last executing test programs: 1m38.269978025s ago: executing program 2 (id=3): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x8e44, 0x1f400, 0x201, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 1m38.17189628s ago: executing program 2 (id=6): socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x2a) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x84) r0 = io_uring_setup(0xa5d, &(0x7f0000000040)={0x0, 0xca72, 0x1cc90, 0x0, 0x20002fb}) r1 = socket$inet(0x2, 0x80001, 0x84) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x130, 0x0, 0x3, {0x1, 0x0, 0x0, '\x00', {0x20, 0xf602, 0x6, 0x8, 0x0, 0x0, 0x0, '\x00', 0xfffffffffffffffe, 0x0, 0x1ff, 0x0, {}, {0x200005, 0x4}, {0xfffffffffffffffb, 0x40}, {0x45}, 0x64, 0x0, 0x81}}}}) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffefb) io_uring_enter(r0, 0x2218, 0x7521, 0x16, 0x0, 0x0) 1m38.091850172s ago: executing program 2 (id=8): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r2, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r3, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r3, 0x0, 0x10001, 0x0, 0x1, 0xd6fe2, 0x1000000}) 1m37.937176096s ago: executing program 2 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x180) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x81c0, 0x80000001) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000140), 0x8, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0/file0\x00', 0x400) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0, 0x41) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f00000005c0)={0x8}) chdir(&(0x7f0000000240)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0x8042, 0x34) 1m37.899683298s ago: executing program 2 (id=16): mkdirat(0xffffffffffffff9c, &(0x7f0000001580)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000015c0)='./proc\x00', &(0x7f0000001600)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001640)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000001680)='270', 0x3) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x204040, 0x0) pselect6(0x40, &(0x7f0000000000)={0x7, 0x1ff, 0x4, 0x7, 0x1, 0x2, 0x5, 0x9}, 0x0, &(0x7f0000000040)={0x9, 0x9, 0x401, 0x9, 0x6, 0x8000000000000001, 0xa94f, 0x2}, &(0x7f0000000080), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000980)='./sys\x00', 0x1ff) unshare(0x40000000) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) 1m28.930176227s ago: executing program 1 (id=118): socket$kcm(0x21, 0x2, 0x2) socket$inet6_udp(0xa, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$vbi(&(0x7f0000000300), 0x0, 0x2) syz_open_dev$vim2m(&(0x7f0000000380), 0x2000000f5, 0x2) pselect6(0x40, &(0x7f0000000740)={0x1ff, 0x0, 0x0, 0x0, 0x800, 0x0, 0x8000100ffffe}, 0x0, 0x0, 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f00000002c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) 1m28.893837862s ago: executing program 1 (id=120): fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000540), 0x4) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000700)={0x81, 0xffffffffffffffff, 'id1\x00'}) r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000100000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x10000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {0x7, 0xfff3}, {0xb, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x14, 0x2, [@TCA_BASIC_EMATCHES={0x10, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8}, @TCA_EMATCH_TREE_LIST={0x4}]}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) 1m28.815639564s ago: executing program 1 (id=121): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000800), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000880)={[0x60000000004, 0x1000000000, 0x80000000000005, 0x41, 0x2000000, 0x0, 0x2004cb, 0xffffffffeffffffe, 0xa1d, 0x9, 0x5, 0x0, 0x3, 0x2, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000940)=@x86={0x33, 0xb, 0x8, 0x0, 0x2, 0x1, 0x2, 0x0, 0x81, 0x81, 0x6e, 0xd2, 0x0, 0x8, 0x8, 0x6, 0x6d, 0x10, 0x9, '\x00', 0x8, 0x3}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000980)={{0x0, 0xeeee0000, 0x0, 0xf, 0x8, 0x0, 0x7, 0x2, 0x0, 0x8, 0x9, 0x10}, {0x2, 0x200000, 0xb, 0xff, 0xb, 0x0, 0x0, 0x0, 0x7, 0x7}, {0xe000, 0x5000, 0xc, 0xff, 0x4, 0x4, 0x0, 0x0, 0x3, 0xf6, 0x0, 0xfc}, {0x3000, 0x3000, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x8, 0x10, 0x89, 0xfc}, {0xeeee8000, 0xffff1000, 0x9, 0xff, 0x47, 0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x11}, {0x1000, 0x0, 0xb, 0x0, 0x8, 0x6, 0x42, 0x0, 0xff, 0x1, 0x5}, {0xdddd1000, 0xeeef0000, 0x3, 0xfe, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x4}, {0x100000, 0x1, 0xd, 0x0, 0x4, 0x1, 0x0, 0x8, 0x26}, {0x1, 0x7}, {0xd000}, 0xddf8ffdb, 0x0, 0x10000, 0x50, 0x0, 0x0, 0x0, [0x0, 0x20000000, 0x1, 0x40]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m28.693785787s ago: executing program 1 (id=124): r0 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x0) fchdir(r1) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x20, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) r3 = dup(r2) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000500)=@generic={&(0x7f0000000540)='./file0\x00', r3}, 0x18) prlimit64(0x0, 0x7, &(0x7f0000000440), 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000340)=@generic={&(0x7f0000000140)='./file0\x00'}, 0x18) 1m28.665305376s ago: executing program 1 (id=125): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x180) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x8400, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/core/rps_default_mask\x00', 0x0, 0x0) r0 = open(&(0x7f00000002c0)='.\x00', 0x101500, 0x12d) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) 1m28.614644843s ago: executing program 1 (id=127): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x6d, 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x3, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c71b95a9847d2bdede66c6e3184c386faf938fd6db888e73a5c0dcc69c3de7458e68ed33226a8d1c8e17", 0x0, 0xb2}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x40000073, 0x0, 0x81}]}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m23.136318486s ago: executing program 3 (id=159): mbind(&(0x7f0000002000/0x3000)=nil, 0x3000, 0xa002, &(0x7f0000000140)=0x3ff, 0x61, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000340)={[{0x22a, 0x2, 0xfe, 0x0, 0x0, 0x88, 0x0, 0x0, 0x5, 0xff, 0x1f}, {0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfd, 0x0, 0x4, 0x24, 0xfd, 0x1000000}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_open_dev$hiddev(&(0x7f0000000040), 0x7, 0x8000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m23.015960274s ago: executing program 3 (id=160): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1e6) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mnt\x00', 0x3f) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x7, &(0x7f0000000000/0x400000)=nil) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8042, 0x48) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000480)={0x8, 0x0, 0x9, 0x9, 0x4ea, 0xc}) 1m22.950237188s ago: executing program 3 (id=161): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) accept4$alg(r0, 0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1700000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1m22.856389657s ago: executing program 3 (id=162): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) chdir(&(0x7f0000000200)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x275a, 0x0) pwritev2(r0, &(0x7f00000002c0)=[{&(0x7f0000000300)="be", 0x20013}], 0x1, 0x5, 0xa, 0x14) mkdir(&(0x7f00000000c0)='my_debugfs\x00', 0x144) mount(0x0, &(0x7f0000000100)='my_debugfs\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='my_debugfs/asoc/dais\x00', 0x0, 0x0) 1m22.818440393s ago: executing program 32 (id=16): mkdirat(0xffffffffffffff9c, &(0x7f0000001580)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000015c0)='./proc\x00', &(0x7f0000001600)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001640)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000001680)='270', 0x3) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x204040, 0x0) pselect6(0x40, &(0x7f0000000000)={0x7, 0x1ff, 0x4, 0x7, 0x1, 0x2, 0x5, 0x9}, 0x0, &(0x7f0000000040)={0x9, 0x9, 0x401, 0x9, 0x6, 0x8000000000000001, 0xa94f, 0x2}, &(0x7f0000000080), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000980)='./sys\x00', 0x1ff) unshare(0x40000000) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) 1m22.022629126s ago: executing program 3 (id=166): syz_open_dev$usbfs(&(0x7f0000000040), 0x400, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendto(r0, &(0x7f0000000000)="240000003f0005000a0000000000000002020000000000000c0001006f76732d64703000", 0x24, 0x0, 0x0, 0x0) sendto(r0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) setsockopt$inet_mreqsrc(r1, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) 1m21.616656873s ago: executing program 3 (id=167): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000003c0)={0x73622a85, 0x110a, 0x4}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000540)=[@increfs]}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000580)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000005c0)={0x73622a85, 0x1000, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x8, 0x0, &(0x7f0000000640)=[@acquire]}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f00000006c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}]}) 1m21.569889746s ago: executing program 33 (id=167): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000003c0)={0x73622a85, 0x110a, 0x4}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000540)=[@increfs]}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000580)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000005c0)={0x73622a85, 0x1000, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x8, 0x0, &(0x7f0000000640)=[@acquire]}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f00000006c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}]}) 1m13.842869481s ago: executing program 0 (id=259): setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, &(0x7f0000000a00)={0xd}, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000004c40)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000880), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000a00)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a40)={0x0, 0x41, 0x4, 0x5, 0x1b, "b0bf2ebb48c849ac4000"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) read$FUSE(r2, &(0x7f0000000a80)={0x2020}, 0x2020) read$nci(r2, &(0x7f0000004b00)=""/106, 0x6a) 1m13.565509937s ago: executing program 34 (id=127): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x6d, 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x3, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c71b95a9847d2bdede66c6e3184c386faf938fd6db888e73a5c0dcc69c3de7458e68ed33226a8d1c8e17", 0x0, 0xb2}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x40000073, 0x0, 0x81}]}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m12.935957999s ago: executing program 0 (id=274): r0 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) r1 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x30, 0x0) landlock_restrict_self(r1, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="09000000040000000400000007"], 0x48) r3 = fsmount(r0, 0x1, 0xa) fchdir(r3) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)=@generic={&(0x7f0000000000)='./file0\x00', r2}, 0x18) 1m12.886554152s ago: executing program 0 (id=276): connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000440)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./bus\x00', 0x180) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x81c0, 0x80000001) mount$overlay(0x0, &(0x7f0000000200)='./bus\x00', &(0x7f0000000240), 0x8, &(0x7f0000000280)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) linkat(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0/file0\x00', 0x400) chdir(&(0x7f0000000340)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x8042, 0x34) 1m12.819928809s ago: executing program 0 (id=277): socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./dev/mtdblock0\x00', 0x42, 0x1ff) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, 0x0}, 0x68) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x27, &(0x7f0000000040)={0x0, 0x8e44, 0x1f400, 0x201, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1m12.71772321s ago: executing program 0 (id=278): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0xffffffffffffff14, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000640)=[{&(0x7f0000000080)="89e7ee2c67062f080700000088ca54", 0xf}], 0x1) 1m11.292476611s ago: executing program 0 (id=289): syz_emit_ethernet(0x4a, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd60e0ffac0014"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x7, 0x1, 0x41, 0xc3d, 0x0, 0x2004cb, 0xffffffffffffffff, 0xa1d, 0x7, 0x5, 0x79, 0x83, 0x2], 0x3332d000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xd000, 0xe000, 0x0, 0x77, 0x7, 0x3, 0xcb, 0x2, 0x0, 0x6, 0x6, 0x19}, {0xc000, 0x9000, 0x3, 0xeb, 0x2, 0x0, 0x0, 0xff, 0x7, 0x0, 0x3}, {0xeeee0000, 0x1000, 0x0, 0x0, 0x7, 0xc7, 0x40, 0x1, 0x45, 0x3, 0x4, 0xf9}, {0x1, 0x0, 0x9, 0x4, 0x81, 0x0, 0x9, 0x0, 0x3, 0x0, 0x9, 0x2}, {0x0, 0xffff1000, 0x4, 0x4, 0x0, 0x4, 0x0, 0x6, 0x2, 0x34, 0x4}, {0x3000, 0xffffffff, 0x0, 0x78, 0x8, 0x0, 0x2, 0x1c, 0xa3, 0xff, 0x5}, {0xeeee0000, 0x80a0000, 0xa, 0x4, 0x0, 0x0, 0x7, 0x21}, {0x0, 0x6000, 0x8, 0x0, 0xa4, 0x7, 0x8, 0x40, 0x26, 0x0, 0x0, 0xfe}, {0xf000, 0x3}, {0x3000, 0xfffd}, 0xddf8ffdb, 0x0, 0x0, 0x120, 0x0, 0x0, 0xdddd1000, [0x80000001, 0x0, 0xffffffffffffffff, 0xfffffffffffffffe]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m11.188740471s ago: executing program 35 (id=289): syz_emit_ethernet(0x4a, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd60e0ffac0014"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x7, 0x1, 0x41, 0xc3d, 0x0, 0x2004cb, 0xffffffffffffffff, 0xa1d, 0x7, 0x5, 0x79, 0x83, 0x2], 0x3332d000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xd000, 0xe000, 0x0, 0x77, 0x7, 0x3, 0xcb, 0x2, 0x0, 0x6, 0x6, 0x19}, {0xc000, 0x9000, 0x3, 0xeb, 0x2, 0x0, 0x0, 0xff, 0x7, 0x0, 0x3}, {0xeeee0000, 0x1000, 0x0, 0x0, 0x7, 0xc7, 0x40, 0x1, 0x45, 0x3, 0x4, 0xf9}, {0x1, 0x0, 0x9, 0x4, 0x81, 0x0, 0x9, 0x0, 0x3, 0x0, 0x9, 0x2}, {0x0, 0xffff1000, 0x4, 0x4, 0x0, 0x4, 0x0, 0x6, 0x2, 0x34, 0x4}, {0x3000, 0xffffffff, 0x0, 0x78, 0x8, 0x0, 0x2, 0x1c, 0xa3, 0xff, 0x5}, {0xeeee0000, 0x80a0000, 0xa, 0x4, 0x0, 0x0, 0x7, 0x21}, {0x0, 0x6000, 0x8, 0x0, 0xa4, 0x7, 0x8, 0x40, 0x26, 0x0, 0x0, 0xfe}, {0xf000, 0x3}, {0x3000, 0xfffd}, 0xddf8ffdb, 0x0, 0x0, 0x120, 0x0, 0x0, 0xdddd1000, [0x80000001, 0x0, 0xffffffffffffffff, 0xfffffffffffffffe]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m6.706411745s ago: executing program 4 (id=335): socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x3, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) accept4(r0, 0x0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000003c0)=@filter={'filter\x00', 0xe, 0x4, 0x398, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x2c8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x100, 0x128, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x1, 0xa, 0x10, 0x10, 0x10, 0x2710, 0xea60}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffb}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f8) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f00000007c0)={0xa, 0x1234, 0x0, @remote}, 0x1c) 1m6.624646539s ago: executing program 4 (id=336): r0 = epoll_create1(0x80000) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000140), 0x2) r2 = memfd_create(&(0x7f0000000180)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2) ftruncate(r2, 0xffff) fcntl$addseals(r2, 0x409, 0x3) close(0x3) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000340)={r2, 0x1, 0x0, 0x2000}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000000)={0xa000202b}) 1m6.576660413s ago: executing program 4 (id=338): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000000280)='GPL\x00', 0x2, 0xfd90, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xe, 0x4, &(0x7f00000004c0)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000000640)='GPL\x00', 0x4, 0xfd90, &(0x7f0000000680)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000780), 0x366, 0x10, &(0x7f00000007c0), 0x1dd}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000840)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r4}, &(0x7f00000008c0), &(0x7f0000000900)=r0}, 0x20) recvmsg$unix(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f00000009c0)=""/179, 0x33fe0}], 0x1}, 0x0) sendmsg$inet(r2, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000b00)='>', 0x33fe0}], 0x1}, 0x0) 1m6.520180854s ago: executing program 4 (id=339): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) mount$bpf(0x200000000000, 0x0, 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) unshare(0x22020600) mount$bpf(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000100), 0x10000, 0x0) 1m6.48546713s ago: executing program 4 (id=340): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000b40), 0x0, 0x0) sendmsg$NL80211_CMD_SET_MAC_ACL(0xffffffffffffffff, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000f80)={0x34, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004894}, 0x4000) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000010c0)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000001100)=[@text32={0x20, &(0x7f0000001140)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000001180)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m6.146319401s ago: executing program 4 (id=344): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x5, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x100}, 0x0) r3 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r3, 0x40106f52, &(0x7f0000000380)={0xa, &(0x7f00000000c0)=[{0x20, '\x00', @data, 0xfff}]}) 1m6.104354343s ago: executing program 36 (id=344): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x5, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x100}, 0x0) r3 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r3, 0x40106f52, &(0x7f0000000380)={0xa, &(0x7f00000000c0)=[{0x20, '\x00', @data, 0xfff}]}) 793.420969ms ago: executing program 6 (id=1067): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000500)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x10, 0x0) memfd_create(0x0, 0x4) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0xe, &(0x7f0000000540)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8fff7ff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b70500000000e000720a23fe000000008500000012000000b70000000000000095000000000000004e6258941c823b7505608556ba4ababb42684e890d31ae450400373a0a5447a801b8c1c4f0c4bd97c6555e61345400f9bd32abeb9ade0105000000000000a21902ff07000094a2b51c21df74924f5436a6ed89b98f75e800230c49c90fe1336481f3b92a63336c36fcd745d61d7739c6554ca201000000bebbe8282f8b1e26407437a397bf8f50e87ed4d27adfd876bffc402887781979461c4363bc5c9b6202ea471428197ef88bc333fbcec0ea4334f1ddb9d679ae95a90fd41d528f58d305000000435883df6c10ce86188c92292b2d0226082960be682836bdff8b0971f2a5405e453228e7b1005bd73479358a90df3e481947de6453736aa572158af6ea63d6d418fbbd2bba050000001da000ef78df03000000d19913a5fb03c79dac2e489f68127892658115e7ffb588a71dffffff951b8535167ab8069a2c92a3aa18e22517000026637b4c34bf2d0aa304ed42bf70480e9e97203fd169411f37fddd1f7fbe16dbbc0f307bceb5064f388a0350c3dc928b0e638b1e2b2a9d25264233e5d45eb377f56b95241024dbe30f67191c2b56b70328d6d3215dfffe5d89af1d10599bd494d921d1fb2db99b6aba0fa978f41eb1d4c553e5a9326ed550c13f8dd36716a899a1e79234294707c5312b924d142c17b20bb80ee202222c03fa84ccc374e717f694018630366397266090a82343aedfbf7afe892390c2eb775b0d16073da2229958db05de7df6ab7600004000010000006d8081cb3bf251d906c00da0e23b50465f8394820be571e3592d0000c7ef10fdc462e7040e7074ec43aa461fc54401a76406db718d4efd6c1bd10ce1d087cf9bba461162555a95524c84df0952d32093082b7aa71304e0d2d9ec310d1b676b378a5879e47941de1a28c3a8f400000000000000000e032b7d2badd0bc6617a859b7ac273b6304555f664469cec152030f06cc0ca1765838eb5590264736fbccfc3a8f4e3b10daf6a275daf5db2dac7096fe8ac8876acaad043663b3b0fedb05e6d31408fa20140c9d2db1c59ac8a3ce28e489d67d87d3a107ccea3007f58f2c5017e8807107f79ac50cc1d4f546b4443d137eb706b71b1767a10cca7a7c82b76c96e874aff249f36329a6526b354b6e674b08f7ef492b804c4b08fb10de807d79fd782027318cd7632e22d2faa16209272b39b5ec8d239832ea02cc88e249a2e77753a58987547571fbc8de747faab724bebb6401412b496e078fcb6c78ab447e871b76a8b0506f49594aa1d610567e14d739a60ff3ce04d0d2e5681e787c7e1ad25467bb81f2f440128207fe07a83759ec30cf9e0a3fd3f2fcee97fe8d273f8e712a8a64eaf2d89a1fa44554357fcd7ab531ff7a41c27164fca430a62d015b477de61853f5ee2e25b00a63642ec32ece2ff3bb5883deb895f52a923b5c744d8dccdd6a09ded8b90f1eeda8e6e884a4f090edb6ab9fc8107846508d51f3735493d5860cf80200ce31b92eb3563d485b5a7d192092d7a9fd2bc67d305d1d4573aad5f6501d1cd27657ce17330402dacb78d72d776330711645eed7d4c292f4448733c0826c4eb950f3d40453f82d7f792d106518f6bde874aff9e2bea7d73f74bebeeacfc700000000000000000000d40d73be47803297db004264c8c70b7761b22a7114a078a87d63d63b0c9dcc263a5b773bfeba212abef4181ad9e4872e328c0f105d51e3d167a2b717051d7681ba04552eeba18a000000b22b50d76d85040c9000ea68a528049a60d5e26b20455194f4be3b8466fd66d0e6cefcff7891c485d61cb66f4076cd60a22733cb00cf7cc12ca7d9bb864c0e650236a79a5c85349a9b1e6bbc3bace197e72490c566431cd3a08e9d1b641c1ba1f661d01573b904c3fa1427370fa15cecd294ac21fefe3d161fdf58e8bc5957ef145839f4370176e1be88d2e3516a1998c1621a00b4438b85a4dfee6f61827a1e50e158038b037dfda3ffb35069e41fc740ae720800de53948f176c3c15f3a529c02434b920d87f12a6e3420a2fdcb3559e7a5b1ddbb06b7a5977f63bfac701e673bf626d126b213c92e7169a930beb8d76f9db34e8098bea301baa96916d6458c923866dc192928b320738d1b298fb55f2a64500000000000000000000000000509885a38d9d995a46817e7ff7acddcc5f9253c63f86baf33f92820c9ff497cf76b6482c3ab53fb6ecea6d220b91b99b2fb4279ab09ae0645ab92df309000000000000a4868411948f8e3e259f717d722a1eebd3f6860a17f1ae9e10a1178f6aef4951b192d13e9600c1f700ca7b1d127e451034469bf2a8f93dbae6ad8e932e431dc18323794156238625bb9c45c5a76a68a8646e701b29a71ffbd854f50f195833106a5625ff94221f1f04c72525b50aae69081de9626de9847bf53475d90642d9730101d80b1b0000000000000000822b0641698d60160d9157548302dd2636d12c431f96728ae4a45361e6d47a1c4a52d67c0f0a62585c09fcfd70d0f249f87c44b47283c1c6f2430d70c751e4ada9b646e6e7c1719faee476d88a2943c71a21da55b7497dd7ed385ac2e8cb916390a3a0ed52e7371e1a141e69afa07b46ac20f3521fb251b72c82ee1c7eb4f67c0deed5618d0db925ce7a7c50a99835544c540f5d528587d1a26e78df1bc9a8e4d90c57d0b8122eae7b23e4456624f5337c16c42648c7a3d0b799ad409befe0cbe2aa781ba826918df7aa80dff4f62258e54419629eb1d37de7f6a3512bd618781d1ad3a4d4b0da44df9f9a93f0487f79a9b16dfa6f68b06ce6a96ca344d194cded05702c2300d1a4f451b33830765f8131f6c28fada65701851bba089b8a8347900e72d68cea965feb6a06225dd3f0e135323a5bde3b43c9d242b73abf9e05336af040a4a6bb5918146393f1d50705c1d1e986bf2f690de51ee8727d37339df5fc1db535bb1e9bb3e5dadb6e5a2bb4faa2dcbc6ca9b40ac96e448b9dadeb08fc2cf3a960f22bf20b9e967b7a75687372b8e3edc543896c360674d901a7f56b07ba1479b46eea3d94026a9c7e670ab40bb2c1ca1a7c90299361239bef773140af974c7efc285a64633d21513481b3ac62dec9fa3e8ce6156d76b82baa145bc550b0ccbc0934ccfea45292caa2f0654fe18dc0669a4f2af9fa232a293ad94261f55675cc686db72783a6bacc0df6a1ea943ae266af112f35319980cd681811a369e0d03cf7d22bed7cbe1afe498b88942b1bf7edae441a0d0d88fce65cb4e848793a28cbd7373f6acd3b5a48c034e487750388929d37fa3165f205dab3be5f3e5781a84298687cbf02dcaf0e14a2b260293f349d076eb75a2ddc5382d106f0beea02aa45018fe36d1176cf7704383b6922d10dc9feca3982ae232d4bb47c722c83a7cf6ee8832f038b072eb803a47cd7f753e80c9f6eedb89ee1c95361debf58f671170cfa57fb0c9cbad5c70244a2b6de2062cbd1ba2c85f73689d3ffcd37022ab9fcabd17fd40bfd316088dffe92728016ec5c72e21da52d09f849ab4a4b2d9b4799bab3a6d7f2ba57e100e7ffec0bd4c0659ebaf7b225edaa0af3f5aa99d1551d34b2d2faf0971dbe852142088b1c9b052e1177c47365d950e22c2b04283f62fec31837b5068dab60c5c2c1547acd52ab5e5cde41d24563b05e223e2aafe2c55ba3001d12e4de86597487e99c3b2bf193d7d6d0821481c16fd7cece5df2567182ca1ad6028028bf9f72d503b3d70e1c3c4b5e73ac286abb2b3b069f2ccda4c6a7a3759302b02034e8217b4ecdb9f1118a4117fd49d5467a84b70fae675af118bd885ee7798782765438caaf69856e236bf4b37bff5f971df3fd5e03a9ea39d5397b4e5c5a0d7eacf2"], &(0x7f0000001080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x8, &(0x7f00000010c0)={0x0, 