last executing test programs: 21.996124405s ago: executing program 0 (id=125): ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f0000000580)={0x200, 0x1, 0xa45}) r0 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) socket$pppl2tp(0x18, 0x1, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x10, 0x0, 0x7fff7ffc}]}) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/sda\x00', 0x2, 0x0) ioctl$IOC_PR_RELEASE(r1, 0x801070cf, 0x0) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000e00)=ANY=[@ANYBLOB="3c000000100001040000000000000000000000009698c3f8c52ece5a44a29e4d8e85e32bc221d58b93f23dad7091876a06e89d94a315f80171eedb4ea7fee18bfa42a700"/83, @ANYRES32=0x0, @ANYBLOB="00000000041100001c00128009010100626f6e64000000000c00028005001500010000007a6f6f936cb21f8dd0fe3fb2b86e421e78878812dc29b24b7cddb83acc840a981b5e4f7fa77187f1feaecf6136e79fe8d9ce686ad1201db66a972408030860a9d589c316faf8e6759ab2dff50e2f2ba10d5cd1b10f403bec74a9"], 0x3c}, 0x1, 0x0, 0x0, 0x880}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r2, 0x0, 0x82, &(0x7f00000002c0)={'broute\x00', 0x0, 0x0, 0x0, [0x3, 0x7, 0x4, 0x1, 0x2, 0x7]}, &(0x7f0000000200)=0x78) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x0, 0x298, 0x200, 0x200, 0x298, 0x330, 0x330, 0x330, 0x330, 0x330, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x98}}, {{@ip={@remote, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00'}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x4]}}}}, {{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28}}, {{@ip={@rand_addr, @multicast2, 0x0, 0x0, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) ioctl$TIOCGICOUNT(r1, 0x545d, 0x0) sendmsg$nl_route(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000dc0)=ANY=[@ANYRES32, @ANYRES32=r1, @ANYRESHEX=r0, @ANYRES16=r0, @ANYRES16=r0, @ANYRES64, @ANYRES8=r0], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000008c0)=@filter={'filter\x00', 0xe, 0x4, 0x408, 0xffffffff, 0xf8, 0x1f8, 0x0, 0xffffffff, 0xffffffff, 0x338, 0x338, 0x338, 0xffffffff, 0x4, &(0x7f0000000880), {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private1={0xfc, 0x1, '\x00', 0x1}, [0xff000000, 0xff000000, 0xffffff00, 0xff], [0xff, 0xffffffff], 'team0\x00', 'caif0\x00', {}, {}, 0xff, 0x2, 0x4}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@icmp6={{0x28}, {0xe, "f54e", 0x1}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x1}}}, {{@ipv6={@remote, @empty, [0xffffff00, 0xff], [0xff000000, 0xff000000, 0xffff00, 0xffffff00], 'dvmrp1\x00', 'bond_slave_1\x00', {0xff}, {0xff}, 0x3c, 0xf2, 0x4, 0x34}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@srh={{0x30}, {0x2, 0x3, 0x4, 0x2, 0x0, 0x810, 0x1000}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x7, 0x8000, 0x2}}}, {{@uncond, 0x0, 0x118, 0x140, 0x0, {}, [@common=@hbh={{0x48}, {0x1, 0x1, 0x1, [0x0, 0x5, 0xffff, 0x6, 0x2, 0x0, 0x10d, 0x7, 0x17de, 0x9, 0x2, 0x1, 0x0, 0x9, 0x4b9, 0x5], 0xa}}, @common=@inet=@length={{0x28}, {0xfff4, 0x0, 0x1}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x468) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) pipe2$9p(&(0x7f0000000080), 0x800) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010029bd7000ffdbdf2500000000", @ANYRES32=r7, @ANYBLOB="100804002010000024001280110001006272696467655f736c618c65000000000c000580050019"], 0x44}, 0x1, 0x0, 0x0, 0x404c1}, 0x40040d4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200040d4}, 0x24044040) ioctl$int_in(r4, 0x5452, &(0x7f0000000280)=0xffffffffffffffff) sendto$inet6(r4, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) pselect6(0x40, &(0x7f0000000040)={0x0, 0x10, 0x4, 0x2, 0x7fffffff, 0x10, 0x4c4, 0x8096}, &(0x7f0000000100)={0x9, 0x2, 0x400000000000006, 0x8, 0x6, 0x8, 0x4, 0x8}, 0x0, 0x0, 0x0) sendmsg$sock(r3, &(0x7f0000000840)={&(0x7f00000005c0)=@nl=@unspec, 0x80, &(0x7f0000000780)=[{&(0x7f0000000640)="d4884f43c9577281f0c7cbfc98092dc81be18eb3bf3f1e5e18f57acd235aaae489b85074d7d2e3645fd65e692729f1a88d82042b854c102154a2c4dbef3a3526fa78796143dfeb4fe435f027eaf40b1a74d08545e02158f9dc3eb7078bab579124581e02255744a10625", 0x6a}, {&(0x7f00000006c0)="0c5f1527efcf0ba31e616cfdbb810c04058437ea4d8d029cb0d9d4b9dfc6baf1aed6552a221f768629927dde1e2f51b5ddf7eee1bb03d9b21809dab2c7b5bd11ef47e4c99b705189e1ea69166c8f985980a56428ed75e1be4e305f51d1f2027826bf6523fb50e758be7094022bc2815a18a5470f46670dee9a3de08119b49f488eaa6ace9c756a03", 0x88}], 0x2, &(0x7f00000007c0)=[@timestamping={{0x14, 0x1, 0x25, 0xb}}, @txtime={{0x18, 0x1, 0x3d, 0x1}}, @mark={{0x14, 0x1, 0x24, 0x3ff}}, @mark={{0x14, 0x1, 0x24, 0x10001}}, @timestamping={{0x14, 0x1, 0x25, 0xc47}}], 0x78}, 0x4000000) 21.799866383s ago: executing program 0 (id=128): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) openat$cdrom(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) (async) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, 0x0) (async) r1 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x100, 0x0) syz_open_dev$sndmidi(&(0x7f00000000c0), 0x7, 0xc955b673bbc45e27) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="58000000020601080000000000000000000000400500010006000000050005000200000005000400000000000900020073797a31000000000c0007800800064000000000114c2300686173683a69702c6d61726b00000000"], 0x58}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000004c0)={'ip_vti0\x00', &(0x7f0000000440)={'tunl0\x00', 0x0, 0x4706, 0x7, 0x5, 0x68c5, {{0xc, 0x4, 0x2, 0x30, 0x30, 0x64, 0x0, 0x0, 0x2f, 0x0, @private=0xa010101, @private=0xa010100, {[@lsrr={0x83, 0xf, 0x7b, [@loopback, @dev={0xac, 0x14, 0x14, 0x32}, @private=0xa010100]}, @timestamp_addr={0x44, 0xc, 0x8f, 0x1, 0xe, [{@multicast2, 0x6}]}]}}}}}) sendto$packet(r1, &(0x7f0000000380)="cf6e0e167d0ebbf73ab81022e41e8e6063fe5b46a9395832d08943ad5ca903c5123333c275bde55d409ec82c3443e8e7fd60bd94dae6bd400189784fa778a1831e6d22e986cdf2d3c05d33a185c030091fceb84a4ce230c1b1f67be2a3e6abef8005b95277d3a0981391691c5e30c5f8b7ec457d3994c6f509718c87e83b4b8b48821ff887faaddd", 0x88, 0x4054, &(0x7f0000000500)={0x11, 0xf7, r3, 0x1, 0x5, 0x6, @multicast}, 0x14) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="480000000906010200000000000000000500ffff200007800c00018008000140e000000208000a400000000205000300020000002900020073797a31000000000500010007000000"], 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@ipv6_delrule={0x30, 0x21, 0x200, 0x70bd2b, 0x25dfdbff, {0xa, 0x20, 0x14, 0x8, 0x1d, 0x0, 0x0, 0x4, 0x1e}, [@FRA_SRC={0x14, 0x2, @ipv4={'\x00', '\xff\xff', @remote}}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x40) 21.706530709s ago: executing program 0 (id=130): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000700)=ANY=[@ANYBLOB="280000005e00816b00000000000000b20c00a2eefaf1a47463ed00800c000180080004"], 0x28}], 0x1, 0x0, 0x0, 0x40004}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20940, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'virt_wifi0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x401, 0x70bd28, 0x100, {0x0, 0x0, 0x0, 0x0, 0x8603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x20008004) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/keys\x00', 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) lseek(r1, 0x4, 0x0) 21.460570441s ago: executing program 0 (id=131): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x183) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x1000010, 0x0) chdir(&(0x7f0000000080)='./file0\x00') r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_DEV(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x50, r2, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_SHORT_ADDR={0x6}]}, 0x50}, 0x4, 0x700000000000000}, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0xa0c0, 0x0) r4 = ioctl$NS_GET_PARENT(r3, 0xb702, 0x0) setns(r4, 0x4000001) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x10f) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1}) keyctl$search(0xa, r0, &(0x7f0000000880)='rxrpc_s\x00', &(0x7f00000008c0)={'syz', 0x3}, r0) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}}, 0x5c) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x23, &(0x7f0000000280), 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000200)={'wlan0\x00', 0x200}) r7 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000840)='./proc\x00', 0x400000, 0x100) openat(r8, &(0x7f0000000080)='./proc\x00', 0x218201, 0x4) r9 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') sendfile(r9, r9, 0x0, 0x1) syz_emit_ethernet(0x7a, &(0x7f0000001900)={@remote, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv4={0x800, @tipc={{0xa, 0x4, 0x2, 0xb, 0x6c, 0x68, 0x0, 0x3, 0x6, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ra={0x94, 0x4}, @timestamp_addr={0x44, 0xc, 0x95, 0x1, 0x0, [{@rand_addr=0x64010100, 0x1}]}, @noop]}}, @name_distributor={{0x44, 0x0, 0x0, 0x0, 0x0, 0xa, 0xb, 0x2, 0x1, 0x0, 0x1, 0x0, 0x7, 0x1, 0x4e20, 0x4e20, 0x2}, [{0x9, 0x8, 0x7fffffff, 0x1, 0x0, 0x8, 0x3}]}}}}}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x7fff, 0x2, 0x2172, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000005800)={r7, 0xa9, 0x20}, 0x0, &(0x7f0000000780)="010040b6dcb8c658c8b9a7dcffd1bbdae49b8764c8cfeeb2dd200f6d3cdf5c69138da8463ffda45302d788a5c3fd0d82add6092e4edc32ee1405ef00000e25e5dce03e1191cabfd7c6beacd97746cfda01ed0f52ff54a611fe424e3561dbba6794b02cc3ae989632507bf94633f947611862a9267e5612ceba7a66affb0983077dbc088c9a4b6b6293294a51c8214732e04a56638c7911d73ac25dd3e6c7d1cd8c928c357207fca2e9", 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) 21.388048273s ago: executing program 0 (id=133): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000800000/0x800000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4004844) r0 = io_uring_setup(0x56ab, &(0x7f0000000040)={0x0, 0xffca, 0xc000, 0xc, 0xa0002f5}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x26, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240), 0x900, 0x0) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) 21.079719253s ago: executing program 0 (id=140): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) openat$panthor(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83c00fe8000000000000000000000000000aaff02000000000000000000000000000106"], 0xffe) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000100)={0x0, 0x1}) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x9, 0x4, &(0x7f0000000300)=ANY=[@ANYRES32=r0], &(0x7f00000001c0)='syzkaller\x00', 0x20002, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x2, '\x00', 0x0, @fallback=0x38}, 0x94) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') preadv(r4, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/196, 0xc4}], 0x1, 0xa3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r8 = fanotify_init(0xf00, 0x0) fanotify_mark(r8, 0x1, 0x5800003a, r6, 0x0) read$FUSE(r8, &(0x7f00000020c0)={0x2020}, 0x2020) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) r9 = openat$cgroup_int(r5, &(0x7f00000002c0)='blkio.throttle.write_bps_device\x00', 0x2, 0x0) write$cgroup_subtree(r9, &(0x7f00000000c0)=ANY=[], 0x6a) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)) r10 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r0, @ANYRES32=r10, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r11}, &(0x7f0000000000), &(0x7f00000002c0)=r3}, 0x20) mount$tmpfs(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)=ANY=[@ANYRESOCT=r9]) 20.997450866s ago: executing program 32 (id=140): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) openat$panthor(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83c00fe8000000000000000000000000000aaff02000000000000000000000000000106"], 0xffe) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000100)={0x0, 0x1}) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x9, 0x4, &(0x7f0000000300)=ANY=[@ANYRES32=r0], &(0x7f00000001c0)='syzkaller\x00', 0x20002, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x2, '\x00', 0x0, @fallback=0x38}, 0x94) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') preadv(r4, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/196, 0xc4}], 0x1, 0xa3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r8 = fanotify_init(0xf00, 0x0) fanotify_mark(r8, 0x1, 0x5800003a, r6, 0x0) read$FUSE(r8, &(0x7f00000020c0)={0x2020}, 0x2020) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) r9 = openat$cgroup_int(r5, &(0x7f00000002c0)='blkio.throttle.write_bps_device\x00', 0x2, 0x0) write$cgroup_subtree(r9, &(0x7f00000000c0)=ANY=[], 0x6a) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)) r10 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r0, @ANYRES32=r10, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r11}, &(0x7f0000000000), &(0x7f00000002c0)=r3}, 0x20) mount$tmpfs(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)=ANY=[@ANYRESOCT=r9]) 3.083065422s ago: executing program 4 (id=321): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="190000000400000004"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r2}, &(0x7f0000000240), &(0x7f0000000340)=r3}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000008c0)={r3, r1, 0x25, 0x2, @val=@tracing={0x0, 0x2e5b}}, 0x20) syz_emit_ethernet(0x3e, &(0x7f0000000340)={@multicast, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "76b2af", 0x8, 0x2f, 0x0, @private0, @mcast2, {[], {0x0, 0x883e, 0x8}}}}}}, 0x0) 2.99758525s ago: executing program 4 (id=322): syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x200000000000000) 2.997297076s ago: executing program 4 (id=324): syz_open_dev$evdev(0x0, 0x0, 0x88440) socket$packet(0x11, 0x2, 0x300) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019c80)=""/102400, 0x19000) kcmp(r1, r2, 0x1, 0xffffffffffffffff, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xb2}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) syz_emit_vhci(0x0, 0x8) 2.948445247s ago: executing program 1 (id=325): syz_emit_ethernet(0x2a, &(0x7f0000000300)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x40, 0x0, 0x40, 0x11, 0x0, @private=0xa010101, @private=0xa010102}, {0x4e20, 0x4e20, 0x8}}}}}, 0x0) 2.729811098s ago: executing program 1 (id=327): ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x8910, &(0x7f0000000940)={'syztnl0\x00', 0x0}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e22, 0x10000009, @loopback, 0x7}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r1, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$packet(r1, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @random="08021100"}, 0x14) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f00000031c0)=[{&(0x7f0000000000)="247c9b06c6cf", 0x6}], 0x1}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000001c0)="a3", 0x1}], 0x1}}], 0x2, 0x4040881) unshare(0x8040480) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) socket(0x2, 0x80805, 0x0) close(0x3) r2 = socket(0x2, 0x80805, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000001900010000000000000000001c140000fe000001000000000800", @ANYRES64], 0x24}}, 0x4000000) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000200)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r6, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x80002}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r7, @in6={{0xa, 0x3, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r2, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) 2.377087433s ago: executing program 1 (id=329): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) socket$netlink(0x10, 0x3, 0xa) socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() socket$inet6_sctp(0xa, 0x1, 0x84) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000001000)={0x2, 0x4e21, @loopback}, 0x10) sendmsg$rds(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000540)}, 0x0) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r4, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) 2.373115797s ago: executing program 2 (id=330): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sched_setscheduler(0x0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)='!', 0x1) 2.039932414s ago: executing program 2 (id=332): r0 = fsopen(&(0x7f0000000080)='devpts\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x81}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getpid() io_uring_register$IORING_REGISTER_ZCRX_IFQ(0xffffffffffffffff, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x1, 0x2, &(0x7f0000000200)={&(0x7f0000001000), 0x1000}, &(0x7f0000000300)={&(0x7f0000002000), 0x1000, 0x1}}, 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 1.866224435s ago: executing program 4 (id=333): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x40d, 0x70bd29, 0x0, {0x0, 0x0, 0x0, r2, 0x69b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) r3 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r4, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r7], 0x44}}, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) r9 = socket(0x1, 0x803, 0x0) rseq(0x0, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r11 = io_uring_setup(0x1f1c, &(0x7f00000005c0)={0x0, 0x17d7, 0xa, 0x3, 0x283}) close_range(r11, 0xffffffffffffffff, 0x0) close_range(r10, 0xffffffffffffffff, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) mremap(&(0x7f000040b000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f00004b3000/0x4000)=nil) madvise(&(0x7f000083f000/0x1000)=nil, 0x1000, 0xc) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700ff01000000000000000000000000000108000a00", @ANYRES32=r13], 0x54}}, 0x0) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) 1.22111972s ago: executing program 1 (id=334): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x15, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f0000000300)={0x2, 0x15, @loopback}, 0x10) write(r2, &(0x7f0000000400)='PASV\r\n', 0x6) r3 = accept4(r0, 0x0, 0x0, 0x0) write(r3, &(0x7f0000000500)='227 Entering Passive Mode (1,1,1,1,1,1)\r\n', 0x28) 1.215760277s ago: executing program 2 (id=335): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = getpid() syz_pidfd_open(r0, 0x0) unshare(0x20000400) r1 = gettid() r2 = socket$inet6(0xa, 0x3, 0x7) recvmmsg(r2, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000180)={[0x9]}, 0x8, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x400000003, 0x0, 0x1, 0x800, 0xfffffffffffffffd, 0x2}, 0x0, &(0x7f0000000200)={0x1e, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0xfffffffffffffffc, 0x6e8e}, 0x0, 0x0) timer_create(0x8, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xffff, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 1.010678952s ago: executing program 4 (id=339): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x4000000, 0x1, 0x0, &(0x7f0000000040)="97", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x4c) r0 = syz_open_dev$sndpcmc(&(0x7f0000000180), 0x0, 0x80) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r0, 0xc2604110, &(0x7f0000000680)={0x0, [[0x5, 0x0, 0x9, 0x1, 0xfffffff5, 0x0, 0x0, 0x1], [0x4, 0x1, 0x0, 0x6], [0x100091, 0x4, 0x2, 0x0, 0xfffffffe, 0x0, 0xff]], '\x00', [{0x0, 0x3304}, {}, {0x4}, {}, {}, {0x8}, {}, {0x1}, {}, {0xb}, {0x2, 0xf7bb}, {0x0, 0x3}], '\x00', 0x303}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000000)='ext4\x00', 0x9410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101842, 0x1) write$vhost_msg_v2(r1, &(0x7f0000000400)={0x2, 0x0, {0x0, 0x0, 0x0, 0x3, 0x1}}, 0x48) 931.071013ms ago: executing program 4 (id=340): openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x901800, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x901800, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1f, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="7b87f20f89", @ANYRESHEX, @ANYBLOB="c2"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1f, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="7b87f20f89", @ANYRESHEX, @ANYBLOB="c2"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x4e1d, 0x0, @empty, 0x61}, 