last executing test programs: 3.369447812s ago: executing program 0 (id=296): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async, rerun: 64) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64) read$FUSE(0xffffffffffffffff, &(0x7f0000000140)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmsg$nl_netfilter(r1, &(0x7f0000003680)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000003640)={&(0x7f0000002180)={0x4bc, 0x11, 0xa, 0x101, 0x70bd2d, 0x25dfdbfc, {0x5, 0x0, 0x5}, [@nested={0x270, 0xb3, 0x0, 0x1, [@generic="0ae565d2dcfe627070763120e8021c054e9c932ebad7feec9c587b93580acd3cfe1967d876035889078f9636f9e15ab1c4632d14bbddac45dfc9933ac15fe2cca91f276d6a320814d07b936b131ed9d6c4c5b8433c6cc621964431542a1ba8ce7fd803", @nested={0x4, 0x143}, @generic="8a21ef5e0d8abc3a805354b4a12a3f958210555f2955604ae5bdeb56ee551038011264fdb9a15a677e185d833c35192632f93f38464b74021722ba9c08f24f5f72cf5a15ba1a413c747b29b79d3963c683ce37fad963b909a4d87fedfea94e9a1257c41041d5cc7adb6e941f2e7db326c592738df27a114a1b33994d8de76ab362cc88857136f8ed1e61f6e3003e5364233c6a8018b9138add119f29398ec3c194f44ae7f29a78cc63b8eee9d3bdd426294f56bc8165b24a94784951920c0795ef285f8b4fdc7430a4784ec00074429c926072a068f608b4c1feb14e41980f97b90d54654ddf65a0ee041617c855ecf792a18cec1248", @generic="c41d5b4e6e1b43254ea250d55a792931289e0886fd5f2d372782bc8ee4083b018d20da204d39eb0d907ca7e6cd3007ac3fdf3411d48d0355bddd0f7b07f747882f8302115976f4af1caa8973d7e595d01a8a2b968b6589db482e5d2e51a27b0bdb5cd027a84bca6d70d6684c6a8f7d7bc647b73fa1bc6c216fd7f400e6fd3002913ef714a69603ae20e5433f5168692e13099502936e0ab45543", @generic="0e4199aacf6bfbf7ed2e2aa15b5ee9ffa7f2662d558e7618d8f2281ddd3362c18875f8961acf143bb1ed49eb7bfaf4071eb52c3813c520be3e158ea6d5f7543f71d5d3e45385817f780a326c5fb4a171e24501ee3392b14c7d7469950cb7d5bd5597c0d606321d16f180264d79", @nested={0x4, 0xb6}, @nested={0x4, 0xea}]}, @nested={0x14, 0x11e, 0x0, 0x1, [@nested={0x4, 0x21}, @typed={0x8, 0x76, 0x0, 0x0, @pid=r2}, @nested={0x4, 0x1}]}, @typed={0x5, 0x5f, 0x0, 0x0, @str='\x00'}, @nested={0x9a, 0xa5, 0x0, 0x1, [@nested={0x4, 0x12}, @generic="6c90955b4d7c4960157a2c2dccc8fdee582c8eb4537f8be9b0118752f2e0d90f6afe6417aa82bdc2616da45fbe71fd629c34c1a3094bcae51b5338c5b3ea49ec2d1f092f3c63e48db6494cc862777fbc796e7505523ae9c686a0ac8a72a0e2172b472e4d2d9036cac754c3d5e49b479dec776db4fbc057a0176c20750d1269b47cfe524d8ab8", @typed={0x8, 0x130, 0x0, 0x0, @pid=r2}, @nested={0x4, 0xec}]}, @generic="82b019c55db156b8b6d8978ce8a156e83a5d924acd21600962fc2fbb840574d6e0bf7ca61aaed8f4c5ef87a8b09fe09c5d913f869c1b7c284f0dc440d8f10507fd778dda61037d9e0954d32822899dc923049af04cdf5d8243fee3d2b3cabee5f2f34106c1cd74169f5716f7640274560abf0e830233702274052fda80829ac6a9ee7ae9c3fbd5b200a88fb2347965f7314615a7337e9af6ab6e82aa6adcd862cdd5f511feae1463d9862bcaff414c2978399c", @typed={0x8, 0x7d, 0x0, 0x0, @pid=0xffffffffffffffff}, @nested={0xc2, 0x1c, 0x0, 0x1, [@generic="74759b8041a9a533949385613aa5f758d0ae26a31b99d5af4b7f291ffc1ed5a8890300f796a71951776f57be108b289e4fec9002f400d2ee0dfd6b059fecd48c6c45c9abc71f11bcabd646c238efe5e35938eacda4af063c8e59af8c542d753c71f9f77020b0f8087855ec1e74c0e7e10a85e162bd5e99e4ca5802fe7586329df9766d9f157c2a09e6af720a94016b6e3803e8cd25b88ae1a924c9afdfb7991f81f86d379d997dd9249ee0543fc9b3d062ce4f52ae25b0517616", @nested={0x4, 0x62}]}]}, 0x4bc}, 0x1, 0x0, 0x0, 0x8000}, 0x1004) (async) ioctl$SOUND_OLD_MIXER_INFO(r0, 0x80304d65, &(0x7f0000000100)) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) 3.16950487s ago: executing program 0 (id=298): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22903) r1 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r1, 0x0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x1002f6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe700, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x74a0, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40000001, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x2000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000001c0)={'pim6reg1\x00', 0x1000}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, 0x0, 0x4000) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="12010102d1a05e20cd0c02010e89010203010902120001085440010904"], &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r3 = syz_open_dev$I2C(&(0x7f0000000140), 0x2, 0x48842) ioctl$I2C_TENBIT(r3, 0x704, 0x1) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0x5012, 0x0, 0x0, 0x0, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0) ioctl$I2C_SMBUS(r3, 0x720, &(0x7f00000000c0)={0x1, 0x9, 0x3, &(0x7f0000000080)={0x5f, "a1f6c56c9eee0308b1d595f1b16a238692192584860094e000"}}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0xbf, 0xc0006, 0x0, 0x0, 0x0, 0x4a9e47b3, 0xffffff3e, 0x0, 0x6}) r4 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x300000b, 0x12, r4, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0xc877, 0x80, 0x2, 0x27e}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r8, r9, r10, &(0x7f00000005c0)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x50, 0x0, r6, 0x0, 0x0, 0x0, 0x40000000}) r11 = socket$rds(0x15, 0x5, 0x0) setsockopt$sock_int(r11, 0x1, 0x3c, &(0x7f0000000080)=0x1, 0x4) bind$rds(r11, &(0x7f0000000100)={0x2, 0x4e29, @local}, 0x10) sendmsg$rds(r11, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @remote}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000300)=""/4, 0x4}], 0x1, &(0x7f0000000240)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x42}], 0xfffffe5d}, 0x4000000) syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000180)=@any_dev={0x4, 0x94a, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r7, 0x18, &(0x7f0000000080)={0x9, 0xffffffffffffffff, 0x9, {0xfff, 0x7ff}}, 0x1) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000000)="114353012008ba00000037510800", 0xe, 0x4008015, &(0x7f00000000c0)={0x11, 0xe5, r12, 0x1, 0x6, 0x6, @broadcast}, 0x14) 2.809099942s ago: executing program 3 (id=305): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x406, r0) write$tun(r1, &(0x7f0000000000)=ANY=[], 0xa2) read$FUSE(r1, 0x0, 0x5700) 2.808668788s ago: executing program 3 (id=306): openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x40, 0x16f) execve(&(0x7f0000000140)='./file0\x00', 0x0, &(0x7f0000000180)={[&(0x7f0000000000)='\x00', &(0x7f0000000080)='.\x00', &(0x7f00000000c0)='\x00\x00\x00\x00', &(0x7f00000005c0)='{]B_\a\x03\x19+,\x02n\xc6\x9e5\xd6\xcf\xa2\x1e\xa7\n\xe1\xbfHM\x9c\xc6\x80\n\x18W#^\xfb\x11c\xc9w#\xc0\f\x1e\x8fB\xa6\x94\xa1\xb9\xb5\xadv\xab\xc8\xe7\xca\xa6c\xe5S|\xcc\xf8\xf5\xb5}\x85\xd9`&\xde\xf2%\xecP\xb4y\xc2Gif\x9dh\xad\x1a\x9da[\x83\xab\x02\xf5>\xdb\xfe\x05\x8eOm[\a\xea\xaf\xfd{p\xed\x90~\xea\xa5\xa3\xcd-\xdf<\x8d\xe7t\x8f\x06\xe5\x03\x00\x00\x00\x00\x00\x00\x00{\xc0r\xb2\'Y`\x99\xef\f\xb0kR\x0f\"r\xd9\x8f\xf3B\xd7\x1b\x82\xf8oXd\xf0\xce3\xe2.\xa4\x14\xc8(\x10\x02\x8bm\x1a\xeft\xf7\xd4\xa2\xae%pp\x19\x1b\xa5\xab\xc2A\x9a\x01\xc6\x7f\x1da\xdcmPD\xc2\x02J\xc0@7s=\xb2F=\xea\xbeOf\x0e<\x8f\xf8\x9f\xdd\xdd[\xdfF\x11\x11\x93`\x95\xec\x10\a)\x85\xab\\\x11\xc3\xe76}Wr\x02\"\xca\x15L<\xca\xd8\xfa`\xcaj\x170x0, &(0x7f00000000c0), &(0x7f0000000180)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) syz_io_uring_setup(0x51ef, &(0x7f0000000400)={0x0, 0x5961, 0x0, 0xfffffffc, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_SENDMSG={0x9, 0x8, 0x0, r1, 0x0, &(0x7f0000000640)={0x0, 0x0, 0x0}, 0x0, 0x48840}) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f00000017c0)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x2007, @fd_index=0x5, 0xc, &(0x7f0000000140)=[{&(0x7f0000002080)=""/4096, 0x1000}], 0x1, 0x4, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit$UBLK(r0, r3, r7, &(0x7f0000000200)=@ublk_get_queue_affinity_sqe={0x2e, 0x21, 0x0, 0xffffffffffffffff, 0x80207501, 0x0, 0x0, 0x0, 0x1, 0xd7b, 0x0, r8, '\x00', {0x0, 0xffff, 0x8, &(0x7f00000001c0)}}) 1.90865453s ago: executing program 1 (id=326): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000001000)={0x6, 0xc, &(0x7f00000010c0)=@raw=[@generic={0xb7, 0x7}, @generic={0x7b, 0xa, 0x7, 0xfff0}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x3, 0x0, 0x0, 0xc}, @generic={0xb7, 0x4}, @generic={0xb7, 0x5}, @generic={0x85, 0x0, 0x0, 0x0, 0x63}, @generic={0x15, 0x0, 0x0, 0x2}, @generic={0xbf, 0x1}, @generic={0x85, 0x0, 0x0, 0x0, 0x56}, @generic={0x95}], &(0x7f00000011c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r0, 0x0, 0xe, 0x0, &(0x7f0000002280)="0011223344550011223344560800", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_emit_ethernet(0xfdef, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xfde1, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0xfdcd, 0x0, @wg=@data}}}}}, 0x0) 1.908483523s ago: executing program 1 (id=327): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_INIT(r0, 0x29, 0xc8, &(0x7f00000002c0), 0x4) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x2, 0x6, 0x475f1e72b322f312, 0x0, 0x0, {0x7, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x44}, 0x4880) 1.839775832s ago: executing program 3 (id=328): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYRESOCT=r0, @ANYRES16=r0, @ANYRESDEC=r0], &(0x7f0000000140)='GPL\x00', 0x3a, 0x0, 0x0, 0x41000}, 0x94) r2 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r1}, 0x8) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r3, @ANYBLOB="0100000002"], 0x40) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', 0x0, 0x2, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0xe8302, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000700)={[0x90b, 0x3, 0xfffffffffffffffa, 0x86, 0x2000100001, 0x0, 0x2004c8, 0x5, 0x100000004, 0x0, 0x7, 0xfffbfffffffff639, 0x5, 0x0, 0x2], 0xffff1000}) ioctl$KVM_RUN(r7, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000340)=[@text64={0x40, &(0x7f00000002c0)="b805000000b9000000000f01c1c4416959e766bad104ec2e360fc7ac050f57000066410f50d92e2644f4c461915553250fc7bc0800300000c7442400c4000000c74424020bc4bc91ff1c24c4e17950f8", 0x50}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r7, 0x4048ae9b, &(0x7f0000000240)={0x20003, 0x0, {[0x9, 0xc9, 0xf3, 0xc0, 0x7, 0xab, 0xd0f0, 0x2]}}) ioctl$KVM_RUN(r7, 0xae80, 0x0) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x601, 0x0) chdir(&(0x7f0000000140)='./bus\x00') open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) getxattr(&(0x7f0000000340)='./file1\x00', &(0x7f00000003c0)=@known='system.posix_acl_access\x00', 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001c00)={{r4, 0xffffffffffffffff}, &(0x7f0000001b80), &(0x7f0000001bc0)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r8}, &(0x7f00000001c0), &(0x7f0000000400)=r1}, 0x20) 1.838630271s ago: executing program 1 (id=329): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x1b7c, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000980)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000002d030100000000009500000c000000006926000000000000bf67000000000000150600000fff07ffd7060000400000006a0200000ee60000bf050000000000003d35f3ff000000006507000002000000070700004a0000000f75000000000000bf54000000000000070400000400f9ff6d53010000000000840400000000000073720000000000009500000000000000db13d5d8b741f2cdaabc8383caf56b8c2b84a8d09535a157f9005bd38addaa65b925cd3ded85d3cdd66d9c79f0529d045625b8b9e2a095d2c51ef45c5588ec78c7f32946b17cecfe54c53ab530c58b67851b7e0e82452a083b98a6aa766401047d150203b0417edef332233b081df18961d6822d133bf72a4de1c2ea17f04537fc211576846ac629d1d93265ba474580047a9dc88de358ce795731891a2031de4e09740c64e5306f991ed4785a9773a433e0db9c1a7d4ab9d658ce9cfdb4db3bed62bcb2bc91ddcdfac2e6d4421c49fb6641cbf56914e76702f673b586c700e3806f825f1d0da2a304e06543b56d35235d7897a7fe912971aab876022e96f5143b6234f5a6b701690b07fb664b44e22b72e843e7cf55f394cf75d1cd57c9150bfb98cc45b3fde43e42e150d4a2fddd9a9767748ca3522443097c55dc97c09d38485b18ad2cff787338bab324336f50c97b751f2ed2c4281858b428d1b2c1194b06f9bb7ffcc95c1bcfc5540f9574f20e7f513a2a7c5dad90e7d479724d69fa0c0bf97af1231a49ea166f743279d240e2e6f01d8704f313d68b16198be5f6a50e9e0fd20893b2922df566d2622edee5000000000000000000d91c6da09fa7cdbbf16d4780d8c2401c55aff772aced3ff966ff76d796c171f5f7a31e1b14b0c0c712c0fdd2710f37a3d15710d68e7326a7db043c57784bd9bdb047db75"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x200, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x1}, {0x0, 0x2}}}, 0x24}}, 0x4004045) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)) r2 = socket$inet(0x2, 0x80001, 0x84) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/netfilter\x00') getdents64(r3, &(0x7f0000000240)=""/44, 0x7a) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x4008855}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000440)={r3, r3, 0x8, 0xc7, &(0x7f0000000340)="648b69a030cd42b2c55258beff128f82814f9f2e4b256b5d90d2a71fa85ad896ada18b460bd2e72a4da256a442f98ee10fb3eaf6a6cd7cc1dad9d457563ec95c58bde1c38d83d875b93de63cf582a3b55571505f21fa8e6d7b3b201faa1a5783381e786a25a407821147bf6485c4597ace9ed16543ed568b9085bf54abcf57933fc1a6f5ece68c6deec3ae2f9f9e13df2a9b6d7f5ab60b37aec6771d782aaaaef10e532ae1f2c31b4cc4f5cef20dcf36d07bef0d91c023335016411e5bb2bb3e749a6255bada4b", 0x4, 0xfc, 0x7, 0xe5b7, 0x2, 0x1, 0x0, 'syz0\x00'}) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000012000000000000000000000000a44000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000018000480140003007465616d5f736c6176655f3100000000140000001100010000000000000000000000000a"], 0x6c}, 0x1, 0x0, 0x0, 0x20040845}, 0x802) sendmsg$NFT_BATCH(r4, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="14000000100001f500000000000000000100000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}, 0x1, 0x0, 0x0, 0x2004c040}, 0xc050) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)="163280", 0x3}], 0x1) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="041817aaaaaaaaaa10e8fad507b2c422b6ffa902c586"], 0x1a) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1.759511294s ago: executing program 0 (id=330): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x13101}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_INDEX={0x8, 0x15, 0x2bb60}]}}}]}, 0x40}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) bind$l2tp6(0xffffffffffffffff, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="0408"], 0xa) 1.25852234s ago: executing program 1 (id=331): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x800) 1.256296828s ago: executing program 0 (id=332): mount(&(0x7f00000006c0)=@sr0, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='ext3\x00', 0x204001, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r2, &(0x7f00000002c0)="05031612d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.14013412s ago: executing program 1 (id=333): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/auth.unix.gid/channel\x00', 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000000000/0x400000)=nil) r1 = syz_open_procfs(0x0, &(0x7f0000000200)='net/protocols\x00') r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000000280)={r3, r3, 0xc, 0x1, &(0x7f0000000340)='\x00', 0xb, 0x1, 0x15c2, 0x2, 0x9, 0x2, 0x1, 'syz1\x00'}) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYRESOCT=r6, @ANYRES64=r1, @ANYBLOB="01000000010000e4835593b53dd1a200"/32, @ANYRES32=r6, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x4090}, 0x4000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000100)='./file0\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x20008044}, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x101) write(r7, &(0x7f0000000000)='3', 0x4e) mount$afs(0x0, &(0x7f0000000180)='./cgroup\x00', &(0x7f00000001c0), 0x1, &(0x7f0000000580)=ANY=[]) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) syz_emit_ethernet(0x3a, &(0x7f0000000640)=ANY=[@ANYBLOB="ffffffffffff0200000000024305000f32000000000102000000000202000000000200ff00140101001000010000000000000200000000aa0000"], 0x0) preadv(r1, &(0x7f00000001c0)=[{&(0x7f00000006c0)=""/4089, 0xff9}], 0x2, 0xc00, 0x0) socket$nl_route(0x10, 0x3, 0x0) r8 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f00000001c0)={0x9, @pix_mp={0x80000001, 0x1, 0x33424752, 0x5, 0x7, [{0x2, 0xa}, {0x9, 0x100}, {0x9, 0x1}, {0x3, 0x2}, {0x366, 0x5}, {0x9, 0x8}, {0xf6a0, 0x4}, {0x10000007, 0x5}], 0x2, 0x73, 0x3, 0x1, 0x5}}) 1.139277367s ago: executing program 0 (id=334): r0 = fsopen(&(0x7f0000000180)='hfs\x00', 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000800)={'filter\x00', 0x104, 0x4, 0x3c8, 0x110, 0x110, 0x110, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@arp={@empty, @broadcast, 0x0, 0x0, 0x0, 0x0, {@mac}, {@empty, {[0x0, 0x0, 0x0, 0xff]}}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 'dvmrp0\x00', 'netdevsim0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @empty, @dev={0xac, 0x14, 0x14, 0x41}, @rand_addr=0x64010101, 0x8, 0x1}}}, {{@arp={@loopback, @local, 0x0, 0x0, 0x0, 0x0, {@mac=@local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg0\x00', 'veth0\x00', {}, {}, 0x0, 0x20}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0x80ca, 0x8}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) (async, rerun: 64) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000080)='iocharset', &(0x7f00000000c0)='io#harset', 0x0) (rerun: 64) 1.098739505s ago: executing program 1 (id=335): bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc1105511, &(0x7f0000000040)={0xa, 0x0, 0x3d, 0x10000, 'syz1\x00', 0x5}) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\\]', @ANYRES8=r0, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d"], 0x5c}, 0x1, 0x0, 0x0, 0x2000}, 0x40090) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup(r2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000540)={'netpci0\x00', &(0x7f0000000440)=@ethtool_drvinfo={0x1d, "13000000cde403e48efcd481ffa7bb90bd80b22a53222556fc9b790f2d3a3d45", "3e00be9c93938e9f9b23eab1502bdbeddc4aec10fa878e1b7b9755a63474648a", "2bc15739a02b801e68ba8446a73ccfb0ee9082262689c6cbd7362debb8601d1e", "3d771e8033c517b4ecb49b85624ff99614ee20c02e3a8e562d3d6af1bbc9e1ca", "a29157ef062ecc5b78a56b83bdec6b4e91c6bc59e348038600", "451f950ee4d438a31a1c376c", 0x105, 0x1, 0x1000, 0x6, 0x80000000}}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 880.175831ms ago: executing program 3 (id=336): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x14, 0x27, 0x1, 0x70bd29, 0x0, {0x8, 0x1}}, 0x14}}, 0xc000) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x40902, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000140)={0x0, 0xdffffffe, 0x9, 0x0, 0x0, "810002ee0900598c44ff00be875f3c00"}) (async) r3 = syz_open_pts(r2, 0x141601) fcntl$setstatus(r3, 0x4, 0x102800) (async, rerun: 32) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000840)={'veth0_macvtap\x00', &(0x7f0000000740)=@ethtool_gstrings={0x25, 0x4}}) (rerun: 32) unshare(0x68040000) (async, rerun: 64) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000040)) (rerun: 64) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='fd\x00') statx(r4, 0x0, 0x1000, 0x10, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) (async, rerun: 32) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f00000001c0)='qnx4\x00', 0x208004, 0x0) (rerun: 32) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000000)={"b4ca223fecc139aecc5c6ae481249aaaa5f0047dfe4efe89f3c35ad941fec3e0", 0xffffffffffffffff, 0xffffffffffffffff}) fchdir(r5) (async) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000040)={0x2, 0x2383, @loopback}, 0x10) (async) connect$inet(r6, &(0x7f0000000080)={0x2, 0x2383, @loopback}, 0x10) (async) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x10, 0x0, 0x0, 0xfffffffe, '\x00', 0x0, 0x0}, 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xe, 0x6, &(0x7f0000000500)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r7}, @generic={0xb7, 0x3}, @generic={0xb7, 0x4}, @call={0x85, 0x0, 0x0, 0x34}, @exit], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@map=r7, r8, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r7, &(0x7f0000000340), &(0x7f0000000380)=@tcp=r6}, 0x20) write(r6, &(0x7f0000000700)='h', 0x1) (async) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r9, 0xffffffffffffffff, 0x0) (async) r10 = socket$netlink(0x10, 0x3, 0x0) writev(r10, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) unshare(0xce443fa467e6ad2e) 750.178243ms ago: executing program 2 (id=337): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf85, 0x3}, 0x1c) sendmmsg$inet(r0, &(0x7f0000000b40)=[{{&(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f0000000580)=[{&(0x7f00000001c0)="d86dfc134aa8aecc6ceac9d104949e26412cc618af5f7448ed19f23d21ca120c600bd552ea736c396f43dca6c5cec36585eea91d97285d455f39dc6b364eed083c71d97287749c7f90637be14e7afa70c629594ac9002bc3effa96cff4902ede448c625c02ac55434d97e522675e29c3520cffaffc19252fbfed1dc106", 