last executing test programs: 1m16.649530675s ago: executing program 1 (id=158): mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000440)='0', 0x1) write$ublk_bdev(r0, &(0x7f0000000480)="540427cf5eac2e1f6172c5f63a6ead696174edc6c8c095f92e30bf71e97b69e3ee84db46ecf24b01b108b3d2af82c75b36c5f79dc6c31235c74d69c726057d2179e67be8a317ad308b956c0aea922036830f7acbe7073f03a46055bff60ada2d24ba8a8067d175df76135bf793f1f53bf38ca69df63f61e8520a3da847ce587b44aeb08f864c6e034dbeac11ea5ffd71553e174a3f89169d66f540da2746528bfca01fc3f930523d602798c1e6da5f258a1a8ac2a95a17ec5c7b4f6c7a5da1e4e4a794ae1b6483fbb4228f481a571a26630409d845462600278e8a6f4e77e16e45b92fc79bd76b51af72c46774b764a87186d1", 0xf3) 1m16.591243276s ago: executing program 1 (id=159): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000a0000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b705000008000000850000008f00000095"], &(0x7f0000000280)='syzkaller\x00', 0x9}, 0x94) 1m16.510336765s ago: executing program 1 (id=161): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000004c0)=0x68) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000680)=ANY=[@ANYBLOB="4400000010000104fcfffffffbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0315000004000000140012800b0001006970766c616e00000400028008000500", @ANYRES32=r5, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r4], 0x44}, 0x1, 0x0, 0x0, 0x4001}, 0x0) 1m16.347949154s ago: executing program 1 (id=165): socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000006000001"], 0xfdef) 1m16.20934163s ago: executing program 1 (id=168): r0 = syz_io_uring_complete(0x0, 0x0) r1 = openat(r0, &(0x7f0000000180)='./tracing/uprobe_events\x00', 0x20401, 0x0) write(r1, &(0x7f0000000080)="703a749f8c742f6576656e7431202e2f66696c65303a30", 0x17) r2 = syz_open_dev$vim2m(&(0x7f0000000080), 0x252, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x5, 0x1c, &(0x7f0000001840)=ANY=[@ANYBLOB="1800000000000008000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b70300001b0000000000000083000000bf090000000000005509010000000000950000000000009af8ff00000000b5090500000000007baaf00000bda804000000000007080000f8ffffffbfa000000000000007000000f0ffffffb702000008000000182200"/132, @ANYRES32=r3, @ANYBLOB="0000000000000000b7050000080000006200000076000000bf91000000000000b6080000000000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x5, 0x1, 0x1, 0x0, 0x4}) socket(0x2, 0x80805, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r5 = dup(0xffffffffffffffff) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xcabd8245) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, 0x0, 0x40040c0) keyctl$set_reqkey_keyring(0xe, 0x7) sendmsg$NFT_MSG_GETOBJ_RESET(r6, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000006c0)=ANY=[@ANYBLOB="a8000000150a010300000000000000000100000594000800455d813ff589d7a51473a19e69e010938d44374f3fd2ec890cc429b8e239354eb9b6efd96522968a935486c3ee832286e9c93e52ba3dec56effcc3fa12aed6c91f8c95384132b0f6a230e97b9d71920393d514f3eae1b39ee1c093f50d111a1dc1589550512a1f2d72779e78f237ab3d1b7308ef65f12c5a4869679a53a1bc7147620317737811c69fc0f80d7c38de6d22d51afe74f6ea950dace8ba31cbdbbbd27ea0e6208659dad99a51a9eaca5b6d68a2da73898ecbd69adf0cadcc825042820e7ef3f7381676a5d72ddf85a869e108d9a600cc66eca867e7cfd73ee7916064b4eba9d6cbb2f9b6ee1455f43a2fe9a1bbef6eeecaf340586b623acf1e8e585e93f11657077d17a6e1e7135f8cad0338d798afb6d9ed45004c5c1a6febd098ab6a05c7e0a5115a3947938aebacf36ffbb50b1777536b91353e9091d7df01831957d131b0f98e94a5097c91726ba855b024e036cffb8cf6ad5a5b36fbd873025521ce2337b98d536196cad9d271758af55006de1fee"], 0xa8}, 0x1, 0x0, 0x0, 0x880}, 0x40800) unshare(0x6a040000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0) writev(r8, &(0x7f0000000600)=[{&(0x7f0000000640)="bc36dcbc2778db7de8b3dced6cb916a5dcedf971cb5a1e3e389b6c8175a79cb0cd543bc8e5a32b9a4a778f6c52e757e9db32a11b41abde9d6914758f1522a891943c3e8cee1d6ce74eba36453c39698f29d976aefd67c533db24ab744efebfe4ee8a36643bfb8150807677cadfb40a6de60a", 0x72}], 0x1) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) mprotect(&(0x7f0000191000/0x2000)=nil, 0x2000, 0x0) r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r9) ptrace$poke(0x5, r9, &(0x7f0000000200), 0x0) ioctl$KDENABIO(r1, 0x4b36) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x13, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000007000000000000000100000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000850000002a000000000b0000fcffffff95000000000000006da11000ffffffffbf91000000000000b7020000020000008500000085000000b7000000000000009500000000000000f4b13ebcd5913c2621e87f3267dd28915b14c76cec90f7fc0e02e9e830a254c1a324499e32f5be142303bb7ef99abaf7dd2004326283bb99"], &(0x7f0000000000)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc}, 0x94) 1m16.011071325s ago: executing program 1 (id=175): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040eee087c0c"], 0x9) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000040)=0x21003, 0x4) ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000780)=""/169) r2 = syz_open_dev$media(&(0x7f0000000080), 0x7fff, 0x410200) ioctl$BTRFS_IOC_BALANCE_CTL(r2, 0x40049421, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f00000000c0), 0x4) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000500)=ANY=[@ANYBLOB="b4050000000000006110a400000000001f150000000000009500000000000000704fff7649b0983f42d01eccd13e9ec8a0a0ba6f00720c38fb17c6973e6361f5710065aaf625b96d173daf810865508ce8e9e1fa28e8bc8620294d24b6e609fa8a42156ea7394b8e0f09362f9e2576fd38cecff65abf747c96f88c9e0d54c135a1666ac39044329aaff9afb6"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) 1m0.736804991s ago: executing program 32 (id=175): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040eee087c0c"], 0x9) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000040)=0x21003, 0x4) ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000780)=""/169) r2 = syz_open_dev$media(&(0x7f0000000080), 0x7fff, 0x410200) ioctl$BTRFS_IOC_BALANCE_CTL(r2, 0x40049421, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f00000000c0), 0x4) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000500)=ANY=[@ANYBLOB="b4050000000000006110a400000000001f150000000000009500000000000000704fff7649b0983f42d01eccd13e9ec8a0a0ba6f00720c38fb17c6973e6361f5710065aaf625b96d173daf810865508ce8e9e1fa28e8bc8620294d24b6e609fa8a42156ea7394b8e0f09362f9e2576fd38cecff65abf747c96f88c9e0d54c135a1666ac39044329aaff9afb6"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) 47.970249666s ago: executing program 0 (id=855): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_emit_ethernet(0x6e, &(0x7f0000000440)=ANY=[@ANYBLOB="ffffffffffff9e4338bf2d1486dd6000318e00383a00fa880000000000000000000000000001ff020000000000f9ffffffffffffff01"], 0x0) 46.763869992s ago: executing program 0 (id=856): socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000003b01"], 0xfdef) 46.630920849s ago: executing program 0 (id=866): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3c, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x800}}) 46.57064631s ago: executing program 0 (id=870): mkdir(&(0x7f0000000000)='./sys\x00', 0x80) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./sys/class/tty/ttyS0/console\x00', 0x43, 0x154) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) syz_create_resource$binfmt(&(0x7f0000000080)='./sys/class/tty/ttyS0/console\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/tty/ttyS0/console\x00', 0x2, 0x0) write(r0, &(0x7f0000000440), 0x0) r1 = shmget$private(0x0, 0x1000, 0x1000, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r1, 0xd, &(0x7f0000000340)=""/187) write$ublk_bdev(r0, &(0x7f0000000480)="540427cf5eac2e1f6172c5f63a6ead696174edc6c8c095f92e30bf71e97b69e3ee84db46ecf24b01b108b3d2af82c75b36c5f79dc6c31235c74d69c726057d2179e67be8a317ad308b956c0aea922036830f7acbe7073f03a46055bff60ada2d24ba8a8067d175df76135bf793f1f53bf38ca69df63f61e8520a3da847ce587b44aeb08f864c6e034dbeac11ea5ffd71553e174a3f89169d66f540da2746528bfca01fc3f930523d602798c1e6da5f258a1a8ac2a95a17ec5c7b4f6c7a5da1e4e4a794ae1b6483fbb4228f481a571a26630409d845462600278e8a6f4e77e16e45b92fc79bd76b51af72c46774b764a87186d1", 0xf3) openat2(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/tty/ttyS0/console\x00', &(0x7f0000000100)={0x80000, 0x12, 0x4}, 0x18) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) openat$selinux_enforce(0xffffffffffffff9c, 0x0, 0x145380, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000440)="d8df0f23b3b9ce000000b807000000ba000000000f301b8154fea900600000c4e28ddc8dcd000000c182fd3f0000c8b950020000b801000000ba00000000b9c50d0000b800c80000b8010000000f01d90f300fc79d53bf0000c4e16dd3010f2202", 0x52}], 0x0, 0x6, 0x0, 0x0) r6 = dup(r2) close_range(r6, r2, 0x0) socket$nl_audit(0x10, 0x3, 0x9) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0xb23091, 0x0) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) mprotect(&(0x7f0000ff2000/0x1000)=nil, 0x1000, 0x0) r7 = getpid() r8 = syz_pidfd_open(r7, 0x0) setns(r8, 0x24020000) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) syz_clone(0xa2074180, 0x0, 0x0, 0x0, 0x0, 0x0) 46.50932286s ago: executing program 0 (id=873): r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x130, 0x1c8, 0x260, 0x2f8, 0x98, 0x130, 0x1c8, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x1, 0x1}}}, {{@uncond, 0x0, 0x70, 0x98, 0x0, {0x40000}}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) 46.179958184s ago: executing program 0 (id=881): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="06000000040000000800000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000001f00000000000000000018200000", @ANYRES32=r0, @ANYBLOB="0000000000000000790200000000000095"], &(0x7f0000000d40)='syzkaller\x00'}, 0x90) 46.113876797s ago: executing program 33 (id=881): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="06000000040000000800000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000001f00000000000000000018200000", @ANYRES32=r0, @ANYBLOB="0000000000000000790200000000000095"], &(0x7f0000000d40)='syzkaller\x00'}, 0x90) 1.309426055s ago: executing program 4 (id=1729): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1e, 0xf, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r0, 0x0, 0x0, 0xfffb}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1c}, {}, {0x85, 0x0, 0x0, 0xa0}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.228996408s ago: executing program 4 (id=1730): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000001c0)="c744240077dd0000c74424027fbe0000c7442406000000000f011c24b8010000000f01c1450f01ca470f01f866baf80cb8e4f61882ef66bafc0c66b8795966ef40250000000066b8de000f00d02e0f005ffa0f01c92e640fc71f", 0x5a}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000ffb000/0x3000)=nil}) prlimit64(0x0, 0xb, &(0x7f0000000000), 0x0) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) r3 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) mkdir(&(0x7f0000000140)='./control\x00', 0x171) close(r3) r4 = inotify_init1(0x800) fcntl$setstatus(r3, 0x4, 0x2c00) r5 = gettid() fcntl$setown(r3, 0x8, r5) fcntl$setsig(r3, 0xa, 0x22) inotify_add_watch(r4, &(0x7f0000000180)='./control\x00', 0xa4000960) rmdir(&(0x7f0000000100)='./control\x00') ioctl$KVM_RUN(r2, 0xae80, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2800003, 0x31, r2, 0x47550000) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000000)=@x86={0x6, 0x9, 0x0, 0x0, 0x3, 0xa, 0x98, 0x3, 0x3, 0x6, 0x9, 0xb, 0x0, 0x7, 0x1, 0x8, 0x2, 0x7, 0xda, '\x00', 0x6, 0x3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.015587274s ago: executing program 4 (id=1736): r0 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x45, &(0x7f0000000640), 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$VFAT_IOCTL_READDIR_BOTH(0xffffffffffffffff, 0x82307201, 0x0) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r3, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d") write(r3, &(0x7f0000000138)="0000000000000000008000000000000000000000000000007468696e2d706f6f6c00000000000000373a3020373a31203132382030", 0x35) ioctl(r3, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000326e0100003801000001000000000000000000") 690.668456ms ago: executing program 3 (id=1744): mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) umount2(&(0x7f0000000000)='./sys\x00', 0x4) prctl$PR_MCE_KILL(0x23, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/nullb0/queue/nr_requests\x00', 0x2, 0x0) read(r0, &(0x7f0000000340)=""/117, 0x75) 640.707072ms ago: executing program 3 (id=1745): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000048000000030a01020000ff3900000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a3000000000080007006e6174005c000000060a010400000000000000000100000008000b40000000000900010073797a30000000003400048030000180080001006e6174002400028008000240679349b9080004400000000c0800034000000009080001"], 0xec}}, 0x0) 639.166701ms ago: executing program 4 (id=1746): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b4000000000000007910300000fffe0069003e00000000009500740000000000", @ANYRESDEC], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/164, 0x0, 0x25, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff8f}, 0x48) 639.109033ms ago: executing program 3 (id=1747): socket$igmp6(0xa, 0x3, 0x2) syz_emit_ethernet(0x19a, &(0x7f00000002c0)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa86dd60eaff0201642c00fe8000000000000000000000070000bbfe8000000000000000000000000000aa0000000e"], 0x0) 570.959148ms ago: executing program 4 (id=1749): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002800500190084"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000002280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) 570.750738ms ago: executing program 3 (id=1750): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={0x18, 0x26, 0x109, 0x870bd22, 0xfffffff9, {0x2}, [@typed={0x4, 0x15b, 0x0, 0x0, @binary}]}, 0x18}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = socket(0x28, 0x801, 0x0) connect$vsock_stream(r1, &(0x7f00000000c0)={0x28, 0x0, 0x0, @local}, 0x10) shutdown(r1, 0x2) setsockopt$inet_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "a62868e43de8e926", "554ded917fd3faf568100052e203b7f9", "35fde211", "7c791fef6fe68bc9"}, 0x28) (async) setsockopt$inet_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "a62868e43de8e926", "554ded917fd3faf568100052e203b7f9", "35fde211", "7c791fef6fe68bc9"}, 0x28) epoll_create(0x7) (async) r2 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000001c0)={0x30000009}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)) 564.071429ms ago: executing program 4 (id=1753): r0 = socket$inet6(0xa, 0x5, 0x0) gettid() r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./mysys/bus/usb/devices/2-0:1.0/usb2-port1/disable\x00', 0x1, 0x0) write(r2, &(0x7f0000001240)='Dq', 0x2) read(r1, &(0x7f0000000440)=""/247, 0x26) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000040)={0x31, @tick=0xfffff797, 0x0, {0xfd, 0x2}, 0x8, 0x0, 0x4}) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x6200, 0x0, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, &(0x7f0000000040)=[r3], 0x1}, 0x58) tkill(r3, 0x4000000e) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x33, &(0x7f00000002c0)={0x1, &(0x7f0000000200)=[{0x6, 0x1}]}, 0x10) r4 = fsopen(&(0x7f0000000580)='debugfs\x00', 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = io_uring_setup(0x3450, &(0x7f0000000080)={0x0, 0x1539, 0x0, 0x0, 0xeb}) io_uring_register$IORING_REGISTER_BUFFERS(r7, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r7, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}], 0x0, 0x1}, 0x20) r8 = dup(r6) write$UHID_INPUT(r8, &(0x7f00000014c0)={0x9, {"a2e3ad084fc752f91b29090930f70e0dd038e7ff7fc6e5539b3272078b089b34393b6d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31300d336d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169b34288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda0382ec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa1811a678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b473e2ffd9d44b56871495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df0784c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3527138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a20900000000000000bdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16b3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d618e462071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aad66d7bbef724779ca1f73373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473396b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b4db39b012a6d7e566539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d66c7463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af44863c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d0642b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff258a6be40e88bd1e4b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffcb759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef865a29ddd1b6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000ff070000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000510b00000000000000000000000000000000000000000000000000000000000011000000000000000000000000000000000200", 0x1000}}, 0x1006) ioctl$USBDEVFS_RESET(r8, 0x5514) madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x11) listen(r0, 0x50) 489.653686ms ago: executing program 3 (id=1756): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000a80), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000340)={0x48, r1, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x30, 0x2, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x3, 0x1, 0x5}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000004}, 0x40) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=@newtaction={0x4c, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x38, 0x1, [@m_tunnel_key={0x34, 0x1, 0x0, 0x0, {{0xf}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x4c}}, 0x0) 430.438791ms