0x1c) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x440, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r5, 0x5404) socket$pppl2tp(0x18, 0x1, 0x1) (async) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, &(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, r3, {0x2, 0x4e22, @multicast2}, 0x1, 0x2, 0x4, 0x2}}, 0x26) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000001300)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) ppoll(&(0x7f0000001780)=[{r7, 0x2108}], 0x1, 0x0, 0x0, 0x0) 418.730721ms ago: executing program 1 (id=346): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) link(0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1e00000007000000fdffffff"], 0x50) getsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000080)=ANY=[@ANYBLOB="000000001f0000001a007f"]) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x0) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/devices/system/memory/auto_online_blocks\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='online', 0x6) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/vlan/vlan1\x00') 360.547732ms ago: executing program 3 (id=347): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000640)={0x0, &(0x7f0000000000)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18, 0x1}, @nested_vmresume={0x130, 0x18, 0x1}, @nested_amd_set_intercept={0x181, 0x30, {0x0, 0x3}}, @out_dx={0x6a, 0x28, {0xb01e, 0x2, 0x400}}, @in_dx={0x69, 0x20, {0x728b, 0xc}}, @wr_crn={0x67, 0x20, {0x2, 0x942c}}, @enable_nested={0x12c, 0x18}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x2, @guest_nat=0x6802, 0x2, 0xd7e, 0xc}}, @wrmsr={0x65, 0x20, {0x13c, 0x8}}, @nested_amd_vmload={0x182, 0x18, 0x2}, @rdmsr={0x66, 0x18, {0x9cd}}, @nested_load_syzos={0x136, 0x14d, {0x1, 0x10, [@enable_nested={0x12c, 0x18}, @nested_load_code={0x12e, 0x55, {0x2, "66b883000f00d865260f01cac4814572d3fa3e644f0fc7a80000000066b8c8000f00d8c42210f736440f01f80183602e000064400fc7745c00650f7feb"}}, @nested_amd_inject_event={0x180, 0x38, {0x1, 0x2d, 0x0, 0x2, 0x2}}, @nested_vmresume={0x130, 0x18, 0x2}, @nested_load_code={0x12e, 0x50, {0x2, "c423fd0b0a0966b8f5008ec8c422c109262e470f005f0026450f20c2c441257c93b10000000f01f8f3470f1b5711f30fc7750566ba4100ec"}}, @nested_amd_invlpga={0x17d, 0x20, {0x4000, 0x8534}}]}}, @wr_crn={0x67, 0x20, {0x4, 0x3}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @control_area=0x7, 0xf, 0x8, 0x401}}, @wrmsr={0x65, 0x20, {0xcfd, 0xfffffffffffff489}}, @enable_nested={0x12c, 0x18}, @nested_vmlaunch={0x12f, 0x18, 0x2}, @nested_amd_set_intercept={0x181, 0x30, {0x0, 0xef3, 0x80, 0x1}}, @code={0xa, 0x53, {"364b0fc72fb9b40000400f32c462fd9e6200d9ee0f20053e673665660f38811ac441e571f596c4e1fe2c16c44195ea4d00b900040000b8f0000000ba000000000f30"}}, @nested_vmlaunch={0x12f, 0x18, 0x1}, @wrmsr={0x65, 0x20, {0x2bd, 0x158}}, @nested_load_syzos={0x136, 0x50, {0x1, 0x0, [@nested_amd_vmload={0x182, 0x18}, @nested_vmresume={0x130, 0x18}]}}, @nested_amd_set_intercept={0x181, 0x30, {0x2, 0x7, 0x8}}, @nested_amd_inject_event={0x180, 0x38, {0x1, 0xa, 0x2, 0x5, 0x2}}, @enable_nested={0x12c, 0x18}, @wr_drn={0x68, 0x20, {0x5}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x0, 0x7, 0x1}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @host32=0x4c00, 0x1, 0x1, 0x2}}, @nested_create_vm={0x12d, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0x45, 0x0, 0x400, 0x1}}, @code={0xa, 0x5e, {"b9800000c00f3235002000000f30c1464f00360f32450f01ca0f01ca36420f009409c800000066baf80cb8b607fd8eef66bafc0c66ed66410f383edb3e650fc79c2fff00000066b87e000f00d8"}}], 0x636}) ioctl$KVM_GET_LAPIC(r1, 0x8400ae8e, &(0x7f0000000680)) ioctl$OCFS2_IOC_GROUP_ADD(r1, 0x40186f02, &(0x7f0000000a80)={0xffffffffffff7fff, 0x8, 0x2, 0x6}) write$UHID_INPUT2(0xffffffffffffffff, &(0x7f0000000ac0), 0x6) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000b00)={0x0, ""/256, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000d00)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000f00)={"002bb624427d81ec3e0b69b243b992e9", r2, r3, {0x401, 0x7}, {0x7ad, 0x5}, 0x7, [0x0, 0x8000000000000001, 0x8, 0x1, 0x0, 0x5, 0x4, 0x9, 0x6, 0x0, 0x0, 0x2, 0x6, 0x8, 0x8000, 0x1]}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000001180)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001140)={&(0x7f00000010c0)={0x64, r4, 0x10, 0x3, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0xa8, 0x7c}}}}, [@NL80211_ATTR_MESH_CONFIG={0x2c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_PATH_REFRESH_TIME={0x8, 0x9, 0x4}, @NL80211_MESHCONF_POWER_MODE={0x8, 0x1a, 0x2}, @NL80211_MESHCONF_PLINK_TIMEOUT={0x8, 0x1c, 0x3}, @NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR={0x8, 0x15, 0xad}, @NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL={0x6, 0x12, 0x1}]}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x4}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x4044085}, 0x20000800) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f00000011c0), 0x802, 0x0) io_uring_setup(0x41e6, &(0x7f0000001200)={0x0, 0x7500, 0x80, 0x0, 0x342, 0x0, r6}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001380)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000001280)="e8f6139cb31586fea24e4b21912301781c0f03dd48fc60abc0cc2ac8dce2ef6773fe1abe8a4a6ace1f4cfcd019490fded5af93320db3e16327ac4df3e991c2c2511ea8310664e23f91f49a7a6259fcc4a884e7065654b5e0a6d1c86d35fa5193e2baa1de177a52da0d4dfd552237c326a2986cac368462cbb558bd369245c2036bd0ef4f99df67f51eee237e219d4713c7df8ec6bd11f099ee17e6036bd0649eee3a6ac1ec32579ef4170a5b1c1ee861c1e60369b5fd78617cf8ab3bbf18d99acd15794703a1d0d01bc1e7cb4a896f55d5ca8b879883ebd982df0f93a6", 0xdd}, 0x68) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r6, &(0x7f00000014c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x20, r4, 0x8, 0x70bd26, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xa, 0x5e}}}}}, 0x20}}, 0x0) ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x7c0790ba) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000001500), r7) bind$bt_hci(r6, &(0x7f0000001540), 0x6) recvmmsg$unix(r6, &(0x7f0000008b40)=[{{&(0x7f0000001580), 0x6e, &(0x7f00000016c0)=[{&(0x7f0000001600)=""/171, 0xab}], 0x1, &(0x7f0000001700)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x118}}, {{&(0x7f0000001840)=@abs, 0x6e, &(0x7f0000001d80)=[{&(0x7f00000018c0)=""/99, 0x63}, {&(0x7f0000001940)=""/133, 0x85}, {&(0x7f0000001a00)=""/89, 0x59}, {&(0x7f0000001a80)=""/151, 0x97}, {&(0x7f0000001b40)=""/28, 0x1c}, {&(0x7f0000001b80)=""/130, 0x82}, {&(0x7f0000001c40)=""/69, 0x45}, {&(0x7f0000001cc0)=""/135, 0x87}], 0x8, &(0x7f0000001e00)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x118}}, {{0x0, 0x0, &(0x7f0000003080)=[{&(0x7f0000001f40)=""/86, 0x56}, {&(0x7f0000001fc0)=""/180, 0xb4}, {&(0x7f0000002080)=""/4096, 0x1000}], 0x3, &(0x7f00000030c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa0}}, {{&(0x7f0000003180), 0x6e, &(0x7f00000032c0)=[{&(0x7f0000003200)=""/20, 0x14}, {&(0x7f0000003240)=""/75, 0x4b}], 0x2, 0xfffffffffffffffe}}, {{&(0x7f0000003300), 0x6e, &(0x7f00000044c0)=[{&(0x7f0000003380)=""/124, 0x7c}, {&(0x7f0000003400)}, {&(0x7f0000003440)=""/4096, 0x1000}, {&(0x7f0000004440)=""/124, 0x7c}], 0x4, &(0x7f0000004500)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x58}}, {{&(0x7f0000004580), 0x6e, &(0x7f00000047c0)=[{&(0x7f0000004600)=""/253, 0xfd}, {&(0x7f0000004700)=""/154, 0x9a}], 0x2, &(0x7f0000004800)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x90}}, {{0x0, 0x0, &(0x7f0000004c00)=[{&(0x7f00000048c0)=""/212, 0xd4}, {&(0x7f00000049c0)=""/216, 0xd8}, {&(0x7f0000004ac0)=""/40, 0x28}, {&(0x7f0000004b00)=""/241, 0xf1}], 0x4, &(0x7f0000004c40)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x118}}, {{&(0x7f0000004d80)=@abs, 0x6e, &(0x7f0000005480)=[{&(0x7f0000004e00)=""/115, 0x73}, {&(0x7f0000004e80)=""/82, 0x52}, {&(0x7f0000004f00)=""/233, 0xe9}, {&(0x7f0000005000)=""/236, 0xec}, {&(0x7f0000005100)=""/81, 0x51}, {&(0x7f0000005180)=""/180, 0xb4}, {&(0x7f0000005240)=""/253, 0xfd}, {&(0x7f0000005340)=""/205, 0xcd}, {&(0x7f0000005440)=""/47, 0x2f}], 0x9, &(0x7f0000005540)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x90}}, {{&(0x7f0000005600)=@abs, 0x6e, &(0x7f0000006840)=[{&(0x7f0000005680)=""/223, 0xdf}, {&(0x7f0000005780)=""/137, 0x89}, {&(0x7f0000005840)=""/4096, 0x1000}], 0x3, &(0x7f0000006880)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x40}}, {{&(0x7f00000068c0)=@abs, 0x6e, &(0x7f0000008a80)=[{&(0x7f0000006940)=""/89, 0x59}, {&(0x7f00000069c0)=""/4096, 0x1000}, {&(0x7f00000079c0)=""/87, 0x57}, {&(0x7f0000007a40)=""/4096, 0x1000}, {&(0x7f0000008a40)=""/11, 0xb}], 0x5, &(0x7f0000008b00)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x20}}], 0xa, 0x10040, &(0x7f0000008dc0)) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000008f00)={&(0x7f0000008e00)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000008ec0)={&(0x7f0000008e40)={0x44, r4, 0x401, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0x8}, @val={0xc, 0x99, {0xf2ce, 0x5a}}}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}]}]]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x880) r13 = syz_open_dev$video(&(0x7f0000008f40), 0x3, 0x200) ioctl$VIDIOC_QBUF(r13, 0xc058560f, &(0x7f0000008f80)=@overlay={0xd4, 0x4, 0x4, 0x102000, 0x4, {}, {0x3, 0x2, 0x6, 0x2, 0x5, 0x6, "68a5f6d4"}, 0x40800, 0x3, {}, 0x8, 0x0, r10}) r14 = syz_genetlink_get_family_id$devlink(&(0x7f0000009040), r11) sendmsg$DEVLINK_CMD_PORT_SPLIT(r9, &(0x7f0000009140)={&(0x7f0000009000), 0xc, &(0x7f0000009100)={&(0x7f0000009080)={0x44, r14, 0x200, 0x70bd2c, 0x25dfdbff, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0x9, 0x2}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004}, 0x80) ioctl$KVM_CAP_VM_COPY_ENC_CONTEXT_FROM(r12, 0x4068aea3, &(0x7f0000009180)={0xc5, 0x0, r8}) mknod$loop(&(0x7f0000009200)='./file0\x00', 0x8, 0x0) r15 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r15, &(0x7f00000093c0)={&(0x7f0000009240)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000009380)={&(0x7f0000009280)=@deltclass={0xd4, 0x29, 0x1, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x9, 0x9}, {0x9, 0xf}, {0xffe0, 0x6}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x70}}, @tclass_kind_options=@c_hfsc={{0x9}, {0x74, 0x2, [@TCA_HFSC_RSC={0x10, 0x1, {0x1, 0x8, 0x4}}, @TCA_HFSC_RSC={0x10, 0x1, {0x5, 0x6, 0x6}}, @TCA_HFSC_RSC={0x10, 0x1, {0x3, 0xfffffffc, 0x8001}}, @TCA_HFSC_USC={0x10, 0x3, {0x9, 0x0, 0x82}}, @TCA_HFSC_FSC={0x10, 0x2, {0x0, 0x9, 0xffff}}, @TCA_HFSC_RSC={0x10, 0x1, {0x1, 0x9, 0xffff}}, @TCA_HFSC_RSC={0x10, 0x1, {0x2, 0x6}}]}}, @TCA_RATE={0x6, 0x5, {0x10, 0x2}}, @TCA_RATE={0x6, 0x5, {0x46}}, @tclass_kind_options=@c_fq_codel={0xd}, @TCA_RATE={0x6, 0x5, {0x7, 0x43}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x800}, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000009400)='/dev/comedi2\x00', 0x84002, 0x0) 360.281249ms ago: executing program 1 (id=348): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="5c00000013006bec9e3be35c6e17aa31076b876c0d000000ba090000160af3653c001ac00400020208000400030001002c000000eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0000300000000000000ffffc6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4a046) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x204002, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f0000006180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000062c0)=[@rights={{0x14, 0x1, 0x1, [r6]}}, @rights={{0x14, 0x1, 0x1, [r6]}}], 0x30, 0xc000}}], 0x1, 0x0) write(r5, &(0x7f0000000000)='3', 0x4e) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000000)={0x0, 0xffffff76}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r5, 0x84, 0x7c, &(0x7f0000000100)={r7, 0x3}, &(0x7f00000001c0)=0x8) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) recvfrom$rxrpc(r5, &(0x7f00000002c0)=""/71, 0x47, 0x1, &(0x7f0000000340)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e22, @private=0xa010100}}, 0x24) syz_emit_vhci(&(0x7f0000000200)=ANY=[@ANYRES32=r8], 0x1d) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000226bd7000fbdbdf251c00000008000300", @ANYRES32=r4, @ANYBLOB="19d5270f0c007d000500000044000000"], 0x28}, 0x1, 0x0, 0x0, 0x892}, 0x0) 351.007575ms ago: executing program 3 (id=349): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) ioctl$RFKILL_IOCTL_NOINPUT(r1, 0x5201) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000000100)={0x2, {0x2, 0x103, 0x100, 0x9, 0x2}}) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000000400)={0x2, {0x2, 0x1000, 0x500, 0x900, 0x1, 0x4000}}) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002b80)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000001000000000000000000000017000100ffffffff95000000000000003d30773aaa601e001d1b4ebf1ecda2b0ba22ccd857c3b9754a96b2cf0e2df551e19df7b099dbcb9673722ad4115912417f79"], &(0x7f0000001a40)='GPL\x00', 0x7, 0x0, 0x0, 0x5d59e8f085ed71bc, 0xa}, 0x94) close(r2) 290.626798ms ago: executing program 2 (id=350): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, 0x0}], 0x1, 0xe8, 0x0, 0x0) r3 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000000906010200100000000000000a0000090900020073797a30000000010500010007000000080049400000000114000880100000247501607715d85e50094356deea90e5262f5d47f91789ad57b3fc283067e26e009080ffc339716983be6df6ddffb01733"], 0x44}, 0x1, 0x0, 0x0, 0x404c005}, 0x4000) read(r2, &(0x7f0000000180)=""/204, 0xcc) ioctl$KVM_RUN(r2, 0xae80, 0x0) 289.40045ms ago: executing program 3 (id=351): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'ipvlan0\x00', 0x5001}) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'ipvlan0\x00', 0x5001}) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20}, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) (async) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) r5 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000180)={@mcast1, 0x800, 0x0, 0x2, 0x3, 0x8000}, 0x20) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000180)={@mcast1, 0x800, 0x0, 0x2, 0x3, 0x8000}, 0x20) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = open$dir(&(0x7f0000000300)='./proc\x00', 0x400, 0x40) mkdirat(r8, &(0x7f0000000040)='./proc\x00', 0xf9) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/sctp/auth_enable\x00', 0x2, 0x0) sendfile(r9, r9, 0x0, 0x3) (async) sendfile(r9, r9, 0x0, 0x3) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000080)={'vxcan0\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000080)={'vxcan0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@can_newroute={0x24, 0x18, 0x1, 0x0, 0x200, {0x1d, 0x1, 0x8}, [@CGW_DST_IF={0x8, 0xa, r10}, @CGW_SRC_IF={0x8, 0x9, r11}]}, 0x24}}, 0x0) (async) sendmsg$nl_route(r7, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@can_newroute={0x24, 0x18, 0x1, 0x0, 0x200, {0x1d, 0x1, 0x8}, [@CGW_DST_IF={0x8, 0xa, r10}, @CGW_SRC_IF={0x8, 0x9, r11}]}, 0x24}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3400000019"], 0x34}}, 0x0) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r12, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r12, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) (async) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r12, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@delchain={0x34, 0x64, 0xf31, 0xfffffffb, 0x1000000, {0x0, 0x0, 0x0, r12, {0x0, 0x9}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) r13 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r13, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000003240)=ANY=[@ANYBLOB="03031c0005001400060046230fc00064000003029078000000000000000044044a7011089078e00000017535bfe5a7e97b15cdcba5966d9732ea8ea08cf639b5e5d7bcec8a8a25ecde7989a190279cbfc9c67f6a2c99e404512295a4cb3dfd4a1ef09082d6d9dd11683efc9cbfbedf14876b75b5a0b6e83c7bb96983447caf70f4f1bab78e6fb7f86c49abefdd46d198449e26dade932f3bbeb7474762162a196d0921762555e96dbd4c3728c458cee2cc4573281cf2a63b58774a7e89abd34565e59067826875881bea3b1eeedfa8cb09ae250d9e89488c3e99bd41dc02f566409f739964151d46d4f3e8e25080e086e7018b95d4a2a7e66c99e9df40c7e553a5e13f9e8a895f438a6a776845b275d19dc4b6fa52153caa3c6bac9c57643ee975cb1d0665a10703d785a9ca1029a9bc4b29f5f8159788e2ce8566ae144edf636947d1d3e1fabcac9801ea7e75e2ee53fb52fcd2d05aca25f79bc514baa52d1ac470964234c3c3545ac1e7b4aef579e3ca9996afcb527157bdc14880d35c9b26891cb75503d476a1961bef9bd05aab15a8f6d086b22e4265f4f57e8692edaeff9eeb8f71981ad983b26b553142a65e00e0e0a764902d46c766f13a0393ecff1543eb642c23f587745c414315902b90b6c7ebf2c40dc5578f1f2141844489abd912b450d900ad3383636ca68b3704dea493c2cf0ddb71045b62f5a856bec50d8ac4d83dee03b201bc5ed65f281d9fb48d25fad5222550e7b23988084bbab10356cc167b8863daac2aa5ec5b4e3796625589466007e1217abc661f3bdf56b6621fe54f1ad78fde9acd9bf91ecc2a33a8ef655d5b2accd01794491a254d46c8f40dd1373aa43cec8d247c9c09acb1b0cb5e9e561b5d6f58e50d6e06463830b95b137bc9be674569c6d52233f707657b46163b56e75dec716ba88b24bb7b920a0f90ed64e25a11d71a21df7e960fae2fad78c51e55bc0b7c1f2ba6480f216f3ff07cf070627d3d6d3eae05628efac172018781b8a005e20c32022ec6c487913f9c84a881a28034c5bec4d8cb101ecb1521f077398f2f6d2fe8f23baab409a2611d4cadb438f462c4dec2a79a1d6daf8ca8dacf380159e0a9ed5933a955e9d3f1e51a73b662588a9bd9039d75a6f72a627c0d04f1241911ab66ebc3622e37502cfca2f4fde0c41dfe674fb04f028b5f363c4a2171e5ee7a37c5076684d95f9410874ed0a4fbe6b42b14a1fec1826b00bb9a92d288328cb97897ca9029396110ef9a4029bc5d81ff765cbd9217d15662d975a73c71c1d4fece4c955a89e10b5645deaf5e0c2ac858a81d04aa75a2305e815d0be3ea37b2b4dcfd12bca49350b4db4971e95b60897fced07aed8dfcbe16e923bb1687202dd0afc5fc704de262575c988aa3390ea4d958adc81e1d6295e13d55457a780855ae762ab2b95752a20c7a14c0db07aa274a46b29b5e90dcf6af0061fe2c5519c922a98b45b3e19db159afa2ebc53464244f681e4a9b77bee51563a8ac05657b701de22af924dffaea81d63c8fc155ca24c6452fca586aee653b2fd08f64c40bbb352159ca4458a6c0516dc101235e5fe8a17bf323dec6adf7ff489dad49a6c721369bde4d29070c3c1c041266a84d10956766a23cb7eb7771f7724423868ac33ea27933c2ddcdf6270dc4f95bf7574850b3989ce78f79550b3fff34430db937f6986f3c671ecfc3e9f9528f2f421e8e739f42007aafc65044017f3ae8c804b9cfe265db3f8133c52d7872fc9e84d5ee66979784e82f685548dd9d73d4e08a96fa16450138edda99f5a0f1ce42a95cd31a2cc89809314f6601d2b9f3dade31c3b6a3697258e36eb14b36a07d526e8fd35736615891a742dc5f245a3623a466394630816b4c1060fe5024b2e8502ea8e5af35dca603c435fdc600a2c6b4c850843754af386a740c7391c6597b7e449db86e8014e4016562c6554df947913924b840918ed527cd33af80e8e4621064acfe51bc109f7bc3d0ff379f99111657cd672241ce51669fe523c79df3143921674fe13d0ac9e412df58565e4a0f1bccdc46c38778a0036c68d9e91bc64e04e8089fec22ac103b28a13ac3a493e461b874ab47ec360d90a3e82761339bbf64a42586b8463e236d56528a2707ed1a391045aaec35e32cdf711073ab8dbc4dd1e00b53efa33349abae900bf776fefcb12de10f87f629db55aec4a01bdc1b2bdc353ebb438474e45fe5df2dc835595b94d98fbca406fc5dc8de8aa433bcbde4da5cb20a139fdd4a896a72f6df8d7af762c937fd9426608f605a17d80a411562a2bb7378ce7e064a96fa500222922857a7d35d66da170c5998e302141f04efe50cc59d4907a8afd9719e8b18c4e390916876df1c1c34e60ac45abdbb800ddb28d26b22f22d677098a9d08e4a5ef66e8379fd2c22850397d50e3db8a0a9c3204c32792cc5e73e7b9c7ec91960d832b97497aaaf29d68801fa3a4335de56c7b7f98dafc80a12ae8f73c47c1a591fd377bf46ee686429327901003b4d7a97ec0049119158965d85d1cbbb59c61cb3aac1005a8b1801eb5edf9b687a7179044a052e3fd0bb54aecaf6a38a1cfe08a19a1704f3e1ef0e9da860b36593ab0da53b32f8df6ac7f6543b8ae48d3033d282d12f91c565f3ad2058a0163763046897d15bbca0bf9c51295dbf6ac0b0c118aac434ef40d47f291c38f15f2d05ac9c39c2107ac636a7b59d3c6f9d01dabf6238793b128973fee47a8913fce9d19cdc3d77cbe1c0105b8f51f8dbe9cff95883bb23d490f123f05a46dd9fda0db6431f11b871ecc817b59aa399e7983a71030deda30ab18557326c567614a269b1799948bd95cad843a901e6e7277cbd0b426c7df0d8cd515a16ea4ce0fff512aa9fe1f713e8b0e0ad3d4aa133fc5e13df93a3d9e2fb1b16eed71c1ed525d4372432b0387af9c6e8632a0524986f1bc409b5341e972e67e6b37b0341e5d7874673435f3c3d5a7ca91967a755dcccce0ab81dd31493556b082514b32b38686a559ea4df5f3e1e0172d0b8e35054a14bc5c76ffbde95cd0de982ce2447533814188550dcf5c6ef11257f8fc2ae901c51450d3275d1931ea45356f34bbb999a387b8c7ff21ef55d156f3c7d128