, rerun: 64) sendmsg$inet(0xffffffffffffffff, 0x0, 0x40080) (async, rerun: 64) syz_open_dev$radio(&(0x7f0000000080), 0x0, 0x2) 2.025315062s ago: executing program 3 (id=644): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x401, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x20008004) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000002c0)=@o_path={&(0x7f0000000280)='./file0\x00', 0x0, 0x4000, r2}, 0x18) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000440)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x5, [@decl_tag={0xc, 0x0, 0x0, 0x11, 0x1, 0x4}]}, {0x0, [0x0, 0x61, 0x5f]}}, &(0x7f00000003c0)=""/99, 0x2d, 0x63, 0x1, 0x9}, 0x28) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000100)=@ethtool_pauseparam={0x29, 0x10, 0x41, 0x5}}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r5 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x96f, 0x1c080, 0x0, 0x2f9}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) io_uring_enter(r5, 0x2219, 0x7721, 0x16, 0x0, 0x2f) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000007c0)={0xffffffffffffffff, 0xe0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2, &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000540)=[0x0, 0x0], 0x0, 0x3e, &(0x7f0000000580)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000600), &(0x7f0000000640), 0x8, 0x55, 0x8, 0x8, &(0x7f0000000680)}}, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a80)={0x18, 0x11, &(0x7f0000000800)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xe}, {}, {}, [@btf_id={0x18, 0xa, 0x3, 0x0, 0x5}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000008c0)='GPL\x00', 0x8e, 0x0, 0x0, 0x41100, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000900)={0x3, 0x4}, 0x8, 0x10, &(0x7f0000000940)={0x2, 0xa, 0x1, 0xe}, 0x10, 0x0, 0x0, 0xa, &(0x7f0000000980)=[0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f00000009c0)=[{0x4, 0x2, 0x4, 0x9}, {0x3, 0x5, 0x4, 0xc}, {0x3, 0x5, 0x2, 0x8}, {0x2, 0x5, 0xa}, {0x0, 0x3, 0xb, 0x5}, {0x4, 0x4, 0x9, 0xc}, {0x3, 0x5, 0xf, 0x3}, {0x0, 0x4, 0xb, 0x2}, {0x0, 0x4, 0xa, 0xc}, {0x4, 0x2, 0x5, 0x8}], 0x10, 0x9}, 0x94) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000b40)={0x1, 0xffffffffffffffff}, 0x4) r9 = dup(r2) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000b80)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000bc0)=ANY=[@ANYBLOB="020000000400000008000000c100000080000000", @ANYRES32, @ANYBLOB="0200"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="02000000030000000100"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000c80)={0x7, 0x7, &(0x7f0000000300)=@raw=[@map_idx={0x18, 0xb, 0x5, 0x0, 0x8}, @map_val={0x18, 0x4, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffff8}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}], &(0x7f0000000340)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x41100, 0x1a, '\x00', 0x0, @fallback=0x1c, r4, 0x8, &(0x7f0000000480)={0x5, 0x1}, 0x8, 0x10, 0x0, 0x0, r6, r7, 0x0, &(0x7f0000000c40)=[r8, r9, r10, r11], 0x0, 0x10, 0xe}, 0x94) bpf$BPF_MAP_FREEZE(0x16, &(0x7f0000001040)=r11, 0x4) sendmsg$NFQNL_MSG_VERDICT(r9, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000d40)={0x188, 0x1, 0x3, 0x3, 0x0, 0x0, {0x7, 0x0, 0xa}, [@NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0xfff}, @NFQA_VERDICT_HDR={0xc, 0x2, {0x4, 0x8}}, @NFQA_CT={0x14c, 0xb, 0x0, 0x1, [@CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}, @CTA_SYNPROXY={0x54, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x8}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0xfffffff3}, @CTA_SYNPROXY_ITS={0x0, 0x2, 0x1, 0x0, 0x9}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0xe35e}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x5}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x7}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x200}, @CTA_SYNPROXY_ISN={0x8}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0xb}]}, @CTA_TUPLE_MASTER={0x7c, 0xe, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv4={{0x0, 0x1, @dev={0xac, 0x14, 0x14, 0x3e}}, {0x0, 0x2, @private=0xa010101}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x7}]}, @CTA_NAT_SRC={0x48, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MAXIP={0x14, 0x5, @mcast2}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @remote}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @loopback}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @ipv4={'\x00', '\xff\xff', @private=0xa010102}}]}, @CTA_NAT_DST={0x0, 0xd, 0x0, 0x1, [@CTA_NAT_V4_MINIP={0x0, 0x1, @local}, @CTA_NAT_V4_MINIP={0x0, 0x1, @rand_addr=0x64010100}, @CTA_NAT_V6_MINIP={0x0, 0x4, @remote}, @CTA_NAT_V4_MINIP={0x0, 0x1, @local}, @CTA_NAT_V6_MAXIP={0x0, 0x5, @remote}]}]}, @NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0xa2}, @NFQA_VLAN={0x4}, @NFQA_MARK={0x8}]}, 0x188}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mknod(&(0x7f00000048c0)='./file0\x00', 0x0, 0xffffffff) r12 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r12, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r12, &(0x7f000000a380)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r12, &(0x7f00000006c0)={0x50, 0x0, r13, {0x7, 0x1f, 0x0, 0x0, 0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x80}}, 0x50) syz_fuse_handle_req(r12, &(0x7f0000008380)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008df76a250000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea21056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000131a5d9400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r14 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) lseek(r14, 0x83, 0x0) 1.965160875s ago: executing program 5 (id=645): mremap(&(0x7f0000097000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$mtd(&(0x7f0000000080), 0xfd2, 0x80001) ioctl$MEMGETINFO(r2, 0x80204d01, &(0x7f00000002c0)) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@ipv6_newroute={0x1c, 0x18, 0xffffffffffffffff, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0xfe, 0x0, 0xfd, 0x9}}, 0x1c}}, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmmsg$inet6(r3, &(0x7f0000019680)=[{{&(0x7f0000000100)={0xa, 0x0, 0x0, @loopback={0x0, 0xac141414}}, 0x1c, 0x0}}], 0x1, 0x20004855) setsockopt$sock_int(r3, 0x1, 0x9, &(0x7f0000000040)=0x5, 0x4) r4 = socket$inet6(0xa, 0x3, 0xff) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r6, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000440)={0x28, r7, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x4040) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYRES16=r6], 0x60}, 0x1, 0x0, 0x0, 0x20020801}, 0x44880) r8 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r8, 0xc2604111, &(0x7f0000000100)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]], '\x00', [{0x9, 0x989680}, {0x0, 0x989680}, {0x0, 0x989680}, {0x0, 0x989680}, {0x0, 0x989680}, {0x0, 0x989680}, {0x0, 0x989680}, {0x0, 0x989680}, {0x0, 0x989680}, {0x0, 0x989680}, {0x0, 0x989680}, {0x0, 0x989680}], '\x00', 0xffffffff}) r9 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f00000006c0)={'wlan1\x00', &(0x7f0000000700)=@ethtool_stats={0x11}}) migrate_pages(0x0, 0x401, &(0x7f0000000040)=0x7, &(0x7f00000000c0)=0x7) sendmmsg$inet6(r4, &(0x7f0000004f00)=[{{&(0x7f0000000080)={0xa, 0x0, 0x0, @private1}, 0x1c, 0x0}}], 0x1, 0x0) r10 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(r11, 0x0) setresuid(0x0, r11, r11) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@ipv6_newroute={0x1c, 0x18, 0x1ef, 0x0, 0x0, {0xa, 0x80, 0x0, 0x0, 0x0, 0x2, 0xfd}}, 0x1c}, 0x1, 0x11}, 0x0) 1.828993539s ago: executing program 5 (id=646): set_mempolicy(0x6, &(0x7f00000003c0)=0xa, 0x8) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x103001, 0x0) mprotect(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x1000009) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x0, 0x0}) socket(0x400000000010, 0x3, 0x5) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1, {r0}}, './file0\x00'}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10) r3 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x1f, 0x0, @tid=r3}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10) r4 = socket(0x2, 0x80805, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x5}}, 0x1c) getsockopt$bt_hci(r4, 0x84, 0x75, &(0x7f0000000000)=""/4071, &(0x7f0000001080)=0xfe7) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) rseq(&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6}, 0x46, 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) prctl$PR_SET_SECCOMP(0x4f, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001000)=ANY=[@ANYRES32=r3], 0x30}}, 0x0) ftruncate(r5, 0x2000009) sendfile(r2, r5, 0x0, 0x7ffff004) fsmount(r5, 0x1, 0x8c) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) 883.377996ms ago: executing program 5 (id=647): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) recvmsg$unix(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x6, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r6 = dup3(r5, r4, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r4, 0x10000000000) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000003c0)={0x7c, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @release={0x40046306, 0x1}, @increfs_done={0x40106308, 0x3}, @acquire_done={0x40106309, 0x2}, @acquire], 0x0, 0x0, 0x0}) setsockopt$sock_attach_bpf(r0, 0x1, 0x24, &(0x7f0000000000)=r3, 0x4) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x45, 0x6, 0x2}, {0x60, 0x4}, {}, {0x6}]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x13, &(0x7f0000000600)=ANY=[@ANYBLOB="1808000000000000000000000000000034314c984887e8325ccd589ab8aef31337a9a7eb751c952afb5a8619e38543d0066dd7edabc057df010100000000000034cb9a018e4bca7f4a0076a271639589860d5b5bf3e3ae59d56c24dc074cff72f6414768f6d710ab1c65e67f58997ee121bea14385263c9245bc785d115dae805ee3", @ANYRES32=r3, @ANYBLOB="00000000000000006600020000000000180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0xa, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000003000000000000000900000085200000040000001f8803000000000018120000", @ANYRES32=r8, @ANYBLOB="2000000000000000b703000000000000850000000c000000b7001500000000009500000000000000"], &(0x7f00000001c0)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x400001, 0xd, 0x9, 0x3ff}, 0x10, 0x0, 0x0, 0x7, &(0x7f0000000240)=[0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1], &(0x7f0000000740)=[{0x5, 0x5, 0xf, 0xb}, {0x2, 0x1, 0x2, 0xa}, {0x0, 0x5, 0x1, 0x3}, {0x0, 0x2, 0x10, 0x1}, {0x1, 0x2, 0xc, 0x1}, {0x1, 0x3, 0x1, 0xa}, {0x5, 0x4, 0xa, 0x6}]}, 0x94) r9 = socket$can_raw(0x1d, 0x3, 0x1) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700), 0x2122c1, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r11 = socket(0x400000000010, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffdf, {0x0, 0x0, 0x0, r13, {0x0, 0x9}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x1c, 0x2, [@TCA_HHF_QUANTUM={0x8, 0x2, 0x400}, @TCA_HHF_BACKLOG_LIMIT={0x8, 0x1, 0x51}, @TCA_HHF_HH_FLOWS_LIMIT={0x8}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) setsockopt$CAN_RAW_FILTER(r9, 0x65, 0x1, &(0x7f00000000c0), 0xf00) ioctl$ifreq_SIOCGIFINDEX_vcan(r9, 0x8933, &(0x7f0000000040)={'vcan0\x00'}) 726.462863ms ago: executing program 5 (id=648): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000ec0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x60, r0, 0x10, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x280000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000091}, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c150000410007012cbd7000fadbdf25037c00000400c280341501802d15108029150f"], 0x154c}, 0x1, 0x0, 0x0, 0x4c084}, 0xc000) (async) r4 = io_uring_setup(0x1, &(0x7f0000000000)={0x0, 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r3) sendmsg$NL80211_CMD_SET_QOS_MAP(r3, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x54, r5, 0x200, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_QOS_MAP={0x2a, 0xc7, {[{0x4, 0x6}, {0x4, 0x5}, {0xf5, 0x5}, {0xb, 0x3}, {0x0, 0x5}, {0x8, 0x2}, {0xae, 0x3}, {0x0, 0x5}, {0x81}, {0x6, 0x3}, {0xb, 0x4}, {0x1, 0x4}, {0x0, 0x6}, {0x20, 0x3}, {0xfd}], "bbc5b3942458ff77"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x1, 0x6}, {0x44, 0x1}, {0x4, 0x6}, {0xbf, 0x5}], "1b4d562f109eb758"}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4c804}, 0x4000800) io_uring_register$IORING_REGISTER_ZCRX_IFQ(r4, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x1, 0x2, &(0x7f0000000200)={&(0x7f0000001000), 0x1000, 0x0, 0x0, 0x1f}, &(0x7f0000000300)={&(0x7f0000002000), 0x1000, 0x1}}, 0x1) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_KEY(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x34, r0, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_SEC_KEY={0x18, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x14, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}]}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008805}, 0x0) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000540)={&(0x7f00000005c0)={0x1a4, r7, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x4}, @TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1}]}, @TIPC_NLA_BEARER={0x10, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'ib', 0x3a, 'gre0\x00'}}]}, @TIPC_NLA_NODE={0x58, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY={0x4b, 0x4, {'gcm(aes)\x00', 0x23, "536d35e96095f84f58bcc53897ab21d7cf792f349d2f335227029e4e6c332a7e9a958a"}}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7fff}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x40}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1ff}, @TIPC_NLA_PUBL_TYPE={0x8}]}, @TIPC_NLA_NODE={0xdc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x40}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0xb1, 0x3, "ce16346da9a35998079b78001cc25bf22012e30ed06a82fa58db383e6a6277dbaf5a51bb1e0c7c14ad5f1e90538e5a58b0fb97506f4ccc1a133145f7ab67e853f99d536c38308d7cdd2e98e64f64379be83844b43eff045782bb844b92e8d64f7fbd97a6eb249ecc58f4d62e1633920140003b78d4e8579850113fe2034119006f93ca7af5b8ebef07ce9668cedbf027014fd75560129fe998bf12ad1dea7a2d6210472c05ecf6b0f423d0236b"}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x73d2}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x40}]}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x400c010}, 0x40) 663.552241ms ago: executing program 5 (id=649): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0x12, {"a2e3ad21ed0d09f91b5b090987f70906d038e7ff7fc6e5539b0d3d0e8b089b323b6d07060890e0878f0e1ac6e7049b334a959b3e9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0931a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5bcd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383701d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9748684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d441d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b6080000007a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39dd0000000039ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb06ffc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00b98e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d877a4eddd5d0fc5a752f9000", 0xfffffffffffffffc}}, 0xffffffffffffffcb) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000010c0)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="1802000001000000000000008500000087000000180100002020702500000000002020207b1af8ff00000000bfa100000000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8}, 0x94) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x240000d5}, 0x4c040) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000001200)=ANY=[], 0x6f4}, 0x1, 0x0, 0x0, 0x4045}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wg2\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'batadv0\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001180)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01002dbd7000fbdbdf25310000000c009900020000004a00000008000300", @ANYRES32=r9, @ANYBLOB="3c69af8064635909b56e09e60347171dbb67bf13e910ee0d4402e5f003014059ddb042"], 0x28}, 0x1, 0x0, 0x0, 0x48000}, 0x8482) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x95f6ef274f5ddc19}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYRESDEC=r4, @ANYRES16=r2, @ANYBLOB="020025bd7000fedbdf25020000001c0001800800060000000000080006001000000008000700", @ANYRES32=r5, @ANYBLOB="08000200020000000800020002000000300001800500020005000000060005004e230000060005004e22000014000400fe8000000000000000000000000000bb080003000800000005000500fb0000002c00018008000700", @ANYRES32=r6, @ANYBLOB="080003000208000300ac1414aa05000200060000000800060008000000"], 0xac}, 0x1, 0x0, 0x0, 0x4}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100290008000300000000fcffffff000000", @ANYRES32=r11, @ANYBLOB="10001d800c00008006000500b0000000"], 0x2c}, 0x1, 0x0, 0x0, 0x4001}, 0x44) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r12, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r13 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r13, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r14, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) setsockopt$RDS_GET_MR(r1, 0x114, 0x2, &(0x7f0000001240)={{&(0x7f0000001080)}, &(0x7f0000001200), 0x53}, 0x20) sendmsg$nl_route_sched(r13, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000840)=@newtfilter={0x38, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r14, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_HASH={0x8, 0x2, 0x8}]}}]}, 0x38}}, 0x0) syz_open_dev$video(&(0x7f00000000c0), 0x6, 0x84100) 586.336621ms ago: executing program 5 (id=650): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x901800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async, rerun: 64) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) (rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="7b87f20f", @ANYRESDEC], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x76, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r0, 0x8040942d, &(0x7f0000000000)) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 6 (id=640): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fbdbdf25010000dfffffff0002413a74756e6c30000000a1040ff421f123eaaa2a81a29b3daa941060e02e054fc31bc8eb2e6d7bfdb003301b"], 0x2c}, 0x1, 0x0, 0x0, 0x40040d1}, 0x24000804) capset(&(0x7f0000000500)={0x19980330}, &(0x7f0000000200)={0x200004, 0x200003, 0x801, 0x4, 0xbe67}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) getsockname$l2tp(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='hybla', 0x5) shutdown(r2, 0x1) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) r3 = syz_clone(0x200000, 0x0, 0x36, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r4 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x4ea3, 0x0, @local, 0x1}, 0x1c) bpf$MAP_CREATE(0x0, 0x0, 0xfffffffffffffd2f) r5 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000019200)=@raw={'raw\x00', 0x8, 0x3, 0x4d8, 0x180, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x408, 0xffffffff, 0xffffffff, 0x408, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@loopback, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x158, 0x180, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@iprange={{0x68}, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4=@multicast2, @ipv6=@loopback, @ipv6=@empty}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x538) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000000080)={0x5, 0x3fc, 0x6, 0xa513, 0xf, "4ebd9cd43bc444a54fb40ada91ac7660b300"}) sendmsg(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000340)="ff00acdccae6419f316ea1a770a2693332efa457f9fa1c50bd2f78a2913eac66ec89a52a3f4c107d4ba2e5ead68caa2e0cb66046a76706c10729660c8f79597140a71fb8d6cf07a4559129ac35e27827d00ee6fd376e720487ed10", 0x5b}, {&(0x7f0000000140)='E', 0x1}], 0x2, 0x0, 0x0, 0x2c}, 0x4c055) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/tcp6\x00') fchdir(r6) mount(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000000)='proc\x00', 0x800000, 0x0) r7 = syz_open_procfs(r3, &(0x7f0000000400)='stat\x00') pread64(r7, &(0x7f00000003c0)=""/17, 0x11, 0x4) socket$nl_generic(0x10, 0x3, 0x10) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) kernel console output (not intermixed with test programs): nux: unrecognized netlink message: protocol=0 nlmsg_type=1382 sclass=netlink_route_socket pid=6638 comm=syz.4.177 [ 100.683735][ T6639] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1382 sclass=netlink_route_socket pid=6639 comm=syz.4.177 [ 100.714107][ T6642] squashfs: Unknown parameter ']' [ 101.024471][ T6657] erspan0: entered promiscuous mode [ 101.024498][ T6657] erspan0: entered allmulticast mode [ 101.200731][ T6667] CacheFiles: Failed to register: -95 [ 101.230991][ T6671] sctp: [Deprecated]: syz.2.188 (pid 6671) Use of int in max_burst socket option. [ 101.230991][ T6671] Use struct sctp_assoc_value instead [ 101.234864][ T6671] warning: `syz.2.188' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 101.288684][ T6675] FAULT_INJECTION: forcing a failure. [ 101.288684][ T6675] name failslab, interval 1, probability 0, space 0, times 0 [ 101.288703][ T6675] CPU: 1 UID: 0 PID: 6675 Comm: syz.1.191 Not tainted syzkaller #0 PREEMPT(full) [ 101.288715][ T6675] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.288722][ T6675] Call Trace: [ 101.288726][ T6675] [ 101.288730][ T6675] dump_stack_lvl+0x100/0x190 [ 101.288750][ T6675] should_fail_ex.cold+0x5/0xa [ 101.288766][ T6675] should_failslab+0xc2/0x120 [ 101.288780][ T6675] __kmalloc_cache_node_noprof+0x94/0x720 [ 101.288794][ T6675] ? __get_vm_area_node+0x124/0x350 [ 101.288809][ T6675] __get_vm_area_node+0x124/0x350 [ 101.288824][ T6675] __vmalloc_node_range_noprof+0x268/0x1420 [ 101.288839][ T6675] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 101.288855][ T6675] ? __lock_acquire+0x5c0/0x1f40 [ 101.288868][ T6675] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 101.288881][ T6675] ? lock_acquire+0x1d1/0x380 [ 101.288893][ T6675] ? find_held_lock+0x2b/0x80 [ 101.288908][ T6675] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 101.288922][ T6675] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 101.288939][ T6675] ? avc_has_perm_noaudit+0x145/0x3b0 [ 101.288954][ T6675] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 101.288973][ T6675] __vmalloc_node_noprof+0xad/0xf0 [ 101.288987][ T6675] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 101.289002][ T6675] __vmalloc_noprof+0xa3/0x120 [ 101.289016][ T6675] ? __pfx___vmalloc_noprof+0x10/0x10 [ 101.289031][ T6675] ? rcu_is_watching+0x13/0xc0 [ 101.289045][ T6675] ? cap_capable+0x107/0x430 [ 101.289062][ T6675] bpf_prog_alloc_no_stats+0x59/0x690 [ 101.289075][ T6675] ? security_capable+0x80/0x260 [ 101.289092][ T6675] bpf_prog_alloc+0x3b/0x200 [ 101.289104][ T6675] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 101.289118][ T6675] bpf_prog_load+0x49e/0x2a80 [ 101.289135][ T6675] ? __pfx_bpf_prog_load+0x10/0x10 [ 101.289160][ T6675] __sys_bpf+0x1f46/0x4a30 [ 101.289170][ T6675] ? plist_check_list+0x1b8/0x280 [ 101.289183][ T6675] ? plist_check_list+0x190/0x280 [ 101.289194][ T6675] ? __pfx___sys_bpf+0x10/0x10 [ 101.289204][ T6675] ? find_held_lock+0x2b/0x80 [ 101.289218][ T6675] ? futex_wake+0x4ea/0x5e0 [ 101.289236][ T6675] ? futex_private_hash_put.part.0+0xdc/0x180 [ 101.289250][ T6675] ? futex_private_hash_put+0x24/0x30 [ 101.289266][ T6675] ? __pfx_futex_wake+0x10/0x10 [ 101.289284][ T6675] ? rcu_read_lock_any_held+0x6a/0x90 [ 101.289299][ T6675] ? find_held_lock+0x2b/0x80 [ 101.289314][ T6675] ? ksys_write+0x190/0x250 [ 101.289324][ T6675] ? ksys_write+0x190/0x250 [ 101.289342][ T6675] ? __x64_sys_futex+0x34f/0x4d0 [ 101.289357][ T6675] ? __x64_sys_futex+0x358/0x4d0 [ 101.289372][ T6675] ? xfd_validate_state+0x129/0x190 [ 101.289386][ T6675] ? __x64_sys_bpf+0xce/0x140 [ 101.289396][ T6675] __x64_sys_bpf+0xce/0x140 [ 101.289407][ T6675] ? do_syscall_64+0xae/0x790 [ 101.289421][ T6675] do_syscall_64+0x123/0x790 [ 101.289436][ T6675] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.289448][ T6675] RIP: 0033:0x7f00dc79e159 [ 101.289457][ T6675] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.289469][ T6675] RSP: 002b:00007f00dd6aa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 101.289482][ T6675] RAX: ffffffffffffffda RBX: 00007f00dca25fa0 RCX: 00007f00dc79e159 [ 101.289489][ T6675] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005 [ 101.289495][ T6675] RBP: 00007f00dc83503b R08: 0000000000000000 R09: 0000000000000000 [ 101.289501][ T6675] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.289507][ T6675] R13: 00007f00dca26038 R14: 00007f00dca25fa0 R15: 00007ffc9bf90068 [ 101.289521][ T6675] [ 101.289628][ T6675] syz.1.191: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 101.289751][ T6675] CPU: 1 UID: 0 PID: 6675 Comm: syz.1.191 Not tainted syzkaller #0 PREEMPT(full) [ 101.289763][ T6675] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.289769][ T6675] Call Trace: [ 101.289773][ T6675] [ 101.289777][ T6675] dump_stack_lvl+0x100/0x190 [ 101.289795][ T6675] warn_alloc.cold+0x9e/0xb2 [ 101.289807][ T6675] ? __pfx_warn_alloc+0x10/0x10 [ 101.289823][ T6675] ? __kasan_kmalloc+0x8a/0xb0 [ 101.289840][ T6675] ? __get_vm_area_node+0x22b/0x350 [ 101.289855][ T6675] __vmalloc_node_range_noprof+0xfa2/0x1420 [ 101.289873][ T6675] ? __lock_acquire+0x5c0/0x1f40 [ 101.289885][ T6675] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 101.289898][ T6675] ? lock_acquire+0x1d1/0x380 [ 101.289912][ T6675] ? find_held_lock+0x2b/0x80 [ 101.289928][ T6675] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 101.289942][ T6675] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 101.289959][ T6675] ? avc_has_perm_noaudit+0x145/0x3b0 [ 101.289978][ T6675] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 101.289992][ T6675] __vmalloc_node_noprof+0xad/0xf0 [ 101.290005][ T6675] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 101.290020][ T6675] __vmalloc_noprof+0xa3/0x120 [ 101.290034][ T6675] ? __pfx___vmalloc_noprof+0x10/0x10 [ 101.290049][ T6675] ? rcu_is_watching+0x13/0xc0 [ 101.290064][ T6675] ? cap_capable+0x107/0x430 [ 101.290080][ T6675] bpf_prog_alloc_no_stats+0x59/0x690 [ 101.290093][ T6675] ? security_capable+0x80/0x260 [ 101.290110][ T6675] bpf_prog_alloc+0x3b/0x200 [ 101.290122][ T6675] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 101.290135][ T6675] bpf_prog_load+0x49e/0x2a80 [ 101.290151][ T6675] ? __pfx_bpf_prog_load+0x10/0x10 [ 101.290176][ T6675] __sys_bpf+0x1f46/0x4a30 [ 101.290186][ T6675] ? plist_check_list+0x1b8/0x280 [ 101.290199][ T6675] ? plist_check_list+0x190/0x280 [ 101.290210][ T6675] ? __pfx___sys_bpf+0x10/0x10 [ 101.290219][ T6675] ? find_held_lock+0x2b/0x80 [ 101.290234][ T6675] ? futex_wake+0x4ea/0x5e0 [ 101.290251][ T6675] ? futex_private_hash_put.part.0+0xdc/0x180 [ 101.290265][ T6675] ? futex_private_hash_put+0x24/0x30 [ 101.290282][ T6675] ? __pfx_futex_wake+0x10/0x10 [ 101.290301][ T6675] ? rcu_read_lock_any_held+0x6a/0x90 [ 101.290316][ T6675] ? find_held_lock+0x2b/0x80 [ 101.290330][ T6675] ? ksys_write+0x190/0x250 [ 101.290340][ T6675] ? ksys_write+0x190/0x250 [ 101.290358][ T6675] ? __x64_sys_futex+0x34f/0x4d0 [ 101.290372][ T6675] ? __x64_sys_futex+0x358/0x4d0 [ 101.290388][ T6675] ? xfd_validate_state+0x129/0x190 [ 101.290401][ T6675] ? __x64_sys_bpf+0xce/0x140 [ 101.290411][ T6675] __x64_sys_bpf+0xce/0x140 [ 101.290422][ T6675] ? do_syscall_64+0xae/0x790 [ 101.290436][ T6675] do_syscall_64+0x123/0x790 [ 101.290451][ T6675] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.290462][ T6675] RIP: 0033:0x7f00dc79e159 [ 101.290473][ T6675] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.290482][ T6675] RSP: 002b:00007f00dd6aa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 101.290492][ T6675] RAX: ffffffffffffffda RBX: 00007f00dca25fa0 RCX: 00007f00dc79e159 [ 101.290498][ T6675] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005 [ 101.290505][ T6675] RBP: 00007f00dc83503b R08: 0000000000000000 R09: 0000000000000000 [ 101.290511][ T6675] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.290517][ T6675] R13: 00007f00dca26038 R14: 00007f00dca25fa0 R15: 00007ffc9bf90068 [ 101.290530][ T6675] [ 101.290534][ T6675] Mem-Info: [ 101.290539][ T6675] active_anon:10045 inactive_anon:2931 isolated_anon:0 [ 101.290539][ T6675] active_file:42 inactive_file:61520 isolated_file:0 [ 101.290539][ T6675] unevictable:1000 dirty:32 writeback:0 [ 101.290539][ T6675] slab_reclaimable:8111 slab_unreclaimable:66728 [ 101.290539][ T6675] mapped:24741 shmem:4428 pagetables:1279 [ 101.290539][ T6675] sec_pagetables:300 bounce:0 [ 101.290539][ T6675] kernel_misc_reclaimable:0 [ 101.290539][ T6675] free:444706 free_pcp:24143 free_cma:0 [ 101.290564][ T6675] Node 0 active_anon:40180kB inactive_anon:11724kB active_file:168kB inactive_file:245872kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:98964kB dirty:120kB writeback:0kB shmem:15712kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13728kB pagetables:4920kB sec_pagetables:1176kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 101.290729][ T6675] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:8kB writeback:0kB shmem:2000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:196kB sec_pagetables:24kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 101.290755][ T6675] Node 0 DMA free:14988kB boost:0kB min:340kB low:424kB high:508kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:372kB local_pcp:144kB free_cma:0kB [ 101.290906][ T6675] lowmem_reserve[]: 0 1223 1223 1223 1223 [ 101.290927][ T6675] Node 0 DMA32 free:174424kB boost:0kB min:27356kB low:34192kB high:41028kB reserved_highatomic:0kB free_highatomic:0kB active_anon:40180kB inactive_anon:11724kB active_file:168kB inactive_file:245872kB unevictable:2000kB writepending:120kB zspages:0kB present:2080628kB managed:1252920kB mlocked:0kB bounce:0kB free_pcp:39576kB local_pcp:10612kB free_cma:0kB [ 101.290984][ T6675] lowmem_reserve[]: 0 0 0 0 0 [ 101.291002][ T6675] Node 1 Normal free:1589412kB boost:0kB min:39880kB low:49848kB high:59816kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:2000kB writepending:8kB zspages:0kB present:2097152kB managed:1781880kB mlocked:0kB bounce:0kB free_pcp:56624kB local_pcp:2992kB free_cma:0kB [ 101.291031][ T6675] lowmem_reserve[]: 0 0 0 0 0 [ 101.291048][ T6675] Node 0 DMA: 3*4kB (UM) 2*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 2*128kB (UM) 3*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 1*2048kB (U) 2*4096kB (UM) = 14988kB [ 101.291132][ T6675] Node 0 DMA32: 654*4kB (UE) 780*8kB (UME) 639*16kB (UME) 289*32kB (UME) 203*64kB (UME) 87*128kB (UME) 32*256kB (UME) 22*512kB (UME) 12*1024kB (UM) 16*2048kB (UM) 14*4096kB (UM) = 174312kB [ 101.291215][ T6675] Node 1 Normal: 7*4kB (UM) 11*8kB (U) 14*16kB (U) 15*32kB (U) 15*64kB (UM) 13*128kB (UME) 12*256kB (U) 10*512kB (U) 7*1024kB (UM) 7*2048kB (UM) 380*4096kB (UM) = 1589620kB [ 101.291298][ T6675] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 101.291306][ T6675] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 101.291314][ T6675] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 101.291322][ T6675] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 101.291330][ T6675] 65986 total pagecache pages [ 101.291333][ T6675] 0 pages in swap cache [ 101.291337][ T6675] Free swap = 124996kB [ 101.291340][ T6675] Total swap = 124996kB [ 101.291344][ T6675] 1048443 pages RAM [ 101.291348][ T6675] 0 pages HighMem/MovableOnly [ 101.291351][ T6675] 285903 pages reserved [ 101.291355][ T6675] 0 pages cma reserved [ 101.404943][ T6679] netlink: 'syz.2.192': attribute type 10 has an invalid length. [ 101.412974][ T6679] team0 (unregistering): Port device team_slave_0 removed [ 101.419246][ T6679] team0 (unregistering): Port device team_slave_1 removed [ 101.723222][ T6698] program syz.2.197 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 101.772062][ T6709] hfs: unable to load iocharset "io#harset" [ 101.908435][ T6717] x_tables: ip6_tables: rpfilter match: used from hooks INPUT, but only valid from PREROUTING [ 102.203625][ T6702] null_blk: disk nullb1 created [ 102.224685][ T6736] overlayfs: failed to resolve './file0': -40 [ 102.287878][ T6739] __nla_validate_parse: 10 callbacks suppressed [ 102.287890][ T6739] netlink: 12 bytes leftover after parsing attributes in process `syz.1.205'. [ 102.325648][ T6739] bridge2: port 1(veth3) entered blocking state [ 102.325738][ T6739] bridge2: port 1(veth3) entered disabled state [ 102.328963][ T6739] veth3: entered allmulticast mode [ 102.330274][ T6739] veth3: entered promiscuous mode [ 102.359345][ T6739] bridge2: port 2(veth5) entered blocking state [ 102.359418][ T6739] bridge2: port 2(veth5) entered disabled state [ 102.359557][ T6739] veth5: entered allmulticast mode [ 102.360548][ T6739] veth5: entered promiscuous mode [ 102.457524][ T5760] Bluetooth: hci2: ISO packet for unknown connection handle 0 [ 102.742017][ T6778] netlink: 8 bytes leftover after parsing attributes in process `syz.1.217'. [ 102.748878][ T6779] netlink: 12 bytes leftover after parsing attributes in process `syz.2.214'. [ 102.825889][ T6783] netlink: 2560 bytes leftover after parsing attributes in process `syz.1.218'. [ 102.890696][ T6792] capability: warning: `syz.4.220' uses deprecated v2 capabilities in a way that may be insecure [ 103.107924][ T6828] jffs2: notice: (6828) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 103.177621][ T6831] nvme_fc: nvme_fc_create_ctrl: nn-0x3333333333333333:pn-0x4444444444444444 - nn-0x1111111111111111:pn-0x2222222222222222 combination not found [ 103.202230][ T6831] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.203160][ T6831] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.239833][ T6831] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 103.242483][ T6831] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 103.306026][ T25] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 103.306050][ T25] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.306069][ T25] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 103.306084][ T25] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.306101][ T25] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 103.306114][ T25] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.483732][ T6848] Illegal XDP return value 4294967274 on prog (id 25) dev N/A, expect packet loss! [ 103.610012][ T44] kauditd_printk_skb: 63 callbacks suppressed [ 103.610024][ T44] audit: type=1326 audit(1789055348.518:517): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6859 comm="syz.1.235" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00dc79e159 code=0x7ffc0000 [ 103.610047][ T44] audit: type=1326 audit(1789055348.518:518): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6859 comm="syz.1.235" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00dc79e159 code=0x7ffc0000 [ 103.611559][ T44] audit: type=1326 audit(1789055348.518:519): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6859 comm="syz.1.235" exe="/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f00dc79e159 code=0x7ffc0000 [ 103.611743][ T44] audit: type=1326 audit(1789055348.518:520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6859 comm="syz.1.235" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00dc79e159 code=0x7ffc0000 [ 103.611866][ T44] audit: type=1326 audit(1789055348.518:521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6859 comm="syz.1.235" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00dc79e159 code=0x7ffc0000 [ 103.612099][ T44] audit: type=1326 audit(1789055348.518:522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6859 comm="syz.1.235" exe="/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f00dc79e159 code=0x7ffc0000 [ 103.613670][ T44] audit: type=1326 audit(1789055348.518:523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6859 comm="syz.1.235" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00dc79e159 code=0x7ffc0000 [ 103.613693][ T44] audit: type=1326 audit(1789055348.518:524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6859 comm="syz.1.235" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00dc79e159 code=0x7ffc0000 [ 103.613957][ T44] audit: type=1326 audit(1789055348.518:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6859 comm="syz.1.235" exe="/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f00dc79e159 code=0x7ffc0000 [ 103.614185][ T44] audit: type=1326 audit(1789055348.518:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6859 comm="syz.1.235" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00dc79e159 code=0x7ffc0000 [ 103.668272][ T6861] netlink: 20 bytes leftover after parsing attributes in process `syz.1.235'. [ 104.418452][ T38] IPVS: starting estimator thread 0... [ 104.527415][ T6900] IPVS: using max 43 ests per chain, 103200 per kthread [ 104.575008][ T6916] FAULT_INJECTION: forcing a failure. [ 104.575008][ T6916] name failslab, interval 1, probability 0, space 0, times 0 [ 104.575028][ T6916] CPU: 0 UID: 0 PID: 6916 Comm: syz.4.249 Not tainted syzkaller #0 PREEMPT(full) [ 104.575041][ T6916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.575048][ T6916] Call Trace: [ 104.575052][ T6916] [ 104.575057][ T6916] dump_stack_lvl+0x100/0x190 [ 104.575088][ T6916] should_fail_ex.cold+0x5/0xa [ 104.575106][ T6916] should_failslab+0xc2/0x120 [ 104.575123][ T6916] __kmalloc_noprof+0xfc/0x840 [ 104.575134][ T6916] ? tomoyo_encode2+0xfb/0x3c0 [ 104.575149][ T6916] tomoyo_encode2+0xfb/0x3c0 [ 104.575163][ T6916] tomoyo_encode+0x29/0x50 [ 104.575174][ T6916] tomoyo_realpath_from_path+0x18c/0x690 [ 104.575190][ T6916] tomoyo_check_open_permission+0x2af/0x3c0 [ 104.575209][ T6916] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 104.575230][ T6916] ? hook_file_open+0x248/0x8e0 [ 104.575254][ T6916] ? path_get+0x61/0x80 [ 104.575270][ T6916] tomoyo_file_open+0x6b/0x90 [ 104.575284][ T6916] security_file_open+0xb5/0x1e0 [ 104.575297][ T6916] do_dentry_open+0x588/0x14d0 [ 104.575312][ T6916] vfs_open+0x82/0x3f0 [ 104.575327][ T6916] path_openat+0x19fa/0x2440 [ 104.575343][ T6916] ? __pfx_path_openat+0x10/0x10 [ 104.575360][ T6916] do_file_open+0x20e/0x430 [ 104.575373][ T6916] ? __pfx_do_file_open+0x10/0x10 [ 104.575396][ T6916] ? _raw_spin_unlock+0x28/0x50 [ 104.575411][ T6916] ? alloc_fd+0x471/0x7a0 [ 104.575429][ T6916] do_sys_openat2+0x10f/0x1e0 [ 104.575444][ T6916] ? __pfx_do_sys_openat2+0x10/0x10 [ 104.575460][ T6916] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 104.575477][ T6916] __x64_sys_openat+0x12d/0x210 [ 104.575492][ T6916] ? __pfx___x64_sys_openat+0x10/0x10 [ 104.575512][ T6916] do_syscall_64+0x123/0x790 [ 104.575527][ T6916] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.575538][ T6916] RIP: 0033:0x7fbe7495e98e [ 104.575547][ T6916] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 104.575557][ T6916] RSP: 002b:00007fbe7585ab28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 104.575568][ T6916] RAX: ffffffffffffffda RBX: 00007fbe7585b6c0 RCX: 00007fbe7495e98e [ 104.575575][ T6916] RDX: 00000000000a0402 RSI: 00007fbe7585ac00 RDI: ffffffffffffff9c [ 104.575582][ T6916] RBP: 00007fbe7585ac00 R08: 0000000000000000 R09: 0000000000000000 [ 104.575588][ T6916] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 104.575594][ T6916] R13: 00007fbe74c26038 R14: 00007fbe74c25fa0 R15: 00007ffdcc6d2b28 [ 104.575608][ T6916] [ 104.575619][ T6916] ERROR: Out of memory at tomoyo_realpath_from_path. [ 104.599423][ T6912] kvm: pic: non byte write [ 104.779366][ T6943] SELinux: unknown common socke0 [ 104.779393][ T6943] SELinux: invalid class [ 104.781777][ T6943] SELinux: failed to load policy [ 104.839391][ T6954] netlink: 8 bytes leftover after parsing attributes in process `syz.2.255'. [ 104.889284][ T6963] netlink: 'syz.4.256': attribute type 1 has an invalid length. [ 104.901942][ T6963] 8021q: adding VLAN 0 to HW filter on device bond1 [ 104.910477][ T6963] bond1: (slave geneve2): making interface the new active one [ 104.911729][ T6963] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 104.914360][ T6968] netlink: 'syz.4.256': attribute type 1 has an invalid length. [ 104.950090][ T6978] ip_tables: iptables: counters copy to user failed while replacing table [ 104.985721][ T6984] xt_NETMAP: bad MAP_IPS. [ 105.322807][ T356] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.322821][ T356] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.415292][ T7038] sch_tbf: peakrate 216 is lower than or equals to rate 25783 ! [ 105.492851][ T7045] ip_tables: iptables: counters copy to user failed while replacing table [ 105.694511][ T7077] ip_tables: iptables: counters copy to user failed while replacing table [ 105.738060][ T7076] nvme nvme0: failed to connect socket: -111 [ 105.743443][ T7082] tipc: Started in network mode [ 105.743459][ T7082] tipc: Node identity ac141441, cluster identity 4711 [ 105.745435][ T7082] tipc: Enabled bearer , priority 10 [ 105.800173][ T7090] netlink: 16 bytes leftover after parsing attributes in process `syz.2.281'. [ 105.939748][ T7098] 9p: Bad value for 'rfdno' [ 106.251098][ T7114] ip_tables: iptables: counters copy to user failed while replacing table [ 106.325837][ T7123] netlink: 'syz.3.290': attribute type 4 has an invalid length. [ 106.361483][ T7125] syzkaller1: entered promiscuous mode [ 106.361498][ T7125] syzkaller1: entered allmulticast mode [ 106.368415][ T7125] sg_write: data in/out 1701588992/136 bytes for SCSI command 0x0-- guessing data in; [ 106.368415][ T7125] program syz.4.292 not setting count and/or reply_len properly [ 106.369494][ T7127] overlay: ./file0 is not a directory [ 106.414474][ T7129] FAULT_INJECTION: forcing a failure. [ 106.414474][ T7129] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 106.414494][ T7129] CPU: 3 UID: 0 PID: 7129 Comm: syz.3.294 Not tainted syzkaller #0 PREEMPT(full) [ 106.414506][ T7129] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 106.414512][ T7129] Call Trace: [ 106.414516][ T7129] [ 106.414520][ T7129] dump_stack_lvl+0x100/0x190 [ 106.414552][ T7129] should_fail_ex.cold+0x5/0xa [ 106.414568][ T7129] _copy_from_user+0x2e/0xd0 [ 106.414584][ T7129] memdup_user+0x6b/0xe0 [ 106.414601][ T7129] strndup_user+0x78/0xe0 [ 106.414618][ T7129] __x64_sys_mount+0x136/0x310 [ 106.414634][ T7129] ? __pfx___x64_sys_mount+0x10/0x10 [ 106.414654][ T7129] do_syscall_64+0x123/0x790 [ 106.414673][ T7129] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.414685][ T7129] RIP: 0033:0x7f91bb59e159 [ 106.414694][ T7129] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.414704][ T7129] RSP: 002b:00007f91bc4a5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 106.414715][ T7129] RAX: ffffffffffffffda RBX: 00007f91bb825fa0 RCX: 00007f91bb59e159 [ 106.414722][ T7129] RDX: 0000200000000080 RSI: 0000200000000300 RDI: 0000000000000000 [ 106.414729][ T7129] RBP: 00007f91bc4a5090 R08: 0000200000000240 R09: 0000000000000000 [ 106.414736][ T7129] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 106.414742][ T7129] R13: 00007f91bb826038 R14: 00007f91bb825fa0 R15: 00007ffd75fdf678 [ 106.414756][ T7129] [ 106.499530][ T7134] comedi comedi3: comedi_test: 259 microvolt, 4 microsecond waveform attached [ 106.690534][ T7140] ip_tables: iptables: counters copy to user failed while replacing table [ 106.737290][ T5545] tipc: Node number set to 2886997057 [ 106.816301][ T26] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 106.948692][ T7156] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7156 comm=syz.1.302 [ 106.965873][ T26] usb 9-1: Using ep0 maxpacket: 8 [ 106.967005][ T26] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 106.967875][ T26] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 106.967897][ T26] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 106.967909][ T26] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 106.967921][ T26] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 106.967932][ T26] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 106.967951][ T26] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.981539][ T7159] FAULT_INJECTION: forcing a failure. [ 106.981539][ T7159] name failslab, interval 1, probability 0, space 0, times 0 [ 106.981557][ T7159] CPU: 2 UID: 0 PID: 7159 Comm: syz.1.303 Not tainted syzkaller #0 PREEMPT(full) [ 106.981570][ T7159] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 106.981577][ T7159] Call Trace: [ 106.981581][ T7159] [ 106.981585][ T7159] dump_stack_lvl+0x100/0x190 [ 106.981618][ T7159] should_fail_ex.cold+0x5/0xa [ 106.981634][ T7159] should_failslab+0xc2/0x120 [ 106.981649][ T7159] __kmalloc_cache_noprof+0x91/0x6d0 [ 106.981671][ T7159] ? copy_mount_options+0x55/0x190 [ 106.981684][ T7159] copy_mount_options+0x55/0x190 [ 106.981696][ T7159] __x64_sys_mount+0x1ab/0x310 [ 106.981713][ T7159] ? __pfx___x64_sys_mount+0x10/0x10 [ 106.981732][ T7159] do_syscall_64+0x123/0x790 [ 106.981749][ T7159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.981761][ T7159] RIP: 0033:0x7f00dc79e159 [ 106.981770][ T7159] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.981781][ T7159] RSP: 002b:00007f00dd6aa028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 106.981792][ T7159] RAX: ffffffffffffffda RBX: 00007f00dca25fa0 RCX: 00007f00dc79e159 [ 106.981799][ T7159] RDX: 0000200000000080 RSI: 0000200000000300 RDI: 0000000000000000 [ 106.981805][ T7159] RBP: 00007f00dd6aa090 R08: 0000200000000240 R09: 0000000000000000 [ 106.981811][ T7159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 106.981818][ T7159] R13: 00007f00dca26038 R14: 00007f00dca25fa0 R15: 00007ffc9bf90068 [ 106.981832][ T7159] [ 107.727497][ T110] IPVS: starting estimator thread 0... [ 107.825979][ T7176] IPVS: using max 43 ests per chain, 103200 per kthread [ 108.020700][ T7195] syzkaller0: left promiscuous mode [ 108.020714][ T7195] syzkaller0: left allmulticast mode [ 108.135030][ T7199] comedi comedi1: comedi_config --init_data is deprecated [ 108.292347][ T7200] ima: policy update completed [ 108.930418][ T7208] netlink: 36 bytes leftover after parsing attributes in process `syz.1.318'. [ 109.581781][ T26] usb 9-1: USB disconnect, device number 4 [ 109.614674][ T44] kauditd_printk_skb: 55 callbacks suppressed [ 109.614690][ T44] audit: type=1400 audit(1789055354.518:582): avc: denied { read } for pid=7215 comm="syz.3.321" name="file1" dev="9p" ino=76832965 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 109.614960][ T44] audit: type=1400 audit(1789055354.518:583): avc: denied { open } for pid=7215 comm="syz.3.321" path="/57/file0/file1" dev="9p" ino=76832965 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 109.703733][ T7222] 9p: Bad value for 'rfdno' [ 109.861205][ T7234] FAULT_INJECTION: forcing a failure. [ 109.861205][ T7234] name failslab, interval 1, probability 0, space 0, times 0 [ 109.861225][ T7234] CPU: 2 UID: 0 PID: 7234 Comm: syz.3.327 Not tainted syzkaller #0 PREEMPT(full) [ 109.861241][ T7234] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 109.861250][ T7234] Call Trace: [ 109.861256][ T7234] [ 109.861262][ T7234] dump_stack_lvl+0x100/0x190 [ 109.861303][ T7234] should_fail_ex.cold+0x5/0xa [ 109.861321][ T7234] should_failslab+0xc2/0x120 [ 109.861340][ T7234] __kmalloc_noprof+0xfc/0x840 [ 109.861352][ T7234] ? tomoyo_encode2+0xfb/0x3c0 [ 109.861367][ T7234] tomoyo_encode2+0xfb/0x3c0 [ 109.861381][ T7234] tomoyo_encode+0x29/0x50 [ 109.861393][ T7234] tomoyo_mount_acl+0x14c/0x8b0 [ 109.861404][ T7234] ? is_bpf_text_address+0x8a/0x1a0 [ 109.861419][ T7234] ? is_bpf_text_address+0x8a/0x1a0 [ 109.861435][ T7234] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 109.861454][ T7234] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 109.861465][ T7234] ? kernel_text_address+0x8d/0x100 [ 109.861483][ T7234] ? unwind_get_return_address+0x59/0xa0 [ 109.861499][ T7234] ? arch_stack_walk+0xa6/0xf0 [ 109.861515][ T7234] ? __lock_acquire+0x5c0/0x1f40 [ 109.861533][ T7234] ? tomoyo_mount_permission+0x1f6/0x460 [ 109.861551][ T7234] ? tomoyo_domain+0xb2/0x150 [ 109.861565][ T7234] ? tomoyo_profile+0x47/0x60 [ 109.861581][ T7234] tomoyo_mount_permission+0x214/0x460 [ 109.861592][ T7234] ? tomoyo_mount_permission+0x1f6/0x460 [ 109.861605][ T7234] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 109.861624][ T7234] security_sb_mount+0xdd/0x270 [ 109.861643][ T7234] path_mount+0x158/0x24c0 [ 109.861661][ T7234] ? __pfx_path_mount+0x10/0x10 [ 109.861676][ T7234] ? lockdep_hardirqs_on+0x7d/0x110 [ 109.861696][ T7234] ? putname+0xb1/0x110 [ 109.861709][ T7234] ? kmem_cache_free+0x127/0x6c0 [ 109.861730][ T7234] ? __x64_sys_mount+0x293/0x310 [ 109.861745][ T7234] __x64_sys_mount+0x293/0x310 [ 109.861761][ T7234] ? __pfx___x64_sys_mount+0x10/0x10 [ 109.861781][ T7234] do_syscall_64+0x123/0x790 [ 109.861797][ T7234] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.861809][ T7234] RIP: 0033:0x7f91bb59e159 [ 109.861818][ T7234] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.861829][ T7234] RSP: 002b:00007f91bc4a5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 109.861840][ T7234] RAX: ffffffffffffffda RBX: 00007f91bb825fa0 RCX: 00007f91bb59e159 [ 109.861847][ T7234] RDX: 0000200000000080 RSI: 0000200000000300 RDI: 0000000000000000 [ 109.861853][ T7234] RBP: 00007f91bc4a5090 R08: 0000200000000240 R09: 0000000000000000 [ 109.861860][ T7234] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 109.861866][ T7234] R13: 00007f91bb826038 R14: 00007f91bb825fa0 R15: 00007ffd75fdf678 [ 109.861880][ T7234] [ 109.862403][ T7231] nvme nvme0: failed to connect socket: -111 [ 109.908120][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.908139][ T7238] overlayfs: overlapping lowerdir path [ 109.909658][ T7236] overlayfs: overlapping lowerdir path [ 109.918725][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.918743][ T7238] overlayfs: overlapping lowerdir path [ 109.920036][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.920481][ T7238] overlayfs: overlapping lowerdir path [ 109.921455][ T7236] overlayfs: overlapping lowerdir path [ 109.924487][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.924503][ T7238] overlayfs: overlapping lowerdir path [ 109.926705][ T7236] overlayfs: overlapping lowerdir path [ 109.928692][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.928708][ T7238] overlayfs: overlapping lowerdir path [ 109.929309][ T7236] overlayfs: overlapping lowerdir path [ 109.931104][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.931119][ T7238] overlayfs: overlapping lowerdir path [ 109.932162][ T7236] overlayfs: overlapping lowerdir path [ 109.938586][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.938603][ T7238] overlayfs: overlapping lowerdir path [ 109.941087][ T7236] overlayfs: overlapping lowerdir path [ 109.942037][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.942052][ T7238] overlayfs: overlapping lowerdir path [ 109.948513][ T7236] overlayfs: overlapping lowerdir path [ 109.949300][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.949315][ T7238] overlayfs: overlapping lowerdir path [ 109.950654][ T7236] overlayfs: overlapping lowerdir path [ 109.957101][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.957117][ T7238] overlayfs: overlapping lowerdir path [ 109.958503][ T7236] overlayfs: overlapping lowerdir path [ 109.959531][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.959552][ T7238] overlayfs: overlapping lowerdir path [ 109.961570][ T7236] overlayfs: overlapping lowerdir path [ 109.962164][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.962179][ T7238] overlayfs: overlapping lowerdir path [ 109.964111][ T7236] overlayfs: overlapping lowerdir path [ 109.969192][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.969207][ T7238] overlayfs: overlapping lowerdir path [ 109.969736][ T7236] overlayfs: overlapping lowerdir path [ 109.971726][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.971740][ T7238] overlayfs: overlapping lowerdir path [ 109.972776][ T7236] overlayfs: overlapping lowerdir path [ 109.977313][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.977328][ T7238] overlayfs: overlapping lowerdir path [ 109.986369][ T7236] overlayfs: overlapping lowerdir path [ 109.989417][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.989440][ T7238] overlayfs: overlapping lowerdir path [ 109.990045][ T7236] overlayfs: overlapping lowerdir path [ 109.991235][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.991249][ T7238] overlayfs: overlapping lowerdir path [ 109.994049][ T7236] overlayfs: overlapping lowerdir path [ 109.998771][ T7236] overlayfs: overlapping lowerdir path [ 109.998987][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 109.999001][ T7238] overlayfs: overlapping lowerdir path [ 110.000142][ T7236] overlayfs: overlapping lowerdir path [ 110.001976][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.001991][ T7238] overlayfs: overlapping lowerdir path [ 110.002671][ T7236] overlayfs: overlapping lowerdir path [ 110.003557][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.003571][ T7238] overlayfs: overlapping lowerdir path [ 110.007426][ T7236] overlayfs: overlapping lowerdir path [ 110.008906][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.008920][ T7238] overlayfs: overlapping lowerdir path [ 110.009544][ T7236] overlayfs: overlapping lowerdir path [ 110.010428][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.010442][ T7238] overlayfs: overlapping lowerdir path [ 110.011146][ T7236] overlayfs: overlapping lowerdir path [ 110.012953][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.012968][ T7238] overlayfs: overlapping lowerdir path [ 110.014777][ T7236] overlayfs: overlapping lowerdir path [ 110.015473][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.015487][ T7238] overlayfs: overlapping lowerdir path [ 110.018353][ T7236] overlayfs: overlapping lowerdir path [ 110.019431][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.019446][ T7238] overlayfs: overlapping lowerdir path [ 110.020230][ T7236] overlayfs: overlapping lowerdir path [ 110.021550][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.021565][ T7238] overlayfs: overlapping lowerdir path [ 110.023292][ T7236] overlayfs: overlapping lowerdir path [ 110.025686][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.025701][ T7238] overlayfs: overlapping lowerdir path [ 110.027867][ T7236] overlayfs: overlapping lowerdir path [ 110.028817][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.028832][ T7238] overlayfs: overlapping lowerdir path [ 110.029384][ T7236] overlayfs: overlapping lowerdir path [ 110.032007][ T7236] overlayfs: overlapping lowerdir path [ 110.036325][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.036341][ T7238] overlayfs: overlapping lowerdir path [ 110.038518][ T7236] overlayfs: overlapping lowerdir path [ 110.039094][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.039109][ T7238] overlayfs: overlapping lowerdir path [ 110.039973][ T7236] overlayfs: overlapping lowerdir path [ 110.040559][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.040573][ T7238] overlayfs: overlapping lowerdir path [ 110.041664][ T7236] overlayfs: overlapping lowerdir path [ 110.044887][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.044901][ T7238] overlayfs: overlapping lowerdir path [ 110.047329][ T7236] overlayfs: overlapping lowerdir path [ 110.049023][ T7238] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 110.049038][ T7238] overlayfs: overlapping lowerdir path [ 110.086118][ T7249] netlink: 4 bytes leftover after parsing attributes in process `syz.3.332'. [ 110.134212][ T44] audit: type=1400 audit(1789055355.038:584): avc: denied { mount } for pid=7243 comm="syz.1.331" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 110.181579][ T7263] netlink: 'syz.3.334': attribute type 9 has an invalid length. [ 110.204931][ T44] audit: type=1400 audit(1789055355.108:585): avc: denied { mounton } for pid=7243 comm="syz.1.331" path="/93/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 110.226884][ T7263] netlink: 20 bytes leftover after parsing attributes in process `syz.3.334'. [ 110.377895][ T7247] cgroup: fork rejected by pids controller in /syz1 [ 110.628043][ T7404] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 110.642652][ T44] audit: type=1400 audit(1789055355.548:586): avc: denied { unmount } for pid=5748 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 110.723380][ T7414] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 110.723380][ T7414] The task syz.4.338 (7414) triggered the difference, watch for misbehavior. [ 111.528981][ T44] audit: type=1400 audit(1789055356.438:587): avc: denied { mounton } for pid=7423 comm="syz.4.340" path="/62/sys" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 111.581256][ T7424] smpboot: CPU 1 is now offline [ 111.990769][ T44] audit: type=1400 audit(1789055356.898:588): avc: denied { ioctl } for pid=7438 comm="syz.4.347" path="socket:[16040]" dev="sockfs" ino=16040 ioctlcmd=0x8955 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 112.122941][ T44] audit: type=1400 audit(1789055357.028:589): avc: denied { shutdown } for pid=7440 comm="syz.4.348" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 112.123134][ T44] audit: type=1400 audit(1789055357.028:590): avc: denied { getopt } for pid=7440 comm="syz.4.348" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 112.175894][ T2326] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 112.326541][ T2326] usb 6-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 112.327438][ T2326] usb 6-1: config 1 has an invalid interface number: 3 but max is 0 [ 112.327452][ T2326] usb 6-1: config 1 has no interface number 0 [ 112.328959][ T2326] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.328971][ T2326] usb 6-1: Product: syz [ 112.328978][ T2326] usb 6-1: Manufacturer: syz [ 112.328985][ T2326] usb 6-1: SerialNumber: syz [ 112.337928][ T2326] usb 6-1: 3:1 : does not exist [ 112.337946][ T2326] usb 6-1: 3:2 : does not exist [ 112.934705][ T7445] netlink: 88 bytes leftover after parsing attributes in process `syz.4.349'. [ 113.097529][ T26] usb 6-1: USB disconnect, device number 5 [ 113.114578][ T7434] binder: BINDER_SET_CONTEXT_MGR already set [ 113.114588][ T7434] binder: 7432:7434 ioctl 4018620d 200000004a80 returned -16 [ 113.423208][ T5895] kernel read not supported for file /195/setgroups (pid: 5895 comm: kworker/0:4) [ 113.521387][ T44] audit: type=1400 audit(1789055358.428:591): avc: denied { watch watch_reads } for pid=7464 comm="syz.3.356" path="/proc/198/task/199/setgroups" dev="proc" ino=16273 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 113.638150][ T7470] nvme_fabrics: missing parameter 'transport=%s' [ 113.638161][ T7470] nvme_fabrics: missing parameter 'nqn=%s' [ 113.657621][ T7470] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 113.657645][ T7470] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 113.657981][ T7470] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 113.718633][ T7476] team0 (unregistering): Port device team_slave_0 removed [ 113.721049][ T7476] team0 (unregistering): Port device team_slave_1 removed [ 113.857566][ T7486] netlink: 24 bytes leftover after parsing attributes in process `syz.4.364'. [ 113.983758][ T7496] netlink: 40 bytes leftover after parsing attributes in process `syz.4.366'. [ 114.015335][ T7489] affs: No valid root block on device nullb0 [ 114.141204][ T7504] kvm: vcpu 0: requested 34 ns lapic timer period limited to 200000 ns [ 114.192207][ T7508] netlink: 12 bytes leftover after parsing attributes in process `syz.4.367'. [ 114.664292][ T44] kauditd_printk_skb: 2 callbacks suppressed [ 114.664308][ T44] audit: type=1400 audit(1789055359.568:594): avc: denied { connect } for pid=7528 comm="syz.3.373" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 114.720948][ T44] audit: type=1400 audit(1789055359.628:595): avc: denied { write } for pid=7530 comm="syz.1.374" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 114.967212][ T44] audit: type=1400 audit(1789055359.878:596): avc: denied { ioctl } for pid=7548 comm="syz.3.380" path="socket:[18016]" dev="sockfs" ino=18016 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 114.999820][ T44] audit: type=1400 audit(1789055359.908:597): avc: denied { read } for pid=7551 comm="syz.1.379" path="socket:[18017]" dev="sockfs" ino=18017 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 115.036692][ T44] audit: type=1400 audit(1789055359.948:598): avc: denied { watch watch_reads } for pid=7548 comm="syz.3.380" path="/76/file5" dev="tmpfs" ino=441 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 115.073766][ T44] audit: type=1400 audit(1789055359.978:599): avc: denied { read write } for pid=7556 comm="syz.4.381" name="uhid" dev="devtmpfs" ino=1293 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 115.074439][ T44] audit: type=1400 audit(1789055359.978:600): avc: denied { open } for pid=7556 comm="syz.4.381" path="/dev/uhid" dev="devtmpfs" ino=1293 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 115.107116][ T7552] netlink: 4 bytes leftover after parsing attributes in process `syz.1.379'. [ 115.107166][ T7552] bridge_slave_1: left allmulticast mode [ 115.107178][ T7552] bridge_slave_1: left promiscuous mode [ 115.107283][ T7552] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.111195][ T7552] bridge_slave_0: left allmulticast mode [ 115.111209][ T7552] bridge_slave_0: left promiscuous mode [ 115.112189][ T7552] bridge0: port 1(bridge_slave_0) entered disabled state [ 115.130736][ T26] hid-generic 0006:0008:0008.0003: unknown main item tag 0x0 [ 115.130778][ T26] hid-generic 0006:0008:0008.0003: unknown main item tag 0x0 [ 115.130792][ T26] hid-generic 0006:0008:0008.0003: unknown main item tag 0x2 [ 115.130804][ T26] hid-generic 0006:0008:0008.0003: unknown main item tag 0x1 [ 115.151245][ T26] hid-generic 0006:0008:0008.0003: hidraw1: VIRTUAL HID v0.04 Device [syz1] on syz1 [ 115.192047][ T7569] fido_id[7569]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 115.347856][ T7572] input: syz0 as /devices/virtual/input/input9 [ 115.352587][ T44] audit: type=1400 audit(1789055360.258:601): avc: denied { read } for pid=5132 comm="acpid" name="mouse2" dev="devtmpfs" ino=2922 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 115.352898][ T44] audit: type=1400 audit(1789055360.258:602): avc: denied { open } for pid=5132 comm="acpid" path="/dev/input/mouse2" dev="devtmpfs" ino=2922 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 115.353244][ T44] audit: type=1400 audit(1789055360.258:603): avc: denied { ioctl } for pid=5132 comm="acpid" path="/dev/input/mouse2" dev="devtmpfs" ino=2922 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 115.413956][ T7571] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 115.580051][ T7575] netlink: zone id is out of range [ 115.580062][ T7575] netlink: set zone limit has 8 unknown bytes [ 115.784610][ T7585] netlink: 4 bytes leftover after parsing attributes in process `syz.1.389'. [ 115.847702][ T7585] netlink: 92 bytes leftover after parsing attributes in process `syz.1.389'. [ 115.869035][ T7590] netlink: 'syz.3.391': attribute type 1 has an invalid length. [ 115.899297][ T7590] 8021q: adding VLAN 0 to HW filter on device bond5 [ 115.900531][ T7590] bond4: (slave bond5): making interface the new active one [ 115.900818][ T7590] bond4: (slave bond5): Enslaving as an active interface with an up link [ 115.970342][ T7596] ieee802154 phy0 wpan0: encryption failed: -22 [ 116.215042][ T7610] zero sized request [ 116.270205][ T7616] netlink: 'syz.3.400': attribute type 3 has an invalid length. [ 116.524136][ T7622] netlink: 4 bytes leftover after parsing attributes in process `syz.4.403'. [ 116.783341][ T7633] netlink: 8 bytes leftover after parsing attributes in process `syz.1.408'. [ 116.783354][ T7633] netlink: 4 bytes leftover after parsing attributes in process `syz.1.408'. [ 116.815936][ T25] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 116.815962][ T25] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 116.815979][ T25] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 116.815996][ T25] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 117.072652][ T7651] syzkaller0: entered promiscuous mode [ 117.072666][ T7651] syzkaller0: entered allmulticast mode [ 117.215252][ T7656] overlayfs: failed to resolve './file0': -2 [ 118.532404][ T7686] 9pnet_virtio: no channels available for device ./file0 [ 118.836409][ T39] rpcbind: server 127.0.0.1 not responding, timed out [ 119.169155][ T7696] netlink: 8 bytes leftover after parsing attributes in process `syz.4.427'. [ 119.257247][ T7698] loop5: detected capacity change from 0 to 7 [ 119.260001][ T7698] Dev loop5: unable to read RDB block 7 [ 119.260022][ T7698] loop5: unable to read partition table [ 119.260124][ T7698] loop5: partition table beyond EOD, truncated [ 119.260160][ T7698] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 119.630176][ T7711] Bluetooth: MGMT ver 1.23 [ 119.630477][ T7711] Bluetooth: MGMT ver 1.23 [ 120.382488][ T44] kauditd_printk_skb: 25 callbacks suppressed [ 120.382505][ T44] audit: type=1400 audit(1789055366.291:629): avc: denied { listen } for pid=7724 comm="syz.4.434" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 120.398371][ T7725] netlink: 'syz.4.434': attribute type 1 has an invalid length. [ 120.432533][ T7725] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 120.432786][ T7727] ªªªªªª: renamed from vlan0 (while UP) [ 120.443296][ T7725] netlink: 'syz.4.434': attribute type 1 has an invalid length. [ 120.464643][ T7725] 8021q: adding VLAN 0 to HW filter on device macvlan1 [ 120.541656][ T7733] netlink: 36 bytes leftover after parsing attributes in process `syz.4.437'. [ 120.542164][ T44] audit: type=1400 audit(1789055366.451:630): avc: denied { read } for pid=7732 comm="syz.4.437" name="/" dev="configfs" ino=1037 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 120.545482][ T44] audit: type=1400 audit(1789055366.451:631): avc: denied { read open } for pid=7732 comm="syz.4.437" path="/" dev="configfs" ino=1037 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 120.545519][ T44] audit: type=1400 audit(1789055366.451:632): avc: denied { read } for pid=7732 comm="syz.4.437" name="/" dev="configfs" ino=1037 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 120.673492][ T44] audit: type=1400 audit(1789055366.581:633): avc: denied { write } for pid=7739 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 120.737947][ T44] audit: type=1400 audit(1789055366.651:634): avc: denied { write } for pid=7742 comm="rm" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 120.797805][ T44] audit: type=1400 audit(1789055366.711:635): avc: denied { mount } for pid=7729 comm="syz.3.436" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 120.819947][ T44] audit: type=1400 audit(1789055366.731:636): avc: denied { unmount } for pid=5747 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 120.856543][ T5895] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 120.912843][ T44] audit: type=1400 audit(1789055366.821:637): avc: denied { write } for pid=7752 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 120.931455][ T7754] netlink: 'syz.3.440': attribute type 39 has an invalid length. [ 120.955658][ T44] audit: type=1400 audit(1789055366.861:638): avc: denied { write } for pid=7759 comm="rm" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 121.019047][ T5895] usb 9-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 121.019852][ T5895] usb 9-1: config 1 has an invalid interface number: 7 but max is 0 [ 121.019865][ T5895] usb 9-1: config 1 has no interface number 0 [ 121.019882][ T5895] usb 9-1: config 1 interface 7 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1023 [ 121.019895][ T5895] usb 9-1: config 1 interface 7 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 64 [ 121.019906][ T5895] usb 9-1: config 1 interface 7 altsetting 0 endpoint 0xE has an invalid bInterval 255, changing to 11 [ 121.021535][ T5895] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.021546][ T5895] usb 9-1: Product: syz [ 121.021553][ T5895] usb 9-1: Manufacturer: syz [ 121.021561][ T5895] usb 9-1: SerialNumber: syz [ 121.032926][ T7736] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 121.032979][ T7736] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 121.044299][ T5895] usb 9-1: Error in usbnet_get_endpoints (-22) [ 121.309823][ T7771] netlink: 'syz.1.442': attribute type 4 has an invalid length. [ 121.312170][ T7771] netlink: 12 bytes leftover after parsing attributes in process `syz.1.442'. [ 121.327262][ T7771] netlink: 12 bytes leftover after parsing attributes in process `syz.1.442'. [ 121.869317][ T7784] FAULT_INJECTION: forcing a failure. [ 121.869317][ T7784] name failslab, interval 1, probability 0, space 0, times 0 [ 121.869337][ T7784] CPU: 2 UID: 0 PID: 7784 Comm: syz.1.444 Tainted: G L syzkaller #0 PREEMPT(full) [ 121.869353][ T7784] Tainted: [L]=SOFTLOCKUP [ 121.869356][ T7784] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 121.869363][ T7784] Call Trace: [ 121.869367][ T7784] [ 121.869372][ T7784] dump_stack_lvl+0x100/0x190 [ 121.869399][ T7784] should_fail_ex.cold+0x5/0xa [ 121.869415][ T7784] should_failslab+0xc2/0x120 [ 121.869432][ T7784] __kmalloc_cache_noprof+0x91/0x6d0 [ 121.869449][ T7784] ? p9_client_create+0xaf/0xd40 [ 121.869472][ T7784] p9_client_create+0xaf/0xd40 [ 121.869490][ T7784] ? __pfx_p9_client_create+0x10/0x10 [ 121.869509][ T7784] ? lockdep_init_map_type+0x5c/0x250 [ 121.869523][ T7784] ? __raw_spin_lock_init+0x3a/0x110 [ 121.869539][ T7784] v9fs_session_init+0x3c/0xdd0 [ 121.869558][ T7784] ? v9fs_get_tree+0x9c/0xb50 [ 121.869577][ T7784] v9fs_get_tree+0xb8/0xb50 [ 121.869592][ T7784] ? rcu_is_watching+0x13/0xc0 [ 121.869607][ T7784] ? __pfx_v9fs_get_tree+0x10/0x10 [ 121.869624][ T7784] ? bpf_lsm_capable+0x9/0x10 [ 121.869640][ T7784] ? security_capable+0x80/0x260 [ 121.869657][ T7784] vfs_get_tree+0x92/0x320 [ 121.869673][ T7784] path_mount+0x7d0/0x24c0 [ 121.869692][ T7784] ? __pfx_path_mount+0x10/0x10 [ 121.869707][ T7784] ? lockdep_hardirqs_on+0x7d/0x110 [ 121.869723][ T7784] ? putname+0xb1/0x110 [ 121.869736][ T7784] ? kmem_cache_free+0x127/0x6c0 [ 121.869760][ T7784] ? __x64_sys_mount+0x293/0x310 [ 121.869776][ T7784] __x64_sys_mount+0x293/0x310 [ 121.869792][ T7784] ? __pfx___x64_sys_mount+0x10/0x10 [ 121.869812][ T7784] do_syscall_64+0x123/0x790 [ 121.869827][ T7784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.869839][ T7784] RIP: 0033:0x7f00dc79e159 [ 121.869848][ T7784] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 121.869859][ T7784] RSP: 002b:00007f00dd6aa028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 121.869870][ T7784] RAX: ffffffffffffffda RBX: 00007f00dca25fa0 RCX: 00007f00dc79e159 [ 121.869877][ T7784] RDX: 0000200000000080 RSI: 0000200000000300 RDI: 0000000000000000 [ 121.869883][ T7784] RBP: 00007f00dd6aa090 R08: 0000200000000240 R09: 0000000000000000 [ 121.869890][ T7784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 121.869896][ T7784] R13: 00007f00dca26038 R14: 00007f00dca25fa0 R15: 00007ffc9bf90068 [ 121.869910][ T7784] [ 121.930660][ T7788] netlink: 'syz.3.446': attribute type 1 has an invalid length. [ 121.960640][ T7788] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 121.970047][ T7788] netlink: 'syz.3.446': attribute type 1 has an invalid length. [ 121.992243][ T7788] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 122.946866][ T7868] binder: BINDER_SET_CONTEXT_MGR already set [ 122.946876][ T7868] binder: 7867:7868 ioctl 4018620d 200000000100 returned -16 [ 123.313327][ T5094] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 123.315630][ T5094] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 123.323647][ T5094] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 123.327157][ T5094] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 123.328016][ T5094] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 123.447432][ T7890] FAULT_INJECTION: forcing a failure. [ 123.447432][ T7890] name failslab, interval 1, probability 0, space 0, times 0 [ 123.447453][ T7890] CPU: 2 UID: 0 PID: 7890 Comm: syz.1.456 Tainted: G L syzkaller #0 PREEMPT(full) [ 123.447469][ T7890] Tainted: [L]=SOFTLOCKUP [ 123.447472][ T7890] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 123.447479][ T7890] Call Trace: [ 123.447483][ T7890] [ 123.447487][ T7890] dump_stack_lvl+0x100/0x190 [ 123.447517][ T7890] should_fail_ex.cold+0x5/0xa [ 123.447533][ T7890] should_failslab+0xc2/0x120 [ 123.447550][ T7890] __kmalloc_cache_noprof+0x91/0x6d0 [ 123.447567][ T7890] ? __kasan_kmalloc+0xaa/0xb0 [ 123.447579][ T7890] ? p9_fd_create+0x163/0x460 [ 123.447597][ T7890] p9_fd_create+0x163/0x460 [ 123.447610][ T7890] p9_client_create+0x563/0xd40 [ 123.447627][ T7890] ? __pfx_p9_client_create+0x10/0x10 [ 123.447647][ T7890] ? lockdep_init_map_type+0x5c/0x250 [ 123.447661][ T7890] ? __raw_spin_lock_init+0x3a/0x110 [ 123.447677][ T7890] v9fs_session_init+0x3c/0xdd0 [ 123.447691][ T7890] ? v9fs_get_tree+0x9c/0xb50 [ 123.447709][ T7890] v9fs_get_tree+0xb8/0xb50 [ 123.447724][ T7890] ? rcu_is_watching+0x13/0xc0 [ 123.447739][ T7890] ? __pfx_v9fs_get_tree+0x10/0x10 [ 123.447756][ T7890] ? bpf_lsm_capable+0x9/0x10 [ 123.447772][ T7890] ? security_capable+0x80/0x260 [ 123.447789][ T7890] vfs_get_tree+0x92/0x320 [ 123.447806][ T7890] path_mount+0x7d0/0x24c0 [ 123.447825][ T7890] ? __pfx_path_mount+0x10/0x10 [ 123.447840][ T7890] ? lockdep_hardirqs_on+0x7d/0x110 [ 123.447855][ T7890] ? putname+0xb1/0x110 [ 123.447868][ T7890] ? kmem_cache_free+0x127/0x6c0 [ 123.447889][ T7890] ? __x64_sys_mount+0x293/0x310 [ 123.447904][ T7890] __x64_sys_mount+0x293/0x310 [ 123.447920][ T7890] ? __pfx___x64_sys_mount+0x10/0x10 [ 123.447950][ T7890] do_syscall_64+0x123/0x790 [ 123.447966][ T7890] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.447977][ T7890] RIP: 0033:0x7f00dc79e159 [ 123.447987][ T7890] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.447997][ T7890] RSP: 002b:00007f00dd6aa028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 123.448008][ T7890] RAX: ffffffffffffffda RBX: 00007f00dca25fa0 RCX: 00007f00dc79e159 [ 123.448015][ T7890] RDX: 0000200000000080 RSI: 0000200000000300 RDI: 0000000000000000 [ 123.448022][ T7890] RBP: 00007f00dd6aa090 R08: 0000200000000240 R09: 0000000000000000 [ 123.448028][ T7890] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 123.448035][ T7890] R13: 00007f00dca26038 R14: 00007f00dca25fa0 R15: 00007ffc9bf90068 [ 123.448052][ T7890] [ 123.636393][ T26] usb 9-1: USB disconnect, device number 5 [ 123.680988][ T7907] nvme_tcp: malformed address passed: 1:8009 [ 123.710257][ T7908] nvme_tcp: malformed address passed: 1:8009 [ 123.981747][ T7938] FAULT_INJECTION: forcing a failure. [ 123.981747][ T7938] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 123.981768][ T7938] CPU: 0 UID: 0 PID: 7938 Comm: syz.4.464 Tainted: G L syzkaller #0 PREEMPT(full) [ 123.981783][ T7938] Tainted: [L]=SOFTLOCKUP [ 123.981787][ T7938] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 123.981794][ T7938] Call Trace: [ 123.981798][ T7938] [ 123.981803][ T7938] dump_stack_lvl+0x100/0x190 [ 123.981823][ T7938] should_fail_ex.cold+0x5/0xa [ 123.981839][ T7938] _copy_to_user+0x32/0xd0 [ 123.981851][ T7938] simple_read_from_buffer+0xcb/0x170 [ 123.981867][ T7938] proc_fail_nth_read+0x1af/0x230 [ 123.981884][ T7938] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 123.981898][ T7938] ? rw_verify_area+0xce/0x6d0 [ 123.981914][ T7938] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 123.981927][ T7938] vfs_read+0x1e4/0xb40 [ 123.981938][ T7938] ? lock_acquire+0x1d1/0x380 [ 123.981949][ T7938] ? __fget_files+0x34/0x3d0 [ 123.981962][ T7938] ? __pfx_vfs_read+0x10/0x10 [ 123.981972][ T7938] ? find_held_lock+0x2b/0x80 [ 123.981988][ T7938] ? __fget_files+0x215/0x3d0 [ 123.982003][ T7938] ? __fget_files+0x21f/0x3d0 [ 123.982020][ T7938] ksys_read+0x12a/0x250 [ 123.982030][ T7938] ? __pfx_ksys_read+0x10/0x10 [ 123.982068][ T7938] do_syscall_64+0x123/0x790 [ 123.982085][ T7938] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.982097][ T7938] RIP: 0033:0x7fbe7495e98e [ 123.982106][ T7938] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 123.982117][ T7938] RSP: 002b:00007fbe7585afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 123.982129][ T7938] RAX: ffffffffffffffda RBX: 00007fbe7585b6c0 RCX: 00007fbe7495e98e [ 123.982136][ T7938] RDX: 000000000000000f RSI: 00007fbe7585b0a0 RDI: 0000000000000005 [ 123.982142][ T7938] RBP: 00007fbe7585b090 R08: 0000000000000000 R09: 0000000000000000 [ 123.982149][ T7938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 123.982155][ T7938] R13: 00007fbe74c26038 R14: 00007fbe74c25fa0 R15: 00007ffdcc6d2b28 [ 123.982169][ T7938] [ 124.110055][ T7878] bridge0: port 1(bridge_slave_0) entered blocking state [ 124.111178][ T7878] bridge0: port 1(bridge_slave_0) entered disabled state [ 124.111243][ T7878] bridge_slave_0: entered allmulticast mode [ 124.112092][ T7878] bridge_slave_0: entered promiscuous mode [ 124.113414][ T7878] bridge0: port 2(bridge_slave_1) entered blocking state [ 124.113474][ T7878] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.113536][ T7878] bridge_slave_1: entered allmulticast mode [ 124.114461][ T7878] bridge_slave_1: entered promiscuous mode [ 124.131778][ T7878] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 124.133213][ T7878] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 124.154211][ T7878] team0: Port device team_slave_0 added [ 124.157558][ T7878] team0: Port device team_slave_1 added [ 124.178169][ T7953] Invalid ELF header type: 2 != 1 [ 124.178300][ T7953] Invalid ELF header type: 2 != 1 [ 124.178361][ T7953] Invalid ELF header type: 2 != 1 [ 124.178426][ T7953] Invalid ELF header type: 2 != 1 [ 124.178485][ T7953] Invalid ELF header type: 2 != 1 [ 124.178555][ T7953] Invalid ELF header type: 2 != 1 [ 124.180210][ T7878] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 124.180219][ T7878] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 124.180232][ T7878] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 124.180742][ T7953] Invalid ELF header type: 2 != 1 [ 124.180845][ T7953] Invalid ELF header type: 2 != 1 [ 124.180960][ T7953] Invalid ELF header type: 2 != 1 [ 124.181075][ T7953] Invalid ELF header type: 2 != 1 [ 124.181170][ T7953] Invalid ELF header type: 2 != 1 [ 124.181264][ T7953] Invalid ELF header type: 2 != 1 [ 124.181302][ T7878] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 124.181309][ T7878] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 124.181322][ T7878] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 124.181359][ T7953] Invalid ELF header type: 2 != 1 [ 124.181477][ T7953] Invalid ELF header type: 2 != 1 [ 124.181599][ T7953] Invalid ELF header type: 2 != 1 [ 124.181696][ T7953] Invalid ELF header type: 2 != 1 [ 124.181810][ T7953] Invalid ELF header type: 2 != 1 [ 124.181905][ T7953] Invalid ELF header type: 2 != 1 [ 124.182026][ T7953] Invalid ELF header type: 2 != 1 [ 124.182124][ T7953] Invalid ELF header type: 2 != 1 [ 124.182337][ T7953] Invalid ELF header type: 2 != 1 [ 124.182444][ T7953] Invalid ELF header type: 2 != 1 [ 124.182521][ T7953] Invalid ELF header type: 2 != 1 [ 124.182615][ T7953] Invalid ELF header type: 2 != 1 [ 124.182728][ T7953] Invalid ELF header type: 2 != 1 [ 124.182822][ T7953] Invalid ELF header type: 2 != 1 [ 124.182941][ T7953] Invalid ELF header type: 2 != 1 [ 124.183067][ T7953] Invalid ELF header type: 2 != 1 [ 124.183181][ T7953] Invalid ELF header type: 2 != 1 [ 124.183314][ T7953] Invalid ELF header type: 2 != 1 [ 124.183444][ T7953] Invalid ELF header type: 2 != 1 [ 124.183571][ T7953] Invalid ELF header type: 2 != 1 [ 124.183716][ T7953] Invalid ELF header type: 2 != 1 [ 124.295504][ T7958] netlink: 'syz.4.468': attribute type 1 has an invalid length. [ 124.300572][ T7878] hsr_slave_0: entered promiscuous mode [ 124.301010][ T7878] hsr_slave_1: entered promiscuous mode [ 124.301311][ T7878] debugfs: 'hsr0' already exists in 'hsr' [ 124.301322][ T7878] Cannot create hsr debugfs directory [ 124.337414][ T25] bridge_slave_1: left promiscuous mode [ 124.337558][ T25] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.343069][ T25] bridge_slave_0: left allmulticast mode [ 124.343086][ T25] bridge_slave_0: left promiscuous mode [ 124.343228][ T25] bridge0: port 1(bridge_slave_0) entered disabled state [ 124.358286][ T7962] netlink: 4 bytes leftover after parsing attributes in process `syz.1.470'. [ 124.452246][ T25] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 124.454485][ T25] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 124.457298][ T7966] netlink: 40 bytes leftover after parsing attributes in process `syz.1.471'. [ 124.466483][ T25] bond0 (unregistering): Released all slaves [ 124.469769][ T25] bond1 (unregistering): Released all slaves [ 124.657376][ T5451] 8021q: adding VLAN 0 to HW filter on device eth6 [ 124.712282][ T7878] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 124.740311][ T7878] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 124.756663][ T7878] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 124.760146][ T7878] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 124.760715][ T7878] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 124.765023][ T7878] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 124.767660][ T7878] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 124.781565][ T7878] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 124.814980][ T25] hsr_slave_0: left promiscuous mode [ 124.815421][ T25] hsr_slave_1: left promiscuous mode [ 124.816582][ T25] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 124.817247][ T25] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 124.992855][ T5451] 8021q: adding VLAN 0 to HW filter on device eth7 [ 125.054722][ T7878] 8021q: adding VLAN 0 to HW filter on device bond0 [ 125.068139][ T7878] 8021q: adding VLAN 0 to HW filter on device team0 [ 125.072002][ T1165] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.072049][ T1165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 125.078155][ T110] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.078199][ T110] bridge0: port 2(bridge_slave_1) entered forwarding state [ 125.253024][ T25] IPVS: stop unused estimator thread 0... [ 125.270705][ T7997] syz.1.473 (7997): attempted to duplicate a private mapping with mremap. This is not supported. [ 125.344646][ T5451] 8021q: adding VLAN 0 to HW filter on device eth8 [ 125.397237][ T5760] Bluetooth: hci4: command tx timeout [ 125.400849][ T44] kauditd_printk_skb: 30 callbacks suppressed [ 125.400860][ T44] audit: type=1400 audit(1789055371.311:669): avc: denied { write } for pid=8012 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 125.443793][ T44] audit: type=1400 audit(1789055371.351:670): avc: denied { write } for pid=8021 comm="rm" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 125.493052][ T8020] sch_tbf: burst 0 is lower than device veth1 mtu (1514) ! [ 125.521714][ T7878] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 125.561511][ T44] audit: type=1400 audit(1789055371.471:671): avc: denied { write } for pid=8027 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 125.612039][ T44] audit: type=1400 audit(1789055371.521:672): avc: denied { write } for pid=8035 comm="rm" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 125.659619][ T5451] 8021q: adding VLAN 0 to HW filter on device eth9 [ 125.693211][ T44] audit: type=1400 audit(1789055371.601:673): avc: denied { wake_alarm } for pid=8043 comm="syz.1.479" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 125.734855][ T7878] veth0_vlan: entered promiscuous mode [ 125.740588][ T7878] veth1_vlan: entered promiscuous mode [ 125.742969][ T44] audit: type=1400 audit(1789055371.651:674): avc: denied { write } for pid=8029 comm="syz.4.478" name="functions" dev="configfs" ino=19693 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 125.743712][ T8041] LUN: removable file: (no medium) [ 125.749291][ T44] audit: type=1400 audit(1789055371.661:675): avc: denied { write } for pid=8029 comm="syz.4.478" name="mass_storage.0" dev="configfs" ino=22674 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 125.749681][ T8041] LUN: removable file: (no medium) [ 125.768538][ T7878] veth0_macvtap: entered promiscuous mode [ 125.771455][ T7878] veth1_macvtap: entered promiscuous mode [ 125.784106][ T7878] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 125.788178][ T7878] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 125.848689][ T110] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.848704][ T110] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.856477][ T25] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.856549][ T25] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.856567][ T25] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.856585][ T25] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.876129][ T5760] Bluetooth: hci0: command tx timeout [ 125.884868][ T1165] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.884881][ T1165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.903851][ T44] audit: type=1400 audit(1789055371.811:676): avc: denied { mounton } for pid=7878 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2834 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 125.958410][ T8052] netlink: 348 bytes leftover after parsing attributes in process `syz.5.455'. [ 125.961098][ T8053] netlink: 348 bytes leftover after parsing attributes in process `syz.5.455'. [ 126.035127][ T8055] syzkaller0: entered promiscuous mode [ 126.035141][ T8055] syzkaller0: entered allmulticast mode [ 126.042543][ T44] audit: type=1400 audit(1789055371.951:677): avc: denied { read } for pid=8054 comm="syz.3.480" dev="nsfs" ino=4026533018 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 126.042761][ T44] audit: type=1400 audit(1789055371.951:678): avc: denied { open } for pid=8054 comm="syz.3.480" path="net:[4026533018]" dev="nsfs" ino=4026533018 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 126.124763][ T8065] nftables ruleset with unbound set [ 126.179828][ T8067] netlink: 8 bytes leftover after parsing attributes in process `syz.5.485'. [ 126.188225][ T110] IPVS: starting estimator thread 0... [ 126.193328][ T8044] input: syz1 as /devices/virtual/input/input11 [ 126.194469][ T8067] netlink: 32 bytes leftover after parsing attributes in process `syz.5.485'. [ 126.197599][ T5545] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 126.287698][ T8068] IPVS: using max 43 ests per chain, 103200 per kthread [ 127.233446][ T8095] netlink: 4 bytes leftover after parsing attributes in process `syz.3.493'. [ 127.239353][ T8095] bridge_slave_1: left allmulticast mode [ 127.239370][ T8095] bridge_slave_1: left promiscuous mode [ 127.239465][ T8095] bridge0: port 2(bridge_slave_1) entered disabled state [ 127.476220][ T5760] Bluetooth: hci4: command tx timeout [ 127.554224][ T8112] xt_CT: You must specify a L4 protocol and not use inversions on it [ 127.563787][ T8114] xt_CT: You must specify a L4 protocol and not use inversions on it [ 127.914798][ T8122] netlink: 36 bytes leftover after parsing attributes in process `syz.1.498'. [ 127.989143][ T8126] netlink: 88 bytes leftover after parsing attributes in process `syz.1.500'. [ 128.039302][ T8130] ip6t_hbh: Not strict - not implemented [ 128.335962][ T36] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 128.374597][ T8140] netlink: 'syz.3.505': attribute type 21 has an invalid length. [ 128.485903][ T36] usb 6-1: Using ep0 maxpacket: 32 [ 128.488245][ T36] usb 6-1: unable to get BOS descriptor or descriptor too short [ 128.488270][ T36] usb 6-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 128.490298][ T36] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 128.490316][ T36] usb 6-1: can't read configurations, error -61 [ 128.581009][ T8153] netlink: 16 bytes leftover after parsing attributes in process `syz.3.508'. [ 128.583739][ T8153] bond0: (slave syz_tun): Releasing backup interface [ 128.592618][ T8153] bond0: (slave bond_slave_0): Releasing backup interface [ 128.594471][ T8153] bond0: (slave bond_slave_1): Releasing backup interface [ 128.600329][ T8153] team0: Port device team_slave_0 removed [ 128.602753][ T8153] team0: Port device team_slave_1 removed [ 128.603181][ T8153] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.603192][ T8153] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 128.604003][ T8153] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 128.604012][ T8153] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 128.611726][ T8153] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 128.614485][ T8155] netlink: 'syz.4.509': attribute type 4 has an invalid length. [ 128.620066][ T8156] netlink: 'syz.4.509': attribute type 4 has an invalid length. [ 128.626011][ T36] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 128.711675][ T8153] 8021q: adding VLAN 0 to HW filter on device bond1 [ 128.712990][ T8153] 8021q: adding VLAN 0 to HW filter on device bond2 [ 128.715463][ T8153] 8021q: adding VLAN 0 to HW filter on device bond4 [ 128.750949][ T8161] erspan0: entered promiscuous mode [ 128.774887][ T5824] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 128.774938][ T5824] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 128.774971][ T5824] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 128.774998][ T5824] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 128.796611][ T36] usb 6-1: Using ep0 maxpacket: 32 [ 128.805039][ T36] usb 6-1: unable to get BOS descriptor or descriptor too short [ 128.805065][ T36] usb 6-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 128.808498][ T36] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 128.808516][ T36] usb 6-1: can't read configurations, error -61 [ 128.808735][ T36] usb usb6-port1: attempt power cycle [ 128.825078][ T8179] FAULT_INJECTION: forcing a failure. [ 128.825078][ T8179] name fail_futex, interval 1, probability 0, space 0, times 1 [ 128.825100][ T8179] CPU: 3 UID: 0 PID: 8179 Comm: syz.3.512 Tainted: G L syzkaller #0 PREEMPT(full) [ 128.825133][ T8179] Tainted: [L]=SOFTLOCKUP [ 128.825138][ T8179] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 128.825144][ T8179] Call Trace: [ 128.825148][ T8179] [ 128.825153][ T8179] dump_stack_lvl+0x100/0x190 [ 128.825183][ T8179] should_fail_ex.cold+0x5/0xa [ 128.825200][ T8179] get_futex_key+0x1d0/0x14f0 [ 128.825218][ T8179] ? __pfx_get_futex_key+0x10/0x10 [ 128.825237][ T8179] futex_wait_setup+0x91/0x540 [ 128.825258][ T8179] __futex_wait+0x19f/0x300 [ 128.825276][ T8179] ? __pfx___futex_wait+0x10/0x10 [ 128.825292][ T8179] ? __pfx_try_to_wake_up+0x10/0x10 [ 128.825304][ T8179] ? futex_hash+0x311/0x400 [ 128.825318][ T8179] ? __pfx_futex_wake_mark+0x10/0x10 [ 128.825337][ T8179] ? find_held_lock+0x2b/0x80 [ 128.825352][ T8179] ? futex_wake+0x4ea/0x5e0 [ 128.825374][ T8179] futex_wait+0xe6/0x370 [ 128.825391][ T8179] ? __pfx_futex_wait+0x10/0x10 [ 128.825411][ T8179] ? __lock_acquire+0x5c0/0x1f40 [ 128.825425][ T8179] do_futex+0x265/0x440 [ 128.825440][ T8179] ? __pfx_do_futex+0x10/0x10 [ 128.825454][ T8179] ? __fget_files+0x34/0x3d0 [ 128.825472][ T8179] ? find_held_lock+0x2b/0x80 [ 128.825494][ T8179] __x64_sys_futex+0x34f/0x4d0 [ 128.825513][ T8179] ? __pfx___x64_sys_futex+0x10/0x10 [ 128.825534][ T8179] do_syscall_64+0x123/0x790 [ 128.825554][ T8179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.825566][ T8179] RIP: 0033:0x7f91bb59e159 [ 128.825576][ T8179] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.825586][ T8179] RSP: 002b:00007f91bc4a50e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 128.825598][ T8179] RAX: ffffffffffffffda RBX: 00007f91bb825fa8 RCX: 00007f91bb59e159 [ 128.825604][ T8179] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f91bb825fa8 [ 128.825611][ T8179] RBP: 00007f91bb825fa0 R08: 0000000000000000 R09: 0000000000000000 [ 128.825617][ T8179] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 128.825624][ T8179] R13: 00007f91bb826038 R14: 00007ffd75fdf590 R15: 00007ffd75fdf678 [ 128.825638][ T8179] [ 128.936549][ T8195] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=32784 sclass=netlink_route_socket pid=8195 comm=syz.4.513 [ 129.059950][ T8212] ip_tables: iptables: counters copy to user failed while replacing table [ 129.061338][ T8210] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 129.069124][ T8210] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 129.070160][ T8210] team0: Mode changed to "activebackup" [ 129.082035][ T8212] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=23312 sclass=netlink_route_socket pid=8212 comm=syz.5.518 [ 129.093879][ T8212] netlink: 'syz.5.518': attribute type 10 has an invalid length. [ 129.093960][ T8212] dummy0: entered promiscuous mode [ 129.166031][ T36] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 129.196596][ T36] usb 6-1: Using ep0 maxpacket: 32 [ 129.198096][ T36] usb 6-1: unable to get BOS descriptor or descriptor too short [ 129.198119][ T36] usb 6-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 129.199624][ T36] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 129.199643][ T36] usb 6-1: can't read configurations, error -61 [ 129.336153][ T36] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 129.367965][ T36] usb 6-1: Using ep0 maxpacket: 32 [ 129.369406][ T36] usb 6-1: unable to get BOS descriptor or descriptor too short [ 129.369429][ T36] usb 6-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 129.370868][ T36] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 129.370885][ T36] usb 6-1: can't read configurations, error -61 [ 129.371079][ T36] usb usb6-port1: unable to enumerate USB device [ 129.556358][ T5760] Bluetooth: hci4: command tx timeout [ 129.915427][ T8263] __nla_validate_parse: 3 callbacks suppressed [ 129.915443][ T8263] netlink: 104 bytes leftover after parsing attributes in process `syz.3.525'. [ 129.916559][ T8264] netlink: 96 bytes leftover after parsing attributes in process `syz.3.525'. [ 129.918233][ T9] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 130.031148][ T8279] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 130.032213][ T8279] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 130.077206][ T9] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 130.077727][ T9] usb 9-1: config 0 has no interfaces? [ 130.079522][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.079542][ T9] usb 9-1: Product: syz [ 130.079554][ T9] usb 9-1: Manufacturer: syz [ 130.079569][ T9] usb 9-1: SerialNumber: syz [ 130.086534][ T9] usb 9-1: config 0 descriptor?? [ 130.236674][ T5256] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 130.327436][ T5545] usb 9-1: USB disconnect, device number 6 [ 130.387712][ T5256] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 130.388592][ T5256] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 130.388607][ T5256] usb 10-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 130.388616][ T5256] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 130.388636][ T5256] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 130.388654][ T5256] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 130.389941][ T5256] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 130.389953][ T5256] usb 10-1: Product: syz [ 130.389960][ T5256] usb 10-1: Manufacturer: syz [ 130.395832][ T5256] cdc_wdm 10-1:1.0: skipping garbage [ 130.395842][ T5256] cdc_wdm 10-1:1.0: skipping garbage [ 130.399141][ T5256] cdc_wdm 10-1:1.0: cdc-wdm0: USB WDM device [ 130.399201][ T5256] cdc_wdm 10-1:1.0: Unknown control protocol [ 130.597487][ T44] kauditd_printk_skb: 43 callbacks suppressed [ 130.597498][ T44] audit: type=1400 audit(1789055376.511:722): avc: denied { read write } for pid=8276 comm="syz.5.530" name="cdc-wdm0" dev="devtmpfs" ino=2948 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 130.599208][ T44] audit: type=1400 audit(1789055376.511:723): avc: denied { open } for pid=8276 comm="syz.5.530" path="/dev/cdc-wdm0" dev="devtmpfs" ino=2948 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 130.600033][ C3] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 130.600075][ C3] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 130.600279][ C3] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 130.600290][ C3] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 130.600464][ C3] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 130.600473][ C3] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 130.600515][ T2326] usb 10-1: USB disconnect, device number 2 [ 130.600648][ C3] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 130.600657][ C3] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 130.600664][ C3] cdc_wdm 10-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 130.769680][ T44] audit: type=1400 audit(1789055376.681:724): avc: denied { write } for pid=8289 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.804402][ T8277] netlink: 132 bytes leftover after parsing attributes in process `syz.5.530'. [ 130.806837][ T44] audit: type=1400 audit(1789055376.721:725): avc: denied { write } for pid=8292 comm="rm" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.934789][ T8300] netlink: 4 bytes leftover after parsing attributes in process `syz.4.536'. [ 130.934844][ T8300] netlink: 4 bytes leftover after parsing attributes in process `syz.4.536'. [ 130.954073][ T8300] netlink: 4 bytes leftover after parsing attributes in process `syz.4.536'. [ 130.954106][ T8300] netlink: 4 bytes leftover after parsing attributes in process `syz.4.536'. [ 130.990938][ T8300] netlink: 4 bytes leftover after parsing attributes in process `syz.4.536'. [ 130.990970][ T8300] netlink: 4 bytes leftover after parsing attributes in process `syz.4.536'. [ 131.091606][ T8312] netlink: 8 bytes leftover after parsing attributes in process `syz.1.538'. [ 131.091626][ T8312] netlink: 'syz.1.538': attribute type 19 has an invalid length. [ 131.114024][ T44] audit: type=1400 audit(1789055377.021:726): avc: denied { sqpoll } for pid=8313 comm="syz.1.539" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 131.125624][ T44] audit: type=1400 audit(1789055377.031:727): avc: denied { read } for pid=8313 comm="syz.1.539" name="kcore" dev="proc" ino=4026532046 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_kcore_t tclass=file permissive=1 [ 131.128024][ T44] audit: type=1400 audit(1789055377.031:728): avc: denied { open } for pid=8313 comm="syz.1.539" path="/144/proc_mnt/kcore" dev="proc" ino=4026532046 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_kcore_t tclass=file permissive=1 [ 131.172608][ T8320] netlink: 'syz.4.541': attribute type 1 has an invalid length. [ 131.172621][ T8320] netlink: 'syz.4.541': attribute type 4 has an invalid length. [ 131.172933][ T8320] netlink: 'syz.4.541': attribute type 1 has an invalid length. [ 131.172941][ T8320] netlink: 'syz.4.541': attribute type 4 has an invalid length. [ 131.258110][ T44] audit: type=1400 audit(1789055377.171:729): avc: denied { setopt } for pid=8339 comm="syz.1.542" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 131.294700][ T44] audit: type=1400 audit(1789055377.201:730): avc: denied { getopt } for pid=8347 comm="syz.4.543" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 131.305328][ T44] audit: type=1400 audit(1789055377.211:731): avc: denied { read } for pid=8339 comm="syz.1.542" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 »9ôÊ`Óñ[&m·¦ucGÐO?Nì=ìØíæ±ç[ 131.541474][ T8370] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 131.636465][ T5760] Bluetooth: hci4: command tx timeout [ 132.281576][ T8390] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8390 comm=syz.1.553 [ 132.284169][ T8390] trusted_key: syz.1.553 sent an empty control message without MSG_MORE. [ 132.558435][ T8408] netlink: 'syz.1.557': attribute type 1 has an invalid length. [ 132.591666][ T8408] 8021q: adding VLAN 0 to HW filter on device bond2 [ 132.599110][ T8408] bond2: (slave geneve2): making interface the new active one [ 132.602623][ T8408] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 132.604606][ T8409] binder_alloc: binder_alloc_mmap_handler: 8407 200000ffd000-200001000000 already mapped failed -16 [ 132.605660][ T8412] device-mapper: ioctl: name not supplied when creating device [ 132.606138][ T8409] device-mapper: ioctl: name not supplied when creating device [ 132.608017][ T8415] binder: 8414:8415 ioctl c0306201 200000000040 returned -22 [ 132.611795][ T8415] syzkaller0: entered promiscuous mode [ 132.611813][ T8415] syz_tun: entered promiscuous mode [ 132.611970][ T8415] syzkaller0: entered allmulticast mode [ 132.611982][ T8415] syz_tun: entered allmulticast mode [ 132.750689][ T8425] MTRR 1 not used [ 132.756404][ T8425] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8425 comm=syz.4.562 [ 132.775595][ T8431] i8042 kbd 00:00: in use; can't configure [ 132.807788][ T8431] i8042 kbd 00:00: in use; can't configure [ 132.832532][ T8431] kvm: MWAIT instruction emulated as NOP! [ 132.905522][ T8438] jffs2: notice: (8438) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (0 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 132.909907][ T8438] overlayfs: failed to resolve './bus': -2 [ 132.918605][ T8441] overlayfs: failed to resolve './file1': -2 [ 133.092141][ T8463] trusted_key: encrypted_key: keylen parameter is missing [ 133.102609][ T8466] affs: No valid root block on device sr0 [ 133.105547][ T8466] affs: No valid root block on device sr0 [ 133.133613][ T8466] affs: No valid root block on device sr0 [ 133.147755][ T8466] affs: No valid root block on device sr0 [ 133.168045][ T8466] affs: No valid root block on device sr0 [ 133.171931][ T8466] affs: No valid root block on device sr0 [ 133.181260][ T8466] affs: No valid root block on device sr0 [ 133.184066][ T8466] affs: No valid root block on device sr0 [ 133.190584][ T8466] affs: No valid root block on device sr0 [ 133.193201][ T8466] affs: No valid root block on device sr0 [ 133.202512][ T8466] affs: No valid root block on device sr0 [ 133.205133][ T8466] affs: No valid root block on device sr0 [ 133.206501][ T8471] 8021q: adding VLAN 0 to HW filter on device bond6 [ 133.214244][ T8466] affs: No valid root block on device sr0 [ 133.219490][ T8466] affs: No valid root block on device sr0 [ 133.219943][ T8471] bond6: (slave ip6erspan0): making interface the new active one [ 133.221571][ T8471] bond6: (slave ip6erspan0): Enslaving as an active interface with an up link [ 133.222111][ T8466] affs: No valid root block on device sr0 [ 133.234028][ T8466] affs: No valid root block on device sr0 [ 133.241410][ T8466] affs: No valid root block on device sr0 [ 133.243967][ T8466] affs: No valid root block on device sr0 [ 133.250487][ T8466] affs: No valid root block on device sr0 [ 133.254415][ T8466] affs: No valid root block on device sr0 [ 133.260588][ T8466] affs: No valid root block on device sr0 [ 133.263554][ T8466] affs: No valid root block on device sr0 [ 133.269786][ T8466] affs: No valid root block on device sr0 [ 133.272284][ T8466] affs: No valid root block on device sr0 [ 133.274734][ T8466] affs: No valid root block on device sr0 [ 133.284554][ T8466] affs: No valid root block on device sr0 [ 133.291314][ T8466] affs: No valid root block on device sr0 [ 133.294957][ T8466] affs: No valid root block on device sr0 [ 133.302760][ T8466] affs: No valid root block on device sr0 [ 133.307812][ T8466] affs: No valid root block on device sr0 [ 133.310359][ T8466] affs: No valid root block on device sr0 [ 133.312881][ T8466] affs: No valid root block on device sr0 [ 133.315329][ T8466] affs: No valid root block on device sr0 [ 133.332906][ T8482] raw_sendmsg: syz.3.575 forgot to set AF_INET. Fix it! [ 133.864590][ T67] IPVS: starting estimator thread 0... [ 133.945881][ T8516] IPVS: using max 43 ests per chain, 103200 per kthread [ 133.988362][ T8526] random: crng reseeded on system resumption [ 134.010265][ T8525] Restarting kernel threads ... [ 134.012471][ T8525] Done restarting kernel threads. [ 134.049167][ T8530] jffs2: notice: (8530) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (0 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 134.079205][ T8520] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 134.079230][ T8520] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 134.079253][ T8520] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 134.085165][ T8520] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 134.109683][ T8520] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 134.157248][ T8542] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 134.157264][ T8542] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 134.160859][ T8542] vhci_hcd vhci_hcd.0: Device attached [ 134.161232][ T8534] smbdirect: ib_dev[syz1] renamed to [syz2] [ 134.390984][ T8555] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 134.427489][ T5256] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 134.428437][ T10] usb 48-1: SetAddress Request (2) to port 0 [ 134.428574][ T10] usb 48-1: new SuperSpeed USB device number 2 using vhci_hcd [ 134.495947][ T36] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 134.558133][ T8569] kvm: vcpu 1: requested lapic timer restore with starting count register 0x390=4240390349 (8480780698 ns) > initial count (422248798 ns). Using initial count to start timer. [ 134.576308][ T5256] usb 10-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 134.577091][ T5256] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 134.577113][ T5256] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 134.577124][ T5256] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 134.577136][ T5256] usb 10-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 134.578637][ T5256] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.578649][ T5256] usb 10-1: Product: syz [ 134.578656][ T5256] usb 10-1: Manufacturer: syz [ 134.578664][ T5256] usb 10-1: SerialNumber: syz [ 134.616193][ T1035] usb 9-1: new low-speed USB device number 7 using dummy_hcd [ 134.628783][ T8570] kvm [8568]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 134.630057][ T8570] kvm [8568]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 134.657561][ T36] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 134.658350][ T36] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 134.658379][ T36] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.661349][ T36] keyspan 6-1:1.0: Keyspan 2 port adapter converter detected [ 134.661457][ T36] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 81 [ 134.661487][ T36] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 1 [ 134.662102][ T36] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 84 [ 134.662137][ T36] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 2 [ 134.669632][ T36] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 134.670764][ T36] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 88 [ 134.670849][ T36] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 6 [ 134.676286][ T36] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 134.790375][ T1035] usb 9-1: unable to get BOS descriptor or descriptor too short [ 134.790407][ T1035] usb 9-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=d4.29 [ 134.792552][ T1035] usb 9-1: config 8 has an invalid interface number: 109 but max is 0 [ 134.792565][ T1035] usb 9-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 134.792575][ T1035] usb 9-1: config 8 has no interface number 0 [ 134.792592][ T1035] usb 9-1: config 8 interface 109 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 8 [ 134.792606][ T1035] usb 9-1: config 8 interface 109 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 134.792618][ T1035] usb 9-1: config 8 interface 109 altsetting 0 endpoint 0x8E has invalid maxpacket 151, setting to 8 [ 134.794016][ T5256] usb 10-1: usb_control_msg returned -71 [ 134.794093][ T5256] usbtmc 10-1:1.0: can't read capabilities [ 134.797265][ T1035] usb 9-1: string descriptor 0 read error: -22 [ 134.797319][ T1035] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.806270][ T5256] usb 10-1: USB disconnect, device number 3 [ 134.814079][ T8552] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 134.823979][ T1035] metro_usb 9-1:8.109: Metrologic USB to Serial converter detected [ 134.828839][ T1035] usb 9-1: Metrologic USB to Serial converter now attached to ttyUSB2 [ 134.874232][ T8547] i2c i2c-1: DVB: adapter 0 frontend 0 frequency 12 out of range (51000000..2150000000) [ 134.875549][ T36] usb 6-1: USB disconnect, device number 10 [ 134.883140][ T36] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 134.888103][ T36] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 134.888434][ T36] keyspan 6-1:1.0: device disconnected [ 135.021283][ T9] usb 9-1: USB disconnect, device number 7 [ 135.023796][ T9] metro-usb ttyUSB2: Metrologic USB to Serial converter now disconnected from ttyUSB2 [ 135.024988][ T9] metro_usb 9-1:8.109: device disconnected [ 135.355885][ T5256] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 135.445597][ T8581] fuse: Unknown parameter 'w"0x0000000000000006' [ 135.472409][ T8583] validate_nla: 1 callbacks suppressed [ 135.472421][ T8583] netlink: 'syz.3.597': attribute type 1 has an invalid length. [ 135.474806][ T8584] netlink: 'syz.3.597': attribute type 1 has an invalid length. [ 135.500757][ T8588] faux_driver vgem: [drm] Unknown color mode 11176; guessing buffer size. [ 135.516412][ T5256] usb 10-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 135.517177][ T5256] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 135.517202][ T5256] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 135.517213][ T5256] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 135.517224][ T5256] usb 10-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 135.518717][ T5256] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.518729][ T5256] usb 10-1: Product: syz [ 135.518736][ T5256] usb 10-1: Manufacturer: syz [ 135.518744][ T5256] usb 10-1: SerialNumber: syz [ 135.578806][ T8590] __nla_validate_parse: 12 callbacks suppressed [ 135.578819][ T8590] netlink: 36 bytes leftover after parsing attributes in process `syz.3.599'. [ 135.609565][ T8593] tipc: Started in network mode [ 135.609630][ T8593] tipc: Node identity ac141441, cluster identity 4711 [ 135.610881][ T8593] tipc: Enabled bearer , priority 10 [ 135.626160][ T44] kauditd_printk_skb: 7351 callbacks suppressed [ 135.626172][ T44] audit: type=1400 audit(1789055381.541:8083): avc: denied { map } for pid=8596 comm="syz.3.602" path="/dev/sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 135.626285][ T44] audit: type=1400 audit(1789055381.541:8084): avc: denied { execute } for pid=8596 comm="syz.3.602" path="/dev/sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 135.630171][ T8597] netlink: 8 bytes leftover after parsing attributes in process `syz.3.602'. [ 135.630195][ T8597] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 135.647476][ T8597] bond7 (unregistering): Released all slaves [ 135.713182][ T44] audit: type=1400 audit(1789055381.621:8085): avc: denied { block_suspend } for pid=8604 comm="syz.1.605" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 135.730227][ T5256] usb 10-1: usb_control_msg returned -32 [ 135.730308][ T5256] usbtmc 10-1:1.0: can't read capabilities [ 135.838609][ T8624] netlink: 28 bytes leftover after parsing attributes in process `syz.1.610'. [ 135.841613][ T8624] netlink: 28 bytes leftover after parsing attributes in process `syz.1.610'. [ 135.881740][ T8632] FAULT_INJECTION: forcing a failure. [ 135.881740][ T8632] name failslab, interval 1, probability 0, space 0, times 0 [ 135.881762][ T8632] CPU: 0 UID: 0 PID: 8632 Comm: syz.1.611 Tainted: G L syzkaller #0 PREEMPT(full) [ 135.881778][ T8632] Tainted: [L]=SOFTLOCKUP [ 135.881782][ T8632] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 135.881789][ T8632] Call Trace: [ 135.881793][ T8632] [ 135.881797][ T8632] dump_stack_lvl+0x100/0x190 [ 135.881830][ T8632] should_fail_ex.cold+0x5/0xa [ 135.881847][ T8632] should_failslab+0xc2/0x120 [ 135.881865][ T8632] __kmalloc_noprof+0xfc/0x840 [ 135.881877][ T8632] ? __memcg_list_lru_alloc+0x418/0x680 [ 135.881895][ T8632] __memcg_list_lru_alloc+0x418/0x680 [ 135.881910][ T8632] ? xa_load+0x149/0x2c0 [ 135.881932][ T8632] ? __pfx___memcg_list_lru_alloc+0x10/0x10 [ 135.881951][ T8632] ? rcu_read_unlock+0x17/0x60 [ 135.881969][ T8632] memcg_list_lru_alloc+0xd3/0x100 [ 135.881986][ T8632] __memcg_slab_post_alloc_hook+0x27b/0x1270 [ 135.882007][ T8632] ? kasan_save_track+0x14/0x30 [ 135.882021][ T8632] kmem_cache_alloc_lru_noprof+0x4f6/0x6a0 [ 135.882033][ T8632] ? __d_alloc+0x35/0xa50 [ 135.882051][ T8632] __d_alloc+0x35/0xa50 [ 135.882065][ T8632] ? lockdep_init_map_type+0x5c/0x250 [ 135.882078][ T8632] d_make_root+0x3e/0x90 [ 135.882094][ T8632] shmem_fill_super+0xc16/0x13e0 [ 135.882106][ T8632] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 135.882121][ T8632] ? __pfx_shmem_fill_super+0x10/0x10 [ 135.882136][ T8632] ? cap_capable+0x107/0x430 [ 135.882153][ T8632] ? __pfx_shmem_fill_super+0x10/0x10 [ 135.882165][ T8632] get_tree_nodev+0xdd/0x190 [ 135.882177][ T8632] vfs_get_tree+0x92/0x320 [ 135.882193][ T8632] path_mount+0x7d0/0x24c0 [ 135.882210][ T8632] ? __pfx_path_mount+0x10/0x10 [ 135.882226][ T8632] ? lockdep_hardirqs_on+0x7d/0x110 [ 135.882243][ T8632] ? putname+0xb1/0x110 [ 135.882255][ T8632] ? kmem_cache_free+0x127/0x6c0 [ 135.882276][ T8632] ? __x64_sys_mount+0x293/0x310 [ 135.882291][ T8632] __x64_sys_mount+0x293/0x310 [ 135.882307][ T8632] ? __pfx___x64_sys_mount+0x10/0x10 [ 135.882327][ T8632] do_syscall_64+0x123/0x790 [ 135.882342][ T8632] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.882353][ T8632] RIP: 0033:0x7f00dc79e159 [ 135.882362][ T8632] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.882379][ T8632] RSP: 002b:00007f00dd6aa028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 135.882392][ T8632] RAX: ffffffffffffffda RBX: 00007f00dca25fa0 RCX: 00007f00dc79e159 [ 135.882399][ T8632] RDX: 00002000000001c0 RSI: 0000200000000040 RDI: 0000000000000000 [ 135.882406][ T8632] RBP: 00007f00dc83503b R08: 0000200000000200 R09: 0000000000000000 [ 135.882413][ T8632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 135.882420][ T8632] R13: 00007f00dca26038 R14: 00007f00dca25fa0 R15: 00007ffc9bf90068 [ 135.882435][ T8632] [ 135.994711][ T8640] 9pnet_virtio: no channels available for device syz [ 135.998151][ T44] audit: type=1400 audit(1789055381.911:8086): avc: denied { ioctl } for pid=8638 comm="syz.4.613" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=24098 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 136.049811][ T8643] FAULT_FLAG_ALLOW_RETRY missing 801 [ 136.049828][ T8643] CPU: 3 UID: 0 PID: 8643 Comm: syz.4.613 Tainted: G L syzkaller #0 PREEMPT(full) [ 136.049845][ T8643] Tainted: [L]=SOFTLOCKUP [ 136.049849][ T8643] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 136.049856][ T8643] Call Trace: [ 136.049861][ T8643] [ 136.049866][ T8643] dump_stack_lvl+0x100/0x190 [ 136.049887][ T8643] handle_userfault.cold+0x38/0x65 [ 136.049903][ T8643] ? do_raw_spin_unlock+0x145/0x1e0 [ 136.049920][ T8643] ? _raw_spin_unlock+0x28/0x50 [ 136.049932][ T8643] ? __free_frozen_pages+0x751/0x10f0 [ 136.049948][ T8643] ? __pfx_handle_userfault+0x10/0x10 [ 136.049966][ T8643] ? rcu_read_unlock+0x2d/0xb0 [ 136.049982][ T8643] ? rcu_read_unlock+0x2d/0xb0 [ 136.050000][ T8643] do_anonymous_page+0x186d/0x2050 [ 136.050020][ T8643] ? __pfx_do_anonymous_page+0x10/0x10 [ 136.050035][ T8643] ? rcu_read_unlock+0x2d/0xb0 [ 136.050051][ T8643] ? rcu_read_unlock+0x2d/0xb0 [ 136.050066][ T8643] ? __pte_offset_map+0x179/0x310 [ 136.050079][ T8643] __handle_mm_fault+0x1ff3/0x2f60 [ 136.050097][ T8643] ? __pfx___handle_mm_fault+0x10/0x10 [ 136.050116][ T8643] ? pte_offset_map_lock+0x174/0x320 [ 136.050128][ T8643] ? find_held_lock+0x2b/0x80 [ 136.050142][ T8643] ? find_held_lock+0x2b/0x80 [ 136.050157][ T8643] ? follow_page_pte+0x536/0x1050 [ 136.050177][ T8643] handle_mm_fault+0x363/0xa20 [ 136.050194][ T8643] __get_user_pages+0x8ae/0x2c30 [ 136.050212][ T8643] ? __pfx___get_user_pages+0x10/0x10 [ 136.050229][ T8643] populate_vma_page_range+0x267/0x3f0 [ 136.050243][ T8643] ? __pfx_populate_vma_page_range+0x10/0x10 [ 136.050256][ T8643] ? __pfx___vma_start_write+0x10/0x10 [ 136.050273][ T8643] mprotect_fixup+0x925/0xe00 [ 136.050292][ T8643] ? __pfx_mprotect_fixup+0x10/0x10 [ 136.050320][ T8643] do_mprotect_pkey+0xa51/0xdd0 [ 136.050339][ T8643] ? __pfx_do_mprotect_pkey+0x10/0x10 [ 136.050370][ T8643] __x64_sys_mprotect+0x78/0xc0 [ 136.050385][ T8643] ? lockdep_hardirqs_on+0x7d/0x110 [ 136.050399][ T8643] do_syscall_64+0x123/0x790 [ 136.050415][ T8643] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.050426][ T8643] RIP: 0033:0x7fbe7499e159 [ 136.050435][ T8643] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.050445][ T8643] RSP: 002b:00007fbe7583a028 EFLAGS: 00000246 ORIG_RAX: 000000000000000a [ 136.050457][ T8643] RAX: ffffffffffffffda RBX: 00007fbe74c26090 RCX: 00007fbe7499e159 [ 136.050464][ T8643] RDX: 000000000000000a RSI: 0000000000c00000 RDI: 0000200000400000 [ 136.050471][ T8643] RBP: 00007fbe74a3503b R08: 0000000000000000 R09: 0000000000000000 [ 136.050477][ T8643] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 136.050483][ T8643] R13: 00007fbe74c26128 R14: 00007fbe74c26090 R15: 00007ffdcc6d2b28 [ 136.050497][ T8643] [ 136.054011][ T8643] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 136.054025][ T8643] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 136.055300][ T8643] vhci_hcd vhci_hcd.0: Device attached [ 136.235971][ T2326] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 136.252181][ T44] audit: type=1400 audit(1789055382.161:8087): avc: denied { write } for pid=8651 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 136.297681][ T2326] usb 45-1: new full-speed USB device number 2 using vhci_hcd [ 136.314852][ T44] audit: type=1400 audit(1789055382.221:8088): avc: denied { write } for pid=8656 comm="rm" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 136.500661][ T8661] netlink: 16 bytes leftover after parsing attributes in process `syz.5.588'. [ 136.501381][ T8660] usbtmc 10-1:1.0: usb_control_msg returned -32 [ 136.615974][ T9] tipc: Node number set to 2886997057 [ 136.639768][ T43] usb 10-1: USB disconnect, device number 4 [ 136.645964][ T8543] vhci_hcd: connection reset by peer [ 136.651906][ T6106] vhci_hcd vhci_hcd.5: stop threads [ 136.656711][ T6106] vhci_hcd vhci_hcd.5: release socket [ 136.659085][ T6106] vhci_hcd vhci_hcd.5: disconnect device [ 136.691770][ T8337] Bluetooth: hci3: Frame reassembly failed (-84) [ 136.750987][ T36] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 136.759019][ T36] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 136.792428][ T36] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 136.824265][ T8644] vhci_hcd: connection reset by peer [ 136.824928][ T6106] vhci_hcd vhci_hcd.4: stop threads [ 136.824944][ T6106] vhci_hcd vhci_hcd.4: release socket [ 136.826494][ T6106] vhci_hcd vhci_hcd.4: disconnect device [ 136.938619][ T44] audit: type=1400 audit(1789055382.851:8089): avc: denied { write } for pid=8684 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 136.975399][ T44] audit: type=1400 audit(1789055382.881:8090): avc: denied { write } for pid=8687 comm="rm" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 137.017933][ T855] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 137.046719][ T855] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 137.050493][ T44] audit: type=1400 audit(1789055382.961:8091): avc: denied { write } for pid=8690 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 137.220379][ T8698] syz.5.621 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=3, oom_score_adj=1000 [ 137.220405][ T8698] CPU: 2 UID: 0 PID: 8698 Comm: syz.5.621 Tainted: G L syzkaller #0 PREEMPT(full) [ 137.220420][ T8698] Tainted: [L]=SOFTLOCKUP [ 137.220424][ T8698] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 137.220431][ T8698] Call Trace: [ 137.220435][ T8698] [ 137.220440][ T8698] dump_stack_lvl+0x100/0x190 [ 137.220460][ T8698] dump_header+0xfb/0x606 [ 137.220473][ T8698] oom_kill_process.cold+0xd/0x380 [ 137.220488][ T8698] out_of_memory+0x340/0x14f0 [ 137.220505][ T8698] ? __pfx_out_of_memory+0x10/0x10 [ 137.220530][ T8698] mem_cgroup_out_of_memory+0xc6/0x130 [ 137.220543][ T8698] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 137.220554][ T8698] ? find_held_lock+0x2b/0x80 [ 137.220572][ T8698] ? do_raw_spin_unlock+0x145/0x1e0 [ 137.220587][ T8698] ? _raw_spin_unlock+0x28/0x50 [ 137.220601][ T8698] try_charge_memcg+0x783/0xf60 [ 137.220621][ T8698] ? __pfx_try_charge_memcg+0x10/0x10 [ 137.220637][ T8698] ? find_held_lock+0x2b/0x80 [ 137.220651][ T8698] ? rcu_read_unlock+0x17/0x60 [ 137.220667][ T8698] ? rcu_read_unlock+0x17/0x60 [ 137.220688][ T8698] __memcg_slab_post_alloc_hook+0x4a1/0x1270 [ 137.220710][ T8698] ? kasan_unpoison+0x27/0x60 [ 137.220722][ T8698] __kmalloc_noprof+0x653/0x840 [ 137.220734][ T8698] ? __register_sysctl_table+0xac/0x1650 [ 137.220754][ T8698] __register_sysctl_table+0xac/0x1650 [ 137.220772][ T8698] ? lock_acquire+0x1d1/0x380 [ 137.220785][ T8698] ? __pfx___register_sysctl_table+0x10/0x10 [ 137.220801][ T8698] ? is_module_address+0x5f/0xf0 [ 137.220814][ T8698] ? is_module_address+0x5f/0xf0 [ 137.220830][ T8698] register_net_sysctl_sz+0x325/0x420 [ 137.220848][ T8698] ? __asan_memcpy+0x3c/0x60 [ 137.220860][ T8698] ipv4_sysctl_init_net+0x156/0x3c0 [ 137.220884][ T8698] ? __pfx_ipv4_sysctl_init_net+0x10/0x10 [ 137.220900][ T8698] ops_init+0x1e2/0x5f0 [ 137.220916][ T8698] setup_net+0x118/0x3a0 [ 137.220930][ T8698] ? __pfx_setup_net+0x10/0x10 [ 137.220949][ T8698] copy_net_ns+0x345/0x7a0 [ 137.220973][ T8698] create_new_namespaces+0x3ea/0xac0 [ 137.220997][ T8698] unshare_nsproxy_namespaces+0xf2/0x220 [ 137.221019][ T8698] ksys_unshare+0x4a2/0xa70 [ 137.221034][ T8698] ? __pfx_ksys_unshare+0x10/0x10 [ 137.221053][ T8698] __x64_sys_unshare+0x31/0x40 [ 137.221066][ T8698] do_syscall_64+0x123/0x790 [ 137.221082][ T8698] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.221094][ T8698] RIP: 0033:0x7f7e9c99e159 [ 137.221104][ T8698] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 137.221115][ T8698] RSP: 002b:00007f7e9d7ce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 137.221126][ T8698] RAX: ffffffffffffffda RBX: 00007f7e9cc25fa0 RCX: 00007f7e9c99e159 [ 137.221133][ T8698] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000042000000 [ 137.221139][ T8698] RBP: 00007f7e9ca3503b R08: 0000000000000000 R09: 0000000000000000 [ 137.221146][ T8698] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 137.221152][ T8698] R13: 00007f7e9cc26038 R14: 00007f7e9cc25fa0 R15: 00007ffe4eb38638 [ 137.221167][ T8698] [ 137.221171][ T8698] memory: usage 88kB, limit 96kB, failcnt 38 [ 137.221178][ T8698] memory+swap: usage 100kB, limit 9007199254740988kB, failcnt 0 [ 137.221185][ T8698] kmem: usage 88kB, limit 9007199254740988kB, failcnt 0 [ 137.221191][ T8698] Memory cgroup stats for /syz5/test: [ 137.221259][ T8698] cache 0 [ 137.221264][ T8698] rss 0 [ 137.221267][ T8698] rss_huge 0 [ 137.221271][ T8698] shmem 0 [ 137.221275][ T8698] mapped_file 0 [ 137.221278][ T8698] dirty 0 [ 137.221282][ T8698] writeback 0 [ 137.221286][ T8698] workingset_refault_anon 0 [ 137.221290][ T8698] workingset_refault_file 0 [ 137.221294][ T8698] swap 0 [ 137.221297][ T8698] swapcached 0 [ 137.221301][ T8698] pgpgin 0 [ 137.221305][ T8698] pgpgout 0 [ 137.221308][ T8698] pgfault 0 [ 137.221312][ T8698] pgmajfault 0 [ 137.221316][ T8698] inactive_anon 0 [ 137.221320][ T8698] active_anon 0 [ 137.221323][ T8698] inactive_file 0 [ 137.221327][ T8698] active_file 0 [ 137.221331][ T8698] unevictable 0 [ 137.221334][ T8698] hierarchical_memory_limit 98304 [ 137.221339][ T8698] hierarchical_memsw_limit 9223372036854771712 [ 137.221344][ T8698] total_cache 0 [ 137.221347][ T8698] total_rss 0 [ 137.221351][ T8698] total_rss_huge 0 [ 137.221355][ T8698] total_shmem 0 [ 137.221358][ T8698] total_mapped_file 0 [ 137.221362][ T8698] total_dirty 0 [ 137.221366][ T8698] total_writeback 0 [ 137.221370][ T8698] total_workingset_refault_anon 0 [ 137.221374][ T8698] total_workingset_refault_file 0 [ 137.221379][ T8698] total_swap 0 [ 137.221382][ T8698] total_swapcached 0 [ 137.221386][ T8698] total_pgpgin 0 [ 137.221390][ T8698] total_pgpgout 0 [ 137.221394][ T8698] total_pgfault 0 [ 137.221397][ T8698] total_pgmajfault 0 [ 137.221401][ T8698] total_inactive_anon 0 [ 137.221405][ T8698] total_active_anon 0 [ 137.221409][ T8698] total_inactive_file 0 [ 137.221413][ T8698] total_active_file 0 [ 137.221417][ T8698] total_unevictable 0 [ 137.221421][ T8698] anon_cost 0 [ 137.221424][ T8698] file_cost 0 [ 137.221428][ T8698] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz5/test,task_memcg=/syz5/test,task=syz.5.621,pid=8697,uid=0 [ 137.222843][ T8698] Memory cgroup out of memory: Killed process 8697 (syz.5.621) total-vm:102252kB, anon-rss:1424kB, file-rss:23328kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 137.507926][ T8725] bond0: option slaves: interface -v does not exist! [ 137.527175][ T855] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 137.558404][ T855] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 137.569381][ T8669] ceph: No mds server is up or the cluster is laggy [ 137.572516][ T8672] ceph: No mds server is up or the cluster is laggy [ 137.806089][ T8738] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 137.806438][ T8738] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 137.899130][ T8742] 9pnet_virtio: no channels available for device syz [ 137.915516][ T8742] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 137.921220][ T8742] netlink: 20 bytes leftover after parsing attributes in process `syz.1.632'. [ 138.047421][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.047504][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 138.056120][ T8751] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 138.065077][ T8751] openvswitch: netlink: Tunnel attr 4 has unexpected len 0 expected 1 [ 138.164114][ T8754] xt_hashlimit: size too large, truncated to 1048576 [ 138.513205][ T25] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 138.513227][ T25] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.591668][ T25] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 138.591689][ T25] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.666631][ T5754] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 138.671473][ T5754] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 138.673453][ T5754] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 138.677964][ T5754] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 138.678380][ T5754] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 138.679406][ T25] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 138.679424][ T25] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.747141][ T25] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 138.747162][ T25] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.759217][ T5760] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 138.887414][ T8784] ima: policy update failed [ 138.954169][ T8793] ipvlan2: entered allmulticast mode [ 138.954184][ T8793] batadv0: entered allmulticast mode [ 138.954895][ T8793] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 138.955672][ T8794] netlink: 20 bytes leftover after parsing attributes in process `syz.3.644'. [ 139.053732][ T25] veth5: left allmulticast mode [ 139.053749][ T25] veth5: left promiscuous mode [ 139.053866][ T25] bridge2: port 2(veth5) entered disabled state [ 139.077266][ T25] veth3: left allmulticast mode [ 139.077283][ T25] veth3: left promiscuous mode [ 139.077386][ T25] bridge2: port 1(veth3) entered disabled state [ 139.194260][ T25] gretap0 (unregistering): left promiscuous mode [ 139.214817][ T25] bond2 (unregistering): (slave geneve2): Releasing active interface [ 139.245109][ T25] bond0 (unregistering): left promiscuous mode [ 139.245125][ T25] bond_slave_0: left promiscuous mode [ 139.245266][ T25] bond_slave_1: left promiscuous mode [ 139.252160][ T25] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 139.253394][ T25] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 139.255187][ T25] bond0 (unregistering): Released all slaves [ 139.262504][ T25] bond1 (unregistering): Released all slaves [ 139.267782][ T25] bond2 (unregistering): Released all slaves [ 139.273143][ T5451] 8021q: adding VLAN 0 to HW filter on device eth10 [ 139.449314][ T8777] bridge0: port 1(bridge_slave_0) entered blocking state [ 139.449376][ T8777] bridge0: port 1(bridge_slave_0) entered disabled state [ 139.449479][ T8777] bridge_slave_0: entered allmulticast mode [ 139.450586][ T8777] bridge_slave_0: entered promiscuous mode [ 139.454344][ T25] tipc: Disabling bearer [ 139.456787][ T25] tipc: Left network mode [ 139.467008][ T8777] bridge0: port 2(bridge_slave_1) entered blocking state [ 139.467050][ T8777] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.467123][ T8777] bridge_slave_1: entered allmulticast mode [ 139.467876][ T8777] bridge_slave_1: entered promiscuous mode [ 139.489556][ T10] usb 48-1: device descriptor read/8, error -110 [ 139.494732][ T8777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 139.495297][ T25] rxrpc: Leaked peer 103 {1} 127.0.0.1:7003 [ 139.503446][ T8777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 139.559586][ T8777] team0: Port device team_slave_0 added [ 139.563243][ T8777] team0: Port device team_slave_1 added [ 139.581609][ T8777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 139.581619][ T8777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 139.581632][ T8777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 139.582412][ T8777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 139.582419][ T8777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 139.582431][ T8777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 139.612114][ T8777] hsr_slave_0: entered promiscuous mode [ 139.612524][ T8777] hsr_slave_1: entered promiscuous mode [ 139.691496][ T5451] 8021q: adding VLAN 0 to HW filter on device eth11 [ 139.760380][ T25] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 139.760401][ T25] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 139.760850][ T25] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 139.760861][ T25] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 139.763444][ T25] veth1_macvtap: left promiscuous mode [ 139.763465][ T25] veth0_macvtap: left promiscuous mode [ 139.763509][ T25] veth1_vlan: left promiscuous mode [ 139.763548][ T25] veth0_vlan: left promiscuous mode [ 139.900532][ T25] team0 (unregistering): Port device team_slave_1 removed [ 139.912534][ T25] team0 (unregistering): Port device team_slave_0 removed [ 139.919530][ T10] usb usb48-port1: attempt power cycle [ 139.993280][ T5451] 8021q: adding VLAN 0 to HW filter on device eth12 [ 140.023118][ T8838] binder: 8837:8838 ioctl c0306201 2000000003c0 returned -22 [ 140.042434][ T8777] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 140.049904][ T8777] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 140.050461][ T8777] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 140.067122][ T8777] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 140.068634][ T8777] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 140.088518][ T8777] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 140.089068][ T8777] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 140.096036][ T8777] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 140.183646][ T8855] openvswitch: netlink: ERSPAN option length err (len 5413, max 255). [ 140.214991][ T5451] 8021q: adding VLAN 0 to HW filter on device eth13 [ 140.279169][ T25] IPVS: stop unused estimator thread 0... [ 140.302569][ T8777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 140.322183][ T8777] 8021q: adding VLAN 0 to HW filter on device team0 [ 140.330171][ T1169] bridge0: port 1(bridge_slave_0) entered blocking state [ 140.330218][ T1169] bridge0: port 1(bridge_slave_0) entered forwarding state [ 140.343015][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state [ 140.343086][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state [ 140.498717][ T10] usb usb48-port1: unable to enumerate USB device [ 140.601487][ T8777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 140.750005][ T8777] veth0_vlan: entered promiscuous mode [ 140.756750][ T8777] veth1_vlan: entered promiscuous mode [ 140.756840][ T5760] Bluetooth: hci2: command tx timeout [ 140.777771][ T8777] veth0_macvtap: entered promiscuous mode [ 140.779914][ T8777] veth1_macvtap: entered promiscuous mode [ 140.788153][ T8777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 140.789966][ T8777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 140.834387][ T1166] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 140.834402][ T1166] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 140.877956][ T25] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.878172][ T25] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.878340][ T25] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.878359][ T25] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.899472][ T8337] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 140.899484][ T8337] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 140.905434][ T44] kauditd_printk_skb: 27 callbacks suppressed [ 140.905446][ T44] audit: type=1400 audit(1789055386.811:8119): avc: denied { mounton } for pid=8777 comm="syz-executor" path="/syzkaller.DJKdt2/syz-tmp" dev="sda1" ino=2046 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 140.955708][ T8887] capability: warning: `syz.6.640' uses 32-bit capabilities (legacy support in use) [ 140.957542][ T8887] BUG: using smp_processor_id() in preemptible [00000000] code: syz.6.640/8887 [ 140.957559][ T8887] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 140.957592][ T8887] CPU: 0 UID: 0 PID: 8887 Comm: syz.6.640 Tainted: G L syzkaller #0 PREEMPT(full) SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 140.957616][ T8887] Tainted: [L]=SOFTLOCKUP [ 140.957622][ T8887] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 140.957632][ T8887] Call Trace: [ 140.957638][ T8887] [ 140.957645][ T8887] dump_stack_lvl+0x100/0x190 [ 140.957672][ T8887] check_preemption_disabled+0xd2/0xe0 [ 140.957702][ T8887] ? tcp_data_queue+0x23d0/0x4fb0 [ 140.957724][ T8887] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 140.957747][ T8887] ? tcp_data_queue+0x23d0/0x4fb0 [ 140.957774][ T8887] trace_kfree_skb+0x18b/0x230 [ 140.957798][ T8887] sk_skb_reason_drop+0xb7/0x1b0 [ 140.957820][ T8887] tcp_data_queue+0x23d0/0x4fb0 [ 140.957849][ T8887] ? find_held_lock+0x2b/0x80 [ 140.957874][ T8887] ? tcp_urg+0x10f/0xb80 [ 140.957893][ T8887] ? __pfx_tcp_data_queue+0x10/0x10 [ 140.957942][ T8887] ? tcp_ecn_create_request+0x8b0/0x8d0 [ 140.957964][ T8887] ? sock_def_wakeup+0x118/0x2c0 [ 140.957987][ T8887] tcp_rcv_state_process+0x1063/0x7190 [ 140.958019][ T8887] ? __pfx_tcp_rcv_state_process+0x10/0x10 [ 140.958055][ T8887] ? lock_acquire+0x1d1/0x380 [ 140.958076][ T8887] ? __pfx_tcp_v4_do_rcv+0x10/0x10 [ 140.958100][ T8887] ? tcp_v4_do_rcv+0x691/0x1260 [ 140.958125][ T8887] tcp_v4_do_rcv+0x691/0x1260 [ 140.958151][ T8887] ? __pfx_tcp_v4_do_rcv+0x10/0x10 [ 140.958174][ T8887] __release_sock+0x35a/0x440 [ 140.958200][ T8887] release_sock+0x1e5/0x280 [ 140.958220][ T8887] __inet_stream_connect+0x619/0xf90 [ 140.958248][ T8887] ? __pfx___inet_stream_connect+0x10/0x10 [ 140.958271][ T8887] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 140.958294][ T8887] ? __pfx_woken_wake_function+0x10/0x10 [ 140.958319][ T8887] ? __local_bh_enable_ip+0xa5/0x120 [ 140.958340][ T8887] inet_stream_connect+0x57/0xa0 [ 140.958365][ T8887] __sys_connect_file+0x146/0x1a0 [ 140.958385][ T8887] __sys_connect+0x141/0x170 [ 140.958402][ T8887] ? __pfx___sys_connect+0x10/0x10 [ 140.958435][ T8887] __x64_sys_connect+0x72/0xb0 [ 140.958458][ T8887] ? lockdep_hardirqs_on+0x7d/0x110 [ 140.958483][ T8887] do_syscall_64+0x123/0x790 [ 140.958507][ T8887] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.958527][ T8887] RIP: 0033:0x7febeb39e159 [ 140.958542][ T8887] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 140.958559][ T8887] RSP: 002b:00007febe95f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 140.958578][ T8887] RAX: ffffffffffffffda RBX: 00007febeb625fa0 RCX: 00007febeb39e159 [ 140.958590][ T8887] RDX: 0000000000000010 RSI: 0000200000000180 RDI: 0000000000000004 [ 140.958599][ T8887] RBP: 00007febeb43503b R08: 0000000000000000 R09: 0000000000000000 [ 140.958610][ T8887] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 140.958625][ T8887] R13: 00007febeb626038 R14: 00007febeb625fa0 R15: 00007fff3b3f4e98 [ 140.958650][ T8887] [ 141.381622][ T67] smbdirect: ib_dev[syz2] removed [ 141.387304][ T2326] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 141.388814][ T8808] syz2: Port: 1 Link DOWN [ 141.506681][ T8897] BUG: using smp_processor_id() in preemptible [00000000] code: syz.5.651/8897 [ 141.506698][ T8897] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 141.506721][ T8897] CPU: 3 UID: 0 PID: 8897 Comm: syz.5.651 Tainted: G L syzkaller #0 PREEMPT(full) [ 141.506736][ T8897] Tainted: [L]=SOFTLOCKUP [ 141.506740][ T8897] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 141.506765][ T8897] Call Trace: [ 141.506770][ T8897] [ 141.506775][ T8897] dump_stack_lvl+0x100/0x190 [ 141.506803][ T8897] check_preemption_disabled+0xd2/0xe0 [ 141.506820][ T8897] ? skb_queue_purge_reason+0x2aa/0x420 [ 141.506834][ T8897] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 141.506850][ T8897] ? skb_queue_purge_reason+0x2aa/0x420 [ 141.506864][ T8897] trace_kfree_skb+0x18b/0x230 [ 141.506880][ T8897] sk_skb_reason_drop+0xb7/0x1b0 [ 141.506893][ T8897] skb_queue_purge_reason+0x2aa/0x420 [ 141.506906][ T8897] ? synchronize_rcu_expedited+0x3c3/0x450 [ 141.506920][ T8897] ? __pfx_skb_queue_purge_reason+0x10/0x10 [ 141.506941][ T8897] packet_release+0x839/0xd70 [ 141.506956][ T8897] ? __pfx_packet_release+0x10/0x10 [ 141.506968][ T8897] ? __pfx_down_write+0x10/0x10 [ 141.506984][ T8897] ? __pfx_locks_remove_file+0x10/0x10 [ 141.507004][ T8897] __sock_release+0xb3/0x260 [ 141.507017][ T8897] ? __pfx_sock_close+0x10/0x10 [ 141.507029][ T8897] sock_close+0x1c/0x30 [ 141.507041][ T8897] __fput+0x3ff/0xb50 [ 141.507058][ T8897] task_work_run+0x150/0x240 [ 141.507075][ T8897] ? __pfx_task_work_run+0x10/0x10 [ 141.507094][ T8897] do_exit+0x951/0x2ae0 [ 141.507110][ T8897] ? __pfx_do_exit+0x10/0x10 [ 141.507124][ T8897] ? do_raw_spin_lock+0x128/0x260 [ 141.507137][ T8897] ? find_held_lock+0x2b/0x80 [ 141.507152][ T8897] ? get_signal+0x7e0/0x21e0 [ 141.507165][ T8897] do_group_exit+0xd5/0x2a0 [ 141.507180][ T8897] get_signal+0x1ec7/0x21e0 [ 141.507192][ T8897] ? __pfx_debug_object_free+0x10/0x10 [ 141.507208][ T8897] ? __pfx_get_signal+0x10/0x10 [ 141.507221][ T8897] ? hrtimer_nanosleep+0x181/0x350 [ 141.507240][ T8897] arch_do_signal_or_restart+0x91/0x7e0 [ 141.507257][ T8897] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 141.507273][ T8897] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 141.507300][ T8897] exit_to_user_mode_loop+0x139/0x700 [ 141.507318][ T8897] ? rcu_is_watching+0x13/0xc0 [ 141.507340][ T8897] do_syscall_64+0x661/0x790 [ 141.507364][ T8897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.507384][ T8897] RIP: 0033:0x7f7e9c99e159 [ 141.507398][ T8897] Code: Unable to access opcode bytes at 0x7f7e9c99e12f. [ 141.507405][ T8897] RSP: 002b:00007f7e9ab93028 EFLAGS: 00000246 ORIG_RAX: 0000000000000023 [ 141.507422][ T8897] RAX: fffffffffffffdfc RBX: 00007f7e9cc26540 RCX: 00007f7e9c99e159 [ 141.507433][ T8897] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000600 [ 141.507444][ T8897] RBP: 00007f7e9ca3503b R08: 0000000000000000 R09: 0000000000000000 [ 141.507454][ T8897] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 141.507465][ T8897] R13: 00007f7e9cc265d8 R14: 00007f7e9cc26540 R15: 00007ffe4eb38638 [ 141.507490][ T8897] [ 141.507678][ T8897] BUG: using smp_processor_id() in preemptible [00000000] code: syz.5.651/8897 [ 141.507692][ T8897] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 141.507722][ T8897] CPU: 3 UID: 0 PID: 8897 Comm: syz.5.651 Tainted: G L syzkaller #0 PREEMPT(full) [ 141.507745][ T8897] Tainted: [L]=SOFTLOCKUP [ 141.507751][ T8897] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 141.507761][ T8897] Call Trace: [ 141.507767][ T8897] [ 141.507773][ T8897] dump_stack_lvl+0x100/0x190 [ 141.507806][ T8897] check_preemption_disabled+0xd2/0xe0 [ 141.507833][ T8897] ? skb_queue_purge_reason+0x2aa/0x420 [ 141.507854][ T8897] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 141.507880][ T8897] ? skb_queue_purge_reason+0x2aa/0x420 [ 141.507903][ T8897] trace_kfree_skb+0x18b/0x230 [ 141.507927][ T8897] sk_skb_reason_drop+0xb7/0x1b0 [ 141.507950][ T8897] skb_queue_purge_reason+0x2aa/0x420 [ 141.507971][ T8897] ? synchronize_rcu_expedited+0x3c3/0x450 [ 141.507994][ T8897] ? __pfx_skb_queue_purge_reason+0x10/0x10 [ 141.508031][ T8897] packet_release+0x839/0xd70 [ 141.508055][ T8897] ? __pfx_packet_release+0x10/0x10 [ 141.508094][ T8897] ? __pfx_down_write+0x10/0x10 [ 141.508118][ T8897] ? __pfx_locks_remove_file+0x10/0x10 [ 141.508145][ T8897] __sock_release+0xb3/0x260 [ 141.508166][ T8897] ? __pfx_sock_close+0x10/0x10 [ 141.508185][ T8897] sock_close+0x1c/0x30 [ 141.508199][ T8897] __fput+0x3ff/0xb50 [ 141.508216][ T8897] task_work_run+0x150/0x240 [ 141.508233][ T8897] ? __pfx_task_work_run+0x10/0x10 [ 141.508253][ T8897] do_exit+0x951/0x2ae0 [ 141.508268][ T8897] ? __pfx_do_exit+0x10/0x10 [ 141.508284][ T8897] ? do_raw_spin_lock+0x128/0x260 [ 141.508298][ T8897] ? find_held_lock+0x2b/0x80 [ 141.508313][ T8897] ? get_signal+0x7e0/0x21e0 [ 141.508326][ T8897] do_group_exit+0xd5/0x2a0 [ 141.508341][ T8897] get_signal+0x1ec7/0x21e0 [ 141.508352][ T8897] ? __pfx_debug_object_free+0x10/0x10 [ 141.508369][ T8897] ? __pfx_get_signal+0x10/0x10 [ 141.508382][ T8897] ? hrtimer_nanosleep+0x181/0x350 [ 141.508400][ T8897] arch_do_signal_or_restart+0x91/0x7e0 [ 141.508418][ T8897] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 141.508433][ T8897] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 141.508454][ T8897] exit_to_user_mode_loop+0x139/0x700 [ 141.508467][ T8897] ? rcu_is_watching+0x13/0xc0 [ 141.508482][ T8897] do_syscall_64+0x661/0x790 [ 141.508498][ T8897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.508509][ T8897] RIP: 0033:0x7f7e9c99e159 [ 141.508517][ T8897] Code: Unable to access opcode bytes at 0x7f7e9c99e12f. [ 141.508522][ T8897] RSP: 002b:00007f7e9ab93028 EFLAGS: 00000246 ORIG_RAX: 0000000000000023 [ 141.508533][ T8897] RAX: fffffffffffffdfc RBX: 00007f7e9cc26540 RCX: 00007f7e9c99e159 [ 141.508540][ T8897] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000600 [ 141.508546][ T8897] RBP: 00007f7e9ca3503b R08: 0000000000000000 R09: 0000000000000000 [ 141.508552][ T8897] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 141.508558][ T8897] R13: 00007f7e9cc265d8 R14: 00007f7e9cc26540 R15: 00007ffe4eb38638 [ 141.508572][ T8897] [ 141.508677][ T8897] BUG: using smp_processor_id() in preemptible [00000000] code: syz.5.651/8897 [ 141.508686][ T8897] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 141.508704][ T8897] CPU: 3 UID: 0 PID: 8897 Comm: syz.5.651 Tainted: G L syzkaller #0 PREEMPT(full) [ 141.508718][ T8897] Tainted: [L]=SOFTLOCKUP [ 141.508722][ T8897] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 141.508728][ T8897] Call Trace: [ 141.508732][ T8897] [ 141.508735][ T8897] dump_stack_lvl+0x100/0x190 [ 141.508751][ T8897] check_preemption_disabled+0xd2/0xe0 [ 141.508767][ T8897] ? skb_queue_purge_reason+0x2aa/0x420 [ 141.508785][ T8897] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 141.508801][ T8897] ? skb_queue_purge_reason+0x2aa/0x420 [ 141.508815][ T8897] trace_kfree_skb+0x18b/0x230 [ 141.508831][ T8897] sk_skb_reason_drop+0xb7/0x1b0 [ 141.508845][ T8897] skb_queue_purge_reason+0x2aa/0x420 [ 141.508858][ T8897] ? synchronize_rcu_expedited+0x3c3/0x450 [ 141.508871][ T8897] ? __pfx_skb_queue_purge_reason+0x10/0x10 [ 141.508892][ T8897] packet_release+0x839/0xd70 [ 141.508906][ T8897] ? __pfx_packet_release+0x10/0x10 [ 141.508918][ T8897] ? __pfx_down_write+0x10/0x10 [ 141.508934][ T8897] ? __pfx_locks_remove_file+0x10/0x10 [ 141.508952][ T8897] __sock_release+0xb3/0x260 [ 141.508965][ T8897] ? __pfx_sock_close+0x10/0x10 [ 141.508977][ T8897] sock_close+0x1c/0x30 [ 141.508988][ T8897] __fput+0x3ff/0xb50 [ 141.509005][ T8897] task_work_run+0x150/0x240 [ 141.509021][ T8897] ? __pfx_task_work_run+0x10/0x10 [ 141.509041][ T8897] do_exit+0x951/0x2ae0 [ 141.509056][ T8897] ? __pfx_do_exit+0x10/0x10 [ 141.509070][ T8897] ? do_raw_spin_lock+0x128/0x260 [ 141.509083][ T8897] ? find_held_lock+0x2b/0x80 [ 141.509098][ T8897] ? get_signal+0x7e0/0x21e0 [ 141.509110][ T8897] do_group_exit+0xd5/0x2a0 [ 141.509125][ T8897] get_signal+0x1ec7/0x21e0 [ 141.509136][ T8897] ? __pfx_debug_object_free+0x10/0x10 [ 141.509152][ T8897] ? __pfx_get_signal+0x10/0x10 [ 141.509165][ T8897] ? hrtimer_nanosleep+0x181/0x350 [ 141.509183][ T8897] arch_do_signal_or_restart+0x91/0x7e0 [ 141.509199][ T8897] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 141.509215][ T8897] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 141.509236][ T8897] exit_to_user_mode_loop+0x139/0x700 [ 141.509248][ T8897] ? rcu_is_watching+0x13/0xc0 [ 141.509264][ T8897] do_syscall_64+0x661/0x790 [ 141.509280][ T8897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.509292][ T8897] RIP: 0033:0x7f7e9c99e159 [ 141.509301][ T8897] Code: Unable to access opcode bytes at 0x7f7e9c99e12f. [ 141.509305][ T8897] RSP: 002b:00007f7e9ab93028 EFLAGS: 00000246 ORIG_RAX: 0000000000000023 [ 141.509315][ T8897] RAX: fffffffffffffdfc RBX: 00007f7e9cc26540 RCX: 00007f7e9c99e159 [ 141.509322][ T8897] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000600 [ 141.509328][ T8897] RBP: 00007f7e9ca3503b R08: 0000000000000000 R09: 0000000000000000 [ 141.509334][ T8897] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 141.509341][ T8897] R13: 00007f7e9cc265d8 R14: 00007f7e9cc26540 R15: 00007ffe4eb38638 [ 141.509354][ T8897] [ 141.629618][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.702479][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.873466][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.973162][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.404240][ T12] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.433694][ T44] audit: type=1400 audit(1789055389.341:8120): avc: denied { write } for pid=8906 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 143.472141][ T12] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.478528][ T44] audit: type=1400 audit(1789055389.391:8121): avc: denied { write } for pid=8909 comm="rm" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 143.517678][ T5451] 8021q: adding VLAN 0 to HW filter on device eth14 [ 143.535296][ T12] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.599157][ T12] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.599177][ T44] audit: type=1400 audit(1789055389.511:8122): avc: denied { write } for pid=8912 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 143.644573][ T44] audit: type=1400 audit(1789055389.551:8123): avc: denied { write } for pid=8915 comm="rm" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 143.691490][ T5451] 8021q: adding VLAN 0 to HW filter on device eth15 [ 143.720068][ T12] bridge_slave_1: left allmulticast mode [ 143.720084][ T12] bridge_slave_1: left promiscuous mode [ 143.720193][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 143.721388][ T12] bridge_slave_0: left allmulticast mode [ 143.721400][ T12] bridge_slave_0: left promiscuous mode [ 143.721525][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.735476][ T12] bridge_slave_1: left allmulticast mode [ 143.735491][ T12] bridge_slave_1: left promiscuous mode [ 143.735583][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 143.741097][ T12] bridge_slave_0: left allmulticast mode [ 143.741111][ T12] bridge_slave_0: left promiscuous mode [ 143.741205][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.765456][ T44] audit: type=1400 audit(1789055389.671:8124): avc: denied { write } for pid=8918 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 143.854510][ T12] gretap0 (unregistering): left allmulticast mode [ 143.872821][ T12] bond1 (unregistering): (slave geneve2): Releasing active interface [ 143.889163][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 143.890925][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 143.891655][ T12] bond0 (unregistering): Released all slaves [ 143.894436][ T12] bond1 (unregistering): Released all slaves [ 143.901711][ T12] bond2 (unregistering): Released all slaves [ 143.979720][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 143.981045][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 143.981812][ T12] bond0 (unregistering): Released all slaves [ 143.985432][ T5451] 8021q: adding VLAN 0 to HW filter on device eth16 [ 144.069027][ T12] tipc: Disabling bearer [ 144.069116][ T12] tipc: Left network mode [ 144.153037][ T5451] 8021q: adding VLAN 0 to HW filter on device eth17 [ 144.322944][ T5451] 8021q: adding VLAN 0 to HW filter on device eth18 [ 144.359264][ T12] hsr_slave_0: left promiscuous mode [ 144.359723][ T12] hsr_slave_1: left promiscuous mode [ 144.360107][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 144.360117][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 144.360707][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 144.360716][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 144.362915][ T12] hsr_slave_0: left promiscuous mode [ 144.363295][ T12] hsr_slave_1: left promiscuous mode [ 144.363656][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 144.363666][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 144.364073][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 144.364082][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 144.374705][ T12] veth1_macvtap: left promiscuous mode [ 144.374779][ T12] veth0_macvtap: left promiscuous mode [ 144.374827][ T12] veth1_vlan: left promiscuous mode [ 144.374857][ T12] veth0_vlan: left promiscuous mode [ 144.384249][ T12] veth1_macvtap: left promiscuous mode [ 144.384269][ T12] veth0_macvtap: left promiscuous mode [ 144.384313][ T12] veth1_vlan: left promiscuous mode [ 144.384328][ T12] veth0_vlan: left promiscuous mode [ 144.705302][ T12] team0 (unregistering): Port device team_slave_1 removed [ 144.712184][ T12] team0 (unregistering): Port device team_slave_0 removed [ 144.771198][ T5451] 8021q: adding VLAN 0 to HW filter on device eth19 [ 144.930193][ T5451] 8021q: adding VLAN 0 to HW filter on device eth20 [ 145.095861][ T5451] 8021q: adding VLAN 0 to HW filter on device eth21 [ 145.154032][ T12] IPVS: stop unused estimator thread 0... [ 145.260059][ T12] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.322641][ T12] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.393729][ T12] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.471804][ T12] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.547368][ T12] bridge_slave_1: left allmulticast mode [ 145.547384][ T12] bridge_slave_1: left promiscuous mode [ 145.549206][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 145.550995][ T12] bridge_slave_0: left allmulticast mode [ 145.551008][ T12] bridge_slave_0: left promiscuous mode [ 145.551100][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.640360][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 145.641763][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 145.642490][ T12] bond0 (unregistering): Released all slaves [ 145.805585][ T5451] 8021q: adding VLAN 0 to HW filter on device eth22 [ 145.914276][ T12] hsr_slave_0: left promiscuous mode [ 145.914894][ T12] hsr_slave_1: left promiscuous mode [ 145.915498][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 145.915515][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 145.919941][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 145.919957][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 145.931402][ T44] kauditd_printk_skb: 14 callbacks suppressed [ 145.931414][ T44] audit: type=1400 audit(1789055391.841:8139): avc: denied { write } for pid=8979 comm="rm" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 145.932322][ T12] veth1_macvtap: left promiscuous mode [ 145.932360][ T12] veth0_macvtap: left promiscuous mode [ 145.932436][ T12] veth1_vlan: left promiscuous mode [ 145.932489][ T12] veth0_vlan: left promiscuous mode [ 146.051496][ T12] team0 (unregistering): Port device team_slave_1 removed [ 146.058155][ T12] team0 (unregistering): Port device team_slave_0 removed [ 146.129017][ T5451] 8021q: adding VLAN 0 to HW filter on device eth24 [ 146.200408][ T44] audit: type=1400 audit(1789055392.111:8140): avc: denied { write } for pid=8984 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 146.241052][ T44] audit: type=1400 audit(1789055392.151:8141): avc: denied { write } for pid=8987 comm="rm" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 146.269204][ T5451] 8021q: adding VLAN 0 to HW filter on device eth23 [ 146.335879][ T44] audit: type=1400 audit(1789055392.241:8142): avc: denied { write } for pid=8990 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 146.380400][ T44] audit: type=1400 audit(1789055392.291:8143): avc: denied { write } for pid=8993 comm="rm" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 146.408715][ T5451] 8021q: adding VLAN 0 to HW filter on device eth25 [ 150.488042][ T44] audit: type=1400 audit(1789055396.401:8144): avc: denied { write } for pid=9015 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 150.529527][ T44] audit: type=1400 audit(1789055396.441:8145): avc: denied { write } for pid=9018 comm="rm" name="hook-state" dev="tmpfs" ino=1838 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1