last executing test programs: 7.789396184s ago: executing program 2 (id=788): r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000040)=0x5) ioctl$VIDIOC_ENCODER_CMD(r0, 0xc028564d, &(0x7f0000000080)={0x2, 0x0, [0xec, 0xbb, 0xd5, 0x10001, 0x1, 0xc, 0x6]}) ioctl$VIDIOC_SUBDEV_S_CROP(r0, 0xc038563c, &(0x7f00000000c0)={0x1, 0x0, {0x1ff, 0x0, 0x0, 0x7}}) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$UHID_INPUT2(r2, &(0x7f0000000140)={0xc, {0x37, "e303793ffaea49541720aa4bb320cf3dcccdbee0e1436bdbd7edd5594de28b2125eea0a33976895a6c3203bc24e8e56d6d94c47ac675d1"}}, 0x3d) ioctl$AUTOFS_IOC_SETTIMEOUT(r0, 0x80049367, &(0x7f0000000180)=0x7) r3 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$PIO_SCRNMAP(r3, 0x4b41, &(0x7f00000001c0)="43da8ebaa865c5c07e84011822656779e5c93fe9e47ff2fbe8978c816d6187666aeb13012afee49c038c39b630b54c14330f8b4025d6711faf9ba2d6e9eb99ff4eafca9050ae27b09a7978b677f6358da8f2d696ff792dde4ba95bcae4bfdcd531ae0edb71c9e5a9279243499a674ebcacb5954be10e02eb509df639cdd883a75242274304008c2a6c754c047d7a874730e34304fd06eacd05c6ff053f2c1dad2e29f9b0ff8a3de3ec80d8c020cfc1bd") pipe2$9p(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r4, &(0x7f00000002c0)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) write$UHID_SET_REPORT_REPLY(r2, &(0x7f0000000300)={0xe, {0x8, 0xe, 0x7, 0x8d, "cc990463b8795734653b13ba2bc1c36fce75cce50327cf649fe49ad8cdc17d11c6704a4d2fcc06923262dd2935af7ce828d15240e234d78ab5c65a34cd1c3f099bad4e374e9fc6e38ad8bfc9ee5c71054414e48418bbc39d53543f8c615d7539bfdb22f01397b574487bd978c7fdde1903e749a93bd052bd237f4d84ffe18fb64eecf90941a7ccd3876fcf283b"}}, 0x99) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f00000003c0)={0x0, 0x2, 0x5, 0x1}) ioctl$BTRFS_IOC_SCRUB(r3, 0xc400941b, &(0x7f00000007c0)={r5, 0x40, 0x1000, 0x1}) io_uring_register$IORING_REGISTER_FILES2(r3, 0xd, &(0x7f0000000d00)={0x1, 0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f0000000bc0)=""/155, 0x9b}], &(0x7f0000000cc0)}, 0x20) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x39) ioctl$KVM_CAP_EXIT_HYPERCALL(r6, 0x4068aea3, &(0x7f0000000d40)) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) fsetxattr$security_ima(r7, &(0x7f0000000dc0), &(0x7f0000000e00)=@v2={0x5, 0x0, 0xd, 0xbd, 0x6f, "b62f583ef00feb97baa70b8e4ad0a6518db80aa4f4678bb0c0b457d56b88cb0ac8ca3ca0098d71ea421a3a8ad4cd1673c4092b4a0b17e32035ed353c062e05b85739dc4e81f711e49eb7cefbf217284e49a05672432ef0e09e394581e032254db022209991a707fe3f7fe7791b37bc"}, 0x78, 0x1) r8 = syz_open_dev$ndb(&(0x7f0000000e80), 0x0, 0x105000) ioctl$F2FS_IOC_PRECACHE_EXTENTS(r8, 0xf50f, 0x0) write(r0, &(0x7f0000000ec0)="8c2ae73f7b74ae2a84d4046903fc0fb07eed21e30c82ce895f8c2af59edbb85c", 0x20) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) fcntl$notify(r9, 0x402, 0x2d) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000f80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4a0, 0xe8, 0x348, 0x2b0, 0x1b0, 0x2b0, 0x408, 0x408, 0x408, 0x408, 0x408, 0x6, &(0x7f0000000f00), {[{{@ip={@local, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffff00, 0xffffff00, 'veth0_macvtap\x00', 'wg0\x00', {}, {}, 0x11, 0x1, 0x12}, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}, {0x4}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x2}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0x16}, @loopback, 0xffffff00, 0xffffffff, 'vcan0\x00', 'veth0_vlan\x00', {}, {}, 0x6c, 0x2, 0x1b}, 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@ah={{0x30}, {[0x8001, 0x7ff]}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xc0, 0x100, 0x0, {}, [@common=@icmp={{0x28}, {0xe, "aee7"}}, @common=@unspec=@addrtype1={{0x28}, {0x20, 0x0, 0x3}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x4, 0x7, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4e23}}}, {{@ip={@remote, @dev={0xac, 0x14, 0x14, 0x39}, 0xff000000, 0xffffffff, 'macvtap0\x00', 'batadv_slave_0\x00', {0xff}, {}, 0x1d, 0x1, 0x51}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x20, 0xb4, 0x2}}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x5}}]}, @ECN={0x28, 'ECN\x00', 0x0, {0x11, 0x9, 0x1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x500) mknod(&(0x7f0000001480)='./file0\x00', 0x8000, 0x7) ioctl$BLKPG(r8, 0x1269, &(0x7f0000001580)={0x3, 0x0, 0x98, &(0x7f00000014c0)={0x4, 0x7f, 0x7}}) ioctl$FE_SET_FRONTEND_TUNE_MODE(0xffffffffffffffff, 0x6f51, &(0x7f00000015c0)) 7.722722227s ago: executing program 2 (id=789): r0 = fsopen(&(0x7f00000005c0)='nfs\x00', 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0xb, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020752f00000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000f8ffffff850000000600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000200)={r2, 0x0, 0x25, 0x0, @val=@kprobe_multi=@addrs={0x1, 0x0, 0x0, 0x0, 0xdb}}, 0x30) syz_emit_ethernet(0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c2000001080045000028006500000f06907864010101ac1414aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5c02ff4d94780000"], 0x0) write(r1, &(0x7f0000000600)="93c443ebea7dc802f97b18664133bac4a8413d12d9180210b6bb82473d2ccb21927e5417e2b0129c04a4ae39a9e05173525d1024eca6a121a8f43b39a9391459ba442be2edfcda151303c2725bcbca918f", 0x51) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000740)='vers\x00', &(0x7f0000000780)='3\x00', 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r2, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x7, &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xed, &(0x7f0000000300)=[{}, {}, {}], 0x18, 0x10, &(0x7f0000000340), &(0x7f0000000380), 0x8, 0x62, 0x8, 0x8, &(0x7f00000003c0)}}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000540)={r2, r3, 0x25, 0x16, @val=@netfilter={0x7, 0x0, 0x10001, 0x1}}, 0x20) ioctl$FITHAW(r0, 0xc0045878) 7.649166871s ago: executing program 2 (id=791): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x4001}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d23210000000000000000001"], 0x4a) 7.549484592s ago: executing program 2 (id=792): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = syz_usb_connect(0x2, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109024a0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e", @ANYRESHEX], 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000140)={0x34, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r2, 0x5b14, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000200)={0x4, "aba4d211000700dbd2f118040000000000000000ffff00"}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda501009bdeffafde25"}) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000240)={'syzkaller0\x00', 0x7101}) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000280)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r9, {0xc}, {}, {0xa, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x40098}, 0x0) openat(r3, &(0x7f0000000180)='./file0\x00', 0xc0, 0x9) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000480)={0x3, 0x6, 0x40, 0x3, 0x9, 0x6, 0x67, 0x9, 0x3, 0x81, 0x40, 0x0, 0xc4, 0x6}, 0xe) 6.120339549s ago: executing program 2 (id=800): mknodat$null(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2000, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x101100, 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = fcntl$dupfd(r3, 0x0, r2) getpeername$packet(r4, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000340)={'syzkaller0\x00', 0x1001}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = openat$bsg(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$BSG_SET_COMMAND_Q(r6, 0x2271, &(0x7f0000000680)=0x1) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) lremovexattr(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)=@known='system.posix_acl_access\x00') 5.177378863s ago: executing program 2 (id=812): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, &(0x7f0000000040)={0x0, 0x12}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$dvb_frontend(&(0x7f0000000140), 0x1, 0x802) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 3.879931803s ago: executing program 1 (id=831): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000540)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f00000029c0)="34000000070001020304050601", 0x178) 3.879750064s ago: executing program 0 (id=832): socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000780)={'bond0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000007c0)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x300, &(0x7f0000000840)={&(0x7f0000000880)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8, 0x1, r1}, @IFLA_HSR_SLAVE2={0x8, 0x2, r2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) 3.867302634s ago: executing program 1 (id=833): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f00000000c0)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) (async) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000300)={0x2, {{0x2, 0x0, @multicast2}}, 0x0, 0x3, [{{0x2, 0x4e22, @broadcast}}, {{0x2, 0x4e22, @broadcast}}, {{0x2, 0x4e22, @rand_addr=0x64010102}}]}, 0x210) (async, rerun: 32) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/fscreate\x00') (rerun: 32) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000080)={0x1, 0x9b}, 0x2) (async) exit(0x5) (async) write$P9_RRENAME(r1, 0x0, 0x0) (async) exit(0x1) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfff}, [@generic={0x73, 0x1, 0x1, 0x1f}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.809396539s ago: executing program 0 (id=834): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f00000001c0)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1}) socket$inet_sctp(0x2, 0x1, 0x84) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d23210000000000000000001"], 0x4a) 3.678669321s ago: executing program 0 (id=835): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001800)={0x11, 0x3, &(0x7f0000000240)=ANY=[], &(0x7f0000000180)='syzkaller\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000002c0)={0x7, 0x1}, 0x8}, 0x94) (fail_nth: 1) 3.618752533s ago: executing program 0 (id=836): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40000000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0004400000000000000c7f14000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=ANY=[@ANYBLOB="4c0000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a3100000000200003801c0000800c000180060001001e1c00000c000a"], 0x4c}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00') (async) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)={0xc4001, 0xc8, 0x1}, 0x18) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000180)=0x2) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48000000100001060100000000000000000000000000000000000000000000001000030073797a6b616c6c65723000001800128008000100767266000c00028008000100e8"], 0x48}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'syzkaller0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="300000001000810814000000fedb30643ff605b7", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r5, @ANYBLOB="08001b0000000000"], 0x30}}, 0x8c0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000080)='./file0/file0\x00', 0x0, 0x1042c12, 0x0) (async) mount$bind(&(0x7f0000000100)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b100a, 0x0) (async) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/file0\x00', 0x0, 0x10dcd8, 0x0) 3.618270055s ago: executing program 0 (id=837): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/pm_test', 0x42, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000280)="2c1cbf6d78c76cca14f0b1dfd5af514fcc6f5bd69ce4df3145e02c97dd3c0a", 0x1f}], 0x1) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='mountinfo\x00') sendfile(r2, r2, &(0x7f0000000040)=0x2eb4, 0x2000007ff) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000300)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000340)=0x6, 0x4) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000380), 0x4) ioctl$KVM_HAS_DEVICE_ATTR_vm(r2, 0x4018aee3, &(0x7f0000000640)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000600)={0xf2, 0x6}}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c0002800500010000000000080007"], 0x98}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r6, &(0x7f0000000680)={0x1f, 0x5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) setsockopt$bt_BT_SECURITY(r6, 0x112, 0x4, &(0x7f00000006c0)={0x2, 0x1}, 0x2) sendmmsg$inet(r6, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40844) mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000780)='./proc\x00', &(0x7f00000007c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./proc/net/stat\x00', 0x0, 0x0) r8 = openat(r7, &(0x7f0000000840)='rt_cache\x00', 0x0, 0x0) read(r8, &(0x7f0000000880)=""/4096, 0x1000) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="500000000001010400000000000000000a0000063c0001802c00018214000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c0002800500010000001100"], 0x50}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x3, &(0x7f0000000240)=ANY=[], &(0x7f0000000180)='syzkaller\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000002c0)={0x7, 0x1}, 0x8}, 0x94) 2.969872317s ago: executing program 1 (id=838): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000001c0), r0) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4080}, 0x0) 2.969699425s ago: executing program 1 (id=839): bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="bf16000000000000b7070000000100004870000000ffffffdc0700001000000095000000000000002ba728041598fbd30cb599e83d24a3aa81d36bb3019c13bd23212fb56fa54f2681d8b02c3815e79c1414eb07eae6f0711e6bd917487960717142fa9ea4318123f602000000000080de89e661168c1886d0d4d94f204e345c65c26e278ef5b915395b19284a1a4bc72fbc1626e3a2a2ad358061d0ae0209e6e83d15645aa818d92b21aa6459512f51ee988e6ea604ce974a22a550d6f97080980400003e05df3ceb9f1feae5737ecaa8666963c474c2a100c788b277beee1cbf9b0a4d3881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3431abe802f5ab3e89cf6c662ed4048d3b3e22278d00ce00000000d3a02762c2951257b85802189d74005d2a1bcf9436e192e23fd275985bf31b714f000bcab6fcd610f25f5888000000003f11afc9bd08c6ebfbb89432fb465bc52f49129b9b6150e320c9901de2ebb9000000018e3095c4c5c7a156cec33a667dccaff950ca1e5efdd4c968dacf81baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba175d876defd3541772f26e27c44cfdb2d85d6d29983e830a9cdd79837b3468e8c67a571d0a017c100344c52a6f387a1340a1c8889464f90cc4cd1f570dd39877dfb2ff1ae66e1ce917474b2e650ae630afd014a337ac5d58bcb5e517232586872c5255f20100000000000000f041b665ab21372c8d8b7bac5b5c784d20a4a24d8dbd75062e1daef9dead619cc6e7baa72707157791c3d2a286ffb8d35452bb5d36c2a8682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b9935f771fd49e480cd9d48aeb12b1d6acabd38a817bcd222614d1f62734d679039a97d2b74f9e8e997ccd314000f747f4e8e7025123e783df8b8a17e3aa9fe1f662aef87a065b03cfb65b4dfe4f1b56e1f23128d743753a1de172d683d5892ce9414a1d98ea93e3d35dbb6c23b90cf36e83b8a434a97d09343d7f83079ccb02e69d384146056d125cfa788237874dd42dae334bda042819a2aa24dba1c25be2794448b4f63483026b5e34d44705b76ef29241adab0dd7d68bf975e02069f6f2425e1bc97a3d588085f16bef63a06578d4f5de7bfb6aaa75f16996d536256c02284cb1d3a6fb8cae87691fae365a70c3fc69e1565bba8dd8a8ca049f798abe646f738bebd69413afc9d8a5edd7aaa000000000600001e6c2f2a287c5278a218dbfaffffff00a14db5cfa6819eb1d39c48cfdc80d215c9e16e0c4736dd19363154cca4e2f89800d18c89d7f46f679df6c9e2952ae1ebfd0ca88368ee6ce139e8b5822c22cf2e9dde943d34c432e1001171792c65986146666a5490928441f47e0fe5eac41824ca1fd0eb71aa243c88d5480e5aee9c9e5f2e5a56a6d920335c8e8726fd8329d9a733d8f9ffffff5f912ac4e34bf6ea8a86da707b03bddb491ba0cc98f6be92c50008a2b50025419dfc75c73132ca7ca26ce8a7e3ffb700f09e157f9b844051f1a642aca9ff98c9036471ccff0522903e7bcf62e18f7696bbc280b95e8e0d6fd5644b0ebde3a95b06548862de809d3dae3cccf109f7c78e8479a345e800000000000000000000009455bf417627ce723a5d9103706aba69279500bb82f6b5a3ddc0bd9856712945b70c75ce5b722578820820d010d7a3cffc99fc647d0b82ef26ab708c0b19ed144be51c3b398f0e6bb7a30006000000cba12953d58cff0f0378740fe6662f377b97d8e7cdb047050d7296cd3856476a0ea49ad127ba6570bafc2bbcf9ee721fd9cb467ff071e5604fbf0491245c0000007d932d7a64de4c4aa433fc0840aff7c47da3a4c6966d0000000000000000f6bfbae29e8a6e2a889f6ef6869d82d6bd73eb76b65c7a35a54a4a6b8ad4600e3a972a0bb5971a5f16590b0a03dafa3fd1118765cc8ab9fccf3b51c41a339f200f2fa33006910a679a9ae0187b4d750c4bd244cb0cbfd23b265f4d4da448a7a0d19c5e43eae50a31609dfa2ddf267551467eb6475293dd7012cc449009981f22820e57a0eff234ccfe21d7a2302e000669753d3c3432cc14ee1abe724adb6b5431befedd3e22971118f0e21aed186a370e9eb56b3d790b98f2bd0db1e5de6a146597b2cbb7103040d2a39d7965d36df524b760ab92efcce7dd1574a0730a9e015c7f5ffee9ff66e5dd2866b15b6e0d17618cb1f5c1ee4b05ebf1445ea110f499f840a5c965443d725556351ee25fe09f69494b053678dcadcf02e063dff2fa4bef1ac3bbbe4fe3e8cc759b05785adc346b7ffd05963f92c1d0d7d90ba878ad89e490f3e29ac51d30632869a534418f916bf6fe8167827a8e6c8f8b391c822805cb0adf1b8bd6947ff208753eb0d208ce14f7b206b2e02c21e963abc5ceb735c1b3c46b0a843de52a903375dfb663a8d8ee9c2b2705c1a81d9d3b9656b219c8cd99c9cafcd0d0540884d97aecb19983fc6af29ab44a82aff9cba921192c665b877af6539bdb1b567f481ba07982e7ad758f4e1eac69e7e88a63960975f490e161e371ec8534791e3b61c63fb9450dd03985d900a9c0839208356b53750e76fcc3c2d1bddcbd83897921bd4d0c02e8188f3df79ea2a5c5444004830e6cb227ca1bdafb977c00000000003a417193b8c5d793687335a980010000fdf278218218e04b705ec62f1608cb569b81914e68f175b392af6bc4fd2121d7fd276af2c97a441b56e7a0687d98b8e76d8d0d231e4fe00be1de76bd19cc12e2bd938eb681ed6bc951c1b4f7c51af59eea4d40c6000000000200778a677b72786311153271a3313da02645e11761699e4d04ac86dd14ff7b9a10d3fa74696fe3953a5b7706bf5d1faba4b18808d9cb0e9d3696dec4e0820ee4028d7225a2c9c427cf64cbde6fba056b2006b7a37c1181d530fb865e235cd302f3b4071ee5237ada986b9e5e3144bf479f277f10656ad3744037ccc9c63685a6f1109d2ea73773d3635f61497f1fa1ea4a16f601800bf3e59141fbf05a96113320c445f9ba8596970d5254727e804fbd99ccefb7c09269dd2c5c25e56e169ac15980f3f85f7ca36dd5950ef5b64fd46f123311829534a82940994199b3cf7a8fabea9930952f5da9b909c1946e55289f668c423fcbb31ae91864c882313151741a67538c9689dc8ecc9903c7041e5c0704e2fa55a756487517a7445cbd9e3f5175e41c00000000000000000000000000bf98efd587fffe326f474b0b089c017b16c0062cbce96f5adebec52a79f9363909842f79c50a1520be46d87003137e4c5031f00123e812a5e37cd52c9eb7336281cb8c6ce9934b157d7875a70eaf103cb3138e2361c51cd1eab8a26b232acf6bf0ab829c26dab637538b2eb1420d812d2b80c777710ba0f18e4661681aa218d9ba54023ab4305d77eb15611ae2545835e9d30e9f6d4fb43a291c69545a1eea0f8720431132d8549f99bf6c5cb060da70cbb59d0a000000000034d083fc37d2449f72de0cbea4bc1dc89c136cdbc504f849d5502d77a95c7bfff4cd9c03058d0d4d07ea64824f1acf2b39389f675f39d01719cdbab3f1ce10609c8d7b3e37cb99b41da5e485a441b6a103549f55ab09dc98767763d1f21d9d5bc27d2b40050d1f8292f4d9ec6d0000000000003932062290f4996fdd55b06023437e9e2072daf7f5d82f6f1b5b89a41134f4dc2e65bb11272fdf8c8141f41d6160b3d8b6ecd16d14267f61b4881adee7f07f3d6af5ae79e16fe2c3f55ac7a6392d2e1d9b4286b6c30600a76b85ed6e1f0000c67e6c5fcdc8c39381be4799b8cb2d08b8262c807dd755e22b801162381aa9d1af2bbc9cfd497585337eac408b8475b47a392a10cae349160f128e5f873a58064eb400c36a90624f6aed398a215e9ce64522ab249f67c38a656d32ecff5cdb2b039c4abf349d2c0f88a42e9189bbfa7f5cf35b6e7ef8f9d33163b7ea87550fb1ba334c83e3aec4714c9c4ca3ecb04f2720237615a28bf310b58ffa2a103216fdcc8c2d8f5d55e5e7ebf147105272aaae56e86da86b3cf79a3f7306436762dd1a08ce873e07cebc7892ec6f9f696da38feed3d70001500e34ad2e1b2e64af4e37211b524e20f4ae1ba89a32bad2af9030f8add5cbacc59352c290f55d971b65953533668c25f21d8d62d849e9058eaa97c63491568887548f668cdbca2abf01a361a0b64d8b523e669da350e3ec7445dfbf366b0b3bc5e76824a1e43eaaeca70db90f2fa39596443447671933079a24fe3681ad9ac361f71ac279a688f10a12105edebc5e3bbc394c8305ab129ca2dfb9b7c5e9d097bd01b495cccefddce569117f7f5d6a6270ff0f0f4c371029ca8489571b55841bf3dd003bc81460eee57ceb3c33f4e90eb1fffffffffffffcfcbb616c2070237881afdb314cecd1623f3e55ab8b7627fa1be349145a8d6313cbc790eefe2020138e82fb9d351be4ddcbcc9bc048dd3db5828d16baec6e07a007f0030f34ea3cfd524d6fa1d45da5641d6c94e1d3ae7fba1c85035d2a60ef1696e0d96aa1c60019f73ae0aa6113cd66ef26b5777337c26e1461405d86fdf091edd526f25cada439bb3609ed5c35ab60a539ade786bd6004d0ea3edbd6c4da0d8e8be8c771c8c8a0b07d9859e04adb18964dcce9bce546074c2615318bf813e788c84409dffbc2df372a016e8c845d4257000000000000000000000000000000000000f29657697d9c2b132b2dc2f5ea5122836582a7e85fe2bc166f17aefd9d861de0191f5277d4a3b5afb6f23d9eea2459f7844606e1202768d83c24cc791bde44a448022bbfa571fe029a7b2d5152639ee283894ab6168992ff0acc01b39a078f285ce615351f262019586eb9447bb3eaffd7b53d8f37ca6c5f1027dd5b7592996c8a7789ba108979cc9ad07ed86682843e2eaa855dd01443ee6ffde1811f10039d5d14458177096e15cc4d8f2582a1bea5cc98d992f3de7d1cdfb24384b9f11b615c87c441dc970ec896a5af6bf69b50a244bc138a1cae3d220bcff6bcb3058c6e0d1cc0da889710f33f5638f805ce602365492282863cc8092b16656dea03cd50182aabbac78a14506dcbf823bec4a5dad14c4d7353b6a55c28321647df3a85bf9fca4e18aeaf4867e6a3dbdd7a5dbe1a52bddae83fc368404a032b75649cf74d7af8e9e3e43fad643ad3e8575a2bb0507531eac5e10b631575f1360803c8f556e07f292ab66b9bcea0c2f09db289a5934a4f2f5fe5cfc52b270a4a5fa2a8de62dcaf7ef52f1fd84c55e6a0c5a365a3b4e73c4ac6fc26367f3f6c07b06a0874c039622ba2bd369b105f57099f742a000a36c2f044a5de24604f82a1f197d9a70b5a62f794f57ec02df70d459fedd6125ae41479a2661360a79e175f0add2820018d5985183ee80f681403a7d08e0e2b88d0750c90b7ed5fed6f81ce797f3b60445ce811d2b4e45005a5ea06c1fe927af06433cd3885dc954e698a7a73416c73bfab7773a6e5e14338797ce9148cda4c0bf05fb67915aeb3661e755e4e1a0ceedfe8e91ee5361ff4c7c07b422e1443a6616b6eb3c325d5687644a4c0a1d44d9dfd82896f56bdfa0790406984c123e1d37da4a9a9444485e9b1e3b6b548528989d2aecc1e7b6ee92ca19298801105ced8964e000000000000000000000000000000000000000000000000000000000003d1c031ee2fc25c7ad34283187545b1343f7ab862e66cf5bf4ba4dbf5fda31619c05ddb97199ad4d01471e9b3c7f485b1e74d0ed34201915e79d5ed229f0773ab6b38529c45b10d0796e005b6d663b942320339b9fe1d4e393b4bcb596898cde06955a345db3cb956b0e5da1c1dba7046f4d12fc65085302f333516804d9f"], &(0x7f0000001200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000001240), 0xfffffffffffffe89}, 0x48) r0 = socket$l2tp6(0xa, 0x2, 0x73) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = dup2(r1, r1) getpeername$l2tp(r2, 0x0, 0x0) getsockname$l2tp6(r0, 0x0, &(0x7f0000000140)) 2.878599221s ago: executing program 1 (id=840): r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000200)='.