last executing test programs: 58.717890507s ago: executing program 3 (id=134): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000007000000070000000020000000400000000e3ff01050000000300000005000093010004000a000000ffff00000600000002000000ff0f00000500000004000000400000000300000031e28cab08f3182c81000000100002007304000001000000060000000000000e0400000000630000000000000000000d"], 0x0, 0x8a, 0x0, 0x40000001, 0x6}, 0x28) socket$inet_smc(0x2b, 0x1, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) (async) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x10001, 0x1, 0x3, 0x8, 0xffffffc0}, 0x4, 0x1, 0x8, 0x0, 0x3, 0x0, 0x16, 0x13, 0x3, 0xca, {0x0, 0x8, 0x3, 0x5, 0x84, 0x8}}}}]}, 0x78}}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=@getchain={0x34, 0x66, 0x200, 0x70bd25, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0xf, 0x6}, {0x5, 0xf}, {0xb, 0x10}}, [{0x8, 0xb, 0x7}, {0x8, 0xb, 0xe66}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r4 = socket$kcm(0x11, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000001780)={&(0x7f00000003c0)=@caif=@rfm={0x25, 0x15, "fb95785b587f23ba61bfb990191a2af1"}, 0x80, &(0x7f00000015c0)=[{&(0x7f0000001800)="a5", 0x48}], 0x1}, 0x0) 58.714834314s ago: executing program 3 (id=135): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2501, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(r4, 0xc0905664, &(0x7f0000000140)={0x0, 0x0, '\x00', @bt={0x1, 0x9, 0x401, 0x9, 0x792c, 0x1fe000000, 0x4, 0x7}}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@ipv6_delrule={0x38, 0x18, 0x1, 0x70bd2a, 0x25dfdbff, {0xa, 0x0, 0x0, 0x0, 0xff, 0x3, 0x0, 0x2}, [@FRA_DST={0x14, 0x7, @loopback}, @FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x4, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4044004}, 0x20044884) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000480)={0x1, 0x0, [{0x773, 0x0, 0xb8}]}) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r7 = syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r8 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r7) pread64(r8, 0x0, 0x0, 0xc) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_IBSS(r9, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r10, 0x800, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r11}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0xc004}, 0x804) r12 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r12, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r12, &(0x7f0000000000), 0xd) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000fdffffff0025bd701414bb00"/28], 0x1c}, 0x1, 0x0, 0x0, 0x24040855}, 0x8410) 58.700758073s ago: executing program 3 (id=141): syz_emit_ethernet(0x14e, &(0x7f0000000340)={@multicast, @remote, @val={@val={0x88a8, 0x0, 0x1}, {0x8100, 0x7, 0x0, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\a\x00', 0x110, 0x3a, 0xff, @remote, @private0={0xfc, 0x0, '\x00', 0x1}, {[@hopopts={0x0, 0x1e, '\x00', [@hao={0xc9, 0x10, @private2}, @pad1, @generic={0x1, 0xde, "0995bcb44d418eaad5f8afab4948e6068f7ad6285f6c0abe95b1ae97d659607230f6d5c355d37fa73eabc59f8fe09294a0a5118bab745e287ffdaa3db166ef9db00e59020a1211fcfc4a279cc7d7af69f90f0d4d8369c991ae4b56223f28e00633339580985dcc9968f28b093934c32682baf5eee0931585540c39df34ad035cb66adfff817831e88be2fc76fef30f9c54ea8a39257a35eb81a561272f285fb76e7401bc4985b35ac03d6fb89a8d7da716715b702e3eebd6f4c57b507f572779a6a74152c7de5263ea749eafac93b70ffacb87a5d02ea910464d9871a828"}]}], @ndisc_ra}}}}}, 0x0) (async) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000200)={0x0, 0x17}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000000280)={r1, @in6={{0xa, 0x4e22, 0x1ff, @loopback, 0x200}}}, 0x84) (async) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r2, &(0x7f00000001c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x3e, @remote, 0x6}, r3}}, 0x30) (async) r4 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendto$l2tp6(r4, &(0x7f0000000040)="6211098048fba98b88996d34554829765d0b893fa8c2542d6013ea01f19c12123c9d2c4b651bb175974fefa445d679239834b3a19e0d5943fdc25e2d71382f59aba636012a218056b7cc57188d8e859843077e51aa12a8f5f62bfe4c38f1f8d5", 0x60, 0x4008080, &(0x7f00000000c0)={0xa, 0x0, 0x5, @dev={0xfe, 0x80, '\x00', 0x2e}, 0x5, 0x3}, 0x20) 58.599382943s ago: executing program 3 (id=143): ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f00000000c0)={0xffe00000, 0x400, @value=0x2}) socket$packet(0x11, 0x3, 0x300) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x585d}, [@IFLA_IFNAME={0x14, 0x3, 'tunl0\x00'}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x2}]}}}]}, 0x50}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r1 = open(&(0x7f00000002c0)='.\x00', 0x80000, 0x12d) ioctl$AUTOFS_IOC_ASKUMOUNT(r1, 0x80049370, &(0x7f00000000c0)) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r3 = fanotify_init(0xf00, 0x0) r4 = open$dir(&(0x7f0000000180)='./file0\x00', 0x200000, 0x10) renameat2(r2, &(0x7f0000000140)='./file0\x00', r4, &(0x7f0000000200)='./file0\x00', 0x0) fanotify_mark(r3, 0x1, 0x5000003a, r2, 0x0) open(&(0x7f0000000300)='.\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f0000000f40)={0x2020}, 0x2020) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x0) chdir(0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file7\x00', 0x1ac) r5 = openat$dir(0xffffffffffffff9c, 0x0, 0x101000, 0x0) syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYRES32=r5], 0x9) 58.521499983s ago: executing program 3 (id=146): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x400000000000004) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r2, &(0x7f0000001180)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000380)="c4f6567b42428c351d0eb7e00adfac40f6f3c6ddfeee4f9b47f2ae534b00a80cf8bfe9952dadad722784be00d5e05f8aa568711892567737d85ade9858ea72a66a3a417d6fbdfe0c98a369e4e8de7139ea726aa8fd9e2b80cf70a64914c3cc12d10db3f785dcc90135afb89c4f917aba8da3dafa45a3ce5c98ad8d4e6528e2210d206b85f15e5eb55355d2acc609a1cc4df8ff5011ac509e40cc0ebded6b2781a05df6b38f458fe8a98d5ec9117cf4d25825b441b2e49dd32aca0852c7d7387a5452972ebde3fa90be5547e19b635d3b468d8cb58dd8d5e5aa5a9171", 0xdc}, {&(0x7f0000000640)="18f2539a86f4267acf60e40dadcc211bb186706861b663e404ae5430d948a3deeb5982fbb1551c83edaad587e700949a9d32f5e7ab7cf7f52b86771efac9c04f3e30497f94e49127658062a15683e89b0aceb57d125d3b4ea3d1ad05f4e14c85034917bea1f128a1f6f3f33e7fd479", 0x6f}, {&(0x7f0000000800)="1c98baccf3c4dda10bf3823360bf673a13af18c90ee53a5b0ab6833eee1edc56059d6fdcb3227e7e06079dc9725423d66f47694787ec855a7fa2310330b220642ee8afcbd20fd692957d850174c2a1e64e225bad95c1c5ca477757bb1d8b4785dd0cba2804aaeecb9bcd3802d2fde5", 0x6f}, {&(0x7f0000000880)="6697624319e115b3b12c54b477244af3979b03fafbcbe555a59252423d41131d33d81eefbc306e247aeb9a5e6891b7ff731b", 0x32}, {&(0x7f0000000900)}], 0x5}}, {{0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000ac0)="a19168e24152c670ecff4e0ee89533187a9206e8b223bed2e89af6709b054a05bafbd8bdb01fe87a3b63a17eff007ee93b40c121e355801159a45e36111175f8d8453960c864bdcf3826be3ffadaa7dba08508123324e0a45a93818ebf5c0fbac285cd0f399da8e4257170efbebf704e9c42cd6e193c280eac0e484d38db0e45923cc47acab1da2c1b47f999d17a7f681eb1f12fb8771d4c103091f99d1c1a", 0x9f}, {0x0}, {&(0x7f0000000dc0)="820b29dccf3af022d0ddfd370dd8dda2b3c897775aa4271e7408cb", 0x1b}], 0x3}}], 0x2, 0x4000000) sendmmsg$inet(r2, &(0x7f0000000c00)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f00000002c0)="91f8a9849519def2f8eb48d9173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000000000f38a6a4cb6b275ee91bd01", 0x4c}, {&(0x7f0000000700)}, {0x0}], 0x3}}], 0x1, 0x4000900) setsockopt$sock_int(r2, 0x1, 0x8, 0x0, 0x0) sendto$inet(r2, 0x0, 0x0, 0x10008095, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd700000000000047c00000400c2800c0001800600060084"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/drivers\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f00000028c0)={0x2020}, 0x2020) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800}, 0x20) sendmmsg(r2, 0x0, 0x0, 0x200080c1) writev(r1, &(0x7f0000000100)=[{0x0}], 0x1) 58.295026112s ago: executing program 3 (id=151): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) (rerun: 64) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000080)=0x40000) (async) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r1) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r3, 0x7, 0x70bd25}, 0x14}}, 0x24040881) (async) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r4, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xc07409eec6774eae}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x84, r5, 0x200, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0x7}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x6}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x3}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x6}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xb}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x32}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x119}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x4}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1711}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x186}], @NL80211_ATTR_DURATION={0x8, 0x57, 0xad}]}, 0x84}, 0x1, 0x0, 0x0, 0x28000045}, 0x44090) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) 58.279998829s ago: executing program 32 (id=151): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) (rerun: 64) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000080)=0x40000) (async) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r1) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r3, 0x7, 0x70bd25}, 0x14}}, 0x24040881) (async) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r4, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xc07409eec6774eae}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x84, r5, 0x200, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0x7}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x6}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x3}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x6}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xb}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x32}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x119}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x4}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1711}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x186}], @NL80211_ATTR_DURATION={0x8, 0x57, 0xad}]}, 0x84}, 0x1, 0x0, 0x0, 0x28000045}, 0x44090) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) 24.60485514s ago: executing program 1 (id=655): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x80400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000004c0)={'pcl812\x00', [0x100, 0xf, 0xcd, 0x2, 0x1, 0x100, 0x4, 0x6d, 0x8, 0xb, 0x0, 0x7, 0x1, 0x401, 0x10001, 0x1, 0x200009, 0x8, 0xfe9, 0x401, 0x0, 0x2, 0x7, 0x9, 0x148, 0x9, 0x7, 0x6a77, 0x5, 0x0, 0x8]}) read(r0, &(0x7f0000000080)=""/116, 0x74) r1 = creat(&(0x7f0000000280)='./file2\x00', 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) lsetxattr(&(0x7f0000000000)='./file2\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="6f73322e6f7665726c6171000611186844b7c6d8fb0ab13cb408c53fc61a52f6cdb62b898a6aa141f79feb27477c57e2b1190fe7282d0760a182f09166fce27b1d9bc32f55fa4cab6a2e6ed0ce6f8ee9e3c71c15b146ecca555c5cfba65af13b86ed16acbd9f2fe055f72f99fb78724a82443fb64a71413ba872fbb9bc53f7b5551bcfab7fc2a24bcb10"], &(0x7f00000001c0)='overlay\x00', 0x8, 0x0) socket$nl_route(0x10, 0x3, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0xffffffff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x66) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x8, 0x0, 0x0, 0x10}]}}, 0x0, 0x26}, 0x28) ioctl$KVM_RUN(r1, 0xae80, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x187) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@uuid_off}, {@index_off}]}) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='./file1/file2/file0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./file0/file2\x00', 0x2) 24.555113224s ago: executing program 1 (id=656): setgid(0xee00) r0 = syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') fchdir(r1) mount(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000000)='proc\x00', 0x800000, 0x0) r2 = syz_open_procfs(r0, &(0x7f0000000400)='stat\x00') pread64(r2, &(0x7f0000000140)=""/15, 0xf, 0x4) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000100), 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f00000000c0)=0x2, 0x4) getsockopt$inet_tcp_int(r3, 0x6, 0x15, 0x0, &(0x7f0000000040)) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) 24.5051448s ago: executing program 1 (id=657): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_int(r2, 0x0, 0x2, 0x0) sendfile(r0, r3, 0x0, 0x101) 24.504842896s ago: executing program 1 (id=658): syz_io_uring_setup(0x4eac, &(0x7f0000000000)={0x0, 0x9e8c, 0x20, 0x0, 0x8e}, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$binder(0x0, &(0x7f0000000140)='./file0/file0/file0\x00', &(0x7f0000000180), 0x400000, &(0x7f00000003c0)={[{@max={'max', 0x3d, 0x4}}, {@stats}, {@max={'max', 0x3d, 0x10000000003}}, {@stats}, {@max={'max', 0x3d, 0x2}}, {@stats}, {@stats}, {@stats}], [{@mask={'mask', 0x3d, 'MAY_APPEND'}}, {@hash}]}) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000000314230c2abd7000ff05df250900020073797a310000000008004100727865001400330073797a5f74756e"], 0x38}, 0x1, 0x0, 0x0, 0x48845}, 0x4000) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x28, 0x1410, 0x1, 0x70bd29, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x50}, 0xc0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) umount2(&(0x7f0000000380)='./file0/file0/file0\x00', 0x1) mount$tmpfs(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000040), 0x10, &(0x7f0000000240)={[{@usrquota_inode_hardlimit={'usrquota_inode_hardlimit', 0x3d, [0x36, 0x39, 0x36, 0x65]}}]}) 23.554652885s ago: executing program 1 (id=675): syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="54b008bdd80d8a5074985c610d5ce2d43f7501ab7c8e75d06e9d2f9c1dac7da040237d29c7c6aab26dc60ed2c5d11a78cf7aeef9e252a0a2b866a5befd70357800fcd2029d04ac42b2ed90af71776bae8ab26f2ea8c576193507905f521830f23a9e0779b507c952fa57b41353f14d526df6e70e7e51ac116e20ee93cecbf54194126f69aadfa8462f1794148c1c9e80e9e53bcb476591c4fdb03aad52a5d9136e2a0737775bdea081164de7b33f3ac0490c900af67afd88e830419f6d253ded9c5df0fd48f56e9a759818ae6425e266f9c89bee622e2b54b128bddf442dc7223b32fca7280574403ba973177969438d82b77c640000000000000000"], 0x4) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000002f00090027bd7000eddbdf250400000008001a8004000480"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 21.865264661s ago: executing program 1 (id=691): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x400000000000004) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r1, &(0x7f0000001180)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000380)="c4f6567b42428c351d0eb7e00adfac40f6f3c6ddfeee4f9b47f2ae534b00a80cf8bfe9952dadad722784be00d5e05f8aa568711892567737d85ade9858ea72a66a3a417d6fbdfe0c98a369e4e8de7139ea726aa8fd9e2b80cf70a64914c3cc12d10db3f785dcc90135afb89c4f917aba8da3dafa45a3ce5c98ad8d4e6528e2210d206b85f15e5eb55355d2acc609a1cc4df8ff5011ac509e40cc0ebded6b2781a05df6b38f458fe8a98d5ec9117cf4d25825b441b2e49dd32aca0852c7d7387a5452972ebde3fa90be5547e19b635d3b468d8cb58dd8d5e5aa5a9171", 0xdc}, {&(0x7f0000000640)="18f2539a86f4267acf60e40dadcc211bb186706861b663e404ae5430d948a3deeb5982fbb1551c83edaad587e700949a9d32f5e7ab7cf7f52b86771efac9c04f3e30497f94e49127658062a15683e89b0aceb57d125d3b4ea3d1ad05f4e14c85034917bea1f128a1f6f3f33e7fd479", 0x6f}, {&(0x7f0000000800)="1c98baccf3c4dda10bf3823360bf673a13af18c90ee53a5b0ab6833eee1edc56059d6fdcb3227e7e06079dc9725423d66f47694787ec855a7fa2310330b220642ee8afcbd20fd692957d850174c2a1e64e225bad95c1c5ca477757bb1d8b4785dd0cba2804aaeecb9bcd3802d2fde5", 0x6f}, {&(0x7f0000000880)="6697624319e115b3b12c54b477244af3979b03fafbcbe555a59252423d41131d33d81eefbc306e247aeb9a5e6891b7ff731b", 0x32}, {&(0x7f0000000900)}], 0x5}}, {{0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000ac0)="a19168e24152c670ecff4e0ee89533187a9206e8b223bed2e89af6709b054a05bafbd8bdb01fe87a3b63a17eff007ee93b40c121e355801159a45e36111175f8d8453960c864bdcf3826be3ffadaa7dba08508123324e0a45a93818ebf5c0fbac285cd0f399da8e4257170efbebf704e9c42cd6e193c280eac0e484d38db0e45923cc47acab1da2c1b47f999d17a7f681eb1f12fb8771d4c103091f99d1c1a", 0x9f}, {0x0}, {&(0x7f0000000dc0)="820b29dccf3af022d0ddfd370dd8dda2b3c897775aa4271e7408cb", 0x1b}], 0x3}}], 0x2, 0x4000000) sendmmsg$inet(r1, &(0x7f0000000c00)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f00000002c0)="91f8a9849519def2f8eb48d9173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000000000f38a6a4cb6b275ee91bd01", 0x4c}, {&(0x7f0000000700)}, {0x0}], 0x3}}], 0x1, 0x4000900) setsockopt$sock_int(r1, 0x1, 0x8, 0x0, 0x0) sendto$inet(r1, 0x0, 0x0, 0x10008095, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd700000000000047c0000040097800c0001801b00060084"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/drivers\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f00000028c0)={0x2020}, 0x2020) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r3, 0x117, 0x5, 0x0, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800}, 0x20) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f0000000380)={0x28, 0x7, r6, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000}) ioctl$IOMMU_DESTROY$stdev(r5, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000980)={0x48, 0x5, r6, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r5, 0x3ba0, &(0x7f0000000b80)={0x48, 0x6, r7}) sendmmsg(r1, 0x0, 0x0, 0x200080c1) 21.863932172s ago: executing program 33 (id=691): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x400000000000004) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r1, &(0x7f0000001180)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000380)="c4f6567b42428c351d0eb7e00adfac40f6f3c6ddfeee4f9b47f2ae534b00a80cf8bfe9952dadad722784be00d5e05f8aa568711892567737d85ade9858ea72a66a3a417d6fbdfe0c98a369e4e8de7139ea726aa8fd9e2b80cf70a64914c3cc12d10db3f785dcc90135afb89c4f917aba8da3dafa45a3ce5c98ad8d4e6528e2210d206b85f15e5eb55355d2acc609a1cc4df8ff5011ac509e40cc0ebded6b2781a05df6b38f458fe8a98d5ec9117cf4d25825b441b2e49dd32aca0852c7d7387a5452972ebde3fa90be5547e19b635d3b468d8cb58dd8d5e5aa5a9171", 0xdc}, {&(0x7f0000000640)="18f2539a86f4267acf60e40dadcc211bb186706861b663e404ae5430d948a3deeb5982fbb1551c83edaad587e700949a9d32f5e7ab7cf7f52b86771efac9c04f3e30497f94e49127658062a15683e89b0aceb57d125d3b4ea3d1ad05f4e14c85034917bea1f128a1f6f3f33e7fd479", 0x6f}, {&(0x7f0000000800)="1c98baccf3c4dda10bf3823360bf673a13af18c90ee53a5b0ab6833eee1edc56059d6fdcb3227e7e06079dc9725423d66f47694787ec855a7fa2310330b220642ee8afcbd20fd692957d850174c2a1e64e225bad95c1c5ca477757bb1d8b4785dd0cba2804aaeecb9bcd3802d2fde5", 0x6f}, {&(0x7f0000000880)="6697624319e115b3b12c54b477244af3979b03fafbcbe555a59252423d41131d33d81eefbc306e247aeb9a5e6891b7ff731b", 0x32}, {&(0x7f0000000900)}], 0x5}}, {{0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000ac0)="a19168e24152c670ecff4e0ee89533187a9206e8b223bed2e89af6709b054a05bafbd8bdb01fe87a3b63a17eff007ee93b40c121e355801159a45e36111175f8d8453960c864bdcf3826be3ffadaa7dba08508123324e0a45a93818ebf5c0fbac285cd0f399da8e4257170efbebf704e9c42cd6e193c280eac0e484d38db0e45923cc47acab1da2c1b47f999d17a7f681eb1f12fb8771d4c103091f99d1c1a", 0x9f}, {0x0}, {&(0x7f0000000dc0)="820b29dccf3af022d0ddfd370dd8dda2b3c897775aa4271e7408cb", 0x1b}], 0x3}}], 0x2, 0x4000000) sendmmsg$inet(r1, &(0x7f0000000c00)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f00000002c0)="91f8a9849519def2f8eb48d9173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000000000f38a6a4cb6b275ee91bd01", 0x4c}, {&(0x7f0000000700)}, {0x0}], 0x3}}], 0x1, 0x4000900) setsockopt$sock_int(r1, 0x1, 0x8, 0x0, 0x0) sendto$inet(r1, 0x0, 0x0, 0x10008095, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd700000000000047c0000040097800c0001801b00060084"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/drivers\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f00000028c0)={0x2020}, 0x2020) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r3, 0x117, 0x5, 0x0, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800}, 0x20) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f0000000380)={0x28, 0x7, r6, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000}) ioctl$IOMMU_DESTROY$stdev(r5, 0x3b80, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000980)={0x48, 0x5, r6, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r5, 0x3ba0, &(0x7f0000000b80)={0x48, 0x6, r7}) sendmmsg(r1, 0x0, 0x0, 0x200080c1) 2.05462169s ago: executing program 0 (id=892): r0 = socket(0x11, 0x3, 0x0) setsockopt(r0, 0x107, 0xf, &(0x7f0000000100)="00008634", 0x4) (async) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="1400000013000104000000000000000005"], 0x14}], 0x1}, 0x0) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'geneve0\x00', 0x0}) sendmsg(r0, &(0x7f0000000100)={&(0x7f0000000040)=@ll={0x11, 0x3, r2, 0x1, 0xe5, 0x6, @broadcast}, 0x80, &(0x7f0000000240)=[{&(0x7f00000003c0)="020195ff002d3922ff65b4355e953d23d254f00000000000", 0x18}, {&(0x7f00000001c0)="2cf2565b0e508224b706a643e98dc932f5fc6d8e51626cdbf9ff02dbb8b2d2ca2be0dfa8f2a777f680c590257a0641579678f72a6ff270a8989633cbe781bf372d4a0e61", 0xff87}], 0x2}, 0x44000) 1.963961538s ago: executing program 0 (id=894): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r0) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x38, r1, 0x1, 0x70bd2e, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x81}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x4008000) mount(&(0x7f0000000000)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='gfs2\x00', 0x10, &(0x7f0000000100)='barrier') 1.961070174s ago: executing program 0 (id=896): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000000080008d804dd0000000000000109022400010000a008090400fe01030001000921fffffd0122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000080)={0x18, &(0x7f00000012c0)=ANY=[@ANYBLOB="001105"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xc}]}, @NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x24, 0x3, 0x0, 0x1, [{0x20, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x8}, @NFTA_SET_ELEM_EXPRESSIONS={0x18, 0xb, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @counter={{0x10}, @val={0x4}}}]}]}]}]}], {0x14, 0x10}}, 0xd0}}, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r2, 0x4048587b, &(0x7f00000008c0)={{r2, &(0x7f0000000040)='&\x00', 0x18002, &(0x7f0000000140)={@align=0x9, {0x1000, 0x8000, 0x2, 0x1}}, 0x6, &(0x7f0000000540)={@_ha_fsid}, &(0x7f0000000580)=0x8}, 0x4, &(0x7f0000000840)=[{0x3, 0x40, &(0x7f00000005c0)='\xde\x00', &(0x7f0000000600)="b8296e3f47bcc52d9c18cfcf03a440a59a1391bfab2fb2f5dcc0cd24d4520a17eb4715cfeaf71629897de7af9f2dea61d9975538f83830b4ebb9a50e733119e1114d598c1315322b8d6610e4cfb41ce7b7050e3e57dc10458c26b25be1", 