ago: executing program 3 (id=1759): mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x10000) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0xeb) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000000)=0x2000) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r2 = io_uring_setup(0xaae, &(0x7f0000000080)={0x0, 0xdf5, 0x0, 0x7, 0x2e5, 0x0, r1}) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) writev(r1, &(0x7f0000000000)=[{&(0x7f00000004c0)='4', 0x1}], 0x1) readv(r0, &(0x7f0000001400)=[{&(0x7f0000002700)=""/4106, 0x100a}], 0x1) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) write$dsp(r3, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="720203383b8abd3d000000400004"], 0x0, 0x1000) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(r5, 0x1) writev(r5, &(0x7f00000001c0)=[{&(0x7f0000000040)="cb", 0x1}], 0x1) open_by_handle_at(r4, &(0x7f0000000600)=ANY=[], 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000001c00010429bd700002dcdf2507000000", @ANYRES32=r7, @ANYBLOB="02000200"], 0x1c}, 0x1, 0x0, 0x0, 0x44801}, 0x840) r8 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_QUERYCTRL(r8, 0xc0445624, &(0x7f0000000140)={0x98f90d, 0x100, "5a31a4a02e2d3ee200a0b00b472c5ec23cc6881aff36702dbe3ab1d0b4829675", 0x81, 0x8, 0x1, 0x8, 0x200}) ioctl$KVM_GET_SREGS2(0xffffffffffffffff, 0x8140aecc, &(0x7f0000000640)) 358.315148ms ago: executing program 5 (id=1762): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0xc30) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='\x00', 0x1, 0x1e8133) pwrite64(r0, &(0x7f0000000100)='TOCBLOCK', 0x8, 0x100200) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, "00000000000000000000000000000000000000000000000000000000000000000000000000000000001200"}) 267.948533ms ago: executing program 5 (id=1764): r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85512, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x80000000000000, 0x5, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000001, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}) 267.796955ms ago: executing program 5 (id=1765): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000004fff7ffff0000000003"], 0x0, 0x56, 0x0, 0x0, 0x3}, 0x28) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c00000070000100000000000000000007000000", @ANYRES32=r1, @ANYBLOB="140000170800010000000100050006"], 0x2c}}, 0x0) 220.725501ms ago: executing program 2 (id=1766): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000200)={@local, @multicast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x3, 0x68, 0x64, 0x0, 0x8, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x15, 0x20, 0x606f, 0x0, 0xe7, {[@exp_fastopen={0xfe, 0x14, 0xf989, "e0625660bac570f7f163f1bb3603f207"}, @timestamp={0x8, 0xa, 0x9, 0x6}, @window={0x3, 0x0, 0x1}, @exp_smc={0xfe, 0x6}, @nop, @mss={0x2, 0x3, 0x200}, @mss={0x2, 0x4, 0x5}, @timestamp={0x8, 0xa, 0xe6, 0x10000}]}}}}}}}, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/freeze_filesystems', 0x4881, 0x5c) sendfile(r1, r1, 0x0, 0x68) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@setlink={0x180, 0x13, 0x5, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x102}, [@IFLA_IFALIAS={0x14, 0x14, 'ip_vti0\x00'}, @IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2d}}, @IFLA_CARRIER_CHANGES={0x8, 0x23, 0x4}, @IFLA_OPERSTATE={0x5}, @IFLA_PORT_SELF={0x128, 0x19, 0x0, 0x1, [@IFLA_PORT_HOST_UUID={0x14, 0x5, "d0291a59424a07c2a2ba9e01018feb30"}, @IFLA_PORT_PROFILE={0xe7, 0x2, '\x05\xc1\xa7\x14\xaa\xd5zX\x1c\x91\x7f\x84\x81\xad\xb53\xfe=\x95\x88p\xbc\xe2\xab\xfb\x91\x7f\xa5\x83\x97\xfdz/j\xbf{gh\xe1!\x96\x00w>8\xdcD\xe7\xfe\x98\xae\x89\xbb9O\xf9(\'\xb2\xd8\xa9\xa2\x9d\x1c>fKpcB\x1c$\x8b\x82\x91\x15\xdf\x97\xe4\x1c\xbd\xb2\xbfl!\x84\xa2\xe9.\x10\xa7I\x18\xe5+\xac\xef\x81\xd3\x85q^\x10\x00\x04\xf9\xde\x16\xb4\x7f\xebr\xaf;\x90]\xf9\xa3)%<\xb69}\xea\x9d\xff\r:{\xd4C:\x8a\x179\vr\'!\x11\xad\xda\x19G\x04\x82\xd4)\xd0E\xf9\x80R\xf7\xdd\xdc)\xd9\xd8\xaf\x85r(\xeb\xf23\xe8\x8d\xe8rz1\xd6ii2\x80S\xdar=\xdf\xf9\xc6\xe5?\xb1\xa8A\xf5\xaf\xab\xc1+[@\xb7\xf6\xd8\xed\xdc\xa8\xcb\x8b=\x0e\x88\x04\x94\x8a\xab2\xe1mn\xfa\x83\xae\xaa\xcbK\xb0\xa3\xdf/\x1f'}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x2}, @IFLA_PORT_PROFILE={0x9, 0x2, '\xaa\xaa\xaa\xaa\xaa'}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "d8229769b17fd23cdb6991681e1a4a4e"}]}, @IFLA_GSO_MAX_SEGS={0x8, 0x28, 0x2356}]}, 0x180}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 149.426832ms ago: executing program 5 (id=1767): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}, 0x1, 0x0, 0x0, 0x24008810}, 0x8010) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000000c0)=@setlink={0x2c, 0x13, 0x5, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r2, 0x312}, [@IFLA_ADDRESS={0xa, 0x1, @remote}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x42) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c00000010000104000000000000600000000000", @ANYRES32=0x0, @ANYBLOB="00030000000000001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r6, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r6], 0x4c}}, 0x884) 149.253185ms ago: executing program 2 (id=1768): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000001300000000010000000900010073797a3100000000e8010000030a01020000000000000000010000000900030073797a3200000000280004800800024000000000080001400000000514000300626174616476300000000000000000000900010073797a31000000000900010073797a3100000000340008800c00024000000000000080010c00024000000000000000040c00014000000000000000000c00014000000000000000014c000480080002404c82f47c080001400000000008000140000000010800014000000003080002404f32945f080001400000000308000140000000020800024019885f270800014000000003fd000c00a03ac330bf11a2145946e6d945deece8485ee69dbc29a8dd5dbce127f829a3adf5c4171b4bedbbc9b913a67b9ee679020f0200000064419faae0136b893d91d95b1174f115798a1abfdc06983fb83f2116a85a00dd35cdf9d8f81683e5e2ebcca132a712e0be44c12c02ac92fbbb86ed717ce0cbd6a0134f899e23ca6d2f063d26be86555cc0e9c7a25d77e6c0f4217794be96b5d797e3116d874c3adfb096e0567ec28bd1e4d8d6713109695f1f3a877d89d20e19304501aeb851d14c4f9b2d769d554fe5308810d19bb040c1977bce50b894f2c45a1f0e80c8256b6dcb072f9d91d94a67bba9f62eb2f192fa4b3786d9a774b99aa332dfbb000000080007006e6174002c000000050a01020000000000000000010020000c00024000000000000000010900010073797a3100000000"], 0x25c}}, 0x0) 100.423541ms ago: executing program 2 (id=1769): syz_emit_ethernet(0x66, &(0x7f0000000000)={@local, @local, @val, {@ipv6={0x86dd, @generic={0x0, 0x6, "76cd8a", 0x28, 0x0, 0x0, @rand_addr=' \x01\x00', @dev={0xfe, 0x80, '\x00', 0x20}, {[@hopopts={0x0, 0x4, '\x00', [@calipso={0x7, 0x18, {0x0, 0x4, 0x0, 0xd600, [0x4, 0x0]}}, @pad1, @padn={0x1, 0x1, [0x0]}]}]}}}}}, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2, 0x2}}, '.\x00'}) (async) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000140)={r1, @in6={{0xa, 0x4e22, 0x80000000, @mcast2, 0xffffc3bb}}}, 0x84) 31.082247ms ago: executing program 2 (id=1770): capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x9, 0x5, 0x81, 0xffffffff}) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1e, 0xf, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1c}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xeaff}, {0x85, 0x0, 0x0, 0xa0}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 30.88364ms ago: executing program 5 (id=1771): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xd4}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000040)='devpts\x00', 0x1, 0x0) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x8024, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x38, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x2}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}]}, 0x38}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r2, &(0x7f0000000200)="11223344", 0x4, 0x0, &(0x7f0000000300)={0x2, 0x4d2, @remote}, 0x10) 30.694543ms ago: executing program 2 (id=1772): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="180000ffffff90000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b705000008000000850000008f00000095"], &(0x7f0000000280)='syzkaller\x00', 0x9}, 0x94) 5.147328ms ago: executing program 2 (id=1773): r0 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x180) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000140)={"218ff100", 0x8, 0x6, 0x3, 0x4, 0x9, "f700", "00806000", '\x00', "fd1400", ["50cb94040001338000", "3e6860b0223749b45300e400", "000000008000", "c80700"]}) 0s ago: executing program 5 (id=1774): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r0) sendmsg$NLBL_MGMT_C_PROTOCOLS(r0, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8180}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, r1, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @dev={0xac, 0x14, 0x14, 0xf}}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @rand_addr=0x64010102}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private0}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x8000) r2 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000080), r0) pipe2(&(0x7f0000000500)={0x0, 0x0}, 0x0) write(r3, &(0x7f0000000014)="0500010001000000", 0x8) sendmsg$NET_DM_CMD_START(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x1c, r2, 0x1, 0x0, 0x0, {0x2}}, 0x1c}}, 0x0) sendmsg$NET_DM_CMD_START(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x14, r2, 0x1}, 0x14}}, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x52, &(0x7f0000001880)={@multicast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f4adf7", 0x1c, 0x2c, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[@hopopts={0x3a}], @ndisc_ns={0x87, 0x0, 0x0, @loopback}}}}}}, 0x0) r5 = socket$igmp(0x2, 0x3, 0x2) sendmsg$NET_DM_CMD_STOP(r0, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)={0x14, r2, 0x100, 0x70bd2b, 0x25dfdbfc, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r5, 0x0, 0xd2, &(0x7f0000000040)={@broadcast, @multicast1, 0x1, "0d5011f02b7fab96e0aa834d3a9e7cfc12178ac0ab1e6227c2b6ddaa5effda90", 0x5, 0x16, 0xfffffffe}, 0x3c) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r6, 0x0, 0xd2, &(0x7f0000000000)={@broadcast, @multicast1, 0x0, "12ceaac82ab7d944e84b6fbd6178697e3b10c9b81bede26c85ee73daab4158e8", 0x2, 0x6, 0x4, 0x4}, 0x3c) setsockopt$MRT_FLUSH(r6, 0x0, 0xd4, &(0x7f0000000100)=0xe, 0x4) sendto$inet(r4, &(0x7f0000000600)='trigger_packet', 0xe, 0x0, &(0x7f0000000700)={0x2, 0x1234, @loopback}, 0x10) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./proc/devices\x00', 0x200, 0x0) nanosleep(&(0x7f00000002c0)={0x77359400}, &(0x7f0000000380)) read$FUSE(r7, &(0x7f00000016c0)={0x2020}, 0x2020) kernel console output (not intermixed with test programs): ION: forcing a failure. [ 97.855769][ T9366] name failslab, interval 1, probability 0, space 0, times 0 [ 97.855784][ T9366] CPU: 3 UID: 0 PID: 9366 Comm: syz.2.996 Tainted: G L syzkaller #0 PREEMPT(full) [ 97.855799][ T9366] Tainted: [L]=SOFTLOCKUP [ 97.855803][ T9366] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 97.855810][ T9366] Call Trace: [ 97.855814][ T9366] [ 97.855818][ T9366] dump_stack_lvl+0x100/0x190 [ 97.855837][ T9366] should_fail_ex.cold+0x5/0xa [ 97.855854][ T9366] should_failslab+0xc2/0x120 [ 97.855869][ T9366] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 97.855892][ T9366] ? security_context_to_sid_core+0x7e7/0x8a0 [ 97.855908][ T9366] kstrdup+0x51/0xe0 [ 97.855925][ T9366] security_context_to_sid_core+0x7e7/0x8a0 [ 97.855939][ T9366] ? __pfx_security_context_to_sid_core+0x10/0x10 [ 97.855955][ T9366] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 97.855971][ T9366] ? do_raw_spin_lock+0x128/0x260 [ 97.855985][ T9366] ? inode_doinit_use_xattr+0x54/0x330 [ 97.856005][ T9366] inode_doinit_use_xattr+0x105/0x330 [ 97.856023][ T9366] inode_doinit_with_dentry+0xb7a/0x1340 [ 97.856038][ T9366] ? __pfx_inode_doinit_with_dentry+0x10/0x10 [ 97.856053][ T9366] selinux_d_instantiate+0x26/0x40 [ 97.856065][ T9366] security_d_instantiate+0x14c/0x1b0 [ 97.856080][ T9366] d_splice_alias_ops+0xd7/0x15b0 [ 97.856092][ T9366] ? kasan_quarantine_put+0x104/0x240 [ 97.856104][ T9366] ? lockdep_hardirqs_on+0x7d/0x110 [ 97.856118][ T9366] ? __pfx_d_splice_alias_ops+0x10/0x10 [ 97.856130][ T9366] ? rcu_is_watching+0x13/0xc0 [ 97.856145][ T9366] ? ovl_lookup+0x58f/0x6b0 [ 97.856156][ T9366] ? kfree+0x1e5/0x6d0 [ 97.856173][ T9366] ovl_lookup+0x5b0/0x6b0 [ 97.856217][ T9366] ? __pfx_ovl_lookup+0x10/0x10 [ 97.856240][ T9366] ? __pfx_d_alloc_parallel+0x10/0x10 [ 97.856265][ T9366] ? down_read+0x13b/0x4c0 [ 97.856287][ T9366] ? __pfx_down_read+0x10/0x10 [ 97.856306][ T9366] __lookup_slow+0x155/0x320 [ 97.856324][ T9366] lookup_slow+0x50/0x70 [ 97.856340][ T9366] path_lookupat+0x5e8/0xc40 [ 97.856354][ T9366] filename_lookup+0x202/0x590 [ 97.856365][ T9366] ? kasan_save_stack+0x30/0x50 [ 97.856379][ T9366] ? __pfx_filename_lookup+0x10/0x10 [ 97.856407][ T9366] filename_linkat+0x145/0x640 [ 97.856425][ T9366] ? __pfx_filename_linkat+0x10/0x10 [ 97.856440][ T9366] ? do_getname+0x2ec/0x390 [ 97.856454][ T9366] ? kmem_cache_free+0x127/0x6c0 [ 97.856473][ T9366] ? do_getname+0x191/0x390 [ 97.856490][ T9366] __x64_sys_linkat+0xf6/0x150 [ 97.856506][ T9366] do_syscall_64+0x123/0x790 [ 97.856522][ T9366] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.856534][ T9366] RIP: 0033:0x7f3b5739e159 [ 97.856543][ T9366] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.856553][ T9366] RSP: 002b:00007f3b555f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000109 [ 97.856565][ T9366] RAX: ffffffffffffffda RBX: 00007f3b57625fa0 RCX: 00007f3b5739e159 [ 97.856572][ T9366] RDX: ffffffffffffff9c RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 97.856579][ T9366] RBP: 00007f3b555f6090 R08: 0000000000001000 R09: 0000000000000000 [ 97.856585][ T9366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 97.856591][ T9366] R13: 00007f3b57626038 R14: 00007f3b57625fa0 R15: 00007ffcd52322d8 [ 97.856606][ T9366] [ 97.856617][ T9366] SELinux: inode_doinit_use_xattr: context_to_sid(root:object_r:user_tmpfs_t) returned 12 for dev=overlay ino=1432 [ 97.871604][ T9368] netlink: 4 bytes leftover after parsing attributes in process `syz.5.997'. [ 97.992655][ T9378] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1000'. [ 97.993304][ T9377] libceph: resolve '.RHe'ˠ/1C~1WexEAeSb{~R' (ret=-3): failed [ 98.112112][ T9395] netlink: 'syz.2.1006': attribute type 1 has an invalid length. [ 98.150527][ T9395] 8021q: adding VLAN 0 to HW filter on device bond5 [ 98.161525][ T9403] xt_hashlimit: size too large, truncated to 1048576 [ 98.179365][ T9395] bond5: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 98.205008][ T9395] bond5: entered promiscuous mode [ 98.205031][ T9395] bond5: entered allmulticast mode [ 98.240044][ T9395] macvlan2: entered promiscuous mode [ 98.240067][ T9395] macvlan2: entered allmulticast mode [ 98.241125][ T9395] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 98.274534][ T9415] FAULT_INJECTION: forcing a failure. [ 98.274534][ T9415] name failslab, interval 1, probability 0, space 0, times 0 [ 98.274556][ T9415] CPU: 3 UID: 0 PID: 9415 Comm: syz.4.1011 Tainted: G L syzkaller #0 PREEMPT(full) [ 98.274572][ T9415] Tainted: [L]=SOFTLOCKUP [ 98.274575][ T9415] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.274582][ T9415] Call Trace: [ 98.274586][ T9415] [ 98.274591][ T9415] dump_stack_lvl+0x100/0x190 [ 98.274612][ T9415] should_fail_ex.cold+0x5/0xa [ 98.274629][ T9415] should_failslab+0xc2/0x120 [ 98.274644][ T9415] kmem_cache_alloc_noprof+0x92/0x6a0 [ 98.274657][ T9415] ? d_instantiate+0x8a/0xb0 [ 98.274673][ T9415] ? alloc_empty_file+0x5b/0x1c0 [ 98.274690][ T9415] alloc_empty_file+0x5b/0x1c0 [ 98.274705][ T9415] alloc_file_pseudo+0x183/0x290 [ 98.274720][ T9415] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 98.274735][ T9415] ? alloc_fd+0x471/0x7a0 [ 98.274753][ T9415] sock_alloc_file+0x50/0x210 [ 98.274785][ T9415] __sys_socket+0x1c0/0x260 [ 98.274803][ T9415] ? __pfx___sys_socket+0x10/0x10 [ 98.274824][ T9415] __x64_sys_socket+0x72/0xb0 [ 98.274840][ T9415] ? lockdep_hardirqs_on+0x7d/0x110 [ 98.274856][ T9415] do_syscall_64+0x123/0x790 [ 98.274872][ T9415] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.274884][ T9415] RIP: 0033:0x7ff9e759e159 [ 98.274893][ T9415] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.274903][ T9415] RSP: 002b:00007ff9e84c6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 98.274915][ T9415] RAX: ffffffffffffffda RBX: 00007ff9e7826090 RCX: 00007ff9e759e159 [ 98.274922][ T9415] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000018 [ 98.274929][ T9415] RBP: 00007ff9e763503b R08: 0000000000000000 R09: 0000000000000000 [ 98.274940][ T9415] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.274946][ T9415] R13: 00007ff9e7826128 R14: 00007ff9e7826090 R15: 00007ffd43226188 [ 98.274960][ T9415] [ 98.503485][ T5740] Bluetooth: hci0: command tx timeout [ 98.600348][ T9446] ip_tables: iptables: counters copy to user failed while replacing table [ 98.764142][ T9461] iommufd_mock iommufd_mock0: Adding to iommu group 2 [ 98.888055][ T9468] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1025'. [ 99.091285][ T9483] @0: renamed from dummy0 (while UP) [ 99.139021][ T9487] tipc: Enabling of bearer rejected, failed to enable media [ 99.259406][ T5740] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 99.259431][ T5740] CPU: 1 UID: 0 PID: 5740 Comm: kworker/u34:5 Tainted: G L syzkaller #0 PREEMPT(full) [ 99.259460][ T5740] Tainted: [L]=SOFTLOCKUP [ 99.259467][ T5740] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 99.259479][ T5740] Workqueue: hci2 hci_rx_work [ 99.259502][ T5740] Call Trace: [ 99.259510][ T5740] [ 99.259518][ T5740] dump_stack_lvl+0x100/0x190 [ 99.259549][ T5740] sysfs_warn_dup.cold+0x1c/0x28 [ 99.259578][ T5740] sysfs_create_dir_ns+0x24b/0x2b0 [ 99.259603][ T5740] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 99.259628][ T5740] ? find_held_lock+0x2b/0x80 [ 99.259653][ T5740] ? kobject_add_internal+0x25f/0x930 [ 99.259681][ T5740] ? kobject_add_internal+0x25f/0x930 [ 99.259710][ T5740] ? do_raw_spin_unlock+0x145/0x1e0 [ 99.259735][ T5740] kobject_add_internal+0x2c8/0x930 [ 99.259775][ T5740] kobject_add+0x16a/0x1e0 [ 99.259793][ T5740] ? __pfx_kobject_add+0x10/0x10 [ 99.259809][ T5740] ? class_to_subsys+0x10f/0x150 [ 99.259839][ T5740] ? kobject_put+0xb9/0x640 [ 99.259864][ T5740] ? _raw_spin_unlock+0x28/0x50 [ 99.259892][ T5740] device_add+0x294/0x1970 [ 99.259918][ T5740] ? __pfx_dev_set_name+0x10/0x10 [ 99.259946][ T5740] ? __pfx_device_add+0x10/0x10 [ 99.259971][ T5740] ? mgmt_send_event_skb+0x2fb/0x460 [ 99.260001][ T5740] hci_conn_add_sysfs+0x1a3/0x260 [ 99.260025][ T5740] le_conn_complete_evt+0x122f/0x2130 [ 99.260055][ T5740] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 99.260075][ T5740] ? hci_event_packet+0x186/0xcd0 [ 99.260102][ T5740] hci_le_conn_complete_evt+0x23c/0x3a0 [ 99.260123][ T5740] ? skb_pull_data+0x15f/0x1e0 [ 99.260151][ T5740] hci_le_meta_evt+0x34a/0x5f0 [ 99.260173][ T5740] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 99.260233][ T5740] hci_event_packet+0x51c/0xcd0 [ 99.260255][ T5740] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 99.260280][ T5740] ? __pfx_hci_event_packet+0x10/0x10 [ 99.260309][ T5740] ? lockdep_hardirqs_on+0x7d/0x110 [ 99.260340][ T5740] hci_rx_work+0x451/0xfc0 [ 99.260381][ T5740] process_one_work+0xac7/0x1b10 [ 99.260425][ T5740] ? __pfx_process_one_work+0x10/0x10 [ 99.260456][ T5740] ? lock_acquire+0x1d1/0x380 [ 99.260484][ T5740] ? __pfx_hci_rx_work+0x10/0x10 [ 99.260507][ T5740] worker_thread+0x5ef/0xe50 [ 99.260547][ T5740] ? kthread+0x13a/0x450 [ 99.260573][ T5740] ? __pfx_worker_thread+0x10/0x10 [ 99.260603][ T5740] kthread+0x373/0x450 [ 99.260628][ T5740] ? __pfx_kthread+0x10/0x10 [ 99.260656][ T5740] ret_from_fork+0x730/0xd60 [ 99.260679][ T5740] ? __pfx_ret_from_fork+0x10/0x10 [ 99.260702][ T5740] ? __switch_to+0x800/0x10f0 [ 99.260728][ T5740] ? __pfx_kthread+0x10/0x10 [ 99.260774][ T5740] ret_from_fork_asm+0x1a/0x30 [ 99.260811][ T5740] [ 99.260852][ T5740] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 99.260883][ T5740] Bluetooth: hci2: failed to register connection device [ 99.368964][ T9501] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1033'. [ 99.410050][ T9509] overlayfs: failed to get index nlink (file0/file1, err=-61) [ 99.427453][ T9505] Bluetooth: MGMT ver 1.23 [ 99.430229][ T9505] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1036'. [ 99.435722][ T9515] netlink: 204 bytes leftover after parsing attributes in process `syz.2.1040'. [ 99.439798][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 99.439813][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 99.439838][ T5141] loop0: [ 99.486175][ T9519] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1041'. [ 99.486207][ T9519] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1041'. [ 99.533552][ T5838] usb 9-1: new low-speed USB device number 8 using dummy_hcd [ 99.568884][ T9527] ip_tables: iptables: counters copy to user failed while replacing table [ 99.662340][ T5838] usb 9-1: device descriptor read/64, error -71 [ 99.706842][ T9546] xt_hashlimit: size too large, truncated to 1048576 [ 99.739271][ T9550] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1054'. [ 99.745142][ T9552] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 0, id = 0 [ 99.867758][ T9564] 9pnet_virtio: no channels available for device syz [ 99.876464][ T9561] device-mapper: thin metadata: sb_check failed: magic 0: wanted 27022010 [ 99.876486][ T9561] device-mapper: block manager: superblock validator check failed for block 0 [ 99.876499][ T9561] device-mapper: thin metadata: couldn't read superblock [ 99.904942][ T5838] usb 9-1: new low-speed USB device number 9 using dummy_hcd [ 99.996701][ T9573] VFS: Mount too revealing [ 100.026020][ T9561] device-mapper: table: 248:0: thin-pool: Error creating metadata object (-EILSEQ) [ 100.026046][ T9561] device-mapper: ioctl: error adding target to table [ 100.034397][ T5838] usb 9-1: device descriptor read/64, error -71 [ 100.150661][ T5838] usb usb9-port1: attempt power cycle [ 100.160971][ T9588] misc userio: The device must be registered before sending interrupts [ 100.239711][ T9590] bridge0: port 1(ipvlan2) entered blocking state [ 100.239786][ T9590] bridge0: port 1(ipvlan2) entered disabled state [ 100.239849][ T9590] ipvlan2: entered allmulticast mode [ 100.239858][ T9590] bridge0: entered allmulticast mode [ 100.241082][ T9590] ipvlan2: left allmulticast mode [ 100.241092][ T9590] bridge0: left allmulticast mode [ 100.414669][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 100.414732][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 100.414778][ T5141] loop0: [ 100.479299][ T43] kauditd_printk_skb: 40 callbacks suppressed [ 100.479340][ T43] audit: type=1400 audit(1789145665.561:822): avc: denied { write } for pid=9604 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 100.487022][ T9607] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3303861288 (422894244864 ns) > initial count (241705619456 ns). Using initial count to start timer. [ 100.492428][ T5838] usb 9-1: new low-speed USB device number 10 using dummy_hcd [ 100.513254][ T5838] usb 9-1: device descriptor read/8, error -71 [ 100.524922][ T5815] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 100.526562][ T43] audit: type=1400 audit(1789145665.611:823): avc: denied { write } for pid=9609 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 100.634639][ T1348] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 100.673108][ T43] audit: type=1400 audit(1789145665.761:824): avc: denied { write } for pid=9614 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 100.692398][ T5815] usb 8-1: Using ep0 maxpacket: 8 [ 100.692929][ T5815] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 100.693859][ T5815] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 100.693892][ T5815] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 100.693908][ T5815] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 100.693927][ T5815] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 100.693946][ T5815] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 100.693974][ T5815] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.738246][ T43] audit: type=1400 audit(1789145665.821:825): avc: denied { write } for pid=9617 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 100.752629][ T5838] usb 9-1: new low-speed USB device number 11 using dummy_hcd [ 100.773109][ T5838] usb 9-1: device descriptor read/8, error -71 [ 100.794049][ T1348] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 100.795985][ T1348] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 100.798363][ T1348] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 100.798382][ T1348] usb 7-1: Product: syz [ 100.798393][ T1348] usb 7-1: Manufacturer: syz [ 100.798404][ T1348] usb 7-1: SerialNumber: syz [ 100.883183][ T5838] usb usb9-port1: unable to enumerate USB device [ 100.905767][ T5815] usb 8-1: usb_control_msg returned -32 [ 100.905812][ T5815] usbtmc 8-1:16.0: can't read capabilities [ 100.948475][ T9624] ip_tables: iptables: counters copy to user failed while replacing table [ 101.006003][ T1348] usblp 7-1:1.0: usblp1: USB Unidirectional printer dev 5 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 101.008965][ T9628] netlink: 'syz.5.1081': attribute type 1 has an invalid length. [ 101.019341][ T9628] bond1: entered promiscuous mode [ 101.019520][ T9628] 8021q: adding VLAN 0 to HW filter on device bond1 [ 101.027837][ T9628] bond1: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 101.027852][ T9628] bond1: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 101.027861][ T9628] bond1: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 101.078646][ T43] audit: type=1400 audit(1789145666.161:826): avc: denied { write } for pid=9630 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.118316][ T43] audit: type=1400 audit(1789145666.201:827): avc: denied { write } for pid=9633 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.207514][ T1348] usb 7-1: USB disconnect, device number 5 [ 101.211627][ T1348] usblp1: removed [ 101.250060][ T43] audit: type=1400 audit(1789145666.331:828): avc: denied { write } for pid=9640 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.308402][ T43] audit: type=1400 audit(1789145666.391:829): avc: denied { write } for pid=9648 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.314258][ T43] audit: type=1400 audit(1789145666.401:830): avc: denied { read } for pid=9595 comm="syz.3.1072" name="mice" dev="devtmpfs" ino=938 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 101.314309][ T43] audit: type=1400 audit(1789145666.401:831): avc: denied { open } for pid=9595 comm="syz.3.1072" path="/dev/input/mice" dev="devtmpfs" ino=938 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 101.937106][ T9701] tipc: Enabling of bearer rejected, failed to enable media [ 101.997793][ T9704] FAULT_INJECTION: forcing a failure. [ 101.997793][ T9704] name failslab, interval 1, probability 0, space 0, times 0 [ 101.997826][ T9704] CPU: 2 UID: 0 PID: 9704 Comm: syz.2.1097 Tainted: G L syzkaller #0 PREEMPT(full) [ 101.997854][ T9704] Tainted: [L]=SOFTLOCKUP [ 101.997861][ T9704] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.997873][ T9704] Call Trace: [ 101.997888][ T9704] [ 101.997896][ T9704] dump_stack_lvl+0x100/0x190 [ 101.997939][ T9704] should_fail_ex.cold+0x5/0xa [ 101.997968][ T9704] should_failslab+0xc2/0x120 [ 101.997999][ T9704] __kmalloc_noprof+0xfc/0x840 [ 101.998021][ T9704] ? __memcg_list_lru_alloc+0x418/0x680 [ 101.998052][ T9704] __memcg_list_lru_alloc+0x418/0x680 [ 101.998079][ T9704] ? xa_load+0x149/0x2c0 [ 101.998138][ T9704] ? __pfx___memcg_list_lru_alloc+0x10/0x10 [ 101.998172][ T9704] ? rcu_read_unlock+0x17/0x60 [ 101.998207][ T9704] memcg_list_lru_alloc+0xd3/0x100 [ 101.998237][ T9704] __memcg_slab_post_alloc_hook+0x27b/0x1270 [ 101.998276][ T9704] ? kasan_save_track+0x14/0x30 [ 101.998298][ T9704] kmem_cache_alloc_lru_noprof+0x4f6/0x6a0 [ 101.998326][ T9704] ? __d_alloc+0x35/0xa50 [ 101.998356][ T9704] ? __pfx_mqueue_fill_super+0x10/0x10 [ 101.998384][ T9704] __d_alloc+0x35/0xa50 [ 101.998414][ T9704] ? __pfx_mqueue_fill_super+0x10/0x10 [ 101.998440][ T9704] d_make_root+0x3e/0x90 [ 101.998467][ T9704] mqueue_fill_super+0x16d/0x250 [ 101.998495][ T9704] get_tree_nodev+0xdd/0x190 [ 101.998518][ T9704] mqueue_get_tree+0xf1/0x130 [ 101.998545][ T9704] vfs_get_tree+0x92/0x320 [ 101.998576][ T9704] fc_mount_longterm+0x1a/0x270 [ 101.998599][ T9704] mq_init_ns+0x482/0x820 [ 101.998630][ T9704] copy_ipcs+0x3dd/0x7e0 [ 101.998650][ T9704] create_new_namespaces+0x20a/0xac0 [ 101.998674][ T9704] ? security_capable+0x80/0x260 [ 101.998706][ T9704] unshare_nsproxy_namespaces+0xf2/0x220 [ 101.998731][ T9704] ksys_unshare+0x4a2/0xa70 [ 101.998755][ T9704] ? __pfx_ksys_unshare+0x10/0x10 [ 101.998786][ T9704] __x64_sys_unshare+0x31/0x40 [ 101.998808][ T9704] do_syscall_64+0x123/0x790 [ 101.998835][ T9704] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.998854][ T9704] RIP: 0033:0x7f3b5739e159 [ 101.998871][ T9704] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.998890][ T9704] RSP: 002b:00007f3b555f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 101.998915][ T9704] RAX: ffffffffffffffda RBX: 00007f3b57625fa0 RCX: 00007f3b5739e159 [ 101.998929][ T9704] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000004a000200 [ 101.998941][ T9704] RBP: 00007f3b5743503b R08: 0000000000000000 R09: 0000000000000000 [ 101.998953][ T9704] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.998965][ T9704] R13: 00007f3b57626038 R14: 00007f3b57625fa0 R15: 00007ffcd52322d8 [ 101.998994][ T9704] [ 102.362290][ T7777] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 102.534420][ T7777] usb 7-1: Using ep0 maxpacket: 8 [ 102.535160][ T7777] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 102.536104][ T7777] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 102.536127][ T7777] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 102.536149][ T7777] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 102.536190][ T7777] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 102.536222][ T7777] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.755717][ T1348] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 102.907651][ T1348] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 102.910222][ T1348] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 102.917673][ T1348] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 102.917693][ T1348] usb 9-1: Product: syz [ 102.917706][ T1348] usb 9-1: Manufacturer: syz [ 102.917717][ T1348] usb 9-1: SerialNumber: syz [ 103.136325][ T1348] usblp 9-1:1.0: usblp1: USB Unidirectional printer dev 12 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 103.271549][ T9644] usbtmc 8-1:16.0: usb_control_msg returned -71 [ 103.277827][ T1348] usb 8-1: USB disconnect, device number 8 [ 103.333454][ T5808] usb 9-1: USB disconnect, device number 12 [ 103.354702][ T5808] usblp1: removed [ 103.442498][ T9786] __nla_validate_parse: 4 callbacks suppressed [ 103.442517][ T9786] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1107'. [ 103.586409][ T7777] usb 7-1: usb_control_msg returned -71 [ 103.586457][ T7777] usbtmc 7-1:16.0: can't read capabilities [ 103.593218][ T7777] usb 7-1: USB disconnect, device number 6 [ 103.732449][ T10] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 103.885399][ T10] usb 8-1: Using ep0 maxpacket: 16 [ 103.885954][ T10] usb 8-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 103.886873][ T10] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 103.886897][ T10] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 103.886915][ T10] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 103.886946][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.889094][ T10] usb 8-1: config 0 descriptor?? [ 104.003652][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 104.003676][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 104.003718][ T5141] loop0: [ 104.015468][ T9815] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1111'. [ 104.015500][ T9815] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1111'. [ 104.107704][ T10] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 104.107730][ T10] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 104.107743][ T10] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 104.107756][ T10] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 104.107768][ T10] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 104.115674][ T10] input: HID 0955:7214 Haptics as /devices/virtual/input/input12 [ 104.166166][ T9824] netlink: 504 bytes leftover after parsing attributes in process `syz.3.1108'. [ 104.217108][ T10] shield 0003:0955:7214.0002: Registered Thunderstrike controller [ 104.220992][ T10] shield 0003:0955:7214.0002: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.3-1/input0 [ 104.221597][ T9833] overlayfs: missing 'lowerdir' [ 104.236570][ T9833] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1117'. [ 104.236701][ T9833] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1117'. [ 104.334904][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 104.334927][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 104.334975][ T5141] loop0: [ 104.375452][ T850] usb 8-1: USB disconnect, device number 9 [ 104.379257][ T1871] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 104.379315][ T1871] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 104.379360][ T1871] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 104.379404][ T1871] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 104.426131][ T1161] thermal thermal_zone0: Temperature check failed (-19) [ 104.552257][ T5808] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 104.577637][ T9861] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 104.589943][ T1161] rtrs_client L2018: : CM error (CM event: address error, err: -ENODEV) [ 104.590390][ T9861] rtrs_client L2636: : init_conns() failed: err=-EHOSTUNREACH path=@ip:27.0.0.1 [:0] [ 104.661226][ T9868] netlink: 'syz.2.1126': attribute type 1 has an invalid length. [ 104.673209][ T9868] 8021q: adding VLAN 0 to HW filter on device bond6 [ 104.681915][ T9868] bond5: (slave veth0_to_bond): Releasing active interface [ 104.688217][ T9868] bond6: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 104.696262][ T9868] bond6: entered promiscuous mode [ 104.696284][ T9868] bond6: entered allmulticast mode [ 104.704657][ T9868] macvlan2: entered promiscuous mode [ 104.704678][ T9868] macvlan2: entered allmulticast mode [ 104.705802][ T9868] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 104.733204][ T5808] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 104.736231][ T5808] usb 10-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 104.738144][ T5808] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 104.738165][ T5808] usb 10-1: Product: syz [ 104.738175][ T5808] usb 10-1: Manufacturer: syz [ 104.738184][ T5808] usb 10-1: SerialNumber: syz [ 104.969308][ T5808] usblp 10-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 104.989280][ T9884] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.989825][ T9885] i801_smbus 0000:00:1f.3: Illegal SMBus block read size 0 [ 105.011045][ T9885] vlan3: entered promiscuous mode [ 105.011067][ T9885] batadv0: entered promiscuous mode [ 105.011407][ T9885] vlan3: entered allmulticast mode [ 105.011422][ T9885] batadv0: entered allmulticast mode [ 105.037545][ T9888] netlink: 'syz.4.1130': attribute type 1 has an invalid length. [ 105.215012][ C3] usblp0: nonzero write