0x4}, 0x22f, 0x10, 0x0, 0xff6a}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001100)={r0, 0x300f000, 0xe, 0x88a8, &(0x7f0000001180)="0069c2704ade28eddb0000200000", 0x0, 0x48b8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) capset(0x0, 0x0) add_key(0x0, 0x0, &(0x7f00000013c0), 0x0, 0xffffffffffffffff) openat(0xffffffffffffffff, 0x0, 0x26001, 0x101) write(0xffffffffffffffff, 0x0, 0x0) 745.828449ms ago: executing program 8 (id=1069): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r0, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r3, r1, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f0000000200)={0x28, 0x0, r3, r4, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) ioctl$IOMMU_HWPT_INVALIDATE$TEST(r0, 0x3b8d, &(0x7f0000000280)={0x20, r5, &(0x7f00000002c0)=[{}], 0xdeadbeef, 0x8, 0x1}) ioctl$IOMMU_DESTROY$hwpt(r0, 0x3b80, &(0x7f0000000300)={0x8, r5}) ioctl$IOMMU_DESTROY$hwpt(r0, 0x3b80, &(0x7f0000000340)={0x8, r4}) ioctl$IOMMU_GET_HW_INFO(r0, 0x3b8a, &(0x7f0000000380)={0x24, 0x0, r3, 0x1c, &(0x7f00000003c0)=""/28}) ioctl$IOMMU_DESTROY$stdev(r0, 0x3b80, &(0x7f0000000400)={0x8, r2}) ioctl$IOMMU_DESTROY$ioas(r0, 0x3b80, &(0x7f0000000440)={0x8, r1}) close(r0) 742.311846ms ago: executing program 6 (id=1070): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000240)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xef-\xa6m\xa1\xc4\xb5{\xf2\\\x8d[7k~\x04\x03~K\xfbP\x84=\xfa\x81\x8c\x1et\x10', 0x0) pwrite64(r0, &(0x7f00000008c0)='/', 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) lseek(r0, 0x0, 0x4) sendfile(r0, r0, &(0x7f00000001c0), 0x7fa) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f00000000c0)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file1\x00', 0x880cc2, 0x20) 673.340493ms ago: executing program 8 (id=1071): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller0\x00', 0x1}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000240)={'syzkaller0\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@newtfilter={0x4c, 0x2c, 0xd3f, 0x4070bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x5, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x9, 0xffffffff}]}}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x24000804) sendmsg$kcm(r6, &(0x7f00000004c0)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000580)=[{&(0x7f00000005c0)='\'', 0x1}], 0x1}, 0x20004014) 669.263933ms ago: executing program 6 (id=1072): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) io_setup(0x40, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x1070bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000cc0)=@newtfilter={0x90, 0x2c, 0xd27, 0x70bd2a, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x57f}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x4e3, 0xca0b, 0x6, 0x3}, 0x2}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x40800}, 0x44000) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r6, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 642.33966ms ago: executing program 6 (id=1073): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/module/md_mod/parameters/new_array\x00', 0x101081, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x105042, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r1, 0x400c0930, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl(r1, 0x928, 0x0) 592.853113ms ago: executing program 8 (id=1074): r0 = socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newtfilter={0x34, 0x2c, 0xd3f, 0x30bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0x3}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r7, {0xc, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x10004000}, 0x4041080) 592.624331ms ago: executing program 6 (id=1075): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x5, 0x12, r0, 0x0) syz_usb_connect(0x6, 0x0, 0x0, 0x0) r1 = socket(0x1d, 0x2, 0x6) r2 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000380)={'vxcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000400)={0x1d, r3, 0x3}, 0x18) syz_genetlink_get_family_id$mptcp(&(0x7f0000000500), r1) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x4005}, 0x2000011) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000640)={'vxcan1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@newtfilter={0x24, 0x11, 0x1, 0x70bd27, 0x25dfdbfa, {0x0, 0x0, 0x74, r5, {0x0, 0xa}, {0xfff1, 0x9}, {0x9, 0x8}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x46}, 0x20004844) 564.41682ms ago: executing program 8 (id=1076): r0 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_syzos={0x136, 0x74, {0x0, 0x10, [@code={0xa, 0x1b, {"49bf563412efbeadde00"}}, @uexit={0x0, 0x18, 0x1}, @code={0xa, 0x21, {"4c89f848ba0001040000000000488902"}}]}}, @nested_vmlaunch={0x12f, 0x18}, @code={0xa, 0x1b, {"49bf0000000000000000"}}, @nested_vmresume={0x130, 0x18}], 0xef}) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$x86(r3, r5, 0x100000000000001) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$x86(r3, r5, 0x1deadbeef123456) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$x86(r3, r5, 0xffffffffffffffff) 540.836374ms ago: executing program 8 (id=1077): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0x1}, {}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x4}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xfffffffa, 0x2, 0x10000000, 0x8, 0x3}}]}, {0x4, 0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syzkaller0\x00', 0xb) sendto$inet(r4, 0x0, 0x0, 0x0, &(0x7f0000000900)={0x2, 0x4e20, @loopback}, 0x10) 489.085482ms ago: executing program 8 (id=1078): fcntl$setstatus(0xffffffffffffffff, 0x4, 0x2000) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r4, 0x0) ftruncate(r4, 0xc17a) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0xc, 0x30c9}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001640)=@newqdisc={0x78, 0x24, 0xd0f, 0x70bd2c, 0x25dfdbfc, {0x60, 0x0, 0x0, r3, {0x0, 0xf}, {0xffe0, 0xa}, {0xfff3, 0xe}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4c, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0x1889}, @TCA_TBF_RATE64={0xc, 0x4, 0xb78fea3163f663ab}, @TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0x0, 0xfffa, 0x9, 0x9, 0x4}, {0x71, 0x2, 0x5, 0x8, 0x7, 0x101}, 0x0, 0x7, 0x1aa2}}, @TCA_TBF_PRATE64={0xc, 0x5, 0xf0cda79ea301acfa}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0xc5}, 0xc010) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) 330.25824ms ago: executing program 5 (id=1079): bpf$MAP_CREATE(0x0, 0x0, 0x50) socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) syz_emit_ethernet(0x3e, 0x0, 0x0) accept4$phonet_pipe(0xffffffffffffffff, 0x0, 0x0, 0x800) r0 = socket(0x2, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r1}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0x4, 0xfff3}, {0x0, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x48080}, 0x0) 281.657982ms ago: executing program 5 (id=1081): socket$alg(0x26, 0x5, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000240)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000580)=[{{&(0x7f00000005c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000640)=[{&(0x7f00000006c0)=""/100, 0x365}, {&(0x7f0000000740)=""/85, 0x7c}, {&(0x7f00000007c0)=""/4096, 0x197}, {&(0x7f00000017c0)=""/106, 0x645}, {&(0x7f0000001840)=""/73, 0x1b}, {&(0x7f00000018c0)=""/77, 0x14}, {&(0x7f0000001940)=""/154, 0x21}, {&(0x7f0000001a00)=""/17, 0x1d8}], 0x21, &(0x7f0000001a40)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000001b00)={0x77359400}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fff000/0x1000)=nil, &(0x7f00000b0000/0x4000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f00003b6000/0x4000)=nil, &(0x7f00000e3000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000060000/0x3000)=nil, &(0x7f00000e0000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f00000f8000/0x3000)=nil, &(0x7f000003b000/0x4000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x240440c5) r1 = io_uring_setup(0x1e64, &(0x7f0000000040)={0x0, 0xc89a, 0xc000, 0x7fff, 0x65}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0xfff0}, {0xe, 0xffff}}}, 0x24}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 264.970057ms ago: executing program 5 (id=1082): bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="000000000400000900000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="02000000040000000800"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b70800000c300000638af8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb7020000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x800000, 0x0) chdir(0x0) r1 = socket(0x1, 0x3, 0x0) bind$unix(r1, &(0x7f00000002c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, 0x0) socket(0x1a, 0x80000, 0x400) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) accept$packet(r1, 0x0, 0x0) 222.561928ms ago: executing program 5 (id=1084): pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r2, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) writev(r1, &(0x7f0000010b40)=[{&(0x7f0000000180)="5abbe3", 0x3}], 0x1) splice(r1, 0x0, r0, 0x0, 0x2, 0x0) 168.021457ms ago: executing program 5 (id=1085): socket$can_raw(0x1d, 0x3, 0x1) socket$can_bcm(0x1d, 0x2, 0x2) socket$igmp6(0xa, 0x3, 0x2) socket$packet(0x11, 0x2, 0x300) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="6400000002060103000000000000000000000000050001000700000016000300686173683a6e65742c706f72742c6e65740000000900020073797a30000000000500040000000000050005000a00000014000780080012400000000005001500", @ANYRES16=r0], 0x64}, 0x1, 0x0, 0x0, 0x24008801}, 0x0) 164.641039ms ago: executing program 5 (id=1086): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x30, r1, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x90) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0xc) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000200)={0x2, 0x4e22, @loopback}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x28, r6, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1a}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x8) 124.104826ms ago: executing program 7 (id=1087): socket(0x10, 0x803, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmc(&(0x7f0000000200), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xee7, 0x1000002, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl(r2, 0xc048aeca, 0x0) 120.963708ms ago: executing program 7 (id=1088): socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x88}, 0x80) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$sw_sync(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40000001, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 61.023157ms ago: executing program 7 (id=1089): pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r2, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) writev(r1, &(0x7f0000010b40)=[{&(0x7f0000000180)='Z', 0x1}], 0x1) splice(r1, 0x0, r0, 0x0, 0x2e93, 0x0) 60.854316ms ago: executing program 6 (id=1090): setitimer(0x0, &(0x7f0000000580)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) r0 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) mkdir(&(0x7f0000000140)='./control\x00', 0x111) close(r0) r1 = inotify_init1(0x800) fcntl$setstatus(r0, 0x4, 0x2c00) r2 = gettid() fcntl$setown(r0, 0x8, r2) fcntl$setsig(r1, 0xa, 0xe) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) rt_sigtimedwait(&(0x7f0000000040)={[0xffffffffffff7ff8]}, 0x0, 0x0, 0x8) inotify_add_watch(r1, &(0x7f0000000180)='./control\x00', 0xa4000960) rmdir(&(0x7f0000000100)='./control\x00') 53.823731ms ago: executing program 7 (id=1091): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_GROUP={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xd0}}, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f00000003c0)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000004c0), 0xffffffffffffffff) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000780)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)={0x28, r3, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) 24.155589ms ago: executing program 7 (id=1092): open_tree(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x9101) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x1f6, 0x4) sendmmsg$inet(r0, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e24, @empty}, 0x10, 0x0}}], 0x1, 0x4000800) 0s ago: executing program 7 (id=1093): r0 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000440)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000004c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000600)=@abs, 0x6e) sendmmsg$unix(r3, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000700)=0x6) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000200)={0x6, @remote, 0x5000, 0x0, 'rr\x00', 0x4, 0x0, 0xffffffff}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000240)={{0x6, @remote, 0x5000, 0x0, 'rr\x00', 0x0, 0x0, 0xffffffff}, {@rand_addr=0x64010100, 0x5000, 0x2000, 0x1}}, 0x44) syz_emit_ethernet(0x36, &(0x7f00000002c0)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @remote}, {{0x1234, 0x5000, 0x1, 0x0, 0x0, 0x0, 0x5, 0x2, 0x1000}}}}}}, 0x0) 0s ago: executing program 7 (id=1094): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0xfffffffa, 0x6, 0x0, 'queue1\x00', 0x5}) writev(r0, &(0x7f0000000280)=[{&(0x7f00000002c0)="268292", 0xff95}], 0x1) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x7, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}, 'macvlan1\x00'}}, 0x1e) sendmmsg(r2, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}}], 0x1, 0x8000) clock_getres(0x9, 0x0) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="040e06e80d08"], 0x9) ioctl$KDFONTOP_SET(r1, 0x4b72, &(0x7f0000000180)={0x4, 0xfffffffb, 0xe, 0x13, 0x100, &(0x7f0000000400)="387ed7626d850509a2d6c1aa38f15cd00f85c263cb226db671261fff7ce9c555f18dafae3530db6dd493f2a3cc88721b9ae21b3e3b4523ae2594f47d8f62b480c4160b1f90ac9c41fae6ab12ac4c113fef588684ef494c89092883b902a41cd75387ef6f7bc7d460d5e665f398ff95596dc94ec97003c7e6f3c82fbd8de6e11aa4031a61c51caf7a65a2b613bda33f3eaeae635d7cd81761e74c38a7695800a15516eb337056e02335f9a7d10aa2eaf7beb7e1aed6e850ecb3421143c5c4ded0f06affc524dcf3208272619b6a952db5bc96141b26c54d13c7a5416287a3b6f7aadf50bc549974b6401a19cdb130282b955592efa94242865a4c8d695a2cdd9ada350defd58c775b92d348305774d3a256c7520b285d8da0dbf5e20d604413ed2ddf9bb0f881caf811852806175d63892a15234fbcd7a88a2a0a0000000048f0e7dada7d6d0d77881387fdeaa0284abe90b88dff64e1bff40c31c6415c54ae3335e54a49d315851feffe30d999c36def4df7df747695efbd649f42f310859122c0d2c1e558dc6586958a283762386ecf369274e43003a0fdff59ea515eb44521901ef0d00baa91c10a8e44a36aac3468a15bd3d45ad389977467f306f9bcde071b30769795eed2f1580414d168f557cd90040c4bd2a3d6bc5092548feaef7204a12cece59181fcb5bad8c24bd9f8f78d17ab82831325501e80d899e9252f99d3a2666343392fda11504800f4dd9f45657f8224fc78eb1168fe0527fac33466aadf48f16994d29a47778566e0f3945b2bf36b6eecc7fa18914beb66ac9e519bd333b30d3ce2f50dddeea3447aebbe3bed781e39d5a0fb0cdc60e196f2261305feb596b68986af3eee7b199fefb5f79ffb2d1050e46982af1c14a88dd9000400002f56a8404755c73e74bb90e64bab9647c70ed5afca1c3d87907d14df8aa9df6f40a80ace2bb8a2aad3b0c66915927db4233181943d88c0c76d5969e2043db5bd77fd60ba0f013139929ccfec96020000000000000032ba1f0875e3146afef5b20cc306d3ecee65944fe9829e0ad0c3f6bb2fd81bc31152538db50f47dc38ba908a0d808687e478fdffffffffffffff813e1dba9c3c16e9fab3bda6ed33cb1c75513e2264b69d472dd0e1338688ba782b41bde141f99c4894ded98eff9aa53d22eb77c9d93169c04ab2490bf28106f770e07eb7a9e87dde71929f918b98c4cbfcb11a90139264a9ee8081973167f493760278df0cc34be9e8f86f948d9a62e63ad6ca9d2195ff9c6320c85bddc42915e4f3a5db642c47bc2195a3d64e04c9ecd1c313c08e29b814bd8fed1ab6d2846c73345962895d289ac77152cac2e0e32b75ce814731c542091f218dd1e68a15f8226577bf9481ae0555db64a717eb23a811356d000000000000000000000000000000000000000000ff00"}) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x2) ioctl$SNDRV_TIMER_IOCTL_GINFO(r3, 0xc0f85403, &(0x7f0000000300)={{0x1, 0x0, 0x0, 0x3}, 0x2000000, 0x0, 'id0\x00', 'timer0\x00'}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x48041) kernel console output (not intermixed with test programs): atadv_slave_1 (retrying later): interface not active [ 75.223097][ T6773] hsr_slave_0: entered promiscuous mode [ 75.223642][ T6773] hsr_slave_1: entered promiscuous mode [ 75.250884][ T41] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 75.261950][ T42] audit: type=1400 audit(1792484873.791:521): avc: denied { write } for pid=6864 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.336926][ T42] audit: type=1400 audit(1792484873.861:522): avc: denied { write } for pid=6867 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.380929][ T6773] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 75.389799][ T6773] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 75.390595][ T5441] 8021q: adding VLAN 0 to HW filter on device eth12 [ 75.390707][ T6773] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 75.396310][ T6773] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 75.403228][ T6773] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 75.409556][ T6773] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 75.410522][ T6773] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 75.416597][ T6773] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 75.427554][ T41] usb 9-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 75.428343][ T41] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 75.428368][ T41] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 75.428381][ T41] usb 9-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 75.428400][ T41] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.480677][ T5739] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 75.487457][ T5739] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 75.487813][ T5739] Bluetooth: hci0: command 0x0419 tx timeout [ 75.487946][ T5730] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 75.488057][ T6773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.489289][ T5730] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 75.489550][ T5730] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 75.512998][ T6773] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.516853][ T208] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.516899][ T208] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.527477][ T208] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.527565][ T208] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.560324][ T42] audit: type=1400 audit(1792484874.091:523): avc: denied { write } for pid=6879 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.607945][ T5784] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 75.607967][ T5784] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.647472][ T42] audit: type=1400 audit(1792484874.181:524): avc: denied { create } for pid=6861 comm="syz.4.288" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 75.660522][ T6773] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 75.717917][ T5784] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 75.717938][ T5784] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.727818][ T42] audit: type=1400 audit(1792484874.261:525): avc: denied { write } for pid=6888 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.830264][ T5784] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 75.830295][ T5784] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.869229][ T42] audit: type=1400 audit(1792484874.401:526): avc: denied { ioctl } for pid=6861 comm="syz.4.288" path="socket:[18876]" dev="sockfs" ino=18876 ioctlcmd=0x6181 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 75.880174][ T5441] 8021q: adding VLAN 0 to HW filter on device eth13 [ 75.969210][ T41] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 75.969223][ T41] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 75.970728][ T41] cxacru 9-1:1.0: probe with driver cxacru failed with error -71 [ 75.972700][ T41] usb 9-1: USB disconnect, device number 3 [ 75.981653][ T5784] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 75.981673][ T5784] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.058995][ T6877] rxe_eth0 speed is unknown, defaulting to 1000 [ 76.167617][ T5784] bridge_slave_1: left allmulticast mode [ 76.167635][ T5784] bridge_slave_1: left promiscuous mode [ 76.167745][ T5784] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.171682][ T5784] bridge_slave_0: left allmulticast mode [ 76.171696][ T5784] bridge_slave_0: left promiscuous mode [ 76.172416][ T5784] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.252749][ T6919] faux_driver vgem: [drm] Unknown color mode 9; guessing buffer size. [ 76.262590][ T5784] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 76.264937][ T5784] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 76.265766][ T5784] bond0 (unregistering): Released all slaves [ 76.290786][ T6773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.449258][ T5441] 8021q: adding VLAN 0 to HW filter on device eth15 [ 76.532956][ T6877] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.533006][ T6877] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.533065][ T6877] bridge_slave_0: entered allmulticast mode [ 76.533870][ T6877] bridge_slave_0: entered promiscuous mode [ 76.535839][ T6877] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.536216][ T6877] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.536300][ T6877] bridge_slave_1: entered allmulticast mode [ 76.543294][ T6877] bridge_slave_1: entered promiscuous mode [ 76.592896][ T6948] kvm: Disabled LAPIC found during irq injection [ 76.592906][ T6948] kvm: apic: phys broadcast and lowest prio [ 76.621302][ T6877] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 76.623122][ T6877] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 76.673585][ T6877] team0: Port device team_slave_0 added [ 76.675805][ T6877] team0: Port device team_slave_1 added [ 76.675891][ T6773] veth0_vlan: entered promiscuous mode [ 76.686394][ T5784] hsr_slave_0: left promiscuous mode [ 76.689236][ T5784] hsr_slave_1: left promiscuous mode [ 76.689631][ T5784] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 76.689642][ T5784] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 76.691572][ T5784] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 76.691583][ T5784] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 76.702176][ T5784] veth1_macvtap: left promiscuous mode [ 76.702199][ T5784] veth0_macvtap: left promiscuous mode [ 76.702255][ T5784] veth1_vlan: left promiscuous mode [ 76.702285][ T5784] veth0_vlan: left promiscuous mode [ 76.780079][ T10] cfg80211: failed to load regulatory.db [ 77.083514][ T5441] 8021q: adding VLAN 0 to HW filter on device eth14 [ 77.084421][ T6877] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.084431][ T6877] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.084444][ T6877] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.085301][ T6877] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.085308][ T6877] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.085321][ T6877] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.101303][ T6773] veth1_vlan: entered promiscuous mode [ 77.133586][ T6877] hsr_slave_0: entered promiscuous mode [ 77.134027][ T6877] hsr_slave_1: entered promiscuous mode [ 77.134356][ T6877] debugfs: 'hsr0' already exists in 'hsr' [ 77.134367][ T6877] Cannot create hsr debugfs directory [ 77.195849][ T6773] veth0_macvtap: entered promiscuous mode [ 77.227220][ T6773] veth1_macvtap: entered promiscuous mode [ 77.247148][ T5730] Bluetooth: hci2: command tx timeout [ 77.274896][ T6773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.286853][ T6773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.396598][ T6877] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 77.408865][ T6877] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 77.416065][ T6109] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.416077][ T6109] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.423309][ T6877] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 77.429067][ T6877] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 77.429567][ T6877] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 77.434234][ T6877] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 77.435811][ T6877] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 77.444832][ T6877] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 77.447587][ T5828] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.478457][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.478472][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.482139][ T6985] FAULT_INJECTION: forcing a failure. [ 77.482139][ T6985] name failslab, interval 1, probability 0, space 0, times 0 [ 77.482176][ T6985] CPU: 2 UID: 0 PID: 6985 Comm: syz.4.304 Tainted: G L syzkaller #0 PREEMPT(full) [ 77.482192][ T6985] Tainted: [L]=SOFTLOCKUP [ 77.482196][ T6985] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.482202][ T6985] Call Trace: [ 77.482206][ T6985] [ 77.482210][ T6985] dump_stack_lvl+0x100/0x190 [ 77.482269][ T6985] should_fail_ex.cold+0x5/0xa [ 77.482305][ T6985] should_failslab+0xc2/0x120 [ 77.482352][ T6985] __kmalloc_cache_noprof+0x91/0x6d0 [ 77.482365][ T6985] ? string+0x201/0x4d0 [ 77.482390][ T6985] ? format_decode+0x1ad/0xdd0 [ 77.482405][ T6985] ? tomoyo_init_log+0x1a0/0x20c0 [ 77.482433][ T6985] tomoyo_init_log+0x1a0/0x20c0 [ 77.482451][ T6985] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 77.482473][ T6985] ? vsnprintf+0x4c5/0x1300 [ 77.482493][ T6985] ? __pfx_tomoyo_init_log+0x10/0x10 [ 77.482509][ T6985] ? tomoyo_profile+0x47/0x60 [ 77.482522][ T6985] ? tomoyo_domain_quota_is_ok+0x367/0x580 [ 77.482540][ T6985] tomoyo_supervisor+0x506/0x1340 [ 77.482560][ T6985] ? __pfx_tomoyo_supervisor+0x10/0x10 [ 77.482581][ T6985] ? tomoyo_realpath_from_path+0x19c/0x690 [ 77.482595][ T6985] ? tomoyo_check_path_number_acl+0x1e6/0x2f0 [ 77.482616][ T6985] tomoyo_path_number_perm+0x445/0x580 [ 77.482632][ T6985] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 77.482654][ T6985] ? find_held_lock+0x2b/0x80 [ 77.482671][ T6985] ? d_splice_alias_ops+0x2e8/0x1350 [ 77.482693][ T6985] ? current_check_access_path+0x262/0x420 [ 77.482711][ T6985] ? simple_lookup+0xfc/0x1d0 [ 77.482727][ T6985] ? lookup_one_qstr_excl+0xaf/0x250 [ 77.482741][ T6985] tomoyo_path_mkdir+0x9b/0xe0 [ 77.482753][ T6985] ? __pfx_tomoyo_path_mkdir+0x10/0x10 [ 77.482766][ T6985] ? lock_acquire+0x1d1/0x380 [ 77.482781][ T6985] security_path_mkdir+0x154/0x2e0 [ 77.482794][ T6985] filename_mkdirat+0x168/0x5e0 [ 77.482812][ T6985] ? __pfx_filename_mkdirat+0x10/0x10 [ 77.482829][ T6985] ? strncpy_from_user+0x19d/0x2d0 [ 77.482848][ T6985] ? do_getname+0x191/0x390 [ 77.482860][ T6985] __x64_sys_mkdirat+0x89/0xc0 [ 77.482877][ T6985] do_syscall_64+0x123/0x790 [ 77.482895][ T6985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.482907][ T6985] RIP: 0033:0x7f92df19e559 [ 77.482917][ T6985] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.482927][ T6985] RSP: 002b:00007f92e00a9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 77.482939][ T6985] RAX: ffffffffffffffda RBX: 00007f92df425fa0 RCX: 00007f92df19e559 [ 77.482946][ T6985] RDX: 00000000000001ff RSI: 00002000000007c0 RDI: ffffffffffffff9c [ 77.482953][ T6985] RBP: 00007f92df235b20 R08: 0000000000000000 R09: 0000000000000000 [ 77.482959][ T6985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 77.482965][ T6985] R13: 00007f92df426038 R14: 00007f92df425fa0 R15: 00007ffed521fb88 [ 77.482980][ T6985] [ 77.508807][ T5828] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.544287][ T6877] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.564978][ T6877] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.567172][ T5730] Bluetooth: hci1: command tx timeout [ 77.583805][ T6109] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.583890][ T6109] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.592268][ T6109] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.592355][ T6109] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.629027][ T5441] 8021q: adding VLAN 0 to HW filter on device eth16 [ 77.648183][ T6999] EXT4-fs warning (device sda1): verify_group_input:136: Cannot add at group 4294967295 (only 8 groups) [ 77.668488][ T13] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.668520][ T13] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.698268][ T1349] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 77.733083][ T5730] Bluetooth: hci2: connection err: -111 [ 77.860736][ T5441] 8021q: adding VLAN 0 to HW filter on device eth17 [ 77.868867][ T1349] usb 10-1: Using ep0 maxpacket: 32 [ 77.870156][ T1349] usb 10-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 77.871174][ T1349] usb 10-1: config index 0 descriptor too short (expected 29220, got 36) [ 77.871194][ T1349] usb 10-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 77.871211][ T1349] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 77.871249][ T1349] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 77.871267][ T1349] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 77.871286][ T1349] usb 10-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 77.871317][ T1349] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.874312][ T1349] usb 10-1: config 0 descriptor?? [ 77.919407][ T6877] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.082551][ T1349] usblp 10-1:0.0: usblp0: USB Bidirectional printer dev 3 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 78.102364][ T6877] veth0_vlan: entered promiscuous mode [ 78.105470][ T6877] veth1_vlan: entered promiscuous mode [ 78.128048][ T6877] veth0_macvtap: entered promiscuous mode [ 78.130936][ T6877] veth1_macvtap: entered promiscuous mode [ 78.142288][ T6877] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.151170][ T6877] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.153669][ T13] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.153791][ T13] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.153822][ T13] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.244277][ T6109] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.244299][ T6109] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.264386][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.264399][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.277522][ T5784] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.292305][ T29] usb 10-1: USB disconnect, device number 3 [ 78.303528][ T29] usblp0: removed [ 78.318676][ T7051] __nla_validate_parse: 6 callbacks suppressed [ 78.318688][ T7051] netlink: 8 bytes leftover after parsing attributes in process `syz.4.311'. [ 78.318697][ T7051] netlink: 8 bytes leftover after parsing attributes in process `syz.4.311'. [ 78.357798][ T7056] netlink: 12 bytes leftover after parsing attributes in process `syz.7.290'. [ 78.419752][ T7059] input: syz0 as /devices/virtual/input/input6 [ 78.513228][ T7064] rxe_eth0 speed is unknown, defaulting to 1000 [ 78.865438][ T7083] netlink: 28 bytes leftover after parsing attributes in process `syz.5.316'. [ 78.865457][ T7083] netlink: 28 bytes leftover after parsing attributes in process `syz.5.316'. [ 78.865466][ T7083] netlink: 8 bytes leftover after parsing attributes in process `syz.5.316'. [ 79.204016][ T42] kauditd_printk_skb: 36 callbacks suppressed [ 79.204038][ T42] audit: type=1400 audit(1792484877.731:562): avc: denied { write } for pid=7105 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 79.208283][ T7107] FAULT_INJECTION: forcing a failure. [ 79.208283][ T7107] name failslab, interval 1, probability 0, space 0, times 0 [ 79.208306][ T7107] CPU: 2 UID: 0 PID: 7107 Comm: syz.7.325 Tainted: G L syzkaller #0 PREEMPT(full) [ 79.208322][ T7107] Tainted: [L]=SOFTLOCKUP [ 79.208327][ T7107] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 79.208345][ T7107] Call Trace: [ 79.208352][ T7107] [ 79.208357][ T7107] dump_stack_lvl+0x100/0x190 [ 79.208420][ T7107] should_fail_ex.cold+0x5/0xa [ 79.208443][ T7107] should_failslab+0xc2/0x120 [ 79.208485][ T7107] __kmalloc_noprof+0xfc/0x840 [ 79.208500][ T7107] ? lsm_blob_alloc+0x68/0x90 [ 79.208524][ T7107] lsm_blob_alloc+0x68/0x90 [ 79.208539][ T7107] security_prepare_creds+0x2d/0x290 [ 79.208552][ T7107] prepare_creds+0x5d6/0x950 [ 79.208572][ T7107] prepare_exec_creds+0x10/0x240 [ 79.208584][ T7107] bprm_execve+0xc0/0x1940 [ 79.208598][ T7107] ? do_raw_spin_lock+0x128/0x260 [ 79.208613][ T7107] ? alloc_bprm+0x54e/0x9e0 [ 79.208632][ T7107] ? alloc_bprm+0x54e/0x9e0 [ 79.208646][ T7107] ? __pfx_bprm_execve+0x10/0x10 [ 79.208660][ T7107] ? copy_string_kernel+0x339/0x3f0 [ 79.208678][ T7107] do_execveat_common.isra.0+0x4a5/0x580 [ 79.208695][ T7107] __x64_sys_execve+0x93/0xd0 [ 79.208711][ T7107] do_syscall_64+0x123/0x790 [ 79.208741][ T7107] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.208753][ T7107] RIP: 0033:0x7fbceab9e559 [ 79.208763][ T7107] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.208774][ T7107] RSP: 002b:00007fbcebb12028 EFLAGS: 00000246 ORIG_RAX: 000000000000003b [ 79.208787][ T7107] RAX: ffffffffffffffda RBX: 00007fbceae25fa0 RCX: 00007fbceab9e559 [ 79.208794][ T7107] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000002c0 [ 79.208801][ T7107] RBP: 00007fbceac35b20 R08: 0000000000000000 R09: 0000000000000000 [ 79.208808][ T7107] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 79.208814][ T7107] R13: 00007fbceae26038 R14: 00007fbceae25fa0 R15: 00007ffe98d230d8 [ 79.208829][ T7107] [ 79.240427][ T42] audit: type=1400 audit(1792484877.771:563): avc: denied { block_suspend } for pid=7109 comm="syz.7.326" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 79.332775][ T5730] Bluetooth: hci2: command tx timeout [ 79.393977][ T42] audit: type=1400 audit(1792484877.921:564): avc: denied { write } for pid=7118 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 79.449215][ T42] audit: type=1400 audit(1792484877.981:565): avc: denied { write } for pid=7124 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 79.598688][ T42] audit: type=1400 audit(1792484878.131:566): avc: denied { write } for pid=7129 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 79.649077][ T5730] Bluetooth: hci1: command tx timeout [ 79.670356][ T42] audit: type=1400 audit(1792484878.201:567): avc: denied { write } for pid=7138 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 79.767075][ T7070] Set syz1 is full, maxelem 65536 reached [ 79.892117][ T7154] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 80.092520][ T42] audit: type=1400 audit(1792484878.621:568): avc: denied { unmount } for pid=6378 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 80.414317][ T5784] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.482695][ T5784] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.536709][ T5784] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.547882][ T5740] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 80.552308][ T5740] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 80.559173][ T5740] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 80.560306][ T5740] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 80.560998][ T5740] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 80.602717][ T5784] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.731462][ T5784] bridge_slave_1: left allmulticast mode [ 80.731488][ T5784] bridge_slave_1: left promiscuous mode [ 80.731597][ T5784] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.733357][ T5784] bridge_slave_0: left allmulticast mode [ 80.733368][ T5784] bridge_slave_0: left promiscuous mode [ 80.733474][ T5784] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.843324][ T5784] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 80.846324][ T5784] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 80.853890][ T5784] bond0 (unregistering): Released all slaves [ 80.874062][ T7179] rxe_eth0 speed is unknown, defaulting to 1000 [ 80.931607][ T42] audit: type=1400 audit(1792484879.461:569): avc: denied { write } for pid=7193 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 80.990476][ T42] audit: type=1400 audit(1792484879.521:570): avc: denied { read } for pid=7197 comm="syz.5.348" name="sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 80.990678][ T42] audit: type=1400 audit(1792484879.521:571): avc: denied { open } for pid=7197 comm="syz.5.348" path="/dev/sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 81.002694][ T7198] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 81.020215][ T7198] blktrace: debugfs_dir not present for sg0 so skipping [ 81.050726][ T5441] 8021q: adding VLAN 0 to HW filter on device eth18 [ 81.146145][ T7179] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.146220][ T7179] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.146280][ T7179] bridge_slave_0: entered allmulticast mode [ 81.148015][ T7179] bridge_slave_0: entered promiscuous mode [ 81.150264][ T7179] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.152619][ T7179] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.152679][ T7179] bridge_slave_1: entered allmulticast mode [ 81.153403][ T7179] bridge_slave_1: entered promiscuous mode [ 81.185467][ T7179] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.190002][ T7179] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.194341][ T6010] block nbd6: Receive control failed (result -32) [ 81.203605][ T7174] block nbd6: shutting down sockets [ 81.225471][ T7179] team0: Port device team_slave_0 added [ 81.238354][ T7179] team0: Port device team_slave_1 added [ 81.279831][ T7217] netfs: Cache "CacheFiles" added (type cachefiles) [ 81.279851][ T7217] CacheFiles: File cache on CacheFiles registered [ 81.281335][ T7216] CacheFiles: File cache on CacheFiles unregistering [ 81.281344][ T7216] netfs: Withdrawing cache "CacheFiles" (0 objs) [ 81.288022][ T7179] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.288032][ T7179] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.288045][ T7179] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.290609][ T7179] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.290617][ T7179] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.290630][ T7179] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.296735][ T5441] 8021q: adding VLAN 0 to HW filter on device eth19 [ 81.335550][ T5784] hsr_slave_0: left promiscuous mode [ 81.339991][ T5784] hsr_slave_1: left promiscuous mode [ 81.340773][ T5784] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 81.340790][ T5784] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 81.344048][ T5784] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 81.344064][ T5784] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 81.360713][ T5784] veth1_macvtap: left promiscuous mode [ 81.360751][ T5784] veth0_macvtap: left promiscuous mode [ 81.360795][ T5784] veth1_vlan: left promiscuous mode [ 81.360826][ T5784] veth0_vlan: left promiscuous mode [ 81.407043][ T5730] Bluetooth: hci2: command tx timeout [ 81.475960][ T5784] team0 (unregistering): Port device team_slave_1 removed [ 81.486521][ T5784] team0 (unregistering): Port device team_slave_0 removed [ 81.606813][ T7179] hsr_slave_0: entered promiscuous mode [ 81.607773][ T7179] hsr_slave_1: entered promiscuous mode [ 81.608282][ T7179] debugfs: 'hsr0' already exists in 'hsr' [ 81.608297][ T7179] Cannot create hsr debugfs directory [ 81.728103][ T5730] Bluetooth: hci1: command tx timeout [ 81.741099][ T7179] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 81.743387][ T7179] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.743780][ T7179] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 81.745318][ T7179] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.745733][ T7179] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 81.747489][ T7179] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.747828][ T7179] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 81.750922][ T7179] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.796577][ T7179] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.805030][ T7179] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.809433][ T75] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.809520][ T75] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.815763][ T75] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.815839][ T75] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.816660][ T5441] 8021q: adding VLAN 0 to HW filter on device eth20 [ 82.035148][ T5441] 8021q: adding VLAN 0 to HW filter on device eth21 [ 82.091199][ T7179] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.260449][ T7280] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2812553464 (22500427712 ns) > initial count (17799498648 ns). Using initial count to start timer. [ 82.270869][ T7179] veth0_vlan: entered promiscuous mode [ 82.274430][ T7179] veth1_vlan: entered promiscuous mode [ 82.288036][ T7179] veth0_macvtap: entered promiscuous mode [ 82.290012][ T7179] veth1_macvtap: entered promiscuous mode [ 82.304167][ T7179] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.307251][ T7179] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.340970][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.340984][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.355612][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.355625][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.377298][ T5784] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.377363][ T5784] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.377382][ T5784] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.377399][ T5784] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.607548][ T5730] Bluetooth: hci3: command tx timeout [ 82.624723][ T7301] smpboot: CPU 1 is now offline [ 82.683285][ T7301] smpboot: CPU 3 is now offline [ 82.739218][ T7305] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 82.822492][ T7310] FAULT_INJECTION: forcing a failure. [ 82.822492][ T7310] name failslab, interval 1, probability 0, space 0, times 0 [ 82.822534][ T7310] CPU: 0 UID: 0 PID: 7310 Comm: syz.5.368 Tainted: G L syzkaller #0 PREEMPT(full) [ 82.822558][ T7310] Tainted: [L]=SOFTLOCKUP [ 82.822564][ T7310] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 82.822575][ T7310] Call Trace: [ 82.822582][ T7310] [ 82.822589][ T7310] dump_stack_lvl+0x100/0x190 [ 82.822671][ T7310] should_fail_ex.cold+0x5/0xa [ 82.822707][ T7310] should_failslab+0xc2/0x120 [ 82.822778][ T7310] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 82.822809][ T7310] ? nfs_get_tree+0x76c/0x1450 [ 82.822857][ T7310] kmemdup_nul+0x49/0xd0 [ 82.822879][ T7310] nfs_get_tree+0x76c/0x1450 [ 82.822920][ T7310] vfs_get_tree+0x92/0x320 [ 82.822942][ T7310] vfs_cmd_create+0xd7/0x2a0 [ 82.822977][ T7310] __do_sys_fsconfig+0x55a/0xcb0 [ 82.823002][ T7310] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 82.823040][ T7310] do_syscall_64+0x123/0x790 [ 82.823081][ T7310] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.823101][ T7310] RIP: 0033:0x7fa55f39e559 [ 82.823117][ T7310] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 82.823134][ T7310] RSP: 002b:00007fa56032d028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 82.823152][ T7310] RAX: ffffffffffffffda RBX: 00007fa55f625fa0 RCX: 00007fa55f39e559 [ 82.823164][ T7310] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 82.823175][ T7310] RBP: 00007fa55f435b20 R08: 0000000000000000 R09: 0000000000000000 [ 82.823187][ T7310] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 82.823198][ T7310] R13: 00007fa55f626038 R14: 00007fa55f625fa0 R15: 00007ffdf20ecf78 [ 82.823223][ T7310] [ 83.262448][ T7331] FAULT_INJECTION: forcing a failure. [ 83.262448][ T7331] name failslab, interval 1, probability 0, space 0, times 0 [ 83.262479][ T7331] CPU: 0 UID: 0 PID: 7331 Comm: syz.5.376 Tainted: G L syzkaller #0 PREEMPT(full) [ 83.262503][ T7331] Tainted: [L]=SOFTLOCKUP [ 83.262509][ T7331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 83.262536][ T7331] Call Trace: [ 83.262542][ T7331] [ 83.262550][ T7331] dump_stack_lvl+0x100/0x190 [ 83.262582][ T7331] should_fail_ex.cold+0x5/0xa [ 83.262609][ T7331] should_failslab+0xc2/0x120 [ 83.262641][ T7331] kmem_cache_alloc_noprof+0x92/0x6a0 [ 83.262667][ T7331] ? alloc_empty_file+0x5b/0x1c0 [ 83.262689][ T7331] alloc_empty_file+0x5b/0x1c0 [ 83.262707][ T7331] alloc_file_clone+0x5f/0x110 [ 83.262725][ T7331] create_pipe_files+0x40e/0x970 [ 83.262754][ T7331] do_pipe2+0xbd/0x1e0 [ 83.262778][ T7331] ? __pfx_do_pipe2+0x10/0x10 [ 83.262802][ T7331] ? ksys_write+0x1ac/0x250 [ 83.262831][ T7331] __x64_sys_pipe+0x33/0x50 [ 83.262855][ T7331] do_syscall_64+0x123/0x790 [ 83.262884][ T7331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.262901][ T7331] RIP: 0033:0x7fa55f39e559 [ 83.262916][ T7331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.262934][ T7331] RSP: 002b:00007fa56032d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000016 [ 83.262951][ T7331] RAX: ffffffffffffffda RBX: 00007fa55f625fa0 RCX: 00007fa55f39e559 [ 83.262962][ T7331] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 83.262972][ T7331] RBP: 00007fa55f435b20 R08: 0000000000000000 R09: 0000000000000000 [ 83.262982][ T7331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.262992][ T7331] R13: 00007fa55f626038 R14: 00007fa55f625fa0 R15: 00007ffdf20ecf78 [ 83.263016][ T7331] [ 83.573025][ T7342] FAULT_INJECTION: forcing a failure. [ 83.573025][ T7342] name failslab, interval 1, probability 0, space 0, times 0 [ 83.573093][ T7342] CPU: 2 UID: 0 PID: 7342 Comm: syz.8.379 Tainted: G L syzkaller #0 PREEMPT(full) [ 83.573110][ T7342] Tainted: [L]=SOFTLOCKUP [ 83.573114][ T7342] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 83.573121][ T7342] Call Trace: [ 83.573126][ T7342] [ 83.573131][ T7342] dump_stack_lvl+0x100/0x190 [ 83.573152][ T7342] should_fail_ex.cold+0x5/0xa [ 83.573169][ T7342] should_failslab+0xc2/0x120 [ 83.573186][ T7342] __kmalloc_noprof+0xfc/0x840 [ 83.573202][ T7342] ? comedi_alloc_devpriv+0x22/0x60 [ 83.573226][ T7342] comedi_alloc_devpriv+0x22/0x60 [ 83.573241][ T7342] pcl816_attach+0x4d/0xb30 [ 83.573259][ T7342] comedi_device_attach+0x40e/0x6b0 [ 83.573279][ T7342] do_devconfig_ioctl+0x1b3/0x6d0 [ 83.573293][ T7342] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 83.573310][ T7342] ? kasan_quarantine_put+0x104/0x240 [ 83.573326][ T7342] ? find_held_lock+0x2b/0x80 [ 83.573355][ T7342] comedi_unlocked_ioctl+0x860/0x3310 [ 83.573369][ T7342] ? tomoyo_path_number_perm+0x188/0x580 [ 83.573389][ T7342] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 83.573428][ T7342] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 83.573450][ T7342] ? do_vfs_ioctl+0x226/0x13e0 [ 83.573465][ T7342] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 83.573479][ T7342] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 83.573498][ T7342] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 83.573518][ T7342] ? __fget_files+0x34/0x3d0 [ 83.573541][ T7342] ? selinux_file_ioctl+0x13b/0x290 [ 83.573558][ T7342] ? selinux_file_ioctl+0xb6/0x290 [ 83.573575][ T7342] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 83.573589][ T7342] __x64_sys_ioctl+0x18e/0x210 [ 83.573605][ T7342] do_syscall_64+0x123/0x790 [ 83.573623][ T7342] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.573635][ T7342] RIP: 0033:0x7ffa4b79e559 [ 83.573645][ T7342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.573655][ T7342] RSP: 002b:00007ffa4c6eb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 83.573668][ T7342] RAX: ffffffffffffffda RBX: 00007ffa4ba25fa0 RCX: 00007ffa4b79e559 [ 83.573675][ T7342] RDX: 0000200000000380 RSI: 0000000040946400 RDI: 0000000000000004 [ 83.573682][ T7342] RBP: 00007ffa4b835b20 R08: 0000000000000000 R09: 0000000000000000 [ 83.573688][ T7342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.573694][ T7342] R13: 00007ffa4ba26038 R14: 00007ffa4ba25fa0 R15: 00007ffddeddc348 [ 83.573708][ T7342] [ 83.808876][ T5730] Bluetooth: hci1: command tx timeout [ 83.813875][ T7353] TC_ACT_REPEAT abuse ? [ 83.816087][ T7355] netlink: 8 bytes leftover after parsing attributes in process `syz.5.385'. [ 83.816099][ T7355] netlink: 8 bytes leftover after parsing attributes in process `syz.5.385'. [ 83.862384][ T7357] uprobe: syz.5.386:7357 failed to unregister, leaking uprobe [ 84.505740][ T42] kauditd_printk_skb: 28 callbacks suppressed [ 84.505756][ T42] audit: type=1400 audit(1792484883.031:600): avc: denied { write } for pid=7390 comm="syz.5.398" path="socket:[20446]" dev="sockfs" ino=20446 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 84.609011][ T7397] netlink: 144 bytes leftover after parsing attributes in process `syz.5.401'. [ 84.685496][ T7401] netlink: 8 bytes leftover after parsing attributes in process `syz.5.402'. [ 84.686280][ T42] audit: type=1400 audit(1792484883.211:601): avc: denied { write } for pid=7400 comm="syz.5.402" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 84.687266][ T5730] Bluetooth: hci3: command tx timeout [ 84.844143][ T7407] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 85.286586][ T42] audit: type=1400 audit(1792484883.811:602): avc: denied { read } for pid=7415 comm="syz.7.407" name="ppp" dev="devtmpfs" ino=729 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 85.705146][ T7438] batman_adv: batadv0: Adding interface: syzkaller0 [ 85.705158][ T7438] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.705174][ T7438] batman_adv: batadv0: Interface activated: syzkaller0 [ 85.881152][ T7437] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 85.902462][ T7437] batman_adv: batadv0: Removing interface: syzkaller0 [ 85.910701][ T42] audit: type=1800 audit(1792484884.441:603): pid=7443 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.8.417" name="syzkaller1" dev="sda1" ino=2039 res=0 errno=0 [ 85.969034][ T7447] netlink: 24 bytes leftover after parsing attributes in process `syz.8.418'. [ 86.005991][ T7447] netlink: 16 bytes leftover after parsing attributes in process `syz.8.418'. [ 86.067235][ T42] audit: type=1400 audit(1792484884.591:604): avc: denied { bind } for pid=7449 comm="syz.8.420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 86.071244][ T7450] kAFS: No cell specified [ 86.117433][ T42] audit: type=1400 audit(1792484884.651:605): avc: denied { getopt } for pid=7452 comm="syz.8.421" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 86.149724][ T7455] TC_ACT_REPEAT abuse ? [ 86.371097][ T42] audit: type=1400 audit(1792484884.891:606): avc: denied { write } for pid=7468 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 86.439060][ T42] audit: type=1400 audit(1792484884.971:607): avc: denied { write } for pid=7472 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 86.499667][ T61] usb 11-1: new high-speed USB device number 2 using dummy_hcd [ 86.554247][ T42] audit: type=1400 audit(1792484885.081:608): avc: denied { write } for pid=7475 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 86.627237][ T42] audit: type=1400 audit(1792484885.161:609): avc: denied { write } for pid=7478 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 86.658142][ T61] usb 11-1: Using ep0 maxpacket: 32 [ 86.658744][ T61] usb 11-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 86.659980][ T61] usb 11-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 32 [ 86.662826][ T61] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.662845][ T61] usb 11-1: Product: syz [ 86.662858][ T61] usb 11-1: Manufacturer: syz [ 86.662869][ T61] usb 11-1: SerialNumber: syz [ 86.696595][ T61] usb 11-1: config 0 descriptor?? [ 86.704231][ T7461] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 86.709670][ T61] hub 11-1:0.0: bad descriptor, ignoring hub [ 86.709692][ T61] hub 11-1:0.0: probe with driver hub failed with error -5 [ 86.713022][ T61] input: syz syz as /devices/platform/dummy_hcd.6/usb11/11-1/11-1:0.0/input/input7 [ 86.767077][ T5740] Bluetooth: hci3: command tx timeout [ 86.946687][ T9] usb 11-1: USB disconnect, device number 2 [ 86.946819][ C2] usbtouchscreen 11-1:0.0: usbtouch_irq - usb_submit_urb failed with result: -19 [ 87.520742][ T7502] netlink: 8 bytes leftover after parsing attributes in process `syz.6.428'. [ 87.642835][ T7506] TC_ACT_REPEAT abuse ? [ 87.836916][ T7514] syzkaller1: entered promiscuous mode [ 87.836930][ T7514] syzkaller1: entered allmulticast mode [ 87.849316][ T7514] netlink: 60 bytes leftover after parsing attributes in process `syz.7.432'. [ 87.954666][ T7517] kvm: requested 93028 ns i8254 timer period limited to 200000 ns [ 88.036709][ T7521] dummy0 speed is unknown, defaulting to 1000 [ 88.042127][ T7521] dummy0 speed is unknown, defaulting to 1000 [ 88.042478][ T7521] dummy0 speed is unknown, defaulting to 1000 [ 88.050379][ T5730] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 88.146008][ T7517] kvm: requested 159238 ns i8254 timer period limited to 200000 ns [ 88.222169][ T7521] infiniband syz0: set active [ 88.222203][ T5806] dummy0 speed is unknown, defaulting to 1000 [ 88.222234][ T7521] infiniband syz0: added dummy0 [ 88.233797][ T7521] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 88.233818][ T7521] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 88.233839][ T7521] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 88.254241][ T7521] RDS/IB: syz0: added [ 88.254266][ T7521] smc: adding ib device syz0 with port count 1 [ 88.254277][ T7521] smc: ib device syz0 port 1 has no pnetid [ 88.254317][ T5806] dummy0 speed is unknown, defaulting to 1000 [ 88.254757][ T7521] dummy0 speed is unknown, defaulting to 1000 [ 88.381998][ T7521] dummy0 speed is unknown, defaulting to 1000 [ 88.472210][ T7521] dummy0 speed is unknown, defaulting to 1000 [ 88.556325][ T7521] dummy0 speed is unknown, defaulting to 1000 [ 88.731838][ T7542] binder: 7541:7542 ioctl c0306201 200000000480 returned -14 [ 88.734667][ T7542] binder: 7541:7542 ioctl c0306201 200000000580 returned -14 [ 88.889725][ T5730] Bluetooth: hci3: command tx timeout [ 89.274727][ T7467] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 89.309984][ T7462] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 89.551691][ T5730] Bluetooth: hci1: Malformed MSFT vendor event: 0x02 [ 89.563985][ T42] kauditd_printk_skb: 16 callbacks suppressed [ 89.564005][ T42] audit: type=1400 audit(1792484888.101:626): avc: denied { write } for pid=7570 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.619149][ C2] vcan0: j1939_tp_rxtimer: 0xffff8880340d0000: rx timeout, send abort [ 89.621089][ C2] vcan0: j1939_xtp_rx_abort_one: 0xffff8880340d0000: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 89.636928][ T42] audit: type=1400 audit(1792484888.161:627): avc: denied { read } for pid=5119 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 89.637024][ T42] audit: type=1400 audit(1792484888.161:628): avc: denied { search } for pid=5119 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.637046][ T42] audit: type=1400 audit(1792484888.161:629): avc: denied { write search } for pid=5119 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.637065][ T42] audit: type=1400 audit(1792484888.161:630): avc: denied { add_name } for pid=5119 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.637083][ T42] audit: type=1400 audit(1792484888.161:631): avc: denied { create } for pid=5119 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 89.637102][ T42] audit: type=1400 audit(1792484888.161:632): avc: denied { append open } for pid=5119 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 89.637339][ T42] audit: type=1400 audit(1792484888.171:633): avc: denied { getattr } for pid=5119 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 89.672246][ T42] audit: type=1400 audit(1792484888.201:634): avc: denied { write } for pid=7576 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.786922][ T7584] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow [ 89.889798][ T42] audit: type=1400 audit(1792484888.421:635): avc: denied { write } for pid=7586 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 89.942109][ T7592] netlink: 8 bytes leftover after parsing attributes in process `syz.6.455'. [ 89.993291][ T7595] binder: 7594:7595 ioctl c0306201 200000000100 returned -14 [ 89.996034][ T7595] binder: 7594:7595 ioctl c0306201 200000000200 returned -14 [ 90.149524][ T7605] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 90.197151][ C2] vcan0: j1939_tp_rxtimer: 0xffff88804c2b1400: rx timeout, send abort [ 90.197247][ C2] vcan0: j1939_tp_rxtimer: 0xffff88804c2b1800: rx timeout, send abort [ 90.197333][ C2] vcan0: j1939_xtp_rx_abort_one: 0xffff88804c2b1400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 90.197462][ C2] vcan0: j1939_xtp_rx_abort_one: 0xffff88804c2b1800: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 90.278508][ T7612] netlink: 'syz.5.462': attribute type 1 has an invalid length. [ 90.332649][ T7612] 8021q: adding VLAN 0 to HW filter on device bond1 [ 90.401101][ T7619] bond1: (slave veth3): Enslaving as an active interface with a down link [ 90.425828][ T7610] infiniband syz1: set active [ 90.425868][ T7610] infiniband syz1: added syz_tun [ 90.433317][ T7612] bond1: (slave macvlan0): making interface the new active one [ 90.436034][ T7612] macvlan0: entered promiscuous mode [ 90.436461][ T7612] bond1: (slave macvlan0): Enslaving as an active interface with an up link [ 90.450905][ T7610] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 90.450927][ T7610] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 90.451010][ T7610] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 90.485152][ T7610] RDS/IB: syz1: added [ 90.485180][ T7610] smc: adding ib device syz1 with port count 1 [ 90.485191][ T7610] smc: ib device syz1 port 1 has no pnetid [ 90.745764][ T7634] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 91.112749][ T5730] Bluetooth: hci3: unexpected cc 0x042d length: 41 > 7 [ 91.146204][ T7654] tipc: Started in network mode [ 91.146227][ T7654] tipc: Node identity ac1414aa, cluster identity 4711 [ 91.146889][ T7654] tipc: New replicast peer: 172.20.20.187 [ 91.154745][ T7654] tipc: Enabled bearer , priority 10 [ 92.064217][ T7706] overlayfs: failed to clone upperpath [ 92.066635][ T7708] binder: 7707:7708 ioctl c0306201 200000000a00 returned -14 [ 92.068946][ T7708] binder: 7707:7708 ioctl c0306201 200000000b00 returned -14 [ 92.114150][ T7712] netlink: 8 bytes leftover after parsing attributes in process `syz.5.499'. [ 92.114170][ T7712] netlink: 4 bytes leftover after parsing attributes in process `syz.5.499'. [ 92.151258][ T7712] netlink: 8 bytes leftover after parsing attributes in process `syz.5.499'. [ 92.151279][ T7712] netlink: 4 bytes leftover after parsing attributes in process `syz.5.499'. [ 92.157392][ T5784] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 92.157441][ T5784] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 92.177158][ T5784] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 92.177187][ T5784] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 92.179438][ T24] tipc: Node number set to 2886997162 [ 92.358798][ T7718] netlink: 40 bytes leftover after parsing attributes in process `syz.5.502'. [ 92.521036][ T171] IPVS: starting estimator thread 0... [ 92.561642][ T7727] netlink: 'syz.8.505': attribute type 1 has an invalid length. [ 92.579854][ T7727] 8021q: adding VLAN 0 to HW filter on device bond1 [ 92.607777][ T7725] IPVS: using max 43 ests per chain, 103200 per kthread [ 92.830096][ T7727] bond1: (slave veth5): Enslaving as an active interface with a down link [ 92.873866][ T7731] bond1: (slave macvlan0): making interface the new active one [ 92.895510][ T7731] macvlan0: entered promiscuous mode [ 92.903394][ T7731] bond1: (slave macvlan0): Enslaving as an active interface with an up link [ 93.437916][ T7746] kvm: requested 160076 ns i8254 timer period limited to 200000 ns [ 93.443509][ T7746] kvm: requested 111466 ns i8254 timer period limited to 200000 ns [ 93.446906][ T7746] kvm: requested 106438 ns i8254 timer period limited to 200000 ns [ 94.038627][ T9] dummy0 speed is unknown, defaulting to 1000 [ 94.601783][ T7807] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 94.630715][ T24] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 94.654955][ T7811] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 94.707800][ T7807] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 94.788988][ T24] usb 10-1: New USB device found, idVendor=0644, idProduct=8020, bcdDevice= 0.40 [ 94.791858][ T24] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.791872][ T24] usb 10-1: Product: syz [ 94.791880][ T24] usb 10-1: Manufacturer: syz [ 94.791887][ T24] usb 10-1: SerialNumber: syz [ 95.101165][ T24] usb 10-1: Can't get UAC3 power state for id 10 [ 95.109039][ T24] usb 10-1: BAAD HEADSET c_chmask mismatch [ 95.147588][ T42] kauditd_printk_skb: 34 callbacks suppressed [ 95.147616][ T42] audit: type=1400 audit(1792484893.681:670): avc: denied { bind } for pid=7840 comm="syz.8.532" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 95.147892][ T42] audit: type=1400 audit(1792484893.681:671): avc: denied { name_bind } for pid=7840 comm="syz.8.532" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 95.148106][ T42] audit: type=1400 audit(1792484893.681:672): avc: denied { node_bind } for