358d39d665cc77c69b76e2eaaf70df0b6b2873b43e6d163c4d185774c649cbed94d2736d55db966b23a1019bf267d90b2aff37f7b3d852211dc88177623a03914064f8541f5ca3e7dd94ffd41b85fc536ccf1ebd77ac6c37a5918ab39734d4452bc79a9c6a1f4fdd8659662ae0dd0c24e38080a9bcb803d66f92e2e9542b3bf5b9972a49e51840ae3f2ee9070988d008d2593aa5ff9e80cfcd591bc16afbe8eb1d0589c0360cd6233b4fca06b117d90daceddcc095733b5bf15dc67fd61bc7138fc0424c31cba588a213e798c8ad2a44130f009c636417346e4c30cdda5d67dee3ef6c230178ef2760ccbe3f2148e2d6b0f4482e4f01ad7b0038bfe0e1b4c4886467e2769af5f01c34d86227a63ea9e6a236f0b016ac45e4dc5740fed4648374d751c47eb05fe7c27f9c0c64bcb8eb8f7caac553b81faf229c2b4d65066db1bcc224cf55a3a9fbd9c4cef128a75081bc328033956ded108b549bb0f0e9d47b1bd11b5c0e530fe82e64fea09cf2ace9321f297865f0ac106b649515f7963a7735c35d0437b9ed86de171abb485c8ae0a356f3cdb5518ebcdc778bdc7d4199973e8b5a250b5a26665fcd4a3e2172d990a6eb0c66b46a242c4761c65dd4ea85c1fc4d72cf1ac9dfa0d97bb30f256d47dda475ed13c48f5cdf3d283e727dcb690f63cb14cb4137c6b5f0a754baac058a81863c6c63d367477ca2fd18974fc59bce30937de4e3b01c32f6b066f942323cf7781eeb0d3c50e8ebe40e24ff8f332463af30b6f34d37066a3f41bd25e91bc6b908a858a35cd3ce1f442170ae646da8d3c48131cf2636df7cc854767082d44b296b5665ac881da2dbdb3f9625e4f08878b7397c569961e5b3bc0247866071b8dfe64444df9a7b793c3536cc6366e6be8a7e149286ce418707340c6631185f7f45a2350b5eaec1fa4feac76f522d72602c31184f47ed1205768a71676fe7f34dfcf40d9a179cb7c65e1bf1580dc566471ecc7e75a8c0d3ba01a2a0c7e13ea1e6baa58cde1c8bc2cdb6107c6eac6350a93d874ba02708dcd00b0e6c11357bf6ab71d1bcf5babaefb8867349c3162597ee60700bb63c99e03d7ab7f2c71f4867aea97b2e703e7a56eb78344476e6cf6e0940774851274ef806618e07f5bdb83c5d6886be415366a14e3ad88b827af03683a59cf8048bb4c5b2e58010dfbfcfad508f94c8d9600e27d45a8cf11457624798c38dc338ec377e0dbf00b3a1cdcc239a7f1afe2a2c7d45a7da900353366ad5052da74808c38fea633bbbc13321202fc23e0728d9e63eede0b9936f59db3786012c17c6f4510861fbe5d37387c1397df41c5eb14be4b5ca3290db26326849bc7e69ce1f69a86aac9fe4c30a91f4f0624f893de5e6eb996ce4256647b6bf7779192c8e029105d669599bcd3b27a6f8ee314c948b1965888789bc729a389e87159dd9fd2bd20114d1461843bd87e498ff389550aaf27a96ce0c84dc7e409c09de299ae6edfd8af85a07b4e3e743ac44174bbdc6646c15b6abc73399bc7a6389213bb1339b79829b2d574ee22d362e708ac809d2095be7e30c4255e298a82f756b6b811302adbd102a6acb0ae3fa66999f3f10d278d0653d2069f1cd35a330f0e09749bfd1f1675373bfe72c4d394c42218e0dd60feb65a75e09a76d3c6f979ec90396cf48e8001d1e5aa90e19dfecaf82af6c728d637c7eab4dc72579997cc1c1f6bb55cb17e546ab7dee9312ac92da028c54ae12eef423e3e8c51b8f7e08dbaefccd9dc06cb52d20742821dc88df1ee6becb5189675905e2880e3265cd4519690a7264e3d306779e0e143dea0a1081c50291e797337eb8db3f62199bbb4d4ad01df503d643b34e50dfbf25a46f8f3df088df17b4fa794db60028314283b70ced54d309669b64e296a6d59fbaf1f65a24a31d7e3956347253b3ca98a5436bb66ee056959845e5c81076fa48b9b7e0872414e6bf834128140b929f0f81cac9d492efb65933a02f6d3381e7f9b2e35b6d4e591e07f1356818a1ae8862aeb82982c5d72af5ea9ba03b5a4389b84cec3f44ef48986f98a8f627f178e7aa2261322448463d3fab69aafa7c6a5e8ac73765a05c4111b98fe7852afe860df1f6490767df30339cb6e67eee871f94965eb09e28aded03e677b6aba31dda17878ba7c0651012c68255ea6fcaf1d85b81ca3706c31d856923a0c898c0aa2ed93a605243ccf02ed0a1414fae1b58bff27cbb80bbbf9a695beafab1ed20327635f6ec63e6f8571d16d1a8cad0e2a751dd5358e98ca53e39f95e12cc13fc7c53196fd849791bf80ea049403a7b15b86bf7881089dc5aeef430f18812ecb3c49553789945b1beb0befbc4ad0e49722bc08686533e1ed11040a61ab54966cb34771ba464166c8ca90f9cb97183c0856fe090b5a8dd38a44adfb92441c27eac7da02622507c51aab0706b9b0d55c91082cc73cba4990ad1535928b6101096cb547e27842df8384637a5f0e3baf74af8ead5b25b2b328b38e5ed0633881c8dccf82e8cc105f64f672c44ac4cde77c3ca0dc6e82167685743047c8543f5d2591b08c8fdc51b4708d8b9d8ebc9cacc8edd444a8"], 0xfca) 200.528377ms ago: executing program 2 (id=352): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)="b57523cb1a2c90d8acad2e2d98dfc9ea7a5843c3b63b683ced2b3266175599b779617e66e6b3e15c042be90635a2d36160bbf9a2edcacc0bbe015b84150a1928de94397894ff36aa430fc2a0814ba634308d6d0837250dfd1eca5383f9d151449743b1a0c4ffc51242a229c5d6d06f147a61d797ea7ffeda95b76f5623", 0x7d}, {&(0x7f00000001c0)="66f7", 0x2}, {&(0x7f0000000300)='l3', 0x2}], 0x3}], 0x1, 0x40) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x25dfdbfc, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_XMIT_HASH_POLICY={0x5, 0xe, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x0) 150.757899ms ago: executing program 3 (id=353): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c00000010008506000000000040000000000000", @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r1], 0x3c}}, 0x20000000) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350064756d6d79300000000000000000000008000a00", @ANYRES32=r2, @ANYRES8=r3], 0x3c}, 0x1, 0x0, 0x0, 0x40018}, 0x404c0d0) sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x89f1, &(0x7f0000000900)={'bond0\x00', @broadcast}) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r8, r6, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000000c0)={0x18, 0x0, &(0x7f0000000000)=[@request_death, @decrefs={0x40046307, 0x1}], 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r9 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/machinecheck/machinecheck0/bank1\x00', 0x2, 0x0) write(r9, &(0x7f0000000340)='1', 0x1) sendmsg$DCCPDIAG_GETSOCK(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYRESDEC=r0, @ANYRES16=r9, @ANYRES64], 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x80800) accept4$nfc_llcp(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000140)=0x60, 0x80000) r10 = syz_open_procfs(0x0, &(0x7f0000000380)='fd\x00') mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setresuid(0x0, 0xee00, 0xffffffffffffffff) open(&(0x7f0000000140)='./file1\x00', 0x60142, 0x0) r11 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r11, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYRES64=r10, @ANYRESDEC=0x0]) lstat(&(0x7f0000000380)='./file1\x00', 0x0) 149.349332ms ago: executing program 2 (id=354): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) write$P9_RWALK(0xffffffffffffffff, &(0x7f0000000280)={0x4a, 0x6f, 0x2, {0x5, [{0x80, 0x4, 0x2}, {0x8, 0x1, 0x4}, {0x10, 0x1, 0x6}, {0x10, 0x0, 0x4}, {0x40, 0x0, 0x6}]}}, 0x4a) (async, rerun: 32) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x24b, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x100007, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0xf, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x0, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x9, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0xf, 0x7ffe, 0x28, 0x5, 0x2d500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x5a, 0x5, 0x8, 0x8, 0x1, 0x9]}, 0x45c) (rerun: 32) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async, rerun: 32) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (rerun: 32) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) sendmsg$IPSET_CMD_RENAME(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x20, 0x5, 0x6, 0x101, 0x0, 0x0, {0x3, 0x0, 0x6}, [@IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) (async) readahead(r0, 0xe, 0x9) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) (async) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x40, 0x10, 0x581, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x100, 0x202}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bond={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x6}, @IFLA_BOND_ARP_IP_TARGET={0x4}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20004002}, 0x0) 49.497383ms ago: executing program 3 (id=355): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r0, &(0x7f0000000040)=0x8000000001cb, 0x12) (async) bpf$ENABLE_STATS(0x20, &(0x7f0000000000), 0x4) 0s ago: executing program 3 (id=356): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x10000000) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f0000000940)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x4a52fb38}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000040)="f8", 0x1}], 0x1}}], 0x1, 0x20008050) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000240)={0x0, 0x964, 0x89f8}, 0x8) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2800003, 0x31, 0xffffffffffffffff, 0x231cd000) syz_clone(0x6004500, &(0x7f0000000700), 0x0, 0x0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3401) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000180)={0x24, 0x6, 0x19d4, 0x0, 0x4, 0x7c1, &(0x7f0000000080)="0c08de66"}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r2 = dup(r0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r6 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r4, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x84, 0x2c, 0x401, 0x0, 0x220000, {0x0, 0x0, 0x0, r5, {0x4}, {0x6, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x54, 0x2, [@TCA_BASIC_ACT={0x50, 0x3, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}, @TCA_CT_ACTION={0x1, 0x3, 0x1d}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x84}}, 0x0) write$tun(r3, &(0x7f0000000500)=ANY=[@ANYBLOB='E\x00'], 0x1c) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_MPATH(r7, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000580)={0x28, r8, 0x10b, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x24000000) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r2, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, r8, 0x800, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0xa6bf, 0x25}}}}, ["", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000018}, 0x10040041) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) 0s ago: executing program 4 (id=357): setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) ioctl$FE_GET_PROPERTY(r2, 0x80106f53, &(0x7f00000016c0)={0x1, &(0x7f0000001600)=[{0x23, '\x00', @st={0x4, [{0x2, @uvalue=0x10009}, {0x1, @uvalue=0x2}, {0x3, @uvalue=0x1}, {0x2, @svalue=0xaae}]}, 0x1}]}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r4, 0xc138fd03, &(0x7f0000000000)="04000000000000000000000038010000380100000000000000000000000000000000000000000000000000000000000074") ioctl(r4, 0xc138fd09, &(0x7f0000000000)="040000000000000000000000a00100003801000001") getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r4, 0x84, 0xf, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e21, @rand_addr=0x64010100}}, 0xfffffffe, 0x4, 0xb, 0x4, 0x7}, &(0x7f0000000180)=0x98) sendmsg$NL80211_CMD_SET_STATION(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000b9662ff5284b3519", @ANYRES16=r1, @ANYBLOB="010027bd7000030000001200000008000300", @ANYRES32=r3, @ANYBLOB="0a000600ffffffffffff00000800118004000300"], 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x4048014) kernel console output (not intermixed with test programs): [ 28.983993][ T44] audit: type=1400 audit(1791047516.956:115): avc: denied { siginh } for pid=5629 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '[localhost]:42440' (ED25519) to the list of known hosts. [ 31.416421][ T44] audit: type=1400 audit(1791047519.396:116): avc: denied { name_bind } for pid=5640 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 31.451846][ T44] audit: type=1400 audit(1791047519.426:117): avc: denied { execute } for pid=5641 comm="sh" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 31.452600][ T44] audit: type=1400 audit(1791047519.426:118): avc: denied { execute_no_trans } for pid=5641 comm="sh" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 32.102355][ T44] audit: type=1400 audit(1791047520.076:119): avc: denied { write } for pid=5642 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.161600][ T44] audit: type=1400 audit(1791047520.136:120): avc: denied { write } for pid=5645 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.238136][ T44] audit: type=1400 audit(1791047520.216:121): avc: denied { write } for pid=5648 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.281211][ T44] audit: type=1400 audit(1791047520.256:122): avc: denied { write } for pid=5651 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.847233][ T44] audit: type=1400 audit(1791047520.826:123): avc: denied { write } for pid=5654 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.914908][ T44] audit: type=1400 audit(1791047520.896:124): avc: denied { write } for pid=5657 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 33.575990][ T44] audit: type=1400 audit(1791047521.556:125): avc: denied { write } for pid=5660 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 34.154582][ T5641] cgroup: Unknown subsys name 'net' [ 34.308424][ T5641] cgroup: Unknown subsys name 'cpuset' [ 34.311515][ T5641] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 34.575672][ T5687] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 35.419724][ T5641] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 39.234081][ T44] kauditd_printk_skb: 35 callbacks suppressed [ 39.234097][ T44] audit: type=1400 audit(1791047527.206:161): avc: denied { execmem } for pid=5721 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 39.454843][ T44] audit: type=1400 audit(1791047527.426:162): avc: denied { create } for pid=5725 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 39.454889][ T44] audit: type=1400 audit(1791047527.426:163): avc: denied { read write } for pid=5725 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 39.455261][ T44] audit: type=1400 audit(1791047527.436:164): avc: denied { open } for pid=5725 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 39.464512][ T44] audit: type=1400 audit(1791047527.436:165): avc: denied { ioctl } for pid=5725 comm="syz-executor" path="socket:[5948]" dev="sockfs" ino=5948 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 39.498184][ T5733] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 39.500008][ T5733] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 39.505739][ T5735] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 39.506682][ T5735] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 39.510650][ T5735] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 39.511666][ T5735] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 39.512138][ T5735] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 39.512481][ T5735] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 39.515911][ T5739] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 39.518396][ T44] audit: type=1400 audit(1791047527.496:166): avc: denied { read } for pid=5725 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 39.518636][ T5737] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 39.519859][ T5737] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 39.521051][ T44] audit: type=1400 audit(1791047527.496:167): avc: denied { open } for pid=5725 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 39.521423][ T5741] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 39.521660][ T44] audit: type=1400 audit(1791047527.496:168): avc: denied { mounton } for pid=5725 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 39.521710][ T5741] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 39.522926][ T5741] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 39.524062][ T5741] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 39.525394][ T5735] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 39.526270][ T44] audit: type=1400 audit(1791047527.506:169): avc: denied { module_request } for pid=5725 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 39.528394][ T5735] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 39.529764][ T5739] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 39.530158][ T5739] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 39.531027][ T66] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 39.566229][ T44] audit: type=1400 audit(1791047527.546:170): avc: denied { sys_module } for pid=5725 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 40.322798][ T5736] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.323274][ T5736] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.324415][ T5736] bridge_slave_0: entered allmulticast mode [ 40.325898][ T5736] bridge_slave_0: entered promiscuous mode [ 40.358114][ T5736] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.358160][ T5736] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.358320][ T5736] bridge_slave_1: entered allmulticast mode [ 40.359108][ T5736] bridge_slave_1: entered promiscuous mode [ 40.396901][ T5731] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.396947][ T5731] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.397000][ T5731] bridge_slave_0: entered allmulticast mode [ 40.397958][ T5731] bridge_slave_0: entered promiscuous mode [ 40.422607][ T5736] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 40.422749][ T5725] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.423460][ T5725] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.423769][ T5725] bridge_slave_0: entered allmulticast mode [ 40.425770][ T5725] bridge_slave_0: entered promiscuous mode [ 40.427315][ T5731] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.427393][ T5731] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.427485][ T5731] bridge_slave_1: entered allmulticast mode [ 40.428980][ T5731] bridge_slave_1: entered promiscuous mode [ 40.444961][ T5736] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.455896][ T5725] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.455978][ T5725] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.456068][ T5725] bridge_slave_1: entered allmulticast mode [ 40.458481][ T5725] bridge_slave_1: entered promiscuous mode [ 40.481548][ T5726] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.481631][ T5726] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.481735][ T5726] bridge_slave_0: entered allmulticast mode [ 40.483044][ T5726] bridge_slave_0: entered promiscuous mode [ 40.518663][ T5726] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.518746][ T5726] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.519041][ T5726] bridge_slave_1: entered allmulticast mode [ 40.520665][ T5726] bridge_slave_1: entered promiscuous mode [ 40.523468][ T5736] team0: Port device team_slave_0 added [ 40.525983][ T5725] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 40.526976][ T5736] team0: Port device team_slave_1 added [ 40.529021][ T5731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 40.552873][ T5725] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.554154][ T5731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.601027][ T5736] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.601043][ T5736] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.601064][ T5736] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.604203][ T5736] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.604216][ T5736] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.604235][ T5736] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.607042][ T5726] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 40.618628][ T5731] team0: Port device team_slave_0 added [ 40.629533][ T5726] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.631456][ T5725] team0: Port device team_slave_0 added [ 40.643916][ T5731] team0: Port device team_slave_1 added [ 40.666073][ T5725] team0: Port device team_slave_1 added [ 40.705002][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.705013][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.705027][ T5731] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.716483][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.716496][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.716512][ T5731] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.718871][ T5726] team0: Port device team_slave_0 added [ 40.728121][ T5736] hsr_slave_0: entered promiscuous mode [ 40.729025][ T5736] hsr_slave_1: entered promiscuous mode [ 40.745673][ T5726] team0: Port