bulk status received: -71 [ 105.217559][ T5808] usb 10-1: USB disconnect, device number 2 [ 105.230234][ T5808] usblp0: removed [ 105.230428][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 105.230448][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 105.230490][ T5141] loop0: [ 105.383492][ T5740] Bluetooth: hci2: command 0x0406 tx timeout [ 105.409764][ T9914] device-mapper: ioctl: Invalid ioctl structure: name m, dev f800 [ 105.567325][ T9923] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 105.569863][ T43] kauditd_printk_skb: 49 callbacks suppressed [ 105.569881][ T43] audit: type=1400 audit(1789145670.651:881): avc: denied { write } for pid=9925 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.609854][ T9933] netlink: 'syz.2.1146': attribute type 1 has an invalid length. [ 105.646418][ T9933] 8021q: adding VLAN 0 to HW filter on device macvlan13 [ 105.695002][ T43] audit: type=1400 audit(1789145670.781:882): avc: denied { write } for pid=9936 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.710911][ T9938] geneve2: entered allmulticast mode [ 105.827069][ T43] audit: type=1400 audit(1789145670.911:883): avc: denied { write } for pid=9946 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.897238][ T43] audit: type=1400 audit(1789145670.981:884): avc: denied { setopt } for pid=9956 comm="syz.3.1155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 105.900381][ T9958] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1155'. [ 105.920355][ T43] audit: type=1400 audit(1789145671.001:885): avc: denied { write } for pid=9957 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.014042][ T43] audit: type=1400 audit(1789145671.101:886): avc: denied { write } for pid=9963 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.064532][ T43] audit: type=1400 audit(1789145671.151:887): avc: denied { write } for pid=9966 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.233908][ T43] audit: type=1400 audit(1789145671.321:888): avc: denied { write } for pid=9971 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.273178][ T43] audit: type=1400 audit(1789145671.361:889): avc: denied { write } for pid=9974 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 107.191480][ T9986] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1160'. [ 107.191513][ T9986] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1160'. [ 107.217557][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 107.217576][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 107.217601][ T5141] loop0: [ 107.239485][ T43] audit: type=1400 audit(1789145672.321:890): avc: denied { write } for pid=9978 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 107.431378][T10018] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1170'. [ 107.543806][T10032] ip_tables: iptables: counters copy to user failed while replacing table [ 107.550672][T10034] xt_l2tp: v2 doesn't support IP mode [ 107.612455][ T1348] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 107.663136][T10044] netlink: 'syz.2.1177': attribute type 1 has an invalid length. [ 107.682838][T10044] 8021q: adding VLAN 0 to HW filter on device macvlan14 [ 107.793479][ T1348] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 107.794456][ T1348] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 107.798839][ T1348] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 107.798855][ T1348] usb 8-1: Product: syz [ 107.798862][ T1348] usb 8-1: Manufacturer: syz [ 107.798870][ T1348] usb 8-1: SerialNumber: syz [ 108.007606][ T1348] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 10 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 108.265905][ T5815] usb 8-1: USB disconnect, device number 10 [ 108.301865][ T5815] usblp0: removed [ 108.401754][T10037] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 108.403642][T10037] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 108.418382][T10037] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 108.437407][T10037] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 108.438245][T10037] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 108.438283][T10037] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 108.439590][T10037] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 108.443226][T10037] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 108.443287][T10037] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 108.447551][T10037] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 108.495320][T10091] netlink: 'syz.4.1183': attribute type 1 has an invalid length. [ 108.507997][T10091] bond3: entered promiscuous mode [ 108.508211][T10091] 8021q: adding VLAN 0 to HW filter on device bond3 [ 108.510109][T10094] netlink: 'syz.2.1184': attribute type 1 has an invalid length. [ 108.521597][T10094] 8021q: adding VLAN 0 to HW filter on device bond7 [ 108.534686][T10094] bond6: (slave veth0_to_bond): Releasing active interface [ 108.542076][T10094] bond7: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 108.548501][T10094] bond7: entered promiscuous mode [ 108.548515][T10094] bond7: entered allmulticast mode [ 108.558970][T10091] 8021q: adding VLAN 0 to HW filter on device bond3 [ 108.559230][T10091] bond3: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 108.559245][T10091] bond3: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 108.571419][T10091] bond3: (slave ip6gre1): making interface the new active one [ 108.571441][T10091] ip6gre1: entered promiscuous mode [ 108.576189][T10091] bond3: (slave ip6gre1): Enslaving as an active interface with an up link [ 108.579035][T10094] macvlan2: entered promiscuous mode [ 108.579047][T10094] macvlan2: entered allmulticast mode [ 108.579747][T10094] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 109.065075][T10105] netlink: 'syz.2.1187': attribute type 1 has an invalid length. [ 109.107019][T10105] bond8: entered promiscuous mode [ 109.107168][T10105] 8021q: adding VLAN 0 to HW filter on device bond8 [ 109.121425][T10105] bond8: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 109.121440][T10105] bond8: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 109.121448][T10105] bond8: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 109.230710][T10133] xt_hashlimit: size too large, truncated to 1048576 [ 109.239846][T10135] syzkaller1: entered promiscuous mode [ 109.239861][T10135] syzkaller1: entered allmulticast mode [ 109.407021][T10154] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 109.457562][T10163] __nla_validate_parse: 1 callbacks suppressed [ 109.457580][T10163] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1207'. [ 109.472275][ T25] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 109.563926][T10176] device-mapper: thin metadata: sb_check failed: magic 0: wanted 27022010 [ 109.563943][T10176] device-mapper: block manager: superblock validator check failed for block 0 [ 109.563951][T10176] device-mapper: thin metadata: couldn't read superblock [ 109.620819][T10185] netlink: 'syz.4.1214': attribute type 1 has an invalid length. [ 109.638799][ T25] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 109.639836][ T25] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 109.643564][ T25] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 109.643583][ T25] usb 8-1: Product: syz [ 109.643594][ T25] usb 8-1: Manufacturer: syz [ 109.643606][ T25] usb 8-1: SerialNumber: syz [ 109.662504][T10185] 8021q: adding VLAN 0 to HW filter on device bond4 [ 109.678467][T10185] bond2: (slave veth0_to_bond): Releasing active interface [ 109.678484][T10185] veth0_to_bond: left promiscuous mode [ 109.678558][T10185] veth0_to_bond: left allmulticast mode [ 109.689989][T10185] bond4: (slave veth0_to_bond): making interface the new active one [ 109.691366][T10185] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 109.700051][T10185] bond4: entered promiscuous mode [ 109.700071][T10185] veth0_to_bond: entered promiscuous mode [ 109.700327][T10185] bond4: entered allmulticast mode [ 109.700341][T10185] veth0_to_bond: entered allmulticast mode [ 109.703370][ T5738] Bluetooth: hci2: command 0x0406 tx timeout [ 109.710736][T10185] macvlan2: entered promiscuous mode [ 109.710756][T10185] macvlan2: entered allmulticast mode [ 109.711792][T10185] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 109.714938][T10185] bond4: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 109.724208][T10176] device-mapper: table: 248:0: thin-pool: Error creating metadata object (-EILSEQ) [ 109.724225][T10176] device-mapper: ioctl: error adding target to table [ 109.746353][T10193] binder: 10188:10193 unknown command 0 [ 109.746372][T10193] binder: 10188:10193 ioctl c0306201 2000000001c0 returned -22 [ 109.866138][ T25] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 11 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 109.877109][T10200] geneve2: entered allmulticast mode [ 109.972755][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 109.972772][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 109.972806][ T5141] loop0: [ 110.070392][ T25] usb 8-1: USB disconnect, device number 11 [ 110.078746][ T25] usblp0: removed [ 110.138125][T10217] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1223'. [ 110.149634][T10218] 9pnet_virtio: no channels available for device syz [ 110.149902][T10217] 9pnet_virtio: no channels available for device syz [ 110.504678][ T5740] Bluetooth: hci0: command 0x0c1a tx timeout [ 110.504731][ T5740] Bluetooth: hci3: command 0x0c1a tx timeout [ 110.531127][T10259] xt_hashlimit: size too large, truncated to 1048576 [ 110.559800][T10263] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 110.559997][T10263] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 110.560014][T10263] UDF-fs: warning (device nbd5): udf_load_vrs: No anchor found [ 110.560025][T10263] UDF-fs: Scanning with blocksize 512 failed [ 110.561983][T10263] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 110.562090][T10263] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 110.562106][T10263] UDF-fs: warning (device nbd5): udf_load_vrs: No anchor found [ 110.562117][T10263] UDF-fs: Scanning with blocksize 1024 failed [ 110.563439][T10263] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 110.563526][T10263] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 110.563542][T10263] UDF-fs: warning (device nbd5): udf_load_vrs: No anchor found [ 110.563552][T10263] UDF-fs: Scanning with blocksize 2048 failed [ 110.563935][T10263] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 110.564010][T10263] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 110.564026][T10263] UDF-fs: warning (device nbd5): udf_load_vrs: No anchor found [ 110.564035][T10263] UDF-fs: Scanning with blocksize 4096 failed [ 110.564044][T10263] UDF-fs: warning (device nbd5): udf_fill_super: No partition found (1) [ 110.640570][ T43] kauditd_printk_skb: 81 callbacks suppressed [ 110.640589][ T43] audit: type=1400 audit(1789145931.720:972): avc: denied { write } for pid=10268 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 110.680411][ T43] audit: type=1400 audit(1789145931.760:973): avc: denied { mounton } for pid=10272 comm="syz.4.1240" path="/137/sys" dev="tmpfs" ino=765 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 110.680686][ T43] audit: type=1400 audit(1789145931.760:974): avc: denied { mount } for pid=10272 comm="syz.4.1240" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 110.681507][ T43] audit: type=1400 audit(1789145931.760:975): avc: denied { mount } for pid=10273 comm="syz.5.1241" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 110.681833][ T43] audit: type=1400 audit(1789145931.760:976): avc: denied { search } for pid=10273 comm="syz.5.1241" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 110.681956][ T43] audit: type=1400 audit(1789145931.760:977): avc: denied { read write } for pid=10273 comm="syz.5.1241" name="set_event" dev="tracefs" ino=6359 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 110.682392][ T43] audit: type=1400 audit(1789145931.760:978): avc: denied { open } for pid=10273 comm="syz.5.1241" path="/106/trace/set_event" dev="tracefs" ino=6359 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 110.683554][ T43] audit: type=1400 audit(1789145931.770:979): avc: denied { mount } for pid=10273 comm="syz.5.1241" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 110.683786][T10274] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 110.696898][ T43] audit: type=1400 audit(1789145931.790:980): avc: denied { unmount } for pid=8883 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 110.706234][ T43] audit: type=1400 audit(1789145931.790:981): avc: denied { unmount } for pid=7591 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 110.791075][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 110.791091][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 110.791116][ T5141] loop0: [ 111.025609][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 111.025625][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 111.025650][ T5141] loop0: [ 111.038223][T10309] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1249'. [ 111.038245][T10309] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1249'. [ 111.322342][ T1871] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 111.402284][ T5815] usb 9-1: new low-speed USB device number 13 using dummy_hcd [ 111.412262][ T850] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 111.472225][ T1871] usb 7-1: Using ep0 maxpacket: 16 [ 111.472711][ T1871] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 111.473645][ T1871] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 111.475182][ T1871] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.475194][ T1871] usb 7-1: Product: syz [ 111.475201][ T1871] usb 7-1: Manufacturer: syz [ 111.475209][ T1871] usb 7-1: SerialNumber: syz [ 111.477236][ T1871] usb 7-1: config 0 descriptor?? [ 111.480576][ T1871] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 111.480593][ T1871] em28xx 7-1:0.0: DVB interface 0 found: bulk [ 111.532248][ T5815] usb 9-1: device descriptor read/64, error -71 [ 111.547108][T10335] infiniband syz0: set active [ 111.547123][T10335] infiniband syz0: added bond0 [ 111.558632][T10335] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 111.558655][T10335] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 111.558676][T10335] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 111.562687][ T850] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 111.563796][ T850] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 111.565574][ T850] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 111.565587][ T850] usb 8-1: Product: syz [ 111.565594][ T850] usb 8-1: Manufacturer: syz [ 111.565602][ T850] usb 8-1: SerialNumber: syz [ 111.599066][T10335] RDS/IB: syz0: added [ 111.599372][T10335] smc: adding ib device syz0 with port count 1 [ 111.599431][T10335] smc: ib device syz0 port 1 has no pnetid [ 111.772248][ T5815] usb 9-1: new low-speed USB device number 14 using dummy_hcd [ 111.782203][ T5738] Bluetooth: hci2: command 0x0406 tx timeout [ 111.785225][ T850] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 12 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 111.902298][ T5815] usb 9-1: device descriptor read/64, error -71 [ 111.986825][ T5838] usb 8-1: USB disconnect, device number 12 [ 112.009885][ T5838] usblp0: removed [ 112.013867][ T5815] usb usb9-port1: attempt power cycle [ 112.083373][ T1871] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 112.290472][T10355] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1255'. [ 112.372322][ T5815] usb 9-1: new low-speed USB device number 15 using dummy_hcd [ 112.394574][ T5815] usb 9-1: device descriptor read/8, error -71 [ 112.493752][ T1871] em28xx 7-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 112.493785][ T1871] em28xx 7-1:0.0: board has no eeprom [ 112.526167][T10371] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 112.536090][T10371] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 112.582407][ T5740] Bluetooth: hci0: command 0x0c1a tx timeout [ 112.582715][ T5738] Bluetooth: hci3: command 0x0c1a tx timeout [ 112.632496][ T5815] usb 9-1: new low-speed USB device number 16 using dummy_hcd [ 112.652804][ T5815] usb 9-1: device descriptor read/8, error -71 [ 112.680376][T10380] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1261'. [ 112.762581][ T5815] usb usb9-port1: unable to enumerate USB device [ 112.817189][T10396] xt_hashlimit: size too large, truncated to 1048576 [ 112.884779][T10314] em28xx 7-1:0.0: reading from i2c device at 0x0 failed (error=-5) [ 112.934892][ T1871] em28xx 7-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 112.934920][ T1871] em28xx 7-1:0.0: dvb set to bulk mode. [ 112.953741][ T5838] em28xx 7-1:0.0: Binding DVB extension [ 112.970215][ T1871] usb 7-1: USB disconnect, device number 7 [ 112.971637][ T1871] em28xx 7-1:0.0: Disconnecting em28xx [ 113.021559][ T5838] em28xx 7-1:0.0: Registering input extension [ 113.023077][ T1871] em28xx 7-1:0.0: Closing input extension [ 113.061797][ T1871] em28xx: Freeing device [ 113.607889][T10413] geneve2: entered allmulticast mode [ 113.730291][T10417] netlink: 'syz.5.1270': attribute type 5 has an invalid length. [ 113.762327][ T5838] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 113.862211][ T5738] Bluetooth: hci2: command 0x0406 tx timeout [ 113.916125][ T5838] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 113.916943][ T5838] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 113.918451][ T5838] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 113.918464][ T5838] usb 7-1: Product: syz [ 113.918471][ T5838] usb 7-1: Manufacturer: syz [ 113.918478][ T5838] usb 7-1: SerialNumber: syz [ 113.936988][T10441] ip_tables: iptables: counters copy to user failed while replacing table [ 114.004655][T10449] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=10449 comm=syz.5.1280 [ 114.037979][T10455] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1282'. [ 114.118778][T10461] FAT-fs (mtdblock0): bogus logical sector size 65535 [ 114.118801][T10461] FAT-fs (mtdblock0): Can't find a valid FAT filesystem [ 114.130384][ T5838] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 8 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 114.188339][T10468] xt_hashlimit: size too large, truncated to 1048576 [ 114.333747][ T5838] usb 7-1: USB disconnect, device number 8 [ 114.339817][ T5838] usblp0: removed [ 114.391914][T10485] geneve3: entered allmulticast mode [ 114.498620][T10494] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10000 [ 114.498638][T10494] flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff) [ 114.498655][T10494] raw: 00fff00000002000 ffffea0000400008 ffffea0000400008 0000000000000000 [ 114.498665][T10494] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 114.498673][T10494] page dumped because: unmovable page [ 114.498678][T10494] page_owner info is not present (never set?) [ 114.597664][T10507] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1298'. [ 114.672282][ T5740] Bluetooth: hci0: command 0x0c1a tx timeout [ 114.672313][ T5738] Bluetooth: hci3: command 0x0c1a tx timeout [ 114.836277][T10541] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1305'. [ 114.848735][T10538] 9pnet_virtio: no channels available for device syz [ 114.935574][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 114.935590][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 114.935616][ T5141] loop0: [ 114.971083][T10552] ref_ctr increment failed for inode: 0x720 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88802360d940 [ 115.136992][T10557] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2566 sclass=netlink_route_socket pid=10557 comm=syz.2.1309 [ 115.222861][T10565] netlink: 'syz.4.1313': attribute type 10 has an invalid length. [ 115.227392][T10565] bond4: (slave veth0_to_bond): Releasing active interface [ 115.227423][T10565] veth0_to_bond: left promiscuous mode [ 115.227500][T10565] veth0_to_bond: left allmulticast mode [ 115.231410][T10565] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 115.278155][T10551] uprobe: syz.2.1309:10551 failed to unregister, leaking uprobe [ 115.293601][T10568] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1315'. [ 115.293622][T10568] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1315'. [ 115.293876][T10568] geneve0: entered promiscuous mode [ 115.331353][T10572] xt_hashlimit: size too large, truncated to 1048576 [ 115.513916][T10592] geneve3: entered allmulticast mode [ 115.618222][ T5738] Bluetooth: hci2: unexpected event for opcode 0x0c25 [ 115.622974][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 115.622987][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 115.623014][ T5141] loop0: [ 115.689775][T10610] netlink: 'syz.4.1329': attribute type 10 has an invalid length. [ 115.836925][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 115.836939][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 115.836967][ T5141] loop0: [ 115.929541][ T5738] Bluetooth: hci3: unexpected event for opcode 0x0c25 [ 115.965383][ T43] kauditd_printk_skb: 141 callbacks suppressed [ 115.965401][ T43] audit: type=1400 audit(1789145937.050:1123): avc: denied { ioctl } for pid=10637 comm="syz.2.1341" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=29131 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 116.007283][T10646] netlink: 'syz.4.1342': attribute type 10 has an invalid length. [ 116.063752][T10651] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 116.092289][ T61] usb 8-1: new low-speed USB device number 13 using dummy_hcd [ 116.127215][T10655] bridge0: port 3(ipvlan2) entered blocking state [ 116.127281][T10655] bridge0: port 3(ipvlan2) entered disabled state [ 116.127344][T10655] ipvlan2: entered allmulticast mode [ 116.127353][T10655] bridge0: entered allmulticast mode [ 116.128522][T10655] ipvlan2: left allmulticast mode [ 116.128531][T10655] bridge0: left allmulticast mode [ 116.242394][ T61] usb 8-1: Invalid ep0 maxpacket: 64 [ 116.248078][ T43] audit: type=1400 audit(1789145937.330:1124): avc: denied { create } for pid=10661 comm="syz.4.1348" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 116.249673][ T43] audit: type=1400 audit(1789145937.330:1125): avc: denied { bind } for pid=10661 comm="syz.4.1348" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 116.309876][T10666] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1350'. [ 116.354634][T10668] netlink: 'syz.4.1351': attribute type 10 has an invalid length. [ 116.372253][ T61] usb 8-1: new low-speed USB device number 14 using dummy_hcd [ 116.501990][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 116.502006][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 116.502031][ T5141] loop0: [ 116.532275][ T61] usb 8-1: Invalid ep0 maxpacket: 64 [ 116.532459][ T61] usb usb8-port1: attempt power cycle [ 116.618960][ T43] audit: type=1400 audit(1789145937.700:1126): avc: denied { getopt } for pid=10683 comm="syz.4.1359" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 116.668360][ T43] audit: type=1400 audit(1789145937.750:1127): avc: denied { write } for pid=10686 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 116.718989][ T43] audit: type=1400 audit(1789145937.800:1128): avc: denied { write } for pid=10692 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 116.797017][ T43] audit: type=1400 audit(1789145937.880:1129): avc: denied { mounton } for pid=10697 comm="syz.4.1361" path="/190/dir0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 116.894490][ T61] usb 8-1: new low-speed USB device number 15 using dummy_hcd [ 116.912953][ T61] usb 8-1: Invalid ep0 maxpacket: 64 [ 116.946667][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 116.946683][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 116.946708][ T5141] loop0: [ 117.042258][ T61] usb 8-1: new low-speed USB device number 16 using dummy_hcd [ 117.063896][ T61] usb 8-1: Invalid ep0 maxpacket: 64 [ 117.064158][ T61] usb usb8-port1: unable to enumerate USB device [ 117.078726][T10723] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 117.119728][ T43] audit: type=1400 audit(1789145938.200:1130): avc: denied { unmount } for pid=8883 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 117.161089][T10728] netlink: 'syz.5.1370': attribute type 1 has an invalid length. [ 117.186515][T10728] 8021q: adding VLAN 0 to HW filter on device macvlan15 [ 117.262800][ T43] audit: type=1400 audit(1789145938.350:1131): avc: denied { write } for pid=10729 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.347215][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 117.347246][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 117.347292][ T5141] loop0: [ 117.371939][ T43] audit: type=1400 audit(1789145938.450:1132): avc: denied { write } for pid=10739 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 117.469857][T10746] netlink: 'syz.4.1374': attribute type 10 has an invalid length. [ 117.695640][T10756] netlink: 'syz.5.1378': attribute type 1 has an invalid length. [ 117.731078][T10756] bond2: entered promiscuous mode [ 117.731314][T10756] 8021q: adding VLAN 0 to HW filter on device bond2 [ 117.743121][T10756] 8021q: adding VLAN 0 to HW filter on device bond2 [ 117.743419][T10756] bond2: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 117.743435][T10756] bond2: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 117.745813][T10756] bond2: (slave ip6gre1): making interface the new active one [ 117.745830][T10756] ip6gre1: entered promiscuous mode [ 117.746604][T10756] bond2: (slave ip6gre1): Enslaving as an active interface with an up link [ 118.629124][T10775] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1379'. [ 118.782567][T10790] FAULT_INJECTION: forcing a failure. [ 118.782567][T10790] name failslab, interval 1, probability 0, space 0, times 0 [ 118.782601][T10790] CPU: 2 UID: 0 PID: 10790 Comm: syz.5.1386 Tainted: G L syzkaller #0 PREEMPT(full) [ 118.782629][T10790] Tainted: [L]=SOFTLOCKUP [ 118.782636][T10790] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 118.782648][T10790] Call Trace: [ 118.782655][T10790] [ 118.782663][T10790] dump_stack_lvl+0x100/0x190 [ 118.782708][T10790] should_fail_ex.cold+0x5/0xa [ 118.782737][T10790] should_failslab+0xc2/0x120 [ 118.782764][T10790] kmem_cache_alloc_noprof+0x92/0x6a0 [ 118.782787][T10790] ? vm_area_alloc+0x1f/0x160 [ 118.782813][T10790] vm_area_alloc+0x1f/0x160 [ 118.782837][T10790] __mmap_region+0x107c/0x32c0 [ 118.782866][T10790] ? find_held_lock+0x2b/0x80 [ 118.782891][T10790] ? ima_match_policy+0x8b8/0x23e0 [ 118.782915][T10790] ? __pfx___mmap_region+0x10/0x10 [ 118.782955][T10790] ? do_raw_spin_lock+0x128/0x260 [ 118.782980][T10790] ? find_held_lock+0x2b/0x80 [ 118.783005][T10790] ? debug_object_activate+0x343/0x4b0 [ 118.783029][T10790] ? do_raw_spin_unlock+0x145/0x1e0 [ 118.783124][T10790] mmap_region+0x3db/0x6d0 [ 118.783143][T10790] ? __pfx_mmap_region+0x10/0x10 [ 118.783159][T10790] ? shmem_get_unmapped_area+0x141/0x960 [ 118.783185][T10790] ? selinux_mmap_addr+0x2b/0x110 [ 118.783213][T10790] ? bpf_lsm_mmap_addr+0x9/0x30 [ 118.783236][T10790] ? security_mmap_addr+0x71/0x1e0 [ 118.783256][T10790] ? __get_unmapped_area+0x255/0x3e0 [ 118.783280][T10790] do_mmap+0x12c7/0x1c30 [ 118.783313][T10790] ? lock_acquire+0x1d1/0x380 [ 118.783332][T10790] ? __pfx_do_mmap+0x10/0x10 [ 118.783355][T10790] ? selinux_mmap_file+0x154/0x1c0 [ 118.783382][T10790] ? __pfx_down_write_killable+0x10/0x10 [ 118.783420][T10790] vm_mmap_pgoff+0x28d/0x470 [ 118.783445][T10790] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 118.783471][T10790] ? __pfx_do_futex+0x10/0x10 [ 118.783501][T10790] ksys_mmap_pgoff+0xe4/0x610 [ 118.783524][T10790] ? __x64_sys_futex+0x358/0x4d0 [ 118.783549][T10790] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 118.783570][T10790] ? xfd_validate_state+0x129/0x190 [ 118.783595][T10790] __x64_sys_mmap+0x125/0x190 [ 118.783616][T10790] do_syscall_64+0x123/0x790 [ 118.783643][T10790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.783662][T10790] RIP: 0033:0x7f472679e159 [ 118.783678][T10790] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.783696][T10790] RSP: 002b:00007f4727639028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 118.783714][T10790] RAX: ffffffffffffffda RBX: 00007f4726a25fa0 RCX: 00007f472679e159 [ 118.783726][T10790] RDX: 0000000002000007 RSI: 0000000008000002 RDI: 000000110c230000 [ 118.783738][T10790] RBP: 00007f472683503b R08: ffffffffffffffff R09: 0000000000000000 [ 118.783751][T10790] R10: 000000000401d031 R11: 0000000000000246 R12: 0000000000000000 [ 118.783764][T10790] R13: 00007f4726a26038 R14: 00007f4726a25fa0 R15: 00007ffc92c742b8 [ 118.783791][T10790] [ 118.838774][T10796] tipc: Enabling of bearer rejected, failed to enable media [ 118.918842][T10805] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1391'. [ 118.919003][T10805] FAULT_INJECTION: forcing a failure. [ 118.919003][T10805] name failslab, interval 1, probability 0, space 0, times 0 [ 118.919022][T10805] CPU: 0 UID: 0 PID: 10805 Comm: syz.2.1391 Tainted: G L syzkaller #0 PREEMPT(full) [ 118.919036][T10805] Tainted: [L]=SOFTLOCKUP [ 118.919041][T10805] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 118.919047][T10805] Call Trace: [ 118.919051][T10805] [ 118.919056][T10805] dump_stack_lvl+0x100/0x190 [ 118.919075][T10805] should_fail_ex.cold+0x5/0xa [ 118.919092][T10805] should_failslab+0xc2/0x120 [ 118.919106][T10805] __kmalloc_cache_noprof+0x91/0x6d0 [ 118.919130][T10805] ? sget_fc+0xb15/0x1f20 [ 118.919149][T10805] sget_fc+0xb15/0x1f20 [ 118.919167][T10805] ? __pfx_set_anon_super_fc+0x10/0x10 [ 118.919190][T10805] ? __pfx_sget_fc+0x10/0x10 [ 118.919210][T10805] ? refcount_dec_not_one+0x136/0x1c0 [ 118.919223][T10805] ? __pfx_refcount_dec_not_one+0x10/0x10 [ 118.919235][T10805] ? __kasan_kmalloc+0xaa/0xb0 [ 118.919247][T10805] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 118.919263][T10805] ? __kasan_kmalloc+0xaa/0xb0 [ 118.919277][T10805] ? __pfx_mqueue_fill_super+0x10/0x10 [ 118.919292][T10805] get_tree_nodev+0x28/0x190 [ 118.919304][T10805] mqueue_get_tree+0xf1/0x130 [ 118.919319][T10805] vfs_get_tree+0x92/0x320 [ 118.919335][T10805] fc_mount_longterm+0x1a/0x270 [ 118.919348][T10805] mq_init_ns+0x482/0x820 [ 118.919367][T10805] copy_ipcs+0x3dd/0x7e0 [ 118.919378][T10805] create_new_namespaces+0x20a/0xac0 [ 118.919392][T10805] ? security_capable+0x80/0x260 [ 118.919410][T10805] unshare_nsproxy_namespaces+0xf2/0x220 [ 118.919425][T10805] ksys_unshare+0x4a2/0xa70 [ 118.919438][T10805] ? __pfx_ksys_unshare+0x10/0x10 [ 118.919462][T10805] __x64_sys_unshare+0x31/0x40 [ 118.919480][T10805] do_syscall_64+0x123/0x790 [ 118.919499][T10805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.919511][T10805] RIP: 0033:0x7f3b5739e159 [ 118.919521][T10805] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.919531][T10805] RSP: 002b:00007f3b555f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 118.919542][T10805] RAX: ffffffffffffffda RBX: 00007f3b57625fa0 RCX: 00007f3b5739e159 [ 118.919549][T10805] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000004a000200 [ 118.919556][T10805] RBP: 00007f3b5743503b R08: 0000000000000000 R09: 0000000000000000 [ 118.919579][T10805] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 118.919586][T10805] R13: 00007f3b57626038 R14: 00007f3b57625fa0 R15: 00007ffcd52322d8 [ 118.919601][T10805] [ 118.925892][T10807] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1391'. [ 119.011162][T10813] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.011642][T10813] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.067021][T10813] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 119.114413][T10813] bond1: left promiscuous mode [ 119.115144][T10813] bond2: left promiscuous mode [ 119.115154][T10813] ip6gre1: left promiscuous mode [ 119.180059][T10820] netlink: 'syz.5.1393': attribute type 1 has an invalid length. [ 119.203821][T10820] 8021q: adding VLAN 0 to HW filter on device bond3 [ 119.217571][T10820] bond3: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 119.217951][ T12] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.218025][ T12] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.218055][ T12] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.218083][ T12] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.233967][T10820] bond3: entered promiscuous mode [ 119.233982][T10820] bond3: entered allmulticast mode [ 119.251808][T10820] macvlan2: entered promiscuous mode [ 119.251836][T10820] macvlan2: entered allmulticast mode [ 119.254421][T10820] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 119.330257][ T5738] Bluetooth: hci2: unexpected event for opcode 0x0c25 [ 119.341125][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 119.341144][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 119.341185][ T5141] loop0: [ 119.454468][T10834] FAULT_INJECTION: forcing a failure. [ 119.454468][T10834] name failslab, interval 1, probability 0, space 0, times 0 [ 119.454491][T10834] CPU: 3 UID: 0 PID: 10834 Comm: syz.3.1398 Tainted: G L syzkaller #0 PREEMPT(full) [ 119.454522][T10834] Tainted: [L]=SOFTLOCKUP [ 119.454528][T10834] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 119.454535][T10834] Call Trace: [ 119.454540][T10834] [ 119.454545][T10834] dump_stack_lvl+0x100/0x190 [ 119.454567][T10834] should_fail_ex.cold+0x5/0xa [ 119.454585][T10834] should_failslab+0xc2/0x120 [ 119.454601][T10834] kmem_cache_alloc_noprof+0x92/0x6a0 [ 119.454615][T10834] ? vm_area_alloc+0x1f/0x160 [ 119.454632][T10834] vm_area_alloc+0x1f/0x160 [ 119.454646][T10834] __mmap_region+0x107c/0x32c0 [ 119.454663][T10834] ? find_held_lock+0x2b/0x80 [ 119.454680][T10834] ? ima_match_policy+0x8b8/0x23e0 [ 119.454695][T10834] ? __pfx___mmap_region+0x10/0x10 [ 119.454719][T10834] ? process_measurement+0x1567/0x2350 [ 119.454750][T10834] ? lock_acquire+0x1d1/0x380 [ 119.454761][T10834] ? finish_task_switch.isra.0+0x149/0x10d0 [ 119.454799][T10834] mmap_region+0x3db/0x6d0 [ 119.454810][T10834] ? __pfx_mmap_region+0x10/0x10 [ 119.454821][T10834] ? shmem_get_unmapped_area+0x141/0x960 [ 119.454836][T10834] ? selinux_mmap_addr+0x2b/0x110 [ 119.454852][T10834] ? bpf_lsm_mmap_addr+0x9/0x30 [ 119.454866][T10834] ? security_mmap_addr+0x71/0x1e0 [ 119.454879][T10834] ? __get_unmapped_area+0x255/0x3e0 [ 119.454894][T10834] do_mmap+0x12c7/0x1c30 [ 119.454909][T10834] ? lock_acquire+0x1d1/0x380 [ 119.454920][T10834] ? __pfx_do_mmap+0x10/0x10 [ 119.454933][T10834] ? selinux_mmap_file+0x154/0x1c0 [ 119.454950][T10834] ? __pfx_down_write_killable+0x10/0x10 [ 119.454970][T10834] vm_mmap_pgoff+0x28d/0x470 [ 119.454985][T10834] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 119.454999][T10834] ? __pfx_do_futex+0x10/0x10 [ 119.455017][T10834] ksys_mmap_pgoff+0xe4/0x610 [ 119.455029][T10834] ? __x64_sys_futex+0x358/0x4d0 [ 119.455044][T10834] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 119.455058][T10834] ? xfd_validate_state+0x129/0x190 [ 119.455073][T10834] __x64_sys_mmap+0x125/0x190 [ 119.455088][T10834] do_syscall_64+0x123/0x790 [ 119.455104][T10834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.455115][T10834] RIP: 0033:0x7fef7639e159 [ 119.455125][T10834] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.455135][T10834] RSP: 002b:00007fef77188028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 119.455147][T10834] RAX: ffffffffffffffda RBX: 00007fef76625fa0 RCX: 00007fef7639e159 [ 119.455154][T10834] RDX: 0000000002000007 RSI: 0000000008000002 RDI: 000000110c230000 [ 119.455161][T10834] RBP: 