0x5d, 0x8}, {0x0, 0x10, &(0x7f0000000680)='counter\x00', &(0x7f00000006c0)="759dbf0d7cfa26a3163fefab62978c67867dfb044a06f47700e47a95d48a0e8e872489c5d7189e4ef60e68d12d79b9da9528f0", 0x33, 0xa}, {0x1, 0x1000, &(0x7f0000000700)='syz2\x00', &(0x7f0000000740)="aac35cc88473391d5f710480a53ec497126a4bc8db412745da0dbab57367e598507ab69202b1a65acb32563a0f34ea97f4b85d6291e2a83875ba9aecc69c3593917dbfe0ec86844f22d89a716eea1139344c498f7fd531bbce6b517efd718a2f72cd7a53edb840bb91a261ed7a910357194805894ee18b50d64ef5158d06", 0x7e}, {0x3, 0x2cb, &(0x7f00000007c0)='/dev/i2c-#\x00', &(0x7f0000000800)="1ab979a1adef3ad6748d3e43ccd52ab713f026b71cd1d9f0fb00cdbac5f6cf7c766d57c2b925320a66b890", 0x2b}]}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001800ef0100000000000000000a0000000000fd0000000a001400050000000000000000000000000000000002"], 0x30}, 0x1, 0x11}, 0x0) sendmsg$NFT_MSG_GETOBJ_RESET(r3, &(0x7f0000000b00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000980)={0x20, 0x15, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4021000}, 0x1) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000100)={0x1, 0x1, 0x5, &(0x7f0000000180)={0x13, "6e003361d70a293d506f8db45f0e0c0000000000ffff27d739ae1ccc7af100"}}) symlink(&(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') readlink(&(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000001200)=""/4096, 0x1000) pipe(&(0x7f00000001c0)) syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010600000009000000180004801300010062"], 0x2c}, 0x1, 0x0, 0x0, 0x20044885}, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08"], 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000000206050000000000000000000000000005000400000000000900020073797a32000000001400078008000840060000b10800064000000fff0500050002000000050001000600000013000300686173683a6e65742c69666163650000"], 0x60}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000440)={[0x3, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0xfffffffffffffffd, 0x0, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 943.938252ms ago: executing program 4 (id=911): socket$nl_netfilter(0x10, 0x3, 0xc) (async) mkdir(&(0x7f00000002c0)='./file0\x00', 0x1e) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000080)='./file0\x00') openat(0xffffffffffffff9c, 0x0, 0x20842, 0x24) (async) r0 = open$dir(&(0x7f0000000140)='./file0\x00', 0x1, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ftruncate(r1, 0x2000009) (async) sendfile(r0, r1, 0x0, 0x20000000000006) (async) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="58000000020605000000000000000000000000001400078005001400090000000800124008001f000500010006000000050005000200000005000400000000000900020073797a31000000000c000300686173683a6970"], 0x58}}, 0x0) 943.472947ms ago: executing program 4 (id=912): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000037000100fffffeff9500000000000000"], &(0x7f00000000c0)='syzkaller\x00', 0x7}, 0x94) 883.069315ms ago: executing program 4 (id=913): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000200)=[@in6={0xa, 0x4e20, 0x1628, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x1}, @in6={0xa, 0x4e24, 0x7, @dev={0xfe, 0x80, '\x00', 0xe}, 0x80}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1a}}, @in={0x2, 0x4e23, @multicast1}, @in={0x2, 0x4e20, @loopback}, @in6={0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x37}}, 0x800}, @in6={0xa, 0x4e22, 0x401, @empty, 0x10000}, @in6={0xa, 0x4e21, 0x3, @dev={0xfe, 0x80, '\x00', 0x16}, 0xb}, @in6={0xa, 0x4e24, 0x2d01ac97, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xe}], 0xd8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x100, &(0x7f0000000340)=[@in6={0xa, 0x4e21, 0xd, @remote, 0x18}, @in={0x2, 0x4e23, @remote}, @in6={0xa, 0x4e24, 0x3, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x2}, @in={0x2, 0x4e20, @multicast1}, @in6={0xa, 0x4e20, 0x1, @dev={0xfe, 0x80, '\x00', 0x2e}, 0x5f6404c1}, @in6={0xa, 0x4e24, 0xb, @loopback, 0xf}, @in6={0xa, 0x8, 0xb49c, @empty, 0x4b50db9a}, @in6={0xa, 0x4e24, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x80}, @in6={0xa, 0x4e21, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}, @in6={0xa, 0x4e24, 0x9, @remote, 0x10000}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000180)={r1, 0x2c, "98eda42bda4ef7ddc3daa7b00fd48e27ded8b3aeb5816a8c9874dac8ae0a1327523a689f38f56f4aa6c08b1f"}, &(0x7f00000001c0)=0x34) r2 = openat$rtc(0xffffff9c, &(0x7f0000001ec0), 0x0, 0x0) ioctl$RTC_AIE_ON(r2, 0x7001) r3 = add_key$keyring(&(0x7f0000002e00), &(0x7f0000002e40)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f00000000c0)='syz', r3) keyctl$read(0xb, r3, &(0x7f0000002e80)=""/4096, 0x1000) ioctl$RTC_AIE_OFF(r2, 0x7002) ioctl$RTC_EPOCH_READ(r2, 0x8008700d, &(0x7f0000000300)) 882.868298ms ago: executing program 4 (id=914): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r1, &(0x7f0000001180)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000380)="c4f6567b42428c351d0eb7e00adfac40f6f3c6ddfeee4f9b47f2ae534b00a80cf8bfe9952dadad722784be00d5e05f8aa568711892567737d85ade9858ea72a66a3a417d6fbdfe0c98a369e4e8de7139ea726aa8fd9e2b80cf70a64914c3cc12d10db3f785dcc90135afb89c4f917aba8da3dafa45a3ce5c98ad8d4e6528e2210d206b85f15e5eb55355d2acc609a1cc4df8ff5011ac509e40cc0ebded6b2781a05df6b38f458fe8a98d5ec9117cf4d25825b441b2e49dd32aca0852c7d7387a5452972ebde3fa90be5547e19b635d3b468d8cb58dd8d5e5aa5a9171", 0xdc}, {&(0x7f0000000640)="18f2539a86f4267acf60e40dadcc211bb186706861b663e404ae5430d948a3deeb5982fbb1551c83edaad587e700949a9d32f5e7ab7cf7f52b86771efac9c04f3e30497f94e49127658062a15683e89b0aceb57d125d3b4ea3d1ad05f4e14c85034917bea1f128a1f6f3f33e7fd479", 0x6f}, {&(0x7f0000000800)="1c98baccf3c4dda10bf3823360bf673a13af18c90ee53a5b0ab6833eee1edc56059d6fdcb3227e7e06079dc9725423d66f47694787ec855a7fa2310330b220642ee8afcbd20fd692957d850174c2a1e64e225bad95c1c5ca477757bb1d8b4785dd0cba2804aaeecb9bcd3802d2fde5", 0x6f}, {&(0x7f0000000880)="6697624319e115b3b12c54b477244af3979b03fafbcbe555a59252423d41131d33d81eefbc306e247aeb9a5e6891b7ff731b", 0x32}, {&(0x7f0000000900)}], 0x5}}, {{0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000ac0)="a19168e24152c670ecff4e0ee89533187a9206e8b223bed2e89af6709b054a05bafbd8bdb01fe87a3b63a17eff007ee93b40c121e355801159a45e36111175f8d8453960c864bdcf3826be3ffadaa7dba08508123324e0a45a93818ebf5c0fbac285cd0f399da8e4257170efbebf704e9c42cd6e193c280eac0e484d38db0e45923cc47acab1da2c1b47f999d17a7f681eb1f12fb8771d4c103091f99d1c1a", 0x9f}, {0x0}, {&(0x7f0000000dc0)="820b29dccf3af022d0ddfd370dd8dda2b3c897775aa4271e7408cb", 0x1b}], 0x3}}], 0x2, 0x4000000) 674.931286ms ago: executing program 5 (id=918): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0x1, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x10b85}, [@IFLA_IFNAME={0x14, 0x3, 'wlan0\x00'}, @IFLA_ADDRESS={0xa, 0x1, @broadcast}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000890}, 0x0) 674.679818ms ago: executing program 5 (id=919): ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) ioctl$KVM_GET_DEVICE_ATTR_vm(0xffffffffffffffff, 0x4018aee2, &(0x7f0000000040)=@attr_other={0x0, 0x0, 0x4, &(0x7f0000000000)=0x3}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x80080, 0x0) ioctl$KVM_GET_PIT2(r0, 0x8070ae9f, &(0x7f00000000c0)) ioctl$KVM_RUN(r0, 0xae80, 0x0) ioctl$BSG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)=0x6) ioctl$KVM_GET_TSC_KHZ_vm(r0, 0xaea3) ioctl$KVM_RUN(r0, 0xae80, 0x0) ioctl$KVM_RUN(r0, 0xae80, 0x0) r1 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_DECODER_CMD(r1, 0xc0485660, &(0x7f00000001c0)={0x3, 0x1, @stop_pts=0x5a}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x4000, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000280)={'custom0\x00'}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) sendmsg$AUDIT_TTY_GET(r0, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x5915eccd11cd7664}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x10, 0x3f8, 0x200, 0x70bd29, 0x25dfdbfb, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = openat$cgroup_devices(r0, &(0x7f00000004c0)='devices.deny\x00', 0x2, 0x0) close_range(r0, r3, 0x2) setsockopt$MRT6_INIT(r0, 0x29, 0xc8, &(0x7f0000000500), 0x4) ioctl$BLKIOOPT(r0, 0x1279, &(0x7f0000000540)) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000580)={0x7, 0x0, [{0xd, 0xf61d, 0x4, 0xfffffff8, 0x27fc000, 0x0, 0x8}, {0x2, 0x8, 0x2, 0x5, 0x5, 0x80000001, 0x6}, {0x40000001, 0x7, 0x5, 0x402d, 0x5, 0x380000, 0x9}, {0x40000001, 0x1, 0x1, 0xffff1823, 0x6, 0x261, 0x3}, {0x6, 0x0, 0x4, 0x4, 0x4, 0x3, 0x6728}, {0xa, 0x1, 0x0, 0x5, 0x8, 0x80, 0x4}, {0x1, 0x386, 0x2, 0x1, 0x10000, 0x7, 0x3ff}]}) r4 = dup(r2) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000006c0)={0x0, 0x2}, &(0x7f0000000700)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000740)={0x9, 0x6, 0x1, 0x10001, 0x7, 0x5be, 0x5, 0x3ff, r5}, 0x20) sendto$l2tp6(0xffffffffffffffff, &(0x7f0000000780)="559fda0bd03b25aff181bb6abe7139ff441443d99c53eec7aa70a7fe82434fa020cfa3bc72b69cf0f8cfbfc945ce88e1954b11b12c57b56127dc7cc8b9b249ab1b64fbe047417fcd3ea3e6a1c60a298849a93b9f2c4b006e8c43f0b78713a1b4f7ebac318e58654fcc7131c844c614bf5f208c172a5e22cc7d9061855ea4e782e778c87668f7a58398e3b990d0fbc76003965abc3dc7cb79da96540be39e4605bb4f75879eeace50c58158c4e94b981f45a24e3b119a5414492ba2b005450352d9f99abd14a8b19f3d2450d6f2b1d5da4a52", 0xd2, 0x4004800, &(0x7f0000000880)={0xa, 0x0, 0x200, @remote, 0x4, 0x3}, 0x20) ioctl$KVM_RUN(r0, 0xae80, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r3, 0xc0709411, &(0x7f00000008c0)={{0x0, 0x8, 0xfffffffffffffffa, 0xfffffffffffffffd, 0xfffffffffffffff7, 0x200, 0x5, 0x9, 0x8, 0x81, 0x9, 0x0, 0x2, 0xec0, 0x1}, 0x20, [0x0, 0x0, 0x0, 0x0]}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r2, 0xc0709411, &(0x7f0000000980)={{r6, 0xffffffffffff8000, 0x400, 0x9, 0xe4, 0x7, 0x4, 0x8, 0xb7, 0x1, 0x2de, 0x6, 0x3, 0x7, 0x776ecd6b}, 0x30, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f0000000a40)={0x0, 0x101000, 0x1}) r7 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r7, 0xc0205648, &(0x7f0000000b00)={0x980000, 0x3, 0xffff987d, r4, 0x0, &(0x7f0000000ac0)={0x600cd, 0x0, '\x00', @value64=0x9}}) 604.214562ms ago: executing program 5 (id=920): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) mkdir(&(0x7f00000001c0)='./bus\x00', 0x40) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x4000, &(0x7f0000000100)={[{@userxattr}, {@metacopy_on}]}) (async) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000100)={0xa, @raw_data="3aee44a9c226a51c91d96d057945493d62731d82b7b243ac2b8c09e616fac25ae19d22dde9f23f852c3c3ccc3a9bd805898c9b2332eefd90a8a3ec23a13d253cf99691b813d8bfe75bfd83c66b56546b67a6d49ef1aa41cd5fb1faa24fd3f04c0551ed1ce90da7f3c55d1722a954283520a13b98bbbda5d490614b0b944b44d09086680a995a0ef055c7b45c50f7096e53c69a5af5d8af27a799d80635b87bb98d78c265cc91f11d80f3215cb8e27902ded8695717e1bc25acbcb5f28d2e5cddcd7b000000009cae"}) mount(&(0x7f0000000040)=@sg0, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='udf\x00', 0x220ec87, 0x0) (async) syz_open_dev$cec(&(0x7f00000000c0), 0x0, 0x8000) syz_open_dev$tty1(0xc, 0x4, 0x1) 603.969016ms ago: executing program 5 (id=921): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r2 = socket$inet6(0xa, 0x1, 0x100) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x22, &(0x7f0000001680)=0x1, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000380)={@in6={{0xa, 0x4e24, 0x1, @loopback, 0x9}}, 0x0, 0x0, 0x32, 0x0, "aae37be4753f0a28060a80cdd60fe31d6ba25cec257a3a485a338d600a8402d23df4854ed4cf29109f0e30e8d115e434392db157494620680fffb8cb989ab0cfc17eb88225e0fb0a062dd7a81eb098d3"}, 0xd8) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x400000000a882, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r5, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x14) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x1, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, 0x0, 0x48968}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_macvtap\x00'}, @IFLA_VFINFO_LIST={0x1c, 0x16, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, [@IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x5}}]}]}]}, 0x50}}, 0x80000) sendmmsg$inet6(r3, &(0x7f0000000140)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0x2, @empty, 0xfe5}, 0x1c, &(0x7f0000000680)=[{&(0x7f0000000540)="922c", 0x2}], 0x1}}], 0x1, 0x200880d8) socket(0x10, 0x2, 0x0) splice(r2, 0x0, r1, 0x0, 0x7ffff000, 0x7) r7 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'dvmrp0\x00'}) r8 = fsmount(r7, 0x0, 0x0) r9 = openat$cgroup_int(r8, &(0x7f0000000080)='cgroup.max.depth\x00', 0x2, 0x0) sendfile(r0, r9, 0x0, 0x101) 544.28251ms ago: executing program 5 (id=922): openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x2040) dup2(0xffffffffffffffff, 0xffffffffffffffff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x15b) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) (async) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='./bus\x00', 0x149100, 0x80) getdents64(r0, 0x0, 0x0) mkdirat(r0, &(0x7f0000000080)='./file0\x00', 0x0) getdents64(r0, &(0x7f0000000f80)=""/4096, 0x1000) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000100)={0x1, 0x6}, 0x2) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fec000/0x14000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0}, 0x68) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0x1c79, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x1c, 0x21, 0x9, 0x70bd27, 0x25dfdbfc, {0x1}, [@typed={0x8, 0x8, 0x0, 0x0, @fd}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) r4 = syz_open_dev$ndb(&(0x7f0000000080), 0x0, 0x42) ioctl$BLKROTATIONAL(r4, 0x127e, &(0x7f00000000c0)) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) (async) write$USERIO_CMD_REGISTER(r1, &(0x7f00000000c0), 0x2) (async) write$USERIO_CMD_SEND_INTERRUPT(r1, &(0x7f0000000000)={0x2, 0x3}, 0x2) r5 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSSOFTCAR(r5, 0x5412, &(0x7f00000001c0)=0x11) syz_emit_vhci(&(0x7f00000000c0)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x8}, @hci_rp_le_read_def_data_len={{0x5}, {0xc, 0xc, 0xf}}}}, 0xb) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x802, 0x0) 492.678965ms ago: executing program 2 (id=925): r0 = socket$kcm(0x29, 0x7, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000001380)={0xffffffffffffffff}) sendmsg$nl_route_sched(r1, &(0x7f0000009c80)={0x0, 0x0, &(0x7f0000009c40)={0x0}, 0x1, 0x0, 0x0, 0x11}, 0x40884) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/kcm\x00') r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendto(r3, 0x0, 0x63, 0x4, 0x0, 0x0) preadv(r2, &(0x7f00000014c0)=[{&(0x7f0000000340)=""/191, 0x5f}], 0x1, 0x185, 0xffffffff) setfsuid(0x0) 414.563686ms ago: executing program 2 (id=926): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x80400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000004c0)={'pcl812\x00', [0x100, 0xf, 0xcd, 0x2, 0x1, 0x100, 0x4, 0x6d, 0x8, 0xb, 0x0, 0x7, 0x1, 0x401, 0x10001, 0x1, 0x200009, 0x8, 0xfe9, 0x401, 0x0, 0x2, 0x7, 0x9, 0x148, 0x9, 0x7, 0x6a77, 0x5, 0x0, 0x8]}) read(r0, &(0x7f0000000080)=""/116, 0x74) r1 = creat(0x0, 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) lsetxattr(&(0x7f0000000000)='./file2\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="6f73322e6f7665726c6171000611186844b7c6d8fb0ab13cb408c53fc61a52f6cdb62b898a6aa141f79feb27477c57e2b1190fe7282d0760a182f09166fce27b1d9bc32f55fa4cab6a2e6ed0ce6f8ee9e3c71c15b146ecca555c5cfba65af13b86ed16acbd9f2fe055f72f99fb78724a82443fb64a71413ba872fbb9bc53f7b5551bcfab7fc2a24bcb10"], &(0x7f00000001c0)='overlay\x00', 0x8, 0x0) socket$nl_route(0x10, 0x3, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0xffffffff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x66) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x8, 0x0, 0x0, 0x10}]}}, 0x0, 0x26}, 0x28) ioctl$KVM_RUN(r1, 0xae80, 0x0) mmap$snddsp_status(&(0x7f0000058000/0x1000)=nil, 0x1000, 0x2000001, 0x10, r1, 0x82000000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x187) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@uuid_off}, {@index_off}]}) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='./file1/file2/file0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./file0/file2\x00', 0x2) 413.917958ms ago: executing program 2 (id=927): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x400840, 0x0) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f00000008c0), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000200)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r2, 0x7a5, &(0x7f0000000180)={{@my=0x0}, 0x0, 0x1, 0x3}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r2, 0x7a5, &(0x7f00000000c0)={{@my=0x0, 0x7}, 0x1, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) acct(&(0x7f0000000040)='./file0\x00') r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x1, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000280)={0x2, @sliced={0x0, [0x0, 0x2, 0x6, 0x7, 0x0, 0x6, 0xfff8, 0x10, 0xfffd, 0x7, 0x90b, 0x3, 0x2, 0x7, 0x8, 0x6, 0x0, 0x2, 0x1, 0x5, 0x7, 0x3, 0x6000, 0x4, 0x5, 0x76c7, 0x9, 0x2, 0x9, 0x0, 0xc7e, 0x82, 0x8000, 0x4, 0x7, 0x7, 0x5, 0x400, 0x680, 0x800, 0x6, 0x8, 0x0, 0x7, 0x4, 0x1, 0x7ff, 0x7f], 0x1000}}) close_range(r0, r1, 0x2) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x121000, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r4, {0xffffffffffffffff}}, './file0\x00'}) r6 = openat$audio(0xffffffffffffff9c, &(0x7f0000000200), 0xa2442, 0x0) write$dsp(r6, &(0x7f00000004c0)='\x00', 0x1) ioctl$SNDCTL_DSP_SYNC(r6, 0x5001, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x94, 0x94, 0xa, [@union={0x1, 0x7, 0x0, 0x5, 0x0, 0x3, [{0xb, 0x3, 0x4}, {0x4, 0x4}, {0xd, 0x1, 0xfffffffd}, {0x0, 0x0, 0x679}, {0x1, 0x2, 0x8000}, {0x0, 0x1, 0x1}, {0x5, 0x2}]}, @enum64={0xd, 0x1, 0x0, 0x13, 0x1, 0x8, [{0x5, 0x2, 0x1}]}, @var={0x1, 0x0, 0x0, 0xe, 0x3, 0x1}, @func={0xb, 0x0, 0x0, 0xc, 0x2}]}, {0x0, [0x61, 0x30, 0x9d, 0x61, 0x5f, 0x0, 0x61, 0x61]}}, &(0x7f0000000100)=""/58, 0xb6, 0x3a, 0x1, 0x8, 0x10000, @value=r5}, 0x28) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_X86_SET_MCE(r5, 0x4040ae9e, &(0x7f0000000200)={0x0, 0xeeee8000, 0x8000000000000000, 0x8, 0x4}) 247.233648ms ago: executing program 2 (id=928): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x400000001fc, 0x181181) r2 = eventfd(0x6) dup3(r2, r1, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@newlink={0x5c, 0x10, 0x401, 0x0, 0xfffffffa, {0x0, 0x0, 0x0, 0x0, 0x4288}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @private1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x5c}}, 0x26040090) 246.752582ms ago: executing program 0 (id=929): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file3\x00', 0x105042, 0x0) mount(&(0x7f0000000280)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000300)='./file3\x00', &(0x7f0000000200)='f2fs\x00', 0x0, &(0x7f0000000380)='acl') fcntl$getflags(r0, 0x401) 246.277707ms ago: executing program 2 (id=930): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) r3 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="000022f0ffffffff00ffaaaaaaaaaabb88a8000081002002"], 0x3e) r4 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) r6 = openat$cgroup_int(r5, &(0x7f0000000080)='cgroup.max.descendants\x00', 0x2, 0x0) sendfile(r0, r6, 0x0, 0x101) 103.786975ms ago: executing program 0 (id=931): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0], 0x48) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) syz_usb_connect(0xe7af3cf0599a7105, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d1d7a440041601801f44010203010902120001000000000904"], 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000000), 0xdc2, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r2, 0xc0045520, &(0x7f0000000080)=0xffffbf7f) mmap$dsp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3, 0x4000010, r1, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x99, 0x101301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000380)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a0000000086d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f6853772b21a140efb76cba37ff3111d6847e8b9398a646717af75fc008daefba68e6222103472bc55704cdb737ae996ed831f3b802549db3a8ffff7d34171113d806726615380fe65a6a0a72e1ac2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be500e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef1d7ee686be0fc58e384f93a13f4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe363590d1f600"}) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r4, 0xffffffffffffffff, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0xd, 0x4, 0x4, 0xc, 0x0, r0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020205d0af8ff00000000bea100000000000007010000f8ffffffb702000008000000b7030000ffee0000850000007200000095"], 0x0, 0x5, 0x0, 0x0, 0x41000, 0x74, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0], 0x48) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) (async) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) (async) syz_usb_connect(0xe7af3cf0599a7105, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d1d7a440041601801f44010203010902120001000000000904"], 0x0) (async) syz_open_dev$sndctrl(&(0x7f0000000000), 0xdc2, 0x0) (async) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r2, 0xc0045520, &(0x7f0000000080)=0xffffbf7f) (async) mmap$dsp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3, 0x4000010, r1, 0x0) (async) syz_open_dev$usbfs(&(0x7f0000000100), 0x99, 0x101301) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000380)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a0000000086d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f6853772b21a140efb76cba37ff3111d6847e8b9398a646717af75fc008daefba68e6222103472bc55704cdb737ae996ed831f3b802549db3a8ffff7d34171113d806726615380fe65a6a0a72e1ac2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be500e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef1d7ee686be0fc58e384f93a13f4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe363590d1f600"}) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) (async) close_range(r4, 0xffffffffffffffff, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0xd, 0x4, 0x4, 0xc, 0x0, r0}, 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020205d0af8ff00000000bea100000000000007010000f8ffffffb702000008000000b7030000ffee0000850000007200000095"], 0x0, 0x5, 0x0, 0x0, 0x41000, 0x74, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) 103.537416ms ago: executing program 5 (id=932): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000280)={0x4000}, 0x10) rt_sigtimedwait(&(0x7f0000000080)={[0x9]}, &(0x7f00000000c0), &(0x7f0000000140), 0x8) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003640)={0x20, 0x12, 0xa01, 0x0, 0x0, {0x7c}, [@nested={0xc, 0x13d, 0x0, 0x1, [@nested={0x5, 0x12c, 0x0, 