pid=7840 comm="syz.8.532" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 95.148919][ T42] audit: type=1400 audit(1792484893.681:673): avc: denied { connect } for pid=7840 comm="syz.8.532" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 95.260704][ T24] snd-usb-audio 10-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 95.266284][ T24] usb 10-1: USB disconnect, device number 4 [ 95.301179][ T6151] udevd[6151]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 95.313299][ T7845] jffs2: notice: (7845) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 1 orphan) and 2 of xref (0 dead, 2 orphan) found. [ 95.319535][ T42] audit: type=1400 audit(1792484893.841:674): avc: denied { write } for pid=7844 comm="syz.7.534" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 95.321568][ T42] audit: type=1400 audit(1792484893.851:675): avc: denied { setattr } for pid=7844 comm="syz.7.534" name="fillfile" dev="jffs2" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 95.322352][ T7845] netlink: 60 bytes leftover after parsing attributes in process `syz.7.534'. [ 95.568896][ T7860] syz0: rxe_newlink: already configured on dummy0 [ 95.691156][ T7874] FAULT_INJECTION: forcing a failure. [ 95.691156][ T7874] name failslab, interval 1, probability 0, space 0, times 0 [ 95.691179][ T7874] CPU: 2 UID: 0 PID: 7874 Comm: syz.5.544 Tainted: G L syzkaller #0 PREEMPT(full) [ 95.691194][ T7874] Tainted: [L]=SOFTLOCKUP [ 95.691198][ T7874] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.691213][ T7874] Call Trace: [ 95.691217][ T7874] [ 95.691221][ T7874] dump_stack_lvl+0x100/0x190 [ 95.691282][ T7874] should_fail_ex.cold+0x5/0xa [ 95.691305][ T7874] should_failslab+0xc2/0x120 [ 95.691344][ T7874] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 95.691361][ T7874] ? xas_split_alloc+0x182/0x530 [ 95.691382][ T7874] xas_split_alloc+0x182/0x530 [ 95.691395][ T7874] __folio_split+0x95e/0x1bf0 [ 95.691413][ T7874] ? __pfx___folio_split+0x10/0x10 [ 95.691426][ T7874] ? folio_alloc_swap+0xbd8/0x1e70 [ 95.691447][ T7874] ? folio_alloc_swap+0x4c6/0x1e70 [ 95.691464][ T7874] shmem_writeout+0x786/0x1a00 [ 95.691479][ T7874] ? __pfx_shmem_writeout+0x10/0x10 [ 95.691489][ T7874] ? __pfx_try_to_unmap+0x10/0x10 [ 95.691501][ T7874] ? find_held_lock+0x2b/0x80 [ 95.691525][ T7874] ? inode_to_bdi+0x9e/0x160 [ 95.691538][ T7874] ? folio_clear_dirty_for_io+0x178/0x960 [ 95.691553][ T7874] shrink_folio_list+0x399a/0x5e40 [ 95.691573][ T7874] ? unwind_next_frame+0xbd/0x2090 [ 95.691590][ T7874] ? __pfx_shrink_folio_list+0x10/0x10 [ 95.691607][ T7874] ? __lock_acquire+0x520/0x1f40 [ 95.691624][ T7874] ? __lock_acquire+0x5c0/0x1f40 [ 95.691639][ T7874] ? lock_acquire+0x1d1/0x380 [ 95.691652][ T7874] ? unwind_next_frame+0xbd/0x2090 [ 95.691679][ T7874] ? __lock_acquire+0x5c0/0x1f40 [ 95.691692][ T7874] ? __css_rstat_updated+0x1ce/0x590 [ 95.691708][ T7874] ? __pfx___css_rstat_updated+0x10/0x10 [ 95.691724][ T7874] reclaim_folio_list+0xe9/0x5e0 [ 95.691742][ T7874] ? __pfx_reclaim_folio_list+0x10/0x10 [ 95.691757][ T7874] ? __mod_memcg_lruvec_state+0x18c/0x5b0 [ 95.691777][ T7874] ? lru_gen_update_size+0x431/0xe20 [ 95.691795][ T7874] ? lru_gen_del_folio+0x382/0x5f0 [ 95.691831][ T7874] reclaim_pages+0x428/0x5e0 [ 95.691851][ T7874] ? __pfx_reclaim_pages+0x10/0x10 [ 95.691872][ T7874] ? madvise_cold_or_pageout_pte_range+0x22ba/0x27b0 [ 95.691891][ T7874] ? folio_isolate_lru+0xd6/0xe90 [ 95.691911][ T7874] madvise_cold_or_pageout_pte_range+0x147e/0x27b0 [ 95.691936][ T7874] ? __pfx_madvise_cold_or_pageout_pte_range+0x10/0x10 [ 95.691960][ T7874] ? __lock_acquire+0x5c0/0x1f40 [ 95.691974][ T7874] ? __pfx_madvise_cold_or_pageout_pte_range+0x10/0x10 [ 95.691994][ T7874] walk_pgd_range+0xbef/0x1e00 [ 95.692018][ T7874] ? __pfx_walk_pgd_range+0x10/0x10 [ 95.692036][ T7874] __walk_page_range+0x171/0x850 [ 95.692050][ T7874] ? __lock_acquire+0x5c0/0x1f40 [ 95.692067][ T7874] walk_page_range_vma_unsafe+0x209/0x8f0 [ 95.692083][ T7874] ? __pfx_walk_page_range_vma_unsafe+0x10/0x10 [ 95.692099][ T7874] ? find_held_lock+0x2b/0x80 [ 95.692115][ T7874] ? mlock_drain_local+0x254/0x4e0 [ 95.692127][ T7874] ? mlock_drain_local+0x254/0x4e0 [ 95.692143][ T7874] walk_page_range_vma+0x63/0x90 [ 95.692158][ T7874] madvise_pageout+0x29e/0x5b0 [ 95.692175][ T7874] ? __pfx_madvise_pageout+0x10/0x10 [ 95.692202][ T7874] madvise_vma_behavior+0x48b/0x2350 [ 95.692214][ T7874] ? mas_prev+0xa4/0x100 [ 95.692227][ T7874] ? __pfx_madvise_vma_behavior+0x10/0x10 [ 95.692239][ T7874] ? mas_walk+0x260/0x310 [ 95.692255][ T7874] ? find_vma_prev+0xd8/0x150 [ 95.692270][ T7874] ? __pfx_find_vma_prev+0x10/0x10 [ 95.692284][ T7874] ? lock_acquire+0x1d1/0x380 [ 95.692304][ T7874] madvise_walk_vmas+0x30e/0xc50 [ 95.692317][ T7874] ? __pfx_madvise_walk_vmas+0x10/0x10 [ 95.692328][ T7874] ? __pfx_futex_wake_mark+0x10/0x10 [ 95.692343][ T7874] ? lock_acquire+0x1d1/0x380 [ 95.692357][ T7874] madvise_do_behavior+0x1ea/0x510 [ 95.692370][ T7874] ? __pfx_madvise_do_behavior+0x10/0x10 [ 95.692382][ T7874] ? down_read+0x13b/0x4c0 [ 95.692411][ T7874] do_madvise+0x238/0x290 [ 95.692422][ T7874] ? __pfx_do_madvise+0x10/0x10 [ 95.692449][ T7874] __x64_sys_madvise+0xa9/0x110 [ 95.692461][ T7874] do_syscall_64+0x123/0x790 [ 95.692479][ T7874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.692492][ T7874] RIP: 0033:0x7fa55f39e559 [ 95.692503][ T7874] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.692513][ T7874] RSP: 002b:00007fa56032d028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 95.692525][ T7874] RAX: ffffffffffffffda RBX: 00007fa55f625fa0 RCX: 00007fa55f39e559 [ 95.692533][ T7874] RDX: 0000000000000015 RSI: 0000000000600000 RDI: 0000200000000000 [ 95.692539][ T7874] RBP: 00007fa55f435b20 R08: 0000000000000000 R09: 0000000000000000 [ 95.692546][ T7874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.692553][ T7874] R13: 00007fa55f626038 R14: 00007fa55f625fa0 R15: 00007ffdf20ecf78 [ 95.692568][ T7874] [ 96.137110][ T5885] usb 12-1: new high-speed USB device number 2 using dummy_hcd [ 96.181204][ T7900] fuse: fd is not a fuse device [ 96.181676][ T42] audit: type=1400 audit(1792484894.711:676): avc: denied { write } for pid=7899 comm="syz.8.554" name="file0" dev="tmpfs" ino=269 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 96.181884][ T42] audit: type=1400 audit(1792484894.711:677): avc: denied { open } for pid=7899 comm="syz.8.554" path="/47/file0" dev="tmpfs" ino=269 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 96.253754][ T7904] overlay: filesystem on ./file1 not supported [ 96.289408][ T5885] usb 12-1: Using ep0 maxpacket: 16 [ 96.289913][ T5885] usb 12-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 96.290348][ T5885] usb 12-1: config 0 has no interfaces? [ 96.292666][ T5885] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.292679][ T5885] usb 12-1: Product: syz [ 96.292686][ T5885] usb 12-1: Manufacturer: syz [ 96.292693][ T5885] usb 12-1: SerialNumber: syz [ 96.295758][ T5885] usb 12-1: config 0 descriptor?? [ 96.353809][ T7910] netlink: 8 bytes leftover after parsing attributes in process `syz.6.559'. [ 96.445696][ T7909] kvm: pic: non byte write [ 96.577770][ T5883] e1000 0000:00:06.0 eth0: Reset adapter [ 96.578375][ T7917] e1000e 0000:00:02.0: Interrupt Throttle Rate off [ 96.662183][ T42] audit: type=1400 audit(1792484895.191:678): avc: denied { write } for pid=7924 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 96.714026][ T7932] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 96.714156][ T7932] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 96.715511][ T42] audit: type=1400 audit(1792484895.241:679): avc: denied { setopt } for pid=7926 comm="syz.6.565" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 96.764149][ T7883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 96.764353][ T7883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 96.789233][ T7917] e1000e 0000:00:02.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 96.846015][ T7936] FAULT_INJECTION: forcing a failure. [ 96.846015][ T7936] name fail_futex, interval 1, probability 0, space 0, times 1 [ 96.846052][ T7936] CPU: 0 UID: 0 PID: 7936 Comm: syz.6.566 Tainted: G L syzkaller #0 PREEMPT(full) [ 96.846068][ T7936] Tainted: [L]=SOFTLOCKUP [ 96.846072][ T7936] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.846085][ T7936] Call Trace: [ 96.846089][ T7936] [ 96.846094][ T7936] dump_stack_lvl+0x100/0x190 [ 96.846159][ T7936] should_fail_ex.cold+0x5/0xa [ 96.846182][ T7936] get_futex_key+0xf62/0x13e0 [ 96.846212][ T7936] ? __pfx_get_futex_key+0x10/0x10 [ 96.846227][ T7936] ? __mutex_unlock_slowpath+0x35d/0x930 [ 96.846258][ T7936] futex_wake+0xf4/0x5e0 [ 96.846271][ T7936] ? __pfx_futex_wake+0x10/0x10 [ 96.846285][ T7936] ? lock_acquire+0x1d1/0x380 [ 96.846298][ T7936] ? detach_task_ctx_data+0x83/0x490 [ 96.846322][ T7936] do_futex+0x2b2/0x440 [ 96.846338][ T7936] ? __pfx_do_futex+0x10/0x10 [ 96.846354][ T7936] ? __might_fault+0xc5/0x140 [ 96.846369][ T7936] mm_exit_exec_release+0x256/0x2f0 [ 96.846384][ T7936] do_exit+0x707/0x2a40 [ 96.846401][ T7936] ? __pfx_do_exit+0x10/0x10 [ 96.846415][ T7936] ? do_raw_spin_lock+0x128/0x260 [ 96.846430][ T7936] ? find_held_lock+0x2b/0x80 [ 96.846445][ T7936] ? get_signal+0x7e0/0x21e0 [ 96.846459][ T7936] do_group_exit+0xd5/0x2a0 [ 96.846475][ T7936] get_signal+0x1ec7/0x21e0 [ 96.846492][ T7936] ? __pfx_get_signal+0x10/0x10 [ 96.846506][ T7936] ? do_futex+0x190/0x440 [ 96.846524][ T7936] arch_do_signal_or_restart+0x91/0x7e0 [ 96.846543][ T7936] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 96.846568][ T7936] exit_to_user_mode_loop+0x139/0x700 [ 96.846583][ T7936] ? rcu_is_watching+0x13/0xc0 [ 96.846600][ T7936] do_syscall_64+0x661/0x790 [ 96.846624][ T7936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.846637][ T7936] RIP: 0033:0x7f4b6e59e559 [ 96.846646][ T7936] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.846657][ T7936] RSP: 002b:00007f4b6f3f00e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 96.846669][ T7936] RAX: fffffffffffffe00 RBX: 00007f4b6e825fa8 RCX: 00007f4b6e59e559 [ 96.846675][ T7936] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f4b6e825fa8 [ 96.846682][ T7936] RBP: 00007f4b6e825fa0 R08: 0000000000000000 R09: 0000000000000000 [ 96.846688][ T7936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.846695][ T7936] R13: 00007f4b6e826038 R14: 00007ffdeb1494d0 R15: 00007ffdeb1495b8 [ 96.846709][ T7936] [ 96.851219][ T7035] dummy0 speed is unknown, defaulting to 1000 [ 97.068578][ T5883] e1000 0000:00:06.0 eth0: Reset adapter [ 97.194064][ T5842] e1000e 0000:00:02.0 eth1: NIC Link is Up 1000 Mbps Full Duplex, Flow Control: Rx/Tx [ 99.248141][ T5883] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX [ 101.547289][ T5784] macvlan0: left promiscuous mode [ 103.526887][ T42] kauditd_printk_skb: 11 callbacks suppressed [ 103.526900][ T42] audit: type=1400 audit(1792484902.051:691): avc: denied { write } for pid=7979 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 103.574875][ T42] audit: type=1400 audit(1792484902.101:692): avc: denied { write } for pid=7982 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 104.007154][ T5784] macvlan0: left promiscuous mode [ 106.548693][ T42] audit: type=1400 audit(1792484905.081:693): avc: denied { write } for pid=7986 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.595003][ T42] audit: type=1400 audit(1792484905.121:694): avc: denied { write } for pid=7989 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.782045][ T42] audit: type=1400 audit(1792484905.311:695): avc: denied { getopt } for pid=7992 comm="syz.7.570" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 106.784103][ T42] audit: type=1400 audit(1792484905.311:696): avc: denied { connect } for pid=7992 comm="syz.7.570" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 109.104509][ T42] audit: type=1400 audit(1792484907.631:697): avc: denied { write } for pid=8000 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 109.151597][ T42] audit: type=1400 audit(1792484907.681:698): avc: denied { write } for pid=8004 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 113.935273][ T42] audit: type=1400 audit(1792484912.461:699): avc: denied { read } for pid=8010 comm="syz.5.576" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 113.935469][ T42] audit: type=1400 audit(1792484912.461:700): avc: denied { open } for pid=8010 comm="syz.5.576" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 113.958498][ T8012] binder_alloc: 8010: pid 8010 spamming oneway? 1 buffers allocated for a total size of 4096 [ 113.958997][ T42] audit: type=1400 audit(1792484912.491:701): avc: denied { ioctl } for pid=8010 comm="syz.5.576" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 113.959026][ T42] audit: type=1400 audit(1792484912.491:702): avc: denied { map } for pid=8010 comm="syz.5.576" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 114.051663][ T42] audit: type=1400 audit(1792484912.581:703): avc: denied { write } for pid=8018 comm="syz.5.579" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 114.077753][ T8017] ref_ctr increment failed for inode: 0x13d offset: 0x5 ref_ctr_offset: 0x1000 of mm: 0xffff888035c41880 [ 114.078694][ T8020] binder: 8018:8020 ioctl c0306201 200000000080 returned -14 [ 114.079728][ T8019] kvm: requested 7542 ns i8254 timer period limited to 200000 ns [ 114.103531][ T8020] binder: 8018:8020 ioctl c0306201 2000000003c0 returned -14 [ 114.704019][ T42] audit: type=1400 audit(1792484913.231:704): avc: denied { name_bind } for pid=8038 comm="syz.7.586" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 115.204936][ T42] audit: type=1400 audit(1792484913.731:705): avc: denied { listen } for pid=8052 comm="syz.5.592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 115.279172][ T42] audit: type=1400 audit(1792484913.801:706): avc: denied { accept } for pid=8052 comm="syz.5.592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 115.405992][ T8058] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 115.552273][ T8062] syzkaller1: entered promiscuous mode [ 115.552289][ T8062] syzkaller1: entered allmulticast mode [ 115.560389][ T8064] binder: 8063:8064 ioctl c0306201 200000000080 returned -14 [ 115.562604][ T8064] binder: 8063:8064 ioctl c0306201 2000000003c0 returned -14 [ 115.746831][ T42] audit: type=1400 audit(1792484914.271:707): avc: denied { read } for pid=5441 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 115.896667][ T42] audit: type=1400 audit(1792484914.421:708): avc: denied { ioctl } for pid=8079 comm="syz.6.604" path="socket:[28332]" dev="sockfs" ino=28332 ioctlcmd=0x7436 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 116.004510][ C0] vcan0: j1939_tp_rxtimer: 0xffff888032eeec00: rx timeout, send abort [ 116.004634][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888032eeec00: 0x2ff03: (3) A timeout occurred and this is the connection abort to close the session. [ 116.007626][ T42] audit: type=1400 audit(1792484914.541:709): avc: denied { read } for pid=5119 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 116.057720][ T8090] netlink: 'syz.8.608': attribute type 2 has an invalid length. [ 116.057734][ T8090] netlink: 48 bytes leftover after parsing attributes in process `syz.8.608'. [ 116.066310][ T8090] : entered promiscuous mode [ 116.886469][ T8104] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 116.969410][ T8109] netlink: 'syz.5.615': attribute type 1 has an invalid length. [ 117.017798][ T8109] 8021q: adding VLAN 0 to HW filter on device bond2 [ 117.029583][ T42] audit: type=1400 audit(1792484915.561:710): avc: denied { create } for pid=8108 comm="syz.5.615" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 117.030412][ T42] audit: type=1400 audit(1792484915.561:711): avc: denied { write } for pid=8108 comm="syz.5.615" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 117.261571][ T556] IPVS: starting estimator thread 0... [ 117.266561][ T42] audit: type=1400 audit(1792484915.791:712): avc: denied { listen } for pid=8119 comm="syz.8.620" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 117.302427][ T8133] netlink: 24 bytes leftover after parsing attributes in process `syz.5.623'. [ 117.348660][ T8131] IPVS: using max 43 ests per chain, 103200 per kthread [ 117.451014][ T42] audit: type=1400 audit(1792484915.981:713): avc: denied { mount } for pid=8138 comm="syz.6.626" name="/" dev="overlay" ino=507 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 117.595676][ T8145] netlink: 24 bytes leftover after parsing attributes in process `syz.5.629'. [ 117.631067][ T8145] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=8145 comm=syz.5.629 [ 117.757111][ T5157] usb 11-1: new high-speed USB device number 3 using dummy_hcd [ 117.758196][ T8148] IPVS: sh: FWM 1 0x00000001 - no destination available [ 117.859361][ T8150] netlink: 24 bytes leftover after parsing attributes in process `syz.5.631'. [ 117.859401][ T8150] netlink: 16 bytes leftover after parsing attributes in process `syz.5.631'. [ 117.909488][ T5157] usb 11-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 117.910677][ T5157] usb 11-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.910716][ T5157] usb 11-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 117.910736][ T5157] usb 11-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 117.912464][ T5157] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 117.912484][ T5157] usb 11-1: Product: syz [ 117.912496][ T5157] usb 11-1: Manufacturer: syz [ 117.944478][ T8141] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 117.946741][ T5157] garmin_gps 11-1:1.0: Garmin GPS usb/tty converter detected [ 117.960321][ T5157] usb 11-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 118.630906][ T8168] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 118.845652][ T8175] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 119.091133][ T8190] warning: `syz.8.644' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 119.188823][ T8196] rxe_eth0 speed is unknown, defaulting to 1000 [ 119.231022][ T8203] fuse: fd is not a fuse device [ 119.324900][ T8196] dummy0 speed is unknown, defaulting to 1000 [ 119.351379][ T8208] __vm_enough_memory: pid: 8208, comm: syz.8.648, bytes: 11727556251648 not enough memory for the allocation [ 119.351596][ T8208] __vm_enough_memory: pid: 8208, comm: syz.8.648, bytes: 11727556251648 not enough memory for the allocation [ 120.499935][ T42] kauditd_printk_skb: 4 callbacks suppressed [ 120.499948][ T42] audit: type=1400 audit(1792484919.031:718): avc: denied { write } for pid=8235 comm="syz.5.662" name="strings" dev="configfs" ino=10117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 120.505551][ T42] audit: type=1400 audit(1792484919.031:719): avc: denied { write } for pid=8235 comm="syz.5.662" name="c.1" dev="configfs" ino=10120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 120.506520][ T42] audit: type=1400 audit(1792484919.031:720): avc: denied { write } for pid=8235 comm="syz.5.662" name="c.1" dev="configfs" ino=10120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 120.566515][ T42] audit: type=1400 audit(1792484919.091:721): avc: denied { write } for pid=8235 comm="syz.5.662" name="c.1" dev="configfs" ino=10120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 120.603358][ T42] audit: type=1400 audit(1792484919.131:722): avc: denied { unlink } for pid=8235 comm="syz.5.662" name="hid.usb0" dev="configfs" ino=28852 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1 [ 120.605644][ T5157] usb 11-1: USB disconnect, device number 3 [ 120.635381][ T5157] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 120.635841][ T5157] garmin_gps 11-1:1.0: device disconnected [ 120.789808][ T8252] tipc: Failed to remove unknown binding: 66,0,0/2886997162:399481440/399481442 [ 120.789836][ T8252] tipc: Failed to remove unknown binding: 66,0,0/2886997162:399481440/399481441 [ 120.790373][ T8252] tipc: Failed to remove unknown binding: 66,0,0/2886997162:399481440/399481442 [ 120.790394][ T8252] tipc: Failed to remove unknown binding: 66,0,0/2886997162:399481440/399481441 [ 120.950474][ T42] audit: type=1400 audit(1792484919.481:723): avc: denied { getopt } for pid=8257 comm="syz.8.667" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 121.086824][ T8268] netlink: 'syz.8.671': attribute type 39 has an invalid length. [ 121.255060][ T8277] netlink: 12 bytes leftover after parsing attributes in process `syz.8.674'. [ 121.335564][ T42] audit: type=1400 audit(1792484919.861:724): avc: denied { ioctl } for pid=8272 comm="syz.5.672" path="socket:[28902]" dev="sockfs" ino=28902 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 121.625447][ T42] audit: type=1400 audit(1792484920.151:725): avc: denied { write } for pid=8300 comm="syz.5.683" name="/" dev="9p" ino=71827753 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 121.625478][ T42] audit: type=1400 audit(1792484920.151:726): avc: denied { associate } for pid=8300 comm="syz.5.683" name="file0" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 121.634309][ T42] audit: type=1400 audit(1792484920.161:727): avc: denied { write } for pid=8300 comm="syz.5.683" name="file0" dev="9p" ino=71827779 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 121.787215][ T8315] netlink: 12 bytes leftover after parsing attributes in process `syz.8.690'. [ 122.125242][ T8337] netlink: 12 bytes leftover after parsing attributes in process `syz.7.698'. [ 122.273406][ T8343] bond0: entered promiscuous mode [ 122.273421][ T8343] bond_slave_0: entered promiscuous mode [ 122.273510][ T8343] bond_slave_1: entered promiscuous mode [ 122.402169][ T8350] netlink: 'syz.7.703': attribute type 1 has an invalid length. [ 122.412268][ T8350] 8021q: adding VLAN 0 to HW filter on device bond1 [ 122.430353][ T8350] bond1: (slave geneve2): making interface the new active one [ 122.431212][ T8350] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 122.477395][ T8353] netlink: 'syz.7.704': attribute type 10 has an invalid length. [ 122.480076][ T8353] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 122.480977][ T8353] batadv0: entered promiscuous mode [ 122.481276][ T8353] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 122.607837][ T8359] netlink: 4 bytes leftover after parsing attributes in process `syz.6.707'. [ 122.762134][ T8371] fuse: fd is not a fuse device [ 122.862728][ T8375] batman_adv: batadv0: Adding interface: dummy0 [ 122.862746][ T8375] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 122.862761][ T8375] batman_adv: batadv0: Interface activated: dummy0 [ 122.886210][ T8375] batadv0: mtu less than device minimum [ 122.886720][ T8375] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 122.887309][ T8375] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 122.887833][ T8375] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 122.888311][ T8375] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 122.888791][ T8375] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 122.889290][ T8375] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 122.889777][ T8375] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 122.890262][ T8375] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 122.890748][ T8375] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 123.202087][ T8390] FAULT_INJECTION: forcing a failure. [ 123.202087][ T8390] name failslab, interval 1, probability 0, space 0, times 0 [ 123.202109][ T8390] CPU: 0 UID: 0 PID: 8390 Comm: syz.7.721 Tainted: G L syzkaller #0 PREEMPT(full) [ 123.202124][ T8390] Tainted: [L]=SOFTLOCKUP [ 123.202128][ T8390] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 123.202146][ T8390] Call Trace: [ 123.202150][ T8390] [ 123.202155][ T8390] dump_stack_lvl+0x100/0x190 [ 123.202220][ T8390] should_fail_ex.cold+0x5/0xa [ 123.202245][ T8390] should_failslab+0xc2/0x120 [ 123.202285][ T8390] kmem_cache_alloc_noprof+0x92/0x6a0 [ 123.202301][ T8390] ? anon_vma_clone+0x2b3/0xca0 [ 123.202321][ T8390] anon_vma_clone+0x2b3/0xca0 [ 123.202348][ T8390] __split_vma+0x750/0x1de0 [ 123.202363][ T8390] ? __pfx___split_vma+0x10/0x10 [ 123.202375][ T8390] ? mas_next_slot+0xc05/0x13a0 [ 123.202403][ T8390] vms_gather_munmap_vmas+0x3a5/0x1720 [ 123.202420][ T8390] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 123.202433][ T8390] ? lock_acquire+0x1d1/0x380 [ 123.202455][ T8390] ? futex_unqueue+0x29/0x2c0 [ 123.202471][ T8390] ? find_held_lock+0x2b/0x80 [ 123.202487][ T8390] ? futex_unqueue+0x133/0x2c0 [ 123.202501][ T8390] ? futex_unqueue+0x133/0x2c0 [ 123.202518][ T8390] ? futex_unqueue+0x13d/0x2c0 [ 123.202536][ T8390] do_vmi_align_munmap+0x287/0x5f0 [ 123.202550][ T8390] ? __pfx_do_vmi_align_munmap+0x10/0x10 [ 123.202563][ T8390] ? __pfx_futex_wake_mark+0x10/0x10 [ 123.202578][ T8390] ? __lock_acquire+0x5c0/0x1f40 [ 123.202602][ T8390] ? mas_walk+0x260/0x310 [ 123.202621][ T8390] do_vmi_munmap+0x1f8/0x3e0 [ 123.202635][ T8390] __vm_munmap+0x196/0x390 [ 123.202648][ T8390] ? __pfx___vm_munmap+0x10/0x10 [ 123.202670][ T8390] __x64_sys_munmap+0x59/0x80 [ 123.202685][ T8390] do_syscall_64+0x123/0x790 [ 123.202703][ T8390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.202715][ T8390] RIP: 0033:0x7fbceab9e559 [ 123.202725][ T8390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.202735][ T8390] RSP: 002b:00007fbcebb12028 EFLAGS: 00000246 ORIG_RAX: 000000000000000b [ 123.202747][ T8390] RAX: ffffffffffffffda RBX: 00007fbceae25fa0 RCX: 00007fbceab9e559 [ 123.202754][ T8390] RDX: 0000000000000000 RSI: 0000000000c5059c RDI: 00007fbce87d6000 [ 123.202760][ T8390] RBP: 00007fbceac35b20 R08: 0000000000000000 R09: 0000000000000000 [ 123.202766][ T8390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 123.202772][ T8390] R13: 00007fbceae26038 R14: 00007fbceae25fa0 R15: 00007ffe98d230d8 [ 123.202786][ T8390] [ 123.380513][ T8398] netlink: 72 bytes leftover after parsing attributes in process `syz.7.724'. [ 123.951918][ T8425] netlink: 8 bytes leftover after parsing attributes in process `syz.8.736'. [ 124.000857][ T8428] syz_tun: entered allmulticast mode [ 124.125554][ T8433] UDC core: g1: couldn't find an available UDC or it's busy [ 124.180975][ T8436] FAULT_INJECTION: forcing a failure. [ 124.180975][ T8436] name failslab, interval 1, probability 0, space 0, times 0 [ 124.181006][ T8436] CPU: 2 UID: 0 PID: 8436 Comm: syz.6.740 Tainted: G L syzkaller #0 PREEMPT(full) [ 124.181023][ T8436] Tainted: [L]=SOFTLOCKUP [ 124.181027][ T8436] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 124.181041][ T8436] Call Trace: [ 124.181046][ T8436] [ 124.181051][ T8436] dump_stack_lvl+0x100/0x190 [ 124.181109][ T8436] should_fail_ex.cold+0x5/0xa [ 124.181131][ T8436] should_failslab+0xc2/0x120 [ 124.181171][ T8436] __kmalloc_cache_noprof+0x91/0x6d0 [ 124.181185][ T8436] ? con_insert_unipair+0x1c0/0x270 [ 124.181202][ T8436] con_insert_unipair+0x1c0/0x270 [ 124.181239][ T8436] con_set_unimap+0x40e/0x640 [ 124.181257][ T8436] vt_ioctl+0xeea/0x3170 [ 124.181273][ T8436] ? __pfx_vt_ioctl+0x10/0x10 [ 124.181287][ T8436] ? tomoyo_path_number_perm+0x28f/0x580 [ 124.181330][ T8436] ? tomoyo_path_number_perm+0x188/0x580 [ 124.181349][ T8436] ? __pfx_futex_wait+0x10/0x10 [ 124.181370][ T8436] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 124.181388][ T8436] ? tty_jobctrl_ioctl+0x152/0xce0 [ 124.181401][ T8436] ? __pfx_vt_ioctl+0x10/0x10 [ 124.181416][ T8436] tty_ioctl+0x26a/0x1870 [ 124.181428][ T8436] ? __pfx_tty_ioctl+0x10/0x10 [ 124.181437][ T8436] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 124.181459][ T8436] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 124.181478][ T8436] ? __fget_files+0x34/0x3d0 [ 124.181501][ T8436] ? selinux_file_ioctl+0x13b/0x290 [ 124.181516][ T8436] ? selinux_file_ioctl+0xb6/0x290 [ 124.181533][ T8436] ? __pfx_tty_ioctl+0x10/0x10 [ 124.181544][ T8436] __x64_sys_ioctl+0x18e/0x210 [ 124.181559][ T8436] do_syscall_64+0x123/0x790 [ 124.181587][ T8436] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.181600][ T8436] RIP: 0033:0x7f4b6e59e559 [ 124.181611][ T8436] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.181622][ T8436] RSP: 002b:00007f4b6f3f0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 124.181635][ T8436] RAX: ffffffffffffffda RBX: 00007f4b6e825fa0 RCX: 00007f4b6e59e559 [ 124.181642][ T8436] RDX: 0000200000000240 RSI: 0000000000004b67 RDI: 0000000000000004 [ 124.181650][ T8436] RBP: 00007f4b6e635b20 R08: 0000000000000000 R09: 0000000000000000 [ 124.181657][ T8436] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.181664][ T8436] R13: 00007f4b6e826038 R14: 00007f4b6e825fa0 R15: 00007ffdeb1495b8 [ 124.181679][ T8436] [ 124.374944][ T8449] syzkaller1: entered promiscuous mode [ 124.374958][ T8449] syzkaller1: entered allmulticast mode [ 124.754555][ T8480] netdevsim netdevsim6: Firmware load for '..' refused, path contains '..' component [ 125.727614][ T8492] veth1_macvtap: left promiscuous mode [ 125.727631][ T8492] macsec0: entered promiscuous mode [ 125.727639][ T8492] macsec0: entered allmulticast mode [ 125.748535][ T8492] veth1_macvtap: entered promiscuous mode [ 125.748549][ T8492] veth1_macvtap: entered allmulticast mode [ 125.748564][ T8492] FAULT_INJECTION: forcing a failure. [ 125.748564][ T8492] name failslab, interval 1, probability 0, space 0, times 0 [ 125.748580][ T8492] CPU: 0 UID: 0 PID: 8492 Comm: syz.5.767 Tainted: G L syzkaller #0 PREEMPT(full) [ 125.748595][ T8492] Tainted: [L]=SOFTLOCKUP [ 125.748600][ T8492] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 125.748606][ T8492] Call Trace: [ 125.748611][ T8492] [ 125.748615][ T8492] dump_stack_lvl+0x100/0x190 [ 125.748635][ T8492] should_fail_ex.cold+0x5/0xa [ 125.748652][ T8492] should_failslab+0xc2/0x120 [ 125.748669][ T8492] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 125.748685][ T8492] ? __alloc_skb+0x140/0x710 [ 125.748707][ T8492] __alloc_skb+0x140/0x710 [ 125.748718][ T8492] ? __alloc_skb+0x5b7/0x710 [ 125.748729][ T8492] ? __pfx___alloc_skb+0x10/0x10 [ 125.748740][ T8492] ? if_nlmsg_size+0x4b/0xdc0 [ 125.748757][ T8492] rtmsg_ifinfo_build_skb+0x81/0x260 [ 125.748776][ T8492] rtmsg_ifinfo+0xa4/0x1b0 [ 125.748794][ T8492] __dev_notify_flags+0x362/0x4b0 [ 125.748808][ T8492] ? __pfx___dev_notify_flags+0x10/0x10 [ 125.748822][ T8492] ? lock_acquire+0x1d1/0x380 [ 125.748837][ T8492] ? do_raw_spin_lock+0x128/0x260 [ 125.748856][ T8492] __dev_set_promiscuity+0x21a/0x350 [ 125.748867][ T8492] ? netdev_work_dequeue+0x10a/0x310 [ 125.748884][ T8492] netif_set_promiscuity+0x52/0xf0 [ 125.748896][ T8492] dev_set_promiscuity+0xb2/0x260 [ 125.748912][ T8492] macsec_dev_open+0x2b3/0x5a0 [ 125.748923][ T8492] ? __pfx_macsec_dev_open+0x10/0x10 [ 125.748933][ T8492] ? vxlan_netdevice_event+0x11f/0x370 [ 125.748944][ T8492] ? __pfx_ib_device_get_by_netdev+0x10/0x10 [ 125.748958][ T8492] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 125.748972][ T8492] ? __pfx_vxlan_netdevice_event+0x10/0x10 [ 125.748983][ T8492] ? netconsole_netdev_event+0x5be/0xbc0 [ 125.749000][ T8492] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 125.749015][ T8492] ? ip6_route_dev_notify+0xe4/0x750 [ 125.749027][ T8492] ? ndisc_netdev_event+0xa1/0x560 [ 125.749043][ T8492] ? notifier_call_chain+0x31b/0x3f0 [ 125.749062][ T8492] ? __pfx_macsec_dev_open+0x10/0x10 [ 125.749074][ T8492] __dev_open+0x3ad/0x8f0 [ 125.749088][ T8492] ? __pfx___dev_open+0x10/0x10 [ 125.749104][ T8492] ? __local_bh_enable_ip+0xa5/0x120 [ 125.749118][ T8492] __dev_change_flags+0x596/0x850 [ 125.749131][ T8492] ? __pfx___dev_change_flags+0x10/0x10 [ 125.749143][ T8492] ? lock_acquire+0x1d1/0x380 [ 125.749155][ T8492] ? dev_ioctl+0x331/0x10e0 [ 125.749170][ T8492] netif_change_flags+0x8d/0x160 [ 125.749183][ T8492] dev_change_flags+0xba/0x260 [ 125.749198][ T8492] dev_ifsioc+0x166f/0x1f80 [ 125.749240][ T8492] ? __pfx_dev_ifsioc+0x10/0x10 [ 125.749253][ T8492] ? __pfx___mutex_lock+0x10/0x10 [ 125.749278][ T8492] ? lock_acquire+0x1d1/0x380 [ 125.749293][ T8492] ? dev_load+0x8e/0x240 [ 125.749304][ T8492] ? dev_load+0x8e/0x240 [ 125.749320][ T8492] dev_ioctl+0x342/0x10e0 [ 125.749334][ T8492] sock_do_ioctl+0x1a0/0x280 [ 125.749351][ T8492] ? __pfx_sock_do_ioctl+0x10/0x10 [ 125.749367][ T8492] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 125.749390][ T8492] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 125.749404][ T8492] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 125.749425][ T8492] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 125.749460][ T8492] sock_ioctl+0x599/0x6b0 [ 125.749477][ T8492] ? __pfx_sock_ioctl+0x10/0x10 [ 125.749496][ T8492] ? selinux_file_ioctl+0x13b/0x290 [ 125.749512][ T8492] ? selinux_file_ioctl+0xb6/0x290 [ 125.749529][ T8492] ? __pfx_sock_ioctl+0x10/0x10 [ 125.749546][ T8492] __x64_sys_ioctl+0x18e/0x210 [ 125.749560][ T8492] do_syscall_64+0x123/0x790 [ 125.749580][ T8492] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.749591][ T8492] RIP: 0033:0x7fa55f39e559 [ 125.749602][ T8492] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.749612][ T8492] RSP: 002b:00007fa56032d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 125.749624][ T8492] RAX: ffffffffffffffda RBX: 00007fa55f625fa0 RCX: 00007fa55f39e559 [ 125.749631][ T8492] RDX: 0000200000000240 RSI: 0000000000008914 RDI: 0000000000000003 [ 125.749638][ T8492] RBP: 00007fa55f435b20 R08: 0000000000000000 R09: 0000000000000000 [ 125.749644][ T8492] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.749651][ T8492] R13: 00007fa55f626038 R14: 00007fa55f625fa0 R15: 00007ffdf20ecf78 [ 125.749668][ T8492] [ 125.749745][ T8492] macsec0: left promiscuous mode [ 125.749847][ T8492] macsec0: left allmulticast mode [ 125.749855][ T8492] veth1_macvtap: left allmulticast mode [ 125.947196][ T8503] jffs2: notice: (8503) jffs2_build_xattr_subsystem: complete building xattr subsystem, 3 of xdatum (0 unchecked, 1 orphan) and 4 of xref (0 dead, 2 orphan) found. [ 125.952940][ T42] kauditd_printk_skb: 21 callbacks suppressed [ 125.952960][ T42] audit: type=1400 audit(1792484924.481:749): avc: denied { bind } for pid=8502 comm="syz.5.770" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 125.952983][ T42] audit: type=1400 audit(1792484924.481:750): avc: denied { name_bind } for pid=8502 comm="syz.5.770" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 125.953002][ T42] audit: type=1400 audit(1792484924.481:751): avc: denied { node_bind } for pid=8502 comm="syz.5.770" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 125.955236][ T42] audit: type=1400 audit(1792484924.481:752): avc: denied { connect } for pid=8502 comm="syz.5.770" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 126.004097][ T42] audit: type=1400 audit(1792484924.531:753): avc: denied { write } for pid=8502 comm="syz.5.770" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 126.030924][ T8507] lo: entered promiscuous mode [ 126.035193][ T8507] tunl0: entered promiscuous mode [ 126.036109][ T8507] gre0: entered promiscuous mode [ 126.042876][ T8507] gretap0: entered promiscuous mode [ 126.046337][ T8507] erspan0: entered promiscuous mode [ 126.053007][ T8507] ip_vti0: entered promiscuous mode [ 126.053819][ T8507] ip6_vti0: entered promiscuous mode [ 126.054922][ T8507] sit0: entered promiscuous mode [ 126.063847][ T8507] ip6tnl0: entered promiscuous mode [ 126.065072][ T8507] ip6gre0: entered promiscuous mode [ 126.073594][ T8507] syz_tun: entered promiscuous mode [ 126.079829][ T8507] ip6gretap0: entered promiscuous mode [ 126.082200][ T8507] bridge0: port 2(bridge_slave_1) entered disabled state [ 126.083240][ T8507] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.083926][ T8507] bridge0: entered promiscuous mode [ 126.086538][ T8507] vcan0: entered promiscuous mode [ 126.089842][ T8507] bond0: entered promiscuous mode [ 126.089852][ T8507] bond_slave_0: entered promiscuous mode [ 126.089983][ T8507] bond_slave_1: entered promiscuous mode [ 126.091914][ T8507] team0: entered promiscuous mode [ 126.091924][ T8507] team_slave_0: entered promiscuous mode [ 126.092017][ T8507] team_slave_1: entered promiscuous mode [ 126.094799][ T8507] dummy0: entered promiscuous mode [ 126.097465][ T8507] nlmon0: entered promiscuous mode [ 126.099887][ T8507] batadv0: entered promiscuous mode [ 126.101496][ T8507] vxcan0: entered promiscuous mode [ 126.101983][ T8507] vxcan1: entered promiscuous mode [ 126.102373][ T8507] veth0: entered promiscuous mode [ 126.103405][ T8507] veth1: entered promiscuous mode [ 126.106144][ T8507] wg0: entered promiscuous mode [ 126.106442][ T8511] netlink: 32 bytes leftover after parsing attributes in process `syz.5.773'. [ 126.110246][ T8507] wg2: entered promiscuous mode [ 126.112196][ T8507] veth0_to_bridge: entered promiscuous mode [ 126.114525][ T8507] veth1_to_bridge: entered promiscuous mode [ 126.121352][ T8507] veth0_to_bond: entered promiscuous mode [ 126.123782][ T8507] veth1_to_bond: entered promiscuous mode [ 126.125356][ T8507] veth0_to_team: entered promiscuous mode [ 126.127787][ T8507] veth1_to_team: entered promiscuous mode [ 126.131073][ T8507] veth0_to_batadv: entered promiscuous mode [ 126.133716][ T8507] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 126.133742][ T8507] batadv_slave_0: entered promiscuous mode [ 126.135228][ T8507] veth1_to_batadv: entered promiscuous mode [ 126.136462][ T8507] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 126.136486][ T8507] batadv_slave_1: entered promiscuous mode [ 126.137711][ T8507] xfrm0: entered promiscuous mode [ 126.139395][ T8507] veth0_to_hsr: entered promiscuous mode [ 126.141554][ T8507] veth1_to_hsr: entered promiscuous mode [ 126.145675][ T8507] hsr0: entered promiscuous mode [ 126.146910][ T8507] veth1_virt_wifi: entered promiscuous mode [ 126.148789][ T8507] veth0_virt_wifi: entered promiscuous mode [ 126.150019][ T8507] virt_wifi0: entered promiscuous mode [ 126.152773][ T8507] vlan0: entered promiscuous mode [ 126.154637][ T8507] macvlan0: entered promiscuous mode [ 126.156471][ T8507] macvlan1: entered promiscuous mode [ 126.164666][ T8507] ipvlan0: entered promiscuous mode [ 126.164767][ T8507] ipvlan1: entered promiscuous mode [ 126.166594][ T8513] netlink: 32 bytes leftover after parsing attributes in process `syz.5.773'. [ 126.173410][ T8507] macvtap0: entered promiscuous mode [ 126.174709][ T8507] macsec0: entered promiscuous mode [ 126.179696][ T8507] geneve0: entered promiscuous mode [ 126.182913][ T8507] geneve1: entered promiscuous mode [ 126.187805][ T8507] netdevsim netdevsim8 netdevsim0: entered promiscuous mode [ 126.190093][ T8507] netdevsim netdevsim8 netdevsim1: entered promiscuous mode [ 126.192945][ T8507] netdevsim netdevsim8 netdevsim2: entered promiscuous mode [ 126.194180][ T8507] netdevsim netdevsim8 netdevsim3: entered promiscuous mode [ 126.208734][ T8507] mac80211_hwsim hwsim18 wlan0: entered promiscuous mode [ 126.220519][ T8507] mac80211_hwsim hwsim19 wlan1: entered promiscuous mode [ 126.221418][ T8507] veth2: entered promiscuous mode [ 126.221615][ T8507] veth3: entered promiscuous mode [ 126.221952][ T8507] bond1: entered promiscuous mode [ 126.223338][ T8507] veth4: entered promiscuous mode [ 126.223481][ T8507] veth5: entered promiscuous mode [ 126.223974][ T8507] syzkaller0: entered promiscuous mode [ 126.224484][ T8507] bridge1: entered promiscuous mode [ 126.225561][ T8509] syzkaller0: entered promiscuous mode [ 126.225572][ T8509] syzkaller0: entered allmulticast mode [ 126.293996][ T42] audit: type=1400 audit(1792484924.821:754): avc: denied { write } for pid=8516 comm="syz.8.775" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 126.317743][ T5828] netdevsim netdevsim8 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.317770][ T5828] netdevsim netdevsim8 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.317788][ T5828] netdevsim netdevsim8 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.317805][ T5828] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.390376][ T8522] syzkaller0: left promiscuous mode [ 126.451858][ T8526] bond0: (slave batadv0): Releasing backup interface [ 126.454173][ T8526] batadv0: left promiscuous mode [ 126.465731][ T8526] bridge_slave_0: left allmulticast mode [ 126.465746][ T8526] bridge_slave_0: left promiscuous mode [ 126.465844][ T8526] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.479692][ T8526] bridge_slave_1: left allmulticast mode [ 126.479707][ T8526] bridge_slave_1: left promiscuous mode [ 126.479797][ T8526] bridge0: port 2(bridge_slave_1) entered disabled state [ 126.505184][ T8526] bond0: (slave bond_slave_0): Releasing backup interface [ 126.506569][ T8526] bond_slave_0: left promiscuous mode [ 126.513481][ T8526] bond0: (slave bond_slave_1): Releasing backup interface [ 126.517807][ T8526] bond_slave_1: left promiscuous mode [ 126.528992][ T8526] team0: Port device team_slave_0 removed [ 126.532458][ T8526] team0: Port device team_slave_1 removed [ 126.532861][ T8526] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 126.532872][ T8526] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 126.533885][ T8526] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 126.533894][ T8526] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 126.543618][ T42] audit: type=1800 audit(1792484925.071:755): pid=8538 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.6.784" name=08 dev="sda1" ino=2049 res=0 errno=0 [ 126.573753][ T8533] team0: Mode changed to "loadbalance" [ 126.582241][ T8539] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 126.643009][ T8542] binder: 8540:8542 ioctl c0306201 2000000000c0 returned -14 [ 126.645023][ T8542] binder: 8540:8542 ioctl c0306201 200000000340 returned -14 [ 126.670387][ T8545] netlink: 'syz.7.787': attribute type 1 has an invalid length. [ 126.690543][ T42] audit: type=1400 audit(1792484925.221:756): avc: denied { read } for pid=8541 comm="syz.6.785" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 126.720202][ T8545] bond2: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 126.733397][ T8545] macvlan2: entered promiscuous mode [ 126.733410][ T8545] macvlan2: entered allmulticast mode [ 126.734653][ T8545] bond2: entered promiscuous mode [ 126.739049][ T8545] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 126.741220][ T8545] bond2: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 126.758850][ T8545] bond2: left promiscuous mode [ 126.778044][ T42] audit: type=1800 audit(1792484925.311:757): pid=8549 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=set_data cause=unavailable-hash-algorithm comm="syz.6.785" name="/newroot/114/bus/#684//deleted" dev="tmpfs" ino=684 res=0 errno=0 [ 126.922701][ T8557] netlink: 28 bytes leftover after parsing attributes in process `syz.7.790'. [ 126.922725][ T8557] netlink: 28 bytes leftover