00007fef7643503b R08: ffffffffffffffff R09: 0000000000000000 [ 119.455172][T10834] R10: 000000000401d031 R11: 0000000000000246 R12: 0000000000000000 [ 119.455179][T10834] R13: 00007fef76626038 R14: 00007fef76625fa0 R15: 00007ffe3afd7dd8 [ 119.455195][T10834] [ 119.459807][T10773] Bluetooth: hci0: Opcode 0x080f failed: -4 [ 119.518953][T10839] geneve2: entered allmulticast mode [ 119.611517][T10843] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 119.682278][T10858] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1404'. [ 119.682300][T10858] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1404'. [ 119.714271][T10861] netlink: 'syz.2.1405': attribute type 1 has an invalid length. [ 119.747503][T10861] 8021q: adding VLAN 0 to HW filter on device macvlan16 [ 119.806736][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 119.806751][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 119.806777][ T5141] loop0: [ 119.826560][T10874] netlink: 'syz.2.1410': attribute type 10 has an invalid length. [ 119.844241][T10874] bond7: (slave veth0_to_bond): Releasing active interface [ 119.848265][T10874] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 120.082232][ T61] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 120.244032][ T61] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 120.244864][ T61] usb 10-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 120.246370][ T61] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 120.246382][ T61] usb 10-1: Product: syz [ 120.246390][ T61] usb 10-1: Manufacturer: syz [ 120.246397][ T61] usb 10-1: SerialNumber: syz [ 120.452416][ T61] usblp 10-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 120.653454][ T5838] usb 10-1: USB disconnect, device number 3 [ 120.659240][ T5838] usblp0: removed [ 120.662348][ T5738] Bluetooth: hci0: command 0x0c1a tx timeout [ 121.048065][ T43] kauditd_printk_skb: 33 callbacks suppressed [ 121.048102][ T43] audit: type=1400 audit(1789145942.130:1166): avc: denied { mount } for pid=10930 comm="syz.4.1418" name="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 121.083323][ T43] audit: type=1400 audit(1789145942.170:1167): avc: denied { mounton } for pid=10930 comm="syz.4.1418" path="/203/dev" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 121.083963][ T43] audit: type=1400 audit(1789145942.170:1168): avc: denied { read write } for pid=10930 comm="syz.4.1418" name="control" dev="devtmpfs" ino=1289 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 121.084378][ T43] audit: type=1400 audit(1789145942.170:1169): avc: denied { open } for pid=10930 comm="syz.4.1418" path="/203/dev/mapper/control" dev="devtmpfs" ino=1289 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 121.084785][ T43] audit: type=1400 audit(1789145942.170:1170): avc: denied { ioctl } for pid=10930 comm="syz.4.1418" path="/203/dev/mapper/control" dev="devtmpfs" ino=1289 ioctlcmd=0xfd03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 121.091901][ T43] audit: type=1400 audit(1789145942.170:1171): avc: denied { write } for pid=10927 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 121.105978][T10938] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1419'. [ 121.113591][T10931] device-mapper: thin metadata: sb_check failed: magic 0: wanted 27022010 [ 121.113613][T10931] device-mapper: block manager: superblock validator check failed for block 0 [ 121.113626][T10931] device-mapper: thin metadata: couldn't read superblock [ 121.154816][T10940] xt_hashlimit: size too large, truncated to 1048576 [ 121.193628][ T43] audit: type=1400 audit(1789145942.280:1172): avc: denied { write } for pid=10941 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 121.229870][ T43] audit: type=1400 audit(1789145942.310:1173): avc: denied { listen } for pid=10933 comm="syz.3.1420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 121.232540][ T43] audit: type=1400 audit(1789145942.320:1174): avc: denied { accept } for pid=10933 comm="syz.3.1420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 121.289415][ T43] audit: type=1400 audit(1789145942.370:1175): avc: denied { mounton } for pid=10933 comm="syz.3.1420" path="/360/file0" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:devpts_t tclass=dir permissive=1 [ 121.332299][T10931] device-mapper: table: 248:0: thin-pool: Error creating metadata object (-EILSEQ) [ 121.332325][T10931] device-mapper: ioctl: error adding target to table [ 121.371847][T10954] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1423'. [ 121.416561][T10958] tipc: Enabling of bearer rejected, failed to enable media [ 121.606257][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 121.606277][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 121.606320][ T5141] loop0: [ 121.806756][T10995] bond0: entered promiscuous mode [ 121.806771][T10995] veth0_to_bond: entered promiscuous mode [ 121.846105][T11007] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1438'. [ 121.846162][T11007] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 121.846168][T11007] IPv6: NLM_F_CREATE should be set when creating new route [ 121.846193][T11007] IPv6: NLM_F_CREATE should be set when creating new route [ 121.935096][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 121.935111][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 121.935136][ T5141] loop0: [ 121.940056][T11014] netlink: 'syz.4.1440': attribute type 10 has an invalid length. [ 122.023204][T11024] netlink: 'syz.4.1443': attribute type 11 has an invalid length. [ 122.024651][T11024] netlink: 'syz.4.1443': attribute type 1 has an invalid length. [ 122.024677][T11024] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 122.122682][T11033] netlink: 'syz.4.1449': attribute type 1 has an invalid length. [ 122.234268][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 122.236317][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 122.236377][ T5141] loop0: [ 122.304003][ T850] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 122.318702][T11047] netlink: 'syz.4.1452': attribute type 10 has an invalid length. [ 122.385312][T11053] xt_hashlimit: size too large, truncated to 1048576 [ 122.466079][ T850] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 122.466870][ T850] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 122.466885][ T850] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 122.466896][ T850] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 122.466915][ T850] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.468102][ T850] usb 8-1: config 0 descriptor?? [ 122.590881][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 122.590901][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 122.590995][ T5141] loop0: [ 122.607981][T11069] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 122.680491][T11028] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1446'. [ 122.682024][T11089] device-mapper: thin metadata: sb_check failed: magic 0: wanted 27022010 [ 122.682039][T11089] device-mapper: block manager: superblock validator check failed for block 0 [ 122.682046][T11089] device-mapper: thin metadata: couldn't read superblock [ 122.722421][T11098] tipc: Enabling of bearer rejected, failed to enable media [ 122.805140][T11089] device-mapper: table: 248:0: thin-pool: Error creating metadata object (-EILSEQ) [ 122.805158][T11089] device-mapper: ioctl: error adding target to table [ 122.906670][ T850] plantronics 0003:047F:FFFF.0003: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 122.959613][ T1161] Bluetooth: hci1: Frame reassembly failed (-84) [ 122.960281][T11113] program syz.4.1472 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 122.960645][ T104] Bluetooth: hci1: Frame reassembly failed (-84) [ 123.253319][T11139] FAULT_INJECTION: forcing a failure. [ 123.253319][T11139] name failslab, interval 1, probability 0, space 0, times 0 [ 123.253349][T11139] CPU: 0 UID: 0 PID: 11139 Comm: syz.5.1476 Tainted: G L syzkaller #0 PREEMPT(full) [ 123.253375][T11139] Tainted: [L]=SOFTLOCKUP [ 123.253382][T11139] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 123.253394][T11139] Call Trace: [ 123.253400][T11139] [ 123.253409][T11139] dump_stack_lvl+0x100/0x190 [ 123.253442][T11139] should_fail_ex.cold+0x5/0xa [ 123.253470][T11139] should_failslab+0xc2/0x120 [ 123.253495][T11139] __kmalloc_cache_noprof+0x91/0x6d0 [ 123.253524][T11139] ? __lock_acquire+0x5c0/0x1f40 [ 123.253541][T11139] ? tipc_nametbl_insert_publ+0x5a/0x1570 [ 123.253574][T11139] tipc_nametbl_insert_publ+0x5a/0x1570 [ 123.253619][T11139] ? do_raw_spin_lock+0x128/0x260 [ 123.253644][T11139] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 123.253676][T11139] tipc_nametbl_publish+0x18b/0x300 [ 123.253708][T11139] tipc_sk_publish+0x1d8/0x430 [ 123.253738][T11139] ? __pfx_tipc_sk_publish+0x10/0x10 [ 123.253768][T11139] ? __local_bh_enable_ip+0xa5/0x120 [ 123.253793][T11139] tipc_sk_bind+0x16f/0x380 [ 123.253813][T11139] tipc_bind+0x18d/0x280 [ 123.253834][T11139] __sys_bind+0x1a9/0x260 [ 123.253875][T11139] ? __pfx___sys_bind+0x10/0x10 [ 123.253924][T11139] __x64_sys_bind+0x72/0xb0 [ 123.253954][T11139] ? lockdep_hardirqs_on+0x7d/0x110 [ 123.253979][T11139] do_syscall_64+0x123/0x790 [ 123.254006][T11139] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.254026][T11139] RIP: 0033:0x7f472679e159 [ 123.254044][T11139] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.254064][T11139] RSP: 002b:00007f4727639028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 123.254087][T11139] RAX: ffffffffffffffda RBX: 00007f4726a25fa0 RCX: 00007f472679e159 [ 123.254101][T11139] RDX: 0000000000000010 RSI: 00002000000000c0 RDI: 0000000000000009 [ 123.254113][T11139] RBP: 00007f472683503b R08: 0000000000000000 R09: 0000000000000000 [ 123.254123][T11139] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 123.254135][T11139] R13: 00007f4726a26038 R14: 00007f4726a25fa0 R15: 00007ffc92c742b8 [ 123.254169][T11139] [ 123.258880][T11139] netlink: 'syz.5.1476': attribute type 10 has an invalid length. [ 123.261371][T11139] bond3: (slave veth0_to_bond): Releasing active interface [ 123.276195][T11139] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 123.489888][T11158] netlink: 'syz.5.1480': attribute type 1 has an invalid length. [ 123.834418][T11178] 8021q: adding VLAN 0 to HW filter on device bond9 [ 123.839765][T11178] bond0: (slave veth0_to_bond): Releasing backup interface [ 123.840514][T11178] veth0_to_bond: left promiscuous mode [ 123.848821][T11178] bond9: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 123.855581][T11178] bond9: entered promiscuous mode [ 123.855655][T11178] bond9: entered allmulticast mode [ 123.862035][T11178] macvlan2: entered promiscuous mode [ 123.862046][T11178] macvlan2: entered allmulticast mode [ 123.872431][T11178] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 123.981913][T11186] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1483'. [ 124.049446][T11190] bond9: (slave veth0_to_bond): Releasing active interface [ 124.056455][T11190] veth0_to_bond: entered promiscuous mode [ 124.059534][T11190] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 124.111596][T11195] xt_hashlimit: size too large, truncated to 1048576 [ 124.238927][T11201] geneve2: entered allmulticast mode [ 124.318754][T11203] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1488'. [ 124.399495][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 124.399511][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 124.399536][ T5141] loop0: [ 124.429278][T11210] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1491'. [ 124.431706][T11212] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1492'. [ 124.439928][T11210] bond0: (slave bond_slave_0): Releasing backup interface [ 124.513308][T11217] EXT4-fs (md0): unable to read superblock [ 124.528031][T11210] bond_slave_0: entered promiscuous mode [ 124.528045][T11210] bond_slave_0: entered allmulticast mode [ 124.588892][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 124.588908][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 124.588934][ T5141] loop0: [ 124.821888][T11240] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1500'. [ 124.821909][T11240] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1500'. [ 124.879582][ T5815] usb 8-1: USB disconnect, device number 17 [ 124.944428][T11249] validate_nla: 3 callbacks suppressed [ 124.944446][T11249] netlink: 'syz.3.1504': attribute type 10 has an invalid length. [ 124.982336][ T5738] Bluetooth: hci1: command 0x1003 tx timeout [ 124.985539][ T5740] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 125.006527][T11253] netlink: 'syz.3.1506': attribute type 1 has an invalid length. [ 125.085277][T11260] ip_tables: iptables: counters copy to user failed while replacing table [ 125.137377][T11264] FAULT_INJECTION: forcing a failure. [ 125.137377][T11264] name failslab, interval 1, probability 0, space 0, times 0 [ 125.137460][T11264] CPU: 0 UID: 0 PID: 11264 Comm: syz.3.1511 Tainted: G L syzkaller #0 PREEMPT(full) [ 125.137486][T11264] Tainted: [L]=SOFTLOCKUP [ 125.137493][T11264] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 125.137504][T11264] Call Trace: [ 125.137511][T11264] [ 125.137518][T11264] dump_stack_lvl+0x100/0x190 [ 125.137551][T11264] should_fail_ex.cold+0x5/0xa [ 125.137579][T11264] should_failslab+0xc2/0x120 [ 125.137603][T11264] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 125.137624][T11264] ? __lock_acquire+0x5c0/0x1f40 [ 125.137644][T11264] ? __alloc_skb+0x140/0x710 [ 125.137670][T11264] __alloc_skb+0x140/0x710 [ 125.137689][T11264] ? __pfx___alloc_skb+0x10/0x10 [ 125.137707][T11264] ? lock_acquire+0x1d1/0x380 [ 125.137726][T11264] ? do_raw_write_lock+0x11e/0x260 [ 125.137755][T11264] tipc_buf_acquire+0x26/0xe0 [ 125.137778][T11264] named_prepare_buf+0x29/0x170 [ 125.137804][T11264] tipc_named_publish+0x1f2/0x760 [ 125.137831][T11264] tipc_nametbl_publish+0x1d5/0x300 [ 125.137862][T11264] tipc_sk_publish+0x1d8/0x430 [ 125.137892][T11264] ? __pfx_tipc_sk_publish+0x10/0x10 [ 125.137924][T11264] ? __local_bh_enable_ip+0xa5/0x120 [ 125.137948][T11264] tipc_sk_bind+0x16f/0x380 [ 125.137968][T11264] tipc_bind+0x18d/0x280 [ 125.137987][T11264] __sys_bind+0x1a9/0x260 [ 125.138016][T11264] ? __pfx___sys_bind+0x10/0x10 [ 125.138062][T11264] __x64_sys_bind+0x72/0xb0 [ 125.138090][T11264] ? lockdep_hardirqs_on+0x7d/0x110 [ 125.138113][T11264] do_syscall_64+0x123/0x790 [ 125.138140][T11264] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.138159][T11264] RIP: 0033:0x7fef7639e159 [ 125.138175][T11264] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.138192][T11264] RSP: 002b:00007fef77188028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 125.138218][T11264] RAX: ffffffffffffffda RBX: 00007fef76625fa0 RCX: 00007fef7639e159 [ 125.138230][T11264] RDX: 0000000000000010 RSI: 00002000000000c0 RDI: 0000000000000009 [ 125.138241][T11264] RBP: 00007fef7643503b R08: 0000000000000000 R09: 0000000000000000 [ 125.138252][T11264] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.138263][T11264] R13: 00007fef76626038 R14: 00007fef76625fa0 R15: 00007ffe3afd7dd8 [ 125.138290][T11264] [ 125.138299][T11264] tipc: Publication distribution failure [ 125.200677][T11268] netlink: 'syz.3.1512': attribute type 1 has an invalid length. [ 125.221398][T11268] 8021q: adding VLAN 0 to HW filter on device bond11 [ 125.232450][T11268] bond0: (slave veth0_to_bond): Releasing backup interface [ 125.246117][T11268] bond11: (slave veth0_to_bond): making interface the new active one [ 125.247353][T11268] bond11: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 125.255393][T11268] bond11: entered promiscuous mode [ 125.255413][T11268] veth0_to_bond: entered promiscuous mode [ 125.255569][T11268] bond11: entered allmulticast mode [ 125.255597][T11268] veth0_to_bond: entered allmulticast mode [ 125.277153][T11268] macvlan2: entered promiscuous mode [ 125.277174][T11268] macvlan2: entered allmulticast mode [ 125.291767][T11268] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 125.295028][T11268] bond11: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 125.361299][T11276] netlink: 'syz.4.1515': attribute type 10 has an invalid length. [ 125.486617][T11289] FAULT_INJECTION: forcing a failure. [ 125.486617][T11289] name failslab, interval 1, probability 0, space 0, times 0 [ 125.486640][T11289] CPU: 2 UID: 0 PID: 11289 Comm: syz.3.1520 Tainted: G L syzkaller #0 PREEMPT(full) [ 125.486656][T11289] Tainted: [L]=SOFTLOCKUP [ 125.486660][T11289] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 125.486666][T11289] Call Trace: [ 125.486670][T11289] [ 125.486674][T11289] dump_stack_lvl+0x100/0x190 [ 125.486694][T11289] should_fail_ex.cold+0x5/0xa [ 125.486711][T11289] should_failslab+0xc2/0x120 [ 125.486725][T11289] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 125.486738][T11289] ? __lock_acquire+0x5c0/0x1f40 [ 125.486750][T11289] ? __alloc_skb+0x140/0x710 [ 125.486764][T11289] __alloc_skb+0x140/0x710 [ 125.486775][T11289] ? __pfx___alloc_skb+0x10/0x10 [ 125.486793][T11289] ? lock_acquire+0x1d1/0x380 [ 125.486805][T11289] ? do_raw_write_lock+0x11e/0x260 [ 125.486821][T11289] tipc_buf_acquire+0x26/0xe0 [ 125.486835][T11289] named_prepare_buf+0x29/0x170 [ 125.486851][T11289] tipc_named_publish+0x1f2/0x760 [ 125.486867][T11289] tipc_nametbl_publish+0x1d5/0x300 [ 125.486885][T11289] tipc_sk_publish+0x1d8/0x430 [ 125.486904][T11289] ? __pfx_tipc_sk_publish+0x10/0x10 [ 125.486922][T11289] ? __local_bh_enable_ip+0xa5/0x120 [ 125.486936][T11289] tipc_sk_bind+0x16f/0x380 [ 125.486947][T11289] tipc_bind+0x18d/0x280 [ 125.486957][T11289] __sys_bind+0x1a9/0x260 [ 125.486974][T11289] ? __pfx___sys_bind+0x10/0x10 [ 125.486999][T11289] __x64_sys_bind+0x72/0xb0 [ 125.487014][T11289] ? lockdep_hardirqs_on+0x7d/0x110 [ 125.487054][T11289] do_syscall_64+0x123/0x790 [ 