0x1, [@generic="93"]}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80000}, 0x0) r3 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x30004001) setsockopt$sock_attach_bpf(r3, 0x1, 0x31, &(0x7f0000000000), 0x4) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r4, &(0x7f00000001c0)={0x1d, r5}, 0x10) setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000040)=0x1, 0x4) sendmsg$can_raw(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@can={{0x3}, 0x3, 0x2, 0x0, 0x0, "ee0d702fac00008a"}, 0xfffffe84}, 0x1, 0x0, 0x0, 0x44801}, 0xd209f6d83486bb56) recvmmsg(r4, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}, 0x101}], 0x1, 0x2, 0x0) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0042, 0x0) read$snddsp(r6, &(0x7f0000000040)=""/10, 0xa) r7 = getpid() syz_pidfd_open(r7, 0x0) read$FUSE(r6, &(0x7f0000003680)={0x2020, 0x0, 0x0, 0x0}, 0x2020) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r10, 0x89a2, &(0x7f0000000000)='bridge0\x00') mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x8400, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r9, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRES32=r10, @ANYRESOCT=0x0, @ANYRESDEC=0x0]) read$FUSE(r9, &(0x7f0000006380)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) r13 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xa6c81, 0xc0) write$FUSE_ENTRY(r13, &(0x7f00000000c0)={0x90, 0x0, 0x0, {0x6, 0x0, 0x27c8, 0x415, 0xe25, 0x7f, {0x4, 0x5e2bf46f, 0x8, 0xbf6, 0x100000001, 0x3, 0x9, 0x6, 0x0, 0x8000, 0x0, r11, r12, 0x7e76f365, 0x5}}}, 0x90) setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000056c0)={r7, r8, r12}, 0xc) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=@newqdisc={0x3c, 0x24, 0xf0b, 0x0, 0x25dfdbfb, {0x60, 0x0, 0x0, r1, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_AUTORATE={0x8}]}}]}, 0x3c}}, 0x0) 103.179054ms ago: executing program 0 (id=933): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe8e, 0x0, 0x0, 0x0, 0x0, 0x4d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000200400001"], 0x48) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./my_configfs\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000b00)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/midi1_first_group\x00', 0xc0) write(r0, &(0x7f00000010c0)="7bfd1852", 0x4) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r3) lseek(r2, 0x0, 0x4) prlimit64(0x0, 0x7, &(0x7f0000000000), 0x0) memfd_create(&(0x7f0000000a40)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x06t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\x04n0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81\xbd\xd5\x00\x00C6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x1c\xd11\xfc\xa7\x93E\xff\xff\xd0\xac\b\x01\x10\xcc\xcd\x9a0\xd83\xb6\r\xbb\xe1u_KUd3l\x862\xa8I\xa7\x8f\xfb\xed\xdbn\xbd\xbe\xf0+a\xc8JC\x03:&9\xae\xb8\xd8TdMf[\x1c\n#\x87\xfc\x81O`\x19P\x142~|\xdf\xbc\xaf\xe4^\xac\xa5\xfbyy\xcb\f\x14}g\xa7\xc2\xe1\xa9\xdf\xbf\xdbV\x94:\xa6I\xa9\x15\x0f', 0x0) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000006c0)={0x54, r4, 0x1, 0x70bd2c, 0x1000, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}]}, 0x54}}, 0x4) 88.424555ms ago: executing program 2 (id=934): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) (async) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000840)={"96398d2fd9b43f86d912e46b79bc31220f8763754c201a0392a16210166895317c919effe306379c8bfc6deabd7ce27fdec0c16a77e7fd5f6f96a3e3a2c53ff467d7965124bed66f2d8df224e357d27c36b9b6df92a82b83fb54fcfa10c6a32d5f2e7fcdda12fac3c3518498e23bf6af290a0bda5a9a003cfceed707d0108f33d7c1ebe7d0adc55f36f0b756c05951bff0bb3e54ea276103ce9cb1ca20fdead019b2b1ea4c45fdb7b296d171fb1bea1c28759ef6cd0548b8f6c7e13743026fd78553a6c921e9109aecef7eeea9e2e8904d62e8af2a0eabb6fd0a638e9559ca96f85c7fc303f2992e75261d6f4dacb14180333080274fe22f47efb609802d3f0866ded623740181cc626e81157af8d758c8385e97998604ef132535aa1c2df0a88b3e01c0aa6b401329d757126da4ed7a1edc34b00f91613b57fff7024ca4706b4c79de16e8e1caa8624be0f02d2d76fa0f27f3a51556a00cd21ed0402a543fbc89a6f2636316f13ac1b98284f30efcfbe74c67a7c46549accfddf12fe25ccb9aa6d18a28e4c63c1a2a134786a646f3e7432cc1e477454d8839679a7a9da6c923622cc2ec748b2337fec8187b03c94721c1607ef7f305e718a004d01af6b23a0834c2cc8e6bf75b574786d1468baceaa70f58d444d97cffc3a7d9ffb54ca3a0500c6499018d07f3b9e82ee0ba7eb94ca949e4da9ab0c71edfff53e703adfafb5e2bfcac165fe483dc04620d18fb3f46741dc32ad9887dbc3fe53d47fac34b72156b7a4366bc717a7f3dafae82026fde89cbfbcf22bcb3768ba51c4a29984c4ec5334c9aee894b8256c45d85149688bef7ade6dbd483cadba1e87506a32b84e80d339c56cd5955dd7a1eb7894afd5b774f44ec1c3e847d1a83db24ca98ec893f798d854c4aadfc02d4a93dc7aeacc4dcaa5b683b0110e226acb1cdf6ea4ce53a5abeda7de6a34eb47b152c8c7dd26f2300dd180c5595a00e1e8cfbc22842a6f7a750402d5909edc8ab69249cb256ec6263123f9d26296b3358461e8da2561be0c269fa3fa4f29fdc36b35e2fbf0e9d62900c4ab98328ee0bc15599f800b8688a655bfbcf26e0ae7fd175d1c4e31e981623d3c9f27a1ca89d79a4e599501b6a16cbc7c38d4bc29817a92f642bf0dcacdbc07753296e7568287889a03e43dccd05d6e54bbfd21455e2ebb1c38b97d5498ecff863cdc13e6c7aca467b660542d69024d5830a4fd505973d0f6a8a809c03ddb0459133f0535d44f0a05462a577ed03038d45acc6aac491435a3336373dda045e55c2365bdc0e375ad4a03f14531d302924397e23e3da8b88f791be2418c2e04981b27f933d435a8799e66db6d2112baca6cf7c6f6b87dacfd80e7fb6373ea2def3b7e7f2bf539a98885b537f0f218608349d6782ed66855e6b8ea533e8490224ee2bdfb7e93f27169d4dd9cc66d8c1c5"}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000600)={0x2, 0x0, @ioapic={0xffff1000, 0x2, 0x9, 0xffffffff, 0x0, [{0x81, 0x1, 0x2, '\x00', 0xff}, {0x6, 0x3, 0x5, '\x00', 0xcf}, {0x1, 0x2, 0x91, '\x00', 0x6}, {0x4, 0xfd, 0x8, '\x00', 0x97}, {0x9, 0xb, 0x80, '\x00', 0x8}, {0xfa, 0x6, 0xf, '\x00', 0x6}, {0x7, 0x15, 0x4, '\x00', 0xcf}, {0x6, 0xd, 0xf, '\x00', 0x1}, {0x99, 0x9, 0x4, '\x00', 0xff}, {0x1, 0x81, 0xfb, '\x00', 0x9}, {0xd, 0xfd, 0x8, '\x00', 0x9}, {0x2, 0x5, 0x10, '\x00', 0x5}, {0xf, 0x6, 0x8, '\x00', 0x7f}, {0x9, 0x1, 0x8, '\x00', 0x8}, {0x81, 0x10, 0x4, '\x00', 0x3d}, {0x1, 0xe, 0x2, '\x00', 0x20}, {0x0, 0x0, 0x20, '\x00', 0x5}, {0x20, 0x40, 0x8, '\x00', 0xfc}, {0xb, 0x3, 0x5, '\x00', 0x4}, {0xf9, 0x5, 0x9, '\x00', 0x8}, {0x1, 0x6, 0x5, '\x00', 0xa}, {0x9, 0x5, 0x1, '\x00', 0x21}, {0x5, 0xec, 0xc0}, {0x6, 0x5, 0x0, '\x00', 0xb}]}}) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r6, 0x0) (async) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f00000001c0)={"f7c18106feff20528f054e75ce66af1f8cec1f3a622abf949a66d0f2bc39ffe23a43c89c9b7b56cadd87d141f60192308fef2a04294f9899c01e3d7ba1b52fe39c4dade4f47dd88ffb1d2bef4744b74c93c9e635dd1e6f1922530b90fe045627adfa3e8c5f097c667d565500808da08a8db9625b899d731f446efcb99bd940c8d45f88af33717b264ec81f01be2d054ef2fe5cc742f15f1b37f7498cbf21d8266a03009c34492e1372b85d6629814582ba03cc402bbd1ad83e6090a67b9ebe837cdd7a81cb309a2d4fb111827d8d91cc64081c3fca32f152260c6548890613178d928c8de28e5827e39aea1eede5d99981ff9c8d46c3b16e4d067d19e3142d8771c82cb9ed9794ece2140498a3f3afe9e04875da5350b382e0a8531c612c2e0ee60bf3bfe1218fa375328f7e5c39517053ab1a5340d956af5a0a1867a7380a0a094587d283598bc2f43db5c3004039704da2f4f046741b1920a931aca0a973e69e00bdd00d6668b6134bdc76b8bdf90cb9baa12e68a074e0ab70c9b82686795d3a353c0c04701603659a3948e8329ee1ef3995c9ef45a7b24a44638b1bbcae9397956067039972308abf7b17f5e9cc75dbbd85f8c3f618f17686596314841fc74e77487c6d05512cdbad146e8096ce8c5766dc52494ab50875d5da7c00ddcda731925933c02a9a3ddf80eff7d619b4c341eef2f8fce8cd5b482534bb3c4fd1879eae1566596a5de88da164877733dbc8582e4147149db0ba5ccbc0170f64ca31d8168d30701dd74e7fd42310e9ab7f494dc669d408caaf5b55ed9ed05cef279ffccf712c2d0a47c4692a187e69e0c8d5a2e1be36cf38b61604e700e080feb43032cea8f2f067c6ab1e6f1eff124fc9ffd2bd3b1ffbccfa031ce43e98afb79f344f81573da9bf6b52687cb1bfbab9b6084c643a655b9c0ad622a215dafe18153a2f9d1d8a46c8d4a3cf7634abcfd309425d7ecb3e8672b2948496507a1c4b10796f194ae4013f5c9547cb87d9f1b40fad80b1d3d21ae025959bd866af48c15ea2ecdf1510c4c57003d194d698aa052cbfa68d5a9c241f46d234280cae19af3f1ec7418b26412bfc4013a68b5d3c81d28c8a6aee412374439b481d47e02536b658a5d3af0c78aeca006c6e4d3ea4a1302e3af4565862616ffe5be51cac16fdc20cdcda534c6361f193f6400c8cb63688a89e995cb8f0df7995cbe743fb9396683a9ecf9baccd6325982b087fa3d32fe89579a8a9fb42a4e9a753718c802c405db00ac67d1d418a707035ac629ad10128f3df6ad49716006ec65c80e459f7c4c4c04ed437bebfe75efe13d865161a378863dc238e64fe62e1f54c0122d45542b9a7431a4ed8a4ef28c6e0600c08371657c9341047b385762008051183ad606a1149e2bdbdd74230e48a2fd4214fe1e6a34edb82a905556c77bb48341ff1555999c3"}) (async) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) (async) ioctl$sock_netdev_private(r0, 0x89f2, &(0x7f0000000000)) (async) r7 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$EXT4_IOC_MIGRATE(r7, 0x6609) 643.21µs ago: executing program 4 (id=935): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x80400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000004c0)={'pcl812\x00', [0x100, 0xf, 0xcd, 0x2, 0x1, 0x100, 0x4, 0x6d, 0x8, 0xb, 0x0, 0x7, 0x1, 0x401, 0x10001, 0x1, 0x200009, 0x8, 0xfe9, 0x401, 0x0, 0x2, 0x7, 0x9, 0x148, 0x9, 0x7, 0x6a77, 0x5, 0x0, 0x8]}) read(r0, &(0x7f0000000080)=""/116, 0x74) r1 = creat(0x0, 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) lsetxattr(&(0x7f0000000000)='./file2\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="6f73322e6f7665726c6171000611186844b7c6d8fb0ab13cb408c53fc61a52f6cdb62b898a6aa141f79feb27477c57e2b1190fe7282d0760a182f09166fce27b1d9bc32f55fa4cab6a2e6ed0ce6f8ee9e3c71c15b146ecca555c5cfba65af13b86ed16acbd9f2fe055f72f99fb78724a82443fb64a71413ba872fbb9bc53f7b5551bcfab7fc2a24bcb10"], &(0x7f00000001c0)='overlay\x00', 0x8, 0x0) socket$nl_route(0x10, 0x3, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0xffffffff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x66) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x8, 0x0, 0x0, 0x10}]}}, 0x0, 0x26}, 0x28) ioctl$KVM_RUN(r1, 0xae80, 0x0) mmap$snddsp_status(&(0x7f0000058000/0x1000)=nil, 0x1000, 0x2000001, 0x10, r1, 0x82000000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x187) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@uuid_off}, {@index_off}]}) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='./file1/file2/file0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./file0/file2\x00', 0x2) 0s ago: executing program 4 (id=936): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40ff"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r0 = socket(0x10, 0x3, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000380), 0x8001, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r1, 0x40186f40, &(0x7f0000000180)={0xffffffff, 0x0, 0xf3f, 0x1, '\x00', 0x10003}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) kernel console output (not intermixed with test programs): yzkaller0: entered promiscuous mode [ 71.629962][ T6382] syzkaller0: entered allmulticast mode [ 71.645803][ T6382] netlink: 'syz.0.156': attribute type 16 has an invalid length. [ 71.650998][ T6382] netlink: 'syz.0.156': attribute type 3 has an invalid length. [ 71.653848][ T6382] netlink: 132 bytes leftover after parsing attributes in process `syz.0.156'. [ 71.743065][ T6401] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6401 comm=syz.2.158 [ 71.749472][ T6401] netlink: 'syz.2.158': attribute type 1 has an invalid length. [ 71.967587][ T6407] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6407 comm=syz.2.158 [ 72.565214][ T6404] macvtap1: entered allmulticast mode [ 72.567912][ T5446] 8021q: adding VLAN 0 to HW filter on device eth4 [ 72.577478][ T6405] bond1: (slave bridge1): making interface the new active one [ 72.580474][ T6405] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 72.599593][ T6363] vhci_hcd: connection reset by peer [ 72.605284][ T5787] vhci_hcd vhci_hcd.1: stop threads [ 72.607884][ T5787] vhci_hcd vhci_hcd.1: release socket [ 72.610970][ T5787] vhci_hcd vhci_hcd.1: disconnect device [ 72.614433][ T5750] Bluetooth: hci0: command tx timeout [ 72.624558][ T6412] netlink: 16 bytes leftover after parsing attributes in process `syz.2.161'. [ 72.629999][ T6411] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 72.675667][ T6336] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 72.683796][ T6336] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.686615][ T6336] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 72.692649][ T6336] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.696557][ T6336] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 72.700324][ T6336] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.703746][ T6336] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 72.709078][ T6336] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.741500][ T13] IPVS: stop unused estimator thread 0... [ 72.756191][ T6336] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.770533][ T6336] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.776676][ T1166] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.779847][ T1166] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.789112][ T5446] 8021q: adding VLAN 0 to HW filter on device eth5 [ 72.796190][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.799201][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.015476][ T6336] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.153860][ T6336] veth0_vlan: entered promiscuous mode [ 73.160241][ T6336] veth1_vlan: entered promiscuous mode [ 73.161143][ T6453] IPVS: set_ctl: invalid protocol: 47 127.0.0.1:0 [ 73.165002][ T5750] Bluetooth: hci3: unexpected event for opcode 0x080d [ 73.177802][ T6336] veth0_macvtap: entered promiscuous mode [ 73.184290][ T6336] veth1_macvtap: entered promiscuous mode [ 73.193910][ T6336] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.199635][ T6336] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.207948][ T5787] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.210658][ T5787] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.213755][ T5787] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.216582][ T5787] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.608758][ T6459] netlink: 48 bytes leftover after parsing attributes in process `syz.1.166'. [ 73.623787][ T6461] evm: overlay not supported [ 73.629498][ T6458] comedi comedi2: comedi_config --init_data is deprecated [ 73.667435][ T1166] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.670838][ T1166] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.694436][ T81] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.696922][ T81] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.761226][ T6474] netlink: 12 bytes leftover after parsing attributes in process `syz.4.159'. [ 73.901317][ T6481] dlm: non-version read from control device 8224 [ 73.974393][ T4573] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 74.012226][ T6492] input: syz0 as /devices/virtual/input/input8 [ 74.115400][ T4573] usb 6-1: device descriptor read/64, error -71 [ 74.125444][ T6508] netlink: 12 bytes leftover after parsing attributes in process `syz.4.179'. [ 74.182813][ T6513] netlink: 'syz.4.181': attribute type 11 has an invalid length. [ 74.364277][ T4573] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 74.494262][ T4573] usb 6-1: device descriptor read/64, error -71 [ 74.511476][ T6543] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.518235][ T6543] bridge_slave_0 (unregistering): left allmulticast mode [ 74.531498][ T6543] bridge_slave_0 (unregistering): left promiscuous mode [ 74.534895][ T6543] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.607560][ T6555] netlink: 64 bytes leftover after parsing attributes in process `syz.2.187'. [ 74.616789][ T4573] usb usb6-port1: attempt power cycle [ 74.694463][ T5750] Bluetooth: hci0: command tx timeout [ 74.964638][ T4573] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 74.994821][ T4573] usb 6-1: device descriptor read/8, error -71 [ 75.254493][ T4573] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 75.274660][ T4573] usb 6-1: device descriptor read/8, error -71 [ 75.385895][ T4573] usb usb6-port1: unable to enumerate USB device [ 75.951465][ T42] kauditd_printk_skb: 88 callbacks suppressed [ 75.951478][ T42] audit: type=1400 audit(1784965228.291:480): avc: denied { read append } for pid=6597 comm="syz.2.194" name="ppp" dev="devtmpfs" ino=731 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 75.961046][ T42] audit: type=1400 audit(1784965228.291:481): avc: denied { open } for pid=6597 comm="syz.2.194" path="/dev/ppp" dev="devtmpfs" ino=731 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 76.016025][ T42] audit: type=1400 audit(1784965228.361:482): avc: denied { map } for pid=6604 comm="syz.2.196" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=14480 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 76.021156][ T6605] comedi comedi3: comedi_config --init_data is deprecated [ 76.023551][ T42] audit: type=1400 audit(1784965228.361:483): avc: denied { read write } for pid=6604 comm="syz.2.196" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=14480 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 76.033902][ T42] audit: type=1400 audit(1784965228.361:484): avc: denied { mmap_zero } for pid=6604 comm="syz.2.196" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 76.040463][ T42] audit: type=1400 audit(1784965228.381:485): avc: denied { unmount } for pid=5733 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 76.075279][ T42] audit: type=1400 audit(1784965228.421:486): avc: denied { map } for pid=6606 comm="syz.2.197" path="socket:[15584]" dev="sockfs" ino=15584 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 76.082314][ T42] audit: type=1400 audit(1784965228.421:487): avc: denied { read } for pid=6606 comm="syz.2.197" path="socket:[15584]" dev="sockfs" ino=15584 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 76.107588][ T42] audit: type=1400 audit(1784965228.451:488): avc: denied { write } for pid=6608 comm="syz.2.198" name="route" dev="proc" ino=4026533033 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 76.114535][ T42] audit: type=1400 audit(1784965228.451:489): avc: denied { setopt } for pid=6608 comm="syz.2.198" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 76.134262][ T5750] Bluetooth: hci2: command 0x0c1a tx timeout [ 76.138623][ T1047] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 76.140225][ T6614] hsr0: entered promiscuous mode [ 76.140804][ T1047] Bluetooth: hci2: Error when powering off device on rfkill (-110) [ 76.148269][ T6614] netlink: 4 bytes leftover after parsing attributes in process `syz.2.199'. [ 76.151173][ T6614] hsr_slave_0: left promiscuous mode [ 76.153452][ T6614] hsr_slave_1: left promiscuous mode [ 76.159134][ T6614] hsr0 (unregistering): left promiscuous mode [ 76.454442][ T34] usb 40-1: device descriptor read/8, error -110 [ 76.495252][ T6629] i2c i2c-0: new_device: Instantiated device stusb160x at 0x48 [ 76.505608][ T6629] i2c i2c-0: new_device: Instantiated device rt1719 at 0x49 [ 76.509369][ T6629] wusb3801 0-004a: supply vbus not found, using dummy regulator [ 76.525023][ T6629] i2c i2c-0: new_device: Instantiated device wusb3801 at 0x4a [ 76.784294][ T5750] Bluetooth: hci0: command tx timeout [ 76.823202][ T6651] netlink: 48 bytes leftover after parsing attributes in process `syz.2.209'. [ 76.826646][ T6651] netlink: 48 bytes leftover after parsing attributes in process `syz.2.209'. [ 76.829636][ T6651] netlink: 48 bytes leftover after parsing attributes in process `syz.2.209'. [ 76.832480][ T6651] netlink: 48 bytes leftover after parsing attributes in process `syz.2.209'. [ 76.835684][ T6651] netlink: 48 bytes leftover after parsing attributes in process `syz.2.209'. [ 76.839144][ T6651] netlink: 48 bytes leftover after parsing attributes in process `syz.2.209'. [ 76.842608][ T6651] netlink: 48 bytes leftover after parsing attributes in process `syz.2.209'. [ 76.847157][ T6651] netlink: 48 bytes leftover after parsing attributes in process `syz.2.209'. [ 76.850331][ T6651] netlink: 48 bytes leftover after parsing attributes in process `syz.2.209'. [ 76.866053][ T34] usb usb40-port1: attempt power cycle [ 76.876777][ T6647] program syz.1.208 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 77.028745][ T5750] Bluetooth: hci3: unexpected event for opcode 0x080d [ 77.435811][ T34] usb usb40-port1: unable to enumerate USB device [ 78.214343][ T5750] Bluetooth: hci1: command 0x0c1a tx timeout [ 78.214719][ T1047] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 78.219050][ T1047] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 78.854660][ T5750] Bluetooth: hci0: command tx timeout [ 80.294304][ T1047] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 80.294486][ T5750] Bluetooth: hci3: command 0x0c1a tx timeout [ 80.296641][ T1047] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 81.345233][ T848] cfg80211: failed to load regulatory.db [ 82.374520][ T5750] Bluetooth: hci0: command 0x0c1a tx timeout [ 82.378440][ T1047] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 82.381487][ T1047] Bluetooth: hci0: Error when powering off device on rfkill (-110) [ 82.471324][ T6681] __nla_validate_parse: 122 callbacks suppressed [ 82.471337][ T6681] netlink: 12 bytes leftover after parsing attributes in process `syz.4.215'. [ 82.540256][ T5815] bridge0: entered promiscuous mode [ 82.700797][ T6705] netlink: 12 bytes leftover after parsing attributes in process `syz.2.223'. [ 82.744381][ T5739] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 82.779385][ T6708] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8 sclass=netlink_route_socket pid=6708 comm=syz.4.222 [ 82.786058][ T6709] netlink: 12 bytes leftover after parsing attributes in process `syz.2.224'. [ 82.869618][ T42] kauditd_printk_skb: 10 callbacks suppressed [ 82.869636][ T42] audit: type=1400 audit(1784965235.211:500): avc: denied { connect } for pid=6710 comm="syz.2.225" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 82.918050][ T42] audit: type=1400 audit(1784965235.261:501): avc: denied { shutdown } for pid=6710 comm="syz.2.225" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 82.924297][ T5739] usb 6-1: Using ep0 maxpacket: 8 [ 82.930183][ T5739] usb 6-1: config index 0 descriptor too short (expected 74, got 45) [ 82.933631][ T5739] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 82.938414][ T5739] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 82.942660][ T5739] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 65535, setting to 1024 [ 82.947812][ T5739] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 82.952056][ T5739] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 82.957607][ T5739] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 82.961377][ T5739] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.984622][ T6714] comedi comedi2: comedi_test: 320 microvolt, 100000 microsecond waveform attached [ 83.045415][ T42] audit: type=1400 audit(1784965235.391:502): avc: denied { remount } for pid=6717 comm="syz.4.227" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 83.080404][ T6723] netlink: 'syz.4.228': attribute type 1 has an invalid length. [ 83.146027][ T6725] misc userio: Begin command sent, but we're already running [ 83.171791][ T5739] usb 6-1: GET_CAPABILITIES returned 0 [ 83.175090][ T5739] usbtmc 6-1:16.0: can't read capabilities [ 83.194555][ T6728] netlink: 12 bytes leftover after parsing attributes in process `syz.4.230'. [ 83.384143][ T6735] veth1_macvtap: left promiscuous mode [ 83.440760][ T6736] gfs2: error -5 reading superblock [ 83.525897][ T6749] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2584 sclass=netlink_route_socket pid=6749 comm=syz.1.217 [ 83.531320][ T6685] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2584 sclass=netlink_route_socket pid=6685 comm=syz.1.217 [ 83.531712][ T42] audit: type=1400 audit(1784965235.871:503): avc: denied { write } for pid=6745 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.547159][ T42] audit: type=1400 audit(1784965235.881:504): avc: denied { setopt } for pid=6684 comm="syz.1.217" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 83.572201][ T42] audit: type=1400 audit(1784965235.911:505): avc: denied { sqpoll } for pid=6753 comm="syz.0.236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 83.592441][ T42] audit: type=1400 audit(1784965235.931:506): avc: denied { accept } for pid=6684 comm="syz.1.217" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 83.604004][ T42] audit: type=1400 audit(1784965235.931:507): avc: denied { write } for pid=6756 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.617463][ T6758] netlink: 8 bytes leftover after parsing attributes in process `syz.4.237'. [ 83.618482][ T5815] usb 6-1: USB disconnect, device number 7 [ 83.624589][ T42] audit: type=1400 audit(1784965235.961:508): avc: denied { create } for pid=6757 comm="syz.4.237" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 83.653169][ T5446] veth1_macvtap: entered promiscuous mode [ 83.671749][ T6767] netlink: 12 bytes leftover after parsing attributes in process `syz.1.239'. [ 83.685992][ T42] audit: type=1400 audit(1784965236.021:509): avc: denied { bind } for pid=6757 comm="syz.4.237" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 83.740669][ T6773] netlink: 156 bytes leftover after parsing attributes in process `syz.2.240'. [ 83.766727][ T6768] IPv6: NLM_F_CREATE should be specified when creating new route [ 83.769905][ T6768] netlink: 12 bytes leftover after parsing attributes in process `syz.4.237'. [ 83.818758][ T6777] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 83.826759][ T6782] 9pnet_virtio: no channels available for device syz [ 83.841485][ T6782] 9pnet_virtio: no channels available for device syz [ 83.948185][ T6793] dlm: Unknown command passed to DLM device : 33 [ 83.948185][ T6793] [ 84.098700][ T6809] netlink: 8 bytes leftover after parsing attributes in process `syz.1.247'. [ 84.115353][ T6809] 8021q: adding VLAN 0 to HW filter on device bond1 [ 84.263755][ T6829] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 84.615856][ T6861] netlink: 128 bytes leftover after parsing attributes in process `syz.0.260'. [ 84.624017][ T6006] IPVS: starting estimator thread 0... [ 84.714318][ T6862] IPVS: using max 28 ests per chain, 67200 per kthread [ 84.762573][ T6872] tmpfs: Bad value for 'mpol' [ 84.820537][ T4573] hid-generic 0006:0008:0008.0003: unknown main item tag 0x0 [ 84.823450][ T4573] hid-generic 0006:0008:0008.0003: unknown main item tag 0x0 [ 84.824879][ T6878] xt_limit: Overflow, try lower: 271964/0 [ 84.826241][ T4573] hid-generic 0006:0008:0008.0003: unknown main item tag 0x0 [ 84.830842][ T4573] hid-generic 0006:0008:0008.0003: unknown main item tag 0x0 [ 84.833415][ T4573] hid-generic 0006:0008:0008.0003: unknown main item tag 0x0 [ 84.837106][ T4573] hid-generic 0006:0008:0008.0003: unknown main item tag 0x0 [ 84.839521][ T4573] hid-generic 0006:0008:0008.0003: unknown main item tag 0x0 [ 84.841895][ T4573] hid-generic 0006:0008:0008.0003: unknown main item tag 0x0 [ 84.845174][ T4573] hid-generic 0006:0008:0008.0003: unknown main item tag 0x0 [ 84.847680][ T4573] hid-generic 0006:0008:0008.0003: unknown main item tag 0x0 [ 84.854937][ T4573] hid-generic 0006:0008:0008.0003: hidraw1: VIRTUAL HID v0.04 Device [syz1] on syz1 [ 84.884256][ T848] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 84.920153][ T6883] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 84.924386][ T6883] block device autoloading is deprecated and will be removed. [ 84.987387][ T6892] program syz.1.268 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 85.035970][ T848] usb 5-1: Using ep0 maxpacket: 8 [ 85.049110][ T848] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 85.055110][ T848] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 85.060712][ T848] usb 5-1: config 0 interface 0 has no altsetting 0 [ 85.063520][ T848] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 85.068167][ T848] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.076298][ T848] usb 5-1: config 0 descriptor?? [ 85.242558][ T6905] cgroup: name respecified [ 85.352210][ T6926] 9pnet_virtio: no channels available for device syz [ 85.357438][ T6924] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 85.359659][ T6924] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 85.362518][ T6924] vhci_hcd vhci_hcd.0: Device attached [ 85.382322][ T6921] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 85.418103][ T6933] netlink: 'syz.2.277': attribute type 14 has an invalid length. [ 85.425818][ T6933] vhci_hcd vhci_hcd.0: port 0 already used [ 85.479072][ T6937] bond2: entered promiscuous mode [ 85.498799][ T848] mcp2221 0003:04D8:00DD.0004: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 85.564013][ T6946] Bluetooth: MGMT ver 1.23 [ 85.634714][ T34] usb 42-1: SetAddress Request (2) to port 0 [ 85.637248][ T34] usb 42-1: new SuperSpeed USB device number 2 using vhci_hcd [ 85.697734][ T6864] IPv6: NLM_F_REPLACE set, but no existing node found! [ 85.712864][ T6954] hugetlbfs: Bad value 'x' for mount option 'size' [ 85.712864][ T6954] [ 85.806866][ T848] usb 5-1: USB disconnect, device number 4 [ 85.896428][ T5829] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 86.009794][ T6970] dummy0: left promiscuous mode [ 86.011449][ T6970] dummy0: entered allmulticast mode [ 86.024259][ T5829] usb 9-1: device descriptor read/64, error -71 [ 86.179010][ T6927] vhci_hcd: connection reset by peer [ 86.182498][ T13] vhci_hcd vhci_hcd.2: stop threads [ 86.184347][ T13] vhci_hcd vhci_hcd.2: release socket [ 86.187412][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 86.284240][ T5829] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 86.424376][ T5829] usb 9-1: device descriptor read/64, error -71 [ 86.534936][ T5829] usb usb9-port1: attempt power cycle [ 86.715412][ T6990] syz.2.297 uses obsolete (PF_INET,SOCK_PACKET) [ 86.719946][ T6990] x_tables: duplicate underflow at hook 2 [ 86.867748][ T7008] netlink: 'syz.1.301': attribute type 11 has an invalid length. [ 86.884330][ T5829] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 86.914741][ T5829] usb 9-1: device descriptor read/8, error -71 [ 86.933948][ T7017] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7017 comm=syz.0.303 [ 86.939138][ T7017] xt_HMARK: spi-set and port-set can't be combined [ 87.174236][ T5829] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 87.205028][ T5829] usb 9-1: device descriptor read/8, error -71 [ 87.254340][ T5815] usb 5-1: new low-speed USB device number 5 using dummy_hcd [ 87.324441][ T5829] usb usb9-port1: unable to enumerate USB device [ 87.367235][ T7037] sctp: [Deprecated]: syz.2.308 (pid 7037) Use of struct sctp_assoc_value in delayed_ack socket option. [ 87.367235][ T7037] Use struct sctp_sack_info instead [ 87.404216][ T5815] usb 5-1: Invalid ep0 maxpacket: 32 [ 87.544226][ T5815] usb 5-1: new low-speed USB device number 6 using dummy_hcd [ 87.704447][ T5815] usb 5-1: Invalid ep0 maxpacket: 32 [ 87.707635][ T5815] usb usb5-port1: attempt power cycle [ 87.996905][ T42] kauditd_printk_skb: 48 callbacks suppressed [ 87.996916][ T42] audit: type=1400 audit(1784965240.341:558): avc: denied { ioctl } for pid=7054 comm="syz.1.313" path="socket:[15170]" dev="sockfs" ino=15170 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 88.054258][ T5815] usb 5-1: new low-speed USB device number 7 using dummy_hcd [ 88.060506][ T42] audit: type=1400 audit(1784965240.401:559): avc: denied { create } for pid=7056 comm="syz.1.314" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 88.084750][ T5815] usb 5-1: Invalid ep0 maxpacket: 32 [ 88.101884][ T7062] xt_hashlimit: size too large, truncated to 1048576 [ 88.224546][ T5815] usb 5-1: new low-speed USB device number 8 using dummy_hcd [ 88.244897][ T5815] usb 5-1: Invalid ep0 maxpacket: 32 [ 88.248180][ T5815] usb usb5-port1: unable to enumerate USB device [ 88.253090][ T42] audit: type=1400 audit(1784965240.591:560): avc: denied { write } for pid=7068 comm="syz.1.317" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 88.308840][ T7077] __nla_validate_parse: 9 callbacks suppressed [ 88.308873][ T7077] netlink: 20 bytes leftover after parsing attributes in process `syz.1.319'. [ 88.352516][ T7080] netlink: 12 bytes leftover after parsing attributes in process `syz.1.320'. [ 88.401397][ T42] audit: type=1400 audit(1784965240.741:561): avc: denied { accept } for pid=7081 comm="syz.1.321" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 88.404807][ T7082] 9pnet_virtio: no channels available for device syz [ 88.535731][ T7092] netlink: 8 bytes leftover after parsing attributes in process `syz.2.324'. [ 88.538601][ T7092] netlink: 'syz.2.324': attribute type 30 has an invalid length. [ 88.541030][ T7092] netlink: 4 bytes leftover after parsing attributes in process `syz.2.324'. [ 88.545874][ T7092] netlink: 8 bytes leftover after parsing attributes in process `syz.2.324'. [ 88.548654][ T7092] netlink: 'syz.2.324': attribute type 30 has an invalid length. [ 88.551050][ T7092] netlink: 4 bytes leftover after parsing attributes in process `syz.2.324'. [ 88.655369][ T7101] netlink: 4 bytes leftover after parsing attributes in process `syz.2.327'. [ 88.672216][ T42] audit: type=1400 audit(1784965241.011:562): avc: denied { unmount } for pid=5733 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 88.691610][ T7108] netlink: 12 bytes leftover after parsing attributes in process `syz.4.330'. [ 88.729074][ T42] audit: type=1400 audit(1784965241.071:563): avc: denied { getattr } for pid=7113 comm="syz.2.331" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=18618 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 88.774443][ T42] audit: type=1400 audit(1784965241.111:564): avc: denied { mmap_zero } for pid=7118 comm="syz.4.334" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 88.787346][ T42] audit: type=1400 audit(1784965241.121:565): avc: denied { read } for pid=7118 comm="syz.4.334" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 88.795831][ T7123] overlayfs: conflicting options: nfs_export=on,index=off [ 88.805454][ T5523] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 88.867391][ T7136] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 88.979200][ T7141] netlink: 12 bytes leftover after parsing attributes in process `syz.4.341'. [ 88.985050][ T5523] usb 6-1: Using ep0 maxpacket: 16 [ 88.993918][ T5523] usb 6-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 89.000388][ T5523] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.003538][ T5523] usb 6-1: Product: syz [ 89.008225][ T5523] usb 6-1: Manufacturer: syz [ 89.011784][ T5523] usb 6-1: SerialNumber: syz [ 89.020498][ T5523] usb 6-1: config 0 descriptor?? [ 89.239406][ T5523] dvb_usb_dtv5100 6-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -71 [ 89.248419][ T5523] usb 6-1: USB disconnect, device number 8 [ 89.296820][ T42] audit: type=1400 audit(1784965241.641:566): avc: denied { connect } for pid=7161 comm="syz.1.346" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 89.302857][ T42] audit: type=1400 audit(1784965241.641:567): avc: denied { write } for pid=7161 comm="syz.1.346" laddr=fe80::dc0b:17ff:fe3b:f58a lport=16021 faddr=ff02::1 fport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 89.612787][ T7165] use of bytesused == 0 is deprecated and will be removed in the future, [ 89.617922][ T7165] use the actual size instead. [ 89.895751][ T7184] comedi comedi4: bad chanlist[0]=0x0000ffff chan=65535 range length=2 [ 89.943085][ T7187] netlink: 12 bytes leftover after parsing attributes in process `syz.2.355'. [ 90.020565][ T7192] netlink: 'syz.2.356': attribute type 1 has an invalid length. [ 90.035528][ T7192] 8021q: adding VLAN 0 to HW filter on device bond2 [ 90.046904][ T7192] bond2: (slave geneve2): making interface the new active one [ 90.049941][ T7192] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 90.052737][ T5787] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 90.057014][ T5787] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 90.059881][ T5787] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 90.062844][ T5787] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 90.223891][ T7225] vcan1: entered allmulticast mode [ 90.305897][ T7239] netlink: 'syz.2.367': attribute type 1 has an invalid length. [ 90.332574][ T7239] bond3: entered promiscuous mode [ 90.334509][ T7239] 8021q: adding VLAN 0 to HW filter on device bond3 [ 90.344702][ T7239] bond3: entered allmulticast mode [ 90.356838][ T7239] bond3: (slave bridge3): making interface the new active one [ 90.359196][ T7239] bridge3: entered promiscuous mode [ 90.360978][ T7239] bridge3: entered allmulticast mode [ 90.363817][ T7239] bond3: (slave bridge3): Enslaving as an active interface with an up link [ 90.401125][ T7243] nfs: Unknown parameter '$-' [ 90.433106][ T7251] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 90.435135][ T7253] netlink: 'syz.0.373': attribute type 1 has an invalid length. [ 90.469255][ T7262] openvswitch: netlink: Flow key attr not present in new flow. [ 90.647453][ T7284] bond3: Removing last ns target with arp_interval on [ 90.678463][ T7292] FAULT_INJECTION: forcing a failure. [ 90.678463][ T7292] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 90.679229][ T7291] input: syz0 as /devices/virtual/input/input11 [ 90.682574][ T7292] CPU: 1 UID: 0 PID: 7292 Comm: syz.4.385 Tainted: G L syzkaller #0 PREEMPT(full) [ 90.682591][ T7292] Tainted: [L]=SOFTLOCKUP [ 90.682594][ T7292] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 90.682600][ T7292] Call Trace: [ 90.682604][ T7292] [ 90.682609][ T7292] dump_stack_lvl+0x100/0x190 [ 90.682635][ T7292] should_fail_ex.cold+0x5/0xa [ 90.682649][ T7292] _copy_from_user+0x2e/0xd0 [ 90.682667][ T7292] copy_msghdr_from_user+0x9f/0x4c0 [ 90.682689][ T7292] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 90.682707][ T7292] ? __pfx__kstrtoull+0x10/0x10 [ 90.682720][ T7292] ___sys_sendmsg+0x106/0x1e0 [ 90.682737][ T7292] ? __pfx____sys_sendmsg+0x10/0x10 [ 90.682759][ T7292] ? find_held_lock+0x2b/0x80 [ 90.682787][ T7292] __sys_sendmmsg+0x20c/0x440 [ 90.682801][ T7292] ? __pfx___sys_sendmmsg+0x10/0x10 [ 90.682813][ T7292] ? ksys_write+0x190/0x250 [ 90.682838][ T7292] ? fput+0x79/0x100 [ 90.682851][ T7292] ? ksys_write+0x1ac/0x250 [ 90.682866][ T7292] ? __pfx_ksys_write+0x10/0x10 [ 90.682884][ T7292] __x64_sys_sendmmsg+0x9c/0x100 [ 90.682897][ T7292] ? lockdep_hardirqs_on+0x78/0x100 [ 90.682908][ T7292] do_syscall_64+0x115/0x870 [ 90.682919][ T7292] ? clear_bhb_loop+0x40/0x90 [ 90.682932][ T7292] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.682961][ T7292] RIP: 0033:0x7f6a0639de99 [ 90.682971][ T7292] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.682980][ T7292] RSP: 002b:00007f6a045f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 90.682991][ T7292] RAX: ffffffffffffffda RBX: 00007f6a06625fa0 RCX: 00007f6a0639de99 [ 90.682997][ T7292] RDX: 0000000000000002 RSI: 0000200000001180 RDI: 0000000000000005 [ 90.683003][ T7292] RBP: 00007f6a045f6090 R08: 0000000000000000 R09: 0000000000000000 [ 90.683009][ T7292] R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000001 [ 90.683015][ T7292] R13: 00007f6a06626038 R14: 00007f6a06625fa0 R15: 00007ffd26a2ebb8 [ 90.683028][ T7292] [ 90.695539][ T34] usb 42-1: device descriptor read/8, error -110 [ 90.740605][ T7296] overlayfs: missing 'lowerdir' [ 90.924347][ T5815] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 90.964281][ T5739] usb 6-1: new low-speed USB device number 9 using dummy_hcd [ 91.086253][ T5815] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 91.089598][ T5815] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 91.092712][ T5815] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 91.096199][ T5815] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.104094][ T7276] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 91.109723][ T5815] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 91.128867][ T34] usb usb42-port1: attempt power cycle [ 91.136105][ T5739] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 91.139220][ T5739] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 91.141988][ T5739] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 91.145789][ T5739] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 91.148580][ T5739] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.193239][ T7291] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 91.207630][ T5739] hub 6-1:1.0: bad descriptor, ignoring hub [ 91.209735][ T5739] hub 6-1:1.0: probe with driver hub failed with error -5 [ 91.213330][ T5739] cdc_wdm 6-1:1.0: skipping garbage [ 91.215250][ T5739] cdc_wdm 6-1:1.0: skipping garbage [ 91.220387][ T5739] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 91.222914][ T5739] cdc_wdm 6-1:1.0: Unknown control protocol [ 91.308383][ T7276] libceph: resolve '0' (ret=-3): failed [ 91.423488][ T7380] netlink: 'syz.4.405': attribute type 1 has an invalid length. [ 91.528083][ T7394] dlm: no local IP address has been set [ 91.534717][ T7394] dlm: cannot start dlm midcomms -107 [ 91.685264][ T34] usb usb42-port1: unable to enumerate USB device [ 91.765459][ T7422] block nbd0: shutting down sockets [ 91.947883][ T7291] usb 6-1: reset low-speed USB device number 9 using dummy_hcd [ 92.238271][ T7387] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 92.248179][ C3] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 92.250325][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 92.252752][ C3] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 92.254830][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 92.256728][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -1 [ 92.357748][ C3] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 92.359889][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 92.362413][ C3] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 92.365010][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 92.367534][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -1 [ 92.530240][ T7435] netlink: 'syz.4.415': attribute type 1 has an invalid length. [ 92.537257][ T34] usb 6-1: USB disconnect, device number 9 [ 92.551962][ T7435] 8021q: adding VLAN 0 to HW filter on device bond3 [ 92.558271][ T7435] bond3: entered allmulticast mode [ 92.965779][ T34] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 93.010250][ T7456] netlink: 'syz.4.422': attribute type 39 has an invalid length. [ 93.082710][ T7458] xt_connbytes: Forcing CT accounting to be enabled [ 93.120278][ T34] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 93.124604][ T34] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 93.128435][ T34] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 93.133666][ T34] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 93.136801][ T34] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.141224][ T34] usb 5-1: config 0 descriptor?? [ 93.146364][ T42] kauditd_printk_skb: 35 callbacks suppressed [ 93.146374][ T42] audit: type=1400 audit(1784965245.491:603): avc: denied { read } for pid=7461 comm="syz.1.425" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 93.157134][ T42] audit: type=1400 audit(1784965245.491:604): avc: denied { open } for pid=7461 comm="syz.1.425" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 93.258471][ T42] audit: type=1400 audit(1784965245.601:605): avc: denied { read append } for pid=7472 comm="syz.4.428" name="fb0" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 93.266114][ T42] audit: type=1400 audit(1784965245.601:606): avc: denied { open } for pid=7472 comm="syz.4.428" path="/dev/fb0" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 93.290000][ T5787] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 93.292876][ T5787] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 93.297299][ T5787] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 93.300242][ T5787] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 93.303161][ T42] audit: type=1400 audit(1784965245.641:607): avc: denied { map } for pid=7472 comm="syz.4.428" path="/dev/fb0" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 93.310786][ T42] audit: type=1400 audit(1784965245.641:608): avc: denied { write execute } for pid=7472 comm="syz.4.428" path="/dev/fb0" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 93.354085][ T34] usbhid 5-1:0.0: can't add hid device: -71 [ 93.360539][ T34] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 93.369946][ T34] usb 5-1: USB disconnect, device number 9 [ 93.434408][ T42] audit: type=1400 audit(1784965245.771:609): avc: denied { read } for pid=7479 comm="syz.0.430" name="btrfs-control" dev="devtmpfs" ino=1341 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 93.437614][ T7488] openvswitch: netlink: Multiple metadata blocks provided [ 93.442293][ T42] audit: type=1400 audit(1784965245.781:610): avc: denied { open } for pid=7479 comm="syz.0.430" path="/dev/btrfs-control" dev="devtmpfs" ino=1341 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 93.458894][ T7489] SELinux: ebitmap: empty map [ 93.464419][ T42] audit: type=1400 audit(1784965245.791:611): avc: denied { load_policy } for pid=7475 comm="syz.4.429" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 93.475712][ T42] audit: type=1400 audit(1784965245.801:612): avc: denied { accept } for pid=7487 comm="syz.1.432" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 93.479731][ T7489] SELinux: failed to load policy [ 93.590791][ T7506] __nla_validate_parse: 18 callbacks suppressed [ 93.590803][ T7506] netlink: 8 bytes leftover after parsing attributes in process `syz.0.434'. [ 93.620981][ T34] usb 7-1: USB disconnect, device number 2 [ 93.692686][ T7515] netlink: 288 bytes leftover after parsing attributes in process `syz.2.439'. [ 93.694236][ T7518] netlink: 12 bytes leftover after parsing attributes in process `syz.0.440'. [ 93.763393][ T7522] netlink: 12 bytes leftover after parsing attributes in process `syz.2.441'. [ 93.846131][ T7549] 9pnet_virtio: no channels available for device syz [ 93.847489][ T7547] loop2: detected capacity change from 0 to 7 [ 93.849270][ T7549] trusted_key: encrypted_key: master key parameter is missing [ 93.860905][ T7547] Dev loop2: unable to read RDB block 7 [ 93.862511][ T7547] loop2: AHDI p1 p2 p3 [ 93.863717][ T7547] loop2: partition table partially beyond EOD, truncated [ 93.869412][ T7547] loop2: p1 start 1601398130 is beyond EOD, truncated [ 93.871647][ T7547] loop2: p2 start 1702059890 is beyond EOD, truncated [ 93.892477][ T7552] netlink: 'syz.2.448': attribute type 7 has an invalid length. [ 93.901756][ T7554] netlink: 12 bytes leftover after parsing attributes in process `syz.1.449'. [ 94.040303][ T7559] x_tables: duplicate underflow at hook 3 [ 94.081505][ T7570] netlink: 8 bytes leftover after parsing attributes in process `syz.0.456'. [ 94.084585][ T7570] netlink: 24 bytes leftover after parsing attributes in process `syz.0.456'. [ 94.232050][ T7590] Bluetooth: MGMT ver 1.23 [ 94.277245][ T7603] erspan0: entered promiscuous mode [ 94.304369][ T7605] netlink: 16 bytes leftover after parsing attributes in process `syz.0.465'. [ 94.309573][ T7605] xt_CONNSECMARK: invalid mode: 0 [ 94.396129][ T7612] hub 4-0:1.0: USB hub found [ 94.398570][ T7612] hub 4-0:1.0: 2 ports detected [ 94.474602][ T7620] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 94.641250][ T7634] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 94.672544][ T7636] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 94.850373][ T7639] autofs4:pid:7639:validate_dev_ioctl: path string terminator missing for cmd(0xc0189371) [ 94.972168][ T7651] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7651 comm=syz.1.479 [ 95.000526][ T7657] trusted_key: encrypted_key: keylen parameter is missing [ 95.005228][ T7657] netlink: 28 bytes leftover after parsing attributes in process `syz.1.480'. [ 95.045863][ T7664] F2FS-fs: Conflicting test_dummy_encryption options [ 95.111095][ T7670] Invalid argument reading file caps for ./file0 [ 95.191429][ T7679] loop4: detected capacity change from 0 to 2640 [ 95.193623][ T7679] buffer_io_error: 8 callbacks suppressed [ 95.193631][ T7679] Buffer I/O error on dev loop4, logical block 0, async page read [ 95.197752][ T7679] Buffer I/O error on dev loop4, logical block 0, async page read [ 95.201037][ T7679] Buffer I/O error on dev loop4, logical block 0, async page read [ 95.203387][ T7679] Buffer I/O error on dev loop4, logical block 0, async page read [ 95.205825][ T7679] Buffer I/O error on dev loop4, logical block 0, async page read [ 95.208079][ T7679] Buffer I/O error on dev loop4, logical block 0, async page read [ 95.210346][ T7679] Buffer I/O error on dev loop4, logical block 0, async page read [ 95.212671][ T7679] Buffer I/O error on dev loop4, logical block 0, async page read [ 95.215132][ T7679] ldm_validate_partition_table(): Disk read failed. [ 95.217159][ T7679] Buffer I/O error on dev loop4, logical block 0, async page read [ 95.219568][ T7679] Buffer I/O error on dev loop4, logical block 0, async page read [ 95.221936][ T7679] Dev loop4: unable to read RDB block 0 [ 95.223740][ T7679] loop4: unable to read partition table [ 95.225626][ T7679] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 95.262423][ T5144] ldm_validate_partition_table(): Disk read failed. [ 95.264991][ T7672] nbd0: detected capacity change from 0 to 63 [ 95.265569][ T5144] Dev loop4: unable to read RDB block 0 [ 95.269131][ T5144] loop4: unable to read partition table [ 95.271988][ T65] block nbd0: Receive control failed (result -32) [ 95.279690][ T5105] block nbd0: Dead connection, failed to find a fallback [ 95.283621][ T5105] block nbd0: shutting down sockets [ 95.286727][ T5105] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 95.290839][ T5105] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 95.295736][ T1311] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 95.296049][ T5144] ldm_validate_partition_table(): Disk read failed. [ 95.300653][ T1311] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 95.300982][ T5144] Dev loop4: unable to read RDB block 0 [ 95.303874][ T1311] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 95.308164][ T5144] loop4: unable to read partition table [ 95.309645][ T1311] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 95.313408][ T1311] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 95.316681][ T1311] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 95.323137][ T1311] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 95.326299][ T1311] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 95.331380][ T6771] ldm_validate_partition_table(): Disk read failed. [ 95.335826][ T6771] Dev nbd0: unable to read RDB block 0 [ 95.340356][ T6771] nbd0: unable to read partition table [ 95.352370][ T6771] ldm_validate_partition_table(): Disk read failed. [ 95.359962][ T6771] Dev nbd0: unable to read RDB block 0 [ 95.365286][ T6771] nbd0: unable to read partition table [ 95.370511][ T7688] netlink: 12 bytes leftover after parsing attributes in process `syz.4.490'. [ 95.388494][ T7688] 8021q: adding VLAN 0 to HW filter on device bond4 [ 95.446318][ T5739] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 95.595774][ T5739] usb 5-1: Using ep0 maxpacket: 8 [ 95.604289][ T5523] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 95.605793][ T5739] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 95.610050][ T5739] usb 5-1: config 179 has no interface number 0 [ 95.612238][ T5739] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 95.616518][ T5739] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 95.620787][ T5739] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 95.630406][ T5739] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 95.634452][ T5739] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 95.638885][ T5739] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 95.641857][ T5739] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.650801][ T7681] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 95.754243][ T5523] usb 6-1: Using ep0 maxpacket: 8 [ 95.757683][ T5523] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 95.761048][ T5523] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 95.764443][ T5523] usb 6-1: config 0 interface 0 has no altsetting 0 [ 95.766462][ T5523] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 95.769254][ T5523] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.773255][ T5523] usb 6-1: config 0 descriptor?? [ 95.911674][ T5739] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:179.65/input/input12 [ 96.096531][ T9] usb 5-1: USB disconnect, device number 10 [ 96.098382][ C0] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 96.098407][ C0] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 96.192611][ T5523] hid_parser_main: 12 callbacks suppressed [ 96.192625][ T5523] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 96.197237][ T5523] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 96.199453][ T5523] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 96.201644][ T5523] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 96.203746][ T5523] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 96.208074][ T5523] mcp2221 0003:04D8:00DD.0005: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 96.526390][ T5739] usb 6-1: USB disconnect, device number 10 [ 96.743770][ T7717] 9pnet_fd: p9_fd_create_unix (7717): address too long: ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 96.788129][ T7720] kAFS: unable to lookup cell 'syz0' [ 96.853908][ T7735] overlayfs: missing 'workdir' [ 96.903825][ T7737] netlink: 'syz.2.505': attribute type 2 has an invalid length. [ 96.906350][ T7737] netlink: 'syz.2.505': attribute type 2 has an invalid length. [ 96.977011][ T7749] cgroup: Unknown subsys name 'cpuset' [ 97.046429][ T7749] block nbd2: shutting down sockets [ 97.077034][ T7757] qnx6: unable to read the first superblock [ 97.081172][ T7757] qnx6: unable to read the first superblock [ 97.083063][ T7757] qnx6: unable to read the first superblock [ 97.170615][ T7766] kvm: kvm [7764]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 97.173772][ T7766] kvm: kvm [7764]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 97.195054][ T7779] ieee802154 phy0 wpan0: encryption failed: -22 [ 97.427115][ T7787] loop4: detected capacity change from 0 to 2640 [ 97.431584][ T7787] ldm_validate_partition_table(): Disk read failed. [ 97.434269][ T7787] Dev loop4: unable to read RDB block 0 [ 97.436619][ T7787] loop4: unable to read partition table [ 97.439033][ T7787] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 97.951779][ T7834] 9pnet_virtio: no channels available for device syz [ 98.234257][ T5815] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 98.279965][ T7845] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 98.282628][ T7845] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 98.290416][ T7845] vhci_hcd vhci_hcd.0: Device attached [ 98.312197][ T7847] vhci_hcd: connection closed [ 98.319562][ T13] vhci_hcd vhci_hcd.0: stop threads [ 98.324250][ T13] vhci_hcd vhci_hcd.0: release socket [ 98.326691][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 98.346759][ T7852] netlink: 'syz.0.540': attribute type 1 has an invalid length. [ 98.358103][ T7852] bond5: entered promiscuous mode [ 98.360219][ T7852] 8021q: adding VLAN 0 to HW filter on device bond5 [ 98.375660][ T7855] ptrace attach of "/syz-executor exec"[5733] was attempted by "/syz-executor exec"[7855] [ 98.385942][ T7852] 8021q: adding VLAN 0 to HW filter on device bond5 [ 98.388224][ T7852] bond5: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 98.391368][ T7852] bond5: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 98.398743][ T7852] bond5: (slave ip6gre1): making interface the new active one [ 98.401105][ T7852] ip6gre1: entered promiscuous mode [ 98.403868][ T7852] bond5: (slave ip6gre1): Enslaving as an active interface with an up link [ 98.404287][ T5815] usb 6-1: Using ep0 maxpacket: 32 [ 98.410366][ T5815] usb 6-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 98.415498][ T5815] usb 6-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 98.419860][ T5815] usb 6-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 98.423449][ T5815] usb 6-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 98.429510][ T5815] usb 6-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 98.433110][ T5815] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.435743][ T5815] usb 6-1: Product: syz [ 98.437056][ T5815] usb 6-1: Manufacturer: syz [ 98.437611][ T7857] 9p: Bad value for 'rfdno' [ 98.438497][ T5815] usb 6-1: SerialNumber: syz [ 98.446479][ C2] imon 6-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 98.455584][ T5815] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:155.0/input/input13 [ 98.626805][ T42] kauditd_printk_skb: 33 callbacks suppressed [ 98.626861][ T42] audit: type=1400 audit(1784965250.971:646): avc: denied { create } for pid=7866 comm="syz.0.546" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 98.638227][ T42] audit: type=1400 audit(1784965250.981:647): avc: denied { mounton } for pid=7866 comm="syz.0.546" path="/149/file0" dev="tmpfs" ino=817 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 98.638529][ T7867] Invalid source name [ 98.648408][ T7867] UBIFS error (pid: 7867): cannot open "./file0", error -22 [ 98.664255][ T5815] imon 6-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 98.669161][ T5815] (id 0x00) [ 98.724744][ T5815] rc_core: IR keymap rc-imon-pad not found [ 98.726706][ T5815] Registered IR keymap rc-empty [ 98.728338][ T5815] imon 6-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 98.731486][ T5815] imon 6-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 98.877471][ T7877] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 98.878230][ T5815] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:155.0/rc/rc0 [ 98.888822][ T5815] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:155.0/rc/rc0/input14 [ 98.895280][ T5815] imon 6-1:155.0: iMON device (15c2:ffdc, intf0) on usb<6:11> initialized [ 98.904684][ T7879] /dev/sr0: Can't open blockdev [ 98.930813][ T7881] __nla_validate_parse: 3 callbacks suppressed [ 98.930824][ T7881] netlink: 12 bytes leftover after parsing attributes in process `syz.4.552'. [ 98.941812][ T7883] netlink: 12 bytes leftover after parsing attributes in process `syz.0.553'. [ 98.988815][ T7885] openvswitch: netlink: IPv4 tunnel dst address is zero [ 99.231442][ T7901] netlink: 8 bytes leftover after parsing attributes in process `syz.0.560'. [ 99.325647][ T7911] netlink: 12 bytes leftover after parsing attributes in process `syz.4.563'. [ 99.374464][ T7915] netlink: 16 bytes leftover after parsing attributes in process `syz.2.564'. [ 99.386335][ T42] audit: type=1400 audit(1784965251.721:648): avc: denied { listen } for pid=7916 comm="syz.4.565" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 99.394267][ T42] audit: type=1400 audit(1784965251.731:649): avc: denied { map } for pid=7914 comm="syz.2.564" path="socket:[27672]" dev="sockfs" ino=27672 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 99.401880][ T42] audit: type=1400 audit(1784965251.731:650): avc: denied { accept } for pid=7914 comm="syz.2.564" path="socket:[27672]" dev="sockfs" ino=27672 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 99.402421][ T7919] openvswitch: netlink: Tunnel attr 16 has unexpected len 16 expected 0 [ 99.442273][ T42] audit: type=1400 audit(1784965251.781:651): avc: denied { connect } for pid=7923 comm="syz.2.569" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 99.459209][ T42] audit: type=1400 audit(1784965251.801:652): avc: denied { cmd } for pid=7928 comm="syz.0.570" path="/dev/ublk-control" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 99.462894][ T7931] dns_resolver: Unsupported content type (234) [ 99.470627][ T42] audit: type=1400 audit(1784965251.811:653): avc: denied { map } for pid=7928 comm="syz.0.570" path="/dev/ublkc0" dev="devtmpfs" ino=2984 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 99.470826][ T7929] ublk0: read batch cmd buffer failed [ 99.481313][ T7929] ublk0: read batch cmd buffer failed [ 99.499361][ T7934] 9pnet_virtio: no channels available for device syz [ 99.574061][ T7836] imon:send_packet: task interrupted [ 99.577242][ T7836] imon:send_packet: packet tx failed (-512) [ 99.580018][ T7836] imon:vfd_write: send packet #2 failed [ 99.586192][ T55] usb 6-1: USB disconnect, device number 11 [ 99.592583][ T7943] netlink: 32 bytes leftover after parsing attributes in process `syz.4.575'. [ 99.613322][ T7947] 9pnet_virtio: no channels available for device syz [ 99.656097][ T7955] netlink: 'syz.4.579': attribute type 23 has an invalid length. [ 99.684289][ T34] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 99.688752][ T7957] NILFS (loop0): device size too small [ 99.745517][ T7967] netlink: 20 bytes leftover after parsing attributes in process `syz.0.583'. [ 99.748288][ T7967] netlink: 20 bytes leftover after parsing attributes in process `syz.0.583'. [ 99.854415][ T34] usb 7-1: Using ep0 maxpacket: 32 [ 99.857583][ T34] usb 7-1: config 0 has an invalid interface number: 119 but max is 0 [ 99.860220][ T34] usb 7-1: config 0 has no interface number 0 [ 99.862350][ T34] usb 7-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 99.867231][ T34] usb 7-1: config 0 interface 119 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 99.870989][ T34] usb 7-1: config 0 interface 119 altsetting 0 endpoint 0x83 has an invalid bInterval 115, changing to 7 [ 99.875117][ T34] usb 7-1: config 0 interface 119 altsetting 0 endpoint 0x83 has invalid maxpacket 25972, setting to 1024 [ 99.879622][ T34] usb 7-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 99.881825][ T7973] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 99.885969][ T34] usb 7-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 99.889887][ T34] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.893072][ T34] usb 7-1: Product: syz [ 99.894915][ T34] usb 7-1: Manufacturer: syz [ 99.896890][ T34] usb 7-1: SerialNumber: syz [ 99.900792][ T34] usb 7-1: config 0 descriptor?? [ 99.906557][ T34] input: bcm5974 as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.119/input/input15 [ 99.921270][ T7976] xt_cluster: you have exceeded the maximum number of cluster nodes (205 > 32) [ 100.079242][ T7985] netlink: 12 bytes leftover after parsing attributes in process `syz.4.588'. [ 100.115838][ T7925] bridge0: port 3(vlan0) entered blocking state [ 100.117956][ T7925] bridge0: port 3(vlan0) entered disabled state [ 100.120559][ T7925] vlan0: entered allmulticast mode [ 100.122259][ T7925] bond0: entered allmulticast mode [ 100.123926][ T7925] bond_slave_0: entered allmulticast mode [ 100.126157][ T7925] bond_slave_1: entered allmulticast mode [ 100.132897][ T7925] vlan0: entered promiscuous mode [ 100.135313][ T7925] bond0: entered promiscuous mode [ 100.137786][ T7925] bond_slave_0: entered promiscuous mode [ 100.140475][ T7925] bond_slave_1: entered promiscuous mode [ 100.145781][ T7925] bridge0: port 3(vlan0) entered blocking state [ 100.148905][ T7925] bridge0: port 3(vlan0) entered forwarding state [ 100.162241][ T7991] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=246 sclass=netlink_route_socket pid=7991 comm=syz.2.569 [ 100.169157][ T1047] usb 7-1: USB disconnect, device number 3 [ 100.300720][ T7998] Attempt to restore checkpoint with obsolete wellknown handles [ 100.499992][ T42] audit: type=1400 audit(1784965252.841:654): avc: denied { write } for pid=8009 comm="syz.0.595" name="ppp" dev="devtmpfs" ino=731 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 100.502522][ T8008] erspan0: entered promiscuous mode [ 100.509817][ T42] audit: type=1400 audit(1784965252.851:655): avc: denied { ioctl } for pid=8009 comm="syz.0.595" path="/dev/ppp" dev="devtmpfs" ino=731 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 100.557829][ T8014] netlink: 28 bytes leftover after parsing attributes in process `syz.4.596'. [ 100.582134][ T8014] deleting an unspecified loop device is not supported. [ 100.634268][ T8020] macvtap1: entered allmulticast mode [ 100.636092][ T8020] bond0: entered allmulticast mode [ 100.638072][ T8020] bond_slave_0: entered allmulticast mode [ 100.639841][ T8020] bond_slave_1: entered allmulticast mode [ 100.643620][ T8020] bond_slave_0: entered promiscuous mode [ 100.646315][ T8020] bond_slave_1: entered promiscuous mode [ 100.649019][ T8020] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 100.654660][ T8020] bond0: left allmulticast mode [ 100.656302][ T8020] bond_slave_0: left allmulticast mode [ 100.658131][ T8020] bond_slave_1: left allmulticast mode [ 100.675348][ T5829] bond_slave_0: left promiscuous mode [ 100.677231][ T5829] bond_slave_1: left promiscuous mode [ 100.784370][ T5815] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 100.819915][ T8035] NILFS (nullb0): couldn't find nilfs on the device [ 100.846818][ T8038] block nbd1: Unsupported socket: should be TCP or UNIX. [ 100.905563][ T55] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 100.944429][ T5815] usb 5-1: Using ep0 maxpacket: 8 [ 100.949939][ T5815] usb 5-1: config 0 has an invalid interface number: 186 but max is 0 [ 100.955992][ T5815] usb 5-1: config 0 has no interface number 0 [ 100.957963][ T5815] usb 5-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 100.961829][ T5815] usb 5-1: config 0 interface 186 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 100.964937][ T5815] usb 5-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 100.968508][ T5815] usb 5-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 100.976010][ T5815] usb 5-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 100.982392][ T5815] usb 5-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 100.985774][ T5815] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.989789][ T5815] usb 5-1: Product: syz [ 100.991233][ T5815] usb 5-1: Manufacturer: syz [ 100.992704][ T5815] usb 5-1: SerialNumber: syz [ 100.996502][ T5815] usb 5-1: config 0 descriptor?? [ 101.054431][ T55] usb 9-1: Using ep0 maxpacket: 8 [ 101.059497][ T55] usb 9-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 101.063073][ T55] usb 9-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 101.066431][ T55] usb 9-1: config 0 interface 0 has no altsetting 0 [ 101.069056][ T55] usb 9-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 101.076583][ T55] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.081018][ T55] usb 9-1: config 0 descriptor?? [ 101.082123][ T8059] syz_tun: entered allmulticast mode [ 101.105518][ T8057] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 101.146025][ T8067] ieee802154 phy0 wpan0: encryption failed: -22 [ 101.202652][ T5815] iowarrior 5-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0 [ 101.298612][ T8082] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 101.407130][ T5815] usb 5-1: USB disconnect, device number 11 [ 101.455356][ T8094] faux_driver vkms: [drm] Unknown color mode 257; guessing buffer size. [ 101.499663][ T55] mcp2221 0003:04D8:00DD.0006: unknown main item tag 0x0 [ 101.501952][ T55] mcp2221 0003:04D8:00DD.0006: unknown main item tag 0x0 [ 101.504400][ T55] mcp2221 0003:04D8:00DD.0006: unknown main item tag 0x0 [ 101.506581][ T55] mcp2221 0003:04D8:00DD.0006: unknown main item tag 0x0 [ 101.508782][ T55] mcp2221 0003:04D8:00DD.0006: unknown main item tag 0x0 [ 101.512206][ T55] mcp2221 0003:04D8:00DD.0006: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 101.519344][ T8096] binder: 8095:8096 ioctl c0306201 200000001040 returned -14 [ 101.522254][ T8096] binder: 8095:8096 ioctl c0306201 2000000001c0 returned -14 [ 101.525170][ T8096] binder: 8095:8096 ioctl c0306201 200000000c00 returned -14 [ 101.564265][ T5829] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 101.696560][ T8027] IPv6: NLM_F_REPLACE set, but no existing node found! [ 101.725796][ T5829] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 101.728914][ T5829] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 101.732788][ T5829] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 101.737223][ T5829] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.819482][ T55] usb 9-1: USB disconnect, device number 6 [ 101.942664][ T5829] usb 7-1: usb_control_msg returned -32 [ 101.944507][ T5829] usbtmc 7-1:16.0: can't read capabilities [ 102.114704][ T9] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 102.276478][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 102.281146][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 102.285237][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 102.289780][ T9] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 102.292614][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.300671][ T9] usb 6-1: config 0 descriptor?? [ 102.310628][ T5829] usb 7-1: USB disconnect, device number 4 [ 102.365891][ T5815] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 102.483478][ T8130] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 [ 102.487931][ T8130] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 102.493368][ T8130] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8130 comm=syz.4.635 [ 102.499886][ T8130] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8130 comm=syz.4.635 [ 102.506715][ T8130] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8130 comm=syz.4.635 [ 102.511877][ T8130] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8130 comm=syz.4.635 [ 102.515970][ T5815] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 102.516962][ T8130] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8130 comm=syz.4.635 [ 102.524318][ T5815] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 102.525886][ T8130] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8130 comm=syz.4.635 [ 102.530571][ T5815] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 102.536402][ T8130] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8130 comm=syz.4.635 [ 102.537891][ T5815] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.543609][ T8130] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8130 comm=syz.4.635 [ 102.549437][ T5815] usb 5-1: config 0 descriptor?? [ 102.551685][ T8130] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8130 comm=syz.4.635 [ 102.558510][ T5815] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 102.561795][ T5815] dvb-usb: bulk message failed: -22 (3/0) [ 102.573174][ T5815] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 102.581499][ T5815] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 102.585543][ T5815] usb 5-1: media controller created [ 102.589887][ T5815] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 102.604855][ T5815] dvb-usb: bulk message failed: -22 (6/0) [ 102.608214][ T5815] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 102.629501][ T5815] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb5/5-1/input/input16 [ 102.637050][ T5815] dvb-usb: schedule remote query interval to 150 msecs. [ 102.640381][ T5815] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 102.710805][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 102.715565][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 102.717996][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 102.720213][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 102.722437][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 102.739382][ T9] plantronics 0003:047F:FFFF.0007: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 102.765230][ T1047] usb 5-1: USB disconnect, device number 12 [ 102.789305][ T1047] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 102.924349][ T5815] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 102.989646][ T9] usb 6-1: USB disconnect, device number 12 [ 103.075030][ T5815] usb 7-1: Using ep0 maxpacket: 8 [ 103.079980][ T5815] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 103.083998][ T5815] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 103.087839][ T5815] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 103.091882][ T5815] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 103.096348][ T5815] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 103.101298][ T5815] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 103.104890][ T5815] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.315277][ T5815] usb 7-1: GET_CAPABILITIES returned 0 [ 103.317078][ T5815] usbtmc 7-1:16.0: can't read capabilities [ 103.338127][ T5815] usb 7-1: USB disconnect, device number 5 [ 103.554372][ T848] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 103.714234][ T848] usb 5-1: Using ep0 maxpacket: 8 [ 103.719176][ T848] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 103.722667][ T848] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 103.725943][ T848] usb 5-1: config 0 interface 0 has no altsetting 0 [ 103.727987][ T848] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 103.730800][ T848] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.734902][ T848] usb 5-1: config 0 descriptor?? [ 103.741069][ T42] kauditd_printk_skb: 20 callbacks suppressed [ 103.741080][ T42] audit: type=1400 audit(1784965256.081:676): avc: denied { map } for pid=8182 comm="syz.1.651" path="socket:[26285]" dev="sockfs" ino=26285 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 103.780986][ T8185] netlink: 'syz.1.652': attribute type 1 has an invalid length. [ 103.808185][ T8185] 8021q: adding VLAN 0 to HW filter on device bond4 [ 103.966104][ T8192] overlay: Unknown parameter 'euid<00000000000000000000' [ 104.038032][ T8185] dummy0: left allmulticast mode [ 104.048246][ T8185] bond4: (slave dummy0): Enslaving as a backup interface with a down link [ 104.149284][ T848] mcp2221 0003:04D8:00DD.0008: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 104.164885][ T42] audit: type=1400 audit(1784965256.511:677): avc: denied { mounton } for pid=8203 comm="syz.1.656" path="/proc/488/task" dev="proc" ino=27978 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 104.259947][ T42] audit: type=1400 audit(1784965256.601:678): avc: denied { map } for pid=8210 comm="syz.4.659" path="/dev/vbi9" dev="devtmpfs" ino=1031 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 104.277120][ T8213] tmpfs: User quota inode hardlimit too large. [ 104.289675][ T42] audit: type=1400 audit(1784965256.631:679): avc: denied { read } for pid=8214 comm="syz.4.660" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 104.346714][ T8148] IPv6: NLM_F_REPLACE set, but no existing node found! [ 104.352045][ T8209] infiniband syz1: set active [ 104.355295][ T8209] infiniband syz1: added syz_tun [ 104.367691][ T8209] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 104.372818][ T8209] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 104.380603][ T8209] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 104.407586][ T8209] RDS/IB: syz1: added [ 104.409214][ T8209] smc: adding ib device syz1 with port count 1 [ 104.411492][ T8209] smc: ib device syz1 port 1 has no pnetid [ 104.438269][ T34] usb 5-1: USB disconnect, device number 13 [ 104.697091][ T8229] __nla_validate_parse: 6 callbacks suppressed [ 104.697105][ T8229] netlink: 20 bytes leftover after parsing attributes in process `syz.4.663'. [ 104.697126][ T8231] netlink: 20 bytes leftover after parsing attributes in process `syz.4.663'. [ 104.703339][ T42] audit: type=1400 audit(1784965257.041:680): avc: denied { unmount } for pid=5733 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 104.717423][ T8229] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 104.743975][ T8231] ipvlan2: entered allmulticast mode [ 104.746904][ T8231] batadv_slave_1: entered allmulticast mode [ 104.749283][ T42] audit: type=1400 audit(1784965257.091:681): avc: denied { write } for pid=8236 comm="syz.2.664" lport=45795 faddr=::ffff:172.20.255.187 fport=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 104.750182][ T8231] batman_adv: batadv0: Adding interface: ipvlan2 [ 104.757326][ T42] audit: type=1400 audit(1784965257.091:682): avc: denied { setopt } for pid=8236 comm="syz.2.664" lport=45795 faddr=::ffff:172.20.255.187 fport=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 104.768895][ T8231] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.777433][ T8231] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 104.780714][ T8231] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.783753][ T8231] batman_adv: batadv0: Interface activated: ipvlan2 [ 104.791693][ T8229] overlayfs: failed to verify index (index/00fb210001326e5725f7024bcf81a05b78a544623292a5323df602000000000000, ftype=8000, err=-61) [ 104.797521][ T8229] overlayfs: failed index dir cleanup (-61) [ 104.801019][ T8229] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 104.853035][ T8242] overlayfs: failed to resolve './file1/file0': -2 [ 104.968187][ T8252] netlink: 12 bytes leftover after parsing attributes in process `syz.2.669'. [ 105.024774][ T8258] FAULT_INJECTION: forcing a failure. [ 105.024774][ T8258] name failslab, interval 1, probability 0, space 0, times 0 [ 105.038052][ T8258] CPU: 0 UID: 0 PID: 8258 Comm: syz.4.671 Tainted: G L syzkaller #0 PREEMPT(full) [ 105.038072][ T8258] Tainted: [L]=SOFTLOCKUP [ 105.038075][ T8258] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.038082][ T8258] Call Trace: [ 105.038086][ T8258] [ 105.038090][ T8258] dump_stack_lvl+0x100/0x190 [ 105.038122][ T8258] should_fail_ex.cold+0x5/0xa [ 105.038136][ T8258] should_failslab+0xc2/0x120 [ 105.038150][ T8258] __kmalloc_noprof+0xfc/0x820 [ 105.038162][ T8258] ? alloc_pipe_info+0x1ec/0x590 [ 105.038176][ T8258] alloc_pipe_info+0x1ec/0x590 [ 105.038189][ T8258] splice_direct_to_actor+0x78f/0xa30 [ 105.038207][ T8258] ? __pfx_direct_splice_actor+0x10/0x10 [ 105.038218][ T8258] ? inode_has_perm+0x16d/0x1d0 [ 105.038232][ T8258] ? __file_has_perm+0x336/0x460 [ 105.038246][ T8258] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 105.038258][ T8258] ? __pfx___file_has_perm+0x10/0x10 [ 105.038279][ T8258] do_splice_direct+0x174/0x240 [ 105.038292][ T8258] ? __pfx_do_splice_direct+0x10/0x10 [ 105.038305][ T8258] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 105.038317][ T8258] ? bpf_lsm_file_permission+0x9/0x10 [ 105.038333][ T8258] ? security_file_permission+0x76/0x210 [ 105.038351][ T8258] ? rw_verify_area+0xce/0x6d0 [ 105.038367][ T8258] do_sendfile+0xadc/0xe20 [ 105.038385][ T8258] ? __pfx_do_sendfile+0x10/0x10 [ 105.038399][ T8258] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 105.038417][ T8258] ? __fget_files+0x21f/0x3d0 [ 105.038431][ T8258] __x64_sys_sendfile64+0x1d8/0x220 [ 105.038443][ T8258] ? ksys_write+0x1ac/0x250 [ 105.038458][ T8258] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 105.038474][ T8258] do_syscall_64+0x115/0x870 [ 105.038484][ T8258] ? clear_bhb_loop+0x40/0x90 [ 105.038497][ T8258] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.038508][ T8258] RIP: 0033:0x7f6a0639de99 [ 105.038518][ T8258] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.038528][ T8258] RSP: 002b:00007f6a045f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 105.038539][ T8258] RAX: ffffffffffffffda RBX: 00007f6a06625fa0 RCX: 00007f6a0639de99 [ 105.038545][ T8258] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 105.038551][ T8258] RBP: 00007f6a045f6090 R08: 0000000000000000 R09: 0000000000000000 [ 105.038557][ T8258] R10: 0000000000000101 R11: 0000000000000246 R12: 0000000000000001 [ 105.038563][ T8258] R13: 00007f6a06626038 R14: 00007f6a06625fa0 R15: 00007ffd26a2ebb8 [ 105.038577][ T8258] [ 105.186978][ T8266] overlayfs: workdir and upperdir must be separate subtrees [ 105.279308][ T1166] smc: removing ib device syz1 [ 105.293863][ T8268] netlink: 12 bytes leftover after parsing attributes in process `syz.4.674'. [ 105.294899][ T5815] syz1: Port: 1 Link DOWN [ 105.313525][ T8268] af_packet: tpacket_rcv: packet too big, clamped from 64521 to 3956. macoff=92 [ 105.369422][ T8272] ubi0: attaching mtd0 [ 105.390253][ T8272] ubi0: scanning is finished [ 105.393375][ T8272] ubi0: empty MTD device detected [ 105.395439][ T8272] ubi0 error: ubi_read_volume_table: LEB size too small for a volume record [ 105.418262][ T1166] smbdirect: ib_dev[syz1] removed [ 105.444402][ T8274] nbd0: detected capacity change from 63 to 87 [ 105.458163][ T8274] block nbd0: reconnected socket [ 105.466341][ T8270] netlink: 'syz.0.677': attribute type 21 has an invalid length. [ 105.466480][ T42] audit: type=1400 audit(1784965257.811:683): avc: denied { read write } for pid=8269 comm="syz.0.677" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 105.469003][ T8270] netlink: 'syz.0.677': attribute type 6 has an invalid length. [ 105.479601][ T42] audit: type=1400 audit(1784965257.811:684): avc: denied { open } for pid=8269 comm="syz.0.677" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 105.491598][ T8270] netlink: 132 bytes leftover after parsing attributes in process `syz.0.677'. [ 105.515169][ T8270] netlink: 4 bytes leftover after parsing attributes in process `syz.0.677'. [ 105.520106][ T8270] netlink: 4 bytes leftover after parsing attributes in process `syz.0.677'. [ 105.532476][ T65] block nbd0: Receive control failed (result -104) [ 105.584675][ T42] audit: type=1400 audit(1784965257.931:685): avc: denied { ioctl } for pid=8281 comm="syz.0.681" path="socket:[28046]" dev="sockfs" ino=28046 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 105.684962][ T8272] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 105.886609][ T848] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 105.957239][ T8311] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 106.256122][ T5740] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 106.259017][ T5740] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 106.262011][ T5740] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 106.268700][ T5740] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 106.273262][ T5740] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 106.284570][ T5750] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 106.289186][ T5750] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 106.291471][ T5750] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 106.295214][ T5750] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 106.297862][ T5750] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 106.582325][ T8314] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.585102][ T8314] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.587387][ T8314] bridge_slave_0: entered allmulticast mode [ 106.590255][ T8314] bridge_slave_0: entered promiscuous mode [ 106.593419][ T8314] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.596494][ T8314] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.599166][ T8314] bridge_slave_1: entered allmulticast mode [ 106.601840][ T8314] bridge_slave_1: entered promiscuous mode [ 106.619232][ T8314] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 106.623714][ T8314] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 106.641594][ T8314] team0: Port device team_slave_0 added [ 106.645134][ T8314] team0: Port device team_slave_1 added [ 106.658419][ T8314] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 106.660558][ T8314] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 106.670121][ T8314] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 106.676061][ T8314] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 106.678930][ T8314] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 106.690029][ T8314] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 106.729135][ T8314] hsr_slave_0: entered promiscuous mode [ 106.731427][ T8314] hsr_slave_1: entered promiscuous mode [ 106.733396][ T8314] debugfs: 'hsr0' already exists in 'hsr' [ 106.735209][ T8314] Cannot create hsr debugfs directory [ 106.843555][ T8314] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 106.847620][ T8314] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.850397][ T8314] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 106.854428][ T8314] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.857140][ T8314] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 106.867125][ T8314] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.870389][ T8314] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 106.879752][ T8314] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.935696][ T8314] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.949560][ T8314] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.970702][ T103] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.972980][ T103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.978976][ T103] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.981219][ T103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.144261][ T4573] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 107.226895][ T8314] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.315922][ T4573] usb 9-1: config 0 has an invalid interface number: 120 but max is 0 [ 107.320838][ T4573] usb 9-1: config 0 has no interface number 0 [ 107.325335][ T4573] usb 9-1: config 0 interface 120 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 107.334414][ T4573] usb 9-1: New USB device found, idVendor=16e3, idProduct=f9e9, bcdDevice= 0.58 [ 107.337747][ T4573] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.345440][ T4573] usb 9-1: config 0 descriptor?? [ 107.350613][ T8335] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 107.379240][ T8314] veth0_vlan: entered promiscuous mode [ 107.379667][ T8379] JFS: charset not found [ 107.395606][ T8314] veth1_vlan: entered promiscuous mode [ 107.428553][ T8314] veth0_macvtap: entered promiscuous mode [ 107.432719][ T8314] veth1_macvtap: entered promiscuous mode [ 107.442510][ T8314] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.449600][ T8314] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.465309][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.469085][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.473476][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.477546][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.577954][ T9] usb 9-1: USB disconnect, device number 7 [ 107.581205][ T103] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.587785][ T103] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.603581][ T8385] netlink: 12 bytes leftover after parsing attributes in process `syz.2.700'. [ 107.624326][ T8385] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 107.627537][ T1166] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.631967][ T1166] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.738266][ T8388] netlink: 48 bytes leftover after parsing attributes in process `syz.5.692'. [ 107.794814][ T8392] ieee802154 phy0 wpan0: encryption failed: -22 [ 107.843868][ T8394] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.844539][ T8397] overlayfs: failed to decode file handle (len=8, type=251, flags=0, err=-22) [ 107.950695][ T8405] netlink: 4 bytes leftover after parsing attributes in process `syz.2.708'. [ 108.011441][ T8406] netlink: 'syz.5.707': attribute type 1 has an invalid length. [ 108.080521][ T8414] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 108.104339][ T9] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 108.248165][ T8432] kAFS: No cell specified [ 108.254285][ T55] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 108.265584][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 108.268726][ T9] usb 5-1: config index 0 descriptor too short (expected 74, got 45) [ 108.272978][ T9] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 108.279755][ T9] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 108.285057][ T9] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 108.289606][ T9] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 108.292743][ T9] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 108.297229][ T9] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 108.300059][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.374407][ T5740] Bluetooth: hci3: command tx timeout [ 108.394932][ T8444] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 108.405874][ T8444] vlan2: entered allmulticast mode [ 108.407557][ T8444] bond0: entered allmulticast mode [ 108.409477][ T8444] bond_slave_0: entered allmulticast mode [ 108.409524][ T55] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 108.411826][ T8444] bond_slave_1: entered allmulticast mode [ 108.413267][ T8444] bridge0: port 3(vlan2) entered blocking state [ 108.416116][ T55] usb 10-1: config 0 has no interfaces? [ 108.418579][ T8444] bridge0: port 3(vlan2) entered disabled state [ 108.420485][ T55] usb 10-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 108.425676][ T8444] vlan2: entered promiscuous mode [ 108.428543][ T55] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.430570][ T55] usb 10-1: config 0 descriptor?? [ 108.430620][ T8444] bond0: entered promiscuous mode [ 108.438447][ T8444] bond_slave_0: entered promiscuous mode [ 108.440917][ T8444] bond_slave_1: entered promiscuous mode [ 108.443905][ T8444] bridge0: port 3(vlan2) entered blocking state [ 108.446394][ T8444] bridge0: port 3(vlan2) entered forwarding state [ 108.486783][ T5787] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.489658][ T5787] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.492468][ T5787] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.500171][ T5787] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.506807][ T9] usb 5-1: GET_CAPABILITIES returned 0 [ 108.508548][ T9] usbtmc 5-1:16.0: can't read capabilities [ 108.572419][ T8455] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 108.711682][ T9] usb 5-1: USB disconnect, device number 14 [ 108.744919][ T42] kauditd_printk_skb: 13 callbacks suppressed [ 108.744931][ T42] audit: type=1400 audit(1784965261.081:699): avc: denied { map } for pid=8460 comm="syz.2.723" path="socket:[30825]" dev="sockfs" ino=30825 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 108.753669][ T42] audit: type=1400 audit(1784965261.091:700): avc: denied { wake_alarm } for pid=8460 comm="syz.2.723" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 108.979616][ T8464] 9pnet_virtio: no channels available for device syz [ 109.016083][ T42] audit: type=1400 audit(1784965261.361:701): avc: denied { bind } for pid=8465 comm="syz.4.725" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 109.252819][ T42] audit: type=1400 audit(1784965261.591:702): avc: denied { name_bind } for pid=8479 comm="syz.4.729" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 109.261328][ T8480] l2tp_ppp: sess 2/0: no socket in recv [ 109.263732][ T8481] l2tp_ppp: sess 2/0: no socket in recv [ 109.332408][ T8480] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 109.341011][ T8481] iommufd_mock iommufd_mock1: Adding to iommu group 10 [ 109.566402][ T42] audit: type=1400 audit(1784965261.911:703): avc: denied { setopt } for pid=8495 comm="syz.4.735" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 109.567429][ T8496] ecryptfs_validate_options: You must supply at least one valid auth tok signature as a mount parameter; see the eCryptfs README [ 109.578947][ T8496] Error validating options; rc = [-22] [ 109.686567][ T42] audit: type=1400 audit(1784965262.031:704): avc: denied { bind } for pid=8502 comm="syz.2.737" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 109.759909][ T8507] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 109.763266][ T8507] overlayfs: missing 'lowerdir' [ 109.789316][ T8505] __nla_validate_parse: 7 callbacks suppressed [ 109.789328][ T8505] netlink: 8 bytes leftover after parsing attributes in process `syz.2.738'. [ 109.816221][ T2245] block nbd0: Connection timed out, retrying (0/1 alive) [ 109.821809][ T2245] block nbd0: Connection timed out, retrying (0/1 alive) [ 109.824115][ T2245] block nbd0: Connection timed out, retrying (0/1 alive) [ 109.826625][ T2245] block nbd0: Dead connection, failed to find a fallback [ 109.909912][ T8523] openvswitch: netlink: Key 4 has unexpected len 4 expected 12 [ 109.915004][ T42] audit: type=1400 audit(1784965262.251:705): avc: denied { setopt } for pid=8524 comm="syz.0.744" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 109.921204][ T42] audit: type=1400 audit(1784965262.251:706): avc: denied { accept } for pid=8524 comm="syz.0.744" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 109.930375][ T42] audit: type=1400 audit(1784965262.261:707): avc: denied { write } for pid=8524 comm="syz.0.744" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 109.935128][ T5787] nci: nci_rsp_packet: unsupported rsp opcode 0xf00 [ 109.940356][ T42] audit: type=1400 audit(1784965262.261:708): avc: denied { read } for pid=8524 comm="syz.0.744" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 109.976385][ T8530] netlink: 12 bytes leftover after parsing attributes in process `syz.4.746'. [ 109.982246][ T8525] kvm: kvm [8524]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 109.986086][ T8525] kvm: kvm [8524]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 110.093058][ T8540] netlink: 'syz.4.749': attribute type 1 has an invalid length. [ 110.095641][ T8540] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 110.191212][ T8545] netlink: 'syz.0.751': attribute type 1 has an invalid length. [ 110.204998][ T8545] 8021q: adding VLAN 0 to HW filter on device bond6 [ 110.214830][ T8545] bond6: (slave gretap1): making interface the new active one [ 110.217785][ T8545] bond6: (slave gretap1): Enslaving as an active interface with an up link [ 110.226675][ T8545] bond6 (unregistering): (slave gretap1): Releasing active interface [ 110.230514][ T8545] bond6 (unregistering): Released all slaves [ 110.330943][ T8550] xt_hashlimit: size too large, truncated to 1048576 [ 110.387635][ T8555] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 110.415075][ T8550] TCP: tcp_parse_options: Illegal window scaling value 215 > 14 received [ 110.455265][ T5740] Bluetooth: hci3: command tx timeout [ 110.581280][ T8561] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 110.584067][ T8561] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 110.589745][ T8561] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 110.864288][ T2245] block nbd0: shutting down sockets [ 110.866186][ T2245] blk_print_req_error: 96 callbacks suppressed [ 110.866195][ T2245] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 2 prio class 2 [ 110.872243][ T2245] buffer_io_error: 255 callbacks suppressed [ 110.872252][ T2245] Buffer I/O error on dev nbd0, logical block 2, async page read [ 110.876560][ T2245] Buffer I/O error on dev nbd0, logical block 3, async page read [ 110.878958][ T2245] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 110.881813][ T2245] Buffer I/O error on dev nbd0, logical block 1, async page read [ 110.884269][ T2245] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 110.887158][ T2245] Buffer I/O error on dev nbd0, logical block 0, async page read [ 110.893790][ T2245] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 110.896878][ T2245] Buffer I/O error on dev nbd0, logical block 0, async page read [ 110.899335][ T2245] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 110.902760][ T2245] Buffer I/O error on dev nbd0, logical block 1, async page read [ 110.905292][ T2245] Buffer I/O error on dev nbd0, logical block 2, async page read [ 110.907751][ T2245] Buffer I/O error on dev nbd0, logical block 3, async page read [ 110.910390][ T5105] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 110.913472][ T5105] Buffer I/O error on dev nbd0, logical block 0, async page read [ 110.916299][ T5105] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 110.919367][ T5105] Buffer I/O error on dev nbd0, logical block 1, async page read [ 110.922666][ T5105] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 110.925818][ T5105] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 110.929046][ T5105] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 110.932688][ T6771] ldm_validate_partition_table(): Disk read failed. [ 110.933544][ T41] usb 10-1: USB disconnect, device number 2 [ 110.936675][ T6771] Dev nbd0: unable to read RDB block 0 [ 110.939890][ T6771] nbd0: unable to read partition table [ 110.946671][ T6771] ldm_validate_partition_table(): Disk read failed. [ 110.949529][ T6771] Dev nbd0: unable to read RDB block 0 [ 110.951977][ T6771] nbd0: unable to read partition table [ 112.544780][ T5740] Bluetooth: hci3: command 0x0419 tx timeout [ 112.863774][ T8515] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 112.929069][ T8589] netlink: 'syz.4.763': attribute type 8 has an invalid length. [ 112.966540][ T8593] erspan0: entered promiscuous mode [ 112.971869][ T8593] erspan0: entered allmulticast mode [ 113.042288][ T8603] netlink: 'syz.4.768': attribute type 4 has an invalid length. [ 113.045783][ T8603] netlink: 224 bytes leftover after parsing attributes in process `syz.4.768'. [ 113.076965][ T8607] --map-set only usable from mangle table [ 113.103732][ T8607] 9pnet_virtio: no channels available for device syz [ 113.139759][ T8618] ufs: Unknown parameter 'debug' [ 113.223261][ T8629] netlink: 100 bytes leftover after parsing attributes in process `syz.4.777'. [ 113.230071][ T8630] netlink: 100 bytes leftover after parsing attributes in process `syz.4.777'. [ 113.333195][ T5787] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0xc9 [ 113.381645][ T8646] binder: 8645:8646 ioctl c018620c 200000000040 returned -22 [ 113.391209][ T8646] binder: BC_ACQUIRE_RESULT not supported [ 113.393487][ T8646] binder: 8645:8646 ioctl c0306201 2000000003c0 returned -22 [ 113.396693][ T8646] netlink: 36 bytes leftover after parsing attributes in process `syz.2.780'. [ 113.463765][ T8659] FAT-fs (nbd2): unable to read boot sector [ 113.480919][ T8659] geneve3: entered promiscuous mode [ 113.483172][ T8659] geneve3: entered allmulticast mode [ 113.505466][ T8663] xt_hashlimit: size too large, truncated to 1048576 [ 113.661317][ T8673] netlink: 12 bytes leftover after parsing attributes in process `syz.2.790'. [ 113.664577][ T8673] netlink: 12 bytes leftover after parsing attributes in process `syz.2.790'. [ 113.671040][ T8673] netlink: 12 bytes leftover after parsing attributes in process `syz.2.790'. [ 113.677474][ T8673] netlink: 12 bytes leftover after parsing attributes in process `syz.2.790'. [ 113.757345][ T8684] openvswitch: netlink: Port -2146435068 exceeds max allowable 65535 [ 114.607619][ T42] kauditd_printk_skb: 12 callbacks suppressed [ 114.607635][ T42] audit: type=1400 audit(1784965266.951:721): avc: denied { write } for pid=8685 comm="syz.2.793" name="loop-control" dev="devtmpfs" ino=657 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 114.625131][ T5740] Bluetooth: hci3: command 0x0419 tx timeout [ 115.074275][ T55] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 115.224310][ T55] usb 7-1: Using ep0 maxpacket: 8 [ 115.228007][ T55] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 115.230955][ T55] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 115.234783][ T55] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 115.238066][ T55] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 115.241840][ T55] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 115.246705][ T55] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 115.249664][ T55] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.459432][ T8693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.465055][ T8693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.468228][ T8693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.471071][ T8693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.474566][ T8693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.479882][ T8693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.483961][ T8693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.487191][ T8693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.490562][ T8693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.493758][ T8693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.503668][ T55] usb 7-1: usb_control_msg returned -32 [ 115.505544][ T55] usbtmc 7-1:16.0: can't read capabilities [ 116.272092][ T8635] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 116.311177][ T42] audit: type=1400 audit(1784965268.651:722): avc: denied { create } for pid=8695 comm="syz.0.798" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 116.344476][ T8707] lo speed is unknown, defaulting to 1000 [ 116.347436][ T8707] lo speed is unknown, defaulting to 1000 [ 116.350986][ T5739] usb 7-1: USB disconnect, device number 6 [ 116.376739][ T8707] lo speed is unknown, defaulting to 1000 [ 116.385418][ T8707] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 116.389925][ T8707] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 116.397626][ T8707] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 116.404933][ T8711] dummy0: entered allmulticast mode [ 116.416246][ T8707] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 116.427344][ T8714] overlayfs: failed to verify upper (201/file1, ino=1134, err=-116) [ 116.432098][ T8714] overlayfs: failed to verify index dir 'upper' xattr [ 116.434333][ T8714] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 116.437440][ T8707] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 116.468351][ T8707] lo speed is unknown, defaulting to 1000 [ 116.473976][ T8707] lo speed is unknown, defaulting to 1000 [ 116.477376][ T8707] lo speed is unknown, defaulting to 1000 [ 116.480480][ T8707] lo speed is unknown, defaulting to 1000 [ 116.483109][ T8707] lo speed is unknown, defaulting to 1000 [ 116.491312][ T8717] __nla_validate_parse: 61 callbacks suppressed [ 116.491323][ T8717] netlink: 8 bytes leftover after parsing attributes in process `syz.2.803'. [ 116.531248][ T42] audit: type=1400 audit(1784965268.871:723): avc: denied { block_suspend } for pid=8720 comm="syz.2.805" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 116.694245][ T5740] Bluetooth: hci3: command 0x0419 tx timeout [ 116.714267][ T42] audit: type=1400 audit(1784965269.051:724): avc: denied { watch } for pid=8740 comm="syz.2.812" path="/206/file0" dev="tmpfs" ino=1172 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 116.723389][ T42] audit: type=1400 audit(1784965269.051:725): avc: denied { watch_sb } for pid=8740 comm="syz.2.812" path="/206/file0" dev="tmpfs" ino=1172 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 116.810502][ T8752] ip6t_srh: unknown srh match flags 4000 [ 116.845608][ T848] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 116.986473][ T8761] atomic_op ffff88802c1f2198 conn xmit_atomic 0000000000000000 [ 116.989959][ T42] audit: type=1400 audit(1784965269.331:726): avc: denied { append } for pid=8760 comm="syz.2.818" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 116.997361][ T42] audit: type=1400 audit(1784965269.331:727): avc: denied { ioctl } for pid=8760 comm="syz.2.818" path="/dev/cachefiles" dev="devtmpfs" ino=4 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 117.004324][ T848] usb 9-1: Using ep0 maxpacket: 8 [ 117.010469][ T848] usb 9-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 117.013945][ T848] usb 9-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 117.017598][ T848] usb 9-1: config 0 interface 0 has no altsetting 0 [ 117.021347][ T848] usb 9-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 117.026335][ T848] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.032338][ T848] usb 9-1: config 0 descriptor?? [ 117.144855][ T8770] ALSA: seq fatal error: cannot create timer (-19) [ 117.190083][ T5851] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x80 [ 117.281499][ T8781] trusted_key: syz.0.822 sent an empty control message without MSG_MORE. [ 117.440547][ T848] hid_parser_main: 15 callbacks suppressed [ 117.440561][ T848] mcp2221 0003:04D8:00DD.0009: unknown main item tag 0x0 [ 117.445947][ T848] mcp2221 0003:04D8:00DD.0009: unknown main item tag 0x0 [ 117.448749][ T848] mcp2221 0003:04D8:00DD.0009: unknown main item tag 0x0 [ 117.451504][ T848] mcp2221 0003:04D8:00DD.0009: unknown main item tag 0x0 [ 117.454731][ T848] mcp2221 0003:04D8:00DD.0009: unknown main item tag 0x0 [ 117.458096][ T848] mcp2221 0003:04D8:00DD.0009: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 117.641774][ T8730] IPv6: NLM_F_REPLACE set, but no existing node found! [ 118.742807][ T848] usb 9-1: reset high-speed USB device number 8 using dummy_hcd [ 118.774377][ T5740] Bluetooth: hci3: command 0x0419 tx timeout [ 119.761527][ T8791] netlink: 12 bytes leftover after parsing attributes in process `syz.4.823'. [ 119.765190][ T8791] 8021q: VLANs not supported on ip6_vti0 [ 120.065198][ T8800] netlink: 'syz.4.825': attribute type 13 has an invalid length. [ 120.072036][ T8772] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 120.077628][ T8800] gretap0: refused to change device tx_queue_len [ 120.080134][ T8800] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 120.123781][ T8811] netlink: 'syz.5.828': attribute type 1 has an invalid length. [ 120.171125][ T8807] ªªªªªªI¡§å!qƒú: renamed from lo (while UP) [ 120.179580][ T8814] netlink: 12 bytes leftover after parsing attributes in process `syz.5.828'. [ 120.239001][ T42] audit: type=1400 audit(1784965272.581:728): avc: denied { getopt } for pid=8820 comm="syz.5.831" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 120.278242][ T8825] Invalid source name [ 120.280712][ T8825] UBIFS error (pid: 8825): cannot open "./file0", error -22 [ 120.290838][ T42] audit: type=1400 audit(1784965272.631:729): avc: denied { read } for pid=8827 comm="syz.5.833" name="ndctl0" dev="devtmpfs" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 120.303277][ T42] audit: type=1400 audit(1784965272.631:730): avc: denied { open } for pid=8827 comm="syz.5.833" path="/dev/ndctl0" dev="devtmpfs" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 120.476306][ T55] usb 9-1: USB disconnect, device number 8 [ 121.968079][ T8853] overlayfs: missing 'lowerdir' [ 122.034756][ T8854] A link change request failed with some changes committed already. Interface ipvlan0 may have been left with an inconsistent configuration, please check. [ 123.208676][ T8816] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 123.223656][ T8853] netlink: 'syz.2.838': attribute type 1 has an invalid length. [ 123.226862][ T8853] netlink: 199820 bytes leftover after parsing attributes in process `syz.2.838'. [ 123.367252][ T42] audit: type=1400 audit(1784965275.701:731): avc: denied { watch } for pid=8871 comm="syz.4.844" path="/189/file0" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 123.379337][ T8873] mac80211_hwsim hwsim10 »»»»»»: renamed from wlan0 [ 123.551280][ T42] audit: type=1400 audit(1784965275.891:732): avc: denied { ioctl } for pid=8904 comm="syz.5.855" path="socket:[33963]" dev="sockfs" ino=33963 ioctlcmd=0x89a1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 123.602074][ T8913] Sensor A: ================= START STATUS ================= [ 123.604535][ T8913] Sensor A: Test Pattern: 75% Colorbar [ 123.610403][ T8913] Sensor A: Show Information: All [ 123.612220][ T8913] Sensor A: Vertical Flip: false [ 123.613822][ T8913] Sensor A: Horizontal Flip: false [ 123.617024][ T8913] Sensor A: Brightness: 128 [ 123.618846][ T8913] Sensor A: Contrast: 128 [ 123.620560][ T8913] Sensor A: Hue: 0 [ 123.622010][ T8913] Sensor A: Saturation: 128 [ 123.623843][ T8913] Sensor A: Pixel Rate: 160000000 [ 123.625897][ T8913] Sensor A: Horizontal Blanking: 800 [ 123.628013][ T8913] Sensor A: Vertical Blanking: 3223 [ 123.630038][ T8913] Sensor A: ================== END STATUS ================== [ 123.637517][ T8920] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 123.639641][ T8920] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 123.642343][ T8920] vhci_hcd vhci_hcd.0: Device attached [ 123.645985][ T8921] usbip_core: unknown command [ 123.647495][ T8921] vhci_hcd: unknown pdu 50331648 [ 123.651418][ T8921] usbip_core: unknown command [ 123.653110][ T42] audit: type=1400 audit(1784965275.991:733): avc: denied { connect } for pid=8912 comm="syz.4.857" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 123.655473][ T5851] vhci_hcd vhci_hcd.4: stop threads [ 123.660162][ T5851] vhci_hcd vhci_hcd.4: release socket [ 123.661926][ T5851] vhci_hcd vhci_hcd.4: disconnect device [ 123.671174][ T42] audit: type=1400 audit(1784965276.011:734): avc: denied { setattr } for pid=8915 comm="syz.0.859" name="NETLINK" dev="sockfs" ino=33135 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 123.904709][ T34] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 123.904918][ T8944] i2c i2c-1: Frontend requested software zigzag, but didn't set the frequency step size [ 123.905418][ T8941] netlink: 12 bytes leftover after parsing attributes in process `syz.4.864'. [ 123.919518][ T8945] netlink: 8 bytes leftover after parsing attributes in process `syz.2.865'. [ 123.923533][ T8945] syzkaller0: entered promiscuous mode [ 123.925847][ T8945] syzkaller0: entered allmulticast mode [ 123.943917][ T8947] exFAT-fs (nbd4): unable to read boot sector [ 123.947260][ T8947] exFAT-fs (nbd4): failed to read boot sector [ 123.949738][ T8947] exFAT-fs (nbd4): failed to recognize exfat type [ 124.075761][ T34] usb 5-1: config 1 has an invalid interface number: 7 but max is 0 [ 124.078597][ T34] usb 5-1: config 1 has no interface number 0 [ 124.080569][ T34] usb 5-1: config 1 interface 7 altsetting 0 bulk endpoint 0xD has invalid maxpacket 16 [ 124.083583][ T34] usb 5-1: config 1 interface 7 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 124.091199][ T34] usb 5-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 124.094405][ T34] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.096865][ T34] usb 5-1: Product: syz [ 124.098288][ T34] usb 5-1: Manufacturer: syz [ 124.099840][ T34] usb 5-1: SerialNumber: syz [ 124.100043][ T8956] netlink: 72 bytes leftover after parsing attributes in process `syz.5.869'. [ 124.104856][ T8916] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 124.109227][ T34] usb 5-1: Expected 3 endpoints, found: 2 [ 124.293389][ T42] audit: type=1400 audit(1784965276.631:735): avc: denied { ioctl } for pid=8969 comm="syz.5.874" path="/dev/nullb0" dev="devtmpfs" ino=707 ioctlcmd=0x125d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 124.297060][ T8970] Trying to write to read-only block-device nullb0 [ 124.526635][ T42] audit: type=1400 audit(1784965276.871:736): avc: denied { setopt } for pid=8977 comm="syz.2.877" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 124.528921][ T8978] netlink: 32 bytes leftover after parsing attributes in process `syz.2.877'. [ 124.744392][ T1047] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 124.894463][ T1047] usb 10-1: Using ep0 maxpacket: 8 [ 124.899286][ T1047] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 124.904112][ T1047] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 124.909732][ T1047] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 124.917692][ T1047] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 124.922178][ T1047] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 124.926406][ T1047] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.953864][ T8993] syzkaller0: entered promiscuous mode [ 124.958024][ T8993] syzkaller0: entered allmulticast mode [ 125.142735][ T1047] usb 10-1: GET_CAPABILITIES returned 0 [ 125.145325][ T1047] usbtmc 10-1:16.0: can't read capabilities [ 125.152165][ T8995] vcan1: entered allmulticast mode [ 125.344248][ T9006] binder: 9005:9006 ioctl c0306201 2000000003c0 returned -14 [ 125.374013][ C0] usbtmc 10-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 125.744530][ T55] usb 10-1: USB disconnect, device number 3 [ 126.621624][ T55] usb 5-1: USB disconnect, device number 15 [ 126.726192][ T9040] netlink: 'syz.5.893': attribute type 1 has an invalid length. [ 126.738183][ T9040] bond1: entered promiscuous mode [ 126.740002][ T9040] 8021q: adding VLAN 0 to HW filter on device bond1 [ 126.745725][ T9043] gfs2: error -5 reading superblock [ 126.749951][ T9040] ipvlan2: entered allmulticast mode [ 126.751613][ T9040] bond1: entered allmulticast mode [ 126.765804][ T9040] bond1: (slave bridge1): making interface the new active one [ 126.768688][ T9040] bridge1: entered promiscuous mode [ 126.771046][ T9040] bridge1: entered allmulticast mode [ 126.774320][ T9040] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 126.786713][ T41] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 126.852450][ T9055] Context (ID=0x0) not attached to queue pair (handle=0x4d7:0x8) [ 126.858004][ T9055] openvswitch: netlink: Actions may not be safe on all matching packets [ 126.862686][ T9055] Context (ID=0x0) not attached to queue pair (handle=0x4d7:0x8) [ 126.956330][ T41] usb 9-1: unable to get BOS descriptor or descriptor too short [ 126.959621][ T41] usb 9-1: config 129 has an invalid interface number: 135 but max is 0 [ 126.962183][ T41] usb 9-1: config 129 has an invalid interface number: 5 but max is 0 [ 126.964869][ T41] usb 9-1: config 129 has 2 interfaces, different from the descriptor's value: 1 [ 126.967720][ T41] usb 9-1: config 129 has no interface number 0 [ 126.969593][ T41] usb 9-1: config 129 has no interface number 1 [ 126.971684][ T41] usb 9-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 126.975997][ T41] usb 9-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30 [ 126.979665][ T41] usb 9-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37 [ 126.983691][ T41] usb 9-1: config 129 interface 135 has no altsetting 0 [ 126.986015][ T41] usb 9-1: config 129 interface 5 has no altsetting 0 [ 126.990456][ T41] usb 9-1: string descriptor 0 read error: -22 [ 126.992410][ T41] usb 9-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.00 [ 126.995530][ T41] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.007178][ T41] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 127.010311][ T41] usb 9-1: MIDIStreaming interface descriptor not found [ 127.045875][ T9] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 127.094363][ T42] audit: type=1326 audit(1784965279.441:737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9075 comm="syz.2.905" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f89de39de99 code=0x0 [ 127.194310][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 127.197903][ T9] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 127.202195][ T9] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 127.205191][ T41] usb 9-1: USB disconnect, device number 9 [ 127.205898][ T9] usb 5-1: config 0 interface 0 has no altsetting 0 [ 127.210507][ T9] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 127.213717][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.228307][ T9] usb 5-1: config 0 descriptor?? [ 127.501467][ T9089] uhci_hcd 0000:00:1d.0: remove, state 1 [ 127.509923][ T9089] usb usb2: USB disconnect, device number 1 [ 127.513134][ T9089] usb 2-1: USB disconnect, device number 2 [ 127.580404][ T9089] uhci_hcd 0000:00:1d.0: USB bus 2 deregistered [ 127.646633][ T9] mcp2221 0003:04D8:00DD.000A: unknown main item tag 0x0 [ 127.648868][ T9] mcp2221 0003:04D8:00DD.000A: unknown main item tag 0x0 [ 127.651182][ T9] mcp2221 0003:04D8:00DD.000A: unknown main item tag 0x0 [ 127.653254][ T9] mcp2221 0003:04D8:00DD.000A: unknown main item tag 0x0 [ 127.655546][ T9] mcp2221 0003:04D8:00DD.000A: unknown main item tag 0x0 [ 127.658208][ T9] mcp2221 0003:04D8:00DD.000A: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 127.668140][ T9090] pci 0000:00:1d.0: [8086:2934] type 00 class 0x0c0300 conventional PCI endpoint [ 127.674567][ T9090] pci 0000:00:1d.0: BAR 4 [io 0xc0e0-0xc0ff] [ 127.688054][ T9090] pci 0000:00:1d.0: Adding to iommu group 7 [ 127.698921][ T9090] pci 0000:00:1d.0: BAR 4 [io 0x2000-0x201f]: assigned [ 127.702284][ T9090] pci 0000:00:04.0: PCI bridge to [bus 01] [ 127.704101][ T9090] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 127.709393][ T9090] pci 0000:00:04.0: bridge window [mem 0xfe800000-0xfe9fffff] [ 127.712814][ T9090] pci 0000:00:04.0: bridge window [mem 0x380000000000-0x3807ffffffff 64bit pref] [ 127.754818][ T9092] 9pnet_virtio: no channels available for device syz [ 127.788646][ T9090] pci 0000:00:1d.0: quirk_usb_early_handoff+0x0/0x1360 took 68306 usecs [ 127.833121][ T42] audit: type=1400 audit(1784965280.171:738): avc: denied { name_bind } for pid=9100 comm="syz.4.914" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 127.834567][ T9090] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 127.843587][ T9047] IPv6: NLM_F_REPLACE set, but no existing node found! [ 127.849909][ T9090] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1 [ 127.852467][ T9090] uhci_hcd 0000:00:1d.0: detected 2 ports [ 127.859671][ T9090] uhci_hcd 0000:00:1d.0: irq 16, io port 0x00002000 [ 127.867176][ T9090] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 127.870697][ T9090] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 127.873120][ T9090] usb usb1: Product: UHCI Host Controller [ 127.874987][ T9090] usb usb1: Manufacturer: Linux syzkaller uhci_hcd [ 127.877303][ T9090] usb usb1: SerialNumber: 0000:00:1d.0 [ 127.890795][ T9090] hub 1-0:1.0: USB hub found [ 127.894289][ T9090] hub 1-0:1.0: 2 ports detected [ 127.935327][ T9] usb 5-1: USB disconnect, device number 16 [ 128.042378][ T42] audit: type=1400 audit(1784965280.381:739): avc: denied { ioctl } for pid=9112 comm="syz.5.919" path="/dev/btrfs-control" dev="devtmpfs" ino=1341 ioctlcmd=0xae9f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 128.089399][ T9115] overlay: Unknown parameter ' [ 128.089399][ T9115] ' [ 128.152450][ T9123] overlayfs: failed to resolve './file0': -2 [ 128.174346][ T41] usb 1-1: new full-speed USB device number 2 using uhci_hcd [ 128.216946][ T42] audit: type=1400 audit(1784965280.561:740): avc: denied { read } for pid=9127 comm="syz.2.924" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 128.363780][ T41] usb 1-1: not running at top speed; connect to a high speed hub [ 128.400691][ T41] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 128.404077][ T41] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 128.407556][ T41] usb 1-1: Product: QEMU USB Tablet [ 128.411763][ T41] usb 1-1: Manufacturer: QEMU [ 128.413478][ T41] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 128.430970][ T41] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb1/1-1/1-1:1.0/0003:0627:0001.000B/input/input18 [ 128.444344][ T9138] geneve1: entered allmulticast mode [ 128.462487][ T25] blk_print_req_error: 129 callbacks suppressed [ 128.462500][ T25] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 128.467651][ T25] buffer_io_error: 138 callbacks suppressed [ 128.467661][ T25] Buffer I/O error on dev nbd0, logical block 0, async page read [ 128.471789][ T25] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 128.474810][ T25] Buffer I/O error on dev nbd0, logical block 1, async page read [ 128.477231][ T25] Buffer I/O error on dev nbd0, logical block 2, async page read [ 128.479551][ T25] Buffer I/O error on dev nbd0, logical block 3, async page read [ 128.482081][ T5105] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 128.488002][ T5105] Buffer I/O error on dev nbd0, logical block 0, async page read [ 128.491230][ T5105] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 128.495152][ T5105] Buffer I/O error on dev nbd0, logical block 1, async page read [ 128.498369][ T5105] Buffer I/O error on dev nbd0, logical block 2, async page read [ 128.499851][ T41] hid-generic 0003:0627:0001.000B: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 128.501866][ T5105] Buffer I/O error on dev nbd0, logical block 3, async page read [ 128.512692][ T9145] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 128.516633][ T9145] Buffer I/O error on dev nbd0, logical block 0, async page read [ 128.519821][ T9145] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 128.523649][ T9145] Buffer I/O error on dev nbd0, logical block 1, async page read [ 128.527514][ T2245] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 128.532926][ T2245] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 128.538274][ T2245] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 128.542424][ T2245] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 128.546681][ T9140] ldm_validate_partition_table(): Disk read failed. [ 128.551176][ T9140] Dev nbd0: unable to read RDB block 0 [ 128.553989][ T9140] nbd0: unable to read partition table [ 128.693403][ T9157] kvm: apic: phys broadcast and lowest prio [ 128.707979][ T9158] kvm: vcpu 1: requested lapic timer restore with starting count register 0x390=2547280607 (20378244856 ns) > initial count (3958255696 ns). Using initial count to start timer. [ 128.751303][ T9165] ubi0: attaching mtd0 [ 128.755703][ T9165] ubi0: scanning is finished [ 128.757678][ T9165] ubi0: empty MTD device detected [ 128.759830][ T9165] ubi0 error: ubi_read_volume_table: LEB size too small for a volume record [ 128.902525][ T9155] [ 128.903604][ T9155] ====================================================== [ 128.906457][ T9155] WARNING: possible circular locking dependency detected [ 128.909260][ T9155] syzkaller #0 Tainted: G L [ 128.911797][ T9155] ------------------------------------------------------ [ 128.914669][ T9155] syz.0.933/9155 is trying to acquire lock: [ 128.915327][ T42] audit: type=1400 audit(1784965281.261:741): avc: denied { create } for pid=9167 comm="syz.2.937" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 128.917064][ T9155] ffff88801d2a6210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_link_sibling+0x555/0x850 [ 128.927977][ T9155] [ 128.927977][ T9155] but task is already holding lock: [ 128.931014][ T9155] ffff88801d2a6180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x38/0xaa0 [ 128.934783][ T9155] [ 128.934783][ T9155] which lock already depends on the new lock. [ 128.934783][ T9155] [ 128.938973][ T9155] [ 128.938973][ T9155] the existing dependency chain (in reverse order) is: [ 128.942592][ T9155] [ 128.942592][ T9155] -> #9 (&root->kernfs_rwsem){++++}-{4:4}: [ 128.945831][ T9155] lock_acquire+0x1b9/0x370 [ 128.947887][ T9155] down_write+0x8b/0x1f0 [ 128.949862][ T9155] kernfs_add_one+0x38/0xaa0 [ 128.951931][ T9155] kernfs_create_dir_ns+0x157/0x2b0 [ 128.954257][ T9155] internal_create_group+0x36f/0xfb0 [ 128.956619][ T9155] cpuhp_invoke_callback+0x3b4/0x9a0 [ 128.959067][ T9155] cpuhp_issue_call+0x1b8/0x970 [ 128.961259][ T9155] __cpuhp_setup_state_cpuslocked+0x431/0x880 [ 128.963662][ T9155] __cpuhp_setup_state+0xf4/0x2f0 [ 128.965295][ T9155] do_one_initcall+0x11d/0x700 [ 128.966922][ T9155] kernel_init_freeable+0x6ea/0x7b0 [ 128.968696][ T9155] kernel_init+0x1f/0x1e0 [ 128.970227][ T9155] ret_from_fork+0x72b/0xd50 [ 128.971816][ T9155] ret_from_fork_asm+0x1a/0x30 [ 128.973442][ T9155] [ 128.973442][ T9155] -> #8 (cpuhp_state_mutex){+.+.}-{4:4}: [ 128.975837][ T9155] [ 128.975837][ T9155] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 128.978135][ T9155] lock_acquire+0x1b9/0x370 [ 128.979630][ T9155] cpus_read_lock+0x42/0x170 [ 128.981136][ T9155] static_key_slow_inc+0x12/0x30 [ 128.982777][ T9155] nbd_genl_reconfigure+0xd82/0x1a00 [ 128.984542][ T9155] genl_family_rcv_msg_doit+0x214/0x300 [ 128.986353][ T9155] genl_rcv_msg+0x560/0x800 [ 128.987894][ T9155] netlink_rcv_skb+0x159/0x420 [ 128.989516][ T9155] genl_rcv+0x28/0x40 [ 128.990913][ T9155] netlink_unicast+0x585/0x850 [ 128.992487][ T9155] netlink_sendmsg+0x8b0/0xda0 [ 128.994069][ T9155] ____sys_sendmsg+0xa4d/0xbe0 [ 128.995669][ T9155] ___sys_sendmsg+0x190/0x1e0 [ 128.997273][ T9155] __sys_sendmsg+0x160/0x210 [ 128.998832][ T9155] do_syscall_64+0x115/0x870 [ 129.000430][ T9155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.002356][ T9155] [ 129.002356][ T9155] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 129.004643][ T9155] lock_acquire+0x1b9/0x370 [ 129.006184][ T9155] __mutex_lock+0x1a4/0x1bd0 [ 129.007741][ T9155] nbd_queue_rq+0x428/0x1080 [ 129.009293][ T9155] blk_mq_dispatch_rq_list+0x422/0x1e70 [ 129.011098][ T9155] __blk_mq_sched_dispatch_requests+0xcea/0x1620 [ 129.013111][ T9155] blk_mq_sched_dispatch_requests+0xd7/0x1c0 [ 129.015142][ T9155] blk_mq_run_work_fn+0x135/0x380 [ 129.016791][ T9155] process_one_work+0xa23/0x1940 [ 129.018421][ T9155] worker_thread+0x5ef/0xe50 [ 129.019946][ T9155] kthread+0x370/0x450 [ 129.021306][ T9155] ret_from_fork+0x72b/0xd50 [ 129.022806][ T9155] ret_from_fork_asm+0x1a/0x30 [ 129.024393][ T9155] [ 129.024393][ T9155] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 129.026544][ T9155] lock_acquire+0x1b9/0x370 [ 129.028067][ T9155] __mutex_lock+0x1a4/0x1bd0 [ 129.029575][ T9155] nbd_queue_rq+0xba/0x1080 [ 129.031068][ T9155] blk_mq_dispatch_rq_list+0x422/0x1e70 [ 129.032927][ T9155] __blk_mq_sched_dispatch_requests+0xcea/0x1620 [ 129.034970][ T9155] blk_mq_sched_dispatch_requests+0xd7/0x1c0 [ 129.036953][ T9155] blk_mq_run_work_fn+0x135/0x380 [ 129.038593][ T9155] process_one_work+0xa23/0x1940 [ 129.040196][ T9155] worker_thread+0x5ef/0xe50 [ 129.041724][ T9155] kthread+0x370/0x450 [ 129.043154][ T9155] ret_from_fork+0x72b/0xd50 [ 129.044772][ T9155] ret_from_fork_asm+0x1a/0x30 [ 129.046341][ T9155] [ 129.046341][ T9155] -> #4 (set->srcu){.+.+}-{0:0}: [ 129.048446][ T9155] lock_sync+0x9d/0x110 [ 129.049879][ T9155] __synchronize_srcu+0xa2/0x300 [ 129.051517][ T9155] blk_mq_quiesce_queue+0x149/0x1c0 [ 129.053246][ T9155] elevator_switch+0x17b/0x7e0 [ 129.054840][ T9155] elevator_change+0x352/0x530 [ 129.056448][ T9155] elevator_set_default+0x29e/0x360 [ 129.058195][ T9155] blk_register_queue+0x48e/0x630 [ 129.059868][ T9155] __add_disk+0x73f/0xe40 [ 129.061350][ T9155] add_disk_fwnode+0x118/0x480 [ 129.062917][ T9155] nbd_dev_add+0x77a/0xb10 [ 129.064420][ T9155] nbd_init+0x291/0x2b0 [ 129.065838][ T9155] do_one_initcall+0x11d/0x700 [ 129.067415][ T9155] kernel_init_freeable+0x6ea/0x7b0 [ 129.069137][ T9155] kernel_init+0x1f/0x1e0 [ 129.070613][ T9155] ret_from_fork+0x72b/0xd50 [ 129.072171][ T9155] ret_from_fork_asm+0x1a/0x30 [ 129.073772][ T9155] [ 129.073772][ T9155] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 129.076119][ T9155] lock_acquire+0x1b9/0x370 [ 129.077637][ T9155] __mutex_lock+0x1a4/0x1bd0 [ 129.079201][ T9155] elevator_change+0x1bc/0x530 [ 129.080781][ T9155] elevator_set_none+0x92/0xf0 [ 129.082390][ T9155] blk_mq_update_nr_hw_queues+0x4c1/0x15f0 [ 129.084338][ T9155] nbd_start_device+0x1a6/0xbd0 [ 129.085986][ T9155] nbd_genl_connect+0xff2/0x1a40 [ 129.087613][ T9155] genl_family_rcv_msg_doit+0x214/0x300 [ 129.089428][ T9155] genl_rcv_msg+0x560/0x800 [ 129.090965][ T9155] netlink_rcv_skb+0x159/0x420 [ 129.092571][ T9155] genl_rcv+0x28/0x40 [ 129.093989][ T9155] netlink_unicast+0x585/0x850 [ 129.095651][ T9155] netlink_sendmsg+0x8b0/0xda0 [ 129.097288][ T9155] ____sys_sendmsg+0xa4d/0xbe0 [ 129.098935][ T9155] ___sys_sendmsg+0x190/0x1e0 [ 129.100551][ T9155] __sys_sendmsg+0x160/0x210 [ 129.102061][ T9155] do_syscall_64+0x115/0x870 [ 129.103589][ T9155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.105507][ T9155] [ 129.105507][ T9155] -> #2 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 129.107997][ T9155] lock_acquire+0x1b9/0x370 [ 129.109543][ T9155] blk_alloc_queue+0x610/0x790 [ 129.111095][ T9155] blk_mq_alloc_queue+0x174/0x290 [ 129.112708][ T9155] __blk_mq_alloc_disk+0x29/0x120 [ 129.114326][ T9155] nbd_dev_add+0x492/0xb10 [ 129.115766][ T9155] nbd_init+0x291/0x2b0 [ 129.117142][ T9155] do_one_initcall+0x11d/0x700 [ 129.118689][ T9155] kernel_init_freeable+0x6ea/0x7b0 [ 129.120346][ T9155] kernel_init+0x1f/0x1e0 [ 129.121765][ T9155] ret_from_fork+0x72b/0xd50 [ 129.123279][ T9155] ret_from_fork_asm+0x1a/0x30 [ 129.124821][ T9155] [ 129.124821][ T9155] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 129.126970][ T9155] lock_acquire+0x1b9/0x370 [ 129.128480][ T9155] fs_reclaim_acquire+0xc4/0x100 [ 129.130149][ T9155] kmem_cache_alloc_noprof+0x63/0x6a0 [ 129.131901][ T9155] __kernfs_iattrs+0x126/0x450 [ 129.133483][ T9155] __kernfs_setattr+0x4d/0x3c0 [ 129.135021][ T9155] kernfs_iop_setattr+0xda/0x130 [ 129.136716][ T9155] notify_change+0xb25/0x1330 [ 129.138319][ T9155] do_truncate+0x1df/0x240 [ 129.139907][ T9155] path_openat+0x370f/0x4280 [ 129.141483][ T9155] do_file_open+0x20e/0x430 [ 129.143036][ T9155] do_sys_openat2+0x10f/0x1e0 [ 129.144545][ T9155] __x64_sys_openat+0x12d/0x210 [ 129.146139][ T9155] do_syscall_64+0x115/0x870 [ 129.147706][ T9155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.149600][ T9155] [ 129.149600][ T9155] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 129.152083][ T9155] check_prev_add+0xeb/0xe60 [ 129.153577][ T9155] __lock_acquire+0x136c/0x1a40 [ 129.155142][ T9155] lock_acquire+0x1b9/0x370 [ 129.156667][ T9155] down_write+0x8b/0x1f0 [ 129.158078][ T9155] kernfs_link_sibling+0x555/0x850 [ 129.159734][ T9155] kernfs_add_one+0x1e7/0xaa0 [ 129.161278][ T9155] kernfs_create_dir_ns+0x157/0x2b0 [ 129.162967][ T9155] sysfs_create_dir_ns+0x13a/0x2b0 [ 129.164625][ T9155] kobject_add_internal+0x2c8/0x930 [ 129.166327][ T9155] kobject_add+0x16a/0x1e0 [ 129.167801][ T9155] elevator_change_done+0x252/0x650 [ 129.169493][ T9155] elv_update_nr_hw_queues+0x1ea/0x2b0 [ 129.171260][ T9155] blk_mq_update_nr_hw_queues+0x900/0x15f0 [ 129.173119][ T9155] nbd_start_device+0x1a6/0xbd0 [ 129.174703][ T9155] nbd_genl_connect+0xff2/0x1a40 [ 129.176349][ T9155] genl_family_rcv_msg_doit+0x214/0x300 [ 129.178232][ T9155] genl_rcv_msg+0x560/0x800 [ 129.179739][ T9155] netlink_rcv_skb+0x159/0x420 [ 129.181354][ T9155] genl_rcv+0x28/0x40 [ 129.182731][ T9155] netlink_unicast+0x585/0x850 [ 129.184359][ T9155] netlink_sendmsg+0x8b0/0xda0 [ 129.185977][ T9155] ____sys_sendmsg+0xa4d/0xbe0 [ 129.187622][ T9155] ___sys_sendmsg+0x190/0x1e0 [ 129.189253][ T9155] __sys_sendmsg+0x160/0x210 [ 129.190831][ T9155] do_syscall_64+0x115/0x870 [ 129.192410][ T9155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.194291][ T9155] [ 129.194291][ T9155] other info that might help us debug this: [ 129.194291][ T9155] [ 129.197315][ T9155] Chain exists of: [ 129.197315][ T9155] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 129.197315][ T9155] [ 129.201411][ T9155] Possible unsafe locking scenario: [ 129.201411][ T9155] [ 129.203582][ T9155] CPU0 CPU1 [ 129.205150][ T9155] ---- ---- [ 129.206729][ T9155] lock(&root->kernfs_rwsem); [ 129.208160][ T9155] lock(cpuhp_state_mutex); [ 129.210253][ T9155] lock(&root->kernfs_rwsem); [ 129.212392][ T9155] lock(&root->kernfs_iattr_rwsem); [ 129.213923][ T9155] [ 129.213923][ T9155] *** DEADLOCK *** [ 129.213923][ T9155] [ 129.216268][ T9155] 5 locks held by syz.0.933/9155: [ 129.217762][ T9155] #0: ffffffff90b4da28 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 129.220121][ T9155] #1: ffffffff90b4dae0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x57b/0x800 [ 129.222894][ T9155] #2: ffff88802954f1c0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0x9d/0x15f0 [ 129.226219][ T9155] #3: ffff88802954f0d0 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xb0/0x15f0 [ 129.229501][ T9155] #4: ffff88801d2a6180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x38/0xaa0 [ 129.232521][ T9155] [ 129.232521][ T9155] stack backtrace: [ 129.234344][ T9155] CPU: 0 UID: 0 PID: 9155 Comm: syz.0.933 Tainted: G L syzkaller #0 PREEMPT(full) [ 129.234361][ T9155] Tainted: [L]=SOFTLOCKUP [ 129.234364][ T9155] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 129.234371][ T9155] Call Trace: [ 129.234375][ T9155] [ 129.234379][ T9155] dump_stack_lvl+0x100/0x190 [ 129.234393][ T9155] print_circular_bug.cold+0x178/0x1c7 [ 129.234410][ T9155] check_noncircular+0x146/0x160 [ 129.234422][ T9155] ? __bfs+0x150/0x2a0 [ 129.234432][ T9155] check_prev_add+0xeb/0xe60 [ 129.234444][ T9155] __lock_acquire+0x136c/0x1a40 [ 129.234458][ T9155] lock_acquire+0x1b9/0x370 [ 129.234470][ T9155] ? kernfs_link_sibling+0x555/0x850 [ 129.234481][ T9155] ? __pfx___might_resched+0x10/0x10 [ 129.234494][ T9155] down_write+0x8b/0x1f0 [ 129.234506][ T9155] ? kernfs_link_sibling+0x555/0x850 [ 129.234516][ T9155] ? __pfx_down_write+0x10/0x10 [ 129.234529][ T9155] kernfs_link_sibling+0x555/0x850 [ 129.234541][ T9155] kernfs_add_one+0x1e7/0xaa0 [ 129.234553][ T9155] kernfs_create_dir_ns+0x157/0x2b0 [ 129.234566][ T9155] sysfs_create_dir_ns+0x13a/0x2b0 [ 129.234582][ T9155] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 129.234598][ T9155] ? lock_acquire+0x1b9/0x370 [ 129.234610][ T9155] ? rcu_is_watching+0x12/0xc0 [ 129.234625][ T9155] ? kfree_const+0x5a/0x70 [ 129.234636][ T9155] kobject_add_internal+0x2c8/0x930 [ 129.234652][ T9155] kobject_add+0x16a/0x1e0 [ 129.234666][ T9155] ? __pfx_kobject_add+0x10/0x10 [ 129.234680][ T9155] ? __mutex_unlock_slowpath+0x35d/0x930 [ 129.234693][ T9155] elevator_change_done+0x252/0x650 [ 129.234706][ T9155] ? lockdep_hardirqs_on+0x78/0x100 [ 129.234717][ T9155] ? __pfx_elevator_change_done+0x10/0x10 [ 129.234729][ T9155] ? elv_update_nr_hw_queues+0x1c7/0x2b0 [ 129.234743][ T9155] elv_update_nr_hw_queues+0x1ea/0x2b0 [ 129.234757][ T9155] blk_mq_update_nr_hw_queues+0x900/0x15f0 [ 129.234793][ T9155] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 129.234811][ T9155] ? sysfs_create_file_ns+0x14c/0x1e0 [ 129.234826][ T9155] ? __pfx_sysfs_create_file_ns+0x10/0x10 [ 129.234843][ T9155] nbd_start_device+0x1a6/0xbd0 [ 129.234858][ T9155] nbd_genl_connect+0xff2/0x1a40 [ 129.234873][ T9155] ? __pfx_nbd_genl_connect+0x10/0x10 [ 129.234886][ T9155] ? __nla_parse+0x40/0x60 [ 129.234896][ T9155] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 129.234909][ T9155] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 129.234922][ T9155] genl_family_rcv_msg_doit+0x214/0x300 [ 129.234935][ T9155] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 129.234946][ T9155] ? genl_get_cmd+0x3e7/0x760 [ 129.234957][ T9155] ? ____sys_sendmsg+0xa4d/0xbe0 [ 129.234973][ T9155] ? ___sys_sendmsg+0x190/0x1e0 [ 129.234987][ T9155] ? __radix_tree_lookup+0x217/0x2b0 [ 129.234998][ T9155] genl_rcv_msg+0x560/0x800 [ 129.235010][ T9155] ? __pfx_genl_rcv_msg+0x10/0x10 [ 129.235021][ T9155] ? __pfx_nbd_genl_connect+0x10/0x10 [ 129.235035][ T9155] ? __lock_acquire+0x49f/0x1a40 [ 129.235048][ T9155] netlink_rcv_skb+0x159/0x420 [ 129.235057][ T9155] ? __pfx_genl_rcv_msg+0x10/0x10 [ 129.235068][ T9155] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 129.235080][ T9155] ? netlink_deliver_tap+0x1ae/0xcc0 [ 129.235099][ T9155] genl_rcv+0x28/0x40 [ 129.235109][ T9155] netlink_unicast+0x585/0x850 [ 129.235119][ T9155] ? __pfx_netlink_unicast+0x10/0x10 [ 129.235129][ T9155] ? __pfx_sock_has_perm+0x10/0x10 [ 129.235143][ T9155] netlink_sendmsg+0x8b0/0xda0 [ 129.235153][ T9155] ? __pfx_netlink_sendmsg+0x10/0x10 [ 129.235163][ T9155] ? selinux_socket_sendmsg+0x198/0x2f0 [ 129.235178][ T9155] ____sys_sendmsg+0xa4d/0xbe0 [ 129.235192][ T9155] ? __pfx_netlink_sendmsg+0x10/0x10 [ 129.235202][ T9155] ? __pfx_____sys_sendmsg+0x10/0x10 [ 129.235218][ T9155] ? plist_check_list+0x1b8/0x280 [ 129.235233][ T9155] ? plist_del+0x308/0x510 [ 129.235247][ T9155] ___sys_sendmsg+0x190/0x1e0 [ 129.235263][ T9155] ? __pfx____sys_sendmsg+0x10/0x10 [ 129.235278][ T9155] ? __lock_acquire+0x49f/0x1a40 [ 129.235290][ T9155] ? futex_wake+0x220/0x5e0 [ 129.235305][ T9155] __sys_sendmsg+0x160/0x210 [ 129.235317][ T9155] ? __pfx___sys_sendmsg+0x10/0x10 [ 129.235332][ T9155] do_syscall_64+0x115/0x870 [ 129.235343][ T9155] ? clear_bhb_loop+0x40/0x90 [ 129.235354][ T9155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.235365][ T9155] RIP: 0033:0x7feab5f9de99 [ 129.235374][ T9155] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.235385][ T9155] RSP: 002b:00007feab6e77028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 129.235395][ T9155] RAX: ffffffffffffffda RBX: 00007feab6225fa0 RCX: 00007feab5f9de99 [ 129.235402][ T9155] RDX: 0000000000000004 RSI: 0000200000001ac0 RDI: 0000000000000006 [ 129.235408][ T9155] RBP: 00007feab6033eaf R08: 0000000000000000 R09: 0000000000000000 [ 129.235414][ T9155] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 129.235420][ T9155] R13: 00007feab6226038 R14: 00007feab6225fa0 R15: 00007ffcaa63e298 [ 129.235429][ T9155] [ 129.465251][ T9165] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 132.536106][ T1444] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.538501][ T1444] ieee802154 phy1 wpan1: encryption failed: -22