device team_slave_1 added [ 40.746497][ T5725] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.746510][ T5725] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.746531][ T5725] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.775254][ T5726] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.775265][ T5726] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.775278][ T5726] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.775961][ T5725] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.775975][ T5725] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.775995][ T5725] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.800048][ T5726] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.800062][ T5726] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 40.800082][ T5726] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.806387][ T5731] hsr_slave_0: entered promiscuous mode [ 40.807206][ T5731] hsr_slave_1: entered promiscuous mode [ 40.807757][ T5731] debugfs: 'hsr0' already exists in 'hsr' [ 40.807840][ T5731] Cannot create hsr debugfs directory [ 40.897062][ T5725] hsr_slave_0: entered promiscuous mode [ 40.897575][ T5725] hsr_slave_1: entered promiscuous mode [ 40.897910][ T5725] debugfs: 'hsr0' already exists in 'hsr' [ 40.897922][ T5725] Cannot create hsr debugfs directory [ 40.980886][ T5726] hsr_slave_0: entered promiscuous mode [ 40.981716][ T5726] hsr_slave_1: entered promiscuous mode [ 40.982300][ T5726] debugfs: 'hsr0' already exists in 'hsr' [ 40.982318][ T5726] Cannot create hsr debugfs directory [ 41.263184][ T5736] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 41.271765][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 41.282863][ T5736] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 41.285754][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 41.286858][ T5736] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 41.291068][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 41.291901][ T5736] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 41.298742][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 41.376494][ T5731] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 41.380474][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 41.381460][ T5731] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 41.385680][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 41.393779][ T5731] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 41.399251][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 41.399793][ T5731] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 41.404263][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 41.473608][ T5725] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 41.475761][ T5725] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 41.476287][ T5725] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 41.478446][ T5725] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 41.483647][ T5725] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 41.486958][ T5725] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 41.487561][ T5725] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 41.490909][ T5725] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 41.515331][ T5736] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.553917][ T5726] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 41.557753][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 41.558412][ T5726] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 41.561630][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 41.568931][ T5736] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.570292][ T5726] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 41.575653][ T5741] Bluetooth: hci0: command tx timeout [ 41.575836][ T5741] Bluetooth: hci2: command tx timeout [ 41.575913][ T5741] Bluetooth: hci1: command tx timeout [ 41.576625][ T5732] Bluetooth: hci3: command tx timeout [ 41.577703][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 41.578455][ T5726] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 41.583342][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 41.595663][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.595785][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.622159][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.622205][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.647502][ T5731] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.693052][ T5731] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.707128][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.707213][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.716689][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.716813][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.759893][ T5725] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.789323][ T5726] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.793131][ T5725] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.802115][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.802161][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.807189][ T5726] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.817031][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.817093][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.818119][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.818197][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.827638][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.827689][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.073296][ T5736] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.122841][ T5736] veth0_vlan: entered promiscuous mode [ 42.125863][ T5731] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.138663][ T5736] veth1_vlan: entered promiscuous mode [ 42.166430][ T5731] veth0_vlan: entered promiscuous mode [ 42.179346][ T5731] veth1_vlan: entered promiscuous mode [ 42.186733][ T5726] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.187869][ T5736] veth0_macvtap: entered promiscuous mode [ 42.196403][ T5736] veth1_macvtap: entered promiscuous mode [ 42.218783][ T5731] veth0_macvtap: entered promiscuous mode [ 42.221937][ T5736] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 42.243877][ T5731] veth1_macvtap: entered promiscuous mode [ 42.260995][ T5736] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 42.268014][ T5725] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.270607][ T5726] veth0_vlan: entered promiscuous mode [ 42.280964][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 42.287184][ T5726] veth1_vlan: entered promiscuous mode [ 42.289283][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 42.358086][ T5726] veth0_macvtap: entered promiscuous mode [ 42.359916][ T1168] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.359928][ T1168] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.380731][ T5726] veth1_macvtap: entered promiscuous mode [ 42.383285][ T5725] veth0_vlan: entered promiscuous mode [ 42.389173][ T75] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.389184][ T75] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.395420][ T5725] veth1_vlan: entered promiscuous mode [ 42.406708][ T5832] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.422942][ T75] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.422958][ T75] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.431438][ T5726] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 42.442337][ T5736] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 42.443448][ T5726] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 42.445263][ T5804] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.458427][ T5725] veth0_macvtap: entered promiscuous mode [ 42.482385][ T75] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.482407][ T75] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.484339][ T5725] veth1_macvtap: entered promiscuous mode [ 42.559603][ T5725] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 42.575591][ T5725] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 42.576922][ T75] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.576941][ T75] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.605148][ T5804] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.613250][ T1168] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.613264][ T1168] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.676262][ T1163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.676284][ T1163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.716001][ T5832] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.716587][ T5832] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.716998][ T5832] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.717240][ T5832] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.724161][ T1168] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.724180][ T1168] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.746347][ T5832] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.746601][ T5832] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.746757][ T5832] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.746879][ T5832] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.746902][ T5832] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.746926][ T5832] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.746952][ T5832] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.746978][ T5832] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.747003][ T5832] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.828929][ T5892] ALSA: seq fatal error: cannot create timer (-19) [ 42.848880][ T5892] syz.1.2 uses obsolete (PF_INET,SOCK_PACKET) [ 42.947735][ T5905] netlink: 'syz.2.10': attribute type 1 has an invalid length. [ 43.379461][ T5921] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5921 comm=syz.2.14 [ 43.380961][ T5921] CIFS mount error: No usable UNC path provided in device string! [ 43.380961][ T5921] [ 43.381072][ T5921] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 43.461120][ T5925] netlink: 60 bytes leftover after parsing attributes in process `syz.2.16'. [ 43.481606][ T5925] null_blk: disk rnullb0 created [ 43.655268][ T5732] Bluetooth: hci1: command tx timeout [ 43.655301][ T5732] Bluetooth: hci2: command tx timeout [ 43.655319][ T5732] Bluetooth: hci0: command tx timeout [ 43.655338][ T5732] Bluetooth: hci3: command tx timeout [ 43.925910][ T5949] nft_compat: unsupported protocol 1 [ 44.073720][ T5968] netlink: 52 bytes leftover after parsing attributes in process `syz.2.28'. [ 44.103739][ T5963] Zero length message leads to an empty skb [ 44.150658][ T5973] Invalid source name [ 44.150678][ T5973] UBIFS error (pid: 5973): cannot open "/dev/loop1", error -22 [ 44.238274][ T44] kauditd_printk_skb: 110 callbacks suppressed [ 44.238290][ T44] audit: type=1400 audit(1791047532.216:281): avc: denied { setopt } for pid=5977 comm="syz.1.31" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 44.248270][ T5981] FAULT_INJECTION: forcing a failure. [ 44.248270][ T5981] name failslab, interval 1, probability 0, space 0, times 1 [ 44.248302][ T5981] CPU: 2 UID: 0 PID: 5981 Comm: syz.3.32 Not tainted syzkaller #0 PREEMPT(full) [ 44.248324][ T5981] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 44.248335][ T5981] Call Trace: [ 44.248342][ T5981] [ 44.248350][ T5981] dump_stack_lvl+0x100/0x190 [ 44.248377][ T5981] should_fail_ex.cold+0x5/0xa [ 44.248404][ T5981] should_failslab+0xc2/0x120 [ 44.248428][ T5981] __kmalloc_cache_noprof+0x91/0x6d0 [ 44.248450][ T5981] ? io_uring_setup.cold+0x6c/0x1cde [ 44.248475][ T5981] io_uring_setup.cold+0x6c/0x1cde [ 44.248494][ T5981] ? lock_acquire+0x1d1/0x380 [ 44.248513][ T5981] ? avc_has_perm_noaudit+0x56/0x470 [ 44.248540][ T5981] ? __pfx_io_uring_setup+0x10/0x10 [ 44.248558][ T5981] ? find_held_lock+0x2b/0x80 [ 44.248579][ T5981] ? avc_has_perm_noaudit+0x11e/0x470 [ 44.248604][ T5981] ? avc_has_perm_noaudit+0x11e/0x470 [ 44.248645][ T5981] ? xfd_validate_state+0x129/0x190 [ 44.248671][ T5981] __x64_sys_io_uring_setup+0xc2/0x170 [ 44.248697][ T5981] do_syscall_64+0x123/0x790 [ 44.248717][ T5981] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.248738][ T5981] RIP: 0033:0x7f0f6b99e159 [ 44.248754][ T5981] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 44.248771][ T5981] RSP: 002b:00007f0f6c8fbfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 44.248793][ T5981] RAX: ffffffffffffffda RBX: 0000200000000200 RCX: 00007f0f6b99e159 [ 44.248806][ T5981] RDX: 00002000000002c0 RSI: 0000200000000200 RDI: 0000000000000020 [ 44.248819][ T5981] RBP: 00007f0f6ba3506b R08: 0000000000000000 R09: 0000000000000000 [ 44.248829][ T5981] R10: 0000200000000040 R11: 0000000000000206 R12: 00002000000002c0 [ 44.248839][ T5981] R13: 0000200000000040 R14: 0000200000000000 R15: 00007ffdf177bab8 [ 44.248863][ T5981] [ 44.279364][ T44] audit: type=1400 audit(1791047532.256:282): avc: denied { open } for pid=5984 comm="syz.2.33" path="/dev/ptyq8" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 44.281005][ T44] audit: type=1400 audit(1791047532.256:283): avc: denied { ioctl } for pid=5984 comm="syz.2.33" path="/dev/ptyq8" dev="devtmpfs" ino=135 ioctlcmd=0x5412 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 44.281546][ T5985] netlink: 64138 bytes leftover after parsing attributes in process `syz.2.33'. [ 44.306636][ T5987] syz_tun: entered allmulticast mode [ 44.307138][ T5987] netlink: 20 bytes leftover after parsing attributes in process `syz.3.34'. [ 44.342371][ T44] audit: type=1400 audit(1791047532.316:284): avc: denied { mmap_zero } for pid=5990 comm="syz.3.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 44.348476][ T5991] netlink: 20 bytes leftover after parsing attributes in process `syz.3.36'. [ 44.348630][ T5991] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 44.357015][ T44] audit: type=1400 audit(1791047532.336:285): avc: denied { write } for pid=5992 comm="syz.1.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 44.393175][ T5991] FAULT_INJECTION: forcing a failure. [ 44.393175][ T5991] name failslab, interval 1, probability 0, space 0, times 0 [ 44.393196][ T5991] CPU: 2 UID: 0 PID: 5991 Comm: syz.3.36 Not tainted syzkaller #0 PREEMPT(full) [ 44.393228][ T5991] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 44.393236][ T5991] Call Trace: [ 44.393240][ T5991] [ 44.393246][ T5991] dump_stack_lvl+0x100/0x190 [ 44.393267][ T5991] should_fail_ex.cold+0x5/0xa [ 44.393285][ T5991] should_failslab+0xc2/0x120 [ 44.393303][ T5991] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 44.393321][ T5991] ? ima_queue_key+0x76/0x4e0 [ 44.393339][ T5991] kmemdup_noprof+0x29/0x60 [ 44.393353][ T5991] ima_queue_key+0x76/0x4e0 [ 44.393369][ T5991] ima_post_key_create_or_update+0xa4/0x130 [ 44.393385][ T5991] security_key_post_create_or_update+0x1ed/0x200 [ 44.393402][ T5991] __key_create_or_update+0x799/0xe30 [ 44.393444][ T5991] ? __pfx___key_create_or_update+0x10/0x10 [ 44.393466][ T5991] ? lookup_user_key+0x3f3/0x1300 [ 44.393487][ T5991] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 44.393505][ T5991] key_create_or_update+0x42/0x60 [ 44.393524][ T5991] __do_sys_add_key+0x2e8/0x460 [ 44.393537][ T5991] ? __pfx___do_sys_add_key+0x10/0x10 [ 44.393561][ T5991] do_syscall_64+0x123/0x790 [ 44.393583][ T5991] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.393600][ T5991] RIP: 0033:0x7f0f6b99e159 [ 44.393618][ T5991] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 44.393635][ T5991] RSP: 002b:00007f0f6c8fc028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 44.393657][ T5991] RAX: ffffffffffffffda RBX: 00007f0f6bc25fa0 RCX: 00007f0f6b99e159 [ 44.393669][ T5991] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 44.393682][ T5991] RBP: 00007f0f6ba3506b R08: ffffffffffffffff R09: 0000000000000000 [ 44.393695][ T5991] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 44.393708][ T5991] R13: 00007f0f6bc26038 R14: 00007f0f6bc25fa0 R15: 00007ffdf177bab8 [ 44.393735][ T5991] [ 44.395070][ T44] audit: type=1804 audit(1791047532.376:286): pid=5991 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=measuring_key cause=ENOMEM comm="syz.3.36" name="_tid" res=0 errno=-12 [ 44.396867][ T5991] openvswitch: netlink: Flow actions attr not present in new flow. [ 44.417871][ T44] audit: type=1400 audit(1791047532.396:287): avc: denied { append } for pid=5992 comm="syz.1.37" name="uprobe_events" dev="tracefs" ino=2078 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 44.472604][ T44] audit: type=1400 audit(1791047532.446:288): avc: denied { read write } for pid=5992 comm="syz.1.37" name="video36" dev="devtmpfs" ino=1064 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 44.472654][ T44] audit: type=1400 audit(1791047532.446:289): avc: denied { open } for pid=5992 comm="syz.1.37" path="/dev/video36" dev="devtmpfs" ino=1064 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 44.472913][ T44] audit: type=1400 audit(1791047532.446:290): avc: denied { ioctl } for pid=5992 comm="syz.1.37" path="/dev/video36" dev="devtmpfs" ino=1064 ioctlcmd=0x5608 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 44.484362][ T6007] openvswitch: netlink: Tunnel attr 9995 out of range max 16 [ 44.559953][ T6013] xt_CT: You must specify a L4 protocol and not use inversions on it [ 44.594492][ T5929] hid-generic 0001:0004:0004.0002: unknown main item tag 0x0 [ 44.594527][ T5929] hid-generic 0001:0004:0004.0002: unknown main item tag 0x0 [ 44.594547][ T5929] hid-generic 0001:0004:0004.0002: unknown main item tag 0x0 [ 44.594565][ T5929] hid-generic 0001:0004:0004.0002: unknown main item tag 0x0 [ 44.595471][ T5929] hid-generic 0001:0004:0004.0002: unknown main item tag 0x0 [ 44.595495][ T5929] hid-generic 0001:0004:0004.0002: unknown main item tag 0x0 [ 44.595516][ T5929] hid-generic 0001:0004:0004.0002: unknown main item tag 0x0 [ 44.595535][ T5929] hid-generic 0001:0004:0004.0002: unknown main item tag 0x0 [ 44.595554][ T5929] hid-generic 0001:0004:0004.0002: unknown main item tag 0x0 [ 44.595572][ T5929] hid-generic 0001:0004:0004.0002: unknown main item tag 0x0 [ 44.616519][ T5929] hid-generic 0001:0004:0004.0002: hidraw1: HID v0.01 Device [syz0] on syz1 [ 44.634918][ T35] usb 7-1: new full-speed USB device number 2 using dummy_hcd [ 44.672950][ T6031] input: syz0 as /devices/virtual/input/input5 [ 44.808896][ T35] usb 7-1: not running at top speed; connect to a high speed hub [ 44.809444][ T35] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 44.810689][ T35] usb 7-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 44.810725][ T35] usb 7-1: config 1 interface 0 altsetting 19 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 44.810748][ T35] usb 7-1: config 1 interface 0 has no altsetting 0 [ 44.816647][ T35] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.816666][ T35] usb 7-1: Product: syz [ 44.816676][ T35] usb 7-1: Manufacturer: syz [ 44.816690][ T35] usb 7-1: SerialNumber: syz [ 45.008891][ T6041] netlink: 50 bytes leftover after parsing attributes in process `syz.3.49'. [ 45.012548][ T6041] FAULT_INJECTION: forcing a failure. [ 45.012548][ T6041] name failslab, interval 1, probability 0, space 0, times 0 [ 45.012608][ T6041] CPU: 0 UID: 0 PID: 6041 Comm: syz.3.49 Not tainted syzkaller #0 PREEMPT(full) [ 45.012628][ T6041] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 45.012639][ T6041] Call Trace: [ 45.012645][ T6041] [ 45.012653][ T6041] dump_stack_lvl+0x100/0x190 [ 45.012702][ T6041] should_fail_ex.cold+0x5/0xa [ 45.012726][ T6041] should_failslab+0xc2/0x120 [ 45.012753][ T6041] __kmalloc_cache_noprof+0x91/0x6d0 [ 45.012773][ T6041] ? create_filter_start.constprop.0+0x1c4/0x310 [ 45.012803][ T6041] create_filter_start.constprop.0+0x1c4/0x310 [ 45.012828][ T6041] apply_subsystem_event_filter+0x188/0x17a0 [ 45.012850][ T6041] ? __might_fault+0xc5/0x140 [ 45.012870][ T6041] ? __might_fault+0xc5/0x140 [ 45.012890][ T6041] ? __pfx_apply_subsystem_event_filter+0x10/0x10 [ 45.012919][ T6041] ? _copy_from_user+0x59/0xd0 [ 45.012944][ T6041] subsystem_filter_write+0x95/0x120 [ 45.012968][ T6041] vfs_write+0x2aa/0x1050 [ 45.012990][ T6041] ? __pfx_subsystem_filter_write+0x10/0x10 [ 45.013013][ T6041] ? lock_acquire+0x1d1/0x380 [ 45.013034][ T6041] ? __fget_files+0x34/0x3d0 [ 45.013057][ T6041] ? __pfx_vfs_write+0x10/0x10 [ 45.013075][ T6041] ? find_held_lock+0x2b/0x80 [ 45.013103][ T6041] ? __fget_files+0x215/0x3d0 [ 45.013132][ T6041] ? __fget_files+0x21f/0x3d0 [ 45.013164][ T6041] ksys_write+0x12a/0x250 [ 45.013183][ T6041] ? __pfx_ksys_write+0x10/0x10 [ 45.013212][ T6041] do_syscall_64+0x123/0x790 [ 45.013235][ T6041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 45.013255][ T6041] RIP: 0033:0x7f0f6b99e159 [ 45.013271][ T6041] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 45.013285][ T6041] RSP: 002b:00007f0f6c8fc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 45.013304][ T6041] RAX: ffffffffffffffda RBX: 00007f0f6bc25fa0 RCX: 00007f0f6b99e159 [ 45.013318][ T6041] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 45.013330][ T6041] RBP: 00007f0f6ba3506b R08: 0000000000000000 R09: 0000000000000000 [ 45.013342][ T6041] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 45.013353][ T6041] R13: 00007f0f6bc26038 R14: 00007f0f6bc25fa0 R15: 00007ffdf177bab8 [ 45.013381][ T6041] [ 45.106444][ T6043] ip_tables: iptables: counters copy to user failed while replacing table [ 45.119041][ T6043] netlink: 36 bytes leftover after parsing attributes in process `syz.1.50'. [ 45.293127][ T6058] JFS: discard option not supported on device [ 45.293752][ T6058] Mount JFS Failure: -5 [ 45.293761][ T6058] jfs_mount failed w/return code = -5 [ 45.643442][ T6071] netlink: 28 bytes leftover after parsing attributes in process `syz.3.58'. [ 45.735120][ T5741] Bluetooth: hci3: command tx timeout [ 45.735143][ T5741] Bluetooth: hci0: command tx timeout [ 45.735155][ T5741] Bluetooth: hci2: command tx timeout [ 45.823045][ T6077] warning: `syz.3.60' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 46.109337][ T6096] ip_tables: iptables: counters copy to user failed while replacing table [ 46.229617][ T6099] fuse: Bad value for 'fd' [ 46.558740][ T6114] bonding: b is being created... [ 46.594006][ T6114] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 46.602136][ T6117] loop1: detected capacity change from 0 to 7 [ 46.610233][ T6117] Dev loop1: unable to read RDB block 7 [ 46.610273][ T6117] loop1: unable to read partition table [ 46.610396][ T6117] loop1: partition table beyond EOD, truncated [ 46.610406][ T6117] loop_reread_partitions: partition scan of loop1 (þ被xü—ŸÑà– ) failed (rc=-5) [ 47.343148][ T35] cdc_ether 7-1:1.0: skipping garbage [ 47.343166][ T35] usb 7-1: No union descriptors [ 47.351837][ T35] usb 7-1: USB disconnect, device number 2 [ 47.415312][ T5732] Bluetooth: hci1: command tx timeout [ 47.467908][ T6140] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 47.595001][ T6149] No control pipe specified [ 47.666427][ T6156] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 47.755890][ T6161] bond1: Removing last ns target with arp_interval on [ 47.798700][ T6167] netlink: 'syz.0.87': attribute type 1 has an invalid length. [ 47.798728][ T6167] netlink: 'syz.0.87': attribute type 4 has an invalid length. [ 47.798736][ T6167] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.87'. [ 47.799177][ T6167] netlink: 'syz.0.87': attribute type 1 has an invalid length. [ 47.799185][ T6167] netlink: 'syz.0.87': attribute type 4 has an invalid length. [ 47.799191][ T6167] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.87'. [ 47.819644][ T5733] Bluetooth: hci3: command tx timeout [ 47.819682][ T5741] Bluetooth: hci0: command tx timeout [ 47.819702][ T5732] Bluetooth: hci2: command tx timeout [ 47.844154][ T6167] team0 (unregistering): Port device team_slave_0 removed [ 47.852056][ T6167] team0 (unregistering): Port device team_slave_1 removed [ 48.031239][ T6175] netlink: 'syz.0.90': attribute type 39 has an invalid length. [ 48.288327][ T6193] netlink: 'syz.0.93': attribute type 1 has an invalid length. [ 48.292364][ T6193] synth uevent: /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00: unknown uevent action string [ 48.292413][ T6193] acpi device:00: uevent: failed to send synthetic uevent: -22 [ 48.298617][ T6193] tipc: Started in network mode [ 48.298642][ T6193] tipc: Node identity ac14142f, cluster identity 4711 [ 48.300079][ T6193] tipc: Enabled bearer , priority 10 [ 48.300585][ T6193] tipc: Can't add remote ip to TIPC UDP multicast bearer [ 48.407575][ T6200] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6200 comm=syz.0.93 [ 48.438451][ T6206] block nbd3: Device being setup by another task [ 48.438467][ T6205] block nbd3: server does not support multiple connections per device. [ 48.438525][ T6205] block nbd3: server does not support multiple connections per device. [ 48.438563][ T6205] block nbd3: server does not support multiple connections per device. [ 48.438611][ T6205] block nbd3: server does not support multiple connections per device. [ 48.438647][ T6205] block nbd3: server does not support multiple connections per device. [ 48.438692][ T6205] block nbd3: server does not support multiple connections per device. [ 48.438731][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439147][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439184][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439220][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439257][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439314][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439351][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439387][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439423][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439470][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439509][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439545][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439582][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439632][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439671][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439708][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439744][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439790][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439827][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439863][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439899][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439946][ T6205] block nbd3: server does not support multiple connections per device. [ 48.439986][ T6205] block nbd3: server does not support multiple connections per device. [ 48.537337][ T6210] xt_cgroup: invalid path, errno=-2 [ 48.561245][ T6208] mmap: syz.2.96 (6208) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 48.717467][ T6225] ip_tables: iptables: counters copy to user failed while replacing table [ 48.758703][ T6223] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3454903815 (6909807630 ns) > initial count (5889073678 ns). Using initial count to start timer. [ 48.768340][ T6223] kvm [6222]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 48.769129][ T6223] kvm [6222]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 48.811236][ T6228] capability: warning: `syz.1.102' uses deprecated v2 capabilities in a way that may be insecure [ 48.815424][ T6228] program syz.1.102 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 48.828077][ T6229] TCP: TCP_TX_DELAY enabled [ 49.054905][ T852] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 49.076559][ T6237] bridge1: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 49.215801][ T852] usb 6-1: New USB device found, idVendor=28de, idProduct=1205, bcdDevice= 0.00 [ 49.218248][ T852] usb 6-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 49.218277][ T852] usb 6-1: config 0 interface 0 has no altsetting 0 [ 49.218302][ T852] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.221255][ T852] usb 6-1: config 0 descriptor?? [ 49.223932][ T6228] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 49.257076][ T6241] __nla_validate_parse: 1 callbacks suppressed [ 49.257098][ T6241] netlink: 32 bytes leftover after parsing attributes in process `syz.2.108'. [ 49.264605][ T6201] block nbd3: shutting down sockets [ 49.326531][ T6251] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 49.415843][ T2546] tipc: Node number set to 2886997039 [ 49.433430][ T852] usbhid 6-1:0.0: can't add hid device: -71 [ 49.433515][ T852] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 49.441827][ T852] usb 6-1: USB disconnect, device number 2 [ 49.487825][ T6260] bridge_slave_1: left allmulticast mode [ 49.487845][ T6260] bridge_slave_1: left promiscuous mode [ 49.488543][ T6260] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.492908][ T6260] bridge_slave_0: left allmulticast mode [ 49.492933][ T6260] bridge_slave_0: left promiscuous mode [ 49.493804][ T6260] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.655246][ T56] wlan1: Trigger new scan to find an IBSS to join [ 49.710986][ T44] kauditd_printk_skb: 28274 callbacks suppressed [ 49.711000][ T44] audit: type=1400 audit(1791047537.686:28565): avc: denied { mount } for pid=6267 comm="syz.2.117" name="/" dev="rpc_pipefs" ino=13723 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 49.718772][ T44] audit: type=1400 audit(1791047537.696:28566): avc: denied { create } for pid=6269 comm="syz.3.118" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 49.719023][ T44] audit: type=1400 audit(1791047537.696:28567): avc: denied { write } for pid=6269 comm="syz.3.118" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 49.773214][ T44] audit: type=1400 audit(1791047537.746:28568): avc: denied { unmount } for pid=5736 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 49.846616][ T44] audit: type=1400 audit(1791047537.826:28569): avc: denied { map_create } for pid=6281 comm="syz.3.120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 49.847068][ T44] audit: type=1400 audit(1791047537.826:28570): avc: denied { map_read map_write } for pid=6281 comm="syz.3.120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 49.848592][ T44] audit: type=1400 audit(1791047537.826:28571): avc: denied { prog_load } for pid=6281 comm="syz.3.120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 49.992283][ T44] audit: type=1400 audit(1791047537.966:28572): avc: denied { create } for pid=6291 comm="syz.3.124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 50.090919][ T44] audit: type=1400 audit(1791047538.066:28573): avc: denied { write } for pid=6296 comm="syz.0.125" name="sda" dev="devtmpfs" ino=723 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 50.091472][ T6297] sd 0:0:0:0: PR command failed: 1026 [ 50.091496][ T6297] sd 0:0:0:0: Sense Key : Illegal Request [current] [ 50.091515][ T6297] sd 0:0:0:0: Add. Sense: Invalid command operation code [ 50.091807][ T6297] netlink: 28 bytes leftover after parsing attributes in process `syz.0.125'. [ 50.093649][ T6303] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.101159][ T6303] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.235534][ T6315] netlink: 20 bytes leftover after parsing attributes in process `syz.0.128'. [ 50.235785][ T6315] netlink: 20 bytes leftover after parsing attributes in process `syz.0.128'. [ 50.304686][ T44] audit: type=1400 audit(1791047538.276:28574): avc: denied { prog_run } for pid=6320 comm="syz.1.129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 50.324878][ T71] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 50.332735][ T6324] ipvlan2: entered allmulticast mode [ 50.332751][ T6324] virt_wifi0: entered allmulticast mode [ 50.342452][ T6324] batman_adv: batadv0: Adding interface: ipvlan2 [ 50.342465][ T6324] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 50.342482][ T6324] batman_adv: batadv0: Interface activated: ipvlan2 [ 50.484222][ T6279] syz.2.119 (6279): drop_caches: 2 [ 50.547638][ T6327] mac80211_hwsim hwsim8 wlan0: entered allmulticast mode [ 50.647554][ T6336] netlink: 'syz.2.134': attribute type 46 has an invalid length. [ 50.647567][ T6336] netlink: 8 bytes leftover after parsing attributes in process `syz.2.134'. [ 50.754351][ T5732] Bluetooth: hci3: ACL packet for unknown connection handle 815 [ 50.868334][ T6351] X.509: signatureAlgorithm (12) differs from tbsCertificate.signature (13) [ 50.932150][ T5804] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.013637][ T5804] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.069061][ T5804] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.107936][ T5741] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 51.113916][ T5741] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 51.118719][ T5741] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 51.119700][ T5741] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 51.120548][ T5741] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 51.148914][ T5804] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.261651][ T5804] bridge_slave_1: left allmulticast mode [ 51.262531][ T5804] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.273341][ T5804] bridge_slave_0: left allmulticast mode [ 51.273357][ T5804] bridge_slave_0: left promiscuous mode [ 51.273532][ T5804] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.297125][ T6372] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 51.297143][ T6372] overlayfs: conflicting options: userxattr,metacopy=on [ 51.312162][ T6372] netlink: 12 bytes leftover after parsing attributes in process `syz.1.143'. [ 51.389152][ T5804] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 51.392143][ T5804] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 51.393962][ T5804] bond0 (unregistering): Released all slaves [ 51.403750][ T5804] bond1 (unregistering): Released all slaves [ 51.428283][ T5442] 8021q: adding VLAN 0 to HW filter on device eth2 [ 51.491349][ T5804] tipc: Disabling bearer [ 51.501107][ T5804] tipc: Left network mode [ 51.667715][ T5442] 8021q: adding VLAN 0 to HW filter on device eth3 [ 51.758801][ T5804] hsr_slave_0: left promiscuous mode [ 51.759492][ T5804] hsr_slave_1: left promiscuous mode [ 51.760120][ T5804] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 51.760145][ T5804] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 51.761344][ T5804] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 51.761358][ T5804] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 51.763645][ T5804] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 51.763660][ T5804] batman_adv: batadv0: Removing interface: ipvlan2 [ 51.788292][ T5804] veth1_macvtap: left promiscuous mode [ 51.788321][ T5804] veth0_macvtap: left promiscuous mode [ 51.788369][ T5804] veth1_vlan: left promiscuous mode [ 51.788737][ T5804] veth0_vlan: left promiscuous mode [ 52.078892][ T5442] 8021q: adding VLAN 0 to HW filter on device eth4 [ 52.124152][ T6359] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.124251][ T6359] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.124322][ T6359] bridge_slave_0: entered allmulticast mode [ 52.126967][ T6359] bridge_slave_0: entered promiscuous mode [ 52.128531][ T6359] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.128619][ T6359] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.128696][ T6359] bridge_slave_1: entered allmulticast mode [ 52.130707][ T6359] bridge_slave_1: entered promiscuous mode [ 52.149796][ T6359] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 52.159272][ T6359] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 52.175501][ T6359] team0: Port device team_slave_0 added [ 52.176963][ T6359] team0: Port device team_slave_1 added [ 52.189685][ T6359] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 52.189696][ T6359] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 52.189709][ T6359] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 52.191523][ T6359] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 52.191534][ T6359] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 52.191548][ T6359] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 52.215975][ T6359] hsr_slave_0: entered promiscuous mode [ 52.216509][ T6359] hsr_slave_1: entered promiscuous mode [ 52.216850][ T6359] debugfs: 'hsr0' already exists in 'hsr' [ 52.216865][ T6359] Cannot create hsr debugfs directory [ 52.299742][ T6409] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 52.347974][ T6413] netlink: 8 bytes leftover after parsing attributes in process `syz.1.147'. [ 52.347990][ T6413] netlink: 8 bytes leftover after parsing attributes in process `syz.1.147'. [ 52.462972][ T6359] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 52.466576][ T6359] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 52.467090][ T6359] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 52.482200][ T6359] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 52.483419][ T5442] 8021q: adding VLAN 0 to HW filter on device eth5 [ 52.483709][ T6359] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 52.493712][ T6359] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 52.496639][ T6359] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 52.513853][ T6359] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 52.554342][ T6430] netlink: 28 bytes leftover after parsing attributes in process `syz.1.148'. [ 52.554359][ T6430] netlink: 32 bytes leftover after parsing attributes in process `syz.1.148'. [ 52.595857][ T6359] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.615840][ T6359] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.624656][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.624817][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.636806][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.636852][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.695712][ T37] wlan1: Trigger new scan to find an IBSS to join [ 52.824467][ T6457] i2c i2c-0: new_device: Missing parameters [ 52.966189][ T6359] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 53.175400][ T5732] Bluetooth: hci0: command tx timeout [ 53.190695][ T6359] veth0_vlan: entered promiscuous mode [ 53.194087][ T6359] veth1_vlan: entered promiscuous mode [ 53.213063][ T6359] veth0_macvtap: entered promiscuous mode [ 53.220450][ T6359] veth1_macvtap: entered promiscuous mode [ 53.248625][ T6359] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 53.253808][ T6359] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 53.276692][ T5832] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.276732][ T5832] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.276760][ T5832] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.276789][ T5832] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.316120][ T1168] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 53.316134][ T1168] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 53.342610][ T1168] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 53.342623][ T1168] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 53.586430][ T75] wlan1: Creating new IBSS network, BSSID 02:2d:83:2e:ee:10 [ 53.633902][ T6503] sch_fq: defrate 4294967295 ignored. [ 53.634019][ T6504] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=6504 comm=syz.4.159 [ 53.713305][ T6509] xt_IDLETIMER: label is empty or not nul-terminated [ 53.969542][ T6526] Could not find key with description: [syz] [ 53.969554][ T6526] process_request_key_err: No key [ 53.969558][ T6526] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 53.969564][ T6526] One or more global auth toks could not properly register; rc = [-2] [ 53.969579][ T6526] Error validating options; rc = [-2] [ 54.126982][ T5732] Bluetooth: Unexpected continuation frame (len 18) [ 54.141694][ T6551] team0: Port device team_slave_0 removed [ 54.295493][ T5929] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 54.398057][ T6571] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 54.398074][ T6571] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 54.399231][ T6571] vhci_hcd vhci_hcd.0: Device attached [ 54.455511][ T5929] usb 9-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 54.455541][ T5929] usb 9-1: too many configurations: 102, using maximum allowed: 8 [ 54.456487][ T5929] usb 9-1: config 1 has an invalid interface number: 3 but max is 0 [ 54.456506][ T5929] usb 9-1: config 1 has no interface number 0 [ 54.457277][ T5929] usb 9-1: config 1 has an invalid interface number: 3 but max is 0 [ 54.457289][ T5929] usb 9-1: config 1 has no interface number 0 [ 54.458040][ T5929] usb 9-1: config 1 has an invalid interface number: 3 but max is 0 [ 54.458052][ T5929] usb 9-1: config 1 has no interface number 0 [ 54.458783][ T5929] usb 9-1: config 1 has an invalid interface number: 3 but max is 0 [ 54.458794][ T5929] usb 9-1: config 1 has no interface number 0 [ 54.459531][ T5929] usb 9-1: config 1 has an invalid interface number: 3 but max is 0 [ 54.459543][ T5929] usb 9-1: config 1 has no interface number 0 [ 54.460277][ T5929] usb 9-1: config 1 has an invalid interface number: 3 but max is 0 [ 54.460288][ T5929] usb 9-1: config 1 has no interface number 0 [ 54.462096][ T5929] usb 9-1: config 1 has an invalid interface number: 3 but max is 0 [ 54.462108][ T5929] usb 9-1: config 1 has no interface number 0 [ 54.462822][ T5929] usb 9-1: config 1 has an invalid interface number: 3 but max is 0 [ 54.462833][ T5929] usb 9-1: config 1 has no interface number 0 [ 54.464298][ T5929] usb 9-1: New USB device strings: Mfr=219, Product=128, SerialNumber=211 [ 54.464309][ T5929] usb 9-1: Product: syz [ 54.464317][ T5929] usb 9-1: Manufacturer: syz [ 54.464324][ T5929] usb 9-1: SerialNumber: syz [ 54.481869][ T5929] usb 9-1: 3:0 : does not exist [ 54.481891][ T5929] usb 9-1: 3:0 : does not exist [ 54.568916][ T6572] vhci_hcd: connection closed [ 54.570378][ T5804] vhci_hcd vhci_hcd.1: stop threads [ 54.571107][ T5804] vhci_hcd vhci_hcd.1: release socket [ 54.572521][ T5804] vhci_hcd vhci_hcd.1: disconnect device [ 54.587587][ T852] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 54.675630][ T10] usb 9-1: USB disconnect, device number 2 [ 54.697806][ T6582] FAULT_INJECTION: forcing a failure. [ 54.697806][ T6582] name failslab, interval 1, probability 0, space 0, times 0 [ 54.697827][ T6582] CPU: 2 UID: 0 PID: 6582 Comm: syz.3.174 Not tainted syzkaller #0 PREEMPT(full) [ 54.697839][ T6582] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 54.697846][ T6582] Call Trace: [ 54.697849][ T6582] [ 54.697854][ T6582] dump_stack_lvl+0x100/0x190 [ 54.697887][ T6582] should_fail_ex.cold+0x5/0xa [ 54.697904][ T6582] should_failslab+0xc2/0x120 [ 54.697924][ T6582] __kvmalloc_node_noprof+0x113/0x9b0 [ 54.697940][ T6582] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 54.697952][ T6582] ? percpu_ref_init+0xec/0x3f0 [ 54.697964][ T6582] ? io_alloc_cache_init+0x38/0x170 [ 54.697978][ T6582] io_alloc_cache_init+0x38/0x170 [ 54.697991][ T6582] io_uring_setup.cold+0x450/0x1cde [ 54.698003][ T6582] ? lock_acquire+0x1d1/0x380 [ 54.698015][ T6582] ? avc_has_perm_noaudit+0x56/0x470 [ 54.698034][ T6582] ? __pfx_io_uring_setup+0x10/0x10 [ 54.698048][ T6582] ? find_held_lock+0x2b/0x80 [ 54.698070][ T6582] ? avc_has_perm_noaudit+0x11e/0x470 [ 54.698088][ T6582] ? avc_has_perm_noaudit+0x11e/0x470 [ 54.698115][ T6582] ? xfd_validate_state+0x129/0x190 [ 54.698131][ T6582] __x64_sys_io_uring_setup+0xc2/0x170 [ 54.698148][ T6582] do_syscall_64+0x123/0x790 [ 54.698166][ T6582] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 54.698177][ T6582] RIP: 0033:0x7f0f6b99e159 [ 54.698186][ T6582] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 54.698197][ T6582] RSP: 002b:00007f0f6c8fbfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 54.698208][ T6582] RAX: ffffffffffffffda RBX: 0000200000000200 RCX: 00007f0f6b99e159 [ 54.698216][ T6582] RDX: 00002000000002c0 RSI: 0000200000000200 RDI: 0000000000000020 [ 54.698223][ T6582] RBP: 00007f0f6ba3506b R08: 0000000000000000 R09: 0000000000000000 [ 54.698230][ T6582] R10: 0000200000000040 R11: 0000000000000206 R12: 00002000000002c0 [ 54.698238][ T6582] R13: 0000200000000040 R14: 0000200000000000 R15: 00007ffdf177bab8 [ 54.698267][ T6582] [ 54.737941][ T6585] __nla_validate_parse: 5 callbacks suppressed [ 54.737953][ T6585] netlink: 8 bytes leftover after parsing attributes in process `syz.3.175'. [ 54.737960][ T6585] netlink: 12 bytes leftover after parsing attributes in process `syz.3.175'. [ 54.737971][ T6585] netlink: 'syz.3.175': attribute type 6 has an invalid length. [ 54.754854][ T5804] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 54.775184][ T5804] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 54.775381][ T5804] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 54.777015][ T5804] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 54.779914][ T44] kauditd_printk_skb: 102 callbacks suppressed [ 54.779926][ T44] audit: type=1400 audit(1791047542.756:28677): avc: denied { write } for pid=6584 comm="syz.3.175" name="sockstat6" dev="proc" ino=4026533333 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 54.834005][ T6590] syzkaller0: entered promiscuous mode [ 54.834018][ T6590] syzkaller0: entered allmulticast mode [ 54.840994][ T6590] tipc: Started in network mode [ 54.841010][ T6590] tipc: Node identity 12fed5fd0306, cluster identity 4711 [ 54.841086][ T6590] tipc: Enabled bearer , priority 0 [ 54.852303][ T6589] tipc: Resetting bearer [ 54.863818][ T6589] tipc: Disabling bearer [ 54.902154][ T44] audit: type=1400 audit(1791047542.876:28678): avc: denied { mount } for pid=6595 comm="syz.2.179" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 54.905006][ T6595] ima: policy update completed [ 54.905226][ T44] audit: type=1807 audit(1791047542.876:28679): action=measure uid>1 res=1 [ 54.905249][ T44] audit: type=1802 audit(1791047542.886:28680): pid=6595 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=policy_update cause=completed comm="syz.2.179" res=1 errno=0 [ 54.928914][ T44] audit: type=1400 audit(1791047542.906:28681): avc: denied { unmount } for pid=5736 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 54.967499][ T44] audit: type=1400 audit(1791047542.936:28682): avc: denied { append } for pid=6600 comm="syz.1.181" name="demux0" dev="devtmpfs" ino=949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 55.062961][ T6612] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3303861288 (422894244864 ns) > initial count (241705619456 ns). Using initial count to start timer. [ 55.097394][ T44] audit: type=1400 audit(1791047543.076:28683): avc: denied { listen } for pid=6615 comm="syz.2.186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 55.097701][ T44] audit: type=1400 audit(1791047543.076:28684): avc: denied { accept } for pid=6615 comm="syz.2.186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 55.102061][ T44] audit: type=1400 audit(1791047543.076:28685): avc: denied { read } for pid=6615 comm="syz.2.186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 55.131324][ T6621] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=6621 comm=syz.3.187 [ 55.132082][ T6621] ecryptfs: Unknown parameter 'ecryptfÌ3sig' [ 55.140429][ T6621] loop4: detected capacity change from 0 to 7 [ 55.151961][ T6621] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 55.151987][ T6621] loop4: partition table partially beyond EOD, truncated [ 55.154050][ T6621] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 55.184353][ T6621] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 55.184374][ T6621] loop4: partition table partially beyond EOD, truncated [ 55.184715][ T6621] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 55.210213][ T6258] udevd[6258]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 55.221774][ T6258] udevd[6258]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 55.266811][ T5732] Bluetooth: hci0: command tx timeout [ 55.269926][ T44] audit: type=1400 audit(1791047543.246:28686): avc: denied { read write } for pid=6622 comm="syz.1.188" name="fb0" dev="devtmpfs" ino=638 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 55.306309][ T6633] netlink: 67 bytes leftover after parsing attributes in process `syz.4.190'. [ 56.165109][ T6635] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 56.166495][ T6635] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 56.170885][ T6635] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 56.174089][ T6635] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 56.174332][ T6635] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 56.179916][ T6635] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 56.188436][ T6635] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 56.188506][ T6635] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 56.195588][ T6635] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 56.201705][ T6635] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 56.201818][ T6635] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 56.203844][ T6635] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 56.410456][ T6676] netlink: 8 bytes leftover after parsing attributes in process `syz.3.198'. [ 56.546986][ T6682] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1039 sclass=netlink_xfrm_socket pid=6682 comm=syz.4.201 [ 56.553567][ T6682] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=6682 comm=syz.4.201 [ 56.554007][ T6682] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=6682 comm=syz.4.201 [ 56.554194][ T6682] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=6682 comm=syz.4.201 [ 56.554225][ T6683] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=6683 comm=syz.4.201 [ 56.554606][ T6682] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=6682 comm=syz.4.201 [ 56.837742][ T5732] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 56.838249][ T6690] syz_tun: entered allmulticast mode [ 56.844907][ T6690] syzkaller1: entered promiscuous mode [ 56.845148][ T6690] syzkaller1: entered allmulticast mode [ 56.956696][ T6690] syz_tun: left allmulticast mode [ 57.054364][ T6699] netlink: 'syz.4.206': attribute type 10 has an invalid length. [ 57.054606][ T6698] netlink: 'syz.1.207': attribute type 83 has an invalid length. [ 57.064717][ T6699] team0: Port device dummy0 added [ 57.065589][ T6699] netlink: 'syz.4.206': attribute type 10 has an invalid length. [ 57.070644][ T6699] team0: Port device dummy0 removed [ 57.207250][ T6713] binder: 6710:6713 ioctl c0306201 200000000080 returned -14 [ 57.221294][ T6718] fuse: Bad value for 'rootmode' [ 57.234883][ T71] usb 7-1: new low-speed USB device number 3 using dummy_hcd [ 57.288649][ T6714] binder: BINDER_SET_CONTEXT_MGR already set [ 57.288663][ T6714] binder: 6710:6714 ioctl 4018620d 200000004a80 returned -16 [ 57.290381][ T6724] netlink: 'syz.4.212': attribute type 10 has an invalid length. [ 57.290406][ T6724] netlink: 55 bytes leftover after parsing attributes in process `syz.4.212'. [ 57.290422][ T6722] binder: 6710:6722 ioctl c0306201 200000000000 returned -14 [ 57.365283][ T71] usb 7-1: device descriptor read/64, error -71 [ 57.434898][ T6729] bond1: option xmit_hash_policy: invalid value (6) [ 57.437411][ T6729] bond1 (unregistering): Released all slaves [ 57.460674][ T6731] netlink: 8 bytes leftover after parsing attributes in process `syz.1.217'. [ 57.460695][ T6731] netlink: 12 bytes leftover after parsing attributes in process `syz.1.217'. [ 57.475157][ T35] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 57.495168][ T5732] Bluetooth: hci1: command 0x0c1a tx timeout [ 57.604829][ T71] usb 7-1: new low-speed USB device number 4 using dummy_hcd [ 57.655532][ T35] usb 8-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 57.656500][ T35] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 57.656532][ T35] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 57.656544][ T35] usb 8-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 57.656563][ T35] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.717063][ T6743] netlink: 'syz.1.218': attribute type 10 has an invalid length. [ 57.717905][ T6743] syz_tun: entered promiscuous mode [ 57.728423][ T6743] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 57.735124][ T71] usb 7-1: device descriptor read/64, error -71 [ 57.848028][ T71] usb usb7-port1: attempt power cycle [ 57.864201][ T35] cxacru 8-1:1.0: usbatm_usb_probe: invalid endpoint 02! [ 57.864356][ T35] cxacru 8-1:1.0: probe with driver cxacru failed with error -22 [ 57.880161][ T35] usb 8-1: USB disconnect, device number 3 [ 57.899613][ T6755] syz.1.219 invoked oom-killer: gfp_mask=0x400cc0(GFP_KERNEL_ACCOUNT), order=1, oom_score_adj=1000 [ 57.899635][ T6755] CPU: 2 UID: 0 PID: 6755 Comm: syz.1.219 Not tainted syzkaller #0 PREEMPT(full) [ 57.899647][ T6755] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 57.899653][ T6755] Call Trace: [ 57.899657][ T6755] [ 57.899661][ T6755] dump_stack_lvl+0x100/0x190 [ 57.899692][ T6755] dump_header+0xfb/0x606 [ 57.899706][ T6755] oom_kill_process.cold+0xd/0x380 [ 57.899719][ T6755] out_of_memory+0x340/0x14f0 [ 57.899741][ T6755] ? __pfx_out_of_memory+0x10/0x10 [ 57.899760][ T6755] mem_cgroup_out_of_memory+0xc6/0x130 [ 57.899774][ T6755] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 57.899787][ T6755] ? find_held_lock+0x2b/0x80 [ 57.899806][ T6755] ? do_raw_spin_unlock+0x145/0x1e0 [ 57.899822][ T6755] ? _raw_spin_unlock+0x28/0x50 [ 57.899844][ T6755] try_charge_memcg+0x783/0xf60 [ 57.899858][ T6755] ? __pfx_try_charge_memcg+0x10/0x10 [ 57.899868][ T6755] ? find_held_lock+0x2b/0x80 [ 57.899885][ T6755] ? rcu_read_unlock+0x17/0x60 [ 57.899895][ T6755] ? rcu_read_unlock+0x17/0x60 [ 57.899910][ T6755] obj_cgroup_charge_pages+0x2b/0x1f0 [ 57.899922][ T6755] __memcg_slab_post_alloc_hook+0x47f/0x10c0 [ 57.899943][ T6755] ? kasan_unpoison+0x27/0x60 [ 57.899958][ T6755] __kvmalloc_node_noprof+0x750/0x9b0 [ 57.899973][ T6755] ? do_raw_spin_lock+0x128/0x260 [ 57.899987][ T6755] ? alloc_fdtable+0x110/0x2d0 [ 57.900004][ T6755] alloc_fdtable+0x110/0x2d0 [ 57.900019][ T6755] dup_fd+0x995/0xd10 [ 57.900035][ T6755] ? do_raw_spin_unlock+0x145/0x1e0 [ 57.900050][ T6755] ? _raw_spin_unlock+0x28/0x50 [ 57.900067][ T6755] ? copy_fs_struct+0x2a0/0x340 [ 57.900082][ T6755] ksys_unshare+0x7c7/0xa70 [ 57.900096][ T6755] ? __pfx_ksys_unshare+0x10/0x10 [ 57.900114][ T6755] __x64_sys_unshare+0x31/0x40 [ 57.900128][ T6755] do_syscall_64+0x123/0x790 [ 57.900141][ T6755] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.900153][ T6755] RIP: 0033:0x7f8da1d9e159 [ 57.900162][ T6755] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 57.900172][ T6755] RSP: 002b:00007f8da2d46028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 57.900183][ T6755] RAX: ffffffffffffffda RBX: 00007f8da2025fa0 RCX: 00007f8da1d9e159 [ 57.900190][ T6755] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000020400 [ 57.900196][ T6755] RBP: 00007f8da1e3506b R08: 0000000000000000 R09: 0000000000000000 [ 57.900202][ T6755] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 57.900209][ T6755] R13: 00007f8da2026038 R14: 00007f8da2025fa0 R15: 00007ffc147c2088 [ 57.900223][ T6755] [ 57.900227][ T6755] memory: usage 4kB, limit 8kB, failcnt 20 [ 57.900233][ T6755] memory+swap: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 57.900239][ T6755] kmem: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 57.900245][ T6755] Memory cgroup stats for /syz1/test: [ 57.900310][ T6755] cache 0 [ 57.900315][ T6755] rss 0 [ 57.900318][ T6755] rss_huge 0 [ 57.900322][ T6755] shmem 0 [ 57.900325][ T6755] mapped_file 0 [ 57.900329][ T6755] dirty 0 [ 57.900332][ T6755] writeback 0 [ 57.900336][ T6755] workingset_refault_anon 0 [ 57.900340][ T6755] workingset_refault_file 0 [ 57.900344][ T6755] swap 0 [ 57.900348][ T6755] swapcached 0 [ 57.900351][ T6755] pgpgin 0 [ 57.900355][ T6755] pgpgout 0 [ 57.900358][ T6755] pgfault 0 [ 57.900362][ T6755] pgmajfault 0 [ 57.900366][ T6755] inactive_anon 0 [ 57.900370][ T6755] active_anon 0 [ 57.900373][ T6755] inactive_file 0 [ 57.900377][ T6755] active_file 0 [ 57.900381][ T6755] unevictable 0 [ 57.900384][ T6755] hierarchical_memory_limit 8192 [ 57.900389][ T6755] hierarchical_memsw_limit 9223372036854771712 [ 57.900393][ T6755] total_cache 0 [ 57.900397][ T6755] total_rss 0 [ 57.900400][ T6755] total_rss_huge 0 [ 57.900404][ T6755] total_shmem 0 [ 57.900408][ T6755] total_mapped_file 0 [ 57.900412][ T6755] total_dirty 0 [ 57.900415][ T6755] total_writeback 0 [ 57.900419][ T6755] total_workingset_refault_anon 0 [ 57.900424][ T6755] total_workingset_refault_file 0 [ 57.900428][ T6755] total_swap 0 [ 57.900431][ T6755] total_swapcached 0 [ 57.900435][ T6755] total_pgpgin 0 [ 57.900439][ T6755] total_pgpgout 0 [ 57.900443][ T6755] total_pgfault 0 [ 57.900446][ T6755] total_pgmajfault 0 [ 57.900450][ T6755] total_inactive_anon 0 [ 57.900454][ T6755] total_active_anon 0 [ 57.900458][ T6755] total_inactive_file 0 [ 57.900462][ T6755] total_active_file 0 [ 57.900466][ T6755] total_unevictable 0 [ 57.900469][ T6755] anon_cost 0 [ 57.900473][ T6755] file_cost 0 [ 57.900477][ T6755] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.219,pid=6754,uid=0 [ 57.901138][ T6755] Memory cgroup out of memory: Killed process 6754 (syz.1.219) total-vm:100280kB, anon-rss:1388kB, file-rss:23188kB, shmem-rss:0kB, UID:0 pgtables:124kB oom_score_adj:1000 [ 58.184899][ T71] usb 7-1: new low-speed USB device number 5 using dummy_hcd [ 58.205546][ T71] usb 7-1: device descriptor read/8, error -71 [ 58.214995][ T5732] Bluetooth: hci0: command 0x0419 tx timeout [ 58.215032][ T5732] Bluetooth: hci3: command 0x0c1a tx timeout [ 58.215171][ T5741] Bluetooth: hci2: command 0x0c1a tx timeout [ 58.398684][ T6774] Unable to locate "_" for $SUBSYSTEM_PLUGIN_$HOST_ID [ 58.466148][ T71] usb 7-1: new low-speed USB device number 6 using dummy_hcd [ 58.485209][ T71] usb 7-1: device descriptor read/8, error -71 [ 58.507194][ T6777] __vm_enough_memory: pid: 6777, comm: syz.3.222, bytes: 11727292649472 not enough memory for the allocation [ 58.507556][ T6777] __vm_enough_memory: pid: 6777, comm: syz.3.222, bytes: 11727292649472 not enough memory for the allocation [ 58.584243][ T6779] netlink: 168 bytes leftover after parsing attributes in process `syz.3.223'. [ 58.584412][ T6779] ======================================================= [ 58.584412][ T6779] WARNING: The mand mount option has been deprecated and [ 58.584412][ T6779] and is ignored by this kernel. Remove the mand [ 58.584412][ T6779] option from the mount to silence this warning. [ 58.584412][ T6779] ======================================================= [ 58.588459][ T6779] jffs2: notice: (6779) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 58.595171][ T71] usb usb7-port1: unable to enumerate USB device [ 58.603163][ T6780] netlink: 24 bytes leftover after parsing attributes in process `syz.3.223'. [ 58.828591][ T6786] ptp ptp0: max value is 20 [ 58.880112][ T6788] netlink: 4 bytes leftover after parsing attributes in process `syz.1.225'. [ 58.917533][ T6790] ip6erspan0: entered promiscuous mode [ 59.067107][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.067121][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.067184][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.067189][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.067285][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.067293][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.067378][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.067384][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.067449][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.067457][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.067524][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.067530][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.067603][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.067610][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.067699][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.067706][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.067773][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.067780][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.067851][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.067859][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.067924][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.067931][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.068017][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.068023][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.068091][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.068097][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.068163][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.068171][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.068236][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.068242][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.068326][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.068333][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.068398][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.068405][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.068473][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.068481][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.068543][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.068550][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.068639][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.068646][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.068713][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.068721][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.068790][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.068796][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.068876][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.068883][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.068971][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.068978][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.069044][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.069052][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.069116][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.069122][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.069336][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.069363][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.070953][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.070963][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.071029][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.071035][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.071148][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.071155][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.071217][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.071224][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.071285][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.071291][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.071354][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.071360][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.071422][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.071428][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.071495][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.071501][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.071560][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.071567][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.071629][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.071635][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.071696][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.071703][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.071764][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.071770][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.071832][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.071838][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.071902][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.071907][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.072015][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.072022][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.072084][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.072090][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.072151][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.072157][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.072222][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.072228][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.072290][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.072296][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.072357][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.072363][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.072422][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.072428][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.072498][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.072503][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.072565][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.072571][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.072632][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.072639][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.072700][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.072706][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.072824][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.072830][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.072891][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.072897][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.072959][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.072965][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.073033][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.073040][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.073103][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.073109][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.073170][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.073176][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.073237][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.073243][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.073304][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.073310][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.073395][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.073401][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.073468][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.073475][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.073537][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.073543][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.073604][ T6796] binder: BINDER_SET_CONTEXT_MGR already set [ 59.073610][ T6796] binder: 6794:6796 ioctl 4018620d 200000000040 returned -16 [ 59.108822][ T5741] Bluetooth: hci1: unexpected event for opcode 0x2028 [ 59.679634][ T6808] capability: warning: `syz.1.231' uses 32-bit capabilities (legacy support in use) [ 59.679947][ T6808] program syz.1.231 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 59.710531][ T6811] UHID_CREATE from different security context by process 252 (syz.1.232), this is not allowed. [ 59.764539][ T6816] __nla_validate_parse: 4 callbacks suppressed [ 59.764555][ T6816] netlink: 8 bytes leftover after parsing attributes in process `syz.1.234'. [ 60.294839][ T5741] Bluetooth: hci3: command 0x0c1a tx timeout [ 60.304932][ T5741] Bluetooth: hci2: command 0x0c1a tx timeout [ 60.304955][ T5741] Bluetooth: hci0: command 0x0419 tx timeout [ 60.415492][ T5929] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 60.587071][ T5929] usb 7-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 60.588991][ T5929] usb 7-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 60.589930][ T5929] usb 7-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 60.591834][ T5929] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 60.591853][ T5929] usb 7-1: Product: syz [ 60.591865][ T5929] usb 7-1: Manufacturer: syz [ 60.591877][ T5929] usb 7-1: SerialNumber: syz [ 60.598599][ T5929] ti_usb_3410_5052 7-1:2.0: TI USB 5052 2 port adapter converter detected [ 60.609426][ T5929] usb 7-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 60.612393][ T5929] usb 7-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 60.801312][ T44] kauditd_printk_skb: 41 callbacks suppressed [ 60.801325][ T44] audit: type=1400 audit(1791047548.776:28727): avc: denied { bind } for pid=6823 comm="syz.2.237" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 60.802571][ T44] audit: type=1400 audit(1791047548.776:28728): avc: denied { node_bind } for pid=6823 comm="syz.2.237" saddr=224.0.0.1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 60.856556][ T44] audit: type=1400 audit(1791047548.836:28729): avc: denied { create } for pid=6826 comm="syz.1.239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 60.858303][ T44] audit: type=1400 audit(1791047548.836:28730): avc: denied { setopt } for pid=6826 comm="syz.1.239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 60.861593][ T44] audit: type=1400 audit(1791047548.836:28731): avc: denied { ioctl } for pid=6826 comm="syz.1.239" path="socket:[22505]" dev="sockfs" ino=22505 ioctlcmd=0x660b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 60.861931][ T44] audit: type=1400 audit(1791047548.836:28732): avc: denied { connect } for pid=6826 comm="syz.1.239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 60.920376][ T6830] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 61.043698][ T44] audit: type=1400 audit(1791047549.016:28733): avc: denied { bind } for pid=6836 comm="syz.4.241" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 61.044347][ T44] audit: type=1400 audit(1791047549.016:28734): avc: denied { mounton } for pid=6836 comm="syz.4.241" path="/14/dev" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 61.278988][ T6848] netlink: 40 bytes leftover after parsing attributes in process `syz.4.243'. [ 61.333714][ T6849] netlink: 52 bytes leftover after parsing attributes in process `syz.4.243'. [ 61.593568][ T6860] netlink: 4 bytes leftover after parsing attributes in process `syz.4.246'. [ 61.598032][ T44] audit: type=1400 audit(1791047549.576:28735): avc: denied { connect } for pid=6859 comm="syz.4.246" lport=256 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 61.601850][ T6861] netlink: 12 bytes leftover after parsing attributes in process `syz.4.246'. [ 61.606597][ T6861] xfrm1: entered promiscuous mode [ 61.606609][ T6861] xfrm1: entered allmulticast mode [ 61.655342][ T6865] netlink: 4 bytes leftover after parsing attributes in process `syz.4.247'. [ 61.657963][ T6865] netlink: 20 bytes leftover after parsing attributes in process `syz.4.247'. [ 61.657990][ T6865] openvswitch: netlink: Missing key (keys=c0, expected=40300) [ 61.705223][ T44] audit: type=1400 audit(1791047549.686:28736): avc: denied { relabelfrom } for pid=6866 comm="syz.4.248" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 62.194181][ T6886] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 62.194358][ T6886] block device autoloading is deprecated and will be removed. [ 62.305014][ T6824] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot send start command, -110 [ 62.386727][ T5732] Bluetooth: hci0: command 0x0419 tx timeout [ 62.386754][ T5732] Bluetooth: hci2: command 0x0c1a tx timeout [ 62.386929][ T5741] Bluetooth: hci3: command 0x0c1a tx timeout [ 62.582190][ T6912] netlink: 4 bytes leftover after parsing attributes in process `syz.4.262'. [ 62.637682][ T6912] nvme nvme0: rdma_resolve_addr failed (-19). [ 63.058075][ T6933] binder: 6932:6933 ioctl 400c620e 200000000500 returned -22 [ 63.112700][ T6937] netlink: 76 bytes leftover after parsing attributes in process `syz.2.272'. [ 63.120022][ T6937] FAULT_INJECTION: forcing a failure. [ 63.120022][ T6937] name failslab, interval 1, probability 0, space 0, times 0 [ 63.120048][ T6937] CPU: 1 UID: 0 PID: 6937 Comm: syz.2.272 Not tainted syzkaller #0 PREEMPT(full) [ 63.120066][ T6937] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 63.120075][ T6937] Call Trace: [ 63.120080][ T6937] [ 63.120086][ T6937] dump_stack_lvl+0x100/0x190 [ 63.120112][ T6937] should_fail_ex.cold+0x5/0xa [ 63.120133][ T6937] should_failslab+0xc2/0x120 [ 63.120155][ T6937] kmem_cache_alloc_noprof+0x92/0x6a0 [ 63.120174][ T6937] ? security_file_alloc+0x34/0x2c0 [ 63.120199][ T6937] security_file_alloc+0x34/0x2c0 [ 63.120219][ T6937] init_file+0x95/0x480 [ 63.120240][ T6937] alloc_empty_file+0x79/0x1c0 [ 63.120264][ T6937] alloc_file_pseudo+0x183/0x290 [ 63.120286][ T6937] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 63.120308][ T6937] ? alloc_fd+0x471/0x7a0 [ 63.120333][ T6937] sock_alloc_file+0x50/0x210 [ 63.120366][ T6937] __sys_socket+0x1c0/0x260 [ 63.120384][ T6937] ? __pfx___sys_socket+0x10/0x10 [ 63.120407][ T6937] __x64_sys_socket+0x72/0xb0 [ 63.120423][ T6937] ? lockdep_hardirqs_on+0x7d/0x110 [ 63.120440][ T6937] do_syscall_64+0x123/0x790 [ 63.120458][ T6937] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.120473][ T6937] RIP: 0033:0x7f5a1fb9e159 [ 63.120485][ T6937] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 63.120498][ T6937] RSP: 002b:00007f5a20b02028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 63.120514][ T6937] RAX: ffffffffffffffda RBX: 00007f5a1fe25fa0 RCX: 00007f5a1fb9e159 [ 63.120524][ T6937] RDX: 000000000000000c RSI: 0000000000000003 RDI: 0000000000000010 [ 63.120534][ T6937] RBP: 00007f5a1fc3506b R08: 0000000000000000 R09: 0000000000000000 [ 63.120543][ T6937] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 63.120552][ T6937] R13: 00007f5a1fe26038 R14: 00007f5a1fe25fa0 R15: 00007ffe03d44228 [ 63.120576][ T6937] [ 63.288957][ T6948] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 63.473948][ T5836] usb 7-1: USB disconnect, device number 7 [ 63.514396][ T5836] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 63.525442][ T5836] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 63.526257][ T5836] ti_usb_3410_5052 7-1:2.0: device disconnected [ 63.910873][ T6956] FAULT_INJECTION: forcing a failure. [ 63.910873][ T6956] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 63.910894][ T6956] CPU: 2 UID: 0 PID: 6956 Comm: syz.3.275 Not tainted syzkaller #0 PREEMPT(full) [ 63.910906][ T6956] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 63.910913][ T6956] Call Trace: [ 63.910917][ T6956] [ 63.910922][ T6956] dump_stack_lvl+0x100/0x190 [ 63.910942][ T6956] should_fail_ex.cold+0x5/0xa [ 63.910959][ T6956] strncpy_from_user+0x3b/0x2d0 [ 63.910976][ T6956] __do_sys_add_key+0xd4/0x460 [ 63.910989][ T6956] ? __pfx___do_sys_add_key+0x10/0x10 [ 63.910999][ T6956] ? ksys_write+0x1ac/0x250 [ 63.911017][ T6956] do_syscall_64+0x123/0x790 [ 63.911031][ T6956] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.911044][ T6956] RIP: 0033:0x7f0f6b99e159 [ 63.911053][ T6956] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 63.911063][ T6956] RSP: 002b:00007f0f6c8fc028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 63.911074][ T6956] RAX: ffffffffffffffda RBX: 00007f0f6bc25fa0 RCX: 00007f0f6b99e159 [ 63.911081][ T6956] RDX: 0000000000000000 RSI: 0000200000000980 RDI: 0000200000000940 [ 63.911088][ T6956] RBP: 00007f0f6ba3506b R08: fffffffffffffffd R09: 0000000000000000 [ 63.911094][ T6956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 63.911100][ T6956] R13: 00007f0f6bc26038 R14: 00007f0f6bc25fa0 R15: 00007ffdf177bab8 [ 63.911114][ T6956] [ 63.913602][ T6956] FAULT_INJECTION: forcing a failure. [ 63.913602][ T6956] name failslab, interval 1, probability 0, space 0, times 0 [ 63.913626][ T6956] CPU: 3 UID: 0 PID: 6956 Comm: syz.3.275 Not tainted syzkaller #0 PREEMPT(full) [ 63.913648][ T6956] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 63.913660][ T6956] Call Trace: [ 63.913667][ T6956] [ 63.913675][ T6956] dump_stack_lvl+0x100/0x190 [ 63.913704][ T6956] should_fail_ex.cold+0x5/0xa [ 63.913729][ T6956] should_failslab+0xc2/0x120 [ 63.913757][ T6956] __kmalloc_cache_noprof+0x91/0x6d0 [ 63.913772][ T6956] ? find_held_lock+0x2b/0x80 [ 63.913795][ T6956] ? alloc_fs_context+0x57/0xf40 [ 63.913821][ T6956] alloc_fs_context+0x57/0xf40 [ 63.913841][ T6956] ? __get_fs_type+0xe3/0x200 [ 63.913863][ T6956] path_mount+0xdbd/0x24c0 [ 63.913887][ T6956] ? __pfx_path_mount+0x10/0x10 [ 63.913904][ T6956] ? lockdep_hardirqs_on+0x7d/0x110 [ 63.913924][ T6956] ? putname+0xb1/0x110 [ 63.913950][ T6956] ? kmem_cache_free+0x127/0x6c0 [ 63.913978][ T6956] ? __x64_sys_mount+0x293/0x310 [ 63.913996][ T6956] __x64_sys_mount+0x293/0x310 [ 63.914016][ T6956] ? __pfx___x64_sys_mount+0x10/0x10 [ 63.914040][ T6956] do_syscall_64+0x123/0x790 [ 63.914064][ T6956] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.914084][ T6956] RIP: 0033:0x7f0f6b99e159 [ 63.914100][ T6956] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 63.914118][ T6956] RSP: 002b:00007f0f6c8fc028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 63.914138][ T6956] RAX: ffffffffffffffda RBX: 00007f0f6bc25fa0 RCX: 00007f0f6b99e159 [ 63.914151][ T6956] RDX: 0000200000000040 RSI: 0000200000000000 RDI: 0000000000000000 [ 63.914164][ T6956] RBP: 00007f0f6ba3506b R08: 0000000000000000 R09: 0000000000000000 [ 63.914176][ T6956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 63.914188][ T6956] R13: 00007f0f6bc26038 R14: 00007f0f6bc25fa0 R15: 00007ffdf177bab8 [ 63.914215][ T6956] [ 64.051943][ T6970] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 64.116641][ T6983] SELinux: Context system_u:object_r:getty_var_run_t:s0 is not valid (left unmapped). [ 64.177072][ T6992] netlink: 4 bytes leftover after parsing attributes in process `syz.1.281'. [ 64.514683][ T7016] bond1: entered allmulticast mode [ 64.516122][ T7016] 8021q: adding VLAN 0 to HW filter on device bond1 [ 65.535983][ T7043] bridge0: port 3(erspan0) entered blocking state [ 65.536395][ T7043] bridge0: port 3(erspan0) entered disabled state [ 65.539151][ T7043] erspan0: entered allmulticast mode [ 65.550084][ T7043] erspan0: entered promiscuous mode [ 65.552386][ T7043] bridge0: port 3(erspan0) entered blocking state [ 65.552480][ T7043] bridge0: port 3(erspan0) entered forwarding state [ 66.375577][ T7058] netlink: 'syz.3.302': attribute type 29 has an invalid length. [ 66.618249][ T7065] nvme nvme0: rdma connection establishment failed (-104) [ 66.722977][ T7072] __nla_validate_parse: 1 callbacks suppressed [ 66.723035][ T7072] netlink: 12 bytes leftover after parsing attributes in process `syz.2.306'. [ 66.734519][ T7072] Bluetooth: MGMT ver 1.23 [ 66.748735][ T7063] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 66.748761][ T7063] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 66.748784][ T7063] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 66.774292][ T7063] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 66.787654][ T7063] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 66.792989][ T44] kauditd_printk_skb: 31 callbacks suppressed [ 66.793008][ T44] audit: type=1400 audit(1791047554.766:28768): avc: denied { create } for pid=7071 comm="syz.2.306" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 66.794629][ T44] audit: type=1400 audit(1791047554.766:28769): avc: denied { getopt } for pid=7071 comm="syz.2.306" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 67.808121][ T44] audit: type=1400 audit(1791047555.786:28770): avc: denied { append } for pid=7093 comm="syz.4.312" name="001" dev="devtmpfs" ino=766 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 68.203752][ T44] audit: type=1400 audit(1791047556.176:28771): avc: denied { append } for pid=7101 comm="syz.3.315" name="nbd3" dev="devtmpfs" ino=691 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 68.313221][ T44] audit: type=1400 audit(1791047556.286:28772): avc: denied { write } for pid=7105 comm="syz.4.319" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 69.033105][ T44] audit: type=1400 audit(1791047557.006:28773): avc: denied { search } for pid=7124 comm="syz.3.323" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 69.774382][ T7139] misc userio: No port type given on /dev/userio [ 70.551411][ T44] audit: type=1400 audit(1791047558.496:28774): avc: denied { mount } for pid=7148 comm="syz.2.332" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 70.710840][ T7152] bond2: entered allmulticast mode [ 70.711334][ T7152] 8021q: adding VLAN 0 to HW filter on device bond2 [ 70.731854][ T7152] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 70.734610][ T7152] macvlan0: entered allmulticast mode [ 70.734629][ T7152] bond0: entered allmulticast mode [ 70.734641][ T7152] bond_slave_0: entered allmulticast mode [ 70.734657][ T7152] bond_slave_1: entered allmulticast mode [ 70.735435][ T7152] bond_slave_0: entered promiscuous mode [ 70.735477][ T7152] bond_slave_1: entered promiscuous mode [ 70.738796][ T7152] bond2: (slave macvlan0): Enslaving as a backup interface with an up link [ 70.772766][ T7152] ip6gretap1: entered allmulticast mode [ 70.773390][ T7152] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 70.776493][ T7152] netlink: 14 bytes leftover after parsing attributes in process `syz.4.333'. [ 70.784572][ T7155] IPVS: rr: TCP 127.0.0.1:21 - no destination available [ 70.789950][ T1067] IPVS: starting estimator thread 0... [ 70.815368][ T44] audit: type=1400 audit(1791047558.796:28775): avc: denied { read } for pid=7158 comm="syz.2.335" lport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 70.845588][ T7152] bond_slave_0: left promiscuous mode [ 70.845677][ T7152] bond_slave_1: left promiscuous mode [ 70.867566][ T7152] bond0 (unregistering): left allmulticast mode [ 70.867581][ T7152] bond_slave_0: left allmulticast mode [ 70.867590][ T7152] bond_slave_1: left allmulticast mode [ 70.873037][ T7152] bond2: (slave macvlan0): Removing an active aggregator [ 70.873057][ T7152] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 70.873553][ T7152] bond2: (slave macvlan0): Releasing backup interface [ 70.873565][ T7152] bond2: (slave macvlan0): the permanent HWaddr of slave - 6e:6d:28:fe:0b:db - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 70.874269][ T7152] macvlan0 (unregistering): left allmulticast mode [ 70.878635][ T7162] netlink: 'syz.3.336': attribute type 2 has an invalid length. [ 70.878653][ T7162] netlink: 20 bytes leftover after parsing attributes in process `syz.3.336'. [ 70.881553][ T7152] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 70.886570][ T7152] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 70.887980][ T7152] bond0 (unregistering): Released all slaves [ 70.950612][ T5832] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 70.964853][ T7157] IPVS: using max 43 ests per chain, 103200 per kthread [ 71.139143][ T44] audit: type=1400 audit(1791047559.116:28776): avc: denied { write } for pid=7184 comm="syz.3.341" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 71.173433][ T7185] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 71.257955][ T1442] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.259688][ T7189] ip_tables: iptables: counters copy to user failed while replacing table [ 71.260509][ T44] audit: type=1400 audit(1791047559.236:28777): avc: denied { name_bind } for pid=7188 comm="syz.3.342" src=65530 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 71.279097][ T25] cfg80211: failed to load regulatory.db [ 71.396551][ T7195] syzkaller1: entered promiscuous mode [ 71.396573][ T7195] syzkaller1: entered allmulticast mode [ 71.620842][ T7202] program syz.1.346 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 71.738708][ T7213] netlink: 16 bytes leftover after parsing attributes in process `syz.3.351'. [ 71.739067][ T7213] netlink: 24 bytes leftover after parsing attributes in process `syz.3.351'. [ 71.839692][ T7221] netlink: 'syz.3.353': attribute type 1 has an invalid length. [ 71.854344][ T7221] 8021q: adding VLAN 0 to HW filter on device bond1 [ 71.868778][ T7221] bond1: (slave dummy0): making interface the new active one [ 71.869908][ T7221] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 71.872676][ T7221] netlink: 'syz.3.353': attribute type 10 has an invalid length. [ 71.872694][ T7221] netlink: 40 bytes leftover after parsing attributes in process `syz.3.353'. [ 71.873024][ T7221] dummy0: entered promiscuous mode [ 71.879119][ T7221] bond1: (slave dummy0): Releasing active interface [ 71.929001][ T7225] bond3: Removing last arp target with arp_interval on [ 71.954341][ T7231] block device autoloading is deprecated and will be removed. [ 72.062245][ T7236] ================================================================== [ 72.062258][ T7236] BUG: KASAN: slab-use-after-free in dvb_device_open+0x33f/0x3b0 [ 72.062292][ T7236] Read of size 8 at addr ffff88802e52b618 by task syz.4.357/7236 [ 72.062303][ T7236] [ 72.062312][ T7236] CPU: 1 UID: 0 PID: 7236 Comm: syz.4.357 Tainted: G L syzkaller #0 PREEMPT(full) [ 72.062330][ T7236] Tainted: [L]=SOFTLOCKUP [ 72.062335][ T7236] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 72.062343][ T7236] Call Trace: [ 72.062347][ T7236] [ 72.062352][ T7236] dump_stack_lvl+0x100/0x190 [ 72.062372][ T7236] print_report+0x13d/0x4b0 [ 72.062391][ T7236] ? __virt_addr_valid+0x239/0x430 [ 72.062405][ T7236] ? dvb_device_open+0x33f/0x3b0 [ 72.062418][ T7236] kasan_report+0xdf/0x1c0 [ 72.062441][ T7236] ? dvb_device_open+0x33f/0x3b0 [ 72.062454][ T7236] ? __pfx_dvb_device_open+0x10/0x10 [ 72.062468][ T7236] dvb_device_open+0x33f/0x3b0 [ 72.062483][ T7236] ? __pfx_dvb_device_open+0x10/0x10 [ 72.062518][ T7236] chrdev_open+0x234/0x6a0 [ 72.062538][ T7236] ? __pfx_chrdev_open+0x10/0x10 [ 72.062557][ T7236] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 72.062575][ T7236] do_dentry_open+0x6ab/0x14d0 [ 72.062591][ T7236] ? __pfx_chrdev_open+0x10/0x10 [ 72.062611][ T7236] vfs_open+0x82/0x3f0 [ 72.062630][ T7236] path_openat+0x19fa/0x2440 [ 72.062650][ T7236] ? __pfx_path_openat+0x10/0x10 [ 72.062669][ T7236] do_file_open+0x20e/0x430 [ 72.062687][ T7236] ? __pfx_do_file_open+0x10/0x10 [ 72.062709][ T7236] ? _raw_spin_unlock+0x28/0x50 [ 72.062734][ T7236] ? alloc_fd+0x471/0x7a0 [ 72.062753][ T7236] do_sys_openat2+0x10f/0x1e0 [ 72.062772][ T7236] ? __pfx_do_sys_openat2+0x10/0x10 [ 72.062793][ T7236] __x64_sys_openat+0x12d/0x210 [ 72.062812][ T7236] ? __pfx___x64_sys_openat+0x10/0x10 [ 72.062835][ T7236] do_syscall_64+0x123/0x790 [ 72.062851][ T7236] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.062865][ T7236] RIP: 0033:0x7f365495e98e [ 72.062876][ T7236] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 72.062888][ T7236] RSP: 002b:00007f36558dfb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 72.062920][ T7236] RAX: ffffffffffffffda RBX: 00007f36558e06c0 RCX: 00007f365495e98e [ 72.062929][ T7236] RDX: 0000000000000400 RSI: 00007f36558dfc00 RDI: ffffffffffffff9c [ 72.062937][ T7236] RBP: 00007f36558dfc00 R08: 0000000000000000 R09: 0000000000000000 [ 72.062945][ T7236] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 72.062953][ T7236] R13: 00007f3654c26038 R14: 00007f3654c25fa0 R15: 00007ffe04c7b768 [ 72.062971][ T7236] [ 72.062978][ T7236] [ 72.062981][ T7236] Allocated by task 5726: [ 72.062988][ T7236] kasan_save_stack+0x30/0x50 [ 72.063005][ T7236] kasan_save_track+0x14/0x30 [ 72.063021][ T7236] __kasan_kmalloc+0xaa/0xb0 [ 72.063036][ T7236] __kmalloc_noprof+0x32f/0x840 [ 72.063050][ T7236] security_inode_init_security+0x113/0x370 [ 72.063070][ T7236] shmem_mknod+0x2ce/0x480 [ 72.063085][ T7236] shmem_mkdir+0x31/0x80 [ 72.063100][ T7236] vfs_mkdir+0x364/0x850 [ 72.063111][ T7236] filename_mkdirat+0x48b/0x5e0 [ 72.063128][ T7236] __x64_sys_mkdirat+0x89/0xc0 [ 72.063144][ T7236] do_syscall_64+0x123/0x790 [ 72.063156][ T7236] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.063168][ T7236] [ 72.063170][ T7236] Freed by task 5726: [ 72.063176][ T7236] kasan_save_stack+0x30/0x50 [ 72.063190][ T7236] kasan_save_track+0x14/0x30 [ 72.063204][ T7236] kasan_save_free_info+0x3b/0x70 [ 72.063216][ T7236] __kasan_slab_free+0x5f/0x80 [ 72.063231][ T7236] kfree+0x22b/0x6d0 [ 72.063240][ T7236] security_inode_init_security+0x2bf/0x370 [ 72.063260][ T7236] shmem_mknod+0x2ce/0x480 [ 72.063275][ T7236] shmem_mkdir+0x31/0x80 [ 72.063288][ T7236] vfs_mkdir+0x364/0x850 [ 72.063299][ T7236] filename_mkdirat+0x48b/0x5e0 [ 72.063316][ T7236] __x64_sys_mkdirat+0x89/0xc0 [ 72.063333][ T7236] do_syscall_64+0x123/0x790 [ 72.063345][ T7236] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.063356][ T7236] [ 72.063359][ T7236] The buggy address belongs to the object at ffff88802e52b600 [ 72.063359][ T7236] which belongs to the cache kmalloc-256 of size 256 [ 72.063369][ T7236] The buggy address is located 24 bytes inside of [ 72.063369][ T7236] freed 256-byte region [ffff88802e52b600, ffff88802e52b700) [ 72.063381][ T7236] [ 72.063384][ T7236] The buggy address belongs to the physical page: [ 72.063390][ T7236] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802e52a200 pfn:0x2e52a [ 72.063401][ T7236] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 72.063411][ T7236] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 72.063423][ T7236] page_type: f5(slab) [ 72.063434][ T7236] raw: 00fff00000000240 ffff88801c042b40 ffffea0000cf2e10 ffffea0000df1310 [ 72.063445][ T7236] raw: ffff88802e52a200 000000000010000b 00000000f5000000 0000000000000000 [ 72.063456][ T7236] head: 00fff00000000240 ffff88801c042b40 ffffea0000cf2e10 ffffea0000df1310 [ 72.063467][ T7236] head: ffff88802e52a200 000000000010000b 00000000f5000000 0000000000000000 [ 72.063477][ T7236] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 72.063488][ T7236] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 72.063495][ T7236] page dumped because: kasan: bad access detected [ 72.063500][ T7236] page_owner tracks the page as allocated [ 72.063505][ T7236] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8057416148 [ 72.063524][ T7236] post_alloc_hook+0xfd/0x120 [ 72.063536][ T7236] get_page_from_freelist+0x110d/0x35d0 [ 72.063549][ T7236] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 72.063563][ T7236] new_slab+0xa9/0x6e0 [ 72.063574][ T7236] refill_objects+0xe3/0x410 [ 72.063585][ T7236] __pcs_replace_empty_main+0x35e/0x650 [ 72.063596][ T7236] __kmalloc_cache_noprof+0x4f4/0x6d0 [ 72.063607][ T7236] bus_add_driver+0x92/0x5b0 [ 72.063622][ T7236] driver_register+0x1e2/0x360 [ 72.063639][ T7236] usb_register_driver+0x21c/0x3e0 [ 72.063650][ T7236] do_one_initcall+0x11c/0x6f0 [ 72.063662][ T7236] kernel_init_freeable+0x6ea/0x7b0 [ 72.063677][ T7236] kernel_init+0x21/0x1e0 [ 72.063692][ T7236] ret_from_fork+0x730/0xd60 [ 72.063705][ T7236] ret_from_fork_asm+0x1a/0x30 [ 72.063717][ T7236] page_owner free stack trace missing [ 72.063722][ T7236] [ 72.063724][ T7236] Memory state around the buggy address: [ 72.063730][ T7236] ffff88802e52b500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.063739][ T7236] ffff88802e52b580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.063747][ T7236] >ffff88802e52b600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.063754][ T7236] ^ [ 72.063760][ T7236] ffff88802e52b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.063768][ T7236] ffff88802e52b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.063775][ T7236] ================================================================== [ 72.063882][ T7236] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 72.354957][ T7236] CPU: 1 UID: 0 PID: 7236 Comm: syz.4.357 Tainted: G L syzkaller #0 PREEMPT(full) [ 72.358233][ T7236] Tainted: [L]=SOFTLOCKUP [ 72.359603][ T7236] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 72.362959][ T7236] Call Trace: [ 72.364152][ T7236] [ 72.365165][ T7236] dump_stack_lvl+0x100/0x190 [ 72.366801][ T7236] vpanic+0x553/0x970 [ 72.368157][ T7236] ? __pfx_vpanic+0x10/0x10 [ 72.369603][ T7236] ? mark_held_locks+0x40/0x70 [ 72.371131][ T7236] ? dvb_device_open+0x33f/0x3b0 [ 72.372658][ T7236] panic+0xd1/0xe0 [ 72.373855][ T7236] ? __pfx_panic+0x10/0x10 [ 72.375268][ T7236] ? dvb_device_open+0x33f/0x3b0 [ 72.376812][ T7236] ? preempt_schedule_common+0x3c/0xb0 [ 72.378538][ T7236] check_panic_on_warn.cold+0x19/0x34 [ 72.380203][ T7236] end_report.part.0+0x3a/0x90 [ 72.381681][ T7236] kasan_report.cold+0xe/0x18 [ 72.383106][ T7236] ? dvb_device_open+0x33f/0x3b0 [ 72.384613][ T7236] ? __pfx_dvb_device_open+0x10/0x10 [ 72.386227][ T7236] dvb_device_open+0x33f/0x3b0 [ 72.387677][ T7236] ? __pfx_dvb_device_open+0x10/0x10 [ 72.389330][ T7236] chrdev_open+0x234/0x6a0 [ 72.390724][ T7236] ? __pfx_chrdev_open+0x10/0x10 [ 72.392273][ T7236] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 72.394179][ T7236] do_dentry_open+0x6ab/0x14d0 [ 72.395647][ T7236] ? __pfx_chrdev_open+0x10/0x10 [ 72.397173][ T7236] vfs_open+0x82/0x3f0 [ 72.398500][ T7236] path_openat+0x19fa/0x2440 [ 72.399906][ T7236] ? __pfx_path_openat+0x10/0x10 [ 72.401443][ T7236] do_file_open+0x20e/0x430 [ 72.402881][ T7236] ? __pfx_do_file_open+0x10/0x10 [ 72.404408][ T7236] ? _raw_spin_unlock+0x28/0x50 [ 72.405922][ T7236] ? alloc_fd+0x471/0x7a0 [ 72.407218][ T7236] do_sys_openat2+0x10f/0x1e0 [ 72.408659][ T7236] ? __pfx_do_sys_openat2+0x10/0x10 [ 72.410321][ T7236] __x64_sys_openat+0x12d/0x210 [ 72.411887][ T7236] ? __pfx___x64_sys_openat+0x10/0x10 [ 72.413545][ T7236] do_syscall_64+0x123/0x790 [ 72.414956][ T7236] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.416755][ T7236] RIP: 0033:0x7f365495e98e [ 72.418074][ T7236] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 72.424428][ T7236] RSP: 002b:00007f36558dfb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 72.427613][ T7236] RAX: ffffffffffffffda RBX: 00007f36558e06c0 RCX: 00007f365495e98e [ 72.430587][ T7236] RDX: 0000000000000400 RSI: 00007f36558dfc00 RDI: ffffffffffffff9c [ 72.432933][ T7236] RBP: 00007f36558dfc00 R08: 0000000000000000 R09: 0000000000000000 [ 72.435394][ T7236] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 72.437823][ T7236] R13: 00007f3654c26038 R14: 00007f3654c25fa0 R15: 00007ffe04c7b768 [ 72.440241][ T7236] [ 72.442091][ T7236] Kernel Offset: disabled [ 72.443532][ T7236] Rebooting in 86400 seconds.. VM DIAGNOSIS: 17:12:40 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000000 RBX=0000000000000000 RCX=0000000000000000 RDX=0000000000000000 RSI=0000000000000000 RDI=0000000000000000 RBP=0000000000000000 RSP=ffffc900030d7890 R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff8bd25190 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] FS =0000 00007f5a20b026c0 ffffffff 00c09300 DPL=0 DS [-WA] GS =0000 ffff8880d5b4e000 ffffffff 00c09300 DPL=0 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000ffff IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000000000000 CR3=000000005d499000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000061 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85b1bad5 RDI=ffffffff9bc76f60 RBP=ffffffff9bc76f20 RSP=ffffc900030570e8 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=20666f2064616552 R12=0000000000000000 R13=0000000000000061 R14=0000000000000003 R15=ffffc90003057400 RIP=ffffffff85b1baff RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 00007f36558e06c0 ffffffff 00c01300 GS =0000 ffff8880d5c4e000 ffffffff 00c01300 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00002000000015c0 CR3=00000000227ce000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=000000000000003f Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a2095d560 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe03d44716 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe03d44716 00007ffe03d4471c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a1fc3564e ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a1fc3568e ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a1fc357f2 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a1fc35680 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 201df9e2c4f76a0f 66000053f3990b32 0f0000028db9300f 00000000ba000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000700080006 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a1fdf25f8 00007f5a1fdf25c8 00007f5a1fdf2600 00007f5a1fdf25e0 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000050 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=ffff88806fe04040 RBX=0000000000013207 RCX=1ffff1100dfc080a RDX=dffffc0000000000 RSI=ffffffff828c04ca RDI=ffff88806fe04050 RBP=ffff88801c700000 RSP=ffffc90000a1f280 R8 =0000000000000006 R9 =0000000000001000 R10=0000000000000000 R11=0000000000000000 R12=0000000000000000 R13=0000000000000001 R14=0000000000013207 R15=ffffea00004c81c0 RIP=ffffffff8bd2b160 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d5d4e000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f0f6bc27dac CR3=0000000026262000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000008000100 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 317a79732f74656e 2f70756f7267637a ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc147c2576 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc147c2576 00007ffc147c257c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f8da1e3564e ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f8da1e3568e ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f8da1e357f2 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f8da1e35680 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000080000 RBX=0000000000000001 RCX=ffffc90006f71000 RDX=0000000000080000 RSI=ffffffff8261d48d RDI=ffffffff8edec5a0 RBP=ffffc90004047980 RSP=ffffc90004047848 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001 R12=ffff88803e0143c0 R13=0000000000000067 R14=0000000000000067 R15=0000000000000001 RIP=ffffffff81e77bc0 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f0f6c8fc6c0 ffffffff 00c00000 GS =0000 ffff8880d5e4e000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007f0f6c8fbff8 CR3=0000000029488000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000001000000 Opmask01=0000000001000001 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 7570637265705f65 676173752e746363 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe03d44716 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe03d44716 00007ffe03d4471c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a1fc3564e ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a1fc3568e ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a1fc357f2 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f5a1fc35680 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000050 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000050 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000