0x7d}, {&(0x7f0000000240)="c9119ac6da7f4b6329291814df67bacf78041d6993598f048b8a897e11a93361eeda47f0fa74c423a63101f93b1a98ebec4ef1db54d8f61073a21398f974b2fc80f8df97371d16693f3fe8b59fc393b62cf5ddbe488238f94bba6c80ce01f92691fe90d302eb2a05eb47cf87f13193ae0624ab7daf74c4387da013116c72602396aa9c", 0x83}, {&(0x7f0000000300)="3876886c627add31d2e1f79fb6a81de9942c7b55ad081be9f52594ccbeab1e8efb55fcd1515812b0d160c70ea22aa9d32e08d92bdeedfc11a4fb9d4c5f8ca347eb2630936142e3293fc01416373ab5e10fdafda6dd5986a1b4eda6d4c7d2a3f9d0d61aff66a2dc6a2c045982dd35535feb248bc923b8470d14bef6d82f89f25b9b3747d2e0bd93df948c60457ebfa808962cc3f5c98e70b76697", 0x9a}, {&(0x7f00000003c0)="058d6956a62f3d43879281d62edb782b23340309b683c8e30d60980ca579d6a7b5acd0530f02b900c0df7cf8b4f4fef86b1c3d23b8", 0x35}, {&(0x7f0000000400)="ab6c992a9963a589dd65eae9f05f17312ff57d24689bc677e289898ce6fe87f4c402fd6fd758d8d4b2b1dfbdb9ad982c97", 0x31}, {&(0x7f0000000440)="c001cdbd16175bec2931eef1356530a52c29c0d72d543e45d55f67a2132fcab062d5192dc4e8f94e33331c15dccccc37e8a2b346e14941044de66810b17805ef7dd4682d8fc811b74bde16e8f89e36a6182d102981e364ae7bc4c678e2ed24c8f5196ced77311841bdf00d3d886cef768d0f2fd4c8a8bf985a68676fe9870a7299ada0f6c7b24fa0fb71243e160c81e7d0fe3ab70534458726903ed717086a282dc0cc81ff05b92d45a0c60c3817c1601abb3ed42ed08a47574e69eb4a6c8a5b5eb178", 0xc3}], 0x6, &(0x7f0000000600)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4cb}}, @ip_ttl={{0x14, 0x0, 0x2, 0x2}}, @ip_retopts={{0x20, 0x0, 0x7, {[@rr={0x7, 0xf, 0x6d, [@remote, @multicast1, @private=0xa010101]}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x80000000}}, @ip_retopts={{0x18, 0x0, 0x7, {[@generic={0x86, 0x7, "802fdf9be8"}]}}}], 0x98}}, {{&(0x7f00000006c0)={0x2, 0x4e22, @empty}, 0x10, &(0x7f0000000a80)=[{&(0x7f0000000700)="44b8e165f5332dc42b681aa491f8f8e6d121067f20af8c389190cce7701529f0416166ec", 0x24}, {&(0x7f0000000740)="ff397b03a3070e5f7b3e0c4e31f6550e7982", 0x12}, {&(0x7f0000000780)="7c24d9298627704dfd2a00883fb84090c62a70189eb7e4b9476b779129d072cf93cbe2495dc2d7180b052d6d3e8f41654f393d503e9bb25a7e9cd7c7728646556bfa2c0610e60c2c990f9d76d18ed267213f4b42fce735746de7431f84cc6d975db8bd58ce02889e25f8d69047450768e8a244c5ba9c9874278d", 0x7a}, {&(0x7f0000000800)="207121325880485237e00278ff6a0a48e6dddd0fe644fd6108444e6ddb80946442aa39dac879bfdbdad4869c868d9a1eb2be7128c4ae58ba8a6e05eb7560042ffafa0de1c8eb406232cdff60f9deb7f2eb5c8111a204fa1842b14c813256e557819ac6112a22924a76abe3e40a997c98a8c1fbddee39928b08d84975b93cf9fdc16fc7a5047e36d316e000e2d512c7271b1a900ea4e8992a53e58765581629ba2ea975f5f7cf9c415e8e110d86b04df0917386fe5d7b441f76f09c00055460a15aa41e311c7125f2f1e293a4bfa025adda96", 0xd2}, {&(0x7f0000000900)="eaa9db78139cf4abc6e954e776cb0558e663700d10b757d195bee44b444f848281b3723befffcf3d3a948155828fd5d719d1d5e971611ce72517163a905aa93dcb1af6f32da8b4c89f667b6d24f3e990ce15fb9bc04a82b262a624a31ac14245f1a77fa85cd38c56b3d33ae5bef788e924", 0x71}, {&(0x7f0000000980)="5f9cd675bcb85298e6457a6b244af1dbb871cf33faf2b41266633182a2c7c1a7078437e9d4a3c702ecabd93893c531cb85c81ad8f90ef7813e04d306cd4cd46dbe4aa0c3666e10fd419fa641edda5c1dca098b89c54424e84c409c55c82c520cb9dabb921d4291d4d23b6deedea1be48deaec19abf41debc78e49c284ebda58663204c13048edca4feac2c9197af324022d8e8b2392313a655131ba79a70d14bc611c6f53406a194773df67570841b54c65822cf62bf8f571ad81a67ccde754953fa05fcab7923c3bad2c91327576c8743effdf4ae979d5c8ffc55d543db000320c6b7523f70f44ed4463335d2cafc31102d31c5d2e773923a", 0xf9}], 0x6, &(0x7f0000000b00)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x1}}], 0x18}}], 0x2, 0x48044) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x2402, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000bc0)={'virt_wifi0\x00', 0x0}) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000080)=0xf3f, 0x4) sendto$packet(r1, &(0x7f00000000c0)="3f0302e90302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) 749.948864ms ago: executing program 2 (id=338): r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) setuid(0xee01) read$FUSE(r1, &(0x7f0000002100)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000100)={0x50, 0x0, r2, {0x7, 0x1f, 0xfffffe, 0xffffffffc068dc81, 0x81, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}}, 0x50) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0x104, 0x4, 0x3c8, 0x110, 0x0, 0x110, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @empty, @dev={0xac, 0x14, 0x14, 0x41}, @rand_addr=0x64010101, 0x4, 0x1}}}, {{@arp={@loopback, @local, 0x0, 0x0, 0x0, 0x0, {@mac=@remote, {[0x0, 0x0, 0xff]}}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg0\x00', 'veth0\x00', {}, {}, 0x0, 0x20}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0x80ca, 0x8}}}, {{@arp={@remote, @remote, 0xffffffff, 0xffffff00, 0xc, 0x10, {@mac=@broadcast, {[0x0, 0x0, 0xff, 0x0, 0x0, 0xff]}}, {@empty, {[0x9f19bd59e1461bb, 0xff, 0xff, 0x0, 0x1fe]}}, 0x4, 0x2, 0x0, 0x721, 0x4, 0x0, 'bridge_slave_1\x00', '\x00', {}, {}, 0x0, 0x22be1122fd1b8ea7}, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x4}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) 659.81054ms ago: executing program 2 (id=339): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x28040041, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) sendmsg$inet(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="17", 0x1}], 0x1}, 0x48c0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000040)=0x193a, 0x4) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), r4) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000540)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000580)=ANY=[@ANYBLOB="58ac000000", @ANYRES16=r5, @ANYBLOB="00082bbd7000ffdbdf250600000005002200010000000500050000000000080019007f00000106001c000500000006001b004e21000014000800767863616e31000000000000000000000800180064010100"], 0x58}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) r6 = socket$inet(0x2, 0x2, 0x0) ioctl$BLKROTATIONAL(0xffffffffffffffff, 0xc010128e, &(0x7f0000002f40)) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r7, 0x1, 0x0) sendmmsg$unix(r2, &(0x7f0000002680)=[{{&(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000002540)=[{&(0x7f00000001c0)="d3870d2cdbd2914381dc1e5c564bafe530ad2cf47801a3e353fdb8b426df77657d90f56f93979c97333b489b90873fe2798531664c2b4e2c41", 0x39}, {&(0x7f0000000300)}, {0x0}, {0x0}], 0x4, &(0x7f00000025c0)=[@rights={{0x18, 0x1, 0x1, [r2, r6]}}, @rights={{0x10}}], 0x28, 0x4044004}}], 0x1, 0x40080) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) close(r1) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newtaction={0x6c, 0x30, 0x871a15abc695fb3d, 0x70bd26, 0x0, {}, [{0xfffffffffffffe32, 0x1, [@m_skbmod={0x54, 0x5, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0x6, 0xffff, 0xffffffffffffffff, 0x7, 0xf}, 0xa}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4000044}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r8, &(0x7f0000006180)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r8, &(0x7f0000004180)="92756f43b31ffe542788ef586b7c5a344424e3acac2590be6bbe37adface4a8f2e534ffe76a83a93f0b3680a72fddfde83f96d01982384e8d689219cb9669b14dbaa1b799f82ea1fc926126a4163618e16d4f94143a4e0f27c44fcef3920a0b3805ed4e78098d8689cc7791bd86648070718d238664332948d87866c8d2590fc0f017f9853abd9ed60b99f1aa6ae2dbd24ab6dbcebdb055246815ace147cc50fa3b2861148fcda374d5b203e51d72c45e4dde3e9ee9a47ffe458baf7bb49035135a8194aa1f0a83fa2abed56398f90daff679634619453f533f22583a6e0a4dc09e9de46684d5e0136e229510f3702cf3a4cd0065d3e5d3c419e38a80b070ca55010e082a9c510fd18cc0b26bb5e8e459e747befbc5c6b60ace80bf41417b7b78cf57e5b3984f0cdddc615c5e0000454d3f4a196fb6d18aa629cf0b0245f95ba958d86dc175616f8cd3ac473057dc3a5ff7107973326350107f4468e7ecd48d689b82c12d22ae5f1858302a1b4cfde8fd347a99ddcde40d1c49d9b5099fbccf09e782212be4b2ce36a2bc3c9ee794abffe72a5501e6c4f3f7f68b74761ffd6620609224a3bf11f655dadb5c8a5813b02fb46830e9ac6825f5d0e89910352eb3a58c0dd82d094f94dd2c85666f684a8f437bbd0e66b9f4d366117b67a054d212c4fbc287848cb0578391335d5d616b14d99a2e3df8e8a152d5de99bcefcaab5bb5cc71f3ddd66b379c104648e190e0b28a180d3aecc5423575d4ba7dbf31215c717da7b87dd454b6efcd36c91aaa631127f5bd88723d221752f102bc0c7ac6c5c7a1ad6747af40d01b6d39eab7b0e1292b44683c586386ad00acf60fb8f9bac551a6eb5bab7317b5d89f64db10bd9018dfa6d65d93862e851afbc30fd70fe5f0de322462045177231852ca80e4e78da4fea0c79ba354333026c8bc77d308a8d256a19ec45d2088c196691d3f9aac28ded36004a65ee1ce49ba9599ceee84553bb61d02d04a6732f1e27d72962f74b59f3522bf844c5022986d55934e48b8681b7f5b7532391448caeef00315d28320a46d8bd7813544e1e4bf994e14a519c2654ff20b42bdb69c262897e28eca528f0999840b00ed8256597d27cfc20d71d5f40d0bbca759f7594c6034aa1e16a84ed152fad0fdc1c303a7f61225712714f823afc5ea241d482d3585759623af8c97ca6a84a2033b3d7314ea0ef7ba9b288b362a294c92c8b9736829c16f61c5a1ee04aca965d71162292274595ea62c9c2918e8279c99f5d2830c617c58211fd7452330184b9428d5ec1d5cd75ddcc6de3326fdc70e891104b3b013c30ffccfaf3308d9671b01f6b080a930dac2052c6f39817a662121d90d40d6a1facfb50bec7d408030b6d0ae3e744f3bcc327c35dc43cf86b743db78ff2e593b19923235ed6467f299b08718fe1840c16a748935dff941150fb08b30573b37bf9af5c86cc8d9e229a832e4ef25ec91f71120f2b3e9062485976c280a2d172386029e2f2a4801197fca0a13514edacf5ddbac5a62e8bb13dd1572657a821a8739297f72e29239d1cdddf3e30cbe9af3141f2275ee4ae85d86ec888fe9a6751f252057e95b8beb055e276439581afee93cd44f1e92f70e5f725451d3ab662918ffbb1269509fbd511e95a00ec717f9d60d643864abd6ad1cc4dd7f933379a6078a86c2158db8076e7b660366fca7b1c46d09d2c8e67a6494bfb4c2c6750e76593895b5e2b2bc78093840c3c4a807826bc2750a96b4e1dd5b82b492bb2215518c92064d1763c37132604e52e73fac3f4511f791753aeecfbb19816e0da7a1bfbea9eeaa0f256eaedcb119a61f7d0ea0f5cd4969d45cb014800f2c888d5c2217cf0f69a7507779883b57352bb8883cc584891950d6e792537074f4fc4337aa19b9bf60e18edd939d289fb4a6b7aa6c66da20774e249ca4f779d3c910b1a9a8e4c38af6adecc87d5481d181fd66023ffff246f4e2556b218fe8110acebe20b1675f1de6f265b6d1d8514a53522396bf0e2f2b153c498e48b36d16f8b9bd56f45d7f5b9397d7f1339117a176d0bad0b68e800682416d3e18fe2197c7f8dc20600feb95cc6ba86ad47f113e159bd4389e30eab2874bd27eebc56020c4dab9973b13f3e82aa62a7e0a151d73de48cb811e32be63ffd303f5a6ea6f097ed763fbf36c430821e451146de79922348354ce285af0997bf3c66e6ef02942e24b8f1ccdd542f09cfe65c0da0094c0b5fd26bbc061538b41e5ed2cbb390ee29b10a4b7a696009e1b5b86c44c0a561a257c15415feaeb1433ea275ed6e4b228503fe71ee5942665164faaed6697112206be0fe7863aebd4bbe951d5dea1da294dba0793196385f4d5141c9d6c4b0fa22b2e200cfb70b52aca31655e71e5a576ccb8ccb5b1364748aa981edbb81a813b1aebc67be1f7619e7e197622d981280429f6ca5145c5b3b05e6bace9191e5c58fbf140f71f594cbfd4db0e9f6923f1758ff9464a61a720a5d4f09c622c3ce3f5d0d3a1d191111168108f41f12b16e9eaf3617c353715cd35260560cbfd0555d51ce5c40bbdb7c95ceaeadadb8902974de50b0863348183864f5ea682e678286a06a6f396af29a7c7fb33a3579e25835963612f3c0d4cf369d85959a0adeda94d35824050e6fba7f83f90867583f713d7783323c7010e94c9be331f860db395dbde6face5bfdb616fcefa9c6b01f6963daa840a31ff554a458c0c50cb5e09f91f54f63234589decaf45bbfbaef0dcbff4ae6e65ca26a530261c491ef8eb9a855a1d7463391c9b66be96cf24c3c321ee5a5bdc857f60b582683c6ae1e3775b62a9f19ff8fa51380ca8a2a3c6de79012f5727ba12025e7e6723a23a81e067ca6e54c7b38ff64880d235d21e7ee5258953dcbf9e2a962f006ca4ffe870859242c850cbae4222b3b72c4f86934379ba2ead1dcde906241b994d95c88355af5a9a30ace9c933a6942f341ad221dd825846a8fd44c03e2eaa9311c26e15a1bd7cbba961a22ef23d7ebba0e34cec5ef09b1ce72814a97e33bd29f3d9ec80a4f45d1d29486accf15c11f1a800bd84918e7626f678275d7c7acb02cc0e6e34bb766ba6b75c3ad14fca9352e09c3b69390c045cfc842ff9ade8ca693c07fadc7047a946e6e570c3afc5b501c964103397f5ddadc2d59a048348dd42f07cfe31bc9b5ae453f5086bb41bba4c8a3e518e30b0855184b053f923025dd72ce1bcbf41231978b34a8547c71d7313992165078903c61d312b0d9469413c9fd97ccdf0ea270fb6c47ec8861a1c8d909eeace761b5a06ba46e25785ff87f867777abb237c6c980687991f1ed0157d58492260c712cec34c1fc0962103955db4d5090b6e8409cf3c3c79d0e691cf4fbc0b2251a016dcd456969cd32e5429533bf0d6f8bda84c05f0e2040de8b53bfb8676eec4b76c3df6f46b1e43732035dda577e75f640777f6ae90fd2f1af42ba462dac732019c599bfef01acd6a0d4d1796bcb8f58519d6f9ad9a3206704a94d472516b988141f44ecd2e6f28a49aa0c449db87972fc995a97379914546ea43143ea2cf779a9cbe81f111fe89129db3610492164ab2598eca7e60d9a6963d8ba03a86729db86e420fd96d61b8fb11edc2b339b57a740074ae5b775eaf60cd85dc934e604bf2b4bd58ee01205b4df57ac20ff8db45a05982b579643882407050c005102a2e71f1e56dc76dbf5331112e83e48bfb5cf2a78a893190d78426175c162ffaa7278a43b9932318fc17fb8cb0dfac610b1ad235b91f9cb7623b155117e07f7b876a3c37627aa31eafed141cc0c5491c4f621a66b6d837a144d78719c46511c04a093cf65fce9fabe5bd6d499eceb63538ece3cf19053550a239bf978c08c879f9954485a4e3e0d5bedb84b407ced85c4dfc4d75af116815992c29f0bc927c4a990c38ae4fcc9feb90fec1b1b555e04d010423010855394d5ccfc8ed21164190cd8f83be5debb70290c3547f07e4dc42814f1e001798e6ceee2558b0c6ff8c1759f90269ee226131116332b99ac8dd104c92088e1f91ace3198c0f59bfb75c4e4a697660eed43a29c831a552de37fce6dce96fa51b6e2111f3071a4e94422d15e102e5f67da7ca6cae6bed7743ebffacb8a811a143605791d17232181a517e872f71262c3c73668f0ef83aad498f67fa26bae698cf78f24c2dbecd399a190e6b8d0684e929f2e4a83765eb2c67793a1adbb89d36b58bfb197cdc5f3c894ac9d886e8f3b0936fabd233c09de8fab8099f72a74d908ba5c5e4d39790b0bf9e45b710f5587b7c937c76690c5c5fce621a53a9fd03b0a4ee6d8d1abbe2ed561820a77f12a08cad0755540ab6dd1604b7c30a8652995ab80b85e919011de9438a4637eb0291124ed4b745e782cff98510cb03be79c2a81351abf276584d75cdd96b9c97e73eb71000b3ab7c3c19c2cab4497298fcb3052b5d4503d05e7f310318be6f848547b1a4f4db82caee190801478be28065036aa4d91f290c1f396343e73a5fe8bb5ccf0a317177ed1f77acda1a4a49dccfcab8d1b5d79f015f788b6d5e9f8228a8bcdc0696e6b19f5edffbcd7e9509c87fbe1f726b93bf8c6d8d37428763e142560c46c9e894f7317859000c25abc4f3691ebcd020171e0d4911b5d97a238109aedeb00b2eb475c1e7b45175f8aa85193b5c0f43b434c15de01610c4d022646cd6e3637f349a434a77f571ac1c5d698452d1b991e267f78dca5e592ecd31ccafcad84e4e98d134b4adc525b81bd6843428883023a6ea407201738c8bf16b541ff7280274a34d4cf14819f2dbae167ca0cae8471c495e006b45194ad91c4516f21cbb10e0d26fd5d734cd7725df5b3fbe92955f4a9bb3b9b813aeeff79d6ed5db92def19d060a208c3ec8c42c110786f1e1496c50a7249b03fc792764366894a35320b99d0bef9fd0b6a246c36a357c6b985dc83a37a8d9b8b9ad643dea94860cbe763bb73cc8422b69d4d12332242c8954075fb7117a6679638073617abcdb4619855b2036af160647f66b3531645a3bf047ae290d6ae2249f114e7a8464278bae1486022bcc7c37390c8d9a0efb0e1cfa0da8ef7a5e072f99a47ecc75e4e442880375193db49bb82ba34901286ca473ed5b63e4048db4dc455e74b3fdd2e7898ca3f4c3a02d435cde6141eea645055123a7dcf0d22057f8d425701afc55859f5147954e719d58c7486b1e02ac16cb799b77632c66bb78e6e52e11017c1736424fa4d433f1e19b4c881d23f0b2a12d5fae3ae24339088088d9b496ad97bd9f6e20a8597d1452a0c72dcf43dbbda8f18166585c06d21fbffe5fe7b55f71c9b9f1b34a02bd05ca63c7c1b1bebbb9dd24fb10500b04c665d45154dd28b85d821ce7e613119128996785e1006a8dabc4899b10d2671107d5a0658ed363b9d4b39d02f8cc5e350fbf0a31048adecd1f9e2ca749bd86f195eb48e9b4605f050de03d642940d79184618f7f88a9a0a4683ad84d6134e395305bc1d4d9d17cc334b97653529d6682a87a5fac80a6d46d6e72fc22e58be7b8f8617b3372ef2622110ab1ec448717118b257acffe55d18c7855e9e8710ad977a6792b2315a189eb4468c68641e9b60c0dab7016ac1ad63cd8004b6eca8fc88b1e4263acc00499255c16b11487a0af858075f9c892dc8044c4146e5a5677c4a2cb24bde5e078985020d4ab1e4c87492e76b7e6f4bbd71d84bab1885c9702849e70cf728776b1a94c2a8fb8c7ca01b6111ef6f2032a290949bfe473fe215273b8b5b3ad540f187490f63077dccbca6f62f0a7a66717c596cdef412f2560b10685ede967b3ee68b8c951959aeb1d7564c3b9d80762ce858381393a79916b78f7e90beadae30ffc0b2b614380f1c2cc551a44565209db3516be379ef566ab00c673fd8aaeeecdcf1168c1960e9a477b9e13757498a44ff089351d1f27abf9fd76816f924504647d1247715ca861ebe624172c322146d66eb2b247f8ecb3e1b5ddca89b287c57510cec40fcf89d802cf4368a861af320e01e34f7a6177d4bc549181b5e87ecdfe02f78c9a59a3bf91ebb6364023ec06410e7b4476ec4e3685bfa3bfe9ef9ecc12dcd899abe0f3c7f16b4686801c0c0a949aa26bed57df56f2bc54ef19af7fcbc7b0d691075f42a4a67acf980b568acb2342f42249f7c1ee3527c13182b096064ecd250887a942d26f637e1c4041b139659d2462a68680bb04387a3b399e396b9fe74de10356125fa47d0a20827370cbf36a79b6fffade91c439dd6cfff4bbe0dd3efefb61c491ee32f935d62307cba369ac8c20f6fe3d4857ce6d240ece5e4d149f0587155a8350fcc18efae2ff11cdbe15218a82499a1996df8b5462ee170b284321e76bbe5c3f4158387644d95f087c598e3d46fbe27f63fa784bda239512113424045a2c5dbc6bc3662ca730a86d13cf8f6fe2743224ca7b535caf6b4701a7dae9cfad3d7290104bbba15b6a064ae6e909a099f75fbe47c9e654d8e3b8dc0f3dbffe829e6c56f7a241e565136812a857f59ab565a9991c6b1d8abcc94c6b33bba314f6e5060e657e4647f969a551dd6c51dfca0ff5d9e4f401fedbc2c927eb1ed95ef25f4e5accba4999322ba1539499310dd5875433a22835cfd42fd77fd4680b7fe767d7aa5c33acde04a65bd3a663fcde4c80e9f2af498f13bf9abbaa1c1265edc691e94abdcc92270c05811cd2a8104eb18efbfec9e4ba9ae5cde211b9b93082ce034b6cd5fbe9cfbac4f7e2404ef159766124f73017cc3600f3c81cd78db25fc3459629eaf20dfdb062c7e502aa69412381d847a9d254d5befc451cda3606f0bc8ae62e0aee928f9ed0b21d705a8d31b899e16445ee064563d32f7b6bb5ad197023cf528d9b329ec67815c6ddf27d2a6ffa7328bb993407cde3d166159fd49fe469254b84c2916daea8df9d69bef019f1351b9bce193e30278835b82ea5f60dc0bdd7f7452b7a820ae7cd6dc29d7ac6a6c1b6411711a96338b1e769146b2a385d282bfaae61b041166efafab2d89a4567b9460cc22d752f8e9aacaaa0db7c84879f5359662d55df6570d4214740851c74574ced733807cbb54571110410892394c3dea07bd4154d0e5689d57c3360207dac951f96a358e9c466a5c5113f3a632e184f57f075edef4dcc9721b963beb95df09dedf848260cbc1ebfdc7408218eaba6d2c51928cd37c4c0c9f321fbb0994a56947cfd9643056db5dbea60a241f8f004c932bc8e645b2ec2eb9bc4e9e2f4156293234d05e70cb26b8a370b0206c756bda6defc11c5eb386640f535a4ffb714168defc6d82f40d8f5ba8768537ead5773c53bd779ca899a2dd31c9138569ff5107c2fb12b804375c3b3dc9b828bfd550328adf358f71e86a0c49fb119f5ef9e06c13855cbfc7d1a62ca2ea655ed912a6dc7bb8b18656e8923fc7a1702ab36947d79384d681c31923e98cf40209f776bc2b219a7ccd139e756a905aa351e6eaae90770c8a193f96cd5c66e4d77a357985556e14333716d80204a5c390e0d76f4081afe917f99ad8a0976b3342f51854b374b4baa9a7f22124d2b82749446e30d9795acb9c3c3a305a6d273ac528e8e9c95c37a78e765fdda55982c2961fbc85a14fc095a78b4654ee6dfc3298749a639ab9c8e155af3a77f8a409ce174532a492ef550a140f774d77d732b3b4ca5bc41fa4488ce5957ce219b032ae1f585273748d81b19edcf3e6cb9a93ec24e41c6b3c472f9baf3ca46cb8b9a91df18acebe7d83bd4473750c4f26806da2f95b9ea48b342460af729ab15e9f033eda67feec645f985d4b9489cf6ceec1b100d007bf46c74be53c7ea17296f9c5b5cbae736491213c93b513009ebdecfcd60d46d7b86c6e3b5e288f2ba5867c07936e7bd1b00de52191eb8630ff82ccafb27a59295164751811bf74eff1e5e2abdf3c93bc5dc9814be83b2562477935e2fa30db7ebb6ec380170cf10c1f98f8c5eb71c7dcd6b31b55a1dd1c12a64802ab95b63c529e0a96cec8f38680221d6089926d8309796c79994d63b67bfb62f66b4a502f30ed12be41e896e88bc45a160a526fbd5f002e677322f116ec5740d7563cd23ee853c008b84998e38fdf158556e28a532573956e7c00f91f08ca245c295a3d5e003a99ea727f61d12893b435d4c8f2f5cce00c6a3091e2a47f290c07168975c53d7529b71d10faf42d2bac9db8d53669cf59c709c25e9e40b5feaed4c37dde8b84c4961c00712326fb6aaa06e80d766b40b72480f3971def61d1d129676df2478e778d899ed317426ec33e496d1fdd2ec27128f8faee92828e13da72d6aee8330a7988ea1cc8b64ec4d8b20990864c16c52c4be6d00b304b87d97bffdd9c66a740b517223089d9f3f414abedc53c768dab9220b980e6c18d5f20ba8994cc8886d7bdee213442f456d79fce1b1eb48fbf600a666c8ade24d118e6328251cf7b57a6285c650e019850f392b1c29aec5c8fc489a3819d60d5de377d4c11b8ee5625b7c02c5d50d2af3397006f2e2a41a06f039229eef5878ed91f9f6be7e988924dbaeb8455f616275e8698d93fb536e2c839b203aa69bceceddbf9c53f8addba53d50ca0f7a4729a42ac6eb757f1b408ad4a0147546173e62f7621eb18a9e1681510cceb48e0a30ab7a1bf71d56742d5f034f2d725e7ea68a011dbb100fa6eefe4ee093873de366d34f4240ca027a25c5b979c9ac47dd1dcb6ed82c4aee09dcc23cf329a8644f89b5cf00e5683934b1837574e9b39b31b1009f276e15aa040959fdf100838ca3f5ab17e45036668d06044e3a13f3a0a6f68579e50d5b0164f900d7bcfcde78396cf30f0b1dff76dc397ab1a5a44b207eb1eaaf73b945c575029ae2dce20724991e6550155ded6a42672609f2439c5aab4882b2ffaf7da787b71d05d15516bd68c6f1a9d79b675395845f24ee853f877e72c14b6c6702f7b8775ca1bfabbbcf4019f7bccf07f1c211531dfc66a7a1df79e92a20dd1cbe1b22e1209e7e3ecb9d3c2450fc22a57bfe09bd735f61c361cdac2488ae0adc7885edc0712655daaf535e1de96ccbe7869d531d8bf3db512fbd17c772332a3f8cf1e052ee0202eb99a36a0f8d7219888acbb57090cdaf3b28e1e62e8fc2ec237bdf18592a7afe4d8390dcb5e7fcc31bf4f797e6f5710070902265cc2e8c459b7da1451046abd6c8c5b02c0be2d2f505a65376266563ac7b59ef3b4e2570a6cb0bd94d46ad861317c743ce1de12bfa2295a98cdded4414d87a1580b1e4675bbdf73a22cac4a1d8d456d089e0b60cbfd16158f073bd1dac481db49fa5d8801d0fb0844b4afec1bab4e61fa0f4f1fa667880a1cd8163953be7b591cc9dfd7f91902370b783ae8a0f3c7cbefa7d229a37c00f523529e159b11d2e240629b64af2d11404773e991207a722c320221ce23baed7cbe40a440c5680814b122cfba9092fe03478f85adcbdeacb76d6cbf2491eafae98327b278e267821a0e1cd06ef90cb0328e246c19d8c63b9332291a89bc9f989effc675c79a870ac024756c6f5a7e32babd69625d61487ae7399490b70dd0fade7d70ad9b0757300a2dde77abaff4f63a0303853589d44efa968e10d36561f04408ad0cc227fc6b2f904cead189a0fcca9b2e6cbde5498652e0b3bc9d8b7921474403718feb5cc750dc70f5a9b1a0ae2c642015b6a1a8ab0572182b4e39e0c869cbdc60c9465f5d564d18ba2f5b3bc3e05a458744077430c5ea031ee02dd8f0a65d7dd8d90dd9b8717f77d202239a5778719423fb2aec7ca86eb07c39de65a34b988d65377a7473e9145f16d79593e96903330bbf3a8024fc15519d9baa0fae2018786f4b1846fca355ff0fccf65cccad1896309a5ccf2056dd542c929850cc91cd655962360fe316557ab3fb378328f77a07d9da24447d3fa2020b382ed2e808ec9529a01273434c64b0b7c35a06a019e4ab51cdc9c0f266ab25b6984338a0ba910d1060283b636c5d7e8a3f969c1ee1c99b54bba7ff3679fbeecbb70349f076480a867cc4ee4cacaea39c80f642533599486d2ffb77b8c9109a9d25fa0b06e58eca764f7d56469eb9547036bbea9d5c3d35b4c1fbc3d39a372c2b7ad184965cad3819c8928f1588d00949949c0c4c93d30ac7f6665247c0108bd89dff3aafe780ac66febfacc8c6a3cc387d09da6de700487a80e2c8d56df94d7ebd3e1d9e06411a6c5f7eb6da41c6f52997b5ad47ba985261103fdf12eb4a2828b248f652ef00b6abccab2eb161b878b9dbc0aa911405b6f67adda83c16187748d7b524ffe6381f489f432d592e6171bd9ccb2cd52f977143f57fbf2ab0b823d449ae55f02440972334344cda01837b93afa4f46a2fdefe27e92764cf9596780846de2e3b1ea83e62ee43b1c05aee675e25363504addfaa68e7c53ed685413f5ba951f120d0a646e474872c81e5a887464c19f8460ae814ffff24cb51dd2dca28d597ab2ea60949f8dbbe67f263e722fdb51bce4e328a19f5ff1218e1f63b8da6d40dbd5490964499b2522ea323310634893ead661407966207a66ab13adfcf1a725ed14339c46011c0e0401f2386b47cd9f902fdf84bc85e74d3ae7cc544e4d65670a554a537712c6ee9f75191631d2a4c4da06fc38423b1d5b828d7201235b2974164f52aa16bee70ee509250752f4fdd6b9f8d021943df8320682a6f80ff0d67ab7a4ceea807bd5b3b7b6380b0c7f0caa67b0208ba71317f0355a3b755af0e2c007186389438615df80b7b25104a733fc90625b62682198733c0f1625dfaa08cf81e3df043094b7b5a098b3b36f803b5b0f10a057bf814ae3579932c0a5f208985bab3d817f975283b8838ae5cb709be72b58df7425e059fdbf4e0ee51b3da01fe0b44963c1196baee5ec5909ad80d9d1660f3edd90374952a0bf8b3bece2c2f944593f4de7de5e05ded096b8f4f05d65dfc2e806f78220d84b3db564fb12f4e5e8f5eab316591f004e9374cce8e787263bc3827affe6793c130b8621d3bbb2a86fd87f070ea21718281ee7aec4bb3bb71af4bf5721cecd139c4be8c9df4ec8dfb09a5cf1d86a25d39faa9f064a997c214f334e4410917fc3b4d67ada8d87a38c0f86b02bf653dddaeb5b75b300f8bcfd792858bef8ab23e063421939c59212964c9ed5dd56e215db58cef53d31a966bb8ce4ed56287fecb3a85ba435e0b41b20ba1164b9c9f2c49fa0f7b17a89e0ec47eefe992d63ee29c8c0a1ece2664fee8edadd43636a54c48519b4fcf55b0d9103602b92441a5f85cf8c5e406d0f5815f8f37309934bd78fbc2acf0a03b051b4528db4f7c09de7d0aabafca3736b8259c818ca338ca6754e0747717c2794d664a1cacc1e9c52764a308e6df73d975638630b74cce6c49b1bac16454e96852c4f9d8ed118e86d2f1c8dc33bccd4a07be128db5e80f5684ddcc1158e744411acde590f902f0987cfb750bb5bfeed53bff076868986b566d7701f48ddfcacbd325c8d930bcef26713bf60585d5c991e2a6cc33ccbc27f7ddfba18f998497c2eb378cc8f2cc07a1b4f141c5e0fb6f52e18242e505bcf6dd20e33a469d056a0b4fd5e72d0da9d0bcce1e2f9e9dc7d1c7b6cb0f3604287eca", 0x2000, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0xffffffffffffffff, {0xffffffffffffffff, 0x2, 0x101, 0x0, 0x0, 0x10000000, {0x40, 0x10000000000d08, 0x4, 0xfffffffffffffffe, 0x4, 0x0, 0x7, 0x80000000, 0x122, 0x6000, 0x10000, r9, r10, 0x982}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) quotactl_fd$Q_GETFMT(r0, 0xffffffff80000401, r9, &(0x7f0000000040)) 527.166357ms ago: executing program 2 (id=340): socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000000c0), 0x4) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x162e02, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x15, 0x0, &(0x7f0000000040)) gettid() ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f00000001c0)={0xfffffffe, 0x9, 0x2, "f1a252b532d0d49d391c1cc71e882539024f00000000000000000000002e00", 0x38416761}) timer_create(0x2, 0x0, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) r0 = epoll_create1(0x0) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000180)={[0x2]}, 0x8, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, 0x0) socket(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0xd) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_rdma(0x10, 0x3, 0x14) r2 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10) listen(r2, 0x10) r3 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r3, &(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10) accept4(r2, 0x0, 0x0, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x21, 0x0, 0x4) socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, 0x0, 0x0) 493.656612ms ago: executing program 2 (id=341): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'macvlan0\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, 0x0) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, 0x0) write$tun(r4, 0x0, 0x6a) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2e, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x6, 0x7ff, 0x73c0, 0xfffffffb, 0xe795, 0x5, 0x5, 0x1, 0x7}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r8 = socket$kcm(0x11, 0x3, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r8, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001300)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x7, 0x4, 0x4, 0xb, 0xdc}, 0x3, r10}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x4015}, 0x40488d0) setsockopt$sock_attach_bpf(r8, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r8, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r7, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0xfdef}], 0x1}, 0x4005) r11 = syz_open_dev$sndpcmc(&(0x7f0000000400), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r11, 0xc0884123, &(0x7f0000000240)={0x1, "fe4bc2070c8230d64a620097e2e100001a424ec9a919621a41f878718cb22a406b87762a90ae10a800", {0xff, 0x9}}) r12 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r12, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x250, 0x5c, 0x160, 0x140, 0x3e0, 0x250, 0x228, 0x25a, 0x250, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [], 'veth0_to_batadv\x00', 'pim6reg\x00', {0xff}, {}, 0x3a}, 0x5002, 0xf8, 0x140, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x28}, {0x12, "d176", 0x1}}, @common=@unspec=@state={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x1}}}, {{@ipv6={@local, @empty, [0xffffffff], [], 'veth1_to_hsr\x00', 'dummy0\x00'}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00', {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x394) 259.732252ms ago: executing program 2 (id=342): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x181041, 0x0) ioctl$IOMMU_IOAS_UNMAP(r2, 0x3b86, &(0x7f0000000240)={0x18, 0x0, 0x7, 0x280000000}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r1, r0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001300), 0x40, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCVHANGUP(r4, 0x5437, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x5c, 0x0, &(0x7f0000000580)=[@request_death, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f00000004c0)={@fd={0x66642a85, 0x0, r1}, @flat=@binder={0x73622a85, 0x100b}, @ptr={0x70742a85, 0x0, &(0x7f0000000440)=""/66, 0x42, 0x2, 0x25}}, &(0x7f0000000540)={0x0, 0x18, 0x30}}, 0x40}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs2/custom1\x00', 0x0, 0x0) r5 = socket(0x1d, 0x2, 0x6) r6 = mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, r3, 0x10000000) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r6, &(0x7f0000000180)={0x2e, 0x35, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000240)) setsockopt$ALG_SET_KEY(r5, 0x6a, 0x1, 0x0, 0xc) socket(0x1d, 0x2, 0x6) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000140)={0x10000, 0x2, 0x8000000, 0x2000, &(0x7f0000002000/0x2000)=nil}) openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) syz_clone3(&(0x7f0000000080)={0x180801400, &(0x7f0000000600)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) process_mrelease(r10, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) 257.564876ms ago: executing program 0 (id=343): r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) close_range(r0, r1, 0x2) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) nanosleep(&(0x7f00000000c0)={r2, r3+60000000}, &(0x7f0000000100)) connect(r1, &(0x7f0000000140)=@isdn={0x22, 0xd7, 0x0, 0x79, 0x2}, 0x80) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000000500)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000240)={0x244, r4, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x3, 0x8}}}}, [@NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x3}, @NL80211_ATTR_TX_RATES={0x21c, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x24, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x6c, 0x2, 0x30, 0x6c, 0x5, 0x1b, 0x30, 0x1a, 0x9, 0x6, 0x16, 0x36, 0x9, 0x9, 0x6, 0x1, 0x6c]}]}, @NL80211_BAND_60GHZ={0x90, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1f, 0x1, [0x4, 0x5, 0x3, 0x4, 0x48, 0x24, 0x12, 0x1b, 0x30, 0x60, 0xd50456608967b17a, 0x9, 0x1, 0x48, 0x1, 0x9, 0xc, 0x4, 0x18, 0x5, 0x24, 0x6, 0xb, 0x48, 0xb, 0xb, 0x18]}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x48, 0x36, 0xc, 0x36, 0x6c, 0x6, 0x36]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x4, 0x100, 0xe00, 0x6, 0xfc00, 0x1, 0x9]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0xd, 0x2, [{0x2, 0x5}, {0x2, 0x4}, {0x4, 0x9}, {0x1, 0x5}, {0x2, 0x5}, {0x1, 0x2}, {0x1, 0x5}, {0x4, 0x5}, {0x7, 0x1}]}, @NL80211_TXRATE_HT={0x23, 0x2, [{0x5, 0x7}, {0x1, 0x1}, {0x7, 0xa}, {0x7, 0x4}, {0x2, 0x4}, {0x5, 0x8}, {0x1, 0x4}, {0x0, 0xa}, {0x0, 0x4}, {0x1, 0x2}, {0x4, 0x4}, {0x1, 0x7}, {0x3, 0x8}, {0x1, 0x5}, {0x1}, {0x0, 0x5}, {0x4, 0x5}, {0x1, 0x5}, {0x4, 0x6}, {0x2, 0xa}, {0x0, 0x7}, {0x2, 0x3}, {0x1, 0x9}, {0x7, 0x6}, {0x6, 0x1}, {0x1, 0x1}, {0x6}, {0x1, 0x6}, {0x6, 0x3}, {0x7, 0x4}, {0x2, 0x5}]}]}, @NL80211_BAND_2GHZ={0x7c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HT={0x25, 0x2, [{0x7, 0x3}, {0x6, 0x8}, {0x1, 0x6}, {0x0, 0x2}, {0x0, 0x2}, {0x5, 0xa}, {0x3, 0x3}, {0x2, 0x1}, {0x7, 0xa}, {0x5, 0xa}, {0x5, 0x6}, {0x6, 0x6}, {0x1, 0x5}, {0x3, 0x6}, {0x7}, {0x6, 0x8}, {0x2, 0x4}, {0x3, 0x5}, {0x1, 0x9}, {0x1}, {0x1, 0x4}, {0x1, 0x5}, {0x1, 0x4}, {0x7, 0xa}, {0x7, 0x7}, {0x0, 0x7}, {0x6, 0x7}, {0x2}, {0x6, 0x9}, {0x0, 0x5}, {0x0, 0x2}, {0x3, 0x5}, {0x5, 0x5}]}, @NL80211_TXRATE_HT={0xb, 0x2, [{0x1, 0x8}, {0x0, 0x5}, {0x4, 0xa}, {0x1}, {0x3, 0x5}, {0x4, 0x9}, {0x5, 0xa}]}, @NL80211_TXRATE_LEGACY={0x1b, 0x1, [0x2, 0x16, 0x4, 0xc, 0xb, 0x6b, 0x0, 0x48, 0x9, 0x6, 0x1, 0x2, 0x48, 0x30, 0x48, 0xb, 0x1, 0x18, 0x4, 0xb, 0x6, 0xb, 0x24]}, @NL80211_TXRATE_LEGACY={0x18, 0x1, [0x36, 0xb, 0xb, 0x6c, 0x7, 0x12, 0x6c, 0x5, 0x9, 0xc, 0x1b, 0x2, 0x2, 0x6, 0x6, 0x24, 0x16, 0x18, 0x6, 0x60]}]}, @NL80211_BAND_5GHZ={0x64, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0xc, 0xfff8, 0xc9, 0x6, 0x7c, 0x5, 0x7fff]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x1, 0x1000, 0xffff, 0x35, 0xff80, 0xf, 0x1]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x2, 0x81, 0x3, 0x8, 0x8, 0xaa5, 0x7]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xba7a, 0x8, 0x8, 0x8, 0x2a08, 0x7f, 0x1000, 0x800]}}]}, @NL80211_BAND_5GHZ={0x84, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0xfff7, 0x200, 0x0, 0x9, 0x708, 0x7, 0x4]}}, @NL80211_TXRATE_LEGACY={0x23, 0x1, [0x4, 0xb, 0x18, 0x6, 0x1, 0x6c, 0x24, 0x16, 0x48, 0x18, 0x60, 0x9, 0xc, 0x6, 0x6, 0x60, 0x23, 0x30, 0x12, 0x60, 0x2, 0x9, 0xf, 0x24, 0x3, 0x16, 0x30, 0x4, 0x18, 0x6, 0x48]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x4, 0x400, 0x3, 0x8000, 0x7, 0xffff, 0xfff8]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0x1a, 0x2, [{0x3, 0xa}, {0x5, 0x6}, {0x6, 0x9}, {0x4}, {0x2, 0x2}, {0x5}, {0x1, 0x7}, {0x6, 0x1}, {0x0, 0xc}, {0x1, 0x5}, {0x6, 0x4}, {0x2, 0x6}, {0x1, 0x2}, {}, {0x2, 0x5}, {0x1, 0x7}, {0x0, 0x8}, {0x5, 0x7}, {0x7, 0x1}, {0x2}, {0x5, 0x8}, {0x3, 0x3}]}]}]}]}, 0x244}, 0x1, 0x0, 0x0, 0x4040040}, 0x20000800) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x44, r5, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000004}, 0x80) sendmsg$NL80211_CMD_GET_POWER_SAVE(r1, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x14, r4, 0x10, 0x70bd27, 0x25dfdbfb, {{}, {@void, @void}}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x24004890) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) futex_waitv(&(0x7f0000001d40)=[{0xfffffffffffffffa, &(0x7f0000000800)=0x5, 0x82}, {0x63, &(0x7f0000000840)=0x10000, 0x6}, {0xffffffffffffe7a3, &(0x7f0000000880), 0x82}, {0xb7, &(0x7f00000008c0)=0x1, 0x82}, {0x6, &(0x7f0000000900)=0x7, 0x2}, {0x32, &(0x7f0000000940)=0xffffffffffffffff, 0x82}, {0x1, &(0x7f0000000980)=0x2bac, 0x82}, {0x2, &(0x7f00000009c0)=0x4, 0x2}, {0x4, &(0x7f0000000a00)=0x1, 0x82}, {0xe6e9, &(0x7f0000000a40)=0x6, 0x2}, {0x0, &(0x7f0000000a80)=0x6, 0x2}, {0x6, &(0x7f0000000ac0)=0xfff, 0x82}, {0x59f, &(0x7f0000000b00), 0x2}, {0x9, &(0x7f0000000b40), 0x2}, {0xe, &(0x7f0000000b80)=0x8001, 0x82}, {0x4, &(0x7f0000000bc0)=0x1a, 0x82}, {0x4, &(0x7f0000000c00)=0x39, 0x2}, {0xfffffffffffffffb, &(0x7f0000000c40), 0x82}, {0x5, &(0x7f0000000c80)=0x8, 0x2}, {0x9, &(0x7f0000000cc0)=0x8, 0x82}, {0x5, &(0x7f0000000d00)=0xd}, {0x8, &(0x7f0000000d40)=0x101, 0x82}, {0xffffffffffff4013, &(0x7f0000000d80)=0xfffffffffffffff7, 0x82}, {0x8, &(0x7f0000000dc0)=0x100, 0x2}, {0xfffffffffffffff4, &(0x7f0000000e00)=0x80000001, 0x82}, {0x5, &(0x7f0000000e40)=0x5b30120f, 0x82}, {0x8, &(0x7f0000000e80)=0x8, 0x2}, {0x7, &(0x7f0000000ec0)=0xc2, 0x82}, {0x3, &(0x7f0000000f00)=0xfffffffffffffffb, 0x2}, {0x7, &(0x7f0000000f40)=0x3e5, 0x2}, {0x7, &(0x7f0000000f80)=0xdda, 0x82}, {0x4, &(0x7f0000000fc0)=0x7fff, 0x82}, {0x8, &(0x7f0000001000)=0x3, 0x2}, {0xe, &(0x7f0000001040)=0x8000000000000001, 0x2}, {0x5, &(0x7f0000001080)=0x2, 0x2}, {0x65b82493, &(0x7f00000010c0)=0x4, 0x82}, {0x3, &(0x7f0000001100)=0x268a, 0x2}, {0xfffffffffffffffa, &(0x7f0000001140)=0x333, 0x2}, {0xe, &(0x7f0000001180)=0x2, 0x2}, {0x7, &(0x7f00000011c0), 0x104}, {0x5, &(0x7f0000001200)=0x8, 0x82}, {0x6, &(0x7f0000001240)=0x1, 0x82}, {0x2, &(0x7f0000001280)=0xfffffffffffffff7, 0x2}, {0x10fa, &(0x7f00000012c0), 0x82}, {0x4, &(0x7f0000001300)=0x8, 0x82}, {0xa, &(0x7f0000001340)=0x80, 0x2}, {0xfffffffffffffff7, &(0x7f0000001380)=0x6, 0x2}, {0x7f, &(0x7f00000013c0)=0xc, 0x2}, {0x4, &(0x7f0000001400)=0x3, 0x2}, {0x7fff, &(0x7f0000001440)=0x9, 0x82}, {0x8, &(0x7f0000001480)=0x1}, {0xffffffffffff5027, &(0x7f00000014c0)=0x70, 0x82}, {0x5, &(0x7f0000001500)=0x9, 0x82}, {0x6a, &(0x7f0000001540)=0x7fffffffffffffff, 0x82}, {0xcb5f, &(0x7f0000001580)=0x4, 0x43}, {0x9, &(0x7f00000015c0)=0x10000, 0x82}, {0x7, &(0x7f0000001600), 0x2}, {0x8, &(0x7f0000001640)=0xec, 0x82}, {0x7fffffffffffffff, &(0x7f0000001680)=0x8, 0x82}, {0x4, &(0x7f00000016c0)=0x5}, {0xad, &(0x7f0000001700)=0x35e, 0x82}, {0x3d50000000, &(0x7f0000001740)=0x85, 0x82}, {0x100000001, &(0x7f0000001780)=0x1, 0x82}, {0x0, &(0x7f00000017c0)=0x9, 0x82}, {0xfe4, &(0x7f0000001800)=0x1000, 0x2}, {0xc, &(0x7f0000001840)=0x10001, 0x2}, {0xffffffff, &(0x7f0000001880)=0x8, 0x82}, {0x1, &(0x7f00000018c0)=0x9, 0x82}, {0x9ff0, &(0x7f0000001900)=0x10, 0x82}, {0x3, &(0x7f0000001940)=0x16, 0x82}, {0xc, &(0x7f0000001980)=0x8, 0x82}, {0x5, &(0x7f00000019c0)=0x7, 0x2}, {0xcf, &(0x7f0000001a00)=0x101, 0x2}, {0xfffffffffffffff8, &(0x7f0000001a40)=0x9, 0x2}, {0x9, &(0x7f0000001a80)=0x3, 0x82}, {0xffffffffffffffff, &(0x7f0000001ac0)=0x6, 0x80}, {0x5835, &(0x7f0000001b00)=0x965, 0x82}, {0x5, &(0x7f0000001b40)=0x2, 0x82}, {0x4, &(0x7f0000001b80)=0x5a10d732, 0x82}, {0x9, &(0x7f0000001bc0)=0x7, 0x2}, {0x100, &(0x7f0000001c00)=0x4, 0x82}, {0xe0b0, &(0x7f0000001c40)=0x1, 0x2}, {0x7, &(0x7f0000001c80)=0x40, 0x82}, {0x800, &(0x7f0000001cc0)=0x4, 0x2}, {0x9, &(0x7f0000001d00)=0x6, 0x82}], 0x55, 0x0, &(0x7f0000002540)={0x77359400}, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xa, 0x10010, r1, 0x3a441000) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_RADAR_DETECT(r7, &(0x7f0000002680)={&(0x7f0000002580)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000002640)={&(0x7f00000025c0)={0x54, r4, 0x400, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x6}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xa}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}]}, 0x54}, 0x1, 0x0, 0x0, 0x20008001}, 0x4080) syslog(0xa, 0x0, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000002700)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r8, &(0x7f0000002800)={&(0x7f00000026c0), 0xc, &(0x7f00000027c0)={&(0x7f0000002740)={0x4c, r4, 0x1, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x8}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x4c}, 0x1, 0x0, 0x0, 0x48000}, 0x30008080) ioctl$SIOCGETNODEID(r1, 0x89e1, &(0x7f0000002840)={0x3}) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000002880)) r10 = syz_genetlink_get_family_id$fou(&(0x7f0000002900), r1) sendmsg$FOU_CMD_ADD(r7, &(0x7f00000029c0)={&(0x7f00000028c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000002980)={&(0x7f0000002940)={0x30, r10, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @local}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e21}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000050}, 0x40000d4) sendmsg$NL80211_CMD_PROBE_CLIENT(r1, &(0x7f0000002ac0)={&(0x7f0000002a00)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000002a80)={&(0x7f0000002a40)={0x20, r4, 0x20, 0x70bd2b, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x12) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000002b40), 0xffffffffffffffff) sendmsg$NL80211_CMD_STOP_NAN(r8, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b80)={0x14, r11, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4014}, 0x40004) r12 = syz_genetlink_get_family_id$tipc2(&(0x7f0000002c80), r8) sendmsg$TIPC_NL_SOCK_GET(r7, &(0x7f0000002ec0)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x92004000}, 0xc, &(0x7f0000002e80)={&(0x7f0000002cc0)={0x1a4, r12, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5fc1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xa42}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x10001}]}, @TIPC_NLA_NODE={0x70, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "ef7dbbfdb98c72f57ff91648a6a0561247845570"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xffffffff}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xfffffffb}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x4}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xffff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4232}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x81}]}, @TIPC_NLA_NODE={0x4}, @TIPC_NLA_SOCK={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6b7b}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8}]}]}, @TIPC_NLA_SOCK={0x38, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1c00000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x101}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_PUBL={0x4}, @TIPC_NLA_LINK={0x54, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x29}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x4}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}]}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x90}, 0x4000000) syslog(0x4, &(0x7f0000002f00)=""/79, 0x4f) 0s ago: executing program 3 (id=344): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000440)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x400e0d1}, 0x4004000) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) mmap$IORING_OFF_PBUF_RING(0x0, 0x69, 0x3000008, 0x80010, 0xffffffffffffffff, 0x840ee97c) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000340)={@map=r1, 0x2e, 0x0, 0x8, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x0, &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) r2 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000100)='tcp_nodelay\x00', &(0x7f0000000200)='1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) r3 = syz_open_dev$swradio(&(0x7f0000000040), 0x1, 0x2) pread64(r3, &(0x7f0000000100)=""/72, 0x48, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/vm/nr_hugepages\x00', 0x1, 0x0) write(r4, &(0x7f00000004c0)="33300aef41b1d30fa74216337aeac6fd83eb413d049d615d64dda628ecf94e03d8e5f40b0a2e", 0x26) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000300)='recover_s3\x00sion\x00', &(0x7f0000000400)='no\x00', 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="280000006a00831300000000000000ffa60000000000000008000e0000000000080005"], 0x28}, 0x1, 0x0, 0x0, 0x400d050}, 0x240c881c) r5 = socket$netlink(0x10, 0x3, 0x12) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$vim2m(&(0x7f0000000640), 0x1, 0x2) capset(&(0x7f00000003c0)={0x19980330}, &(0x7f0000000400)) r6 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x402) write$uinput_user_dev(r6, &(0x7f00000003c0)={'syz1\x00', {0x5, 0x5, 0x5, 0xfff7}, 0x24, [0x6, 0x83bd, 0x69e, 0xffffff81, 0x0, 0x8, 0x4, 0xc160, 0x4, 0xfffffffa, 0x0, 0x6, 0xfffff94c, 0x4, 0x8f2, 0x1e, 0x80, 0xfffffff8, 0x1, 0x1000, 0x0, 0x7c12ad8f, 0xff, 0x5, 0x80000001, 0x7fffffff, 0x8, 0x5, 0x1, 0x81, 0xb6, 0x5, 0x3, 0xd, 0x6, 0x192, 0x3, 0xffff, 0x5, 0xa0, 0x40, 0x100, 0xa, 0x9, 0xfffffffc, 0x0, 0x8, 0x6, 0x1, 0xffffffff, 0x0, 0x7ff, 0x4, 0x80, 0x7e, 0xf, 0xffffffff, 0x7, 0x2, 0x7, 0xffffffff, 0x8, 0x0, 0xffffffff], [0x5, 0x9, 0x7ff, 0xfffffffc, 0x8, 0x7, 0x7, 0x0, 0x1000, 0x0, 0x5426, 0xfffffeff, 0x8, 0x4, 0x4, 0x10, 0x8, 0x0, 0x8, 0x3, 0x800, 0xbd98, 0x6b, 0x73, 0x2, 0x1ff, 0x3, 0x0, 0x8, 0x65, 0xe, 0xa3, 0x1000, 0x166, 0x5, 0x3, 0x9, 0x5, 0x200, 0x5, 0xd, 0x5, 0xb, 0x5, 0xffff, 0x4130, 0x7, 0x8, 0x4, 0xfffffff4, 0x9, 0x2, 0x1, 0x4e9d, 0x2, 0x6, 0x0, 0x3, 0xfffffff9, 0x10000, 0x7, 0xd, 0xb, 0x9], [0x7, 0x894, 0xa0d, 0xffff, 0x2, 0x401, 0x8, 0x1, 0x5, 0x1, 0x1, 0x1ff, 0x7fffffff, 0xb4, 0xb, 0x8, 0x9, 0x4, 0x2, 0x8001, 0x2, 0xffffff0e, 0xc, 0x4, 0xb77c, 0x4, 0x5, 0xc, 0x80000000, 0x1, 0x5, 0xffff6b89, 0x1, 0x4, 0xfffffffd, 0xeb5, 0x8a, 0x28000, 0xff, 0x7, 0x2, 0x10, 0x2, 0x8, 0x807, 0x9, 0x200, 0x0, 0x6, 0xffffffff, 0xacf3, 0x4, 0x200, 0x3, 0x9, 0x7, 0x6a3, 0xd, 0x614d935e, 0x1ff, 0x400, 0x7a, 0x1ff, 0x2], [0xc, 0xfffffff7, 0x2, 0x1, 0x200, 0xd2a, 0x8, 0x7, 0x9, 0x5, 0x2, 0x80000000, 0x3, 0x6, 0xffffff56, 0xfffffffd, 0x3a, 0x3, 0xc, 0x1, 0x77d, 0x7, 0xfff00000, 0x2, 0xc0, 0x4, 0x7, 0x2, 0xec, 0x62, 0x10001, 0x1, 0x114, 0x5, 0x3, 0xfffffff8, 0x0, 0x0, 0x28, 0x8000, 0x3, 0x5, 0x2, 0x9, 0x4, 0x15, 0x0, 0x9, 0xffffff42, 0x1, 0x3, 0xc, 0x2, 0x59eb, 0x3ff, 0x7, 0xffffffff, 0x8, 0xffff, 0x3, 0x3, 0x5, 0xf, 0x6]}, 0x45c) pselect6(0x40, &(0x7f0000000180)={0x8, 0x9, 0x7, 0x7, 0xd6, 0x9d, 0x5, 0x8}, 0x0, 0x0, 0x0, 0x0) ioprio_set$uid(0x3, 0x0, 0x4000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)) r7 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000780)={'vxcan1\x00'}) kernel console output (not intermixed with test programs): [ 28.851681][ T43] audit: type=1400 audit(1790921911.678:113): avc: denied { write } for pid=5633 comm="sh" path="pipe:[2931]" dev="pipefs" ino=2931 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 28.852234][ T43] audit: type=1400 audit(1790921911.678:114): avc: denied { rlimitinh } for pid=5633 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 28.852356][ T43] audit: type=1400 audit(1790921911.678:115): avc: denied { siginh } for pid=5633 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '[localhost]:63750' (ED25519) to the list of known hosts. [ 30.378580][ T43] audit: type=1400 audit(1790921913.208:116): avc: denied { name_bind } for pid=5640 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 30.415029][ T43] audit: type=1400 audit(1790921913.238:117): avc: denied { execute } for pid=5641 comm="sh" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 30.418452][ T43] audit: type=1400 audit(1790921913.248:118): avc: denied { execute_no_trans } for pid=5641 comm="sh" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 30.528360][ T43] audit: type=1400 audit(1790921913.358:119): avc: denied { write } for pid=5642 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.571133][ T43] audit: type=1400 audit(1790921913.398:120): avc: denied { write } for pid=5645 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.486186][ T43] audit: type=1400 audit(1790921914.318:121): avc: denied { write } for pid=5648 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.524883][ T43] audit: type=1400 audit(1790921914.348:122): avc: denied { write } for pid=5651 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.742563][ T43] audit: type=1400 audit(1790921914.568:123): avc: denied { write } for pid=5654 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.780277][ T43] audit: type=1400 audit(1790921914.608:124): avc: denied { write } for pid=5657 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.950717][ T43] audit: type=1400 audit(1790921914.778:125): avc: denied { write } for pid=5660 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.601474][ T5641] cgroup: Unknown subsys name 'net' [ 32.678555][ T5641] cgroup: Unknown subsys name 'cpuset' [ 32.680806][ T5641] cgroup: Unknown subsys name 'rlimit' [ 32.864095][ T5690] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 33.575116][ T5641] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 36.952072][ T43] kauditd_printk_skb: 35 callbacks suppressed [ 36.952084][ T43] audit: type=1400 audit(1790921919.778:161): avc: denied { execmem } for pid=5719 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 37.137533][ T43] audit: type=1400 audit(1790921919.968:162): avc: denied { create } for pid=5723 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.137947][ T43] audit: type=1400 audit(1790921919.968:163): avc: denied { read write } for pid=5723 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.138289][ T43] audit: type=1400 audit(1790921919.968:164): avc: denied { open } for pid=5723 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.146149][ T43] audit: type=1400 audit(1790921919.968:165): avc: denied { ioctl } for pid=5724 comm="syz-executor" path="socket:[6382]" dev="sockfs" ino=6382 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.176403][ T65] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 37.180438][ T5736] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 37.181872][ T5736] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 37.182228][ T5736] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 37.185745][ T5736] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 37.185883][ T5736] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 37.186518][ T5736] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 37.186784][ T5736] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 37.189265][ T5738] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 37.190979][ T5738] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 37.191813][ T43] audit: type=1400 audit(1790921920.018:166): avc: denied { read } for pid=5723 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 37.192075][ T43] audit: type=1400 audit(1790921920.018:167): avc: denied { open } for pid=5723 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 37.195153][ T5738] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 37.195747][ T43] audit: type=1400 audit(1790921920.018:168): avc: denied { mounton } for pid=5723 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 37.196102][ T5738] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 37.197192][ T5738] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 37.198082][ T5737] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 37.199489][ T5087] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 37.200590][ T5087] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 37.201453][ T43] audit: type=1400 audit(1790921920.028:169): avc: denied { module_request } for pid=5723 comm="syz-executor" kmod="netdev-nr3" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 37.201630][ T5737] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 37.201908][ T5738] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 37.209089][ T5087] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 37.215547][ T5732] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 37.232343][ T43] audit: type=1400 audit(1790921920.058:170): avc: denied { sys_module } for pid=5723 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 37.831947][ T5723] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.833289][ T5723] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.833457][ T5723] bridge_slave_0: entered allmulticast mode [ 37.834265][ T5723] bridge_slave_0: entered promiscuous mode [ 37.836072][ T5733] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.836111][ T5733] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.836364][ T5733] bridge_slave_0: entered allmulticast mode [ 37.837252][ T5733] bridge_slave_0: entered promiscuous mode [ 37.861415][ T5723] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.861607][ T5723] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.861719][ T5723] bridge_slave_1: entered allmulticast mode [ 37.862556][ T5723] bridge_slave_1: entered promiscuous mode [ 37.863816][ T5733] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.863891][ T5733] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.863978][ T5733] bridge_slave_1: entered allmulticast mode [ 37.865235][ T5733] bridge_slave_1: entered promiscuous mode [ 37.905143][ T5731] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.905246][ T5731] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.905401][ T5731] bridge_slave_0: entered allmulticast mode [ 37.906289][ T5731] bridge_slave_0: entered promiscuous mode [ 37.926843][ T5733] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.926926][ T5731] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.926969][ T5731] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.927034][ T5731] bridge_slave_1: entered allmulticast mode [ 37.928337][ T5731] bridge_slave_1: entered promiscuous mode [ 37.929326][ T5724] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.929367][ T5724] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.929518][ T5724] bridge_slave_0: entered allmulticast mode [ 37.930311][ T5724] bridge_slave_0: entered promiscuous mode [ 37.932418][ T5723] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.932513][ T5724] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.932582][ T5724] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.932668][ T5724] bridge_slave_1: entered allmulticast mode [ 37.933970][ T5724] bridge_slave_1: entered promiscuous mode [ 37.936935][ T5733] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.949420][ T5723] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.987432][ T5731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.994288][ T5731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.995357][ T5723] team0: Port device team_slave_0 added [ 38.003292][ T5733] team0: Port device team_slave_0 added [ 38.012207][ T5724] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.013616][ T5731] team0: Port device team_slave_0 added [ 38.015176][ T5723] team0: Port device team_slave_1 added [ 38.017663][ T5731] team0: Port device team_slave_1 added [ 38.018819][ T5733] team0: Port device team_slave_1 added [ 38.027479][ T5724] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.074001][ T5733] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.074013][ T5733] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.074026][ T5733] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.075578][ T5724] team0: Port device team_slave_0 added [ 38.076424][ T5733] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.076433][ T5733] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.076446][ T5733] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.077089][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.077096][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.077108][ T5731] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.078178][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.078185][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.078197][ T5731] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.083679][ T5723] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.083688][ T5723] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.083701][ T5723] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.085093][ T5724] team0: Port device team_slave_1 added [ 38.085377][ T5723] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.085385][ T5723] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.085397][ T5723] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.140323][ T5724] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.140334][ T5724] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.140347][ T5724] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.150934][ T5733] hsr_slave_0: entered promiscuous mode [ 38.151423][ T5733] hsr_slave_1: entered promiscuous mode [ 38.158013][ T5731] hsr_slave_0: entered promiscuous mode [ 38.158485][ T5731] hsr_slave_1: entered promiscuous mode [ 38.158781][ T5731] debugfs: 'hsr0' already exists in 'hsr' [ 38.158843][ T5731] Cannot create hsr debugfs directory [ 38.159537][ T5724] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.159550][ T5724] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.159564][ T5724] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.179652][ T5723] hsr_slave_0: entered promiscuous mode [ 38.180081][ T5723] hsr_slave_1: entered promiscuous mode [ 38.180389][ T5723] debugfs: 'hsr0' already exists in 'hsr' [ 38.180400][ T5723] Cannot create hsr debugfs directory [ 38.294352][ T5724] hsr_slave_0: entered promiscuous mode [ 38.295341][ T5724] hsr_slave_1: entered promiscuous mode [ 38.295976][ T5724] debugfs: 'hsr0' already exists in 'hsr' [ 38.295993][ T5724] Cannot create hsr debugfs directory [ 38.589860][ T5731] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.596015][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.597123][ T5731] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.601744][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.602380][ T5731] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.607210][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.618610][ T5731] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.621338][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.675254][ T5733] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 38.681041][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.681770][ T5733] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 38.685566][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.687030][ T5733] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 38.690602][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.691077][ T5733] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 38.694708][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.759456][ T5723] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 38.762975][ T5723] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.767545][ T5723] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 38.772254][ T5723] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.772664][ T5723] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 38.776982][ T5723] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.777797][ T5723] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 38.779786][ T5723] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.856973][ T5731] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.864218][ T5724] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 38.867402][ T5724] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.878188][ T5724] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 38.880385][ T5724] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.880751][ T5724] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 38.882283][ T5724] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.884144][ T5731] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.891007][ T5724] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 38.894407][ T5724] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.910932][ T5733] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.912403][ T1160] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.912477][ T1160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.932677][ T1160] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.932758][ T1160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.960707][ T5733] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.973900][ T5723] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.983927][ T1160] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.983974][ T1160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.988050][ T1160] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.988092][ T1160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.017879][ T5723] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.030006][ T1160] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.030053][ T1160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.040082][ T1160] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.040126][ T1160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.083711][ T5724] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.117521][ T5724] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.122361][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.122420][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.130610][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.130654][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.219108][ T5087] Bluetooth: hci1: command tx timeout [ 39.219112][ T65] Bluetooth: hci0: command tx timeout [ 39.297229][ T5087] Bluetooth: hci3: command tx timeout [ 39.297265][ T65] Bluetooth: hci2: command tx timeout [ 39.311844][ T5731] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.345571][ T5731] veth0_vlan: entered promiscuous mode [ 39.351538][ T5731] veth1_vlan: entered promiscuous mode [ 39.361446][ T5733] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.370226][ T5731] veth0_macvtap: entered promiscuous mode [ 39.373177][ T5731] veth1_macvtap: entered promiscuous mode [ 39.392740][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.394939][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.413598][ T5733] veth0_vlan: entered promiscuous mode [ 39.428107][ T5733] veth1_vlan: entered promiscuous mode [ 39.454322][ T5724] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.455956][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.456199][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.456230][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.456259][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.487238][ T196] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.487252][ T196] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.501695][ T5723] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.514029][ T5733] veth0_macvtap: entered promiscuous mode [ 39.527182][ T5733] veth1_macvtap: entered promiscuous mode [ 39.537273][ T1160] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.537290][ T1160] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.554545][ T5724] veth0_vlan: entered promiscuous mode [ 39.569612][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.583679][ T5724] veth1_vlan: entered promiscuous mode [ 39.589898][ T5723] veth0_vlan: entered promiscuous mode [ 39.592703][ T5731] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 39.592847][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.599593][ T5723] veth1_vlan: entered promiscuous mode [ 39.637500][ T5724] veth0_macvtap: entered promiscuous mode [ 39.646430][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.646597][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.646865][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.647100][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.654478][ T5724] veth1_macvtap: entered promiscuous mode [ 39.668279][ T5723] veth0_macvtap: entered promiscuous mode [ 39.671763][ T5723] veth1_macvtap: entered promiscuous mode [ 39.687006][ T196] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.687027][ T196] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.694070][ T5724] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.705783][ T5723] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.715130][ T5724] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.721269][ T5876] [U]  [ 39.727195][ T5723] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.729417][ T196] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.729430][ T196] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.779360][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.817701][ T196] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.817714][ T196] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.826187][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.835710][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.837449][ T1160] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.837461][ T1160] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.853316][ T196] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.853332][ T196] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.856387][ T5877] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.856548][ T5877] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.856651][ T5877] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.856765][ T5877] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.856911][ T5877] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.870028][ T196] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.870126][ T196] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.037966][ T42] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 40.084165][ T1348] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 40.204122][ T5896] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.204535][ T5896] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.206086][ T5520] usb 7-1: new low-speed USB device number 2 using dummy_hcd [ 40.296861][ T42] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 40.337954][ T1348] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 40.367647][ T5520] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 40.369516][ T5520] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 40.369542][ T5520] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 40.369555][ T5520] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 40.369568][ T5520] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 40.369581][ T5520] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 40.370324][ T5520] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 40.370372][ T5520] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 40.370385][ T5520] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 40.370398][ T5520] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 40.370411][ T5520] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 40.371127][ T5520] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 40.371146][ T5520] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 40.371159][ T5520] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 40.371171][ T5520] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 40.371183][ T5520] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 40.373775][ T5520] usb 7-1: string descriptor 0 read error: -22 [ 40.374082][ T5520] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.387487][ T5520] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 40.445972][ T5878] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 40.591863][ T5886] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3'. [ 40.599983][ T5878] usb 6-1: Using ep0 maxpacket: 8 [ 40.603323][ T5878] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 40.604147][ T5878] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 40.604163][ T5878] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 40.604174][ T5878] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 40.604186][ T5878] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 40.604204][ T5878] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.806379][ T5819] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 40.809760][ T5878] usb 6-1: GET_CAPABILITIES returned 0 [ 40.809785][ T5878] usbtmc 6-1:16.0: can't read capabilities [ 40.833449][ T5891] ceph: No mds server is up or the cluster is laggy [ 40.833588][ T5887] ceph: No mds server is up or the cluster is laggy [ 40.857069][ T1348] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 40.932682][ T65] Bluetooth: hci3: ACL packet too small [ 40.932752][ T65] Bluetooth: hci3: ACL packet too small [ 40.932833][ T65] Bluetooth: hci3: ACL packet too small [ 40.932978][ T65] Bluetooth: hci3: ACL packet too small [ 40.933052][ T65] Bluetooth: hci3: ACL packet too small [ 40.934393][ T65] Bluetooth: hci3: ACL packet too small [ 40.934424][ T65] Bluetooth: hci3: ACL packet too small [ 40.934450][ T65] Bluetooth: hci3: ACL packet too small [ 40.934475][ T65] Bluetooth: hci3: ACL packet too small [ 40.934500][ T65] Bluetooth: hci3: ACL packet too small [ 40.934526][ T65] Bluetooth: hci3: ACL packet too small [ 40.934552][ T65] Bluetooth: hci3: ACL packet too small [ 40.934576][ T65] Bluetooth: hci3: ACL packet too small [ 40.934601][ T65] Bluetooth: hci3: ACL packet too small [ 40.934627][ T65] Bluetooth: hci3: ACL packet too small [ 40.934698][ T65] Bluetooth: hci3: ACL packet too small [ 40.934715][ T65] Bluetooth: hci3: ACL packet too small [ 40.934730][ T65] Bluetooth: hci3: ACL packet too small [ 40.934744][ T65] Bluetooth: hci3: ACL packet too small [ 40.934759][ T65] Bluetooth: hci3: ACL packet too small [ 40.934773][ T65] Bluetooth: hci3: ACL packet too small [ 40.934788][ T65] Bluetooth: hci3: ACL packet too small [ 40.934802][ T65] Bluetooth: hci3: ACL packet too small [ 40.934820][ T65] Bluetooth: hci3: ACL packet too small [ 40.934834][ T65] Bluetooth: hci3: ACL packet too small [ 40.934848][ T65] Bluetooth: hci3: ACL packet too small [ 40.934862][ T65] Bluetooth: hci3: ACL packet too small [ 40.934877][ T65] Bluetooth: hci3: ACL packet too small [ 40.934892][ T65] Bluetooth: hci3: ACL packet too small [ 40.934906][ T65] Bluetooth: hci3: ACL packet too small [ 40.934920][ T65] Bluetooth: hci3: ACL packet too small [ 40.934934][ T65] Bluetooth: hci3: ACL packet too small [ 40.934948][ T65] Bluetooth: hci3: ACL packet too small [ 40.934962][ T65] Bluetooth: hci3: ACL packet too small [ 40.934975][ T65] Bluetooth: hci3: ACL packet too small [ 40.934989][ T65] Bluetooth: hci3: ACL packet too small [ 40.935003][ T65] Bluetooth: hci3: ACL packet too small [ 40.935018][ T65] Bluetooth: hci3: ACL packet too small [ 40.935032][ T65] Bluetooth: hci3: ACL packet too small [ 40.935045][ T65] Bluetooth: hci3: ACL packet too small [ 40.935059][ T65] Bluetooth: hci3: ACL packet too small [ 40.935073][ T65] Bluetooth: hci3: ACL packet too small [ 40.935087][ T65] Bluetooth: hci3: ACL packet too small [ 40.935101][ T65] Bluetooth: hci3: ACL packet too small [ 40.935115][ T65] Bluetooth: hci3: ACL packet too small [ 40.935128][ T65] Bluetooth: hci3: ACL packet too small [ 40.935142][ T65] Bluetooth: hci3: ACL packet too small [ 40.935156][ T65] Bluetooth: hci3: ACL packet too small [ 40.935169][ T65] Bluetooth: hci3: ACL packet too small [ 40.935183][ T65] Bluetooth: hci3: ACL packet too small [ 40.935198][ T65] Bluetooth: hci3: ACL packet too small [ 40.935211][ T65] Bluetooth: hci3: ACL packet too small [ 40.935225][ T65] Bluetooth: hci3: ACL packet too small [ 40.935239][ T65] Bluetooth: hci3: ACL packet too small [ 40.935253][ T65] Bluetooth: hci3: ACL packet too small [ 40.935267][ T65] Bluetooth: hci3: ACL packet too small [ 40.935280][ T65] Bluetooth: hci3: ACL packet too small [ 40.935294][ T65] Bluetooth: hci3: ACL packet too small [ 40.935308][ T65] Bluetooth: hci3: ACL packet too small [ 40.935324][ T65] Bluetooth: hci3: ACL packet too small [ 40.935338][ T65] Bluetooth: hci3: ACL packet too small [ 40.935351][ T65] Bluetooth: hci3: ACL packet too small [ 40.935365][ T65] Bluetooth: hci3: ACL packet too small [ 40.935379][ T65] Bluetooth: hci3: ACL packet too small [ 40.935393][ T65] Bluetooth: hci3: ACL packet too small [ 40.982114][ T5914] netlink: 'syz.0.10': attribute type 39 has an invalid length. [ 41.205746][ T5878] usb 8-1: new low-speed USB device number 2 using dummy_hcd [ 41.296835][ T65] Bluetooth: hci1: command tx timeout [ 41.296867][ T5087] Bluetooth: hci0: command tx timeout [ 41.366481][ T5878] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 41.367334][ T5878] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 41.367357][ T5878] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 41.367370][ T5878] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 41.367382][ T5878] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 41.367394][ T5878] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 41.369415][ T5878] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 41.369441][ T5878] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 41.369453][ T5878] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 41.369465][ T5878] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 41.369478][ T5878] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 41.370220][ T5878] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 41.370241][ T5878] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 41.370258][ T5878] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 41.370275][ T5878] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 41.370293][ T5878] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 41.372554][ T5878] usb 8-1: string descriptor 0 read error: -22 [ 41.372607][ T5878] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.375881][ T5087] Bluetooth: hci3: command tx timeout [ 41.378178][ T5087] Bluetooth: hci2: command tx timeout [ 41.380793][ T5878] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux2 [ 41.581547][ T851] usb 8-1: USB disconnect, device number 2 [ 42.114943][ T43] kauditd_printk_skb: 66 callbacks suppressed [ 42.114963][ T43] audit: type=1400 audit(1790921924.938:237): avc: denied { prog_run } for pid=5919 comm="syz.3.12" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 42.124528][ T43] audit: type=1400 audit(1790921924.948:238): avc: denied { mount } for pid=5919 comm="syz.3.12" name="/" dev="configfs" ino=1127 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 42.124563][ T43] audit: type=1400 audit(1790921924.948:239): avc: denied { search } for pid=5919 comm="syz.3.12" name="/" dev="configfs" ino=1127 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.124583][ T43] audit: type=1400 audit(1790921924.948:240): avc: denied { search } for pid=5919 comm="syz.3.12" name="nullb" dev="configfs" ino=365 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.124602][ T43] audit: type=1400 audit(1790921924.948:241): avc: denied { write search } for pid=5919 comm="syz.3.12" name="nullb" dev="configfs" ino=365 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.124621][ T43] audit: type=1400 audit(1790921924.948:242): avc: denied { add_name } for pid=5919 comm="syz.3.12" name="rnullb0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.124640][ T43] audit: type=1400 audit(1790921924.948:243): avc: denied { create } for pid=5919 comm="syz.3.12" name="rnullb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 42.127083][ T43] audit: type=1400 audit(1790921924.948:244): avc: denied { search } for pid=5919 comm="syz.3.12" name="/" dev="configfs" ino=1127 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.127111][ T43] audit: type=1400 audit(1790921924.958:245): avc: denied { search } for pid=5919 comm="syz.3.12" name="nullb" dev="configfs" ino=365 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.127135][ T43] audit: type=1400 audit(1790921924.958:246): avc: denied { search } for pid=5919 comm="syz.3.12" name="rnullb0" dev="configfs" ino=9645 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.307048][ T5926] netlink: 'syz.3.15': attribute type 1 has an invalid length. [ 42.308541][ T5926] netlink: 8 bytes leftover after parsing attributes in process `syz.3.15'. [ 42.320247][ T5926] netlink: 4 bytes leftover after parsing attributes in process `syz.3.15'. [ 42.374945][ T5926] No such timeout policy "" [ 42.375055][ T5926] netlink: Failed to associated timeout policy '' [ 42.462791][ T5934] netlink: 4 bytes leftover after parsing attributes in process `syz.3.18'. [ 42.464570][ T5933] netlink: 4 bytes leftover after parsing attributes in process `syz.3.18'. [ 42.489248][ T5933] Zero length message leads to an empty skb [ 42.607824][ T5942] netlink: 12 bytes leftover after parsing attributes in process `syz.0.20'. [ 42.647871][ T5945] block nbd0: NBD_DISCONNECT [ 42.654708][ T5945] netlink: 'syz.0.21': attribute type 4 has an invalid length. [ 42.654726][ T5945] netlink: 152 bytes leftover after parsing attributes in process `syz.0.21'. [ 42.662097][ T5945] .`: renamed from bond0 (while UP) [ 42.738851][ T5947] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 42.792933][ T5948] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 42.844758][ T5947] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 43.214628][ T9] usb 6-1: USB disconnect, device number 2 [ 43.336799][ T5959] netlink: 8 bytes leftover after parsing attributes in process `syz.1.25'. [ 43.338288][ T5959] netlink: 8 bytes leftover after parsing attributes in process `syz.1.25'. [ 43.376271][ T5087] Bluetooth: hci1: command tx timeout [ 43.380092][ T5965] scsi_nl_rcv_msg: discarding partial skb [ 43.386916][ T5087] Bluetooth: hci0: command tx timeout [ 43.456304][ T65] Bluetooth: hci3: command tx timeout [ 43.458819][ T5087] Bluetooth: hci2: command tx timeout [ 43.705838][ T5985] smc: net device veth1_macvtap applied user defined pnetid SYZ2 [ 43.759025][ T5987] kvm: user requested TSC rate below hardware speed [ 43.840130][ T5992] process 'syz.0.34' launched './file0' with NULL argv: empty string added [ 43.897472][ T5996] netlink: 'syz.3.35': attribute type 1 has an invalid length. [ 44.058984][ T6000] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 44.061509][ T6000] e1000e 0000:00:02.0 eth1: entered promiscuous mode [ 44.063248][ T6000] netlink: 'syz.3.36': attribute type 1 has an invalid length. [ 44.063260][ T6000] netlink: 1 bytes leftover after parsing attributes in process `syz.3.36'. [ 44.108136][ T5833] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 44.108171][ T5833] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 44.108188][ T5833] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 44.108205][ T5833] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 44.108222][ T5833] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 44.108236][ T5833] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 44.108252][ T5833] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 44.108270][ T5833] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 44.108287][ T5833] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 44.108304][ T5833] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 44.122143][ T5833] hid-generic 0000:0000:0000.0002: hidraw1: HID v0.03 Device [syz1] on syz1 [ 44.307120][ T6024] syz.3.38 uses obsolete (PF_INET,SOCK_PACKET) [ 44.319879][ T405] IPVS: starting estimator thread 0... [ 44.427618][ T6026] IPVS: using max 43 ests per chain, 103200 per kthread [ 44.479575][ T6044] netlink: 'syz.0.42': attribute type 11 has an invalid length. [ 44.481073][ T6044] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 44.498525][ T6046] nbd: must specify a size in bytes for the device [ 44.687526][ T9] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 44.688882][ T6071] netlink: 'syz.3.48': attribute type 58 has an invalid length. [ 44.742705][ T25] usb 7-1: USB disconnect, device number 2 [ 44.845877][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 44.847249][ T9] usb 6-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 44.848226][ T9] usb 6-1: config 1 has an invalid descriptor of length 173, skipping remainder of the config [ 44.848246][ T9] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 44.848262][ T9] usb 6-1: config 1 has no interface number 0 [ 44.848292][ T9] usb 6-1: config 1 interface 1 altsetting 1 has an endpoint descriptor with address 0xBC, changing to 0x8C [ 44.848313][ T9] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x8C has an invalid bInterval 93, changing to 7 [ 44.848333][ T9] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x8C has invalid maxpacket 9440, setting to 1024 [ 44.850609][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.850629][ T9] usb 6-1: Product: syz [ 44.850641][ T9] usb 6-1: Manufacturer: syz [ 44.850652][ T9] usb 6-1: SerialNumber: syz [ 44.948597][ T6094] SELinux: security_context_str_to_sid (5] S9q#) failed with errno=-22 [ 45.046641][ T5833] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 45.096642][ T9] usb 6-1: USB disconnect, device number 3 [ 45.136065][ T6095] udevd[6095]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb6/6-1/6-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 45.209096][ T5833] usb 8-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 45.210782][ T5833] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 45.210803][ T5833] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 45.210830][ T5833] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 45.218525][ T5833] spcp8x5 8-1:1.0: SPCP8x5 converter detected [ 45.231405][ T5833] usb 8-1: SPCP8x5 converter now attached to ttyUSB0 [ 45.271252][ T6115] overlayfs: failed to resolve './file0': -2 [ 45.274752][ T6115] netlink: 'syz.1.60': attribute type 5 has an invalid length. [ 45.280399][ T6115] ip6erspan0: entered promiscuous mode [ 45.352377][ T5087] Bluetooth: hci2: unexpected subevent 0x18 length: 30 > 19 [ 45.352396][ T5087] Bluetooth: hci2: Unable to find connection for dst 00:00:00:00:00:00 sid 0x00 [ 45.456065][ T5087] Bluetooth: hci1: command tx timeout [ 45.456089][ T5087] Bluetooth: hci0: command tx timeout [ 45.535964][ T65] Bluetooth: hci2: command tx timeout [ 45.535987][ T65] Bluetooth: hci3: command tx timeout [ 46.195476][ T6173] 9pnet_virtio: no channels available for device syz [ 46.228497][ T6175] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 46.343791][ T6181] __nla_validate_parse: 5 callbacks suppressed [ 46.343809][ T6181] netlink: 48 bytes leftover after parsing attributes in process `syz.0.81'. [ 46.349186][ T25] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 46.526601][ T25] usb 6-1: Using ep0 maxpacket: 8 [ 46.528126][ T25] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 46.529169][ T25] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 46.529186][ T25] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 46.529218][ T25] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 46.529239][ T25] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 46.529269][ T25] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 46.536909][ T25] hub 6-1:1.0: bad descriptor, ignoring hub [ 46.536926][ T25] hub 6-1:1.0: probe with driver hub failed with error -5 [ 46.537265][ T25] cdc_wdm 6-1:1.0: skipping garbage [ 46.537275][ T25] cdc_wdm 6-1:1.0: skipping garbage [ 46.540891][ T25] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 46.540902][ T25] cdc_wdm 6-1:1.0: Unknown control protocol [ 46.746444][ T6192] netlink: 44 bytes leftover after parsing attributes in process `syz.2.85'. [ 46.748972][ T6192] binder: 6191:6192 ioctl 4018620d 0 returned -22 [ 46.753528][ T6192] binder: 6191:6192 ioctl 80705864 200000000140 returned -22 [ 46.787620][ T6195] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 46.787815][ T6195] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 46.990607][ T6164] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 46.991021][ T6164] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.087645][ T9] usb 6-1: USB disconnect, device number 4 [ 47.089331][ T6203] netlink: 52 bytes leftover after parsing attributes in process `syz.2.88'. [ 47.444972][ T43] kauditd_printk_skb: 136 callbacks suppressed [ 47.444988][ T43] audit: type=1400 audit(1790921930.268:383): avc: denied { create } for pid=6207 comm="syz.2.89" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 47.445429][ T43] audit: type=1400 audit(1790921930.268:384): avc: denied { connect } for pid=6207 comm="syz.2.89" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 47.446022][ T43] audit: type=1400 audit(1790921930.278:385): avc: denied { setopt } for pid=6207 comm="syz.2.89" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 47.448289][ T43] audit: type=1400 audit(1790921930.278:386): avc: denied { create } for pid=6207 comm="syz.2.89" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 47.448558][ T43] audit: type=1400 audit(1790921930.278:387): avc: denied { write } for pid=6207 comm="syz.2.89" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 47.454320][ T6208] bridge_slave_0: left allmulticast mode [ 47.454338][ T6208] bridge_slave_0: left promiscuous mode [ 47.456205][ T6208] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.470441][ T6208] bridge_slave_1: left allmulticast mode [ 47.470458][ T6208] bridge_slave_1: left promiscuous mode [ 47.470570][ T6208] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.494103][ T6208] bond0: (slave bond_slave_0): Releasing backup interface [ 47.503208][ T6208] bond0: (slave bond_slave_1): Releasing backup interface [ 47.511181][ T6208] team0: Port device team_slave_0 removed [ 47.515391][ T6208] team0: Port device team_slave_1 removed [ 47.519166][ T6208] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 47.519193][ T6208] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 47.521959][ T6208] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 47.521977][ T6208] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 47.525566][ T6208] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 47.532040][ T6209] team0: Port device xfrm0 added [ 47.609842][ T6216] netlink: 'syz.1.91': attribute type 1 has an invalid length. [ 47.611237][ T43] audit: type=1400 audit(1790921930.438:388): avc: denied { bind } for pid=6215 comm="syz.1.91" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 47.611713][ T43] audit: type=1400 audit(1790921930.438:389): avc: denied { setopt } for pid=6215 comm="syz.1.91" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 47.691086][ T43] audit: type=1400 audit(1790921930.518:390): avc: denied { read } for pid=6218 comm="syz.2.92" path="socket:[10142]" dev="sockfs" ino=10142 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 47.735971][ T30] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 47.783340][ T6223] syzkaller0: entered promiscuous mode [ 47.783357][ T6223] syzkaller0: entered allmulticast mode [ 47.807874][ T25] usb 8-1: USB disconnect, device number 3 [ 47.835544][ T43] audit: type=1400 audit(1790921930.658:391): avc: denied { read } for pid=6228 comm="syz.1.94" name="rtc0" dev="devtmpfs" ino=943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 47.835573][ T43] audit: type=1400 audit(1790921930.658:392): avc: denied { open } for pid=6228 comm="syz.1.94" path="/dev/rtc0" dev="devtmpfs" ino=943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 47.841879][ T25] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 47.842240][ T25] spcp8x5 8-1:1.0: device disconnected [ 47.860276][ T6229] pimreg: entered allmulticast mode [ 47.887120][ T30] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 47.889517][ T30] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.889532][ T30] usb 5-1: Product: syz [ 47.889539][ T30] usb 5-1: Manufacturer: syz [ 47.889546][ T30] usb 5-1: SerialNumber: syz [ 47.917079][ T851] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 47.977532][ T6241] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 47.994238][ T6241] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 48.006264][ T6241] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 48.011220][ T6241] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 48.020256][ T6241] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 48.055993][ T5725] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 48.317591][ T5725] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 48.686051][ T6284] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.686244][ T6284] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.791529][ T6247] ceph: No mds server is up or the cluster is laggy [ 48.895431][ T6290] bond3: entered allmulticast mode [ 48.898259][ T6290] 8021q: adding VLAN 0 to HW filter on device bond3 [ 48.975883][ T851] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 48.976691][ T851] ath9k_htc: Failed to initialize the device [ 48.999768][ T851] usb 5-1: ath9k_htc: USB layer deinitialized [ 49.009779][ T5833] usb 5-1: USB disconnect, device number 2 [ 49.012641][ T6295] netlink: 8 bytes leftover after parsing attributes in process `syz.3.101'. [ 49.054886][ T6301] Bluetooth: MGMT ver 1.23 [ 49.089282][ T5087] Bluetooth: hci0: status 0x02 [ 49.089873][ T6306] netlink: 64 bytes leftover after parsing attributes in process `syz.3.105'. [ 49.549124][ T6326] netlink: 8 bytes leftover after parsing attributes in process `syz.0.107'. [ 49.549154][ T6326] netlink: 20 bytes leftover after parsing attributes in process `syz.0.107'. [ 49.575808][ T12] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 49.575848][ T12] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 49.575871][ T12] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 49.575897][ T12] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 49.626719][ T6332] syzkaller1: entered promiscuous mode [ 49.626733][ T6332] syzkaller1: entered allmulticast mode [ 49.644367][ T6334] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 49.644473][ T6334] batadv_slave_0: entered promiscuous mode [ 49.644483][ T6334] batadv_slave_0: entered allmulticast mode [ 49.650046][ T9] hid_parser_main: 62 callbacks suppressed [ 49.650060][ T9] hid-generic 0006:0004:0009.0003: unknown main item tag 0x0 [ 49.650074][ T9] hid-generic 0006:0004:0009.0003: unknown main item tag 0x0 [ 49.650086][ T9] hid-generic 0006:0004:0009.0003: unknown main item tag 0x0 [ 49.650099][ T9] hid-generic 0006:0004:0009.0003: unknown main item tag 0x0 [ 49.650111][ T9] hid-generic 0006:0004:0009.0003: unknown main item tag 0x0 [ 49.650123][ T9] hid-generic 0006:0004:0009.0003: unknown main item tag 0x0 [ 49.650135][ T9] hid-generic 0006:0004:0009.0003: unknown main item tag 0x0 [ 49.650147][ T9] hid-generic 0006:0004:0009.0003: unknown main item tag 0x0 [ 49.650159][ T9] hid-generic 0006:0004:0009.0003: unknown main item tag 0x0 [ 49.650172][ T9] hid-generic 0006:0004:0009.0003: unknown main item tag 0x0 [ 49.652734][ T9] hid-generic 0006:0004:0009.0003: hidraw1: VIRTUAL HID v0.04 Device [syz1] on syz0 [ 49.683741][ T6335] fido_id[6335]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 49.686981][ T6337] FAULT_INJECTION: forcing a failure. [ 49.686981][ T6337] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 49.686999][ T6337] CPU: 1 UID: 0 PID: 6337 Comm: syz.0.111 Not tainted syzkaller #0 PREEMPT(full) [ 49.687011][ T6337] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 49.687018][ T6337] Call Trace: [ 49.687021][ T6337] [ 49.687026][ T6337] dump_stack_lvl+0x100/0x190 [ 49.687057][ T6337] should_fail_ex.cold+0x5/0xa [ 49.687074][ T6337] _copy_from_user+0x2e/0xd0 [ 49.687092][ T6337] tipc_setsockopt+0x8ee/0xe30 [ 49.687112][ T6337] ? __pfx_tipc_setsockopt+0x10/0x10 [ 49.687129][ T6337] ? __fget_files+0x215/0x3d0 [ 49.687145][ T6337] ? selinux_socket_setsockopt+0x6a/0x80 [ 49.687159][ T6337] ? __pfx_tipc_setsockopt+0x10/0x10 [ 49.687174][ T6337] do_sock_setsockopt+0xf3/0x1d0 [ 49.687196][ T6337] __sys_setsockopt+0x195/0x220 [ 49.687213][ T6337] __x64_sys_setsockopt+0xbd/0x160 [ 49.687228][ T6337] ? do_syscall_64+0xae/0x790 [ 49.687239][ T6337] ? lockdep_hardirqs_on+0x7d/0x110 [ 49.687252][ T6337] do_syscall_64+0x123/0x790 [ 49.687265][ T6337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 49.687276][ T6337] RIP: 0033:0x7f1813b9e159 [ 49.687285][ T6337] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.687295][ T6337] RSP: 002b:00007f18149c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 49.687306][ T6337] RAX: ffffffffffffffda RBX: 00007f1813e25fa0 RCX: 00007f1813b9e159 [ 49.687313][ T6337] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000007 [ 49.687319][ T6337] RBP: 00007f1813c3506b R08: 0000000000000127 R09: 0000000000000000 [ 49.687328][ T6337] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000000 [ 49.687334][ T6337] R13: 00007f1813e26038 R14: 00007f1813e25fa0 R15: 00007ffd9ae43c78 [ 49.687348][ T6337] [ 49.785133][ T6346] netlink: 4 bytes leftover after parsing attributes in process `syz.0.113'. [ 49.829530][ T6350] netlink: 8 bytes leftover after parsing attributes in process `syz.0.115'. [ 50.030209][ T6366] mmap: syz.1.119 (6366) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 50.634303][ T6371] netlink: 32 bytes leftover after parsing attributes in process `syz.0.121'. [ 50.673816][ T6376] CIFS: Attempting to mount //127.0.0.1/share [ 51.512551][ T6376] CIFS: VFS: Error connecting to socket. Aborting operation. [ 51.515190][ T6376] CIFS: VFS: cifs_mount failed w/return code = -4 [ 51.620065][ T6407] ip_tables: iptables: counters copy to user failed while replacing table [ 51.734208][ T6422] netlink: 'syz.1.133': attribute type 1 has an invalid length. [ 51.734228][ T6422] netlink: 'syz.1.133': attribute type 1 has an invalid length. [ 51.768399][ T6414] SELinux: ebitmap start bit (514745416) is not a multiple of the map unit size (64) [ 51.768576][ T6414] SELinux: invalid class [ 51.770585][ T6414] SELinux: failed to load policy [ 51.809539][ T6425] ovs-dp0: entered promiscuous mode [ 51.810204][ T6431] netlink: 12 bytes leftover after parsing attributes in process `syz.0.135'. [ 51.880842][ T6431] geneve2: entered promiscuous mode [ 51.888198][ T6432] syzkaller1: entered allmulticast mode [ 51.892311][ T6432] syzkaller1: left allmulticast mode [ 52.464553][ T43] kauditd_printk_skb: 53 callbacks suppressed [ 52.464568][ T43] audit: type=1400 audit(1790921935.288:444): avc: denied { create } for pid=6494 comm="syz.2.144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 52.465217][ T43] audit: type=1400 audit(1790921935.288:445): avc: denied { write } for pid=6494 comm="syz.2.144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 52.480069][ T6496] Bluetooth: MGMT ver 1.23 [ 52.695020][ T43] audit: type=1400 audit(1790921935.518:446): avc: denied { mount } for pid=6512 comm="syz.1.146" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 52.695707][ T43] audit: type=1400 audit(1790921935.518:447): avc: denied { read write } for pid=6512 comm="syz.1.146" name="control" dev="devtmpfs" ino=1289 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 52.696074][ T43] audit: type=1400 audit(1790921935.528:448): avc: denied { open } for pid=6512 comm="syz.1.146" path="/29/dev/mapper/control" dev="devtmpfs" ino=1289 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 52.697566][ T43] audit: type=1400 audit(1790921935.528:449): avc: denied { ioctl } for pid=6512 comm="syz.1.146" path="/29/dev/mapper/control" dev="devtmpfs" ino=1289 ioctlcmd=0xfd08 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 52.719205][ T43] audit: type=1400 audit(1790921935.538:450): avc: denied { unmount } for pid=5733 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 52.755509][ T6518] netlink: 4 bytes leftover after parsing attributes in process `syz.1.148'. [ 52.756946][ T6518] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6518 comm=syz.1.148 [ 52.757169][ T6518] netlink: 8 bytes leftover after parsing attributes in process `syz.1.148'. [ 52.804933][ T6522] CIFS: Bad mount helper ver=1.0. Did you want SMB1 (CIFS) dialect and mean to type vers=1.0 instead? [ 52.805097][ T6522] netlink: 'syz.1.149': attribute type 63 has an invalid length. [ 52.805108][ T6522] netlink: 16 bytes leftover after parsing attributes in process `syz.1.149'. [ 52.853208][ T43] audit: type=1400 audit(1790921935.678:451): avc: denied { name_connect } for pid=6523 comm="syz.2.150" dest=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 52.857561][ T6524] netlink: 8 bytes leftover after parsing attributes in process `syz.2.150'. [ 52.857581][ T6524] netlink: 60 bytes leftover after parsing attributes in process `syz.2.150'. [ 53.002472][ T43] audit: type=1400 audit(1790921935.828:452): avc: denied { connect } for pid=6532 comm="syz.2.151" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 53.005996][ T6533] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input5 [ 53.015932][ T43] audit: type=1400 audit(1790921935.838:453): avc: denied { read } for pid=5125 comm="acpid" name="mouse2" dev="devtmpfs" ino=2885 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 53.079244][ T6539] usb usb8: usbfs: process 6539 (syz.1.152) did not claim interface 2 before use [ 53.201437][ T6552] bridge_slave_0: left allmulticast mode [ 53.201452][ T6552] bridge_slave_0: left promiscuous mode [ 53.201542][ T6552] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.205194][ T6552] bridge_slave_1: left allmulticast mode [ 53.205216][ T6552] bridge_slave_1: left promiscuous mode [ 53.205386][ T6552] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.235475][ T6552] bond0: (slave bond_slave_0): Releasing backup interface [ 53.238959][ T6550] CIFS: Attempting to mount //127.0.0.1/share [ 53.257227][ T6552] bond0: (slave bond_slave_1): Releasing backup interface [ 53.274471][ T6552] team0: Port device team_slave_0 removed [ 53.283820][ T6552] team0: Port device team_slave_1 removed [ 53.284357][ T6552] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 53.284368][ T6552] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 53.285290][ T6552] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 53.285301][ T6552] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 53.287900][ T6552] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 53.300232][ T6556] CIFS: VFS: Invalid response size 0 for command 0 [ 53.301048][ T6550] CIFS: VFS: cifs_mount failed w/return code = -5 [ 53.347775][ T6562] netlink: 28 bytes leftover after parsing attributes in process `syz.3.158'. [ 53.347791][ T6562] netlink: 28 bytes leftover after parsing attributes in process `syz.3.158'. [ 53.347799][ T6562] netlink: 'syz.3.158': attribute type 4 has an invalid length. [ 53.355343][ T6562] macvtap1: entered allmulticast mode [ 53.355356][ T6562] bond0: entered allmulticast mode [ 53.355581][ T6562] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 53.362937][ T6562] bond0: left allmulticast mode [ 53.459601][ T6572] can0: slcan on pts0. [ 53.466947][ T6572] usb usb5: usbfs: interface 0 claimed by hub while 'syz.0.161' sets config #0 [ 53.513076][ T6579] netlink: 'syz.3.163': attribute type 18 has an invalid length. [ 53.513089][ T6579] netlink: 4 bytes leftover after parsing attributes in process `syz.3.163'. [ 53.519280][ T6579] netlink: 'syz.3.163': attribute type 18 has an invalid length. [ 53.519292][ T6579] netlink: 4 bytes leftover after parsing attributes in process `syz.3.163'. [ 53.535842][ T5877] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 53.535869][ T5877] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 53.535887][ T5877] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 53.535904][ T5877] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 53.549837][ T6571] can0 (unregistered): slcan off pts0. [ 53.584459][ T6589] macvlan0: entered promiscuous mode [ 53.588210][ T6589] netlink: Unknown conntrack attr (0) [ 53.588226][ T6589] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 53.731381][ T6579] input: PS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input6 [ 53.977752][ T6585] input: PS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input7 [ 54.179428][ T6617] syz.3.171 (6617) used obsolete PPPIOCDETACH ioctl [ 54.215311][ T6622] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Query Mapping response ret = -22) [ 54.245945][ T5833] usb 5-1: new low-speed USB device number 4 using dummy_hcd [ 54.348091][ T6637] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=6637 comm=syz.2.176 [ 54.398555][ T5833] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 54.399581][ T5833] usb 5-1: config 1 interface 0 altsetting 4 endpoint 0x1 is Bulk; changing to Interrupt [ 54.399601][ T5833] usb 5-1: config 1 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 54.399621][ T5833] usb 5-1: config 1 interface 0 has no altsetting 0 [ 55.283400][ T6683] syzkaller0: entered promiscuous mode [ 55.283420][ T6683] syzkaller0: entered allmulticast mode [ 55.396404][ T6694] faux_driver vgem: [drm] Unknown color mode 9; guessing buffer size. [ 55.453406][ T6706] netlink: 'syz.3.193': attribute type 3 has an invalid length. [ 55.510026][ T6713] team1: entered promiscuous mode [ 55.510196][ T6713] team1: entered allmulticast mode [ 55.510668][ T6713] 8021q: adding VLAN 0 to HW filter on device team1 [ 55.785727][ T30] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 55.819607][ T6730] netlink: 'syz.3.203': attribute type 4 has an invalid length. [ 55.937276][ T30] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 55.938361][ T30] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 55.938383][ T30] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 55.940161][ T30] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.940174][ T30] usb 6-1: Product: syz [ 55.940181][ T30] usb 6-1: Manufacturer: syz [ 55.940188][ T30] usb 6-1: SerialNumber: syz [ 56.325173][ T6740] gfs2: Unknown parameter 'aclv/kvm' [ 56.465609][ T6741] ima: policy update failed [ 56.499721][ T5087] Bluetooth: hci1: unexpected event 0x04 length: 11 > 10 [ 56.832647][ T6746] SET target dimension over the limit! [ 56.837374][ T6746] syzkaller0: entered promiscuous mode [ 56.837388][ T6746] syzkaller0: entered allmulticast mode [ 57.005241][ T5833] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 57.012270][ T5833] usb 5-1: can't set config #1, error -71 [ 57.013986][ T5833] usb 5-1: USB disconnect, device number 4 [ 57.084492][ T6754] SELinux: failed to load policy [ 57.178503][ T6755] SELinux: failed to load policy [ 57.337161][ T6778] syzkaller0: entered promiscuous mode [ 57.337176][ T6778] syzkaller0: entered allmulticast mode [ 57.352872][ T6778] netlink: 'syz.0.220': attribute type 3 has an invalid length. [ 57.373880][ T6780] FAULT_INJECTION: forcing a failure. [ 57.373880][ T6780] name fail_futex, interval 1, probability 0, space 0, times 1 [ 57.373901][ T6780] CPU: 2 UID: 0 PID: 6780 Comm: syz.2.216 Not tainted syzkaller #0 PREEMPT(full) [ 57.373914][ T6780] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 57.373920][ T6780] Call Trace: [ 57.373924][ T6780] [ 57.373929][ T6780] dump_stack_lvl+0x100/0x190 [ 57.373948][ T6780] should_fail_ex.cold+0x5/0xa [ 57.373964][ T6780] get_futex_key+0x1d0/0x14f0 [ 57.373982][ T6780] ? __pfx_get_futex_key+0x10/0x10 [ 57.374002][ T6780] futex_wait_setup+0x91/0x540 [ 57.374019][ T6780] __futex_wait+0x19f/0x300 [ 57.374031][ T6780] ? __pfx___futex_wait+0x10/0x10 [ 57.374055][ T6780] ? __pfx_try_to_wake_up+0x10/0x10 [ 57.374069][ T6780] ? futex_hash+0x311/0x400 [ 57.374086][ T6780] ? __pfx_futex_wake_mark+0x10/0x10 [ 57.374100][ T6780] ? find_held_lock+0x2b/0x80 [ 57.374117][ T6780] ? futex_wake+0x4ea/0x5e0 [ 57.374131][ T6780] futex_wait+0xe6/0x370 [ 57.374144][ T6780] ? __pfx_futex_wait+0x10/0x10 [ 57.374159][ T6780] ? __lock_acquire+0x5c0/0x1f40 [ 57.374176][ T6780] do_futex+0x265/0x440 [ 57.374216][ T6780] ? __pfx_do_futex+0x10/0x10 [ 57.374233][ T6780] ? lock_acquire+0x1d1/0x380 [ 57.374246][ T6780] ? __fget_files+0x34/0x3d0 [ 57.374271][ T6780] ? find_held_lock+0x2b/0x80 [ 57.374292][ T6780] __x64_sys_futex+0x34f/0x4d0 [ 57.374309][ T6780] ? __fget_files+0x21f/0x3d0 [ 57.374325][ T6780] ? __pfx___x64_sys_futex+0x10/0x10 [ 57.374348][ T6780] do_syscall_64+0x123/0x790 [ 57.374363][ T6780] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.374374][ T6780] RIP: 0033:0x7f0cde39e159 [ 57.374384][ T6780] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 57.374394][ T6780] RSP: 002b:00007f0cdf2e90e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 57.374405][ T6780] RAX: ffffffffffffffda RBX: 00007f0cde625fa8 RCX: 00007f0cde39e159 [ 57.374413][ T6780] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0cde625fa8 [ 57.374420][ T6780] RBP: 00007f0cde625fa0 R08: 0000000000000000 R09: 0000000000000000 [ 57.374426][ T6780] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 57.374433][ T6780] R13: 00007f0cde626038 R14: 00007ffdbfa9cce0 R15: 00007ffdbfa9cdc8 [ 57.374447][ T6780] [ 57.377705][ T5833] usb 6-1: USB disconnect, device number 5 [ 57.486396][ T6784] loop7: detected capacity change from 0 to 7 [ 57.522813][ T6784] Dev loop7: unable to read RDB block 7 [ 57.522835][ T6784] loop7: unable to read partition table [ 57.522924][ T6784] loop7: partition table beyond EOD, truncated [ 57.522963][ T6784] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 57.565726][ T6784] Invalid logical block size (1025) [ 57.856673][ T9] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 57.973317][ T6803] syz.1.228 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 57.973733][ T6803] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 57.973759][ T6803] CIFS: Attempting to mount //127.0.0.1/test [ 57.974125][ T6803] CIFS: VFS: Error connecting to socket. Aborting operation. [ 57.974143][ T6803] CIFS: VFS: cifs_mount failed w/return code = -101 [ 58.016848][ T9] usb 5-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 58.017739][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 58.017753][ T9] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 58.017770][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 58.022957][ T9] opticon 5-1:1.0: opticon converter detected [ 58.035222][ T9] usb 5-1: opticon converter now attached to ttyUSB0 [ 58.048723][ T43] kauditd_printk_skb: 70 callbacks suppressed [ 58.048735][ T43] audit: type=1400 audit(1790921940.878:524): avc: denied { write } for pid=6816 comm="syz.1.231" name="nullb0" dev="devtmpfs" ino=705 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 58.093124][ T6820] syzkaller0: entered promiscuous mode [ 58.093138][ T6820] syzkaller0: entered allmulticast mode [ 58.095887][ T6820] tipc: Started in network mode [ 58.095903][ T6820] tipc: Node identity da96b4a0cd56, cluster identity 4711 [ 58.096058][ T6820] tipc: Enabled bearer , priority 0 [ 58.096214][ T6821] tipc: Enabling of bearer rejected, already enabled [ 58.116262][ T6820] veth0_to_hsr: mtu less than device minimum [ 58.173788][ T43] audit: type=1400 audit(1790921940.998:525): avc: denied { connect } for pid=6831 comm="syz.1.236" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 58.231153][ T43] audit: type=1400 audit(1790921941.058:526): avc: denied { mount } for pid=6833 comm="syz.2.237" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 58.233852][ T43] audit: type=1400 audit(1790921941.058:527): avc: denied { mounton } for pid=6833 comm="syz.2.237" path="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 58.237458][ T6834] overlayfs: upper fs does not support tmpfile. [ 58.280251][ T43] audit: type=1400 audit(1790921941.108:528): avc: denied { watch } for pid=6840 comm="syz.2.240" path="/55/file0" dev="tmpfs" ino=314 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 58.280556][ T43] audit: type=1400 audit(1790921941.108:529): avc: denied { watch_sb } for pid=6840 comm="syz.2.240" path="/55/file0" dev="tmpfs" ino=314 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 58.281615][ T6841] overlay: ./file0 is not a directory [ 58.286602][ T1348] usb 5-1: USB disconnect, device number 5 [ 58.299420][ T1348] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 58.299836][ T1348] opticon 5-1:1.0: device disconnected [ 58.357213][ T6846] netlink: 'syz.2.241': attribute type 39 has an invalid length. [ 58.528326][ T43] audit: type=1400 audit(1790921941.358:530): avc: denied { setattr } for pid=6848 comm="syz.2.242" name="L2TP/IP" dev="sockfs" ino=16484 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 58.528688][ T43] audit: type=1400 audit(1790921941.358:531): avc: denied { accept } for pid=6848 comm="syz.2.242" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 58.580419][ T6822] tipc: Resetting bearer [ 58.585970][ T5087] Bluetooth: hci1: command tx timeout [ 58.598485][ T6822] tipc: Disabling bearer [ 58.617197][ T43] audit: type=1400 audit(1790921941.448:532): avc: denied { ioctl } for pid=6850 comm="syz.2.243" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=12898 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 58.668411][ T43] audit: type=1400 audit(1790921941.498:533): avc: denied { relabelfrom } for pid=6854 comm="syz.2.245" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 58.765746][ T1348] usb 6-1: new full-speed USB device number 6 using dummy_hcd [ 58.863325][ T6864] binder: binder_mmap: 6863 200000000000-200000200000 bad vm_flags failed -1 [ 58.905056][ T5087] Bluetooth: hci3: connection err: -111 [ 58.916455][ T1348] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 58.917716][ T1348] usb 6-1: config 0 has no interfaces? [ 58.917742][ T1348] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 58.922968][ T1348] usb 6-1: config 0 descriptor?? [ 58.934244][ T6871] binder: 6869:6871 ioctl c0306201 2000000001c0 returned -22 [ 58.934315][ T6872] binder: 6869:6872 ioctl 8004500b 200000000040 returned -22 [ 59.136206][ T1348] usb 6-1: USB disconnect, device number 6 [ 59.215800][ T5087] Bluetooth: hci2: command 0x0406 tx timeout [ 59.484910][ T6884] bonding: bond0 is being deleted... [ 59.500308][ T6884] bond0 (unregistering): Released all slaves [ 59.676503][ T6892] capability: warning: `syz.2.257' uses deprecated v2 capabilities in a way that may be insecure [ 59.878411][ T6904] overlayfs: missing 'lowerdir' [ 59.924345][ T6913] overlayfs: conflicting lowerdir path [ 60.138738][ T6920] No memory to map [ 60.310591][ T6922] __nla_validate_parse: 7 callbacks suppressed [ 60.310608][ T6922] netlink: 32 bytes leftover after parsing attributes in process `syz.3.265'. [ 60.579710][ T6260] IPVS: starting estimator thread 0... [ 60.587277][ T6928] tipc: Cannot configure node identity twice [ 60.625139][ T6932] netlink: 12 bytes leftover after parsing attributes in process `syz.3.266'. [ 60.629762][ T6932] xfrm1: entered promiscuous mode [ 60.629781][ T6932] xfrm1: entered allmulticast mode [ 60.666225][ T6929] IPVS: using max 25 ests per chain, 60000 per kthread [ 60.693675][ T6937] netlink: 44 bytes leftover after parsing attributes in process `syz.1.269'. [ 60.788179][ T6945] can0: slcan on ptm0. [ 60.837716][ T6943] can0 (unregistered): slcan off ptm0. [ 60.846136][ T6950] FAULT_INJECTION: forcing a failure. [ 60.846136][ T6950] name failslab, interval 1, probability 0, space 0, times 0 [ 60.846155][ T6950] CPU: 2 UID: 0 PID: 6950 Comm: syz.1.273 Not tainted syzkaller #0 PREEMPT(full) [ 60.846169][ T6950] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 60.846175][ T6950] Call Trace: [ 60.846179][ T6950] [ 60.846184][ T6950] dump_stack_lvl+0x100/0x190 [ 60.846219][ T6950] should_fail_ex.cold+0x5/0xa [ 60.846237][ T6950] should_failslab+0xc2/0x120 [ 60.846255][ T6950] __kmalloc_cache_noprof+0x91/0x6d0 [ 60.846267][ T6950] ? lockdep_init_map_type+0x5c/0x250 [ 60.846286][ T6950] ? drm_master_create+0x43/0x4d0 [ 60.846307][ T6950] drm_master_create+0x43/0x4d0 [ 60.846325][ T6950] drm_new_set_master+0xcc/0x430 [ 60.846344][ T6950] drm_master_open+0x181/0x1f0 [ 60.846364][ T6950] drm_open_helper+0x42b/0x540 [ 60.846383][ T6950] drm_open+0x1a0/0x3e0 [ 60.846399][ T6950] ? __pfx_drm_open+0x10/0x10 [ 60.846415][ T6950] drm_stub_open+0x20f/0x380 [ 60.846432][ T6950] ? __pfx_drm_stub_open+0x10/0x10 [ 60.846449][ T6950] chrdev_open+0x234/0x6a0 [ 60.846465][ T6950] ? __pfx_chrdev_open+0x10/0x10 [ 60.846480][ T6950] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 60.846493][ T6950] do_dentry_open+0x6ab/0x14d0 [ 60.846506][ T6950] ? __pfx_chrdev_open+0x10/0x10 [ 60.846523][ T6950] vfs_open+0x82/0x3f0 [ 60.846540][ T6950] path_openat+0x19fa/0x2440 [ 60.846558][ T6950] ? __pfx_path_openat+0x10/0x10 [ 60.846576][ T6950] do_file_open+0x20e/0x430 [ 60.846592][ T6950] ? __pfx_do_file_open+0x10/0x10 [ 60.846617][ T6950] ? _raw_spin_unlock+0x28/0x50 [ 60.846637][ T6950] ? alloc_fd+0x471/0x7a0 [ 60.846657][ T6950] do_sys_openat2+0x10f/0x1e0 [ 60.846673][ T6950] ? __pfx_do_sys_openat2+0x10/0x10 [ 60.846688][ T6950] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 60.846708][ T6950] __x64_sys_openat+0x12d/0x210 [ 60.846726][ T6950] ? __pfx___x64_sys_openat+0x10/0x10 [ 60.846748][ T6950] do_syscall_64+0x123/0x790 [ 60.846761][ T6950] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.846772][ T6950] RIP: 0033:0x7f7b46d5e98e [ 60.846782][ T6950] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 60.846792][ T6950] RSP: 002b:00007f7b47ca4b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 60.846803][ T6950] RAX: ffffffffffffffda RBX: 00007f7b47ca56c0 RCX: 00007f7b46d5e98e [ 60.846810][ T6950] RDX: 0000000000000000 RSI: 00007f7b47ca4c00 RDI: ffffffffffffff9c [ 60.846817][ T6950] RBP: 00007f7b47ca4c00 R08: 0000000000000000 R09: 0000000000000000 [ 60.846823][ T6950] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 60.846829][ T6950] R13: 00007f7b47026038 R14: 00007f7b47025fa0 R15: 00007fffbf5cb5d8 [ 60.846844][ T6950] [ 60.892756][ T6959] bridge0: port 3(syz_tun) entered blocking state [ 60.892854][ T6959] bridge0: port 3(syz_tun) entered disabled state [ 60.893488][ T6959] syz_tun: entered allmulticast mode [ 60.894867][ T6959] syz_tun: entered promiscuous mode [ 60.898397][ T6959] bridge0: port 3(syz_tun) entered blocking state [ 60.898440][ T6959] bridge0: port 3(syz_tun) entered forwarding state [ 60.901599][ T6959] netlink: 'syz.1.276': attribute type 9 has an invalid length. [ 60.901704][ T6959] netlink: 'syz.1.276': attribute type 9 has an invalid length. [ 60.901780][ T6959] netlink: 'syz.1.276': attribute type 9 has an invalid length. [ 60.901857][ T6959] netlink: 'syz.1.276': attribute type 9 has an invalid length. [ 60.901935][ T6959] netlink: 'syz.1.276': attribute type 9 has an invalid length. [ 60.902009][ T6959] netlink: 'syz.1.276': attribute type 9 has an invalid length. [ 60.902083][ T6959] netlink: 'syz.1.276': attribute type 9 has an invalid length. [ 60.902164][ T6959] netlink: 'syz.1.276': attribute type 9 has an invalid length. [ 60.902242][ T6959] netlink: 'syz.1.276': attribute type 9 has an invalid length. [ 61.682935][ T7005] netlink: 12 bytes leftover after parsing attributes in process `syz.1.285'. [ 61.985201][ T7011] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 61.998351][ T7011] team0: Port device xfrm0 added [ 61.999905][ T7011] tipc: Started in network mode [ 61.999921][ T7011] tipc: Node identity a65305e80e7c, cluster identity 4711 [ 62.000050][ T7011] tipc: Enabled bearer , priority 0 [ 62.065730][ T5819] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 62.216647][ T5819] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 62.217435][ T5819] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 62.217451][ T5819] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 62.217468][ T5819] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 62.220889][ T7007] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 62.224287][ T5819] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 62.507060][ T1348] usb 6-1: USB disconnect, device number 7 [ 62.813061][ T7062] warning: `syz.3.300' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 62.823335][ T7062] o2cb: This node has not been configured. [ 62.823344][ T7062] o2cb: Cluster check failed. Fix errors before retrying. [ 62.823355][ T7062] (syz.3.300,7062,0):user_dlm_register:674 ERROR: status = -22 [ 62.823369][ T7062] (syz.3.300,7062,0):dlmfs_mkdir:437 ERROR: Error -22 could not register domain "domain1" [ 62.867216][ T7067] GUP no longer grows the stack in syz.3.302 (7067): 200000004000-20000000a000 (200000002000) [ 62.867248][ T7067] CPU: 1 UID: 0 PID: 7067 Comm: syz.3.302 Not tainted syzkaller #0 PREEMPT(full) [ 62.867269][ T7067] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 62.867279][ T7067] Call Trace: [ 62.867285][ T7067] [ 62.867292][ T7067] dump_stack_lvl+0x100/0x190 [ 62.867324][ T7067] gup_vma_lookup.cold+0x83/0x96 [ 62.867353][ T7067] __get_user_pages+0x252/0x2c30 [ 62.867383][ T7067] ? lock_acquire+0x1d1/0x380 [ 62.867405][ T7067] ? mtree_load+0xdc/0xb50 [ 62.867423][ T7067] ? __pfx___get_user_pages+0x10/0x10 [ 62.867444][ T7067] ? mtree_load+0x388/0xb50 [ 62.867464][ T7067] ? mtree_load+0x388/0xb50 [ 62.867525][ T7067] get_user_pages_remote+0x3d2/0xb10 [ 62.867549][ T7067] ? mas_prev_setup.constprop.0+0x980/0x9e0 [ 62.867575][ T7067] ? __pfx_get_user_pages_remote+0x10/0x10 [ 62.867612][ T7067] __access_remote_vm+0x3bb/0x890 [ 62.867641][ T7067] ? __pfx___access_remote_vm+0x10/0x10 [ 62.867659][ T7067] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 62.867676][ T7067] ? proc_pid_cmdline_read+0x31b/0x9a0 [ 62.867701][ T7067] ? proc_pid_cmdline_read+0x4aa/0x9a0 [ 62.867731][ T7067] proc_pid_cmdline_read+0x552/0x9a0 [ 62.867759][ T7067] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 62.867782][ T7067] ? rw_verify_area+0xce/0x6d0 [ 62.867809][ T7067] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 62.867834][ T7067] vfs_readv+0x5d8/0x8d0 [ 62.867861][ T7067] ? __pfx_vfs_readv+0x10/0x10 [ 62.867887][ T7067] ? lock_acquire+0x1d1/0x380 [ 62.867905][ T7067] ? __fget_files+0x34/0x3d0 [ 62.867939][ T7067] ? __fget_files+0x21f/0x3d0 [ 62.867970][ T7067] ? do_preadv+0x1ac/0x270 [ 62.867988][ T7067] do_preadv+0x1ac/0x270 [ 62.868007][ T7067] ? __pfx_do_preadv+0x10/0x10 [ 62.868031][ T7067] do_syscall_64+0x123/0x790 [ 62.868054][ T7067] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 62.868073][ T7067] RIP: 0033:0x7f4dd339e159 [ 62.868089][ T7067] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 62.868106][ T7067] RSP: 002b:00007f4dd42e5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 62.868124][ T7067] RAX: ffffffffffffffda RBX: 00007f4dd3625fa0 RCX: 00007f4dd339e159 [ 62.868134][ T7067] RDX: 0000000000000001 RSI: 0000200000000680 RDI: 0000000000000004 [ 62.868146][ T7067] RBP: 00007f4dd343506b R08: 00000000fffffff9 R09: 0000000000000000 [ 62.868157][ T7067] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000000 [ 62.868168][ T7067] R13: 00007f4dd3626038 R14: 00007f4dd3625fa0 R15: 00007ffc2a8878a8 [ 62.868194][ T7067] [ 62.905886][ T30] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 62.969928][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.969940][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.970005][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.970043][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.970115][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.970122][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.970188][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.970195][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.970259][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.970265][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.970331][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.970330][ T7065] binder_alloc: binder_alloc_mmap_handler: 7063 200000ffd000-200001000000 already mapped failed -16 [ 62.970337][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.970421][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.970428][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.970491][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.970494][ T7065] binder_alloc: binder_alloc_mmap_handler: 7063 200000ffd000-200001000000 already mapped failed -16 [ 62.970497][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.970562][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.970569][ T7065] binder_alloc: binder_alloc_mmap_handler: 7063 200000ffd000-200001000000 already mapped failed -16 [ 62.970569][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.970632][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.970638][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.970642][ T7065] binder_alloc: binder_alloc_mmap_handler: 7063 200000ffd000-200001000000 already mapped failed -16 [ 62.970702][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.970708][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.970715][ T7065] binder_alloc: binder_alloc_mmap_handler: 7063 200000ffd000-200001000000 already mapped failed -16 [ 62.970783][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.970787][ T7065] binder_alloc: binder_alloc_mmap_handler: 7063 200000ffd000-200001000000 already mapped failed -16 [ 62.970794][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.970860][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.970860][ T7065] binder_alloc: binder_alloc_mmap_handler: 7063 200000ffd000-200001000000 already mapped failed -16 [ 62.970866][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.970931][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.970933][ T7065] binder_alloc: binder_alloc_mmap_handler: 7063 200000ffd000-200001000000 already mapped failed -16 [ 62.970936][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.971005][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.971006][ T7065] binder_alloc: binder_alloc_mmap_handler: 7063 200000ffd000-200001000000 already mapped failed -16 [ 62.971011][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.971074][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.971078][ T7065] binder_alloc: binder_alloc_mmap_handler: 7063 200000ffd000-200001000000 already mapped failed -16 [ 62.971080][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.971146][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.971153][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.971216][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.971222][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.971286][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.971292][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.971358][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.971365][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.971427][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.971434][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.971500][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.971506][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.971572][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.971578][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.971648][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.971654][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.971721][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.971727][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.971796][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.971803][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.971867][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.971873][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.971988][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.971996][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.972064][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.972070][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.972223][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.972230][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.972298][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.972305][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.972369][ T7064] binder: BINDER_SET_CONTEXT_MGR already set [ 62.972376][ T7064] binder: 7063:7064 ioctl 4018620d 200000000040 returned -16 [ 62.977814][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.977858][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.977896][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.977933][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978310][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978350][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978387][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978425][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978464][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978501][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978540][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978578][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978616][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978654][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978692][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978730][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978769][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978810][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978848][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978886][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978927][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.978965][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.979003][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.979040][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.979078][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.979116][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.979154][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.979191][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.979230][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.979269][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.979309][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.979347][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 62.979386][ T7065] binder: 7063:7065 ioctl c0286405 200000004980 returned -22 [ 63.039802][ T7081] netlink: 16 bytes leftover after parsing attributes in process `syz.1.307'. [ 63.066729][ T30] usb 5-1: Using ep0 maxpacket: 32 [ 63.069908][ T30] usb 5-1: unable to get BOS descriptor or descriptor too short [ 63.069932][ T30] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 63.073924][ T30] usb 5-1: string descriptor 0 read error: -22 [ 63.073977][ T30] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 63.080438][ T7085] netlink: 48 bytes leftover after parsing attributes in process `syz.2.309'. [ 63.082845][ T30] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 63.082864][ T30] dw2102: su3000_power_ctrl: 1, initialized 0 [ 63.083073][ T30] dvb-usb: bulk message failed: -22 (2/0) [ 63.098458][ T43] kauditd_printk_skb: 27 callbacks suppressed [ 63.098470][ T43] audit: type=1400 audit(1790921945.918:561): avc: denied { read } for pid=7083 comm="syz.2.309" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 63.120220][ T5878] tipc: Node number set to 2821653992 [ 63.132332][ T7091] binder: BINDER_SET_CONTEXT_MGR already set [ 63.132340][ T7091] binder: 7088:7091 ioctl 4018620d 200000000100 returned -16 [ 63.133200][ T30] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 63.134749][ T30] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 63.134776][ T30] usb 5-1: media controller created [ 63.135377][ T30] dvb-usb: bulk message failed: -22 (6/0) [ 63.135386][ T30] dw2102: i2c transfer failed. [ 63.135401][ T30] dvb-usb: bulk message failed: -22 (6/0) [ 63.135408][ T30] dw2102: i2c transfer failed. [ 63.135413][ T30] dvb-usb: bulk message failed: -22 (6/0) [ 63.135419][ T30] dw2102: i2c transfer failed. [ 63.135424][ T30] dvb-usb: bulk message failed: -22 (6/0) [ 63.135431][ T30] dw2102: i2c transfer failed. [ 63.135436][ T30] dvb-usb: bulk message failed: -22 (6/0) [ 63.135442][ T30] dw2102: i2c transferqemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. failed. [ 63.135447][ T30] dvb-usb: bulk message failed: -22 (6/0) [ 63.135453][ T30] dw2102: i2c transfer failed. [ 63.135457][ T30] dvb-usb: MAC address: 02:02:02:02:02:02 [ 63.137303][ T7090] binder: 7088:7090 ioctl 4b46 200000000240 returned -22 [ 63.137362][ T7090] binder: 7088:7090 ioctl 4b46 200000000240 returned -22 [ 63.141980][ T7090] binder: 7088:7090 ioctl 4020ae46 200000000200 returned -22 [ 63.143477][ T30] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 63.152584][ T7081] qnx6: unable to set blocksize [ 63.162547][ T30] dvb-usb: bulk message failed: -22 (3/0) [ 63.162559][ T30] dw2102: command 0x0e transfer failed. [ 63.162563][ T30] dvb-usb: bulk message failed: -22 (3/0) [ 63.162570][ T30] dw2102: command 0x0e transfer failed. [ 63.175019][ T43] audit: type=1400 audit(1790921945.998:562): avc: denied { create } for pid=7092 comm="syz.2.311" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 63.176293][ T43] audit: type=1400 audit(1790921946.008:563): avc: denied { connect } for pid=7092 comm="syz.2.311" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 63.177170][ T43] audit: type=1400 audit(1790921946.008:564): avc: denied { read } for pid=7092 comm="syz.2.311" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 63.198314][ T43] audit: type=1400 audit(1790921946.028:565): avc: denied { ioctl } for pid=7094 comm="syz.1.312" path="socket:[17848]" dev="sockfs" ino=17848 ioctlcmd=0x7437 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 63.203309][ T7095] CIFS: Bad mount helper ver=1.0. Did you want SMB1 (CIFS) dialect and mean to type vers=1.0 instead? [ 63.314615][ T43] audit: type=1400 audit(1790921946.138:566): avc: denied { write } for pid=7101 comm="syz.1.315" name="/" dev="9p" ino=71827707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 63.314931][ T43] audit: type=1400 audit(1790921946.138:567): avc: denied { create } for pid=7101 comm="syz.1.315" name="memory.events" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 63.321270][ T43] audit: type=1400 audit(1790921946.148:568): avc: denied { read append open } for pid=7101 comm="syz.1.315" path="/63/file0/memory.events" dev="9p" ino=71827789 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 63.337132][ T43] audit: type=1400 audit(1790921946.168:569): avc: denied { map } for pid=7053 comm="syz.0.298" path="socket:[16009]" dev="sockfs" ino=16009 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 63.337296][ T43] audit: type=1400 audit(1790921946.168:570): avc: denied { read } for pid=7053 comm="syz.0.298" path="socket:[16009]" dev="sockfs" ino=16009 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 63.477267][ T30] dvb-usb: bulk message failed: -22 (3/0) [ 63.477288][ T30] dw2102: command 0x0e transfer failed. [ 63.477295][ T30] dvb-usb: bulk message failed: -22 (3/0) [ 63.477305][ T30] dw2102: command 0x0e transfer failed. [ 63.477311][ T30] dvb-usb: bulk message failed: -22 (1/0) [ 63.477322][ T30] dw2102: command 0x51 transfer failed. [ 63.480484][ T7054] dvb-usb: bulk message failed: -22 (5/0) [ 63.480498][ T7054] dw2102: i2c transfer failed. [ 63.496908][ T30] DVB: Unable to find symbol ds3000_attach() [ 63.496920][ T30] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 63.545763][ T30] rc_core: IR keymap rc-su3000 not found [ 63.545776][ T30] Registered IR keymap rc-empty [ 63.547028][ T30] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.0/usb5/5-1/rc/rc0 [ 63.549857][ T30] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.0/usb5/5-1/rc/rc0/input8 [ 63.552360][ T7108] JFS: discard option not supported on device [ 63.556022][ T7108] Mount JFS Failure: -5 [ 63.556030][ T7108] jfs_mount failed w/return code = -5 [ 63.575079][ T30] dvb-usb: schedule remote query interval to 150 msecs. [ 63.575094][ T30] dw2102: su3000_power_ctrl: 0, initialized 1 [ 63.575101][ T30] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 63.578093][ T30] usb 5-1: USB disconnect, device number 6 [ 63.620956][ T30] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 63.711463][ T7118] netlink: 8 bytes leftover after parsing attributes in process `syz.2.320'. [ 63.711659][ T7124] loop3: detected capacity change from 0 to 7 [ 63.721238][ T7124] Dev loop3: unable to read RDB block 7 [ 63.721256][ T7124] loop3: AHDI p3 p4 [ 63.721266][ T7124] loop3: partition table partially beyond EOD, truncated [ 63.721365][ T7124] loop3: p3 start 1702000233 is beyond EOD, truncated [ 63.758980][ T7127] 8021q: VLANs not supported on vxcan1 [ 64.025936][ T7150] erspan1: entered promiscuous mode [ 64.033304][ T65] Bluetooth: hci3: unexpected event 0x08 length: 7 > 4 [ 64.115741][ T6564] usb 7-1: new low-speed USB device number 3 using dummy_hcd [ 64.276493][ T6564] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 64.277438][ T6564] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 64.277460][ T6564] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 64.277474][ T6564] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 64.277486][ T6564] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 64.277498][ T6564] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 64.278223][ T6564] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 64.278244][ T6564] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 64.278257][ T6564] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 64.278271][ T6564] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 64.278284][ T6564] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 64.279060][ T6564] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 64.279093][ T6564] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 64.279113][ T6564] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 64.279131][ T6564] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 64.279150][ T6564] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 64.281910][ T6564] usb 7-1: string descriptor 0 read error: -22 [ 64.282000][ T6564] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 64.288673][ T6564] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 64.492301][ T5832] usb 7-1: USB disconnect, device number 3 [ 64.526459][ T7155] validate_nla: 106 callbacks suppressed [ 64.526472][ T7155] netlink: 'syz.1.331': attribute type 15 has an invalid length. [ 64.526480][ T7155] netlink: 4 bytes leftover after parsing attributes in process `syz.1.331'. [ 64.533753][ T7155] netlink: 'syz.1.331': attribute type 15 has an invalid length. [ 64.533775][ T7155] netlink: 4 bytes leftover after parsing attributes in process `syz.1.331'. [ 64.555859][ T12] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 2816 - 0 [ 64.556202][ T12] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 2816 - 0 [ 64.556223][ T12] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 2816 - 0 [ 64.556240][ T12] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 2816 - 0 [ 64.566236][ T7157] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 64.656591][ T7159] ======================================================= [ 64.656591][ T7159] WARNING: The mand mount option has been deprecated and [ 64.656591][ T7159] and is ignored by this kernel. Remove the mand [ 64.656591][ T7159] option from the mount to silence this warning. [ 64.656591][ T7159] ======================================================= [ 64.664158][ T7159] FAULT_INJECTION: forcing a failure. [ 64.664158][ T7159] name failslab, interval 1, probability 0, space 0, times 0 [ 64.664185][ T7159] CPU: 2 UID: 0 PID: 7159 Comm: syz.1.333 Not tainted syzkaller #0 PREEMPT(full) [ 64.664203][ T7159] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 64.664211][ T7159] Call Trace: [ 64.664217][ T7159] [ 64.664223][ T7159] dump_stack_lvl+0x100/0x190 [ 64.664253][ T7159] should_fail_ex.cold+0x5/0xa [ 64.664274][ T7159] should_failslab+0xc2/0x120 [ 64.664290][ T7159] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 64.664306][ T7159] ? security_context_to_sid_core+0xcc/0x8a0 [ 64.664323][ T7159] kmemdup_nul+0x49/0xd0 [ 64.664335][ T7159] security_context_to_sid_core+0xcc/0x8a0 [ 64.664353][ T7159] ? __pfx_security_context_to_sid_core+0x10/0x10 [ 64.664374][ T7159] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 64.664385][ T7159] ? do_raw_spin_lock+0x128/0x260 [ 64.664399][ T7159] ? inode_doinit_use_xattr+0x54/0x330 [ 64.664413][ T7159] inode_doinit_use_xattr+0x105/0x330 [ 64.664426][ T7159] inode_doinit_with_dentry+0xb7a/0x1340 [ 64.664443][ T7159] ? __pfx_inode_doinit_with_dentry+0x10/0x10 [ 64.664462][ T7159] selinux_d_instantiate+0x26/0x40 [ 64.664475][ T7159] security_d_instantiate+0x14c/0x1b0 [ 64.664493][ T7159] d_splice_alias_ops+0xd7/0x15b0 [ 64.664507][ T7159] ? kasan_quarantine_put+0x104/0x240 [ 64.664520][ T7159] ? lockdep_hardirqs_on+0x7d/0x110 [ 64.664533][ T7159] ? __pfx_d_splice_alias_ops+0x10/0x10 [ 64.664545][ T7159] ? rcu_is_watching+0x13/0xc0 [ 64.664561][ T7159] ? ovl_lookup+0x58f/0x6b0 [ 64.664573][ T7159] ? kfree+0x1e5/0x6d0 [ 64.664585][ T7159] ovl_lookup+0x5b0/0x6b0 [ 64.664600][ T7159] ? __pfx_ovl_lookup+0x10/0x10 [ 64.664619][ T7159] ? do_raw_spin_lock+0x128/0x260 [ 64.664638][ T7159] ? do_raw_spin_unlock+0x145/0x1e0 [ 64.664661][ T7159] ? _raw_spin_unlock+0x28/0x50 [ 64.664680][ T7159] lookup_one_qstr_excl+0x1cd/0x250 [ 64.664692][ T7159] ? mnt_want_write+0x164/0x420 [ 64.664708][ T7159] filename_create+0x1cf/0x400 [ 64.664739][ T7159] ? __pfx_filename_create+0x10/0x10 [ 64.664756][ T7159] ? lock_acquire+0x1d1/0x380 [ 64.664771][ T7159] ? find_held_lock+0x2b/0x80 [ 64.664791][ T7159] filename_mkdirat+0xb9/0x5e0 [ 64.664810][ T7159] ? __pfx_filename_mkdirat+0x10/0x10 [ 64.664828][ T7159] ? strncpy_from_user+0x19d/0x2d0 [ 64.664846][ T7159] ? do_getname+0x191/0x390 [ 64.664858][ T7159] __x64_sys_mkdirat+0x89/0xc0 [ 64.664876][ T7159] do_syscall_64+0x123/0x790 [ 64.664889][ T7159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 64.664901][ T7159] RIP: 0033:0x7f7b46d9e159 [ 64.664911][ T7159] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 64.664922][ T7159] RSP: 002b:00007f7b47ca5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 64.664934][ T7159] RAX: ffffffffffffffda RBX: 00007f7b47025fa0 RCX: 00007f7b46d9e159 [ 64.664941][ T7159] RDX: 00000000000001ff RSI: 0000200000000100 RDI: ffffffffffffff9c [ 64.664948][ T7159] RBP: 00007f7b46e3506b R08: 0000000000000000 R09: 0000000000000000 [ 64.664955][ T7159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 64.664961][ T7159] R13: 00007f7b47026038 R14: 00007f7b47025fa0 R15: 00007fffbf5cb5d8 [ 64.664977][ T7159] [ 64.669729][ T7159] SELinux: inode_doinit_use_xattr: context_to_sid(system_u:object_r:sysfs_t) returned 12 for dev=overlay ino=4 [ 64.695184][ T7162] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 64.695286][ T7162] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 64.695358][ T7162] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 64.695428][ T7162] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 64.695506][ T7162] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 64.695581][ T7162] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 64.697548][ T7162] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 64.697666][ T7162] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 64.697747][ T7162] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 64.697823][ T7162] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 64.715407][ T7163] hfs: unable to load iocharset "io#harset" [ 64.732835][ T7163] hfs: unable to load iocharset "io#harset" [ 64.749908][ T7163] hfs: unable to load iocharset "io#harset" [ 64.768188][ T7163] hfs: unable to load iocharset "io#harset" [ 64.786205][ T7163] hfs: unable to load iocharset "io#harset" [ 64.804283][ T7163] hfs: unable to load iocharset "io#harset" [ 64.819828][ T7163] hfs: unable to load iocharset "io#harset" [ 64.835938][ T7163] hfs: unable to load iocharset "io#harset" [ 64.847678][ T30] hid_parser_main: 7 callbacks suppressed [ 64.847691][ T30] hid-generic 0005:15C2:0002.0004: unknown main item tag 0x0 [ 64.856106][ T7163] hfs: unable to load iocharset "io#harset" [ 64.862544][ T30] hid-generic 0005:15C2:0002.0004: hidraw1: BLUETOOTH HID v0.09 Device [syz1] on aa:aa:aa:aa:aa:aa [ 64.877460][ T7163] hfs: unable to load iocharset "io#harset" [ 64.894932][ T7163] hfs: unable to load iocharset "io#harset" [ 64.911375][ T7163] hfs: unable to load iocharset "io#harset" [ 64.933144][ T7163] hfs: unable to load iocharset "io#harset" [ 64.949703][ T7163] hfs: unable to load iocharset "io#harset" [ 64.965131][ T7163] hfs: unable to load iocharset "io#harset" [ 64.980863][ T7163] hfs: unable to load iocharset "io#harset" [ 65.001895][ T7163] hfs: unable to load iocharset "io#harset" [ 65.020397][ T7163] hfs: unable to load iocharset "io#harset" [ 65.048829][ T7163] hfs: unable to load iocharset "io#harset" [ 65.065366][ T7163] hfs: unable to load iocharset "io#harset" [ 65.089523][ T7163] hfs: unable to load iocharset "io#harset" [ 65.106180][ T7163] hfs: unable to load iocharset "io#harset" [ 65.115173][ T7178] netlink: 'syz.3.336': attribute type 4 has an invalid length. [ 65.138493][ T7163] hfs: unable to load iocharset "io#harset" [ 65.157125][ T7163] hfs: unable to load iocharset "io#harset" [ 65.177059][ T7163] hfs: unable to load iocharset "io#harset" [ 65.196508][ T7163] hfs: unable to load iocharset "io#harset" [ 65.202834][ T7202] netlink: 88 bytes leftover after parsing attributes in process `syz.2.339'. [ 65.215965][ T7163] hfs: unable to load iocharset "io#harset" [ 65.249991][ T7163] hfs: unable to load iocharset "io#harset" [ 65.267039][ T7163] hfs: unable to load iocharset "io#harset" [ 65.283779][ T7163] hfs: unable to load iocharset "io#harset" [ 65.313908][ T7163] hfs: unable to load iocharset "io#harset" [ 65.330105][ T7163] hfs: unable to load iocharset "io#harset" [ 65.351987][ T7163] hfs: unable to load iocharset "io#harset" [ 65.367993][ T7163] hfs: unable to load iocharset "io#harset" [ 65.384619][ T7163] hfs: unable to load iocharset "io#harset" [ 65.404257][ T7163] hfs: unable to load iocharset "io#harset" [ 65.425302][ T7163] hfs: unable to load iocharset "io#harset" [ 65.454296][ T7163] hfs: unable to load iocharset "io#harset" [ 65.470170][ T7223] xt_CT: You must specify a L4 protocol and not use inversions on it [ 65.473020][ T7163] hfs: unable to load iocharset "io#harset" [ 65.494345][ T7163] hfs: unable to load iocharset "io#harset" [ 65.511750][ T7163] hfs: unable to load iocharset "io#harset" [ 65.527445][ T7163] hfs: unable to load iocharset "io#harset" [ 65.625438][ T7246] binder: 7240:7246 ioctl 8933 200000000280 returned -22 [ 65.803307][ T7248] capability: warning: `syz.3.344' uses 32-bit capabilities (legacy support in use) [ 66.096825][ T65] Bluetooth: hci3: command 0x2016 tx timeout [ 66.098379][ T65] ------------[ cut here ]------------ [ 66.098386][ T65] refcnt < 0 [ 66.098390][ T65] WARNING: net/bluetooth/hci_conn.c:649 at hci_conn_timeout+0x16a/0x230, CPU#0: kworker/u34:0/65 [ 66.108048][ T65] Modules linked in: [ 66.109697][ T65] CPU: 0 UID: 0 PID: 65 Comm: kworker/u34:0 Not tainted syzkaller #0 PREEMPT(full) [ 66.112988][ T65] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 66.117000][ T65] Workqueue: hci3 hci_conn_timeout [ 66.118837][ T65] RIP: 0010:hci_conn_timeout+0x16a/0x230 [ 66.120877][ T65] Code: 44 0f b6 2d 33 af 78 06 31 ff 41 83 e5 40 44 89 ee e8 ba 20 44 f7 45 84 ed 0f 84 02 ff ff ff e9 c9 01 aa f6 e8 97 26 44 f7 90 <0f> 0b 90 e8 8e 26 44 f7 48 8d bb ed f5 ff ff 48 b8 00 00 00 00 00 [ 66.127476][ T65] RSP: 0018:ffffc90000b2fbf8 EFLAGS: 00010293 [ 66.129664][ T65] RAX: 0000000000000000 RBX: ffff8880555e0a50 RCX: 0000000000000000 [ 66.132477][ T65] RDX: ffff8880236ca580 RSI: ffffffff8ac820f9 RDI: ffff8880236ca580 [ 66.135401][ T65] RBP: 00000000ffffffff R08: 0000000000000005 R09: 0000000000000000 [ 66.138714][ T65] R10: 00000000ffffffff R11: 000000000000763b R12: ffff8880555e0000 [ 66.141398][ T65] R13: ffff8880236caa44 R14: 0000000000000000 R15: ffff88802accc400 [ 66.143937][ T65] FS: 0000000000000000(0000) GS:ffff8880d5b4f000(0000) knlGS:0000000000000000 [ 66.146771][ T65] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 66.149653][ T65] CR2: 00007f0cdf2e8ff8 CR3: 00000000355d7000 CR4: 0000000000352ef0 [ 66.152131][ T65] DR0: 0000000000000009 DR1: 00000000000000c9 DR2: 00000000000000f3 [ 66.154754][ T65] DR3: 00000000000000c0 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 66.157409][ T65] Call Trace: [ 66.158656][ T65] [ 66.159635][ T65] process_one_work+0xac7/0x1b10 [ 66.161235][ T65] ? __pfx_process_one_work+0x10/0x10 [ 66.162945][ T65] ? lock_acquire+0x1d1/0x380 [ 66.164532][ T65] ? __pfx_hci_conn_timeout+0x10/0x10 [ 66.166514][ T65] worker_thread+0x5ef/0xe50 [ 66.168137][ T65] ? kthread+0x13a/0x450 [ 66.169645][ T65] ? __pfx_worker_thread+0x10/0x10 [ 66.171483][ T65] kthread+0x373/0x450 [ 66.172809][ T65] ? __pfx_kthread+0x10/0x10 [ 66.174294][ T65] ret_from_fork+0x730/0xd60 [ 66.175879][ T65] ? __pfx_ret_from_fork+0x10/0x10 [ 66.177510][ T65] ? __switch_to+0x800/0x10f0 [ 66.179043][ T65] ? __pfx_kthread+0x10/0x10 [ 66.180517][ T65] ret_from_fork_asm+0x1a/0x30 [ 66.182051][ T65] [ 66.183058][ T65] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 66.185651][ T65] CPU: 0 UID: 0 PID: 65 Comm: kworker/u34:0 Not tainted syzkaller #0 PREEMPT(full) [ 66.188583][ T65] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 66.191719][ T65] Workqueue: hci3 hci_conn_timeout [ 66.193354][ T65] Call Trace: [ 66.194462][ T65] [ 66.195457][ T65] dump_stack_lvl+0x100/0x190 [ 66.196961][ T65] vpanic+0x553/0x970 [ 66.198276][ T65] ? __pfx_vpanic+0x10/0x10 [ 66.199745][ T65] panic+0xd1/0xe0 [ 66.200938][ T65] ? __pfx_panic+0x10/0x10 [ 66.202462][ T65] check_panic_on_warn.cold+0x19/0x34 [ 66.204250][ T65] ? hci_conn_timeout+0x16a/0x230 [ 66.206084][ T65] __warn.cold+0x191/0x318 [ 66.207763][ T65] __report_bug+0x30f/0x440 [ 66.209498][ T65] ? hci_conn_timeout+0x16a/0x230 [ 66.211123][ T65] ? __pfx___report_bug+0x10/0x10 [ 66.212877][ T65] ? add_lock_to_list+0x9d/0x1d0 [ 66.214602][ T65] ? check_prev_add+0x354/0xe60 [ 66.216315][ T65] ? __lock_acquire+0x5c0/0x1f40 [ 66.218010][ T65] ? hci_conn_timeout+0x16a/0x230 [ 66.219758][ T65] report_bug+0xb3/0x220 [ 66.221229][ T65] ? hci_conn_timeout+0x16a/0x230 [ 66.222971][ T65] handle_bug+0x16a/0x2a0 [ 66.224483][ T65] exc_invalid_op+0x17/0x50 [ 66.226042][ T65] asm_exc_invalid_op+0x1a/0x20 [ 66.227778][ T65] RIP: 0010:hci_conn_timeout+0x16a/0x230 [ 66.229803][ T65] Code: 44 0f b6 2d 33 af 78 06 31 ff 41 83 e5 40 44 89 ee e8 ba 20 44 f7 45 84 ed 0f 84 02 ff ff ff e9 c9 01 aa f6 e8 97 26 44 f7 90 <0f> 0b 90 e8 8e 26 44 f7 48 8d bb ed f5 ff ff 48 b8 00 00 00 00 00 [ 66.235577][ T65] RSP: 0018:ffffc90000b2fbf8 EFLAGS: 00010293 [ 66.237474][ T65] RAX: 0000000000000000 RBX: ffff8880555e0a50 RCX: 0000000000000000 [ 66.240027][ T65] RDX: ffff8880236ca580 RSI: ffffffff8ac820f9 RDI: ffff8880236ca580 [ 66.242570][ T65] RBP: 00000000ffffffff R08: 0000000000000005 R09: 0000000000000000 [ 66.245049][ T65] R10: 00000000ffffffff R11: 000000000000763b R12: ffff8880555e0000 [ 66.247444][ T65] R13: ffff8880236caa44 R14: 0000000000000000 R15: ffff88802accc400 [ 66.250021][ T65] ? hci_conn_timeout+0x169/0x230 [ 66.251603][ T65] ? hci_conn_timeout+0x169/0x230 [ 66.253133][ T65] process_one_work+0xac7/0x1b10 [ 66.254750][ T65] ? __pfx_process_one_work+0x10/0x10 [ 66.256521][ T65] ? lock_acquire+0x1d1/0x380 [ 66.258093][ T65] ? __pfx_hci_conn_timeout+0x10/0x10 [ 66.259822][ T65] worker_thread+0x5ef/0xe50 [ 66.261290][ T65] ? kthread+0x13a/0x450 [ 66.262616][ T65] ? __pfx_worker_thread+0x10/0x10 [ 66.264194][ T65] kthread+0x373/0x450 [ 66.265469][ T65] ? __pfx_kthread+0x10/0x10 [ 66.266920][ T65] ret_from_fork+0x730/0xd60 [ 66.268382][ T65] ? __pfx_ret_from_fork+0x10/0x10 [ 66.269968][ T65] ? __switch_to+0x800/0x10f0 [ 66.271420][ T65] ? __pfx_kthread+0x10/0x10 [ 66.272854][ T65] ret_from_fork_asm+0x1a/0x30 [ 66.274359][ T65] [ 66.275863][ T65] Kernel Offset: disabled [ 66.277214][ T65] Rebooting in 86400 seconds..