after parsing attributes in process `syz.7.790'. [ 126.922750][ T8557] netlink: 8 bytes leftover after parsing attributes in process `syz.7.790'. [ 127.235110][ T8570] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 127.235155][ T8570] lo speed is unknown, defaulting to 1000 [ 127.235185][ T8570] lo speed is unknown, defaulting to 1000 [ 127.235990][ T8570] lo speed is unknown, defaulting to 1000 [ 127.236407][ T8570] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 127.236426][ T8570] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 127.236450][ T8570] smbdirect: ib_dev[syz_device_name_32_chars_1234567]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 127.242256][ T8570] infiniband syz_device_name_32_chars_1234567: RDMA CMA: cma_listen_on_dev, error -22 [ 127.254947][ T8570] lo speed is unknown, defaulting to 1000 [ 127.255673][ T8570] lo speed is unknown, defaulting to 1000 [ 127.257340][ T8570] lo speed is unknown, defaulting to 1000 [ 127.258004][ T8570] lo speed is unknown, defaulting to 1000 [ 127.283665][ T8572] netlink: 20 bytes leftover after parsing attributes in process `syz.5.796'. [ 127.290348][ T8572] geneve2: entered promiscuous mode [ 127.713112][ T8591] netlink: 'syz.6.804': attribute type 1 has an invalid length. [ 127.742678][ T8591] 8021q: adding VLAN 0 to HW filter on device bond1 [ 127.765784][ T8591] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 127.833604][ T8594] 9pnet: p9_errstr2errno: server reported unknown error 0x000000000 [ 128.031225][ T8606] netlink: 'syz.7.808': attribute type 1 has an invalid length. [ 128.224765][ T8612] bridge0: left promiscuous mode [ 128.224790][ T8612] bridge0: entered allmulticast mode [ 128.248412][ T8612] bridge_slave_1: left allmulticast mode [ 128.249790][ T8612] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.276666][ T8612] bridge_slave_0: left allmulticast mode [ 128.276817][ T8612] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.292638][ T8616] random: crng reseeded on system resumption [ 128.295199][ T42] audit: type=1400 audit(1792484926.821:758): avc: denied { append } for pid=8615 comm="syz.5.813" name="snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 128.349249][ T8617] syz_tun: entered allmulticast mode [ 128.364954][ T8614] pimreg: entered allmulticast mode [ 128.386377][ T8614] netlink: 4 bytes leftover after parsing attributes in process `syz.6.812'. [ 128.417451][ T5808] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 128.417469][ T8624] net_ratelimit: 13 callbacks suppressed [ 128.417482][ T8624] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 128.417487][ T5808] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 128.417512][ T5808] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 128.421690][ T8613] syz_tun: left allmulticast mode [ 128.421806][ T8613] pimreg: left allmulticast mode [ 128.465136][ T8621] 0: reclassify loop, rule prio 0, protocol 03 [ 128.507286][ T5828] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 128.523226][ T8631] netlink: 4 bytes leftover after parsing attributes in process `syz.8.817'. [ 128.802221][ T8645] veth0_to_team: left promiscuous mode [ 129.257495][ T8665] netlink: 8 bytes leftover after parsing attributes in process `syz.6.831'. [ 129.257510][ T8665] netlink: 8 bytes leftover after parsing attributes in process `syz.6.831'. [ 129.343231][ T8669] fuse-io-uring is disabled by module parameter [ 129.482318][ T8677] ucma_write: process 311 (syz.6.836) changed security contexts after opening file descriptor, this is not allowed. [ 129.699716][ T8690] syzkaller0: entered promiscuous mode [ 129.699730][ T8690] syzkaller0: entered allmulticast mode [ 130.767175][ T5730] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 130.767819][ T5730] Bluetooth: hci0: command 0x0419 tx timeout [ 130.921691][ T8736] batman_adv: batadv0: Adding interface: syz_tun [ 130.921702][ T8736] batman_adv: batadv0: The MTU of interface syz_tun is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 130.921718][ T8736] batman_adv: batadv0: Interface activated: syz_tun [ 131.236063][ T8754] tipc: Started in network mode [ 131.236082][ T8754] tipc: Node identity 52f556fcbdc5, cluster identity 4711 [ 131.236455][ T8754] tipc: Enabled bearer , priority 0 [ 131.310447][ T8758] mmap: syz.5.870 (8758): VmData 37523456 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 131.428753][ T8762] X.509: signatureAlgorithm (12) differs from tbsCertificate.signature (13) [ 131.485877][ T42] kauditd_printk_skb: 14 callbacks suppressed [ 131.485888][ T42] audit: type=1400 audit(1792484930.011:773): avc: denied { ioctl } for pid=8761 comm="syz.5.873" path="socket:[31080]" dev="sockfs" ino=31080 ioctlcmd=0x894b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 131.603155][ T8771] Bluetooth: (null): Invalid header checksum [ 131.817579][ T42] audit: type=1400 audit(1792484930.351:774): avc: denied { write } for pid=8778 comm="syz.5.881" name="001" dev="devtmpfs" ino=757 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 131.850958][ T42] audit: type=1404 audit(1792484930.381:775): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=selinux res=1 [ 131.926911][ T42] audit: type=1404 audit(1792484930.451:776): enforcing=0 old_enforcing=1 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=selinux res=1 [ 132.023650][ T42] audit: type=1400 audit(1792484930.551:777): avc: denied { bind } for pid=8780 comm="syz.7.882" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 132.036928][ T42] audit: type=1400 audit(1792484930.551:778): avc: denied { accept } for pid=8780 comm="syz.7.882" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 132.037046][ T42] audit: type=1400 audit(1792484930.571:779): avc: denied { setopt } for pid=8780 comm="syz.7.882" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 132.037067][ T42] audit: type=1400 audit(1792484930.571:780): avc: denied { create } for pid=8780 comm="syz.7.882" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 132.037085][ T42] audit: type=1400 audit(1792484930.571:781): avc: denied { write } for pid=8780 comm="syz.7.882" path="socket:[31099]" dev="sockfs" ino=31099 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 132.043659][ T42] audit: type=1400 audit(1792484930.571:782): avc: denied { read } for pid=8780 comm="syz.7.882" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 132.227122][ T5157] tipc: Node number set to 4012922620 [ 132.514194][ T8792] netlink: 28 bytes leftover after parsing attributes in process `syz.6.885'. [ 132.685545][ T8803] mmap: syz.8.889 (8803) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 132.721869][ T8806] 9pnet: p9_errstr2errno: server reported unknown error 0x0000000000 [ 132.736761][ T8814] netlink: 32 bytes leftover after parsing attributes in process `syz.5.891'. [ 132.895672][ T8828] loop5: detected capacity change from 0 to 7 [ 132.908050][ T8828] loop5: p1 p3 p4 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22 p23 p24 p25 p26 p27 p28 p29 p30 p31 p32 p33 p34 p35 p36 p37 p38 p39 p40 p41 p42 p43 p44 p45 p46 p47 p48 p49 p50 p51 p52 p53 p54 p55 p56 p57 p58 p59 p60 p61 p62 p63 p64 p65 p66 p67 p68 p69 p70 p71 p72 p73 p74 p75 p76 p77 p78 p79 p80 p81 p82 p83 p84 p85 p86 p87 p88 p89 p90 p91 p92 p93 p94 p95 p96 p97 p98 p99 p100 p101 p102 p103 p104 p105 p106 p107 p108 p109 p110 p111 p112 p113 p114 p115 p116 p117 p118 p119 p120 p121 p122 p123 p124 p125 p126 p127 p128 p129 p130 p131 p132 p133 p134 p135 p136 p137 p138 p139 p140 p141 p142 p143 p144 p145 p146 p147 p148 p149 p150 p151 p152 p153 p154 p155 p156 p157 p158 p159 p160 p161 p162 p163 p164 p165 p166 p167 p168 p169 p170 p171 p172 p173 p174 p175 p176 p177 p178 p179 p180 p181 p182 p183 p184 p185 p186 p187 p188 p189 p190 p191 p192 p193 p194 p195 p196 p197 p198 p199 p200 p201 p202 p203 p204 p205 p206 p207 p208 p209 p210 p211 p212 p213 p214 p215 p216 p217 p218 p219 p220 p221 p222 p223 p224 p2 [ 132.908097][ T8828] loop5: partition table partially beyond EOD, truncated [ 133.077098][ T10] usb 10-1: new full-speed USB device number 5 using dummy_hcd [ 133.091038][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.091082][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.230249][ T10] usb 10-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 133.231110][ T10] usb 10-1: config 0 has an invalid interface number: 3 but max is 0 [ 133.231129][ T10] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 133.231144][ T10] usb 10-1: config 0 has no interface number 0 [ 133.248504][ T10] usb 10-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 133.248519][ T10] usb 10-1: Product: syz [ 133.248526][ T10] usb 10-1: Manufacturer: syz [ 133.248534][ T10] usb 10-1: SerialNumber: syz [ 133.255632][ T10] usb 10-1: config 0 descriptor?? [ 133.526653][ T10] usb 10-1: USB disconnect, device number 5 [ 133.682949][ T8860] syzkaller0: left promiscuous mode [ 133.682963][ T8860] syzkaller0: left allmulticast mode [ 133.899914][ T8871] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 133.900231][ T8871] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.012518][ T8840] udevd[8840]: inotify_add_watch(7, /dev/loop5p7, 10) failed: No such file or directory [ 134.013810][ T8838] udevd[8838]: inotify_add_watch(7, /dev/loop5p5, 10) failed: No such file or directory [ 134.020061][ T8840] udevd[8840]: inotify_add_watch(7, /dev/loop5p20, 10) failed: No such file or directory [ 134.029595][ T8840] udevd[8840]: inotify_add_watch(7, /dev/loop5p22, 10) failed: No such file or directory [ 134.034479][ T8839] udevd[8839]: inotify_add_watch(7, /dev/loop5p6, 10) failed: No such file or directory [ 134.035552][ T8842] udevd[8842]: inotify_add_watch(7, /dev/loop5p9, 10) failed: No such file or directory [ 134.036251][ T8841] udevd[8841]: inotify_add_watch(7, /dev/loop5p8, 10) failed: No such file or directory [ 134.054309][ T8849] udevd[8849]: inotify_add_watch(7, /dev/loop5p14, 10) failed: No such file or directory [ 134.054593][ T8844] udevd[8844]: inotify_add_watch(7, /dev/loop5p10, 10) failed: No such file or directory [ 134.056420][ T8840] udevd[8840]: inotify_add_watch(7, /dev/loop5p23, 10) failed: No such file or directory [ 134.136804][ T8871] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 134.137814][ T8871] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.413242][ T8875] netlink: 4 bytes leftover after parsing attributes in process `syz.5.912'. [ 134.570487][ T8871] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 134.570698][ T8871] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.595967][ T8875] netlink: 4 bytes leftover after parsing attributes in process `syz.5.912'. [ 134.948926][ T8879] mount: server 127. not responding, timed out [ 135.006051][ T8891] netlink: 'syz.6.916': attribute type 32 has an invalid length. [ 135.006064][ T8891] netlink: 8 bytes leftover after parsing attributes in process `syz.6.916'. [ 135.027470][ T8891] bond2: option coupled_control: invalid value (110) [ 135.029589][ T8891] bond2 (unregistering): Released all slaves [ 135.047172][ T8887] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 136.988910][ T42] kauditd_printk_skb: 116 callbacks suppressed [ 136.988930][ T42] audit: type=1400 audit(1792484935.521:899): avc: denied { read write } for pid=8941 comm="syz.5.934" name="vhost-net" dev="devtmpfs" ino=1297 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 136.989235][ T42] audit: type=1400 audit(1792484935.521:900): avc: denied { open } for pid=8941 comm="syz.5.934" path="/dev/vhost-net" dev="devtmpfs" ino=1297 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 136.992941][ T42] audit: type=1400 audit(1792484935.521:901): avc: denied { ioctl } for pid=8941 comm="syz.5.934" path="/dev/vhost-net" dev="devtmpfs" ino=1297 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 137.160110][ T42] audit: type=1400 audit(1792484935.691:902): avc: denied { setopt } for pid=8950 comm="syz.5.938" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 137.166605][ T42] audit: type=1400 audit(1792484935.691:903): avc: denied { mount } for pid=8946 comm="syz.6.936" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 137.193499][ T8952] bridge_slave_0: left allmulticast mode [ 137.193516][ T8952] bridge_slave_0: left promiscuous mode [ 137.195538][ T8952] bridge0: port 1(bridge_slave_0) entered disabled state [ 137.215237][ T8952] bridge_slave_1: left allmulticast mode [ 137.215254][ T8952] bridge_slave_1: left promiscuous mode [ 137.215369][ T8952] bridge0: port 2(bridge_slave_1) entered disabled state [ 137.234472][ T8952] bond0: (slave bond_slave_0): Releasing backup interface [ 137.243402][ T8952] bond0: (slave bond_slave_1): Releasing backup interface [ 137.251500][ T8952] team0: Port device team_slave_0 removed [ 137.258850][ T8952] team0: Port device team_slave_1 removed [ 137.263149][ T8952] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 137.263168][ T8952] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 137.265009][ T8952] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 137.265025][ T8952] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 137.269751][ T8952] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 137.290320][ T8954] team0: Port device xfrm0 added [ 137.316593][ T8952] tipc: Enabled bearer , priority 0 [ 137.321386][ T8951] ftl_cs: FTL header not found. [ 137.352089][ T8957] netlink: 'syz.8.939': attribute type 1 has an invalid length. [ 137.494777][ T42] audit: type=1400 audit(1792484936.021:904): avc: denied { create } for pid=8961 comm="syz.5.942" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 137.517968][ T8951] block2mtd: mtd1: [/dev/zram0] erase_size = 0KiB [65] [ 137.625892][ T8968] netlink: 14 bytes leftover after parsing attributes in process `syz.5.944'. [ 137.813235][ T42] audit: type=1400 audit(1792484936.341:905): avc: denied { unlink } for pid=6401 comm="syz-executor" name="file0" dev="tmpfs" ino=1182 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 137.847301][ T42] audit: type=1400 audit(1792484936.371:906): avc: denied { bind } for pid=8975 comm="syz.5.947" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 137.847348][ T42] audit: type=1400 audit(1792484936.371:907): avc: denied { setopt } for pid=8975 comm="syz.5.947" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 137.848876][ T8976] netlink: 28 bytes leftover after parsing attributes in process `syz.5.947'. [ 137.939293][ T42] audit: type=1400 audit(1792484936.471:908): avc: denied { unmount } for pid=6773 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 137.974443][ T8979] netlink: 44 bytes leftover after parsing attributes in process `syz.5.948'. [ 138.300609][ T8990] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 138.650111][ T9005] netlink: 12 bytes leftover after parsing attributes in process `syz.8.959'. [ 138.732483][ T8978] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 138.732500][ T8978] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 138.857564][ T8978] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 138.857579][ T8978] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 138.862442][ T8978] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 138.862456][ T8978] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 138.949418][ T8978] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 138.949432][ T8978] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 139.034859][ T9025] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 139.042123][ T9027] netlink: 28 bytes leftover after parsing attributes in process `syz.8.967'. [ 139.733226][ T9051] ip_tables: iptables: counters copy to user failed while replacing table [ 139.944267][ T9058] syzkaller0: Caught tx_queue_len zero misconfig [ 139.965650][ T208] IPVS: starting estimator thread 0... [ 140.047309][ T9063] IPVS: using max 23 ests per chain, 55200 per kthread [ 140.068793][ T9066] bridge0: port 1(dummy0) entered blocking state [ 140.068925][ T9066] bridge0: port 1(dummy0) entered disabled state [ 140.069054][ T9066] dummy0: entered allmulticast mode [ 140.070334][ T9066] dummy0: entered promiscuous mode [ 140.080349][ T9066] bridge0: port 1(dummy0) entered blocking state [ 140.080397][ T9066] bridge0: port 1(dummy0) entered forwarding state [ 140.100657][ T9068] veth0: Caught tx_queue_len zero misconfig [ 140.613765][ T9088] IPVS: Error connecting to the multicast addr [ 141.044952][ T9095] netlink: 44 bytes leftover after parsing attributes in process `syz.5.991'. [ 141.137106][ T5157] usb 11-1: new high-speed USB device number 4 using dummy_hcd [ 141.308935][ T5157] usb 11-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 141.309867][ T5157] usb 11-1: config 1 has an invalid interface number: 3 but max is 0 [ 141.309886][ T5157] usb 11-1: config 1 has no interface number 0 [ 141.311761][ T5157] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 141.311778][ T5157] usb 11-1: Product: syz [ 141.311791][ T5157] usb 11-1: Manufacturer: syz [ 141.311802][ T5157] usb 11-1: SerialNumber: syz [ 141.344534][ T5157] usb 11-1: 3:1 : does not exist [ 141.344554][ T5157] usb 11-1: 3:2 : does not exist [ 141.366723][ T9097] syzkaller0: entered promiscuous mode [ 141.366744][ T9097] syzkaller0: entered allmulticast mode [ 141.788995][ T9116] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 142.084025][ T24] usb 11-1: USB disconnect, device number 4 [ 142.316921][ T9102] ceph: No mds server is up or the cluster is laggy [ 142.458530][ T42] kauditd_printk_skb: 41 callbacks suppressed [ 142.458542][ T42] audit: type=1400 audit(1792484940.991:950): avc: denied { connect } for pid=9121 comm="syz.8.1001" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 142.464751][ T42] audit: type=1400 audit(1792484940.991:951): avc: denied { bind } for pid=9123 comm="syz.7.1000" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 142.465431][ T42] audit: type=1400 audit(1792484940.991:952): avc: denied { listen } for pid=9123 comm="syz.7.1000" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 142.465932][ T42] audit: type=1400 audit(1792484940.991:953): avc: denied { connect } for pid=9123 comm="syz.7.1000" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 142.476713][ T42] audit: type=1400 audit(1792484941.001:954): avc: denied { create } for pid=9125 comm="syz.5.1002" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 142.479531][ T42] audit: type=1400 audit(1792484941.011:955): avc: denied { setopt } for pid=9125 comm="syz.5.1002" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 142.490005][ T42] audit: type=1404 audit(1792484941.021:956): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=selinux res=1 [ 142.491811][ T42] audit: type=1400 audit(1792484941.021:957): avc: denied { write } for pid=9121 comm="syz.8.1001" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=0 [ 142.492134][ T42] audit: type=1400 audit(1792484941.021:958): avc: denied { write } for pid=9121 comm="syz.8.1001" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=0 [ 142.532075][ T42] audit: type=1400 audit(1792484941.061:959): avc: denied { getopt } for pid=9123 comm="syz.7.1000" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=0 [ 142.541556][ T9127] netlink: 'syz.5.1002': attribute type 10 has an invalid length. [ 142.541568][ T9127] netlink: 55 bytes leftover after parsing attributes in process `syz.5.1002'. [ 142.580944][ T9127] bond1: (slave macvlan0): Releasing active interface [ 142.660983][ T9136] netlink: 36 bytes leftover after parsing attributes in process `syz.8.1006'. [ 142.664585][ T9137] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 143.309626][ T9161] IPVS: Error connecting to the multicast addr [ 143.693965][ T9174] ip_tables: iptables: counters copy to user failed while replacing table [ 143.875939][ T9183] netlink: 'syz.5.1024': attribute type 1 has an invalid length. [ 143.923514][ T9183] bond3: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 143.935582][ T9183] macvlan0: entered promiscuous mode [ 143.935601][ T9183] macvlan0: entered allmulticast mode [ 143.936147][ T9183] bond3: entered promiscuous mode [ 143.936553][ T9183] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 143.944929][ T9183] bond3: left promiscuous mode [ 144.323391][ T9215] netlink: 16 bytes leftover after parsing attributes in process `syz.8.1038'. [ 144.837654][ T9246] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1052'. [ 144.837675][ T9246] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1052'. [ 144.951013][ T9253] syzkaller0: entered promiscuous mode [ 144.951028][ T9253] syzkaller0: entered allmulticast mode [ 145.155239][ T9257] rxe_eth0 speed is unknown, defaulting to 1000 [ 145.236638][ T9259] tipc: Resetting bearer [ 145.363639][ T9257] dummy0 speed is unknown, defaulting to 1000 [ 145.377332][ T13] netdevsim netdevsim5 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 145.377363][ T13] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.377395][ T13] netdevsim netdevsim5 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 145.377417][ T13] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.377446][ T13] netdevsim netdevsim5 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 145.377468][ T13] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.377496][ T13] netdevsim netdevsim5 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 145.377518][ T13] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.708702][ T9257] lo speed is unknown, defaulting to 1000 [ 145.978246][ T9297] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1075'. [ 146.171946][ T9305] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 146.172796][ T9305] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 146.266340][ T9307] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1079'. [ 146.646540][ T9339] ================================================================== [ 146.646564][ T9339] BUG: KASAN: slab-out-of-bounds in soft_cursor+0x458/0xa10 [ 146.646601][ T9339] Read of size 42 at addr ffff88805a25b74c by task syz.7.1094/9339 [ 146.646610][ T9339] [ 146.646618][ T9339] CPU: 0 UID: 0 PID: 9339 Comm: syz.7.1094 Tainted: G L syzkaller #0 PREEMPT(full) [ 146.646634][ T9339] Tainted: [L]=SOFTLOCKUP [ 146.646639][ T9339] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 146.646654][ T9339] Call Trace: [ 146.646658][ T9339] [ 146.646662][ T9339] dump_stack_lvl+0x100/0x190 [ 146.646725][ T9339] print_report+0x13d/0x4b0 [ 146.646749][ T9339] ? __virt_addr_valid+0x239/0x430 [ 146.646775][ T9339] ? soft_cursor+0x458/0xa10 [ 146.646788][ T9339] kasan_report+0xdf/0x1c0 [ 146.646818][ T9339] ? soft_cursor+0x458/0xa10 [ 146.646835][ T9339] kasan_check_range+0x10f/0x1e0 [ 146.646846][ T9339] __asan_memcpy+0x23/0x60 [ 146.646858][ T9339] soft_cursor+0x458/0xa10 [ 146.646875][ T9339] cw_cursor+0xd70/0x15b0 [ 146.646891][ T9339] ? __pfx_cw_cursor+0x10/0x10 [ 146.646908][ T9339] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 146.646923][ T9339] ? get_color+0x1da/0x450 [ 146.646935][ T9339] ? __pfx_cw_cursor+0x10/0x10 [ 146.646948][ T9339] fbcon_cursor+0x43c/0x5e0 [ 146.646960][ T9339] ? __mutex_unlock_slowpath+0x35d/0x930 [ 146.646988][ T9339] hide_cursor+0x87/0x230 [ 146.647005][ T9339] redraw_screen+0x5d4/0x760 [ 146.647020][ T9339] ? mark_held_locks+0x40/0x70 [ 146.647033][ T9339] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 146.647049][ T9339] ? __pfx_redraw_screen+0x10/0x10 [ 146.647064][ T9339] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 146.647081][ T9339] vc_do_resize+0xc3d/0xeb0 [ 146.647098][ T9339] ? __pfx_vc_do_resize+0x10/0x10 [ 146.647113][ T9339] ? __local_bh_enable_ip+0xa5/0x120 [ 146.647126][ T9339] ? lockdep_hardirqs_on+0x7d/0x110 [ 146.647148][ T9339] ? kernel_fpu_end+0x5f/0x80 [ 146.647162][ T9339] ? __local_bh_enable_ip+0xa5/0x120 [ 146.647174][ T9339] fbcon_do_set_font+0x443/0x8c0 [ 146.647188][ T9339] fbcon_set_font+0x4be/0x730 [ 146.647201][ T9339] ? __pfx_fbcon_set_font+0x10/0x10 [ 146.647213][ T9339] con_font_op+0x991/0x1020 [ 146.647225][ T9339] ? __pfx_con_font_op+0x10/0x10 [ 146.647236][ T9339] ? __might_fault+0xc5/0x140 [ 146.647248][ T9339] ? __might_fault+0xc5/0x140 [ 146.647260][ T9339] vt_ioctl+0xe00/0x3170 [ 146.647273][ T9339] ? __pfx_vt_ioctl+0x10/0x10 [ 146.647286][ T9339] ? tomoyo_path_number_perm+0x28f/0x580 [ 146.647316][ T9339] ? tomoyo_path_number_perm+0x188/0x580 [ 146.647335][ T9339] ? __pfx_futex_wait+0x10/0x10 [ 146.647347][ T9339] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 146.647379][ T9339] ? tty_jobctrl_ioctl+0x152/0xce0 [ 146.647393][ T9339] ? __pfx_vt_ioctl+0x10/0x10 [ 146.647407][ T9339] tty_ioctl+0x26a/0x1870 [ 146.647418][ T9339] ? __pfx_tty_ioctl+0x10/0x10 [ 146.647428][ T9339] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 146.647447][ T9339] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 146.647465][ T9339] ? __fget_files+0x34/0x3d0 [ 146.647484][ T9339] ? selinux_file_ioctl+0x13b/0x290 [ 146.647499][ T9339] ? selinux_file_ioctl+0xb6/0x290 [ 146.647514][ T9339] ? __pfx_tty_ioctl+0x10/0x10 [ 146.647524][ T9339] __x64_sys_ioctl+0x18e/0x210 [ 146.647538][ T9339] do_syscall_64+0x123/0x790 [ 146.647555][ T9339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 146.647566][ T9339] RIP: 0033:0x7fbceab9e559 [ 146.647575][ T9339] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 146.647586][ T9339] RSP: 002b:00007fbcebb12028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 146.647597][ T9339] RAX: ffffffffffffffda RBX: 00007fbceae25fa0 RCX: 00007fbceab9e559 [ 146.647604][ T9339] RDX: 0000200000000180 RSI: 0000000000004b72 RDI: 0000000000000004 [ 146.647610][ T9339] RBP: 00007fbceac35b20 R08: 0000000000000000 R09: 0000000000000000 [ 146.647617][ T9339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 146.647623][ T9339] R13: 00007fbceae26038 R14: 00007fbceae25fa0 R15: 00007ffe98d230d8 [ 146.647633][ T9339] [ 146.647637][ T9339] [ 146.647640][ T9339] Allocated by task 8137: [ 146.647653][ T9339] kasan_save_stack+0x30/0x50 [ 146.647667][ T9339] kasan_save_track+0x14/0x30 [ 146.647680][ T9339] __kasan_kmalloc+0xaa/0xb0 [ 146.647693][ T9339] __kmalloc_noprof+0x32f/0x840 [ 146.647706][ T9339] font_data_rotate+0x353/0x3b0 [ 146.647718][ T9339] fbcon_rotate_font+0x2bf/0x510 [ 146.647731][ T9339] fbcon_modechanged+0x218/0x7f0 [ 146.647742][ T9339] rotate_store+0x261/0x300 [ 146.647752][ T9339] dev_attr_store+0x58/0x80 [ 146.647762][ T9339] sysfs_kf_write+0xf2/0x150 [ 146.647792][ T9339] kernfs_fop_write_iter+0x3e0/0x5f0 [ 146.647806][ T9339] vfs_write+0x6af/0x1050 [ 146.647818][ T9339] ksys_write+0x12a/0x250 [ 146.647829][ T9339] do_syscall_64+0x123/0x790 [ 146.647844][ T9339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 146.647854][ T9339] [ 146.647857][ T9339] The buggy address belongs to the object at ffff88805a25a000 [ 146.647857][ T9339] which belongs to the cache kmalloc-4k of size 4096 [ 146.647866][ T9339] The buggy address is located 1868 bytes to the right of [ 146.647866][ T9339] allocated 4096-byte region [ffff88805a25a000, ffff88805a25b000) [ 146.647876][ T9339] [ 146.647880][ T9339] The buggy address belongs to the physical page: [ 146.647885][ T9339] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5a258 [ 146.647902][ T9339] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 146.647911][ T9339] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 146.647921][ T9339] page_type: f5(slab) [ 146.647931][ T9339] raw: 00fff00000000040 ffff88801d043040 dead000000000100 dead000000000122 [ 146.647949][ T9339] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 146.647958][ T9339] head: 00fff00000000040 ffff88801d043040 dead000000000100 dead000000000122 [ 146.647966][ T9339] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 146.647975][ T9339] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 146.647984][ T9339] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 146.647989][ T9339] page dumped because: kasan: bad access detected [ 146.647994][ T9339] page_owner tracks the page as allocated [ 146.647998][ T9339] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO| ** replaying previous printk message ** [ 146.647998][ T9339] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5725, tgid 5725 (syz-executor), ts 56913450222 [ 146.648016][ T9339] post_alloc_hook+0xfd/0x120 [ 146.648026][ T9339] get_page_from_freelist+0x110d/0x35d0 [ 146.648038][ T9339] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 146.648050][ T9339] new_slab+0xa9/0x6e0 [ 146.648060][ T9339] refill_objects+0xe3/0x410 [ 146.648071][ T9339] __pcs_replace_empty_main+0x35e/0x650 [ 146.648081][ T9339] __kmalloc_noprof+0x67c/0x840 [ 146.648092][ T9339] tomoyo_realpath_from_path+0xb6/0x690 [ 146.648101][ T9339] tomoyo_check_open_permission+0x2af/0x3c0 [ 146.648115][ T9339] tomoyo_file_open+0x6b/0x90 [ 146.648125][ T9339] security_file_open+0xb5/0x1e0 [ 146.648135][ T9339] do_dentry_open+0x552/0x1470 [ 146.648148][ T9339] vfs_open_consume+0xcc/0x460 [ 146.648155][ T9339] path_openat+0x1551/0x2430 [ 146.648169][ T9339] do_file_open+0x20e/0x430 [ 146.648183][ T9339] do_sys_openat2+0x163/0x1d0 [ 146.648191][ T9339] page_owner free stack trace missing [ 146.648195][ T9339] [ 146.648197][ T9339] Memory state around the buggy address: [ 146.648202][ T9339] ffff88805a25b600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 146.648209][ T9339] ffff88805a25b680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 146.648216][ T9339] >ffff88805a25b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 146.648221][ T9339] ^ [ 146.648226][ T9339] ffff88805a25b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 146.648233][ T9339] ffff88805a25b800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 146.648238][ T9339] ================================================================== [ 146.850352][ T9339] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 146.922182][ T9339] CPU: 2 UID: 0 PID: 9339 Comm: syz.7.1094 Tainted: G L syzkaller #0 PREEMPT(full) [ 146.926740][ T9339] Tainted: [L]=SOFTLOCKUP [ 146.928565][ T9339] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 146.932811][ T9339] Call Trace: [ 146.934273][ T9339] [ 146.935289][ T9339] dump_stack_lvl+0x100/0x190 [ 146.936771][ T9339] vpanic+0x553/0x970 [ 146.938042][ T9339] ? __pfx_vpanic+0x10/0x10 [ 146.939467][ T9339] ? mark_held_locks+0x40/0x70 [ 146.940972][ T9339] ? soft_cursor+0x458/0xa10 [ 146.942558][ T9339] panic+0xd1/0xe0 [ 146.943764][ T9339] ? __pfx_panic+0x10/0x10 [ 146.945192][ T9339] ? soft_cursor+0x458/0xa10 [ 146.946625][ T9339] ? preempt_schedule_common+0x3c/0xb0 [ 146.948289][ T9339] check_panic_on_warn.cold+0x19/0x34 [ 146.949932][ T9339] end_report.part.0+0x3a/0x90 [ 146.951428][ T9339] kasan_report.cold+0xe/0x18 [ 146.952862][ T9339] ? soft_cursor+0x458/0xa10 [ 146.954243][ T9339] kasan_check_range+0x10f/0x1e0 [ 146.955734][ T9339] __asan_memcpy+0x23/0x60 [ 146.957085][ T9339] soft_cursor+0x458/0xa10 [ 146.958459][ T9339] cw_cursor+0xd70/0x15b0 [ 146.959762][ T9339] ? __pfx_cw_cursor+0x10/0x10 [ 146.961355][ T9339] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 146.963216][ T9339] ? get_color+0x1da/0x450 [ 146.964617][ T9339] ? __pfx_cw_cursor+0x10/0x10 [ 146.966145][ T9339] fbcon_cursor+0x43c/0x5e0 [ 146.967571][ T9339] ? __mutex_unlock_slowpath+0x35d/0x930 [ 146.969330][ T9339] hide_cursor+0x87/0x230 [ 146.970740][ T9339] redraw_screen+0x5d4/0x760 [ 146.972236][ T9339] ? mark_held_locks+0x40/0x70 [ 146.973785][ T9339] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 146.975611][ T9339] ? __pfx_redraw_screen+0x10/0x10 [ 146.977217][ T9339] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 146.979038][ T9339] vc_do_resize+0xc3d/0xeb0 [ 146.980477][ T9339] ? __pfx_vc_do_resize+0x10/0x10 [ 146.982239][ T9339] ? __local_bh_enable_ip+0xa5/0x120 [ 146.983912][ T9339] ? lockdep_hardirqs_on+0x7d/0x110 [ 146.985571][ T9339] ? kernel_fpu_end+0x5f/0x80 [ 146.987092][ T9339] ? __local_bh_enable_ip+0xa5/0x120 [ 146.988750][ T9339] fbcon_do_set_font+0x443/0x8c0 [ 146.990316][ T9339] fbcon_set_font+0x4be/0x730 [ 146.992128][ T9339] ? __pfx_fbcon_set_font+0x10/0x10 [ 146.994366][ T9339] con_font_op+0x991/0x1020 [ 146.996327][ T9339] ? __pfx_con_font_op+0x10/0x10 [ 146.998059][ T9339] ? __might_fault+0xc5/0x140 [ 146.999549][ T9339] ? __might_fault+0xc5/0x140 [ 147.001082][ T9339] vt_ioctl+0xe00/0x3170 [ 147.002480][ T9339] ? __pfx_vt_ioctl+0x10/0x10 [ 147.003965][ T9339] ? tomoyo_path_number_perm+0x28f/0x580 [ 147.005735][ T9339] ? tomoyo_path_number_perm+0x188/0x580 [ 147.007489][ T9339] ? __pfx_futex_wait+0x10/0x10 [ 147.009026][ T9339] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 147.010881][ T9339] ? tty_jobctrl_ioctl+0x152/0xce0 [ 147.012525][ T9339] ? __pfx_vt_ioctl+0x10/0x10 [ 147.014216][ T9339] tty_ioctl+0x26a/0x1870 [ 147.015573][ T9339] ? __pfx_tty_ioctl+0x10/0x10 [ 147.017079][ T9339] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 147.019122][ T9339] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 147.021285][ T9339] ? __fget_files+0x34/0x3d0 [ 147.022759][ T9339] ? selinux_file_ioctl+0x13b/0x290 [ 147.024382][ T9339] ? selinux_file_ioctl+0xb6/0x290 [ 147.026004][ T9339] ? __pfx_tty_ioctl+0x10/0x10 [ 147.027555][ T9339] __x64_sys_ioctl+0x18e/0x210 [ 147.029056][ T9339] do_syscall_64+0x123/0x790 [ 147.030519][ T9339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.032418][ T9339] RIP: 0033:0x7fbceab9e559 [ 147.033833][ T9339] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 147.039761][ T9339] RSP: 002b:00007fbcebb12028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 147.042378][ T9339] RAX: ffffffffffffffda RBX: 00007fbceae25fa0 RCX: 00007fbceab9e559 [ 147.044830][ T9339] RDX: 0000200000000180 RSI: 0000000000004b72 RDI: 0000000000000004 [ 147.047273][ T9339] RBP: 00007fbceac35b20 R08: 0000000000000000 R09: 0000000000000000 [ 147.049723][ T9339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 147.052193][ T9339] R13: 00007fbceae26038 R14: 00007fbceae25fa0 R15: 00007ffe98d230d8 [ 147.054660][ T9339] [ 147.056206][ T9339] Kernel Offset: disabled [ 147.057570][ T9339] Rebooting in 86400 seconds.. VM DIAGNOSIS: 08:29:05 Registers: info registers vcpu 0 CPU#0 RAX=000000000000007a RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85b33285 RDI=ffffffff9cc845a0 RBP=ffffffff9cc84560 RSP=ffffc900007cf9d8 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=3038383866666666 R12=0000000000000000 R13=000000000000007a R14=000000000000000a R15=ffffc900007cfda8 RIP=ffffffff85b332af RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d4940000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000200000010000 CR3=000000003840d000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000020100001 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000f99ab03f cf8a4c6a931aa5e1 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000905fb752 fe426c755de43e40 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000d18bcf9 c8767279b41597e2 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000001d495d23 7bf993d6a6f571a8 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000005ef57b4b 997092455d591a47 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fbceac36184 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fbceac362e8 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000001db710640 b4e5b025f7011641 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3a732520656c6261 7462650064656c69 61662029736e7465 6e28736e74657300 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1f56000540494744 514740004140494c 4443050c564b5140 4b0d564b51405600 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fbceadf65f8 00007fbceadf65c8 00007fbceadf6600 00007fbceadf65e0 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000000 RBX=0000000000000006 RCX=0000000000000001 RDX=ffff88801feea580 RSI=ffffffff81b6de9e RDI=ffff88801feea580 RBP=0000000000000001 RSP=ffffc90000177df8 R8 =0000000000000001 R9 =0000000000000003 R10=0000000000000006 R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffff9200002efc4 R15=0000000000000000 RIP=ffffffff81b6de9f RFL=00000093 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d4a40000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000001b3421aff8 CR3=000000000fb96000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=0000000000000fff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffff81afb210 ffffffff81769cc3 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffdeb149aa6 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffdeb149aa6 00007ffdeb149aac ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f4b6e63614a ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f4b6e636184 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f4b6e6362e8 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f4b6e636176 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 006c6f72746e6f63 2f746d732f757063 2f6d65747379732f 736563697665642f ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000040008 0000000f0010000c ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f4b6e7f65f8 00007f4b6e7f65c8 00007f4b6e7f6600 00007f4b6e7f65e0 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000000 RBX=ffff88806a4285c0 RCX=ffffffff81f783c8 RDX=0000000000000000 RSI=000000000004abd8 RDI=ffff888107d78000 RBP=000000000004abd8 RSP=ffffc900075afbf8 R8 =0000000000000004 R9 =000000000004abd8 R10=000000000004abd8 R11=0000000000000000 R12=ffffc900075afd50 R13=000000000004abd8 R14=dffffc0000000000 R15=0000000000000000 RIP=ffffffff820c5c37 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 000055557729b500 ffffffff 00c00000 GS =0000 ffff8880d4b40000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000110c321e4c CR3=00000000001dc000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000feffc200 Opmask01=000000000000ffff Opmask02=00000000ffffffff Opmask03=0000000000001000 Opmask04=0000000000000000 Opmask05=00000000004007ff Opmask06=0000000007ffe7ff Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000001a4 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=c3fda360ac6724d6 303c63e629523ea8 c3fda360ac6724d6 303c63e629523ea8 c3fda360ac6724d6 303c63e629523ea8 c3fda360ac6724d6 303c63e629523ea8 ZMM18=455c0631e1cbde52 70acde86c1849ddc 455c0631e1cbde52 70acde86c1849ddc 455c0631e1cbde52 70acde86c1849ddc 455c0631e1cbde52 70acde86c1849ddc ZMM19=4611000000000000 0000000000000005 4611000000000000 0000000000000004 4611000000000000 0000000000000003 4611000000000000 0000000000000002 ZMM20=0000000000000000 0000000000000004 0000000000000000 0000000000000004 0000000000000000 0000000000000004 0000000000000000 0000000000000004 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffff8a694a67 ffffffff84f33bd7 ffffffff8a685c11 ffffffff8a6794b2 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffff8a679e42 ffffffff8a695889 ffffffff8a67d558 ffffffff8a6957fa ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffff8a6794f9 ffffffff8a67a21f ffffffff8a67885a ffffffff8a679a90 ZMM24=c1849ddcc1849ddc c1849ddcc1849ddc c1849ddcc1849ddc c1849ddcc1849ddc c1849ddcc1849ddc c1849ddcc1849ddc c1849ddcc1849ddc c1849ddcc1849ddc ZMM25=70acde8670acde86 70acde8670acde86 70acde8670acde86 70acde8670acde86 70acde8670acde86 70acde8670acde86 70acde8670acde86 70acde8670acde86 ZMM26=e1cbde52e1cbde52 e1cbde52e1cbde52 e1cbde52e1cbde52 e1cbde52e1cbde52 e1cbde52e1cbde52 e1cbde52e1cbde52 e1cbde52e1cbde52 e1cbde52e1cbde52 ZMM27=455c0631455c0631 455c0631455c0631 455c0631455c0631 455c0631455c0631 455c0631455c0631 455c0631455c0631 455c0631455c0631 455c0631455c0631 ZMM28=000000100000000f 0000000e0000000d 0000000c0000000b 0000000a00000009 0000000800000007 0000000600000005 0000000400000003 0000000200000001 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=4511000045110000 4511000045110000 4511000045110000 4511000045110000 4511000045110000 4511000045110000 4511000045110000 4511000045110000 info registers vcpu 3 CPU#3 RAX=0000000000000000 RBX=0000000000000006 RCX=0000000000000001 RDX=ffff8880202d2580 RSI=ffffffff81b6de9e RDI=ffff8880202d2580 RBP=0000000000000003 RSP=ffffc90000197df8 R8 =0000000000000001 R9 =0000000000000003 R10=0000000000000006 R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffff92000032fc4 R15=0000000000000000 RIP=ffffffff81b6de9f RFL=00000093 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d4c40000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000055d60e2a2868 CR3=000000000fb96000 CR4=00350ef0 DR0=ffffffffffffffff DR1=00000000000001f8 DR2=0000000000000083 DR3=ffffffffefffff15 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000101 Opmask01=0000000000000000 Opmask02=00000000ffffffff Opmask03=0000000000000000 Opmask04=00000000ffffffff Opmask05=00000000004007ff Opmask06=0000000007ffe7ff Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055d60e20cab0 000055d60e20cab0 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055d60e1ff9b0 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f1ee07f1b20 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ff00000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f1ee0752c80 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3d3d3d3d3d3d3d3d 3d3d3d3d3d3d3d3d 3d3d3d3d3d3d3d3d 3d3d3d3d3d3d3d3d ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6d6166303030306e 65762c3638783a65 7079743a75706300 5341494c41444f00 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 505c5b0d0d0d0d53 584b110b05450758 4d444907484d5e00 5341494c41444f00 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3230302c34323030 2c333230302c3232 30302c313230302c 303230302c433130 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 302c423130302c41 3130302c39313030 2c383130302c3731 30302c333130302c ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2c333030302c3230 30302c313030302c 303030302c3a6572 75746165663a4136 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 30302c393030302c 383030302c373030 302c363030302c35 3030302c34303030 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 313130302c303130 302c463030302c45 3030302c44303030 2c433030302c4230 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00414132302c3841 32302c344132302c 314132302c323832 302c463532302c44 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000014100 000000000000303d 44440045525f5346 0054242044492065 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 282b2e2fdf37342d 280bbfbf23243324 26312033fc040f18 1317140d080b0412 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 343133bffc121104 1214041204110814 100411bffc040f18 1317140d080b0412 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4141414141414141 4141414141414141 4141414141414141 4141414141414141 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2020202020202020 2020202020202020 2020202020202020 2020202020202020 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000