125.487071][T11289] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.487083][T11289] RIP: 0033:0x7fef7639e159 [ 125.487097][T11289] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.487107][T11289] RSP: 002b:00007fef77188028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 125.487118][T11289] RAX: ffffffffffffffda RBX: 00007fef76625fa0 RCX: 00007fef7639e159 [ 125.487125][T11289] RDX: 0000000000000010 RSI: 00002000000000c0 RDI: 0000000000000009 [ 125.487131][T11289] RBP: 00007fef7643503b R08: 0000000000000000 R09: 0000000000000000 [ 125.487138][T11289] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.487144][T11289] R13: 00007fef76626038 R14: 00007fef76625fa0 R15: 00007ffe3afd7dd8 [ 125.487159][T11289] [ 125.487165][T11289] tipc: Publication distribution failure [ 125.531495][T11291] bond5 (unregistering): Released all slaves [ 125.784034][T11304] geneve2: entered allmulticast mode [ 125.957398][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 125.957414][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 125.957440][ T5141] loop0: [ 126.065051][ T43] kauditd_printk_skb: 61 callbacks suppressed [ 126.065069][ T43] audit: type=1400 audit(1789145947.150:1237): avc: denied { accept } for pid=11326 comm="syz.5.1534" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 126.065108][ T43] audit: type=1400 audit(1789145947.150:1238): avc: denied { read } for pid=11326 comm="syz.5.1534" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 126.065626][T11328] xt_CT: You must specify a L4 protocol and not use inversions on it [ 126.121774][T11330] netlink: 'syz.5.1535': attribute type 1 has an invalid length. [ 126.170711][ T43] audit: type=1400 audit(1789145947.250:1239): avc: denied { write } for pid=11331 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 126.211398][T11341] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 126.211418][T11341] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 126.213710][T11341] vhci_hcd vhci_hcd.0: Device attached [ 126.214360][T11342] vhci_hcd: cannot find the pending unlink 52 [ 126.214990][T11342] vhci_hcd: connection closed [ 126.222178][ T12] vhci_hcd vhci_hcd.5: stop threads [ 126.222755][ T12] vhci_hcd vhci_hcd.5: release socket [ 126.222785][ T12] vhci_hcd vhci_hcd.5: disconnect device [ 126.241208][ T43] audit: type=1400 audit(1789145947.320:1240): avc: denied { write } for pid=11344 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 126.337637][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 126.337662][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 126.337709][ T5141] loop0: [ 126.425338][ T43] audit: type=1400 audit(1789145947.510:1241): avc: denied { read write } for pid=11354 comm="syz.4.1544" name="rdma_cm" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 126.425747][ T43] audit: type=1400 audit(1789145947.510:1242): avc: denied { open } for pid=11354 comm="syz.4.1544" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 126.427156][ T43] audit: type=1400 audit(1789145947.510:1243): avc: denied { ioctl } for pid=11354 comm="syz.4.1544" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1292 ioctlcmd=0x5869 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 126.618865][ T43] audit: type=1400 audit(1789145947.700:1244): avc: denied { read } for pid=11359 comm="syz.4.1546" name="ndctl0" dev="devtmpfs" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 126.619231][ T43] audit: type=1400 audit(1789145947.700:1245): avc: denied { open } for pid=11359 comm="syz.4.1546" path="/dev/ndctl0" dev="devtmpfs" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 126.645345][ T43] audit: type=1400 audit(1789145947.730:1246): avc: denied { write } for pid=11363 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 126.776649][T11373] xt_hashlimit: size too large, truncated to 1048576 [ 126.808295][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 126.808311][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 126.808336][ T5141] loop0: [ 126.985956][T11390] netlink: 'syz.3.1555': attribute type 10 has an invalid length. [ 127.010502][T11390] bond11: (slave veth0_to_bond): Releasing active interface [ 127.010520][T11390] veth0_to_bond: left promiscuous mode [ 127.010598][T11390] veth0_to_bond: left allmulticast mode [ 127.021952][T11390] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 127.110239][T11399] xt_hashlimit: size too large, truncated to 1048576 [ 127.238017][T11406] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1562'. [ 127.294830][ T5740] Bluetooth: hci2: unexpected event for opcode 0x0025 [ 127.319125][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 127.319146][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 127.319186][ T5141] loop0: [ 127.448113][T11425] geneve2: entered allmulticast mode [ 127.541565][T11427] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1564'. [ 127.597877][T11412] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 127.598222][T11412] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 127.646352][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 127.646367][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 127.646392][ T5141] loop0: [ 127.669953][T11447] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1578'. [ 127.669974][T11447] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1578'. [ 127.768178][T11455] device-mapper: thin metadata: sb_check failed: magic 0: wanted 27022010 [ 127.768194][T11455] device-mapper: block manager: superblock validator check failed for block 0 [ 127.768201][T11455] device-mapper: thin metadata: couldn't read superblock [ 127.864029][ T7777] usb 10-1: new low-speed USB device number 4 using dummy_hcd [ 127.930711][T11470] bond5: up delay (9) is not a multiple of miimon (5), value rounded to 5 ms [ 127.930741][T11470] bond5: entered allmulticast mode [ 127.937764][T11470] bond5: up delay (9) is not a multiple of miimon (5), value rounded to 5 ms [ 128.032699][ T7777] usb 10-1: Invalid ep0 maxpacket: 64 [ 128.053403][T11455] device-mapper: table: 248:0: thin-pool: Error creating metadata object (-EILSEQ) [ 128.053420][T11455] device-mapper: ioctl: error adding target to table [ 128.162245][ T7777] usb 10-1: new low-speed USB device number 5 using dummy_hcd [ 128.163340][T11491] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1594'. [ 128.229641][T11497] xt_hashlimit: size too large, truncated to 1048576 [ 128.312266][ T7777] usb 10-1: Invalid ep0 maxpacket: 64 [ 128.312590][ T7777] usb usb10-port1: attempt power cycle [ 128.324014][ T5838] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 128.347153][T11507] ip_tables: iptables: counters copy to user failed while replacing table [ 128.366534][ T5738] Bluetooth: hci2: ACL packet for unknown connection handle 0 [ 128.390242][T11513] netlink: 'syz.2.1600': attribute type 1 has an invalid length. [ 128.473149][ T5838] usb 9-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 128.474337][ T5838] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 128.474375][ T5838] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 128.474396][ T5838] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 128.474415][ T5838] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 128.474434][ T5838] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 128.474467][ T5838] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.484135][T11484] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 128.486117][ T5838] keyspan 9-1:1.0: Keyspan 2 port adapter converter detected [ 128.488682][ T5838] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 84 [ 128.488750][ T5838] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 2 [ 128.490418][ T5838] usb 9-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 128.494846][ T5838] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 88 [ 128.494930][ T5838] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 6 [ 128.501447][T11521] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1603'. [ 128.503736][ T5838] usb 9-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 128.511496][T11524] bridge0: port 1(ipvlan2) entered blocking state [ 128.511614][T11524] bridge0: port 1(ipvlan2) entered disabled state [ 128.511711][T11524] ipvlan2: entered allmulticast mode [ 128.511725][T11524] bridge0: entered allmulticast mode [ 128.514490][T11524] ipvlan2: left allmulticast mode [ 128.514502][T11524] bridge0: left allmulticast mode [ 128.652284][ T7777] usb 10-1: new low-speed USB device number 6 using dummy_hcd [ 128.672609][ T7777] usb 10-1: Invalid ep0 maxpacket: 64 [ 128.708672][T11542] nvmet: Invalid value '4:0`"~z0׆#WR9p)jF0pMQ0onc' for trtype [ 128.709599][T11542] nvmet_tcp: malformed ip/port passed: 127.0.0.1: [ 128.758232][T11542] nvme nvme0: failed to connect socket: -111 [ 128.814775][ T7777] usb 10-1: new low-speed USB device number 7 using dummy_hcd [ 128.833539][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 128.833562][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 128.833606][ T5141] loop0: [ 128.843587][ T7777] usb 10-1: Invalid ep0 maxpacket: 64 [ 128.843822][ T7777] usb usb10-port1: unable to enumerate USB device [ 128.875964][T11551] tipc: Enabling of bearer rejected, failed to enable media [ 129.192281][ T7777] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 129.242004][T11564] xt_hashlimit: size too large, truncated to 1048576 [ 129.342958][ T7777] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 129.344349][ T7777] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 129.344373][ T7777] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 129.344390][ T7777] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 129.344439][ T7777] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.346488][ T7777] usb 7-1: config 0 descriptor?? [ 129.350147][T11568] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1618'. [ 129.434973][T11573] netlink: 'syz.3.1620': attribute type 1 has an invalid length. [ 129.449902][T11573] bond12: entered promiscuous mode [ 129.450296][T11573] 8021q: adding VLAN 0 to HW filter on device bond12 [ 129.462622][T11573] bond12: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 129.462646][T11573] bond12: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 129.462661][T11573] bond12: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 129.759001][ T7777] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 130.545866][T11600] netlink: 'syz.5.1627': attribute type 1 has an invalid length. [ 130.582029][T11602] geneve2: entered allmulticast mode [ 130.676520][T11606] kAFS: unable to lookup cell '(,cL' [ 130.767965][T11619] tipc: Enabling of bearer rejected, failed to enable media [ 130.866141][T11622] device-mapper: thin metadata: sb_check failed: magic 0: wanted 27022010 [ 130.866157][T11622] device-mapper: block manager: superblock validator check failed for block 0 [ 130.866164][T11622] device-mapper: thin metadata: couldn't read superblock [ 131.036720][T11622] device-mapper: table: 248:0: thin-pool: Error creating metadata object (-EILSEQ) [ 131.036743][T11622] device-mapper: ioctl: error adding target to table [ 131.063832][T11635] xt_hashlimit: size too large, truncated to 1048576 [ 131.092282][ T7777] usb 7-1: reset high-speed USB device number 9 using dummy_hcd [ 131.096603][ T6064] usb 9-1: USB disconnect, device number 17 [ 131.102224][ T6064] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 131.120143][ T6064] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 131.120525][ T6064] keyspan 9-1:1.0: device disconnected [ 131.149604][T11641] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1642'. [ 131.149993][ T43] kauditd_printk_skb: 32 callbacks suppressed [ 131.150003][ T43] audit: type=1400 audit(1789145952.230:1279): avc: denied { create } for pid=11638 comm="syz.4.1641" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 131.154167][ T43] audit: type=1400 audit(1789145952.230:1280): avc: denied { ioctl } for pid=11638 comm="syz.4.1641" path="socket:[33903]" dev="sockfs" ino=33903 ioctlcmd=0x89e3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 131.196721][T11643] batman_adv: batadv0: Adding interface: syzkaller0 [ 131.196737][T11643] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 131.196760][T11643] batman_adv: batadv0: Interface activated: syzkaller0 [ 131.198034][ T43] audit: type=1400 audit(1789145952.280:1281): avc: denied { write } for pid=11642 comm="syz.5.1643" name="video1" dev="devtmpfs" ino=953 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 131.200176][T11642] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 131.216920][T11642] batman_adv: batadv0: Removing interface: syzkaller0 [ 131.219692][T11645] netlink: 'syz.4.1644': attribute type 1 has an invalid length. [ 131.244054][ T7777] usb 7-1: device descriptor read/64, error -32 [ 131.254646][T11645] bond6: entered promiscuous mode [ 131.254839][T11645] 8021q: adding VLAN 0 to HW filter on device bond6 [ 131.260858][T11645] bond6: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 131.260871][T11645] bond6: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 131.260879][T11645] bond6: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 131.327289][ T43] audit: type=1400 audit(1789145952.410:1282): avc: denied { bind } for pid=11653 comm="syz.3.1648" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 131.327519][ T43] audit: type=1400 audit(1789145952.410:1283): avc: denied { name_bind } for pid=11653 comm="syz.3.1648" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 131.327705][ T43] audit: type=1400 audit(1789145952.410:1284): avc: denied { node_bind } for pid=11653 comm="syz.3.1648" saddr=fe80::aa src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 131.329344][ T43] audit: type=1400 audit(1789145952.410:1285): avc: denied { listen } for pid=11653 comm="syz.3.1648" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 131.330215][T11654] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 131.384260][T11660] bridge0: port 3(ipvlan2) entered blocking state [ 131.384395][T11660] bridge0: port 3(ipvlan2) entered disabled state [ 131.384502][T11660] ipvlan2: entered allmulticast mode [ 131.384515][T11660] bridge0: entered allmulticast mode [ 131.388530][T11660] ipvlan2: left allmulticast mode [ 131.388549][T11660] bridge0: left allmulticast mode [ 131.436913][ T43] audit: type=1400 audit(1789145952.520:1286): avc: denied { write } for pid=11661 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 131.497140][ T43] audit: type=1400 audit(1789145952.580:1287): avc: denied { write } for pid=11668 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 131.508867][ T7777] usb 7-1: reset high-speed USB device number 9 using dummy_hcd [ 131.526806][ T43] audit: type=1400 audit(1789145952.610:1288): avc: denied { ioctl } for pid=11671 comm="syz.3.1652" path="/dev/uhid" dev="devtmpfs" ino=1293 ioctlcmd=0x6628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 131.642287][ T7777] usb 7-1: device descriptor read/64, error -32 [ 131.657655][T11686] netlink: 'syz.3.1654': attribute type 10 has an invalid length. [ 131.673318][T11689] ip_tables: iptables: counters copy to user failed while replacing table [ 131.797241][T11698] netlink: 'syz.3.1658': attribute type 1 has an invalid length. [ 131.835154][T11701] geneve3: entered allmulticast mode [ 131.892271][ T7777] usb 7-1: reset high-speed USB device number 9 using dummy_hcd [ 131.913243][ T7777] usb 7-1: device descriptor read/8, error -32 [ 131.918062][T11709] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1661'. [ 132.058507][T11723] netlink: 'syz.3.1664': attribute type 1 has an invalid length. [ 132.081247][T11727] netlink: 'syz.2.1665': attribute type 10 has an invalid length. [ 132.090991][T11723] 8021q: adding VLAN 0 to HW filter on device bond13 [ 132.112665][T11723] bond0: (slave veth0_to_bond): Releasing backup interface [ 132.115672][T11729] FAULT_INJECTION: forcing a failure. [ 132.115672][T11729] name failslab, interval 1, probability 0, space 0, times 0 [ 132.115702][T11729] CPU: 2 UID: 0 PID: 11729 Comm: syz.4.1666 Tainted: G L syzkaller #0 PREEMPT(full) [ 132.115719][T11729] Tainted: [L]=SOFTLOCKUP [ 132.115728][T11729] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 132.115735][T11729] Call Trace: [ 132.115739][T11729] [ 132.115743][T11729] dump_stack_lvl+0x100/0x190 [ 132.115775][T11729] should_fail_ex.cold+0x5/0xa [ 132.115792][T11729] should_failslab+0xc2/0x120 [ 132.115810][T11729] __kmalloc_noprof+0xfc/0x840 [ 132.115822][T11729] ? nsim_fib_event_nb+0x661/0xe50 [ 132.115845][T11729] nsim_fib_event_nb+0x661/0xe50 [ 132.115863][T11729] ? lock_acquire+0x1d1/0x380 [ 132.115875][T11729] ? atomic_notifier_call_chain+0x2f/0x1c0 [ 132.115893][T11729] notifier_call_chain+0x99/0x3f0 [ 132.115912][T11729] atomic_notifier_call_chain+0x71/0x1c0 [ 132.115930][T11729] call_fib_notifiers+0x33/0x70 [ 132.115944][T11729] fib6_add_rt2node+0x14e3/0x3df0 [ 132.115962][T11729] ? __pfx_fib6_add_rt2node+0x10/0x10 [ 132.115974][T11729] ? fib6_add_1+0xe1c/0x1700 [ 132.115995][T11729] ? fib6_add+0x60e/0x1eb0 [ 132.116004][T11729] fib6_add+0x60e/0x1eb0 [ 132.116017][T11729] ? do_raw_spin_lock+0x128/0x260 [ 132.116055][T11729] ? __pfx_fib6_add+0x10/0x10 [ 132.116066][T11729] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 132.116085][T11729] ip6_ins_rt+0xb5/0x110 [ 132.116098][T11729] ? __pfx_ip6_ins_rt+0x10/0x10 [ 132.116113][T11729] ? __local_bh_enable_ip+0xa5/0x120 [ 132.116127][T11729] ? lockdep_hardirqs_on+0x7d/0x110 [ 132.116146][T11729] __ipv6_dev_ac_inc+0x912/0xdb0 [ 132.116160][T11729] ipv6_sock_ac_join+0x67c/0xd80 [ 132.116172][T11729] ? __pfx_ipv6_sock_ac_join+0x10/0x10 [ 132.116182][T11729] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 132.116196][T11729] ? __local_bh_enable_ip+0xa5/0x120 [ 132.116207][T11729] ? lockdep_hardirqs_on+0x7d/0x110 [ 132.116222][T11729] do_ipv6_setsockopt+0x3874/0x44a0 [ 132.116237][T11729] ? avc_has_perm_noaudit+0x56/0x3b0 [ 132.116254][T11729] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 132.116268][T11729] ? avc_has_perm_noaudit+0x145/0x3b0 [ 132.116284][T11729] ? avc_has_perm+0x135/0x1e0 [ 132.116298][T11729] ? __pfx_avc_has_perm+0x10/0x10 [ 132.116314][T11729] ? futex_wait+0x11e/0x370 [ 132.116335][T11729] ? sock_has_perm+0x25a/0x2f0 [ 132.116352][T11729] ? __pfx_sock_has_perm+0x10/0x10 [ 132.116368][T11729] ? selinux_netlbl_socket_setsockopt+0x134/0x470 [ 132.116383][T11729] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 132.116399][T11729] ? ipv6_setsockopt+0xcb/0x170 [ 132.116410][T11729] ipv6_setsockopt+0xcb/0x170 [ 132.116423][T11729] tcp_setsockopt+0xa7/0x100 [ 132.116434][T11729] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 132.116450][T11729] do_sock_setsockopt+0xf3/0x1d0 [ 132.116480][T11729] __sys_setsockopt+0x195/0x220 [ 132.116497][T11729] __x64_sys_setsockopt+0xbd/0x160 [ 132.116509][T11729] ? do_syscall_64+0xae/0x790 [ 132.116523][T11729] ? lockdep_hardirqs_on+0x7d/0x110 [ 132.116537][T11729] do_syscall_64+0x123/0x790 [ 132.116554][T11729] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.116567][T11729] RIP: 0033:0x7ff9e759e159 [ 132.116577][T11729] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.116588][T11729] RSP: 002b:00007ff9e84e7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 132.116600][T11729] RAX: ffffffffffffffda RBX: 00007ff9e7825fa0 RCX: 00007ff9e759e159 [ 132.116607][T11729] RDX: 000000000000001b RSI: 0000000000000029 RDI: 0000000000000006 [ 132.116614][T11729] RBP: 00007ff9e763503b R08: 0000000000000014 R09: 0000000000000000 [ 132.116620][T11729] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000000 [ 132.116627][T11729] R13: 00007ff9e7826038 R14: 00007ff9e7825fa0 R15: 00007ffd43226188 [ 132.116642][T11729] [ 132.120645][T11723] bond13: (slave veth0_to_bond): making interface the new active one [ 132.121374][T11723] bond13: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 132.132615][T11723] bond13: entered promiscuous mode [ 132.132635][T11723] veth0_to_bond: entered promiscuous mode [ 132.132809][T11723] bond13: entered allmulticast mode [ 132.132823][T11723] veth0_to_bond: entered allmulticast mode [ 132.159812][T11731] nvmet: Invalid value '4:0`"~z0׆#WR9p)jF0pMQ0onc' for trtype [ 132.172094][T11729] pim6reg9: entered allmulticast mode [ 132.179561][T11723] macvlan2: entered promiscuous mode [ 132.179580][T11723] macvlan2: entered allmulticast mode [ 132.180170][T11723] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 132.187714][T11723] bond13: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 132.345156][T11749] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1671'. [ 132.351226][T11750] SELinux: security_context_str_to_sid (ramfs) failed with errno=-22 [ 132.361739][T11752] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1672'. [ 132.394153][T11756] netlink: 'syz.3.1675': attribute type 1 has an invalid length. [ 132.439249][T11756] bond14: entered promiscuous mode [ 132.439474][T11756] 8021q: adding VLAN 0 to HW filter on device bond14 [ 132.452973][T11756] bond14: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 132.452989][T11756] bond14: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 132.452998][T11756] bond14: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 132.455657][T11759] FAULT_INJECTION: forcing a failure. [ 132.455657][T11759] name fail_futex, interval 1, probability 0, space 0, times 1 [ 132.455689][T11759] CPU: 0 UID: 0 PID: 11759 Comm: syz.4.1676 Tainted: G L syzkaller #0 PREEMPT(full) [ 132.455715][T11759] Tainted: [L]=SOFTLOCKUP [ 132.455722][T11759] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 132.455733][T11759] Call Trace: [ 132.455740][T11759] [ 132.455747][T11759] dump_stack_lvl+0x100/0x190 [ 132.455780][T11759] should_fail_ex.cold+0x5/0xa [ 132.455807][T11759] get_futex_key+0x1d0/0x14f0 [ 132.455836][T11759] ? __pfx_get_futex_key+0x10/0x10 [ 132.455870][T11759] futex_wait_setup+0x91/0x540 [ 132.455904][T11759] __futex_wait+0x19f/0x300 [ 132.455959][T11759] ? __pfx___futex_wait+0x10/0x10 [ 132.455987][T11759] ? futex_hash+0x311/0x400 [ 132.456013][T11759] ? __pfx_futex_wake_mark+0x10/0x10 [ 132.456073][T11759] ? __pfx_futex_hash+0x10/0x10 [ 132.456096][T11759] ? __lock_acquire+0x5c0/0x1f40 [ 132.456121][T11759] futex_wait+0xe6/0x370 [ 132.456152][T11759] ? __pfx_futex_wait+0x10/0x10 [ 132.456178][T11759] ? lock_acquire+0x1d1/0x380 [ 132.456209][T11759] do_futex+0x265/0x440 [ 132.456234][T11759] ? __pfx_do_futex+0x10/0x10 [ 132.456256][T11759] ? __sys_bind+0x1c7/0x260 [ 132.456286][T11759] __x64_sys_futex+0x34f/0x4d0 [ 132.456316][T11759] ? __pfx___x64_sys_futex+0x10/0x10 [ 132.456353][T11759] do_syscall_64+0x123/0x790 [ 132.456380][T11759] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.456405][T11759] RIP: 0033:0x7ff9e759e159 [ 132.456422][T11759] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.456439][T11759] RSP: 002b:00007ff9e84e70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 132.456461][T11759] RAX: ffffffffffffffda RBX: 00007ff9e7825fa8 RCX: 00007ff9e759e159 [ 132.456474][T11759] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007ff9e7825fa8 [ 132.456486][T11759] RBP: 00007ff9e7825fa0 R08: 0000000000000000 R09: 0000000000000000 [ 132.456496][T11759] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 132.456507][T11759] R13: 00007ff9e7826038 R14: 00007ffd432260a0 R15: 00007ffd43226188 [ 132.456530][T11759] [ 132.485038][T11763] x_tables: duplicate underflow at hook 1 [ 132.526443][T11766] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 132.607742][T11779] netlink: 'syz.3.1682': attribute type 10 has an invalid length. [ 132.619985][T11779] bond13: (slave veth0_to_bond): Releasing active interface [ 132.620012][T11779] veth0_to_bond: left promiscuous mode [ 132.620180][T11779] veth0_to_bond: left allmulticast mode [ 132.631540][T11779] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 132.649199][T11785] binder: 11784:11785 ioctl 4018620d 0 returned -22 [ 132.652295][ T7777] usb 7-1: reset high-speed USB device number 9 using dummy_hcd [ 132.679756][ T7777] usb 7-1: device reset changed ep0 maxpacket size! [ 132.686731][ T5808] usb 7-1: USB disconnect, device number 9 [ 132.746784][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.746839][ T1439] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.775741][ T5738] Bluetooth: hci2: unexpected event for opcode 0x1003 [ 132.790213][T11802] geneve2: entered allmulticast mode [ 132.828619][T11805] Bluetooth: MGMT ver 1.23 [ 132.832360][ T5808] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 132.992774][ T5808] usb 7-1: Using ep0 maxpacket: 16 [ 132.993550][ T5808] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 132.994518][ T5808] usb 7-1: config 1 interface 0 altsetting 250 bulk endpoint 0x82 has invalid maxpacket 16 [ 132.994542][ T5808] usb 7-1: config 1 interface 0 altsetting 250 bulk endpoint 0x3 has invalid maxpacket 1023 [ 132.994563][ T5808] usb 7-1: config 1 interface 0 has no altsetting 0 [ 132.996353][ T5808] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.996371][ T5808] usb 7-1: Product: syz [ 132.996383][ T5808] usb 7-1: Manufacturer: syz [ 132.996394][ T5808] usb 7-1: SerialNumber: syz [ 133.006628][T11734] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 133.006771][T11734] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 133.184087][ T7777] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 133.222552][ T5808] cdc_ether 7-1:1.0: probe with driver cdc_ether failed with error -71 [ 133.227592][ T5808] usb 7-1: USB disconnect, device number 10 [ 133.352765][ T7777] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 133.353576][ T7777] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 133.355090][ T7777] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 133.355103][ T7777] usb 9-1: Product: syz [ 133.355110][ T7777] usb 9-1: Manufacturer: syz [ 133.355117][ T7777] usb 9-1: SerialNumber: syz [ 133.562764][ T7777] usblp 9-1:1.0: usblp0: USB Unidirectional printer dev 18 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 133.685612][ T5738] Bluetooth: hci2: unexpected event for opcode 0x202a [ 133.707111][T11828] netlink: 2716 bytes leftover after parsing attributes in process `syz.3.1697'. [ 133.749836][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 133.749853][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 133.749882][ T5141] loop0: [ 133.818415][ T7777] usb 9-1: USB disconnect, device number 18 [ 133.823316][ T7777] usblp0: removed [ 133.935486][T11849] xt_hashlimit: size too large, truncated to 1048576 [ 134.027836][ T5738] Bluetooth: hci0: unexpected event for opcode 0x0c25 [ 134.037100][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 134.037123][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 134.037167][ T5141] loop0: [ 134.250633][T11879] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1713'. [ 134.250668][T11879] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1713'. [ 134.308396][T11881] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1710'. [ 134.308431][T11881] netlink: 'syz.5.1710': attribute type 7 has an invalid length. [ 134.308444][T11881] netlink: 'syz.5.1710': attribute type 8 has an invalid length. [ 134.308454][T11881] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1710'. [ 134.645344][T11905] 8021q: adding VLAN 0 to HW filter on device bond15 [ 134.658801][T11905] bond0: (slave veth0_to_bond): Releasing backup interface [ 134.671912][T11905] bond15: (slave veth0_to_bond): making interface the new active one [ 134.675977][T11905] bond15: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 134.688626][T11905] bond15: entered promiscuous mode [ 134.688646][T11905] veth0_to_bond: entered promiscuous mode [ 134.688798][T11905] bond15: entered allmulticast mode [ 134.688810][T11905] veth0_to_bond: entered allmulticast mode [ 134.691167][T11911] FAULT_INJECTION: forcing a failure. [ 134.691167][T11911] name failslab, interval 1, probability 0, space 0, times 0 [ 134.691205][T11911] CPU: 2 UID: 0 PID: 11911 Comm: syz.4.1722 Tainted: G L syzkaller #0 PREEMPT(full) [ 134.691232][T11911] Tainted: [L]=SOFTLOCKUP [ 134.691239][T11911] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.691250][T11911] Call Trace: [ 134.691257][T11911] [ 134.691265][T11911] dump_stack_lvl+0x100/0x190 [ 134.691313][T11911] should_fail_ex.cold+0x5/0xa [ 134.691343][T11911] should_failslab+0xc2/0x120 [ 134.691374][T11911] __kmalloc_cache_noprof+0x91/0x6d0 [ 134.691402][T11911] ? __lock_acquire+0x5c0/0x1f40 [ 134.691422][T11911] ? tipc_nametbl_insert_publ+0x5a/0x1570 [ 134.691463][T11911] tipc_nametbl_insert_publ+0x5a/0x1570 [ 134.691495][T11911] ? do_raw_spin_lock+0x128/0x260 [ 134.691520][T11911] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 134.691550][T11911] tipc_nametbl_publish+0x18b/0x300 [ 134.691583][T11911] tipc_sk_publish+0x1d8/0x430 [ 134.691611][T11911] ? __pfx_tipc_sk_publish+0x10/0x10 [ 134.691644][T11911] ? __local_bh_enable_ip+0xa5/0x120 [ 134.691669][T11911] tipc_sk_bind+0x16f/0x380 [ 134.691704][T11911] tipc_bind+0x18d/0x280 [ 134.691727][T11911] __sys_bind+0x1a9/0x260 [ 134.691765][T11911] ? __pfx___sys_bind+0x10/0x10 [ 134.691807][T11911] __x64_sys_bind+0x72/0xb0 [ 134.691834][T11911] ? lockdep_hardirqs_on+0x7d/0x110 [ 134.691856][T11911] do_syscall_64+0x123/0x790 [ 134.691880][T11911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.691899][T11911] RIP: 0033:0x7ff9e759e159 [ 134.691915][T11911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.691934][T11911] RSP: 002b:00007ff9e84e7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 134.691952][T11911] RAX: ffffffffffffffda RBX: 00007ff9e7825fa0 RCX: 00007ff9e759e159 [ 134.691962][T11911] RDX: 0000000000000010 RSI: 00002000000000c0 RDI: 0000000000000006 [ 134.691971][T11911] RBP: 00007ff9e763503b R08: 0000000000000000 R09: 0000000000000000 [ 134.691982][T11911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 134.691992][T11911] R13: 00007ff9e7826038 R14: 00007ff9e7825fa0 R15: 00007ffd43226188 [ 134.692036][T11911] [ 134.704774][T11905] macvlan2: entered promiscuous mode [ 134.704825][T11905] macvlan2: entered allmulticast mode [ 134.705874][T11905] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 134.710561][T11905] bond15: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 134.891940][T11924] 9pnet_virtio: no channels available for device syz [ 134.892068][T11923] 9pnet_virtio: no channels available for device syz [ 134.896939][T11925] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1727'. [ 135.188190][T11957] bond4: entered promiscuous mode [ 135.188567][T11957] 8021q: adding VLAN 0 to HW filter on device bond4 [ 135.198063][T11957] bond4: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 135.198087][T11957] bond4: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 135.198102][T11957] bond4: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 135.265963][T11961] device-mapper: thin metadata: sb_check failed: magic 0: wanted 27022010 [ 135.265987][T11961] device-mapper: block manager: superblock validator check failed for block 0 [ 135.265999][T11961] device-mapper: thin metadata: couldn't read superblock [ 135.359313][ T5738] Bluetooth: hci2: unexpected event for opcode 0x0c25 [ 135.387707][T11975] openvswitch: netlink: IP tunnel attribute has 5413 unknown bytes. [ 135.420277][T11980] xt_hashlimit: size too large, truncated to 1048576 [ 135.462382][T11961] device-mapper: table: 248:0: thin-pool: Error creating metadata object (-EILSEQ) [ 135.462406][T11961] device-mapper: ioctl: error adding target to table [ 135.559834][T11990] xt_hashlimit: size too large, truncated to 1048576 [ 135.627642][T11997] iommufd_mock iommufd_mock0: Adding to iommu group 2 [ 135.693861][T12010] validate_nla: 3 callbacks suppressed [ 135.693874][T12010] netlink: 'syz.5.1751': attribute type 1 has an invalid length. [ 135.907678][T12039] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(1277994756.1432912381.1064105028), cmd(5) [ 135.908789][ T5141] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 135.908808][ T5141] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 135.908849][ T5141] loop0: [ 136.075986][T12055] netlink: 'syz.5.1767': attribute type 1 has an invalid length. [ 136.097137][T12055] 8021q: adding VLAN 0 to HW filter on device bond5 [ 136.106894][T12055] bond0: (slave veth0_to_bond): Releasing backup interface [ 136.110292][T12055] bond5: (slave veth0_to_bond): making interface the new active one [ 136.111015][T12055] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 136.118229][T12055] bond5: entered promiscuous mode [ 136.118242][T12055] veth0_to_bond: entered promiscuous mode [ 136.118336][T12055] bond5: entered allmulticast mode [ 136.118344][T12055] veth0_to_bond: entered allmulticast mode [ 136.127830][T12055] macvlan2: entered promiscuous mode [ 136.127849][T12055] macvlan2: entered allmulticast mode [ 136.129212][T12055] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 136.133761][T12055] bond5: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 136.289421][T12071] check_preemption_disabled: 40 callbacks suppressed [ 136.289439][T12071] BUG: using smp_processor_id() in preemptible [00000000] code: syz.5.1774/12071 [ 136.289452][T12071] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 136.289485][T12071] CPU: 3 UID: 0 PID: 12071 Comm: syz.5.1774 Tainted: G L syzkaller #0 PREEMPT(full) [ 136.289507][T12071] Tainted: [L]=SOFTLOCKUP [ 136.289514][T12071] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 136.289523][T12071] Call Trace: [ 136.289529][T12071] [ 136.289537][T12071] dump_stack_lvl+0x100/0x190 [ 136.289563][T12071] check_preemption_disabled+0xd2/0xe0 [ 136.289588][T12071] ? tun_get_user+0x14f9/0x3cc0 [ 136.289606][T12071] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 136.289631][T12071] ? tun_get_user+0x14f9/0x3cc0 [ 136.289649][T12071] trace_kfree_skb+0x18b/0x230 [ 136.289674][T12071] sk_skb_reason_drop+0xb7/0x1b0 [ 136.289703][T12071] tun_get_user+0x14f9/0x3cc0 [ 136.289732][T12071] ? __lock_acquire+0x5c0/0x1f40 [ 136.289751][T12071] ? __pfx_tun_get_user+0x10/0x10 [ 136.289770][T12071] ? __file_has_perm+0x336/0x460 [ 136.289798][T12071] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 136.289827][T12071] ? find_held_lock+0x2b/0x80 [ 136.289849][T12071] ? tun_get+0x191/0x370 [ 136.289865][T12071] ? tun_get+0x191/0x370 [ 136.289887][T12071] tun_chr_write_iter+0xdc/0x200 [ 136.289908][T12071] vfs_write+0x6af/0x1050 [ 136.289926][T12071] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 136.289948][T12071] ? __pfx_vfs_write+0x10/0x10 [ 136.289963][T12071] ? find_held_lock+0x2b/0x80 [ 136.290000][T12071] ksys_write+0x12a/0x250 [ 136.290017][T12071] ? __pfx_ksys_write+0x10/0x10 [ 136.290040][T12071] do_syscall_64+0x123/0x790 [ 136.290065][T12071] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.290082][T12071] RIP: 0033:0x7f472675e98e [ 136.290098][T12071] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 136.290113][T12071] RSP: 002b:00007f4727638fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 136.290130][T12071] RAX: ffffffffffffffda RBX: 00007f47276396c0 RCX: 00007f472675e98e [ 136.290142][T12071] RDX: 0000000000000052 RSI: 0000200000001880 RDI: 00000000000000c8 [ 136.290153][T12071] RBP: 00007f472683503b R08: 0000000000000000 R09: 0000000000000000 [ 136.290163][T12071] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 136.290173][T12071] R13: 00007f4726a26038 R14: 00007f4726a25fa0 R15: 00007ffc92c742b8 [ 136.290195][T12071] [ 136.291881][T12073] nvmet: Invalid value '4:0`"~z0׆#WR9p)jF0pMQ0onc' for trtype [ 138.502488][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog