last executing test programs: 2.985080037s ago: executing program 0 (id=37): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x2c, r0, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xcb}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001a80)={0x48, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME={0x22, 0x33, @action={{{}, {}, @broadcast, @device_a, @from_mac=@broadcast, {0x0, 0xff}}, @ext_ch_sw={0x4, 0x4, {{0x0, 0x0, 0x5}, @void}}}}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x6, 0xcd, [0x0]}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 2.957736134s ago: executing program 0 (id=40): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000500)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', 0x0}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) close(r4) r5 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000005c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@newtfilter={0x70, 0x2c, 0xf3f, 0x70fd2c, 0x25dddbbf, {0x0, 0x0, 0x0, r6, {0x5, 0x3da48c8682330ab8}, {}, {0x7, 0xfffa}}, [@filter_kind_options=@f_basic={{0xa}, {0x40, 0x2, [@TCA_BASIC_EMATCHES={0x3c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x0, 0x7, 0x5}, {{0x1}, {0x0, 0x0, 0x0, 0x1}}}}, @TCF_EM_CMP={0x18, 0x2, 0x0, 0x0, {{0x5, 0x1, 0x1}, {0x4, 0x1, 0x7, 0x2, 0x5, 0x1, 0x1}}}]}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x20045080}, 0x4880) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f00000007c0)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r2, &(0x7f0000000800)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r3, 0x41}, 0x80, &(0x7f00000008c0)=[{&(0x7f0000000280)="5de82ae03c00bcac63", 0x9}], 0x1}, 0x0) 2.303712189s ago: executing program 0 (id=52): r0 = fsopen(&(0x7f0000000200)='btrfs\x00', 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) creat(&(0x7f0000000340)='./proc/sys/kernel/pid_max\x00', 0x104) openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/sys/kernel/pid_max\x00', 0x0, 0x0) ioctl$CDROMPLAYMSF(r2, 0x5303, &(0x7f0000000140)={0x8, 0xe1, 0x6, 0x8, 0xf2, 0x1}) r3 = syz_open_dev$video4linux(&(0x7f0000000000), 0xd, 0x123002) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8905, &(0x7f0000000700)={'pim6reg1\x00', @broadcast}) r5 = socket$inet6(0xa, 0x3, 0x7) socket(0x11, 0x1, 0x800) mkdirat(0xffffffffffffffff, &(0x7f0000000580)='./config\x00', 0x1c0) mount(0x0, &(0x7f00000005c0)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x1, 0x0) write(r6, &(0x7f0000000680)='MSF', 0x3) sendmmsg$inet6(r5, &(0x7f0000000180)=[{{&(0x7f00000001c0)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[], 0x28}}], 0x1, 0x0) recvfrom$inet6(r5, 0x0, 0x0, 0x10002, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r3, 0xc0585605, &(0x7f0000000040)={0x0, 0x0, {0x2, 0x2, 0x1016, 0x8, 0x0, 0xa, 0x0, 0x1}}) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000005000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) r7 = socket$rds(0x15, 0x5, 0x0) setsockopt$sock_int(r7, 0x1, 0x3c, &(0x7f00000003c0)=0x1, 0x4) bind$rds(r7, &(0x7f0000000400)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000480)={0x2, 0x4e1f, @empty}, 0x10, &(0x7f0000000900)=[{&(0x7f0000000780)=""/213, 0xd5}, {&(0x7f0000000880)=""/106, 0x6a}], 0x1000000000000044, &(0x7f0000000740)=[@rdma_map={0x30, 0x114, 0x3, {{&(0x7f00000004c0)=""/67, 0x43}, &(0x7f0000000540), 0x19}}], 0x30, 0x11}, 0x24000001) mkdir(&(0x7f0000000980)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000009c0)='./file0\x00', &(0x7f0000000a00), 0x8, &(0x7f0000000a40)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 1.949595167s ago: executing program 3 (id=56): syz_create_resource$binfmt(&(0x7f00000000c0)='./file0\x00') r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl(r0, 0x400452c8, &(0x7f00000003c0)="000000000000000000000000000000000000000001") mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./dev\x00', &(0x7f0000000480)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./dev/rfcomm0\x00', 0x802, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) write$P9_RREAD(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="0b000000750100000008c838ba38ce0dd28448c473a139"], 0xb) ioctl$FS_IOC_GETFSLABEL(r2, 0x400452c9, &(0x7f0000000600)) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r5, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{0x561}]}) sendmsg$DEVLINK_CMD_PORT_SPLIT(0xffffffffffffffff, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x4000040) bind$inet6(0xffffffffffffffff, 0x0, 0x0) open(&(0x7f0000000740)='./file0\x00', 0x60840, 0x0) gettid() r6 = socket$igmp(0x2, 0x3, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) setsockopt$MRT_INIT(r6, 0x0, 0xc8, &(0x7f0000000780), 0x4) setsockopt$MRT_ADD_VIF(r6, 0x0, 0xca, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r7, 0x0, 0x23, &(0x7f0000000800)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x3e, &(0x7f0000000840)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x7, 0x0, 0x0, 0x3, 0xc58, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @dev={0xac, 0x14, 0x14, 0x44}}}}}}}, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000880)='net/ip_mr_cache\x00') pread64(r8, &(0x7f00000008c0)=""/253, 0xfd, 0x1) syz_usbip_server_init(0x1) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r9, 0xc0a85320, &(0x7f0000000200)={{0x80, 0xbd}, 'port1\x00', 0x72, 0x11cfa, 0x0, 0x8000008, 0x3, 0x32cbe4cd, 0x1}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r9, 0x40505330, &(0x7f00000002c0)={0x800100, 0x101, 0x6, 0xe1d9, 0x4}) 1.619921744s ago: executing program 2 (id=67): r0 = syz_genetlink_get_family_id$devlink(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_DEL(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a80)={0x34, r0, 0x6ae3e61d32b8160b, 0x0, 0x25dfdbfb, {0x4a}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x4000c00) 1.560388294s ago: executing program 2 (id=68): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000051}, 0x4044850) sendmsg$NFT_BATCH(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1400000010000100f5000000000000000300000a2c000000050a010100000000000000000a00000a0900010073797a3100"], 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) 1.560157122s ago: executing program 2 (id=69): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000500), 0x204, 0x2) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001680), 0x181002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001740)={0x6, 0x9, &(0x7f0000001800)=@raw=[@generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x3, 0x0, 0x0, 0xc}, @generic={0xb7, 0x5}, @generic={0x85, 0x0, 0x0, 0x0, 0x63}, @generic={0x15, 0x0, 0x0, 0x2}, @generic={0xbf, 0x1}, @generic={0x85, 0x0, 0x0, 0x0, 0x56}, @generic={0x95}], &(0x7f0000001880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x12, r1, 0x108000) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1c0000005e0021a555"], 0x1c}, 0x1, 0x0, 0x0, 0x48050}, 0x0) recvmmsg$unix(r2, &(0x7f0000000600)=[{{0x0, 0x3f, &(0x7f0000000640)=[{&(0x7f0000000680)=""/4096, 0x1000}], 0x1}}], 0x4000000000003b9, 0x26022, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) pipe(&(0x7f00000000c0)) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf0}}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x2000008, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000140)={'wg1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@newqdisc={0x24, 0x24, 0xd0f, 0xfffffffd, 0x25dfdbfe, {0x60, 0x0, 0x0, r6, {0x0, 0xa}, {0xffff, 0xffff}}}, 0x24}}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1.399405579s ago: executing program 0 (id=70): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x401}, 0x20}}, 0x4004) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r3, @ANYBLOB="0600eb001f0800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x28000) 1.39868493s ago: executing program 2 (id=71): r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='.\x00', 0x0, 0x0) fcntl$notify(r0, 0x402, 0x8000002c) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000180)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r2, &(0x7f0000000000)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f00000000c0)={0x30, 0x3, 0x8, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x88ca}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}, @CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @icmpv6=[@CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x18000}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x880) close_range(r1, 0xffffffffffffffff, 0x0) 1.398574384s ago: executing program 0 (id=72): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="185300001000000000000000000fd91d8520"], &(0x7f0000000080)='syzkaller\x00', 0x5}, 0x94) 1.350737829s ago: executing program 2 (id=73): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000080)={&(0x7f00000000c0)={0xa, 0x4e24, 0xb, @loopback, 0x5}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000140)="13", 0x1}], 0x1}, 0x48043) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000180)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x48, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000280)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) pipe2$9p(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r3, &(0x7f0000000380)={0x7, 0x1b, 0x2}, 0xffffff9a) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0xfffffff7, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffb9, 0x1a}, 0x9c) 1.350600591s ago: executing program 0 (id=74): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000540)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x0, 0x0, 0xffffffffffff8001, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x90, 0x2, "", [{{0x9, 0x4, 0x0, 0x0, 0x12, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x582, 0x1}}, {[{{0x9, 0x5, 0x81, 0x3, 0x10, 0x8, 0x1, 0x6}}], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x4}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x9}}}}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000005c0)={0x14, 0x0, &(0x7f0000000600)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) ioctl(r0, 0x8914, &(0x7f0000000640)="7573623000000000000000000000000001") 1.34221623s ago: executing program 3 (id=75): r0 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$XFS_IOC_GETBMAP(r0, 0xc0205826, &(0x7f0000000000)={0x0, 0x8000, 0x81, 0x2, 0x3}) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RCLUNK(r1, &(0x7f0000000080)={0x7, 0x79, 0x2}, 0x7) (async) bind$l2tp6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xd}, 0x20) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write$nbd(r3, &(0x7f0000000140)={0x67446698, 0x1, 0x1, 0x1, 0x3, "27194e9a9147eb0ba8b0dcc289197b9583d055ec7f3b2463acf1bb5c7f1b47067d319ce26c2d480fad7bfe759b6d9f1cb61a48a9c844621114a643640fb3"}, 0x4e) (async, rerun: 32) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) (async, rerun: 32) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000001c0)={0x1}, &(0x7f0000000200)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000240)={r5, 0x4, 0x20}, 0xc) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000280)={{0x1, 0x1, 0x18, r4, {0x4}}, './file0\x00'}) setsockopt$inet6_udp_encap(r6, 0x11, 0x64, &(0x7f00000002c0)=0x2, 0x4) (async) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), 0xffffffffffffffff) (async) getsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f0000000380)={@local, @local, 0x0}, &(0x7f00000003c0)=0xc) (async) getsockopt$inet_pktinfo(r6, 0x0, 0x8, &(0x7f0000000400)={0x0, @multicast1, @local}, &(0x7f0000000440)=0xc) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r6, 0x89f8, &(0x7f0000000540)={'syztnl2\x00', &(0x7f0000000480)={'erspan0\x00', 0x0, 0x1, 0x10, 0x101, 0x4, {{0x23, 0x4, 0x0, 0x1f, 0x8c, 0x67, 0x0, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@ssrr={0x89, 0x1b, 0xd3, [@rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @empty, @private=0xa010102, @loopback]}, @ssrr={0x89, 0x1b, 0x4a, [@dev={0xac, 0x14, 0x14, 0x35}, @dev={0xac, 0x14, 0x14, 0x33}, @empty, @remote, @multicast1, @private=0xa010101]}, @cipso={0x86, 0x3c, 0x2, [{0x5, 0xb, "187f552f818b3160fa"}, {0x7, 0xc, "1d6c0bdd0b19f21ae0b6"}, {0x7, 0x10, "dc686650b46956bba5eee09b8b5a"}, {0x1, 0x5, "8e2362"}, {0x6, 0xa, "504682c2ebf7d9f4"}]}, @end, @generic={0x86, 0x2}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000600)={'syztnl1\x00', &(0x7f0000000580)={'ip6gre0\x00', 0x0, 0x2f, 0xfb, 0x7, 0x7f, 0x20, @empty, @dev={0xfe, 0x80, '\x00', 0x16}, 0x7, 0x8000, 0x5, 0xa}}) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000640)={'veth1_to_hsr\x00', 0x0}) (rerun: 32) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r6, &(0x7f0000000880)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x14440000}, 0xc, &(0x7f0000000840)={&(0x7f0000000680)={0x190, r7, 0x100, 0x70bd29, 0x25dfdbff, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}]}, 0x190}, 0x1, 0x0, 0x0, 0x15}, 0x4000000) ptrace$pokeuser(0x6, 0xffffffffffffffff, 0x4, 0x2) ioctl$F2FS_IOC_GET_PIN_FILE(r2, 0x8004f50e, &(0x7f00000008c0)) (async) r13 = creat(&(0x7f0000000900)='./file0\x00', 0x100) setsockopt$IP_VS_SO_SET_DEL(r13, 0x0, 0x484, &(0x7f0000000940)={0x1d, @rand_addr=0x64010100, 0x4e20, 0x2, 'sed\x00', 0x21, 0xc, 0x7b}, 0x2c) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r13, 0xc0c89425, &(0x7f0000000980)={"6864e8ce999778f126e77fd45c7298b5", 0x0, 0x0, {0x8e2, 0x7}, {0x7fffffffffffffff, 0x2}, 0x12, [0xf3, 0x29, 0xb9, 0x7, 0xe, 0x5, 0x2, 0x8, 0x10000, 0x0, 0x5, 0x6, 0x82, 0x4, 0x6, 0x9]}) (async) ioctl$BTRFS_IOC_BALANCE_V2(r3, 0xc4009420, &(0x7f0000000a80)={0xa, 0x5, {0x4, @struct={0x8, 0x3}, 0x0, 0x9, 0x1, 0xcb, 0xff, 0x9, 0x406, @struct={0x0, 0x3}, 0x44, 0x7ff, [0xff, 0x90a, 0x9, 0x5, 0x7, 0xa45]}, {0x3c32, @struct={0x0, 0x7}, 0x0, 0x4, 0x6, 0x1, 0x5, 0xffffffffffffff81, 0x1, @struct={0xfe5, 0xfffffffa}, 0x3, 0x8, [0x2, 0x5, 0x5, 0x7fffffff, 0x8000, 0x5]}, {0x100000001, @struct={0x2, 0x4}, 0x0, 0x8000000000000000, 0xfffffffeffffffff, 0x8, 0x9, 0x0, 0x6a, @struct={0x81, 0x4}, 0xffff6b46, 0x7f, [0x10001, 0x0, 0x280000000, 0x5, 0x969, 0x8]}, {0x3, 0x7fffffff, 0x1}}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r4, 0x50009417, &(0x7f0000000e80)={{r0}, r14, 0x8, @unused=[0x5, 0x4, 0x7, 0x3], @devid=r15}) (async, rerun: 32) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r13, 0x84, 0x77, &(0x7f0000001e80)={r5, 0x3, 0x6, [0x1, 0x100, 0x9, 0x0, 0xff5e, 0x5]}, 0x14) (rerun: 32) r16 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$sock_buf(r16, 0x1, 0x37, &(0x7f0000001ec0)=""/208, &(0x7f0000001fc0)=0xd0) (async, rerun: 32) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r3, 0x2) (rerun: 32) 1.250282388s ago: executing program 3 (id=76): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f00000000c0)}, 0xfffffffd}], 0x1, 0x10000, 0x0) 579.850182ms ago: executing program 1 (id=82): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x11, 0x80a, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f00001e7000/0x18000)=nil, &(0x7f0000000680)=[@text32={0x20, &(0x7f00000006c0)="f3d92f0f0159d8b9b4080000463266b8c3000f00d00f1807660f38807fb3c4c1fddfe0c4e20d02530c66baf80cb8e8d4f38cef66bafc0ced", 0x38}], 0x1, 0xe, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f00001ec000/0x18000)=nil, &(0x7f0000000700)=[@text64={0x40, 0x0}], 0x1, 0x6b, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="340000001400010000000000fbdbdf250a00a100", @ANYRES32=r7, @ANYBLOB="14000100ff05000000000000dfce000000000001"], 0x34}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000200)={'gretap0\x00', &(0x7f0000000140)={'syztnl2\x00', r7, 0x8, 0x80, 0x5, 0x67, {{0x20, 0x4, 0x0, 0x5, 0x80, 0x66, 0x0, 0x6a, 0x4, 0x0, @remote, @rand_addr=0x64010102, {[@ssrr={0x89, 0x7, 0x68, [@local]}, @cipso={0x86, 0x6, 0xffffffffffffffff}, @cipso={0x86, 0x23, 0x1, [{0x0, 0xc, "f652a79ddd5cfa2fd0a7"}, {0x7, 0x8, "5699e3602e03"}, {0x1, 0x9, 'YtyJSZ$'}]}, @noop, @generic={0x89, 0x2}, @timestamp={0x44, 0x8, 0x81, 0x0, 0x7, [0x7fff]}, @noop, @timestamp_prespec={0x44, 0x2c, 0x95, 0x3, 0x4, [{@multicast2, 0x401}, {@empty, 0x4}, {@loopback, 0x356}, {@private=0xa010100, 0x9}, {@empty, 0xff}]}, @end]}}}}}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000005340)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000005380)={0x0, 0x0, &(0x7f00000053c0)={&(0x7f0000005400)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r8, @ANYBLOB="00000000000000002400128009000100626f6e64000000001400028008000000000000000800090001"], 0x44}}, 0x0) r9 = socket$kcm(0x10, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x98) r10 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f00000002c0)=0x5) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r12, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x20, r13, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7}, @MPTCP_PM_ATTR_ADDR={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x800) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r1, &(0x7f0000000600)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x30, r13, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x14, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x8}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000810}, 0x4040000) setreuid(r11, 0x0) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x0, 0x0) r14 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r14, &(0x7f00000003c0)='6', 0x1) add_key(&(0x7f0000000400)='asymmetric\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffc) sendmsg$kcm(r9, &(0x7f0000005480)={0x0, 0x0, &(0x7f00000054c0)=[{&(0x7f0000005500)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) 486.34964ms ago: executing program 2 (id=83): syz_create_resource$binfmt(&(0x7f00000000c0)='./file0\x00') r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl(r0, 0x400452c8, &(0x7f00000003c0)="000000000000000000000000000000000000000001") mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./dev\x00', &(0x7f0000000480)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./dev/rfcomm0\x00', 0x802, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) write$P9_RREAD(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="0b000000750100000008c838ba38ce0dd28448c473a139"], 0xb) ioctl$FS_IOC_GETFSLABEL(r2, 0x400452c9, &(0x7f0000000600)) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r5, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{0x561}]}) sendmsg$DEVLINK_CMD_PORT_SPLIT(0xffffffffffffffff, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x4000040) bind$inet6(0xffffffffffffffff, 0x0, 0x0) open(&(0x7f0000000740)='./file0\x00', 0x60840, 0x0) gettid() r6 = socket$igmp(0x2, 0x3, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) setsockopt$MRT_INIT(r6, 0x0, 0xc8, &(0x7f0000000780), 0x4) setsockopt$MRT_ADD_VIF(r6, 0x0, 0xca, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r7, 0x0, 0x23, &(0x7f0000000800)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x3e, &(0x7f0000000840)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x7, 0x0, 0x0, 0x3, 0xc58, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @dev={0xac, 0x14, 0x14, 0x44}}}}}}}, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000880)='net/ip_mr_cache\x00') pread64(r8, &(0x7f00000008c0)=""/253, 0xfd, 0x1) syz_usbip_server_init(0x1) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r9, 0xc0a85320, &(0x7f0000000200)={{0x80, 0xbd}, 'port1\x00', 0x72, 0x11cfa, 0x0, 0x8000008, 0x3, 0x32cbe4cd, 0x1}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r9, 0x40505330, &(0x7f00000002c0)={0x800100, 0x101, 0x6, 0xe1d9, 0x4}) 390.634124ms ago: executing program 3 (id=84): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, 0x0, 0x80) 390.354357ms ago: executing program 3 (id=85): syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_trie\x00') prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000200), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r3) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000300)={0x0, 0x500, &(0x7f0000000340)={&(0x7f0000000380)={0x28, r4, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffd, 0x6b}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x44001}, 0x4000054) 200.656567ms ago: executing program 1 (id=86): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./proc\x00', &(0x7f0000000380)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)='270', 0x3) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000640)={0x1, &(0x7f0000000a40)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000ac0)={'wlan0\x00'}) r3 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) ioctl$DM_DEV_CREATE(r3, 0xc138fd03, &(0x7f0000000480)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) io_uring_setup(0xf06, &(0x7f00000005c0)={0x0, 0xe5f, 0x38c1, 0x2, 0xf0}) ioctl$DM_TABLE_LOAD(r3, 0xc138fd09, &(0x7f0000000880)={0x4, 0x0, 0x0, 0x198, 0x138, 0x1, 0x9000000, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@integrity={0x0, 0x1000, 0x0, 0x60, 'integrity\x00', {{@ram_num={'1:', 0x0}, 0x20, '0'}, 0x20, '1', 0x20, 'R', ' 1 sectors_per_bit:8'}}]}) 127.647358ms ago: executing program 1 (id=87): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000680)=@newsa={0x140, 0x10, 0x633, 0x70bd2c, 0x0, {{@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in=@empty, 0x0, 0x0, 0x0, 0xfffa, 0x0, 0x0, 0x0, 0x8}, {@in=@broadcast, 0xfffffffd, 0x32}, @in=@remote, {0x1, 0x3, 0x9, 0xa, 0x10001, 0x200, 0x0, 0xfffffffffffffffc}, {0x0, 0x0, 0x5f, 0xa}, {0x100001, 0xc0000000}, 0x100, 0x0, 0x2, 0x3}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @tfcpad={0x8, 0x16, 0x81}]}, 0x140}, 0x1, 0x2000000000000000, 0x0, 0x20040}, 0x80) 64.978749ms ago: executing program 1 (id=88): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x8, {{@in=@remote, @in6=@empty, 0x8000, 0x0, 0x0, 0x0, 0xa, 0x80, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x8}, {0x0, 0x1000000}, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000d00)=@flushpolicy={0x10, 0x1d, 0x1}, 0x10}}, 0x0) 64.742364ms ago: executing program 1 (id=89): r0 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000280)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ipv6={@empty, @empty}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@ah={{0x30}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d0) r1 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r1, &(0x7f0000000680)={&(0x7f00000006c0)={0xa, 0xa, 0x81, @mcast2}, 0x1c, &(0x7f0000000700)=[{0x0}, {&(0x7f0000000780)="9e91d93a92dc7c8fff658bb539e2a1485d4c9223a7dfe538a2e2fea2", 0x1c}, {&(0x7f00000007c0)="000000b814", 0x5}, {&(0x7f0000000800)='3', 0x1}], 0x4}, 0x0) 59.231284ms ago: executing program 3 (id=90): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x3c, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0xffffffff, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0xfffffffe, 0x4, 0x1c, 0x0, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x9, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xeb00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x2, 0x7ffe, 0x28, 0x5, 0x4, 0x1, 0x77, 0x5, 0x6, 0x10000, 0x8, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0xa71, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0xbbd6, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x1, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0xab6b]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0x3, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x17}}, 0x1}, 0x1c) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="440000000206030a0000000000000000899d7a16f2000000001500030068617368"], 0x44}, 0x1, 0x0, 0x0, 0x2002c0c4}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000012000100"/18, @ANYRES32=0x0, @ANYBLOB="000000000000000408001d00ff03"], 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 0s ago: executing program 1 (id=91): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000400)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xd, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x20040004) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x1152, &(0x7f0000000a00)={@broadcast, @remote, @void, {@mpls_uc={0x8847, {[{0x5}, {0xffffa, 0x0, 0x1}, {0x6, 0x0, 0x1}, {0x8, 0x0, 0x1}, {}, {0x5}, {0x6d, 0x0, 0x1}, {0x10}], @ipv6=@udp={0xe, 0x6, "4139d1", 0x10fc, 0x11, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @loopback, {[@dstopts={0x16}, @dstopts={0x104, 0x4, '\x00', [@pad1, @ra={0x5, 0x2, 0x6}, @calipso={0x7, 0x18, {0x1, 0x4, 0x8, 0x400, [0x10001, 0x6]}}]}, @fragment={0x2e, 0x0, 0x0, 0x0, 0x0, 0x14, 0x67}, @dstopts={0x33, 0x2, '\x00', [@hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2a}}}, @pad1]}, @srh={0x3c, 0xa, 0x4, 0x5, 0x0, 0x8, 0x5, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private0={0xfc, 0x0, '\x00', 0x1}, @loopback, @remote, @ipv4={'\x00', '\xff\xff', @private=0xa010101}]}, @fragment={0x67, 0x0, 0x6f, 0x1, 0x0, 0x1a, 0x68}, @fragment={0x62, 0x0, 0x6, 0x0, 0x0, 0xa, 0x65}, @srh={0x3c, 0x4, 0x4, 0x2, 0x40, 0x8, 0x7, [@mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02']}], {0x4e24, 0x4e20, 0x100c, 0x0, @gue={{0x1, 0x0, 0x3, 0xaf, 