\x00', 0x4cb) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x40100, 0x8) fcntl$notify(r1, 0x402, 0x1a) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000300), 0x4) mmap(&(0x7f000026a000/0x2000)=nil, 0x2000, 0x2, 0x28011, r2, 0x0) preadv(r2, 0x0, 0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) ioctl$int_in(r4, 0x40000000af01, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f00000003c0)) r6 = dup(r5) r7 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0), 0x40, 0x0) mount$tmpfs(0x0, &(0x7f0000000580)='./cgroup\x00', &(0x7f00000005c0), 0x0, &(0x7f0000000080)=ANY=[@ANYRESHEX=r7, @ANYRES16=r7]) r8 = fcntl$dupfd(r4, 0x406, r5) ioctl$VHOST_NET_SET_BACKEND(r8, 0x4008af30, &(0x7f0000000440)={0x0, r6}) r9 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r9, 0x89f1, &(0x7f0000000500)={'sit0\x00', &(0x7f0000000540)={'syztnl0\x00', 0x0, 0x700, 0x700, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x3, 0x14, 0x6a, 0x0, 0x0, 0x4, 0x0, @broadcast, @multicast2}}}}) sendto$l2tp6(r8, &(0x7f0000000480)="65e3d48671fcba3445958a", 0xb, 0x4011, &(0x7f00000004c0)={0xa, 0x0, 0x6, @loopback, 0x10, 0x1}, 0x20) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r11 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000640), 0x169802, 0x0) r12 = dup(r11) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r12, 0x0) write(r12, &(0x7f0000000680)='8', 0x1) ioctl$KVM_CREATE_VM(r10, 0x80811501, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'veth0_to_team\x00'}) 2.779624871s ago: executing program 1 (id=841): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000a00), 0x0, 0x1a30c2) ioctl$FE_GET_PROPERTY(r0, 0x80106f53, &(0x7f0000000100)={0x14, &(0x7f0000000000)=[{0x17, '\x00', @data=0xffff, 0xf6}, {0x32, '\x00', @st={0x4, [{0x3}, {0x0, @uvalue=0x9}, {0x0, @svalue=0x2}, {0x0, @uvalue=0x1}]}, 0xa}]}) 2.690157651s ago: executing program 0 (id=842): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x7b0c, 0x40000) ioctl$FE_GET_PROPERTY(r1, 0x80106f53, &(0x7f0000000040)={0x9, &(0x7f0000000080)=[{0x20, '\x00', @st={0x4, [{0x3, @uvalue=0x1}, {0x0, @uvalue=0x8000}, {0x3, @svalue=0x2}, {0x1, @svalue=0xa}]}}, {0x30, '\x00', @st={0x4, [{0x1, @svalue=0x9e}, {0x2, @svalue=0x7}, {0x1, @svalue=0x6}, {0x2, @svalue=0xfffffffffffffff6}]}, 0x387d}, {0x25, '\x00', @buffer={"fa6a4853c3f1768f932438e5ce80be3693f47208edd4c0ef2f099bfe6a64a74b", 0x20}, 0x800007}, {0x17, '\x00', @st={0x4, [{0x0, @uvalue=0xb}, {0x0, @uvalue=0x2}, {0x2, @uvalue=0xfffffffffffffdff}, {0x1, @svalue=0x6}]}, 0x6}, {0x3, '\x00', @data=0x1, 0xbf}, {0x13, '\x00', @st={0x4, [{0x1, @uvalue=0x2}, {0x2}, {0x1, @svalue=0x3}, {0x3, @uvalue=0x4}]}, 0x363}, {0x45, '\x00', @st={0x4, [{0x3, @svalue=0x9}, {0x1, @uvalue=0x4}, {0x1, @svalue=0x1}, {0x0, @uvalue=0xd}]}, 0x40001b}, {0x24, '\x00', @buffer={"2d3b72640ff1a921f82e921d0955dd513cf300a7e9219e16671c3f2b4572f958", 0x20}, 0x7}, {0x3b, '\x00', @data=0xffffffff, 0x4}]}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB="90000000000101060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500003400028014000180080001000506070808000200010203041c000280050001000600000006000200001500000600030004d20000080007000000012c0c000580080001"], 0x90}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x38, 0x1403, 0xc23, 0x70bd2a, 0x25dfdbff, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'syz_tun\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x14f7325d9d03b00}, 0x4000) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) syz_emit_vhci(&(0x7f0000000640)=ANY=[@ANYBLOB="02c80018001400010006000b00"], 0x1d) sendmsg$nl_route_sched(r0, &(0x7f0000000400)={0x0, 0x69e, &(0x7f0000000440)={&(0x7f0000000480)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0xfcff}, {}, {0xe, 0x10}}, [@TCA_RATE={0x4}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x0) 1.247770492s ago: executing program 3 (id=846): r0 = socket$l2tp6(0xa, 0x2, 0x73) getsockname$l2tp6(r0, 0x0, &(0x7f0000000140)) 1.189493618s ago: executing program 3 (id=847): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x40081c4}, 0x44000) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYRESOCT=r3, @ANYRES32=r0, @ANYRES8=r3], 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.078237765s ago: executing program 3 (id=848): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000001c0), r0) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4080}, 0x0) 1.077738209s ago: executing program 3 (id=849): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./dev\x00', &(0x7f00000002c0)='devtmpfs\x00', 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000006c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000224bd7000fbdbdf250292080005003d00060000000400d100"], 0x20}, 0x1, 0x0, 0x0, 0x24008891}, 0x20040000) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f00000007c0)={0x0, 0xffffffffffffff8c, &(0x7f0000000800)={&(0x7f0000000840)={0x28, r1, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @void}}}, 0x28}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mount$9p_fd(0x0, &(0x7f0000000580)='.\x00', &(0x7f00000005c0), 0x0, &(0x7f0000000600)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}}) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000000)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r5, &(0x7f0000000880)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) r6 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f00000008c0)={{{@in=@rand_addr=0x64010101, @in6=@empty, 0x0, 0x56, 0x2, 0x0, 0x2}, {0x0, 0x5, 0x1, 0x6, 0xfffffffffffffff6, 0x1fffffc, 0xfffffffffffffffc, 0x8}, {0x4, 0x2, 0x4}, 0xf4, 0x0, 0x1, 0x0, 0x2}, {{@in=@dev={0xac, 0x14, 0x14, 0x3b}, 0x4d2, 0x33}, 0x2, @in=@loopback, 0x3500, 0x4, 0x0, 0x0, 0xffffffff, 0x8, 0x1}}, 0xe8) connect$inet6(r6, &(0x7f00000009c0)={0xa, 0x4000, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xff}}}, 0x1c) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r4}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={r4, 0xffffffffffffffff}, 0x4) r8 = gettid() fcntl$lock(r3, 0x24, &(0x7f0000000400)={0x0, 0x3, 0x1000, 0x6, r8}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x10, &(0x7f00000004c0)=@framed={{}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}}]}, &(0x7f0000000540)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x68}, 0x94) mount(&(0x7f0000000340)=@sr0, &(0x7f0000000380)='./dev\x00', &(0x7f00000003c0)='qnx6\x00', 0x8410, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x0, 0x21) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r9, 0x800c6613, &(0x7f0000000480)=@v1={0x0, @aes128, 0x3, @desc4}) 868.715435ms ago: executing program 3 (id=850): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x6c, r2, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x13}, 0xf8}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}}, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)={0x34, r3, 0x1, 0x0, 0x0, {{}, {}, {0x18, 0x17, {0x21, 0x0, @l2={'eth', 0x3a, 'dummy0\x00'}}}}}, 0x34}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x1c, r3, 0x5, 0x70bd26, 0x25dfdbfe}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./mnt\x00', &(0x7f00000004c0)='tracefs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000500)="2d25c873c6d0ff57318d8185a94d488b38f0fcd919d01038dc3dc25401000000feba", 0x22) r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./mnt/trace_pipe\x00', 0x0, 0x0) read(r5, &(0x7f0000000580)=""/16384, 0x4000) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x40000000000004, &(0x7f00000001c0)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r6, &(0x7f0000000280)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @remote, 0x3}, r7, 0x7}}, 0x48) 0s ago: executing program 3 (id=851): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000140)={0x3, &(0x7f0000000180)=[{0x1b, '\x00', @st={0x4, [{0x2, @svalue=0x3}, {0x3, @svalue}, {0x3, @svalue}, {0x2, @uvalue=0xf}]}, 0x9}, {0x9, '\x00', @buffer={"233b263a371067f509207d360700008d262565779b883426b1ec008cc77b2c69", 0x20}, 0xe6}]}) kernel console output (not intermixed with test programs): 7][ T6973] ? netlink_deliver_tap+0x1ae/0xcc0 [ 87.083877][ T6973] genl_rcv+0x28/0x40 [ 87.083889][ T6973] netlink_unicast+0x65f/0x950 [ 87.083903][ T6973] ? __pfx_netlink_unicast+0x10/0x10 [ 87.083920][ T6973] netlink_sendmsg+0x8b0/0xda0 [ 87.083935][ T6973] ? __pfx_netlink_sendmsg+0x10/0x10 [ 87.083948][ T6973] ? selinux_socket_sendmsg+0x198/0x2f0 [ 87.083968][ T6973] ____sys_sendmsg+0xa4d/0xbe0 [ 87.083991][ T6973] ? __pfx_netlink_sendmsg+0x10/0x10 [ 87.084003][ T6973] ? __pfx_____sys_sendmsg+0x10/0x10 [ 87.084025][ T6973] ___sys_sendmsg+0x190/0x1e0 [ 87.084041][ T6973] ? __pfx____sys_sendmsg+0x10/0x10 [ 87.084058][ T6973] ? futex_wait+0x11e/0x370 [ 87.084078][ T6973] ? find_held_lock+0x2b/0x80 [ 87.084106][ T6973] __sys_sendmsg+0x160/0x210 [ 87.084119][ T6973] ? __pfx___sys_sendmsg+0x10/0x10 [ 87.084140][ T6973] do_syscall_64+0x123/0x790 [ 87.084159][ T6973] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.084170][ T6973] RIP: 0033:0x7fd4d179e559 [ 87.084181][ T6973] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.084192][ T6973] RSP: 002b:00007fd4d26e5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 87.084204][ T6973] RAX: ffffffffffffffda RBX: 00007fd4d1a25fa0 RCX: 00007fd4d179e559 [ 87.084211][ T6973] RDX: 0000000000000084 RSI: 0000200000000a40 RDI: 0000000000000004 [ 87.084218][ T6973] RBP: 00007fd4d1835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 87.084225][ T6973] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.084232][ T6973] R13: 00007fd4d1a26038 R14: 00007fd4d1a25fa0 R15: 00007ffce1c2c848 [ 87.084248][ T6973] [ 87.149569][ T5734] Bluetooth: Frame is too long (len 12, expected len 4) [ 87.187830][ T1349] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 87.188928][ T1349] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 87.188951][ T1349] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 87.188971][ T1349] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 87.189004][ T1349] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.191521][ T1349] usb 5-1: config 0 descriptor?? [ 87.305641][ T6981] fuse: Unknown parameter 'user_i00000000000000000000' [ 87.605963][ T1349] usbhid 5-1:0.0: can't add hid device: -71 [ 87.606047][ T1349] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 87.613957][ T1349] usb 5-1: USB disconnect, device number 16 [ 87.642789][ T6996] TC_ACT_REPEAT abuse ? [ 87.647445][ T5734] Bluetooth: hci0: command 0x0c13 tx timeout [ 87.650069][ T5742] Bluetooth: hci0: Opcode 0x0c13 failed: -110 [ 87.667955][ T6999] fuse: Unknown parameter 'user_id00000000000000000000' [ 87.728760][ T7004] netlink: 8 bytes leftover after parsing attributes in process `syz.1.431'. [ 87.731216][ T7005] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_team, syncid = 0, id = 0 [ 87.842550][ T7014] openvswitch: netlink: IP tunnel attribute has 5413 unknown bytes. [ 87.891776][ T7016] syzkaller0: entered promiscuous mode [ 87.891798][ T7016] syzkaller0: entered allmulticast mode [ 88.252195][ T7022] program syz.0.438 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 90.781558][ T7030] fuse: Unknown parameter 'user_id00000000000000000000' [ 90.788575][ T7031] netlink: 72 bytes leftover after parsing attributes in process `syz.0.441'. [ 90.789122][ T7031] netlink: 4 bytes leftover after parsing attributes in process `syz.0.441'. [ 90.870646][ T7042] warning: `syz.1.447' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 90.870968][ T7042] netlink: 'syz.1.447': attribute type 2 has an invalid length. [ 90.871318][ T7042] netlink: 14 bytes leftover after parsing attributes in process `syz.1.447'. [ 90.893202][ T7039] sysfs: cannot create duplicate filename '/class/ieee80211/1^!l1r$Gt:uJ˺' [ 90.893220][ T7039] CPU: 2 UID: 0 PID: 7039 Comm: syz.0.445 Not tainted syzkaller #0 PREEMPT(full) [ 90.893234][ T7039] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 90.893241][ T7039] Call Trace: [ 90.893246][ T7039] [ 90.893251][ T7039] dump_stack_lvl+0x100/0x190 [ 90.893274][ T7039] sysfs_warn_dup.cold+0x1c/0x28 [ 90.893291][ T7039] sysfs_do_create_link_sd+0x113/0x140 [ 90.893306][ T7039] sysfs_create_link+0x61/0xc0 [ 90.893318][ T7039] device_add+0x675/0x1970 [ 90.893335][ T7039] ? __pfx_device_add+0x10/0x10 [ 90.893347][ T7039] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 90.893364][ T7039] ? ieee80211_set_bitrate_flags+0x41b/0x6b0 [ 90.893386][ T7039] wiphy_register+0x2151/0x3110 [ 90.893404][ T7039] ? __pfx_wiphy_register+0x10/0x10 [ 90.893418][ T7039] ? __asan_memset+0x23/0x50 [ 90.893432][ T7039] ? minstrel_ht_alloc+0x5e6/0x7f0 [ 90.893451][ T7039] ieee80211_register_hw+0x3090/0x45c0 [ 90.893476][ T7039] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 90.893493][ T7039] ? __pfx___debug_object_init+0x10/0x10 [ 90.893508][ T7039] ? find_held_lock+0x2b/0x80 [ 90.893526][ T7039] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 90.893541][ T7039] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 90.893559][ T7039] ? __hrtimer_setup+0x208/0x330 [ 90.893577][ T7039] mac80211_hwsim_new_radio+0x2b08/0x6510 [ 90.893602][ T7039] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 90.893636][ T7039] ? __asan_memcpy+0x3c/0x60 [ 90.893652][ T7039] hwsim_new_radio_nl+0xc6b/0x13f0 [ 90.893666][ T7039] ? trace_kmalloc+0xeb/0x110 [ 90.893683][ T7039] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 90.893701][ T7039] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 90.893716][ T7039] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 90.893737][ T7039] genl_family_rcv_msg_doit+0x214/0x300 [ 90.893751][ T7039] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 90.893770][ T7039] ? bpf_lsm_capable+0x9/0x10 [ 90.893783][ T7039] ? security_capable+0x80/0x260 [ 90.893798][ T7039] ? ns_capable+0xd2/0xf0 [ 90.893812][ T7039] genl_rcv_msg+0x560/0x800 [ 90.893828][ T7039] ? __pfx_genl_rcv_msg+0x10/0x10 [ 90.893841][ T7039] ? __lock_acquire+0x5c0/0x1f40 [ 90.893855][ T7039] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 90.893876][ T7039] netlink_rcv_skb+0x159/0x420 [ 90.893887][ T7039] ? __pfx_genl_rcv_msg+0x10/0x10 [ 90.893901][ T7039] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 90.893918][ T7039] ? netlink_deliver_tap+0x1ae/0xcc0 [ 90.893937][ T7039] genl_rcv+0x28/0x40 [ 90.893948][ T7039] netlink_unicast+0x65f/0x950 [ 90.893961][ T7039] ? __pfx_netlink_unicast+0x10/0x10 [ 90.893976][ T7039] netlink_sendmsg+0x8b0/0xda0 [ 90.893989][ T7039] ? __pfx_netlink_sendmsg+0x10/0x10 [ 90.894002][ T7039] ? selinux_socket_sendmsg+0x198/0x2f0 [ 90.894021][ T7039] ____sys_sendmsg+0xa4d/0xbe0 [ 90.894035][ T7039] ? __pfx_netlink_sendmsg+0x10/0x10 [ 90.894047][ T7039] ? __pfx_____sys_sendmsg+0x10/0x10 [ 90.894069][ T7039] ___sys_sendmsg+0x190/0x1e0 [ 90.894085][ T7039] ? __pfx____sys_sendmsg+0x10/0x10 [ 90.894101][ T7039] ? futex_wait+0x11e/0x370 [ 90.894119][ T7039] ? find_held_lock+0x2b/0x80 [ 90.894146][ T7039] __sys_sendmsg+0x160/0x210 [ 90.894158][ T7039] ? __pfx___sys_sendmsg+0x10/0x10 [ 90.894179][ T7039] do_syscall_64+0x123/0x790 [ 90.894198][ T7039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.894209][ T7039] RIP: 0033:0x7f13b799e559 [ 90.894220][ T7039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.894231][ T7039] RSP: 002b:00007f13b88bb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 90.894243][ T7039] RAX: ffffffffffffffda RBX: 00007f13b7c25fa0 RCX: 00007f13b799e559 [ 90.894250][ T7039] RDX: 0000000000000084 RSI: 0000200000000a40 RDI: 0000000000000004 [ 90.894257][ T7039] RBP: 00007f13b7a35ad8 R08: 0000000000000000 R09: 0000000000000000 [ 90.894263][ T7039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.894270][ T7039] R13: 00007f13b7c26038 R14: 00007f13b7c25fa0 R15: 00007ffe882c4698 [ 90.894286][ T7039] [ 90.927644][ T7046] netlink: 80 bytes leftover after parsing attributes in process `syz.1.447'. [ 90.944076][ T42] kauditd_printk_skb: 47 callbacks suppressed [ 90.944094][ T42] audit: type=1400 audit(1792415977.030:402): avc: denied { bind } for pid=7040 comm="syz.1.447" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 90.993400][ T7043] capability: warning: `syz.3.446' uses deprecated v2 capabilities in a way that may be insecure [ 91.025065][ T7052] jffs2: notice: (7052) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 91.042243][ T42] audit: type=1400 audit(1792415977.130:403): avc: denied { write } for pid=7051 comm="syz.2.451" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 91.126183][ T42] audit: type=1400 audit(1792415977.210:404): avc: denied { ioctl } for pid=7062 comm="syz.2.455" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 91.126217][ T42] audit: type=1400 audit(1792415977.210:405): avc: denied { set_context_mgr } for pid=7062 comm="syz.2.455" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 91.126664][ T7063] binder: 7062:7063 ioctl c0306201 200000000940 returned -14 [ 91.129775][ T42] audit: type=1400 audit(1792415977.220:406): avc: denied { map } for pid=7062 comm="syz.2.455" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 91.130472][ T7063] binder: 7062:7063 ioctl c0306201 200000000a40 returned -14 [ 91.130707][ T42] audit: type=1400 audit(1792415977.220:407): avc: denied { call } for pid=7062 comm="syz.2.455" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 91.135910][ T42] audit: type=1400 audit(1792415977.220:408): avc: denied { setopt } for pid=7062 comm="syz.2.455" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 91.136888][ T42] audit: type=1400 audit(1792415977.220:409): avc: denied { node_bind } for pid=7062 comm="syz.2.455" saddr=::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 91.139101][ T42] audit: type=1400 audit(1792415977.230:410): avc: denied { write } for pid=7062 comm="syz.2.455" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 91.139326][ T42] audit: type=1400 audit(1792415977.230:411): avc: denied { connect } for pid=7062 comm="syz.2.455" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 91.187498][ T7066] fuse: Unknown parameter 'user_id00000000000000000000' [ 91.207579][ T7068] program syz.2.457 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 91.240164][ T7071] sysfs: cannot create duplicate filename '/class/ieee80211/qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. 1^!l1r$Gt:uJ˺' [ 91.240178][ T7071] CPU: 2 UID: 0 PID: 7071 Comm: syz.0.458 Not tainted syzkaller #0 PREEMPT(full) [ 91.240193][ T7071] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 91.240201][ T7071] Call Trace: [ 91.240205][ T7071] [ 91.240210][ T7071] dump_stack_lvl+0x100/0x190 [ 91.240234][ T7071] sysfs_warn_dup.cold+0x1c/0x28 [ 91.240253][ T7071] sysfs_do_create_link_sd+0x113/0x140 [ 91.240270][ T7071] sysfs_create_link+0x61/0xc0 [ 91.240298][ T7071] device_add+0x675/0x1970 [ 91.240318][ T7071] ? __pfx_device_add+0x10/0x10 [ 91.240331][ T7071] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 91.240348][ T7071] ? ieee80211_set_bitrate_flags+0x41b/0x6b0 [ 91.240371][ T7071] wiphy_register+0x2151/0x3110 [ 91.240390][ T7071] ? __pfx_wiphy_register+0x10/0x10 [ 91.240404][ T7071] ? __asan_memset+0x23/0x50 [ 91.240418][ T7071] ? minstrel_ht_alloc+0x5e6/0x7f0 [ 91.240437][ T7071] ieee80211_register_hw+0x3090/0x45c0 [ 91.240463][ T7071] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 91.240480][ T7071] ? __pfx___debug_object_init+0x10/0x10 [ 91.240495][ T7071] ? find_held_lock+0x2b/0x80 [ 91.240513][ T7071] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 91.240528][ T7071] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 91.240545][ T7071] ? __hrtimer_setup+0x208/0x330 [ 91.240562][ T7071] mac80211_hwsim_new_radio+0x2b08/0x6510 [ 91.240588][ T7071] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 91.240603][ T7071] ? __asan_memcpy+0x3c/0x60 [ 91.240619][ T7071] hwsim_new_radio_nl+0xc6b/0x13f0 [ 91.240632][ T7071] ? trace_kmalloc+0xeb/0x110 [ 91.240649][ T7071] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 91.240666][ T7071] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 91.240680][ T7071] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 91.240697][ T7071] genl_family_rcv_msg_doit+0x214/0x300 [ 91.240712][ T7071] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 91.240730][ T7071] ? bpf_lsm_capable+0x9/0x10 [ 91.240741][ T7071] ? security_capable+0x80/0x260 [ 91.240756][ T7071] ? ns_capable+0xd2/0xf0 [ 91.240769][ T7071] genl_rcv_msg+0x560/0x800 [ 91.240784][ T7071] ? __pfx_genl_rcv_msg+0x10/0x10 [ 91.240796][ T7071] ? __lock_acquire+0x5c0/0x1f40 [ 91.240809][ T7071] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 91.240830][ T7071] netlink_rcv_skb+0x159/0x420 [ 91.240842][ T7071] ? __pfx_genl_rcv_msg+0x10/0x10 [ 91.240855][ T7071] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 91.240873][ T7071] ? netlink_deliver_tap+0x1ae/0xcc0 [ 91.240892][ T7071] genl_rcv+0x28/0x40 [ 91.240902][ T7071] netlink_unicast+0x65f/0x950 [ 91.240915][ T7071] ? __pfx_netlink_unicast+0x10/0x10 [ 91.240931][ T7071] netlink_sendmsg+0x8b0/0xda0 [ 91.240944][ T7071] ? __pfx_netlink_sendmsg+0x10/0x10 [ 91.240957][ T7071] ? selinux_socket_sendmsg+0x198/0x2f0 [ 91.240976][ T7071] ____sys_sendmsg+0xa4d/0xbe0 [ 91.240990][ T7071] ? __pfx_netlink_sendmsg+0x10/0x10 [ 91.241002][ T7071] ? __pfx_____sys_sendmsg+0x10/0x10 [ 91.241049][ T7071] ___sys_sendmsg+0x190/0x1e0 [ 91.241074][ T7071] ? __pfx____sys_sendmsg+0x10/0x10 [ 91.241091][ T7071] ? futex_wait+0x11e/0x370 [ 91.241111][ T7071] ? find_held_lock+0x2b/0x80 [ 91.241140][ T7071] __sys_sendmsg+0x160/0x210 [ 91.241154][ T7071] ? __pfx___sys_sendmsg+0x10/0x10 [ 91.241177][ T7071] do_syscall_64+0x123/0x790 [ 91.241195][ T7071] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.241208][ T7071] RIP: 0033:0x7f13b799e559 [ 91.241218][ T7071] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.241230][ T7071] RSP: 002b:00007f13b88bb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 91.241241][ T7071] RAX: ffffffffffffffda RBX: 00007f13b7c25fa0 RCX: 00007f13b799e559 [ 91.241249][ T7071] RDX: 0000000000000084 RSI: 0000200000000a40 RDI: 0000000000000004 [ 91.241257][ T7071] RBP: 00007f13b7a35ad8 R08: 0000000000000000 R09: 0000000000000000 [ 91.241265][ T7071] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 91.241272][ T7071] R13: 00007f13b7c26038 R14: 00007f13b7c25fa0 R15: 00007ffe882c4698 [ 91.241289][ T7071] [ 91.496644][ T7096] jffs2: notice: (7096) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 91.638833][ T7103] fuse: Bad value for 'fd' [ 92.077917][ T7074] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 92.079407][ T7074] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 92.087133][ T7074] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 92.093771][ T7074] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 92.093822][ T7074] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 92.100295][ T7074] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 92.104249][ T7074] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 92.104495][ T7074] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 92.105865][ T7074] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 92.108559][ T7074] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 92.108616][ T7074] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 92.113625][ T7074] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 92.181420][ T7113] sysfs: cannot create duplicate filename '/class/ieee80211/1^!l1r$Gt:uJ˺' [ 92.181435][ T7113] CPU: 0 UID: 0 PID: 7113 Comm: syz.1.472 Not tainted syzkaller #0 PREEMPT(full) [ 92.181451][ T7113] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.181459][ T7113] Call Trace: [ 92.181464][ T7113] [ 92.181469][ T7113] dump_stack_lvl+0x100/0x190 [ 92.181492][ T7113] sysfs_warn_dup.cold+0x1c/0x28 [ 92.181511][ T7113] sysfs_do_create_link_sd+0x113/0x140 [ 92.181526][ T7113] sysfs_create_link+0x61/0xc0 [ 92.181539][ T7113] device_add+0x675/0x1970 [ 92.181556][ T7113] ? __pfx_device_add+0x10/0x10 [ 92.181569][ T7113] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 92.181587][ T7113] ? ieee80211_set_bitrate_flags+0x41b/0x6b0 [ 92.181625][ T7113] wiphy_register+0x2151/0x3110 [ 92.181651][ T7113] ? __pfx_wiphy_register+0x10/0x10 [ 92.181667][ T7113] ? __asan_memset+0x23/0x50 [ 92.181692][ T7113] ? minstrel_ht_alloc+0x5e6/0x7f0 [ 92.181716][ T7113] ieee80211_register_hw+0x3090/0x45c0 [ 92.181745][ T7113] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 92.181764][ T7113] ? __pfx___debug_object_init+0x10/0x10 [ 92.181779][ T7113] ? find_held_lock+0x2b/0x80 [ 92.181800][ T7113] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 92.181817][ T7113] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 92.181835][ T7113] ? __hrtimer_setup+0x208/0x330 [ 92.181854][ T7113] mac80211_hwsim_new_radio+0x2b08/0x6510 [ 92.181880][ T7113] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 92.181896][ T7113] ? __asan_memcpy+0x3c/0x60 [ 92.181912][ T7113] hwsim_new_radio_nl+0xc6b/0x13f0 [ 92.181926][ T7113] ? trace_kmalloc+0xeb/0x110 [ 92.181944][ T7113] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 92.181964][ T7113] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 92.181978][ T7113] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 92.181996][ T7113] genl_family_rcv_msg_doit+0x214/0x300 [ 92.182011][ T7113] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 92.182030][ T7113] ? bpf_lsm_capable+0x9/0x10 [ 92.182042][ T7113] ? security_capable+0x80/0x260 [ 92.182057][ T7113] ? ns_capable+0xd2/0xf0 [ 92.182072][ T7113] genl_rcv_msg+0x560/0x800 [ 92.182087][ T7113] ? __pfx_genl_rcv_msg+0x10/0x10 [ 92.182100][ T7113] ? __lock_acquire+0x5c0/0x1f40 [ 92.182114][ T7113] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 92.182135][ T7113] netlink_rcv_skb+0x159/0x420 [ 92.182147][ T7113] ? __pfx_genl_rcv_msg+0x10/0x10 [ 92.182161][ T7113] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 92.182179][ T7113] ? netlink_deliver_tap+0x1ae/0xcc0 [ 92.182200][ T7113] genl_rcv+0x28/0x40 [ 92.182212][ T7113] netlink_unicast+0x65f/0x950 [ 92.182225][ T7113] ? __pfx_netlink_unicast+0x10/0x10 [ 92.182242][ T7113] netlink_sendmsg+0x8b0/0xda0 [ 92.182256][ T7113] ? __pfx_netlink_sendmsg+0x10/0x10 [ 92.182269][ T7113] ? selinux_socket_sendmsg+0x198/0x2f0 [ 92.182289][ T7113] ____sys_sendmsg+0xa4d/0xbe0 [ 92.182304][ T7113] ? __pfx_netlink_sendmsg+0x10/0x10 [ 92.182317][ T7113] ? __pfx_____sys_sendmsg+0x10/0x10 [ 92.182340][ T7113] ___sys_sendmsg+0x190/0x1e0 [ 92.182357][ T7113] ? __pfx____sys_sendmsg+0x10/0x10 [ 92.182374][ T7113] ? futex_wait+0x11e/0x370 [ 92.182393][ T7113] ? find_held_lock+0x2b/0x80 [ 92.182422][ T7113] __sys_sendmsg+0x160/0x210 [ 92.182438][ T7113] ? __pfx___sys_sendmsg+0x10/0x10 [ 92.182472][ T7113] do_syscall_64+0x123/0x790 [ 92.182499][ T7113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.182511][ T7113] RIP: 0033:0x7fd4d179e559 [ 92.182523][ T7113] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.182534][ T7113] RSP: 002b:00007fd4d26e5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 92.182547][ T7113] RAX: ffffffffffffffda RBX: 00007fd4d1a25fa0 RCX: 00007fd4d179e559 [ 92.182555][ T7113] RDX: 0000000000000084 RSI: 0000200000000a40 RDI: 0000000000000003 [ 92.182563][ T7113] RBP: 00007fd4d1835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 92.182571][ T7113] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.182580][ T7113] R13: 00007fd4d1a26038 R14: 00007fd4d1a25fa0 R15: 00007ffce1c2c848 [ 92.182597][ T7113] [ 92.217405][ T7116] FAULT_INJECTION: forcing a failure. [ 92.217405][ T7116] name failslab, interval 1, probability 0, space 0, times 0 [ 92.217433][ T7116] CPU: 2 UID: 0 PID: 7116 Comm: syz.2.473 Not tainted syzkaller #0 PREEMPT(full) [ 92.217453][ T7116] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.217463][ T7116] Call Trace: [ 92.217469][ T7116] [ 92.217477][ T7116] dump_stack_lvl+0x100/0x190 [ 92.217507][ T7116] should_fail_ex.cold+0x5/0xa [ 92.217525][ T7116] should_failslab+0xc2/0x120 [ 92.217544][ T7116] kmem_cache_alloc_noprof+0x92/0x6a0 [ 92.217567][ T7116] ? do_getname+0x35/0x390 [ 92.217588][ T7116] do_getname+0x35/0x390 [ 92.217607][ T7116] do_faccessat+0x115/0xc10 [ 92.217636][ T7116] ? __pfx_do_faccessat+0x10/0x10 [ 92.217656][ T7116] ? ksys_write+0x1ac/0x250 [ 92.217676][ T7116] ? __pfx_ksys_write+0x10/0x10 [ 92.217700][ T7116] __x64_sys_faccessat+0x74/0xb0 [ 92.217714][ T7116] ? lockdep_hardirqs_on+0x7d/0x110 [ 92.217730][ T7116] do_syscall_64+0x123/0x790 [ 92.217748][ T7116] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.217759][ T7116] RIP: 0033:0x7f80b7b9e559 [ 92.217769][ T7116] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.217785][ T7116] RSP: 002b:00007f80b89ab028 EFLAGS: 00000246 ORIG_RAX: 000000000000010d [ 92.217803][ T7116] RAX: ffffffffffffffda RBX: 00007f80b7e25fa0 RCX: 00007f80b7b9e559 [ 92.217813][ T7116] RDX: 0000000000000007 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 92.217824][ T7116] RBP: 00007f80b89ab090 R08: 0000000000000000 R09: 0000000000000000 [ 92.217834][ T7116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 92.217844][ T7116] R13: 00007f80b7e26038 R14: 00007f80b7e25fa0 R15: 00007ffe18d35b18 [ 92.217867][ T7116] [ 92.344088][ T7129] ip_tables: iptables: counters copy to user failed while replacing table [ 92.403762][ T7133] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 92.495496][ T7147] FAULT_INJECTION: forcing a failure. [ 92.495496][ T7147] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 92.495516][ T7147] CPU: 2 UID: 0 PID: 7147 Comm: syz.0.484 Not tainted syzkaller #0 PREEMPT(full) [ 92.495528][ T7147] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.495535][ T7147] Call Trace: [ 92.495540][ T7147] [ 92.495545][ T7147] dump_stack_lvl+0x100/0x190 [ 92.495566][ T7147] should_fail_ex.cold+0x5/0xa [ 92.495583][ T7147] _copy_to_user+0x32/0xd0 [ 92.495601][ T7147] simple_read_from_buffer+0xcb/0x170 [ 92.495619][ T7147] proc_fail_nth_read+0x1af/0x230 [ 92.495637][ T7147] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 92.495655][ T7147] ? rw_verify_area+0xce/0x6d0 [ 92.495668][ T7147] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 92.495684][ T7147] vfs_read+0x1e4/0xb40 [ 92.495698][ T7147] ? lock_acquire+0x1d1/0x380 [ 92.495712][ T7147] ? __fget_files+0x34/0x3d0 [ 92.495727][ T7147] ? __pfx_vfs_read+0x10/0x10 [ 92.495739][ T7147] ? find_held_lock+0x2b/0x80 [ 92.495756][ T7147] ? __fget_files+0x215/0x3d0 [ 92.495774][ T7147] ? __fget_files+0x21f/0x3d0 [ 92.495794][ T7147] ksys_read+0x12a/0x250 [ 92.495807][ T7147] ? __pfx_ksys_read+0x10/0x10 [ 92.495819][ T7147] ? v4l2_ioctl+0x1c5/0x250 [ 92.495858][ T7147] do_syscall_64+0x123/0x790 [ 92.495877][ T7147] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.495889][ T7147] RIP: 0033:0x7f13b795ed8e [ 92.495898][ T7147] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 92.495925][ T7147] RSP: 002b:00007f13b88bafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 92.495938][ T7147] RAX: ffffffffffffffda RBX: 00007f13b88bb6c0 RCX: 00007f13b795ed8e [ 92.495945][ T7147] RDX: 000000000000000f RSI: 00007f13b88bb0a0 RDI: 0000000000000004 [ 92.495952][ T7147] RBP: 00007f13b88bb090 R08: 0000000000000000 R09: 0000000000000000 [ 92.495958][ T7147] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 92.495965][ T7147] R13: 00007f13b7c26038 R14: 00007f13b7c25fa0 R15: 00007ffe882c4698 [ 92.495980][ T7147] [ 92.503459][ T7148] fuse: Bad value for 'fd' [ 93.149229][ T7129] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 93.149420][ T7129] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 93.149570][ T7129] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 93.149710][ T7129] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 93.243537][ T7163] netlink: 'syz.3.487': attribute type 1 has an invalid length. [ 93.274377][ T7163] bond1: (slave bridge1): making interface the new active one [ 93.274874][ T7163] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 93.415525][ T7177] SELinux: Context system_u:object_r:inetd_var_run_t:s0 is not valid (left unmapped). [ 93.511282][ T7183] fuse: Bad value for 'fd' [ 93.518506][ T5718] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 93.648672][ T5718] usb 5-1: device descriptor read/64, error -71 [ 93.907445][ T5718] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 93.928880][ T5809] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 94.039414][ T5718] usb 5-1: device descriptor read/64, error -71 [ 94.079500][ T5809] usb 7-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 94.080574][ T5809] usb 7-1: config 1 has an invalid interface number: 7 but max is 0 [ 94.080594][ T5809] usb 7-1: config 1 has no interface number 0 [ 94.080628][ T5809] usb 7-1: config 1 interface 7 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 32 [ 94.083491][ T5809] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.083512][ T5809] usb 7-1: Product: syz [ 94.083526][ T5809] usb 7-1: Manufacturer: syz [ 94.083537][ T5809] usb 7-1: SerialNumber: syz [ 94.087734][ T7191] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 94.096264][ T5809] usb 7-1: Error in usbnet_get_endpoints (-22) [ 94.107801][ T7201] macvlan1: entered promiscuous mode [ 94.116926][ T7201] macvlan1: left promiscuous mode [ 94.147560][ T5718] usb usb5-port1: attempt power cycle [ 94.208308][ T7206] fuse: Unknown parameter '0x0000000000000003' [ 94.296598][ T5809] usb 7-1: USB disconnect, device number 9 [ 94.437253][ T5734] Bluetooth: hci1: command 0x0c1a tx timeout [ 94.490055][ T7213] Invalid logical block size (7) [ 94.500781][ T5718] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 94.519638][ T5718] usb 5-1: device descriptor read/8, error -71 [ 94.758338][ T5718] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 94.778187][ T5718] usb 5-1: device descriptor read/8, error -71 [ 94.801734][ T7218] FAULT_INJECTION: forcing a failure. [ 94.801734][ T7218] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 94.801780][ T7218] CPU: 2 UID: 0 PID: 7218 Comm: syz.1.511 Not tainted syzkaller #0 PREEMPT(full) [ 94.801799][ T7218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.801810][ T7218] Call Trace: [ 94.801826][ T7218] [ 94.801834][ T7218] dump_stack_lvl+0x100/0x190 [ 94.801909][ T7218] should_fail_ex.cold+0x5/0xa [ 94.801952][ T7218] _copy_to_user+0x32/0xd0 [ 94.801991][ T7218] bpf_vlog_reverse_ubuf+0x315/0x470 [ 94.802038][ T7218] bpf_vlog_finalize+0x20f/0x360 [ 94.802060][ T7218] bpf_log_attr_finalize+0x86/0x1a0 [ 94.802079][ T7218] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 94.802105][ T7218] btf_new_fd+0x712/0x38f0 [ 94.802125][ T7218] ? cred_has_capability.isra.0+0x186/0x300 [ 94.802153][ T7218] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 94.802186][ T7218] ? __pfx_btf_new_fd+0x10/0x10 [ 94.802202][ T7218] ? rcu_is_watching+0x13/0xc0 [ 94.802237][ T7218] ? cap_capable+0x107/0x430 [ 94.802260][ T7218] ? bpf_lsm_capable+0x9/0x10 [ 94.802276][ T7218] ? security_capable+0x80/0x260 [ 94.802298][ T7218] ? ns_capable+0xd2/0xf0 [ 94.802319][ T7218] __sys_bpf+0x13ef/0x4a30 [ 94.802338][ T7218] ? plist_check_list+0x1b8/0x280 [ 94.802371][ T7218] ? __pfx___sys_bpf+0x10/0x10 [ 94.802389][ T7218] ? find_held_lock+0x2b/0x80 [ 94.802416][ T7218] ? futex_wake+0x4ea/0x5e0 [ 94.802437][ T7218] ? futex_private_hash_put.part.0+0xdc/0x180 [ 94.802460][ T7218] ? futex_private_hash_put+0x24/0x30 [ 94.802489][ T7218] ? __pfx_futex_wake+0x10/0x10 [ 94.802510][ T7218] ? rcu_read_lock_any_held+0x6a/0x90 [ 94.802526][ T7218] ? find_held_lock+0x2b/0x80 [ 94.802549][ T7218] ? ksys_write+0x190/0x250 [ 94.802570][ T7218] ? ksys_write+0x190/0x250 [ 94.802603][ T7218] ? __x64_sys_futex+0x34f/0x4d0 [ 94.802626][ T7218] ? __x64_sys_futex+0x358/0x4d0 [ 94.802653][ T7218] ? xfd_validate_state+0x129/0x190 [ 94.802676][ T7218] ? __x64_sys_bpf+0xce/0x140 [ 94.802694][ T7218] __x64_sys_bpf+0xce/0x140 [ 94.802714][ T7218] ? do_syscall_64+0xae/0x790 [ 94.802738][ T7218] do_syscall_64+0x123/0x790 [ 94.802765][ T7218] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.802790][ T7218] RIP: 0033:0x7fd4d179e559 [ 94.802914][ T7218] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.802933][ T7218] RSP: 002b:00007fd4d26c4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 94.802964][ T7218] RAX: ffffffffffffffda RBX: 00007fd4d1a26090 RCX: 00007fd4d179e559 [ 94.802977][ T7218] RDX: 0000000000000028 RSI: 0000200000000200 RDI: 0000000000000012 [ 94.802988][ T7218] RBP: 00007fd4d1835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 94.802999][ T7218] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.803009][ T7218] R13: 00007fd4d1a26128 R14: 00007fd4d1a26090 R15: 00007ffce1c2c848 [ 94.803032][ T7218] [ 94.888315][ T5718] usb usb5-port1: unable to enumerate USB device [ 94.941074][ T7220] jffs2: notice: (7220) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 95.157298][ T5734] Bluetooth: hci3: command 0x0c1a tx timeout [ 95.157335][ T5734] Bluetooth: hci2: command 0x0c1a tx timeout [ 95.157351][ T5734] Bluetooth: hci0: command 0x0c13 tx timeout [ 95.686029][ T7232] netlink: NAT attribute has 8 unknown bytes [ 95.686059][ T7232] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 95.742092][ T7236] fuse: Unknown parameter '0x0000000000000003' [ 95.940857][ T7242] FAULT_INJECTION: forcing a failure. [ 95.940857][ T7242] name failslab, interval 1, probability 0, space 0, times 0 [ 95.940887][ T7242] CPU: 2 UID: 0 PID: 7242 Comm: syz.1.518 Not tainted syzkaller #0 PREEMPT(full) [ 95.940908][ T7242] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.940918][ T7242] Call Trace: [ 95.940925][ T7242] [ 95.940933][ T7242] dump_stack_lvl+0x100/0x190 [ 95.940965][ T7242] should_fail_ex.cold+0x5/0xa [ 95.940992][ T7242] should_failslab+0xc2/0x120 [ 95.941056][ T7242] __kmalloc_noprof+0xfc/0x840 [ 95.941080][ T7242] ? rcu_is_watching+0x13/0xc0 [ 95.941108][ T7242] ? tomoyo_realpath_from_path+0xb6/0x690 [ 95.941133][ T7242] tomoyo_realpath_from_path+0xb6/0x690 [ 95.941157][ T7242] tomoyo_path_number_perm+0x23c/0x580 [ 95.941181][ T7242] ? tomoyo_path_number_perm+0x22e/0x580 [ 95.941208][ T7242] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 95.941244][ T7242] ? __lock_acquire+0x5c0/0x1f40 [ 95.941279][ T7242] ? __fget_files+0x34/0x3d0 [ 95.941307][ T7242] ? find_held_lock+0x2b/0x80 [ 95.941333][ T7242] ? hook_file_ioctl_common+0x140/0x440 [ 95.941361][ T7242] ? __fget_files+0x21f/0x3d0 [ 95.941391][ T7242] security_file_ioctl+0xd3/0x230 [ 95.941418][ T7242] __x64_sys_ioctl+0xb7/0x210 [ 95.941444][ T7242] do_syscall_64+0x123/0x790 [ 95.941474][ T7242] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.941493][ T7242] RIP: 0033:0x7fd4d179e559 [ 95.941509][ T7242] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.941527][ T7242] RSP: 002b:00007fd4d26e5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.941546][ T7242] RAX: ffffffffffffffda RBX: 00007fd4d1a25fa0 RCX: 00007fd4d179e559 [ 95.941558][ T7242] RDX: 0000200000000540 RSI: 00000000c02c563a RDI: 0000000000000003 [ 95.941569][ T7242] RBP: 00007fd4d26e5090 R08: 0000000000000000 R09: 0000000000000000 [ 95.941581][ T7242] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 95.941592][ T7242] R13: 00007fd4d1a26038 R14: 00007fd4d1a25fa0 R15: 00007ffce1c2c848 [ 95.941619][ T7242] [ 95.941627][ T7242] ERROR: Out of memory at tomoyo_realpath_from_path. [ 96.003493][ T7246] FAULT_INJECTION: forcing a failure. [ 96.003493][ T7246] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 96.003520][ T7246] CPU: 2 UID: 0 PID: 7246 Comm: syz.1.520 Not tainted syzkaller #0 PREEMPT(full) [ 96.003539][ T7246] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.003550][ T7246] Call Trace: [ 96.003557][ T7246] [ 96.003565][ T7246] dump_stack_lvl+0x100/0x190 [ 96.003596][ T7246] should_fail_ex.cold+0x5/0xa [ 96.003622][ T7246] _copy_from_user+0x2e/0xd0 [ 96.003648][ T7246] __sys_bpf+0x2f5/0x4a30 [ 96.003677][ T7246] ? __pfx___sys_bpf+0x10/0x10 [ 96.003697][ T7246] ? find_held_lock+0x2b/0x80 [ 96.003722][ T7246] ? get_pid_task+0xfc/0x250 [ 96.003747][ T7246] ? get_pid_task+0xfc/0x250 [ 96.003780][ T7246] ? find_held_lock+0x2b/0x80 [ 96.003812][ T7246] ? rcu_read_lock_any_held+0x6a/0x90 [ 96.003829][ T7246] ? find_held_lock+0x2b/0x80 [ 96.003854][ T7246] ? ksys_write+0x190/0x250 [ 96.003875][ T7246] ? ksys_write+0x190/0x250 [ 96.003897][ T7246] ? lock_acquire+0x1d1/0x380 [ 96.003935][ T7246] ? fput+0x7c/0x100 [ 96.003961][ T7246] ? ksys_write+0x1ac/0x250 [ 96.003986][ T7246] ? __x64_sys_bpf+0xce/0x140 [ 96.004005][ T7246] __x64_sys_bpf+0xce/0x140 [ 96.004026][ T7246] ? do_syscall_64+0xae/0x790 [ 96.004054][ T7246] do_syscall_64+0x123/0x790 [ 96.004083][ T7246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.004102][ T7246] RIP: 0033:0x7fd4d179e559 [ 96.004118][ T7246] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.004180][ T7246] RSP: 002b:00007fd4d26e5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 96.004197][ T7246] RAX: ffffffffffffffda RBX: 00007fd4d1a25fa0 RCX: 00007fd4d179e559 [ 96.004208][ T7246] RDX: 0000000000000050 RSI: 00002000000008c0 RDI: 000000000000000a [ 96.004219][ T7246] RBP: 00007fd4d26e5090 R08: 0000000000000000 R09: 0000000000000000 [ 96.004229][ T7246] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 96.004239][ T7246] R13: 00007fd4d1a26038 R14: 00007fd4d1a25fa0 R15: 00007ffce1c2c848 [ 96.004264][ T7246] [ 96.092399][ T42] kauditd_printk_skb: 52 callbacks suppressed [ 96.092416][ T42] audit: type=1400 audit(1792415982.180:464): avc: denied { create } for pid=7248 comm="syz.3.522" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 96.112629][ T7254] jffs2: notice: (7254) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 96.115766][ T42] audit: type=1400 audit(1792415982.200:465): avc: denied { write } for pid=7247 comm="syz.1.521" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 96.340827][ T42] audit: type=1400 audit(1792415982.430:466): avc: denied { mount } for pid=7264 comm="syz.1.526" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 96.350728][ T42] audit: type=1400 audit(1792415982.440:467): avc: denied { mounton } for pid=7264 comm="syz.1.526" path="/144/file1" dev="tmpfs" ino=788 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 96.391272][ T42] audit: type=1400 audit(1792415982.480:468): avc: denied { create } for pid=7268 comm="syz.0.528" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 96.393128][ T42] audit: type=1400 audit(1792415982.480:469): avc: denied { bind } for pid=7268 comm="syz.0.528" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 96.394720][ T42] audit: type=1400 audit(1792415982.480:470): avc: denied { listen } for pid=7268 comm="syz.0.528" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 96.394995][ T42] audit: type=1400 audit(1792415982.480:471): avc: denied { connect } for pid=7268 comm="syz.0.528" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 96.517153][ T5734] Bluetooth: hci1: command 0x0c1a tx timeout [ 96.736758][ T1349] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 96.774439][ T7285] jffs2: notice: (7285) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 96.777379][ T42] audit: type=1400 audit(1792415982.860:472): avc: denied { write } for pid=7284 comm="syz.2.533" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 96.867612][ T7290] tipc: MTU too low for tipc bearer [ 96.949840][ T7293] sg_write: data in/out 8156/120 bytes for SCSI command 0x0-- guessing data in; [ 96.949840][ T7293] program syz.2.536 not setting count and/or reply_len properly [ 96.999840][ T1349] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 97.138321][ T7297] sg_write: data in/out 8156/120 bytes for SCSI command 0x0-- guessing data in; [ 97.138321][ T7297] program syz.3.538 not setting count and/or reply_len properly [ 97.237178][ T5742] Bluetooth: hci0: command 0x0c13 tx timeout [ 97.237327][ T5742] Bluetooth: hci3: command 0x0c1a tx timeout [ 97.237464][ T5734] Bluetooth: hci2: command 0x0c1a tx timeout [ 97.517890][ T1349] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 97.558035][ T7281] ceph: No mds server is up or the cluster is laggy [ 97.591365][ T42] audit: type=1400 audit(1792415983.680:473): avc: denied { block_suspend } for pid=7306 comm="syz.2.541" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 97.606813][ T1174] IPVS: starting estimator thread 0... [ 97.620104][ T7307] can0: slcan on ttyS3. [ 97.698897][ T7312] FAULT_INJECTION: forcing a failure. [ 97.698897][ T7312] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 97.698928][ T7312] CPU: 2 UID: 0 PID: 7312 Comm: syz.0.542 Not tainted syzkaller #0 PREEMPT(full) [ 97.698949][ T7312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.698959][ T7312] Call Trace: [ 97.698978][ T7312] [ 97.698988][ T7312] dump_stack_lvl+0x100/0x190 [ 97.699085][ T7312] should_fail_ex.cold+0x5/0xa [ 97.699123][ T7312] _copy_to_user+0x32/0xd0 [ 97.699161][ T7312] bpf_vlog_reverse_ubuf+0x2c3/0x470 [ 97.699207][ T7312] bpf_vlog_finalize+0x20f/0x360 [ 97.699229][ T7312] bpf_log_attr_finalize+0x86/0x1a0 [ 97.699251][ T7312] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 97.699279][ T7312] btf_new_fd+0x712/0x38f0 [ 97.699302][ T7312] ? cred_has_capability.isra.0+0x186/0x300 [ 97.699330][ T7312] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 97.699362][ T7312] ? __pfx_btf_new_fd+0x10/0x10 [ 97.699378][ T7312] ? rcu_is_watching+0x13/0xc0 [ 97.699415][ T7312] ? cap_capable+0x107/0x430 [ 97.699440][ T7312] ? bpf_lsm_capable+0x9/0x10 [ 97.699460][ T7312] ? security_capable+0x80/0x260 [ 97.699486][ T7312] ? ns_capable+0xd2/0xf0 [ 97.699508][ T7312] __sys_bpf+0x13ef/0x4a30 [ 97.699537][ T7312] ? __pfx___sys_bpf+0x10/0x10 [ 97.699554][ T7312] ? find_held_lock+0x2b/0x80 [ 97.699580][ T7312] ? futex_wake+0x4ea/0x5e0 [ 97.699616][ T7312] ? rcu_read_lock_any_held+0x6a/0x90 [ 97.699633][ T7312] ? find_held_lock+0x2b/0x80 [ 97.699659][ T7312] ? ksys_write+0x190/0x250 [ 97.699680][ T7312] ? ksys_write+0x190/0x250 [ 97.699718][ T7312] ? __x64_sys_futex+0x34f/0x4d0 [ 97.699743][ T7312] ? __x64_sys_futex+0x358/0x4d0 [ 97.699775][ T7312] ? xfd_validate_state+0x129/0x190 [ 97.699801][ T7312] ? __x64_sys_bpf+0xce/0x140 [ 97.699821][ T7312] __x64_sys_bpf+0xce/0x140 [ 97.699844][ T7312] ? do_syscall_64+0xae/0x790 [ 97.699878][ T7312] do_syscall_64+0x123/0x790 [ 97.699909][ T7312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.699929][ T7312] RIP: 0033:0x7f13b799e559 [ 97.699944][ T7312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.699961][ T7312] RSP: 002b:00007f13b889a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 97.699993][ T7312] RAX: ffffffffffffffda RBX: 00007f13b7c26090 RCX: 00007f13b799e559 [ 97.700006][ T7312] RDX: 0000000000000028 RSI: 0000200000000200 RDI: 0000000000000012 [ 97.700018][ T7312] RBP: 00007f13b7a35ad8 R08: 0000000000000000 R09: 0000000000000000 [ 97.700030][ T7312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.700043][ T7312] R13: 00007f13b7c26128 R14: 00007f13b7c26090 R15: 00007ffe882c4698 [ 97.700070][ T7312] [ 97.713350][ T7308] IPVS: using max 29 ests per chain, 69600 per kthread [ 98.478153][ T7307] can0 (unregistered): slcan off ttyS3. [ 98.503964][ T7316] fuse: Unknown parameter '0x0000000000000003' [ 98.562629][ T7319] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 98.597206][ T5734] Bluetooth: hci1: command 0x0c1a tx timeout [ 98.614927][ T7325] kernel profiling enabled (shift: 0) [ 98.725499][ T7335] jffs2: notice: (7335) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 98.806841][ T7340] FAULT_INJECTION: forcing a failure. [ 98.806841][ T7340] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 98.806863][ T7340] CPU: 3 UID: 0 PID: 7340 Comm: syz.0.552 Not tainted syzkaller #0 PREEMPT(full) [ 98.806875][ T7340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.806882][ T7340] Call Trace: [ 98.806887][ T7340] [ 98.806891][ T7340] dump_stack_lvl+0x100/0x190 [ 98.806913][ T7340] should_fail_ex.cold+0x5/0xa [ 98.806929][ T7340] _copy_to_user+0x32/0xd0 [ 98.806948][ T7340] bpf_vlog_reverse_ubuf+0x315/0x470 [ 98.806966][ T7340] bpf_vlog_finalize+0x20f/0x360 [ 98.806979][ T7340] bpf_log_attr_finalize+0x86/0x1a0 [ 98.806993][ T7340] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 98.807026][ T7340] btf_new_fd+0x712/0x38f0 [ 98.807041][ T7340] ? cred_has_capability.isra.0+0x186/0x300 [ 98.807061][ T7340] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 98.807084][ T7340] ? __pfx_btf_new_fd+0x10/0x10 [ 98.807095][ T7340] ? rcu_is_watching+0x13/0xc0 [ 98.807111][ T7340] ? cap_capable+0x107/0x430 [ 98.807126][ T7340] ? bpf_lsm_capable+0x9/0x10 [ 98.807137][ T7340] ? security_capable+0x80/0x260 [ 98.807154][ T7340] ? ns_capable+0xd2/0xf0 [ 98.807167][ T7340] __sys_bpf+0x13ef/0x4a30 [ 98.807180][ T7340] ? plist_check_list+0x1b8/0x280 [ 98.807197][ T7340] ? __pfx___sys_bpf+0x10/0x10 [ 98.807209][ T7340] ? find_held_lock+0x2b/0x80 [ 98.807225][ T7340] ? futex_wake+0x4ea/0x5e0 [ 98.807238][ T7340] ? futex_private_hash_put.part.0+0xdc/0x180 [ 98.807254][ T7340] ? futex_private_hash_put+0x24/0x30 [ 98.807272][ T7340] ? __pfx_futex_wake+0x10/0x10 [ 98.807286][ T7340] ? rcu_read_lock_any_held+0x6a/0x90 [ 98.807297][ T7340] ? find_held_lock+0x2b/0x80 [ 98.807314][ T7340] ? ksys_write+0x190/0x250 [ 98.807327][ T7340] ? ksys_write+0x190/0x250 [ 98.807350][ T7340] ? __x64_sys_futex+0x34f/0x4d0 [ 98.807365][ T7340] ? __x64_sys_futex+0x358/0x4d0 [ 98.807383][ T7340] ? xfd_validate_state+0x129/0x190 [ 98.807398][ T7340] ? __x64_sys_bpf+0xce/0x140 [ 98.807410][ T7340] __x64_sys_bpf+0xce/0x140 [ 98.807423][ T7340] ? do_syscall_64+0xae/0x790 [ 98.807440][ T7340] do_syscall_64+0x123/0x790 [ 98.807457][ T7340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.807469][ T7340] RIP: 0033:0x7f13b799e559 [ 98.807479][ T7340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.807490][ T7340] RSP: 002b:00007f13b889a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 98.807502][ T7340] RAX: ffffffffffffffda RBX: 00007f13b7c26090 RCX: 00007f13b799e559 [ 98.807509][ T7340] RDX: 0000000000000028 RSI: 0000200000000200 RDI: 0000000000000012 [ 98.807516][ T7340] RBP: 00007f13b7a35ad8 R08: 0000000000000000 R09: 0000000000000000 [ 98.807522][ T7340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.807529][ T7340] R13: 00007f13b7c26128 R14: 00007f13b7c26090 R15: 00007ffe882c4698 [ 98.807544][ T7340] [ 98.900918][ T7344] fuse: Unknown parameter '0x0000000000000003' [ 99.317129][ T5732] Bluetooth: hci0: command 0x0c13 tx timeout [ 99.317164][ T5742] Bluetooth: hci3: command 0x0c1a tx timeout [ 99.317185][ T5734] Bluetooth: hci2: command 0x0c1a tx timeout [ 99.698468][ T7358] jffs2: notice: (7358) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 99.708088][ T7362] RDS: rds_bind could not find a transport for ::ffff:172.30.1.4, load rds_tcp or rds_rdma? [ 99.779519][ T7367] FAULT_INJECTION: forcing a failure. [ 99.779519][ T7367] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 99.779550][ T7367] CPU: 1 UID: 0 PID: 7367 Comm: syz.0.563 Not tainted syzkaller #0 PREEMPT(full) [ 99.779573][ T7367] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 99.779585][ T7367] Call Trace: [ 99.779591][ T7367] [ 99.779600][ T7367] dump_stack_lvl+0x100/0x190 [ 99.779634][ T7367] should_fail_ex.cold+0x5/0xa [ 99.779662][ T7367] _copy_to_user+0x32/0xd0 [ 99.779693][ T7367] bpf_vlog_reverse_ubuf+0x2c3/0x470 [ 99.779724][ T7367] bpf_vlog_finalize+0x20f/0x360 [ 99.779748][ T7367] bpf_log_attr_finalize+0x86/0x1a0 [ 99.779769][ T7367] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 99.779800][ T7367] btf_new_fd+0x712/0x38f0 [ 99.779822][ T7367] ? cred_has_capability.isra.0+0x186/0x300 [ 99.779852][ T7367] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 99.779890][ T7367] ? __pfx_btf_new_fd+0x10/0x10 [ 99.779908][ T7367] ? rcu_is_watching+0x13/0xc0 [ 99.779937][ T7367] ? cap_capable+0x107/0x430 [ 99.779964][ T7367] ? bpf_lsm_capable+0x9/0x10 [ 99.779983][ T7367] ? security_capable+0x80/0x260 [ 99.780008][ T7367] ? ns_capable+0xd2/0xf0 [ 99.780033][ T7367] __sys_bpf+0x13ef/0x4a30 [ 99.780063][ T7367] ? __pfx___sys_bpf+0x10/0x10 [ 99.780083][ T7367] ? find_held_lock+0x2b/0x80 [ 99.780112][ T7367] ? futex_wake+0x4ea/0x5e0 [ 99.780161][ T7367] ? rcu_read_lock_any_held+0x6a/0x90 [ 99.780181][ T7367] ? find_held_lock+0x2b/0x80 [ 99.780210][ T7367] ? ksys_write+0x190/0x250 [ 99.780236][ T7367] ? ksys_write+0x190/0x250 [ 99.780279][ T7367] ? __x64_sys_futex+0x34f/0x4d0 [ 99.780308][ T7367] ? __x64_sys_futex+0x358/0x4d0 [ 99.780339][ T7367] ? xfd_validate_state+0x129/0x190 [ 99.780365][ T7367] ? __x64_sys_bpf+0xce/0x140 [ 99.780386][ T7367] __x64_sys_bpf+0xce/0x140 [ 99.780408][ T7367] ? do_syscall_64+0xae/0x790 [ 99.780439][ T7367] do_syscall_64+0x123/0x790 [ 99.780465][ T7367] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.780485][ T7367] RIP: 0033:0x7f13b799e559 [ 99.780500][ T7367] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.780517][ T7367] RSP: 002b:00007f13b889a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 99.780537][ T7367] RAX: ffffffffffffffda RBX: 00007f13b7c26090 RCX: 00007f13b799e559 [ 99.780550][ T7367] RDX: 0000000000000028 RSI: 0000200000000200 RDI: 0000000000000012 [ 99.780561][ T7367] RBP: 00007f13b7a35ad8 R08: 0000000000000000 R09: 0000000000000000 [ 99.780572][ T7367] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 99.780584][ T7367] R13: 00007f13b7c26128 R14: 00007f13b7c26090 R15: 00007ffe882c4698 [ 99.780606][ T7367] [ 100.621689][ T7378] jffs2: notice: (7378) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 100.630728][ T7382] faux_driver vgem: [drm] Unknown color mode 6; guessing buffer size. [ 100.685747][ T7387] FAULT_INJECTION: forcing a failure. [ 100.685747][ T7387] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 100.685776][ T7387] CPU: 2 UID: 0 PID: 7387 Comm: syz.3.573 Not tainted syzkaller #0 PREEMPT(full) [ 100.685796][ T7387] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 100.685806][ T7387] Call Trace: [ 100.685812][ T7387] [ 100.685820][ T7387] dump_stack_lvl+0x100/0x190 [ 100.685849][ T7387] should_fail_ex.cold+0x5/0xa [ 100.685873][ T7387] _copy_from_user+0x2e/0xd0 [ 100.685899][ T7387] copy_msghdr_from_user+0x9f/0x4c0 [ 100.685939][ T7387] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 100.685968][ T7387] ? lock_acquire+0x1d1/0x380 [ 100.685988][ T7387] ? get_pid_task+0x2a/0x250 [ 100.686013][ T7387] ___sys_sendmsg+0x106/0x1e0 [ 100.686038][ T7387] ? __pfx____sys_sendmsg+0x10/0x10 [ 100.686060][ T7387] ? get_pid_task+0x106/0x250 [ 100.686091][ T7387] ? find_held_lock+0x2b/0x80 [ 100.686130][ T7387] __sys_sendmsg+0x160/0x210 [ 100.686150][ T7387] ? __pfx___sys_sendmsg+0x10/0x10 [ 100.686181][ T7387] do_syscall_64+0x123/0x790 [ 100.686208][ T7387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.686226][ T7387] RIP: 0033:0x7f2a1739e559 [ 100.686241][ T7387] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 100.686257][ T7387] RSP: 002b:00007f2a182f7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 100.686274][ T7387] RAX: ffffffffffffffda RBX: 00007f2a17625fa0 RCX: 00007f2a1739e559 [ 100.686285][ T7387] RDX: 0000000000004000 RSI: 0000200000000e40 RDI: 0000000000000003 [ 100.686295][ T7387] RBP: 00007f2a182f7090 R08: 0000000000000000 R09: 0000000000000000 [ 100.686305][ T7387] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 100.686316][ T7387] R13: 00007f2a17626038 R14: 00007f2a17625fa0 R15: 00007fffef212138 [ 100.686339][ T7387] [ 100.733894][ T7390] batadv_slave_0: Caught tx_queue_len zero misconfig [ 100.779708][ T7395] netlink: 'syz.3.577': attribute type 1 has an invalid length. [ 100.810038][ T7395] syzkaller0: entered promiscuous mode [ 100.810053][ T7395] syzkaller0: entered allmulticast mode [ 100.860053][ T1349] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 100.946798][ T7402] netlink: 132 bytes leftover after parsing attributes in process `syz.3.579'. [ 100.951644][ T7402] bridge0: port 3(syz_tun) entered blocking state [ 100.951734][ T7402] bridge0: port 3(syz_tun) entered disabled state [ 100.951833][ T7402] syz_tun: entered allmulticast mode [ 100.952661][ T7402] syz_tun: entered promiscuous mode [ 100.953028][ T7402] bridge0: port 3(syz_tun) entered blocking state [ 100.953091][ T7402] bridge0: port 3(syz_tun) entered forwarding state [ 101.017676][ T1349] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 101.020956][ T1349] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.020987][ T1349] usb 5-1: Product: syz [ 101.020997][ T1349] usb 5-1: Manufacturer: syz [ 101.021004][ T1349] usb 5-1: SerialNumber: syz [ 101.045911][ T7409] netlink: 108 bytes leftover after parsing attributes in process `syz.1.581'. [ 101.048545][ T7409] netlink: 108 bytes leftover after parsing attributes in process `syz.1.581'. [ 101.048575][ T7409] netlink: 84 bytes leftover after parsing attributes in process `syz.1.581'. [ 101.058195][ T7411] netlink: 'syz.3.583': attribute type 1 has an invalid length. [ 101.082551][ T7411] 8021q: adding VLAN 0 to HW filter on device bond3 [ 101.098467][ T7411] bond3: (slave macvlan0): Enslaving as a backup interface with an up link [ 101.206736][ T42] kauditd_printk_skb: 11 callbacks suppressed [ 101.206748][ T42] audit: type=1400 audit(1792415987.290:485): avc: denied { write } for pid=7419 comm="syz.1.586" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 101.230897][ T1349] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 101.230933][ T1349] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 101.230948][ T1349] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 101.235472][ T1349] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 101.247205][ T1349] usb 5-1: USB disconnect, device number 21 [ 101.258658][ T42] audit: type=1400 audit(1792415987.350:486): avc: denied { mount } for pid=7422 comm="syz.1.587" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 101.259112][ T42] audit: type=1400 audit(1792415987.350:487): avc: denied { search } for pid=7422 comm="syz.1.587" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 101.259236][ T42] audit: type=1400 audit(1792415987.350:488): avc: denied { read write } for pid=7422 comm="syz.1.587" name="filehandle" dev="nfsd" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 101.259403][ T42] audit: type=1400 audit(1792415987.350:489): avc: denied { open } for pid=7422 comm="syz.1.587" path="/151/nfsd/filehandle" dev="nfsd" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 101.397467][ T42] audit: type=1400 audit(1792415987.490:490): avc: denied { unmount } for pid=5728 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 101.429901][ T42] audit: type=1400 audit(1792415987.520:491): avc: denied { mount } for pid=7429 comm="syz.1.589" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 101.450472][ T42] audit: type=1400 audit(1792415987.540:492): avc: denied { name_connect } for pid=7431 comm="syz.2.590" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 101.454283][ T7432] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=586 sclass=netlink_route_socket pid=7432 comm=syz.2.590 [ 101.496281][ T7435] kvm: emulating exchange as write [ 101.498248][ T7435] Cannot find del_set index 4 as target [ 101.534284][ T42] audit: type=1400 audit(1792415987.620:493): avc: denied { read } for pid=7429 comm="syz.1.589" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 101.560652][ T42] audit: type=1400 audit(1792415987.650:494): avc: denied { unmount } for pid=5728 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 101.600524][ T7446] FAULT_INJECTION: forcing a failure. [ 101.600524][ T7446] name failslab, interval 1, probability 0, space 0, times 0 [ 101.600556][ T7446] CPU: 2 UID: 0 PID: 7446 Comm: syz.1.593 Not tainted syzkaller #0 PREEMPT(full) [ 101.600579][ T7446] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.600591][ T7446] Call Trace: [ 101.600598][ T7446] [ 101.600607][ T7446] dump_stack_lvl+0x100/0x190 [ 101.600667][ T7446] should_fail_ex.cold+0x5/0xa [ 101.600706][ T7446] should_failslab+0xc2/0x120 [ 101.600744][ T7446] __kmalloc_noprof+0xfc/0x840 [ 101.600771][ T7446] ? __kasan_kmalloc+0xaa/0xb0 [ 101.600798][ T7446] ? nla_strdup+0xc3/0x150 [ 101.600858][ T7446] nla_strdup+0xc3/0x150 [ 101.600883][ T7446] nf_tables_newtable+0xd9c/0x1a90 [ 101.600935][ T7446] ? __pfx_nf_tables_newtable+0x10/0x10 [ 101.600960][ T7446] ? net_generic+0x25/0x2a0 [ 101.601029][ T7446] ? __nla_parse+0x40/0x60 [ 101.601060][ T7446] nfnetlink_rcv_batch+0x1410/0x2880 [ 101.601101][ T7446] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 101.601131][ T7446] ? lock_acquire+0x1d1/0x380 [ 101.601169][ T7446] ? avc_has_perm_noaudit+0x56/0x470 [ 101.601210][ T7446] ? avc_has_perm_noaudit+0x145/0x470 [ 101.601261][ T7446] ? __nla_parse+0x40/0x60 [ 101.601289][ T7446] nfnetlink_rcv+0x3bd/0x440 [ 101.601314][ T7446] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 101.601346][ T7446] netlink_unicast+0x65f/0x950 [ 101.601370][ T7446] ? __pfx_netlink_unicast+0x10/0x10 [ 101.601397][ T7446] netlink_sendmsg+0x8b0/0xda0 [ 101.601420][ T7446] ? __pfx_netlink_sendmsg+0x10/0x10 [ 101.601442][ T7446] ? selinux_socket_sendmsg+0x198/0x2f0 [ 101.601475][ T7446] ____sys_sendmsg+0xa4d/0xbe0 [ 101.601511][ T7446] ? __pfx_netlink_sendmsg+0x10/0x10 [ 101.601536][ T7446] ? __pfx_____sys_sendmsg+0x10/0x10 [ 101.601578][ T7446] ___sys_sendmsg+0x190/0x1e0 [ 101.601609][ T7446] ? __pfx____sys_sendmsg+0x10/0x10 [ 101.601639][ T7446] ? futex_wait+0x11e/0x370 [ 101.601672][ T7446] ? find_held_lock+0x2b/0x80 [ 101.601721][ T7446] __sys_sendmsg+0x160/0x210 [ 101.601744][ T7446] ? __pfx___sys_sendmsg+0x10/0x10 [ 101.601782][ T7446] do_syscall_64+0x123/0x790 [ 101.601827][ T7446] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.601850][ T7446] RIP: 0033:0x7fd4d179e559 [ 101.601869][ T7446] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.601889][ T7446] RSP: 002b:00007fd4d26e5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 101.601919][ T7446] RAX: ffffffffffffffda RBX: 00007fd4d1a25fa0 RCX: 00007fd4d179e559 [ 101.601933][ T7446] RDX: 0000000020050800 RSI: 00002000000000c0 RDI: 0000000000000005 [ 101.601947][ T7446] RBP: 00007fd4d1835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 101.601960][ T7446] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.601973][ T7446] R13: 00007fd4d1a26038 R14: 00007fd4d1a25fa0 R15: 00007ffce1c2c848 [ 101.602003][ T7446] [ 101.740771][ T7453] bond0: (slave bond_slave_1): Releasing backup interface [ 101.744423][ T7453] team0: Port device team_slave_0 removed [ 101.749967][ T7453] team0: Port device team_slave_1 removed [ 101.751443][ T7453] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 101.752664][ T7453] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 101.755578][ T7453] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 101.756891][ T7453] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 101.761503][ T7453] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 101.770501][ T7454] netlink: 40 bytes leftover after parsing attributes in process `syz.3.595'. [ 101.771225][ T7454] Zero length message leads to an empty skb [ 101.772612][ T7454] netlink: 'syz.3.595': attribute type 63 has an invalid length. [ 101.772623][ T7454] netlink: 5 bytes leftover after parsing attributes in process `syz.3.595'. [ 101.889262][ T7466] netlink: 12 bytes leftover after parsing attributes in process `syz.0.598'. [ 101.928422][ T851] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 102.087244][ T851] usb 7-1: Using ep0 maxpacket: 8 [ 102.088017][ T851] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 102.088950][ T851] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 102.088997][ T851] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 102.089016][ T851] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 102.089034][ T851] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 102.089064][ T851] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.298044][ T851] usb 7-1: GET_CAPABILITIES returned 0 [ 102.298195][ T851] usbtmc 7-1:16.0: can't read capabilities [ 102.541841][ T5842] usb 7-1: USB disconnect, device number 10 [ 102.554630][ T7496] fuse: Unknown parameter 'fd0x0000000000000003' [ 102.564861][ T5734] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 102.742785][ T7502] Bluetooth: (null): Too short H5 packet [ 102.743897][ T7502] tipc: Started in network mode [ 102.743912][ T7502] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 102.743936][ T7502] tipc: Enabling of bearer rejected, failed to enable media [ 102.833700][ T7507] CIFS: enabling forcegid mount option implicitly because gid= option is specified [ 102.833712][ T7507] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 102.833863][ T7507] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 102.851284][ T7508] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=586 sclass=netlink_route_socket pid=7508 comm=syz.3.613 [ 102.914288][ T7516] fuse: Unknown parameter 'fd0x0000000000000003' [ 103.175566][ T7540] SELinux: Context #! ./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 103.199280][ T7542] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=586 sclass=netlink_route_socket pid=7542 comm=syz.1.625 [ 103.203441][ T7536] /dev/sr0: Can't open blockdev [ 103.246180][ T7536] openvswitch: netlink: IP tunnel TTL not specified. [ 103.308257][ T7552] netlink: 92 bytes leftover after parsing attributes in process `syz.1.627'. [ 103.320117][ T7550] FAULT_INJECTION: forcing a failure. [ 103.320117][ T7550] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 103.320136][ T7550] CPU: 3 UID: 0 PID: 7550 Comm: syz.3.626 Not tainted syzkaller #0 PREEMPT(full) [ 103.320149][ T7550] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.320156][ T7550] Call Trace: [ 103.320160][ T7550] [ 103.320165][ T7550] dump_stack_lvl+0x100/0x190 [ 103.320188][ T7550] should_fail_ex.cold+0x5/0xa [ 103.320205][ T7550] _copy_to_user+0x32/0xd0 [ 103.320226][ T7550] bpf_vlog_reverse_ubuf+0x2c3/0x470 [ 103.320244][ T7550] bpf_vlog_finalize+0x20f/0x360 [ 103.320257][ T7550] bpf_log_attr_finalize+0x86/0x1a0 [ 103.320270][ T7550] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 103.320287][ T7550] btf_new_fd+0x712/0x38f0 [ 103.320300][ T7550] ? cred_has_capability.isra.0+0x186/0x300 [ 103.320319][ T7550] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 103.320343][ T7550] ? __pfx_btf_new_fd+0x10/0x10 [ 103.320357][ T7550] ? rcu_is_watching+0x13/0xc0 [ 103.320382][ T7550] ? cap_capable+0x107/0x430 [ 103.320408][ T7550] ? bpf_lsm_capable+0x9/0x10 [ 103.320425][ T7550] ? security_capable+0x80/0x260 [ 103.320451][ T7550] ? ns_capable+0xd2/0xf0 [ 103.320474][ T7550] __sys_bpf+0x13ef/0x4a30 [ 103.320498][ T7550] ? __pfx___sys_bpf+0x10/0x10 [ 103.320509][ T7550] ? find_held_lock+0x2b/0x80 [ 103.320526][ T7550] ? futex_wake+0x4ea/0x5e0 [ 103.320549][ T7550] ? rcu_read_lock_any_held+0x6a/0x90 [ 103.320559][ T7550] ? find_held_lock+0x2b/0x80 [ 103.320575][ T7550] ? ksys_write+0x190/0x250 [ 103.320589][ T7550] ? ksys_write+0x190/0x250 [ 103.320611][ T7550] ? __x64_sys_futex+0x34f/0x4d0 [ 103.320627][ T7550] ? __x64_sys_futex+0x358/0x4d0 [ 103.320645][ T7550] ? xfd_validate_state+0x129/0x190 [ 103.320660][ T7550] ? __x64_sys_bpf+0xce/0x140 [ 103.320671][ T7550] __x64_sys_bpf+0xce/0x140 [ 103.320684][ T7550] ? do_syscall_64+0xae/0x790 [ 103.320702][ T7550] do_syscall_64+0x123/0x790 [ 103.320719][ T7550] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.320731][ T7550] RIP: 0033:0x7f2a1739e559 [ 103.320741][ T7550] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.320753][ T7550] RSP: 002b:00007f2a182d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 103.320765][ T7550] RAX: ffffffffffffffda RBX: 00007f2a17626090 RCX: 00007f2a1739e559 [ 103.320773][ T7550] RDX: 0000000000000028 RSI: 0000200000000200 RDI: 0000000000000012 [ 103.320781][ T7550] RBP: 00007f2a17435ad8 R08: 0000000000000000 R09: 0000000000000000 [ 103.320787][ T7550] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.320794][ T7550] R13: 00007f2a17626128 R14: 00007f2a17626090 R15: 00007fffef212138 [ 103.320809][ T7550] [ 104.347240][ T851] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 104.402001][ T5734] Bluetooth: hci1: connection err: -111 [ 104.507196][ T851] usb 8-1: Using ep0 maxpacket: 8 [ 104.507941][ T851] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 104.508893][ T851] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 104.508918][ T851] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 104.508938][ T851] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 104.508980][ T851] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 104.509014][ T851] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.537206][ T5825] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 104.540942][ T5842] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 104.687811][ T5842] usb 6-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 104.688732][ T5842] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 104.688769][ T5842] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.697916][ T5825] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 104.699726][ T5825] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 104.699751][ T5825] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 104.699773][ T5825] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 104.699842][ T5825] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 104.699877][ T5825] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.703877][ T5825] usb 5-1: config 0 descriptor?? [ 104.717197][ T851] usb 8-1: GET_CAPABILITIES returned 0 [ 104.717297][ T851] usbtmc 8-1:16.0: can't read capabilities [ 104.745138][ T5842] as10x_usb: device has been detected [ 104.745682][ T5842] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 104.763388][ T5842] usb 6-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 104.779119][ T5842] as10x_usb: error during firmware upload part1 [ 104.779458][ T5842] Registered device Abilis Systems DVB-Titan [ 104.929966][ T851] usb 8-1: USB disconnect, device number 11 [ 104.934715][ T5734] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 105.115704][ T5825] plantronics 0003:047F:FFFF.0009: hiddev1,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 105.533398][ T7583] FAULT_INJECTION: forcing a failure. [ 105.533398][ T7583] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 105.533430][ T7583] CPU: 1 UID: 0 PID: 7583 Comm: syz.3.638 Not tainted syzkaller #0 PREEMPT(full) [ 105.533454][ T7583] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.533467][ T7583] Call Trace: [ 105.533473][ T7583] [ 105.533482][ T7583] dump_stack_lvl+0x100/0x190 [ 105.533515][ T7583] should_fail_ex.cold+0x5/0xa [ 105.533545][ T7583] _copy_to_user+0x32/0xd0 [ 105.533577][ T7583] bpf_vlog_reverse_ubuf+0x2c3/0x470 [ 105.533615][ T7583] bpf_vlog_finalize+0x20f/0x360 [ 105.533642][ T7583] bpf_log_attr_finalize+0x86/0x1a0 [ 105.533666][ T7583] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 105.533697][ T7583] btf_new_fd+0x712/0x38f0 [ 105.533721][ T7583] ? cred_has_capability.isra.0+0x186/0x300 [ 105.533754][ T7583] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 105.533790][ T7583] ? __pfx_btf_new_fd+0x10/0x10 [ 105.533809][ T7583] ? rcu_is_watching+0x13/0xc0 [ 105.533839][ T7583] ? cap_capable+0x107/0x430 [ 105.533867][ T7583] ? bpf_lsm_capable+0x9/0x10 [ 105.533886][ T7583] ? security_capable+0x80/0x260 [ 105.533913][ T7583] ? ns_capable+0xd2/0xf0 [ 105.533938][ T7583] __sys_bpf+0x13ef/0x4a30 [ 105.533969][ T7583] ? __pfx___sys_bpf+0x10/0x10 [ 105.533991][ T7583] ? find_held_lock+0x2b/0x80 [ 105.534020][ T7583] ? futex_wake+0x4ea/0x5e0 [ 105.534059][ T7583] ? rcu_read_lock_any_held+0x6a/0x90 [ 105.534080][ T7583] ? find_held_lock+0x2b/0x80 [ 105.534108][ T7583] ? ksys_write+0x190/0x250 [ 105.534132][ T7583] ? ksys_write+0x190/0x250 [ 105.534171][ T7583] ? __x64_sys_futex+0x34f/0x4d0 [ 105.534219][ T7583] ? __x64_sys_futex+0x358/0x4d0 [ 105.534250][ T7583] ? fput+0x7c/0x100 [ 105.534279][ T7583] ? __pfx___x64_sys_futex+0x10/0x10 [ 105.534307][ T7583] ? ksys_write+0x1ac/0x250 [ 105.534335][ T7583] ? __x64_sys_bpf+0xce/0x140 [ 105.534358][ T7583] __x64_sys_bpf+0xce/0x140 [ 105.534381][ T7583] ? do_syscall_64+0xae/0x790 [ 105.534413][ T7583] do_syscall_64+0x123/0x790 [ 105.534444][ T7583] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.534466][ T7583] RIP: 0033:0x7f2a1739e559 [ 105.534486][ T7583] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.534506][ T7583] RSP: 002b:00007f2a182d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 105.534527][ T7583] RAX: ffffffffffffffda RBX: 00007f2a17626090 RCX: 00007f2a1739e559 [ 105.534542][ T7583] RDX: 0000000000000028 RSI: 0000200000000200 RDI: 0000000000000012 [ 105.534556][ T7583] RBP: 00007f2a17435ad8 R08: 0000000000000000 R09: 0000000000000000 [ 105.534569][ T7583] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.534582][ T7583] R13: 00007f2a17626128 R14: 00007f2a17626090 R15: 00007fffef212138 [ 105.534616][ T7583] [ 105.653255][ T29] usb 6-1: USB disconnect, device number 11 [ 105.676295][ T29] Unregistered device Abilis Systems DVB-Titan [ 105.678645][ T29] as10x_usb: device has been disconnected [ 106.352194][ T42] kauditd_printk_skb: 31 callbacks suppressed [ 106.352211][ T42] audit: type=1400 audit(1792415992.440:526): avc: denied { name_bind } for pid=7591 comm="syz.3.642" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 106.381484][ T42] audit: type=1326 audit(1792415992.470:527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7590 comm="syz.1.641" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd4d179e559 code=0x0 [ 106.510982][ T7607] jffs2: notice: (7607) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 106.515144][ T42] audit: type=1400 audit(1792415992.600:528): avc: denied { write } for pid=7606 comm="syz.2.645" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 106.533389][ T42] audit: type=1400 audit(1792415992.620:529): avc: denied { write } for pid=7603 comm="syz.1.644" name="mice" dev="devtmpfs" ino=938 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 106.533681][ T42] audit: type=1400 audit(1792415992.620:530): avc: denied { open } for pid=7603 comm="syz.1.644" path="/dev/input/mice" dev="devtmpfs" ino=938 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 106.829672][ T7628] FAULT_INJECTION: forcing a failure. [ 106.829672][ T7628] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 106.829693][ T7628] CPU: 2 UID: 0 PID: 7628 Comm: syz.2.650 Not tainted syzkaller #0 PREEMPT(full) [ 106.829706][ T7628] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 106.829712][ T7628] Call Trace: [ 106.829717][ T7628] [ 106.829722][ T7628] dump_stack_lvl+0x100/0x190 [ 106.829743][ T7628] should_fail_ex.cold+0x5/0xa [ 106.829759][ T7628] _copy_to_user+0x32/0xd0 [ 106.829778][ T7628] bpf_vlog_reverse_ubuf+0x2c3/0x470 [ 106.829795][ T7628] bpf_vlog_finalize+0x20f/0x360 [ 106.829809][ T7628] bpf_log_attr_finalize+0x86/0x1a0 [ 106.829822][ T7628] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 106.829839][ T7628] btf_new_fd+0x712/0x38f0 [ 106.829852][ T7628] ? cred_has_capability.isra.0+0x186/0x300 [ 106.829870][ T7628] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 106.829891][ T7628] ? __pfx_btf_new_fd+0x10/0x10 [ 106.829901][ T7628] ? rcu_is_watching+0x13/0xc0 [ 106.829918][ T7628] ? cap_capable+0x107/0x430 [ 106.829933][ T7628] ? bpf_lsm_capable+0x9/0x10 [ 106.829944][ T7628] ? security_capable+0x80/0x260 [ 106.829973][ T7628] ? ns_capable+0xd2/0xf0 [ 106.829991][ T7628] __sys_bpf+0x13ef/0x4a30 [ 106.830008][ T7628] ? __pfx___sys_bpf+0x10/0x10 [ 106.830019][ T7628] ? find_held_lock+0x2b/0x80 [ 106.830035][ T7628] ? futex_wake+0x4ea/0x5e0 [ 106.830057][ T7628] ? rcu_read_lock_any_held+0x6a/0x90 [ 106.830068][ T7628] ? find_held_lock+0x2b/0x80 [ 106.830084][ T7628] ? ksys_write+0x190/0x250 [ 106.830098][ T7628] ? ksys_write+0x190/0x250 [ 106.830120][ T7628] ? __x64_sys_futex+0x34f/0x4d0 [ 106.830136][ T7628] ? __x64_sys_futex+0x358/0x4d0 [ 106.830153][ T7628] ? fput+0x7c/0x100 [ 106.830169][ T7628] ? __pfx___x64_sys_futex+0x10/0x10 [ 106.830185][ T7628] ? ksys_write+0x1ac/0x250 [ 106.830200][ T7628] ? __x64_sys_bpf+0xce/0x140 [ 106.830212][ T7628] __x64_sys_bpf+0xce/0x140 [ 106.830225][ T7628] ? do_syscall_64+0xae/0x790 [ 106.830242][ T7628] do_syscall_64+0x123/0x790 [ 106.830260][ T7628] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.830272][ T7628] RIP: 0033:0x7f80b7b9e559 [ 106.830281][ T7628] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.830293][ T7628] RSP: 002b:00007f80b898a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 106.830305][ T7628] RAX: ffffffffffffffda RBX: 00007f80b7e26090 RCX: 00007f80b7b9e559 [ 106.830312][ T7628] RDX: 0000000000000028 RSI: 0000200000000200 RDI: 0000000000000012 [ 106.830319][ T7628] RBP: 00007f80b7c35ad8 R08: 0000000000000000 R09: 0000000000000000 [ 106.830325][ T7628] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 106.830332][ T7628] R13: 00007f80b7e26128 R14: 00007f80b7e26090 R15: 00007ffe18d35b18 [ 106.830347][ T7628] [ 106.887089][ T41] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 107.027410][ T41] usb 6-1: Using ep0 maxpacket: 8 [ 107.028154][ T41] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 107.029312][ T41] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 107.029337][ T41] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 107.029356][ T41] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 107.029375][ T41] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 107.029405][ T41] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.234306][ T5718] usb 5-1: USB disconnect, device number 22 [ 107.254042][ T41] usb 6-1: GET_CAPABILITIES returned 0 [ 107.254086][ T41] usbtmc 6-1:16.0: can't read capabilities [ 107.380440][ T7632] SELinux: Context system_u:object_r:inetd_exec_t:s0 is not valid (left unmapped). [ 107.382019][ T42] audit: type=1400 audit(1792415993.470:531): avc: denied { relabelto } for pid=7631 comm="syz.0.652" name="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:inetd_exec_t:s0" [ 107.466837][ T5718] usb 6-1: USB disconnect, device number 12 [ 107.818947][ T7647] 9p: Bad value for 'rfdno' [ 107.941116][ T7656] FAULT_INJECTION: forcing a failure. [ 107.941116][ T7656] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 107.941136][ T7656] CPU: 2 UID: 0 PID: 7656 Comm: syz.3.659 Not tainted syzkaller #0 PREEMPT(full) [ 107.941148][ T7656] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 107.941155][ T7656] Call Trace: [ 107.941159][ T7656] [ 107.941165][ T7656] dump_stack_lvl+0x100/0x190 [ 107.941185][ T7656] should_fail_ex.cold+0x5/0xa [ 107.941201][ T7656] _copy_to_user+0x32/0xd0 [ 107.941218][ T7656] simple_read_from_buffer+0xcb/0x170 [ 107.941248][ T7656] proc_fail_nth_read+0x1af/0x230 [ 107.941266][ T7656] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 107.941283][ T7656] ? rw_verify_area+0xce/0x6d0 [ 107.941296][ T7656] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 107.941312][ T7656] vfs_read+0x1e4/0xb40 [ 107.941325][ T7656] ? lock_acquire+0x1d1/0x380 [ 107.941338][ T7656] ? __fget_files+0x34/0x3d0 [ 107.941353][ T7656] ? __pfx_vfs_read+0x10/0x10 [ 107.941365][ T7656] ? find_held_lock+0x2b/0x80 [ 107.941381][ T7656] ? __fget_files+0x215/0x3d0 [ 107.941399][ T7656] ? __fget_files+0x21f/0x3d0 [ 107.941431][ T7656] ksys_read+0x12a/0x250 [ 107.941447][ T7656] ? __pfx_ksys_read+0x10/0x10 [ 107.941465][ T7656] do_syscall_64+0x123/0x790 [ 107.941483][ T7656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.941494][ T7656] RIP: 0033:0x7f2a1735ed8e [ 107.941503][ T7656] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 107.941514][ T7656] RSP: 002b:00007f2a182f6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 107.941526][ T7656] RAX: ffffffffffffffda RBX: 00007f2a182f76c0 RCX: 00007f2a1735ed8e [ 107.941533][ T7656] RDX: 000000000000000f RSI: 00007f2a182f70a0 RDI: 0000000000000004 [ 107.941539][ T7656] RBP: 00007f2a182f7090 R08: 0000000000000000 R09: 0000000000000000 [ 107.941546][ T7656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 107.941552][ T7656] R13: 00007f2a17626038 R14: 00007f2a17625fa0 R15: 00007fffef212138 [ 107.941571][ T7656] [ 108.038687][ T7662] FAULT_INJECTION: forcing a failure. [ 108.038687][ T7662] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 108.038707][ T7662] CPU: 2 UID: 0 PID: 7662 Comm: syz.3.661 Not tainted syzkaller #0 PREEMPT(full) [ 108.038721][ T7662] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 108.038728][ T7662] Call Trace: [ 108.038732][ T7662] [ 108.038737][ T7662] dump_stack_lvl+0x100/0x190 [ 108.038758][ T7662] should_fail_ex.cold+0x5/0xa [ 108.038775][ T7662] _copy_to_user+0x32/0xd0 [ 108.038794][ T7662] bpf_vlog_reverse_ubuf+0x2c3/0x470 [ 108.038811][ T7662] bpf_vlog_finalize+0x20f/0x360 [ 108.038825][ T7662] bpf_log_attr_finalize+0x86/0x1a0 [ 108.038838][ T7662] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 108.038857][ T7662] btf_new_fd+0x712/0x38f0 [ 108.038869][ T7662] ? cred_has_capability.isra.0+0x186/0x300 [ 108.038887][ T7662] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 108.038908][ T7662] ? __pfx_btf_new_fd+0x10/0x10 [ 108.038918][ T7662] ? rcu_is_watching+0x13/0xc0 [ 108.038935][ T7662] ? cap_capable+0x107/0x430 [ 108.038950][ T7662] ? bpf_lsm_capable+0x9/0x10 [ 108.038961][ T7662] ? security_capable+0x80/0x260 [ 108.038975][ T7662] ? ns_capable+0xd2/0xf0 [ 108.038988][ T7662] __sys_bpf+0x13ef/0x4a30 [ 108.039005][ T7662] ? __pfx___sys_bpf+0x10/0x10 [ 108.039016][ T7662] ? find_held_lock+0x2b/0x80 [ 108.039035][ T7662] ? futex_wake+0x4ea/0x5e0 [ 108.039075][ T7662] ? rcu_read_lock_any_held+0x6a/0x90 [ 108.039088][ T7662] ? find_held_lock+0x2b/0x80 [ 108.039105][ T7662] ? ksys_write+0x190/0x250 [ 108.039119][ T7662] ? ksys_write+0x190/0x250 [ 108.039143][ T7662] ? __x64_sys_futex+0x34f/0x4d0 [ 108.039160][ T7662] ? __x64_sys_futex+0x358/0x4d0 [ 108.039178][ T7662] ? xfd_validate_state+0x129/0x190 [ 108.039194][ T7662] ? __x64_sys_bpf+0xce/0x140 [ 108.039207][ T7662] __x64_sys_bpf+0xce/0x140 [ 108.039220][ T7662] ? do_syscall_64+0xae/0x790 [ 108.039238][ T7662] do_syscall_64+0x123/0x790 [ 108.039255][ T7662] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.039267][ T7662] RIP: 0033:0x7f2a1739e559 [ 108.039280][ T7662] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.039295][ T7662] RSP: 002b:00007f2a182d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 108.039314][ T7662] RAX: ffffffffffffffda RBX: 00007f2a17626090 RCX: 00007f2a1739e559 [ 108.039326][ T7662] RDX: 0000000000000028 RSI: 0000200000000200 RDI: 0000000000000012 [ 108.039336][ T7662] RBP: 00007f2a17435ad8 R08: 0000000000000000 R09: 0000000000000000 [ 108.039347][ T7662] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 108.039359][ T7662] R13: 00007f2a17626128 R14: 00007f2a17626090 R15: 00007fffef212138 [ 108.039382][ T7662] [ 108.045246][ T42] audit: type=1800 audit(1792415994.130:532): pid=7663 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.663" name=08 dev="sda1" ino=2038 res=0 errno=0 [ 108.169242][ T42] audit: type=1400 audit(1792415994.260:533): avc: denied { read } for pid=7664 comm="syz.1.662" laddr=::ffff:0.0.0.0 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 108.236599][ T7670] program syz.2.665 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 108.236802][ T7670] FAULT_INJECTION: forcing a failure. [ 108.236802][ T7670] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 108.236819][ T7670] CPU: 1 UID: 0 PID: 7670 Comm: syz.2.665 Not tainted syzkaller #0 PREEMPT(full) [ 108.236833][ T7670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 108.236840][ T7670] Call Trace: [ 108.236844][ T7670] [ 108.236849][ T7670] dump_stack_lvl+0x100/0x190 [ 108.236870][ T7670] should_fail_ex.cold+0x5/0xa [ 108.236888][ T7670] _copy_to_user+0x32/0xd0 [ 108.236906][ T7670] simple_read_from_buffer+0xcb/0x170 [ 108.236924][ T7670] proc_fail_nth_read+0x1af/0x230 [ 108.236971][ T7670] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 108.236993][ T7670] ? rw_verify_area+0xce/0x6d0 [ 108.237005][ T7670] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 108.237036][ T7670] vfs_read+0x1e4/0xb40 [ 108.237049][ T7670] ? lock_acquire+0x1d1/0x380 [ 108.237064][ T7670] ? __fget_files+0x34/0x3d0 [ 108.237080][ T7670] ? __pfx_vfs_read+0x10/0x10 [ 108.237092][ T7670] ? find_held_lock+0x2b/0x80 [ 108.237108][ T7670] ? __fget_files+0x215/0x3d0 [ 108.237126][ T7670] ? __fget_files+0x21f/0x3d0 [ 108.237146][ T7670] ksys_read+0x12a/0x250 [ 108.237159][ T7670] ? __pfx_ksys_read+0x10/0x10 [ 108.237177][ T7670] do_syscall_64+0x123/0x790 [ 108.237196][ T7670] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.237220][ T7670] RIP: 0033:0x7f80b7b5ed8e [ 108.237231][ T7670] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 108.237241][ T7670] RSP: 002b:00007f80b89aafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 108.237253][ T7670] RAX: ffffffffffffffda RBX: 00007f80b89ab6c0 RCX: 00007f80b7b5ed8e [ 108.237260][ T7670] RDX: 000000000000000f RSI: 00007f80b89ab0a0 RDI: 0000000000000004 [ 108.237266][ T7670] RBP: 00007f80b89ab090 R08: 0000000000000000 R09: 0000000000000000 [ 108.237272][ T7670] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 108.237279][ T7670] R13: 00007f80b7e26038 R14: 00007f80b7e25fa0 R15: 00007ffe18d35b18 [ 108.237294][ T7670] [ 108.890397][ T42] audit: type=1400 audit(1792415994.980:534): avc: denied { write } for pid=7678 comm="syz.2.669" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 108.926834][ T42] audit: type=1400 audit(1792415995.010:535): avc: denied { ioctl } for pid=7682 comm="syz.0.670" path="socket:[24709]" dev="sockfs" ino=24709 ioctlcmd=0x6e88 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 108.967739][ T7687] overlayfs: failed to resolve './dev/sda1': -2 [ 109.003897][ T7698] netlink: 8 bytes leftover after parsing attributes in process `syz.2.676'. [ 109.081874][ T7705] FAULT_INJECTION: forcing a failure. [ 109.081874][ T7705] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 109.081906][ T7705] CPU: 1 UID: 0 PID: 7705 Comm: syz.1.677 Not tainted syzkaller #0 PREEMPT(full) [ 109.081929][ T7705] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 109.081942][ T7705] Call Trace: [ 109.081949][ T7705] [ 109.081956][ T7705] dump_stack_lvl+0x100/0x190 [ 109.081999][ T7705] should_fail_ex.cold+0x5/0xa [ 109.082030][ T7705] _copy_to_user+0x32/0xd0 [ 109.082064][ T7705] bpf_vlog_reverse_ubuf+0x2c3/0x470 [ 109.082093][ T7705] bpf_vlog_finalize+0x20f/0x360 [ 109.082117][ T7705] bpf_log_attr_finalize+0x86/0x1a0 [ 109.082139][ T7705] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 109.082169][ T7705] btf_new_fd+0x712/0x38f0 [ 109.082192][ T7705] ? cred_has_capability.isra.0+0x186/0x300 [ 109.082224][ T7705] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 109.082261][ T7705] ? __pfx_btf_new_fd+0x10/0x10 [ 109.082279][ T7705] ? rcu_is_watching+0x13/0xc0 [ 109.082309][ T7705] ? cap_capable+0x107/0x430 [ 109.082337][ T7705] ? bpf_lsm_capable+0x9/0x10 [ 109.082357][ T7705] ? security_capable+0x80/0x260 [ 109.082382][ T7705] ? ns_capable+0xd2/0xf0 [ 109.082408][ T7705] __sys_bpf+0x13ef/0x4a30 [ 109.082438][ T7705] ? __pfx___sys_bpf+0x10/0x10 [ 109.082460][ T7705] ? find_held_lock+0x2b/0x80 [ 109.082489][ T7705] ? futex_wake+0x4ea/0x5e0 [ 109.082528][ T7705] ? rcu_read_lock_any_held+0x6a/0x90 [ 109.082548][ T7705] ? find_held_lock+0x2b/0x80 [ 109.082577][ T7705] ? ksys_write+0x190/0x250 [ 109.082604][ T7705] ? ksys_write+0x190/0x250 [ 109.082643][ T7705] ? __x64_sys_futex+0x34f/0x4d0 [ 109.082671][ T7705] ? __x64_sys_futex+0x358/0x4d0 [ 109.082703][ T7705] ? xfd_validate_state+0x129/0x190 [ 109.082730][ T7705] ? __x64_sys_bpf+0xce/0x140 [ 109.082751][ T7705] __x64_sys_bpf+0xce/0x140 [ 109.082775][ T7705] ? do_syscall_64+0xae/0x790 [ 109.082807][ T7705] do_syscall_64+0x123/0x790 [ 109.082837][ T7705] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.082859][ T7705] RIP: 0033:0x7fd4d179e559 [ 109.082877][ T7705] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.082895][ T7705] RSP: 002b:00007fd4d26c4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 109.082917][ T7705] RAX: ffffffffffffffda RBX: 00007fd4d1a26090 RCX: 00007fd4d179e559 [ 109.082931][ T7705] RDX: 0000000000000028 RSI: 0000200000000200 RDI: 0000000000000012 [ 109.082943][ T7705] RBP: 00007fd4d1835ad8 R08: 0000000000000000 R09: 0000000000000000 [ 109.082957][ T7705] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 109.082969][ T7705] R13: 00007fd4d1a26128 R14: 00007fd4d1a26090 R15: 00007ffce1c2c848 [ 109.083005][ T7705] [ 109.207100][ T851] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 109.357191][ T851] usb 5-1: Using ep0 maxpacket: 8 [ 109.357620][ T851] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 109.358424][ T851] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 109.358440][ T851] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 109.358452][ T851] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 109.358463][ T851] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 109.358482][ T851] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.565024][ T851] usb 5-1: GET_CAPABILITIES returned 0 [ 109.565049][ T851] usbtmc 5-1:16.0: can't read capabilities [ 109.782792][ T57] usb 5-1: USB disconnect, device number 23 [ 109.808009][ T5734] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 110.042926][ T1039] rxe_eth0 speed is unknown, defaulting to 1000 [ 110.046588][ T5734] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 110.283017][ T851] libceph: connect (1)[c::]:6789 error -101 [ 110.283150][ T851] libceph: mon0 (1)[c::]:6789 connect error [ 110.356915][ T7757] netlink: 60 bytes leftover after parsing attributes in process `syz.0.699'. [ 110.356972][ T7757] bridge_slave_0: entered promiscuous mode [ 110.369821][ T7752] ceph: No mds server is up or the cluster is laggy [ 111.081718][ T7768] device-mapper: ioctl: name not supplied when creating device [ 111.213392][ T7780] netlink: 28 bytes leftover after parsing attributes in process `syz.2.713'. [ 111.216026][ T7780] ip_tables: iptables: counters copy to user failed while replacing table [ 111.330470][ T7791] ubi0: attaching mtd0 [ 111.331814][ T7791] ubi0: scanning is finished [ 111.331839][ T7791] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 111.393734][ T42] kauditd_printk_skb: 8 callbacks suppressed [ 111.393747][ T42] audit: type=1400 audit(1792415997.480:544): avc: denied { setopt } for pid=7793 comm="syz.3.711" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 111.503270][ T7791] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 111.507319][ T5842] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 111.598427][ T7800] debugfs: '1^!l1' already exists in 'ieee80211' [ 111.667282][ T5842] usb 6-1: Using ep0 maxpacket: 8 [ 111.667722][ T5842] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 111.668503][ T5842] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 111.668518][ T5842] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 111.668530][ T5842] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 111.668541][ T5842] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 111.668560][ T5842] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.671397][ T7804] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 111.839018][ T7816] jffs2: notice: (7816) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 111.843437][ T42] audit: type=1400 audit(1792415997.930:545): avc: denied { write } for pid=7815 comm="syz.0.721" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 111.877432][ T5842] usb 6-1: GET_CAPABILITIES returned 0 [ 111.877456][ T5842] usbtmc 6-1:16.0: can't read capabilities [ 111.923644][ T42] audit: type=1400 audit(1792415998.010:546): avc: denied { read } for pid=7813 comm="syz.3.720" name="rtc0" dev="devtmpfs" ino=943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 111.923890][ T42] audit: type=1400 audit(1792415998.010:547): avc: denied { open } for pid=7813 comm="syz.3.720" path="/dev/rtc0" dev="devtmpfs" ino=943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 111.924528][ T42] audit: type=1400 audit(1792415998.010:548): avc: denied { ioctl } for pid=7813 comm="syz.3.720" path="/dev/rtc0" dev="devtmpfs" ino=943 ioctlcmd=0x700f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 111.944714][ T7814] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 112.081600][ T5842] usb 6-1: USB disconnect, device number 13 [ 112.126546][ T7830] kvm_intel: kvm [7829]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x1d9) = 0x12682db2 [ 112.127600][ T7833] debugfs: '1^!l1' already exists in 'ieee80211' [ 112.149777][ T7830] kvm [7829]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x187) = 0x126822f4 [ 112.150006][ T7830] kvm [7829]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x186) = 0x1268fda4 [ 112.167808][ T7837] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 1, id = 0 [ 112.172998][ T7830] kvm [7829]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x11e) = 0x12686ca9 [ 112.194909][ T7830] kvm [7829]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x1268e61c [ 112.195127][ T7830] kvm [7829]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x1268eacd [ 112.251699][ T7841] rxe_eth0 speed is unknown, defaulting to 1000 [ 112.352108][ T42] audit: type=1400 audit(1792415998.440:549): avc: denied { ioctl } for pid=7842 comm="syz.2.728" path="socket:[25239]" dev="sockfs" ino=25239 ioctlcmd=0x89ec scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 112.547291][ T7843] infiniband syz0: set active [ 112.549070][ T7843] infiniband syz0: added ipvlan1 [ 112.564523][ T7843] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 112.564557][ T7843] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 112.564592][ T7843] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 112.593072][ T7843] RDS/IB: syz0: added [ 112.593099][ T7843] smc: adding ib device syz0 with port count 1 [ 112.593110][ T7843] smc: ib device syz0 port 1 has no pnetid [ 112.639828][ T7856] binder: 7855:7856 ioctl c0306201 200000000a00 returned -14 [ 112.640905][ T7856] binder: 7855:7856 ioctl c0306201 200000000b00 returned -14 [ 112.641024][ T7856] binder: 7855:7856 unknown command 1 [ 112.641032][ T7856] binder: 7855:7856 ioctl c0306201 200000000b80 returned -22 [ 112.646441][ T42] audit: type=1400 audit(1792415998.730:550): avc: denied { map } for pid=7857 comm="syz.1.734" path="socket:[25947]" dev="sockfs" ino=25947 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 112.697459][ T42] audit: type=1400 audit(1792415998.790:551): avc: denied { execute } for pid=7860 comm="syz.3.735" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=25960 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 112.705269][ T42] audit: type=1400 audit(1792415998.790:552): avc: denied { read } for pid=7861 comm="syz.1.736" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 112.751782][ T42] audit: type=1400 audit(1792415998.840:553): avc: denied { bind } for pid=7860 comm="syz.3.735" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 112.804143][ T5734] Bluetooth: hci3: unexpected event for opcode 0x0403 [ 112.919466][ T7868] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 112.977166][ T851] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 112.979634][ T7870] netlink: 132 bytes leftover after parsing attributes in process `syz.1.738'. [ 113.055860][ T7874] Invalid logical block size (2304) [ 113.061665][ T7874] Cannot find set identified by id 0 to match [ 113.128688][ T851] usb 5-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 113.129803][ T851] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.129842][ T851] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.151729][ T851] as10x_usb: device has been detected [ 113.152314][ T851] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 113.188432][ T851] usb 5-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 113.207569][ T851] as10x_usb: error during firmware upload part1 [ 113.208002][ T851] Registered device Abilis Systems DVB-Titan [ 113.332896][ T7879] batadv_slave_1: entered promiscuous mode [ 113.349613][ T7880] cgroup: Unknown subsys name 'uid>00000000000000000000' [ 113.349726][ T7879] cgroup: Unknown subsys name 'uid>00000000000000000000' [ 113.355076][ T7878] batadv_slave_1: left promiscuous mode [ 113.473368][ T7886] FAULT_INJECTION: forcing a failure. [ 113.473368][ T7886] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 113.473390][ T7886] CPU: 3 UID: 0 PID: 7886 Comm: syz.2.745 Not tainted syzkaller #0 PREEMPT(full) [ 113.473403][ T7886] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 113.473409][ T7886] Call Trace: [ 113.473413][ T7886] [ 113.473418][ T7886] dump_stack_lvl+0x100/0x190 [ 113.473439][ T7886] should_fail_ex.cold+0x5/0xa [ 113.473455][ T7886] _copy_to_user+0x32/0xd0 [ 113.473473][ T7886] simple_read_from_buffer+0xcb/0x170 [ 113.473491][ T7886] proc_fail_nth_read+0x1af/0x230 [ 113.473509][ T7886] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 113.473527][ T7886] ? rw_verify_area+0xce/0x6d0 [ 113.473539][ T7886] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 113.473562][ T7886] vfs_read+0x1e4/0xb40 [ 113.473592][ T7886] ? lock_acquire+0x1d1/0x380 [ 113.473606][ T7886] ? __fget_files+0x34/0x3d0 [ 113.473622][ T7886] ? __pfx_vfs_read+0x10/0x10 [ 113.473634][ T7886] ? find_held_lock+0x2b/0x80 [ 113.473651][ T7886] ? __fget_files+0x215/0x3d0 [ 113.473669][ T7886] ? __fget_files+0x21f/0x3d0 [ 113.473689][ T7886] ksys_read+0x12a/0x250 [ 113.473703][ T7886] ? __pfx_ksys_read+0x10/0x10 [ 113.473720][ T7886] do_syscall_64+0x123/0x790 [ 113.473738][ T7886] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.473750][ T7886] RIP: 0033:0x7f80b7b5ed8e [ 113.473759][ T7886] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 113.473770][ T7886] RSP: 002b:00007f80b89aafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 113.473781][ T7886] RAX: ffffffffffffffda RBX: 00007f80b89ab6c0 RCX: 00007f80b7b5ed8e [ 113.473788][ T7886] RDX: 000000000000000f RSI: 00007f80b89ab0a0 RDI: 0000000000000004 [ 113.473795][ T7886] RBP: 00007f80b89ab090 R08: 0000000000000000 R09: 0000000000000000 [ 113.473801][ T7886] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 113.473808][ T7886] R13: 00007f80b7e26038 R14: 00007f80b7e25fa0 R15: 00007ffe18d35b18 [ 113.473823][ T7886] [ 113.661814][ T7891] FAULT_INJECTION: forcing a failure. [ 113.661814][ T7891] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 113.661835][ T7891] CPU: 2 UID: 0 PID: 7891 Comm: syz.2.747 Not tainted syzkaller #0 PREEMPT(full) [ 113.661848][ T7891] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 113.661855][ T7891] Call Trace: [ 113.661859][ T7891] [ 113.661864][ T7891] dump_stack_lvl+0x100/0x190 [ 113.661885][ T7891] should_fail_ex.cold+0x5/0xa [ 113.661902][ T7891] _copy_to_user+0x32/0xd0 [ 113.661920][ T7891] bpf_vlog_reverse_ubuf+0x2c3/0x470 [ 113.661937][ T7891] bpf_vlog_finalize+0x20f/0x360 [ 113.661951][ T7891] bpf_log_attr_finalize+0x86/0x1a0 [ 113.661963][ T7891] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 113.662000][ T7891] btf_new_fd+0x712/0x38f0 [ 113.662014][ T7891] ? cred_has_capability.isra.0+0x186/0x300 [ 113.662034][ T7891] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 113.662057][ T7891] ? __pfx_btf_new_fd+0x10/0x10 [ 113.662068][ T7891] ? rcu_is_watching+0x13/0xc0 [ 113.662085][ T7891] ? cap_capable+0x107/0x430 [ 113.662101][ T7891] ? bpf_lsm_capable+0x9/0x10 [ 113.662112][ T7891] ? security_capable+0x80/0x260 [ 113.662127][ T7891] ? ns_capable+0xd2/0xf0 [ 113.662140][ T7891] __sys_bpf+0x13ef/0x4a30 [ 113.662157][ T7891] ? __pfx___sys_bpf+0x10/0x10 [ 113.662168][ T7891] ? find_held_lock+0x2b/0x80 [ 113.662184][ T7891] ? futex_wake+0x4ea/0x5e0 [ 113.662207][ T7891] ? rcu_read_lock_any_held+0x6a/0x90 [ 113.662218][ T7891] ? find_held_lock+0x2b/0x80 [ 113.662234][ T7891] ? ksys_write+0x190/0x250 [ 113.662248][ T7891] ? ksys_write+0x190/0x250 [ 113.662270][ T7891] ? __x64_sys_futex+0x34f/0x4d0 [ 113.662286][ T7891] ? __x64_sys_futex+0x358/0x4d0 [ 113.662304][ T7891] ? xfd_validate_state+0x129/0x190 [ 113.662318][ T7891] ? __x64_sys_bpf+0xce/0x140 [ 113.662330][ T7891] __x64_sys_bpf+0xce/0x140 [ 113.662343][ T7891] ? do_syscall_64+0xae/0x790 [ 113.662360][ T7891] do_syscall_64+0x123/0x790 [ 113.662378][ T7891] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.662390][ T7891] RIP: 0033:0x7f80b7b9e559 [ 113.662400][ T7891] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 113.662410][ T7891] RSP: 002b:00007f80b898a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 113.662423][ T7891] RAX: ffffffffffffffda RBX: 00007f80b7e26090 RCX: 00007f80b7b9e559 [ 113.662430][ T7891] RDX: 0000000000000028 RSI: 0000200000000200 RDI: 0000000000000012 [ 113.662437][ T7891] RBP: 00007f80b7c35ad8 R08: 0000000000000000 R09: 0000000000000000 [ 113.662444][ T7891] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 113.662452][ T7891] R13: 00007f80b7e26128 R14: 00007f80b7e26090 R15: 00007ffe18d35b18 [ 113.662467][ T7891] [ 113.705214][ T7895] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 113.864968][ T5825] wacom 0003:056A:003F.000A: hidraw1: USB HID v0.00 Gamepad [syz0] on syz0 [ 114.593843][ T7930] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 114.755484][ T7934] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2580 sclass=netlink_route_socket pid=7934 comm=syz.3.762 [ 114.766743][ T7934] syz.3.762 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 114.856044][ T7936] ip_tables: iptables: counters copy to user failed while replacing table [ 114.859892][ T851] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 114.862616][ T7936] rnbd_client L607: Mapping device /dev/ram0 on session s0, (access_mode: rw, nr_poll_queues: 0) [ 114.896682][ T12] rtrs_client L1783: : Resolving route failed, err: -ENODEV [ 114.941905][ T7936] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 115.007135][ T851] usb 7-1: Using ep0 maxpacket: 8 [ 115.007593][ T851] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 115.008397][ T851] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 115.008414][ T851] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 115.008426][ T851] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 115.008437][ T851] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 115.008455][ T851] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.060096][ T7941] loop5: detected capacity change from 0 to 7 [ 115.063974][ T7941] Dev loop5: unable to read RDB block 7 [ 115.064006][ T7941] loop5: unable to read partition table [ 115.064199][ T7941] loop5: partition table beyond EOD, truncated [ 115.064215][ T7941] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 115.118771][ T7942] Cannot find set identified by id 0 to match [ 115.130441][ T7941] Dev loop5: unable to read RDB block 7 [ 115.130480][ T7941] loop5: unable to read partition table [ 115.130642][ T7941] loop5: partition table beyond EOD, truncated [ 115.130657][ T7941] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 115.215325][ T851] usb 7-1: GET_CAPABILITIES returned 0 [ 115.215350][ T851] usbtmc 7-1:16.0: can't read capabilities [ 115.416501][ T1039] usb 7-1: USB disconnect, device number 11 [ 115.495291][ T7946] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 115.498846][ T7946] phram: not enough arguments [ 115.732598][ T5718] usb 5-1: USB disconnect, device number 24 [ 115.750419][ T5718] Unregistered device Abilis Systems DVB-Titan [ 115.752766][ T5718] as10x_usb: device has been disconnected [ 115.859851][ T7955] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2304 sclass=netlink_route_socket pid=7955 comm=syz.0.772 [ 116.092456][ T7978] FAULT_INJECTION: forcing a failure. [ 116.092456][ T7978] name fail_futex, interval 1, probability 0, space 0, times 1 [ 116.092503][ T7978] CPU: 3 UID: 0 PID: 7978 Comm: syz.1.779 Not tainted syzkaller #0 PREEMPT(full) [ 116.092527][ T7978] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.092538][ T7978] Call Trace: [ 116.092559][ T7978] [ 116.092567][ T7978] dump_stack_lvl+0x100/0x190 [ 116.092683][ T7978] should_fail_ex.cold+0x5/0xa [ 116.092743][ T7978] get_futex_key+0x1c9/0x13e0 [ 116.092806][ T7978] ? __pfx_get_futex_key+0x10/0x10 [ 116.092853][ T7978] ? __pfx___smp_call_single_queue+0x10/0x10 [ 116.092883][ T7978] futex_wait_setup+0x91/0x540 [ 116.092945][ T7978] __futex_wait+0x19f/0x300 [ 116.092973][ T7978] ? __pfx___futex_wait+0x10/0x10 [ 116.092994][ T7978] ? __pfx_try_to_wake_up+0x10/0x10 [ 116.093021][ T7978] ? futex_hash+0x311/0x400 [ 116.093051][ T7978] ? __pfx_futex_wake_mark+0x10/0x10 [ 116.093080][ T7978] ? find_held_lock+0x2b/0x80 [ 116.093112][ T7978] ? futex_wake+0x4ea/0x5e0 [ 116.093140][ T7978] futex_wait+0xe6/0x370 [ 116.093165][ T7978] ? __pfx_futex_wait+0x10/0x10 [ 116.093195][ T7978] ? find_held_lock+0x2b/0x80 [ 116.093230][ T7978] do_futex+0x265/0x440 [ 116.093261][ T7978] ? __pfx_do_futex+0x10/0x10 [ 116.093293][ T7978] ? fput+0x7c/0x100 [ 116.093351][ T7978] __x64_sys_futex+0x34f/0x4d0 [ 116.093385][ T7978] ? __pfx___x64_sys_futex+0x10/0x10 [ 116.093428][ T7978] do_syscall_64+0x123/0x790 [ 116.093478][ T7978] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.093501][ T7978] RIP: 0033:0x7fd4d179e559 [ 116.093533][ T7978] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 116.093553][ T7978] RSP: 002b:00007fd4d26e50e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 116.093587][ T7978] RAX: ffffffffffffffda RBX: 00007fd4d1a25fa8 RCX: 00007fd4d179e559 [ 116.093602][ T7978] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fd4d1a25fa8 [ 116.093616][ T7978] RBP: 00007fd4d1a25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 116.093630][ T7978] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 116.093643][ T7978] R13: 00007fd4d1a26038 R14: 00007ffce1c2c760 R15: 00007ffce1c2c848 [ 116.093672][ T7978] [ 116.174731][ T7984] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2580 sclass=netlink_route_socket pid=7984 comm=syz.2.776 [ 116.397384][ T5718] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 116.509401][ T42] kauditd_printk_skb: 2 callbacks suppressed [ 116.509419][ T42] audit: type=1400 audit(1792416002.600:556): avc: denied { mounton } for pid=7980 comm="syz.1.780" path="/198/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 116.510149][ T7987] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 116.549279][ T5718] usb 8-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 116.550212][ T5718] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 116.550252][ T5718] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.562263][ T5718] as10x_usb: device has been detected [ 116.562863][ T5718] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 116.574381][ T5718] usb 8-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 116.585125][ T5718] as10x_usb: error during firmware upload part1 [ 116.585628][ T5718] Registered device Abilis Systems DVB-Titan [ 116.607305][ T41] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 116.758208][ T41] usb 5-1: Using ep0 maxpacket: 8 [ 116.758949][ T41] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 116.759912][ T41] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 116.759936][ T41] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 116.759957][ T41] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 116.759982][ T41] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 116.760015][ T41] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.830924][ T42] audit: type=1326 audit(1792416002.920:557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7970 comm="syz.2.776" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80b7b9e559 code=0x7fc00000 [ 116.831192][ T42] audit: type=1326 audit(1792416002.920:558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7970 comm="syz.2.776" exe="/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f80b7b9e559 code=0x7fc00000 [ 116.969652][ T41] usb 5-1: GET_CAPABILITIES returned 0 [ 116.969706][ T41] usbtmc 5-1:16.0: can't read capabilities [ 116.981796][ T42] audit: type=1400 audit(1792416003.070:559): avc: denied { setattr } for pid=8001 comm="syz.2.788" name="NETLINK" dev="sockfs" ino=25288 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 116.983518][ T8002] x_tables: duplicate underflow at hook 1 [ 116.984788][ T42] audit: type=1400 audit(1792416003.070:560): avc: denied { create } for pid=8001 comm="syz.2.788" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 116.984828][ T42] audit: type=1400 audit(1792416003.070:561): avc: denied { setopt } for pid=8001 comm="syz.2.788" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 117.172514][ T41] usb 5-1: USB disconnect, device number 25 [ 117.427544][ T1039] usb 7-1: new full-speed USB device number 12 using dummy_hcd [ 117.577888][ T1039] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 117.578977][ T1039] usb 7-1: config index 0 descriptor too short (expected 74, got 45) [ 117.579018][ T1039] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 64 [ 117.579044][ T1039] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 64 [ 117.579066][ T1039] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 117.579160][ T1039] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.786825][ T1039] usb 7-1: GET_CAPABILITIES returned 0 [ 117.786877][ T1039] usbtmc 7-1:16.0: can't read capabilities [ 117.943764][ T8026] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2580 sclass=netlink_route_socket pid=8026 comm=syz.0.796 [ 118.059294][ T1039] usb 7-1: USB disconnect, device number 12 [ 118.298970][ T8028] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 118.608517][ T42] audit: type=1326 audit(1792416004.700:562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8023 comm="syz.0.796" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f13b799e559 code=0x7fc00000 [ 118.656648][ T42] audit: type=1400 audit(1792416004.740:563): avc: denied { map } for pid=8037 comm="syz.0.801" path="/152/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=6091 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 118.662338][ T42] audit: type=1400 audit(1792416004.750:564): avc: denied { ioctl } for pid=8037 comm="syz.0.801" path="/152/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=6091 ioctlcmd=0x5220 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 118.997429][ T1039] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 119.147441][ T1039] usb 5-1: Using ep0 maxpacket: 8 [ 119.148176][ T1039] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 119.149286][ T1039] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 119.149313][ T1039] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 119.149336][ T1039] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 119.149356][ T1039] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 119.149392][ T1039] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.162736][ T41] usb 8-1: USB disconnect, device number 12 [ 119.191832][ T41] Unregistered device Abilis Systems DVB-Titan [ 119.193339][ T41] as10x_usb: device has been disconnected [ 119.231921][ T8044] debugfs: '1^!l1' already exists in 'ieee80211' [ 119.301551][ T8046] netlink: 'syz.3.805': attribute type 16 has an invalid length. [ 119.301573][ T8046] netlink: 'syz.3.805': attribute type 17 has an invalid length. [ 119.315852][ T8046] bridge0: port 3(syz_tun) entered disabled state [ 119.319278][ T42] audit: type=1400 audit(1792416005.410:565): avc: denied { ioctl } for pid=8047 comm="syz.1.806" path="socket:[27873]" dev="sockfs" ino=27873 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 119.342389][ T8046] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.347854][ T8046] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.362566][ T1039] usb 5-1: GET_CAPABILITIES returned 0 [ 119.362603][ T1039] usbtmc 5-1:16.0: can't read capabilities [ 119.369797][ T8054] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 119.421017][ T8046] 8021q: adding VLAN 0 to HW filter on device bond1 [ 119.425112][ T8046] 8021q: adding VLAN 0 to HW filter on device bond2 [ 119.564714][ T3376] usb 5-1: USB disconnect, device number 26 [ 119.684742][ T8075] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2580 sclass=netlink_route_socket pid=8075 comm=syz.1.810 [ 119.777181][ T851] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 119.927626][ T851] usb 7-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 119.928879][ T851] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.928939][ T851] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.935488][ T851] as10x_usb: device has been detected [ 119.935795][ T851] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 119.958686][ T851] usb 7-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 119.961892][ T851] as10x_usb: error during firmware upload part1 [ 119.962129][ T851] Registered device Abilis Systems DVB-Titan [ 119.967249][ T5718] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 120.097126][ T5718] usb 8-1: device descriptor read/64, error -71 [ 120.114315][ T8079] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 120.255024][ T8086] binder: Binderfs stats mode cannot be changed during a remount [ 120.337545][ T5718] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 120.467196][ T5718] usb 8-1: device descriptor read/64, error -71 [ 120.579686][ T5718] usb usb8-port1: attempt power cycle [ 120.685663][ T8108] overlayfs: failed to resolve './file0': -2 [ 120.799811][ T8118] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 120.867108][ T8123] bond0: entered promiscuous mode [ 120.867136][ T8123] bond_slave_0: entered promiscuous mode [ 120.867349][ T8123] bond_slave_1: entered promiscuous mode [ 120.871477][ T8123] batadv0: entered promiscuous mode [ 120.873216][ T8123] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 120.937274][ T5718] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 120.958413][ T5718] usb 8-1: device descriptor read/8, error -71 [ 121.042247][ T8132] FAULT_INJECTION: forcing a failure. [ 121.042247][ T8132] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 121.042351][ T8132] CPU: 2 UID: 0 PID: 8132 Comm: syz.0.835 Tainted: G L syzkaller #0 PREEMPT(full) [ 121.042378][ T8132] Tainted: [L]=SOFTLOCKUP [ 121.042385][ T8132] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 121.042395][ T8132] Call Trace: [ 121.042416][ T8132] [ 121.042424][ T8132] dump_stack_lvl+0x100/0x190 [ 121.042520][ T8132] should_fail_ex.cold+0x5/0xa [ 121.042558][ T8132] _copy_from_user+0x2e/0xd0 [ 121.042605][ T8132] __sys_bpf+0x2f5/0x4a30 [ 121.042652][ T8132] ? __pfx___sys_bpf+0x10/0x10 [ 121.042670][ T8132] ? find_held_lock+0x2b/0x80 [ 121.042696][ T8132] ? get_pid_task+0xfc/0x250 [ 121.042721][ T8132] ? get_pid_task+0xfc/0x250 [ 121.042752][ T8132] ? find_held_lock+0x2b/0x80 [ 121.042782][ T8132] ? rcu_read_lock_any_held+0x6a/0x90 [ 121.042802][ T8132] ? find_held_lock+0x2b/0x80 [ 121.042827][ T8132] ? ksys_write+0x190/0x250 [ 121.042861][ T8132] ? ksys_write+0x190/0x250 [ 121.042882][ T8132] ? lock_acquire+0x1d1/0x380 [ 121.042919][ T8132] ? fput+0x7c/0x100 [ 121.042946][ T8132] ? ksys_write+0x1ac/0x250 [ 121.042972][ T8132] ? __x64_sys_bpf+0xce/0x140 [ 121.042994][ T8132] __x64_sys_bpf+0xce/0x140 [ 121.043015][ T8132] ? do_syscall_64+0xae/0x790 [ 121.043054][ T8132] do_syscall_64+0x123/0x790 [ 121.043084][ T8132] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.043103][ T8132] RIP: 0033:0x7f13b799e559 [ 121.043120][ T8132] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 121.043138][ T8132] RSP: 002b:00007f13b88bb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 121.043167][ T8132] RAX: ffffffffffffffda RBX: 00007f13b7c25fa0 RCX: 00007f13b799e559 [ 121.043179][ T8132] RDX: 0000000000000094 RSI: 0000200000001800 RDI: 0000000000000005 [ 121.043191][ T8132] RBP: 00007f13b88bb090 R08: 0000000000000000 R09: 0000000000000000 [ 121.043203][ T8132] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 121.043215][ T8132] R13: 00007f13b7c26038 R14: 00007f13b7c25fa0 R15: 00007ffe882c4698 [ 121.043241][ T8132] [ 121.097499][ T8134] netlink: 8 bytes leftover after parsing attributes in process `syz.0.836'. [ 121.105935][ T8134] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 121.162100][ T8138] netlink: 4 bytes leftover after parsing attributes in process `syz.0.837'. [ 121.217496][ T5718] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 121.249795][ T5718] usb 8-1: device descriptor read/8, error -71 [ 121.357618][ T5718] usb usb8-port1: unable to enumerate USB device [ 121.853102][ T42] kauditd_printk_skb: 15 callbacks suppressed [ 121.853177][ T42] audit: type=1400 audit(1792416007.940:581): avc: denied { watch watch_reads } for pid=8144 comm="syz.1.840" path="/221" dev="tmpfs" ino=1204 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 121.864404][ T8145] tmpfs: Unknown parameter '0x000000000000000b ' [ 121.864411][ T42] audit: type=1400 audit(1792416007.950:582): avc: denied { mounton } for pid=8144 comm="syz.1.840" path="/syzcgroup/unified/syz1" dev="configfs" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 121.869114][ T8145] IPv6: syztnl0: Disabled Multicast RS [ 122.110472][ T5734] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 122.110653][ T8152] netlink: 'syz.0.842': attribute type 16 has an invalid length. [ 122.110666][ T8152] netlink: 'syz.0.842': attribute type 17 has an invalid length. [ 122.127126][ T8152] bridge_slave_0: left promiscuous mode [ 122.920902][ T42] audit: type=1400 audit(1792416009.010:583): avc: denied { write } for pid=8156 comm="syz.3.844" name="cluster" dev="configfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 122.921225][ T42] audit: type=1400 audit(1792416009.010:584): avc: denied { add_name } for pid=8156 comm="syz.3.844" name="ocfs2" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 122.921525][ T42] audit: type=1400 audit(1792416009.010:585): avc: denied { create } for pid=8156 comm="syz.3.844" name="ocfs2" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 122.927983][ T42] audit: type=1400 audit(1792416009.020:586): avc: denied { write } for pid=8156 comm="syz.3.844" name="heartbeat" dev="configfs" ino=25361 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 123.691873][ T8170] netlink: 12 bytes leftover after parsing attributes in process `syz.3.849'. [ 123.694153][ T8170] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 123.695986][ T42] audit: type=1400 audit(1792416009.780:587): avc: denied { connect } for pid=8169 comm="syz.3.849" lport=135 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 123.701420][ T42] audit: type=1400 audit(1792416009.790:588): avc: denied { mounton } for pid=8169 comm="syz.3.849" path="/230/dev" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 123.799652][ T8170] /dev/sr0: Can't open blockdev [ 123.843084][ T8173] tipc: Started in network mode [ 123.843107][ T8173] tipc: Node identity fe800000000000000000000000000013, cluster identity 4711 [ 123.844399][ T8173] tipc: Enabled bearer , priority 10 [ 123.845816][ T8173] tipc: Enabled bearer , priority 10 [ 124.848799][ T5718] tipc: Node number set to 4269801491 [ 125.891201][ T5718] usb 7-1: USB disconnect, device number 13 [ 125.898227][ T5718] Unregistered device Abilis Systems DVB-Titan [ 125.899106][ T5718] as10x_usb: device has been disconnected [ 125.912473][ T8151] ================================================================== [ 125.912481][ T8151] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x4f3/0x5d0 [ 125.912529][ T8151] Read of size 4 at addr ffff88802ef5383c by task syz.0.842/8151 [ 125.912540][ T8151] [ 125.912559][ T8151] CPU: 2 UID: 0 PID: 8151 Comm: syz.0.842 Tainted: G L syzkaller #0 PREEMPT(full) [ 125.912583][ T8151] Tainted: [L]=SOFTLOCKUP [ 125.912590][ T8151] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 125.912602][ T8151] Call Trace: [ 125.912619][ T8151] [ 125.912628][ T8151] dump_stack_lvl+0x100/0x190 [ 125.912679][ T8151] print_report+0x13d/0x4b0 [ 125.912709][ T8151] ? __virt_addr_valid+0x239/0x430 [ 125.912737][ T8151] ? dvb_frontend_release+0x4f3/0x5d0 [ 125.912749][ T8151] kasan_report+0xdf/0x1c0 [ 125.912806][ T8151] ? dvb_frontend_release+0x4f3/0x5d0 [ 125.912821][ T8151] dvb_frontend_release+0x4f3/0x5d0 [ 125.912834][ T8151] ? __pfx_dvb_frontend_release+0x10/0x10 [ 125.912847][ T8151] __fput+0x400/0xb60 [ 125.912883][ T8151] task_work_run+0x150/0x240 [ 125.912900][ T8151] ? __pfx_task_work_run+0x10/0x10 [ 125.912918][ T8151] ? do_raw_spin_unlock+0x145/0x1e0 [ 125.912943][ T8151] do_exit+0x8da/0x2a60 [ 125.912968][ T8151] ? __pfx_do_exit+0x10/0x10 [ 125.912989][ T8151] ? do_raw_spin_lock+0x128/0x260 [ 125.913009][ T8151] ? find_held_lock+0x2b/0x80 [ 125.913035][ T8151] ? get_signal+0x7e0/0x21e0 [ 125.913056][ T8151] do_group_exit+0xd5/0x2a0 [ 125.913078][ T8151] get_signal+0x1ec7/0x21e0 [ 125.913101][ T8151] ? putname+0xb1/0x110 [ 125.913117][ T8151] ? __pfx_get_signal+0x10/0x10 [ 125.913136][ T8151] ? putname+0xb6/0x110 [ 125.913151][ T8151] arch_do_signal_or_restart+0x91/0x7e0 [ 125.913180][ T8151] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 125.913209][ T8151] ? __x64_sys_openat+0x12d/0x210 [ 125.913230][ T8151] exit_to_user_mode_loop+0x139/0x700 [ 125.913253][ T8151] ? rcu_is_watching+0x13/0xc0 [ 125.913269][ T8151] do_syscall_64+0x661/0x790 [ 125.913300][ T8151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.913312][ T8151] RIP: 0033:0x7f13b795ed8e [ 125.913320][ T8151] Code: Unable to access opcode bytes at 0x7f13b795ed64. [ 125.913332][ T8151] RSP: 002b:00007f13b88bab28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 125.913344][ T8151] RAX: 0000000000000004 RBX: 00007f13b88bb6c0 RCX: 00007f13b795ed8e [ 125.913350][ T8151] RDX: 0000000000040000 RSI: 00007f13b88bac00 RDI: ffffffffffffff9c [ 125.913357][ T8151] RBP: 00007f13b88bac00 R08: 0000000000000000 R09: 0000000000000000 [ 125.913364][ T8151] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 125.913370][ T8151] R13: 00007f13b7c26038 R14: 00007f13b7c25fa0 R15: 00007ffe882c4698 [ 125.913381][ T8151] [ 125.913385][ T8151] [ 125.913388][ T8151] Allocated by task 1: [ 125.913400][ T8151] kasan_save_stack+0x30/0x50 [ 125.913414][ T8151] kasan_save_track+0x14/0x30 [ 125.913426][ T8151] __kasan_kmalloc+0xaa/0xb0 [ 125.913438][ T8151] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 125.913450][ T8151] dvb_register_device+0x1d6/0x1e20 [ 125.913467][ T8151] dvb_register_frontend+0x552/0x820 [ 125.913479][ T8151] vidtv_bridge_probe+0x44b/0xa30 [ 125.913506][ T8151] platform_probe+0x106/0x1d0 [ 125.913524][ T8151] really_probe+0x241/0xa60 [ 125.913532][ T8151] __driver_probe_device+0x210/0x460 [ 125.913541][ T8151] driver_probe_device+0x4a/0x140 [ 125.913549][ T8151] __driver_attach+0x21f/0x5b0 [ 125.913557][ T8151] bus_for_each_dev+0x13e/0x1d0 [ 125.913570][ T8151] bus_add_driver+0x305/0x5b0 [ 125.913583][ T8151] driver_register+0x1e2/0x360 [ 125.913592][ T8151] vidtv_bridge_init+0x52/0x80 [ 125.913611][ T8151] do_one_initcall+0x11c/0x6f0 [ 125.913622][ T8151] kernel_init_freeable+0x6ea/0x7b0 [ 125.913642][ T8151] kernel_init+0x21/0x1e0 [ 125.913651][ T8151] ret_from_fork+0x730/0xd60 [ 125.913662][ T8151] ret_from_fork_asm+0x1a/0x30 [ 125.913672][ T8151] [ 125.913674][ T8151] Freed by task 8151: [ 125.913679][ T8151] kasan_save_stack+0x30/0x50 [ 125.913691][ T8151] kasan_save_track+0x14/0x30 [ 125.913704][ T8151] kasan_save_free_info+0x3b/0x70 [ 125.913713][ T8151] __kasan_slab_free+0x5f/0x80 [ 125.913726][ T8151] kfree+0x22b/0x6d0 [ 125.913735][ T8151] dvb_device_put.part.0+0x57/0x90 [ 125.913746][ T8151] dvb_generic_release+0xe2/0x160 [ 125.913758][ T8151] dvb_frontend_release+0x13d/0x5d0 [ 125.913770][ T8151] __fput+0x400/0xb60 [ 125.913783][ T8151] task_work_run+0x150/0x240 [ 125.913798][ T8151] do_exit+0x8da/0x2a60 [ 125.913809][ T8151] do_group_exit+0xd5/0x2a0 [ 125.913821][ T8151] get_signal+0x1ec7/0x21e0 [ 125.913831][ T8151] arch_do_signal_or_restart+0x91/0x7e0 [ 125.913846][ T8151] exit_to_user_mode_loop+0x139/0x700 [ 125.913858][ T8151] do_syscall_64+0x661/0x790 [ 125.913872][ T8151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.913881][ T8151] [ 125.913884][ T8151] The buggy address belongs to the object at ffff88802ef53800 [ 125.913884][ T8151] which belongs to the cache kmalloc-256 of size 256 [ 125.913892][ T8151] The buggy address is located 60 bytes inside of [ 125.913892][ T8151] freed 256-byte region [ffff88802ef53800, ffff88802ef53900) [ 125.913901][ T8151] [ 125.913904][ T8151] The buggy address belongs to the physical page: [ 125.913909][ T8151] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2ef52 [ 125.913918][ T8151] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 125.913925][ T8151] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 125.913935][ T8151] page_type: f5(slab) [ 125.913944][ T8151] raw: 00fff00000000040 ffff88801d042b40 dead000000000100 dead000000000122 [ 125.913953][ T8151] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 125.913962][ T8151] head: 00fff00000000040 ffff88801d042b40 dead000000000100 dead000000000122 [ 125.913971][ T8151] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 125.913980][ T8151] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 125.913989][ T8151] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 125.913995][ T8151] page dumped because: kasan: bad access detected [ 125.914000][ T8151] page_owner tracks the page as allocated [ 125.914003][ T8151] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8261163476 [ 125.914019][ T8151] post_alloc_hook+0xfd/0x120 [ 125.914029][ T8151] get_page_from_freelist+0x110d/0x35d0 [ 125.914040][ T8151] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 125.914051][ T8151] new_slab+0xa9/0x6e0 [ 125.914060][ T8151] refill_objects+0xe3/0x410 [ 125.914070][ T8151] __pcs_replace_empty_main+0x35e/0x650 [ 125.914080][ T8151] __kmalloc_cache_noprof+0x4f4/0x6d0 [ 125.914090][ T8151] bus_add_driver+0x92/0x5b0 [ 125.914103][ T8151] driver_register+0x1e2/0x360 [ 125.914113][ T8151] usb_register_driver+0x21c/0x3e0 [ 125.914141][ T8151] do_one_initcall+0x11c/0x6f0 [ 125.914151][ T8151] kernel_init_freeable+0x6ea/0x7b0 [ 125.914162][ T8151] kernel_init+0x21/0x1e0 [ 125.914171][ T8151] ret_from_fork+0x730/0xd60 [ 125.914182][ T8151] ret_from_fork_asm+0x1a/0x30 [ 125.914192][ T8151] page_owner free stack trace missing [ 125.914195][ T8151] [ 125.914198][ T8151] Memory state around the buggy address: [ 125.914202][ T8151] ffff88802ef53700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 125.914209][ T8151] ffff88802ef53780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 125.914216][ T8151] >ffff88802ef53800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 125.914221][ T8151] ^ [ 125.914227][ T8151] ffff88802ef53880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 125.914234][ T8151] ffff88802ef53900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 125.914239][ T8151] ================================================================== [ 125.916666][ T8151] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 126.160149][ T8151] CPU: 2 UID: 0 PID: 8151 Comm: syz.0.842 Tainted: G L syzkaller #0 PREEMPT(full) [ 126.164012][ T8151] Tainted: [L]=SOFTLOCKUP [ 126.165616][ T8151] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 126.169150][ T8151] Call Trace: [ 126.170385][ T8151] [ 126.171485][ T8151] dump_stack_lvl+0x100/0x190 [ 126.173274][ T8151] vpanic+0x553/0x970 [ 126.174747][ T8151] ? __pfx_vpanic+0x10/0x10 [ 126.176425][ T8151] ? rcu_is_watching+0x13/0xc0 [ 126.178202][ T8151] ? dvb_frontend_release+0x4f3/0x5d0 [ 126.179760][ T8151] panic+0xd1/0xe0 [ 126.180815][ T8151] ? __pfx_panic+0x10/0x10 [ 126.182079][ T8151] ? dvb_frontend_release+0x4f3/0x5d0 [ 126.183578][ T8151] ? preempt_schedule_common+0x3c/0xb0 [ 126.185117][ T8151] check_panic_on_warn.cold+0x19/0x34 [ 126.186648][ T8151] end_report.part.0+0x3a/0x90 [ 126.187998][ T8151] kasan_report.cold+0xe/0x18 [ 126.189348][ T8151] ? dvb_frontend_release+0x4f3/0x5d0 [ 126.190860][ T8151] dvb_frontend_release+0x4f3/0x5d0 [ 126.192307][ T8151] ? __pfx_dvb_frontend_release+0x10/0x10 [ 126.193927][ T8151] __fput+0x400/0xb60 [ 126.195086][ T8151] task_work_run+0x150/0x240 [ 126.196435][ T8151] ? __pfx_task_work_run+0x10/0x10 [ 126.197875][ T8151] ? do_raw_spin_unlock+0x145/0x1e0 [ 126.199327][ T8151] do_exit+0x8da/0x2a60 [ 126.200516][ T8151] ? __pfx_do_exit+0x10/0x10 [ 126.201839][ T8151] ? do_raw_spin_lock+0x128/0x260 [ 126.203255][ T8151] ? find_held_lock+0x2b/0x80 [ 126.204594][ T8151] ? get_signal+0x7e0/0x21e0 [ 126.205944][ T8151] do_group_exit+0xd5/0x2a0 [ 126.207203][ T8151] get_signal+0x1ec7/0x21e0 [ 126.208480][ T8151] ? putname+0xb1/0x110 [ 126.209651][ T8151] ? __pfx_get_signal+0x10/0x10 [ 126.211022][ T8151] ? putname+0xb6/0x110 [ 126.212196][ T8151] arch_do_signal_or_restart+0x91/0x7e0 [ 126.213768][ T8151] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 126.215517][ T8151] ? __x64_sys_openat+0x12d/0x210 [ 126.216949][ T8151] exit_to_user_mode_loop+0x139/0x700 [ 126.218439][ T8151] ? rcu_is_watching+0x13/0xc0 [ 126.219792][ T8151] do_syscall_64+0x661/0x790 [ 126.221105][ T8151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.222761][ T8151] RIP: 0033:0x7f13b795ed8e [ 126.224011][ T8151] Code: Unable to access opcode bytes at 0x7f13b795ed64. [ 126.225947][ T8151] RSP: 002b:00007f13b88bab28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 126.228249][ T8151] RAX: 0000000000000004 RBX: 00007f13b88bb6c0 RCX: 00007f13b795ed8e [ 126.230468][ T8151] RDX: 0000000000040000 RSI: 00007f13b88bac00 RDI: ffffffffffffff9c [ 126.232696][ T8151] RBP: 00007f13b88bac00 R08: 0000000000000000 R09: 0000000000000000 [ 126.234872][ T8151] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 126.237047][ T8151] R13: 00007f13b7c26038 R14: 00007f13b7c25fa0 R15: 00007ffe882c4698 [ 126.239226][ T8151] [ 126.240779][ T8151] Kernel Offset: disabled [ 126.241988][ T8151] Rebooting in 86400 seconds.. VM DIAGNOSIS: 13:20:12 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000000 RBX=8000000049e88007 RCX=0000000000000002 RDX=ffff8880269ccb00 RSI=ffffffff82629e1c RDI=ffff888027d05540 RBP=1ffff92000909e8e RSP=ffffc9000484f470 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000001 R12=ffff888027d05540 R13=000000000000c00c R14=ffff888037d10438 R15=ffffea000127a200 RIP=ffffffff82629e1c RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00005555585d0500 ffffffff 00c00000 GS =0000 ffff8880d4946000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007fd4d25556c8 CR3=000000002faa9000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000001000000 Opmask01=0000000001000001 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 6576697372756365 725f64656772656d ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffce1c2cd36 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffce1c2cd36 00007ffce1c2cd3c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd4d1836102 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd4d183613c ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd4d18362a0 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd4d183612e ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000048 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000048 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000080080783 RBX=0000000000000000 RCX=ffff88802c4dd1b0 RDX=000000000000009d RSI=ffffffff8708de11 RDI=ffff88802c4dd420 RBP=0000000000000001 RSP=ffffc900006a0ba8 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000001 R12=0000000000000000 R13=0000000000004e20 R14=ffff88802c4dd1b0 R15=0000000000000001 RIP=ffffffff8708de58 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 00007fd7f9a0b300 ffffffff 00c00000 GS =0000 ffff8880d4a46000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f80b89556c8 CR3=000000003cd07000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000feffc200 Opmask01=000000000000ffff Opmask02=00000000ffffffff Opmask03=0000000000001000 Opmask04=0000000000000000 Opmask05=00000000004007ff Opmask06=0000000007ffe7ff Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0354000000020000 0008000400080010 00080000000c0200 0000000000080008 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0014010000000000 000800080007000c 00080000000c0000 00c4000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0349000000200000 0001000000100008 0000000000000004 000c001a00100000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000c0000000a0004 0008000f0010000a 0000000000000100 0000000000260000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000cffffffea0000 03e6000000080004 0000000800080000 0034000000180000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0002000000000000 0000000000000000 00de00000000ee1e dcc0000000180000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00200000000e0014 000c000000080004 0020000e00000000 0000000000000000 ZMM24=fa8b6bfdfa8b6bfd fa8b6bfdfa8b6bfd fa8b6bfdfa8b6bfd fa8b6bfdfa8b6bfd fa8b6bfdfa8b6bfd fa8b6bfdfa8b6bfd fa8b6bfdfa8b6bfd fa8b6bfdfa8b6bfd ZMM25=1998d9d51998d9d5 1998d9d51998d9d5 1998d9d51998d9d5 1998d9d51998d9d5 1998d9d51998d9d5 1998d9d51998d9d5 1998d9d51998d9d5 1998d9d51998d9d5 ZMM26=eb2e593beb2e593b eb2e593beb2e593b eb2e593beb2e593b eb2e593beb2e593b eb2e593beb2e593b eb2e593beb2e593b eb2e593beb2e593b eb2e593beb2e593b ZMM27=12a976e212a976e2 12a976e212a976e2 12a976e212a976e2 12a976e212a976e2 12a976e212a976e2 12a976e212a976e2 12a976e212a976e2 12a976e212a976e2 ZMM28=000000100000000f 0000000e0000000d 0000000c0000000b 0000000a00000009 0000000800000007 0000000600000005 0000000400000003 0000000200000001 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=6a0800006a080000 6a0800006a080000 6a0800006a080000 6a0800006a080000 6a0800006a080000 6a0800006a080000 6a0800006a080000 6a0800006a080000 info registers vcpu 2 CPU#2 RAX=0000000000000039 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85b2d115 RDI=ffffffff9cc7e6a0 RBP=ffffffff9cc7e660 RSP=ffffc900016ff1f0 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=0000000035313854 R12=0000000000000000 R13=0000000000000039 R14=0000000000000007 R15=ffffc900016ff508 RIP=ffffffff85b2d13f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d4b46000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f2a181556c8 CR3=0000000027bd5000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000001000000 Opmask01=0000000001000001 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 6576697372756365 725f64656772656d ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fffef212626 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fffef212626 00007fffef21262c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f2a17436102 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f2a1743613c ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f2a174362a0 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f2a1743612e ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000000a0 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 0000000000000000 0000000000000000 00000000000000a0 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=00000000de5e3355 RBX=0000000000000007 RCX=ffffffffffffffe8 RDX=00007f13b795ed8e RSI=00007f13b88ba280 RDI=0000000000000007 RBP=00007f13b7a35ad8 RSP=00007f13b88ba260 R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000246 R12=0000000000000000 R13=00007f13b7c26038 R14=00007f13b7c25fa0 R15=00007ffe882c4698 RIP=00007f13b7853ce4 RFL=00000286 [--S--P-] CPL=3 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c01300 CS =0033 0000000000000000 ffffffff 00a0fb00 DPL=3 CS64 [-RA] SS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 00007f13b88bb6c0 ffffffff 00c00000 GS =0000 0000000000000000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f2a173ebc40 CR3=000000005922f000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000