0x100, @void}, "57ffb5b478d23f2ed653b2128321e644d8cda78d73b85a8ab775acbd0be60bf1f9df965464c4c5b5e43804dc16923144d59868eb30a1e85924df22755b4df45e114eecd0af97b58d47603572c6da7cde79b895ad93cbf1799c7aabd9d104eb593da2cffcf2508d43a7858a8b470217a11253ab201e304975408cb12732cc056841415dc794800e5a0d0534e75ca12ce0103fcf56fee2ba3a4803675381f5fd8db1ca1a81d9012f840829ab7fa1d2523b4ea88087c937efced290e4a4aa0c9884d63139afc091bda8f351aa4196008af008508517eb29afc52aedba89b3e006d221fefb373e5db05235d6d8334d171389534481278c799ab6f0ff0a1702fdd5a64ed39a5310f1ee16d813b0c4fce2a4507668dec6b2bc2cb601e67e67e3937fe20da198e9c744fbc60fc8e6242ff7f62559c81fb9f986aa9939ee8c6f64f3985146150448a62029a4ba94a1584720e709c62b583c6879cb11d50a15bb94a9a9330eb73d36d9a2241f9d521c635547699296e239066628498d3df39cacfb41c61ea443de4b2c17637fd61933551559c3e73bc970a76d52c1e7d21d52b7c3baf82cd911b3572213fb556a843aa8a21bc030ad63c3e24d95ae969941c74cf490a3083cdddd54ebaf1db27164056788c30b13e8526a017d44122de0238972e1395157313c13838f93225571733cf2a3e3eb7249f9338b2df99336653cddfd14917b6824f9570865bd83bdd805e8fa8233b1137234b7a936428795bd5cd6a0b9d8c2879964113e5b0af6bcc1a9bd61b2c6e93c8692a026e07a351fdcf96f56102ddd3528489f7410e74e0fdb128ef807afbfc8379cc156aec16bdebc2595a53eb9d63e097be0d00ea8a8a165881d99dc7aee8201b644b1ee332cdc954a0f284a603863722c369ecb2bdd2ec641d0b23f2c869cb70d2f0fed1570875ff98f8fa309b7d53628991f3f23df0847078f1991409972e56fbe4622138c98d0155e0bad8d74fed27d5fb532dbd9551c23cc0e4e0c32b65be8fefb8435255e3f238b38348d2b4d55451afe828c9e1f33140ae5140d196296019312664ace6a58d8c7bde8a1719c3c637b0c8c5d7e9c6010bc7fcf66cdca11a580213f548c554ebcaa92071bb78844abe4783af3eb7be7679e6ca143c8cbd81e7cfc680bd021aa7c327141b9990b3a81cadf8490cc6af6b42cbd6e23b73079a9702cedaa9d3f0ee62a90f6dc550d9cd1f0d1479cd843f16dea9287e20a4ca7e841938d3b5ea988e3ef012c5c5dfb24999f0bf6eafa3ca47c6e3f1f4086922c92e6302476c5161c52b134a6d77ecdb2bb55d63017ba2b1c0151d6b08a137e018e6402980b35b4135dc323c33b73a72923a597e9473329eaec79b45316200be00c84c5dd7c691649b8d0c850152ad6fa3a332a13e7b5fc777279a192f7746717c5ed88504374713c86cccea00c3af3734a58b52561a039ef938169d9a8d21e00ff45c8a23bf318dd275cb10f736f09a8eef96cd15d07feba53243256132e9fdbaeac62bc4d21cb9e70da7fa6f39bfa07eba20c908a614194e66fd6552d2be2056e0cf7d917c731a7d4b1404ee98cdb2ad1b2d6ea71687644f7e1adc4a8f0c742547b2613cf3295a0c70da36a4a6aa3b1b8269d9e84f820534545a2c71698e38ec4c07f862b0ad63514d27e6cfd76afdbcb07f6177385a129ab4bb8e365a0b669731103979bf57651b2a6909086c91df9e15f73aa40ad9a3c30f7a09db1be755d6ed494cb1623c874fa14c3158c79933816aa4ff1baaa2f581a6b0ff4d6b2e1e329492040846e14f507021cab4accab8fb1e52cab2f4bbb79cc9f5d0e397f206231917ac8b2fa704e4e9f2ef74ea7a49c5fb578a47b910f3baa36abbd4229caf1a6ea7da1f7bb4621458c58c0816183e5f5ad2fee5b6c55e0a956ef8dc05531fb9afd08565ef5b9195ca45778c6ca6745807a995558b42742635381a71bb49d80abf3f12a76c6b632ef8ae9c87b30347326ccb51afe4a19fd3e34aee6331542c22db48ea96ea5a29d85b7875b6021d36558a344105396018a61d140a2232ef0594cf7f4a1b5b29488543b419538733d88594459a06fdfe6e33b442e729ad370063b75ecae09ea357e2b3223fcfbade20efd7acb7ec652c844e23934049b1ea5261e46cfc5b6d1c7820a4e11e772a3649d39ff7a37fbaf8b1647deb2a6bfc8cd39f3b37e37e1e45e193cef629982e0a84308c97ac2fcdce55cc802f244185987b1202592f40d92dbc70c7287c1e718230524d1fe6456f333b99be61e4f35e87849d27dfd7262cca9dbac77f6fbc7b3c87c5350236af697e44c9ac67d004ae5ca668b481cd44870924e9f1463f416255c8c7917c44f3275800a5622e0fdf61b0be31f8889033ccae98ad8bedaa1812d1d2e643945190aaf3a880c5c0cb48743264172507c5cd7853ed53ca2202a2ffe58c10b22e166092bf78b6a01ffea8500b59103805829d20580adf1deaf78dd3d85282cd91371a6293d7ac3cef93a95df3ba6cf7c01f6899c87dc1761a6317a4afa712d155d424b57fb73cdc2317788280dd7ae3c97152c71003ebcd76e3970dcc2ae98665ebfe47c208f10dd8d1457f73e17189c9590e6c450e0718c177fbeab929d5b70164d9f3debf5331c675e73c9fc4d4f451182d36be93abbb792691be077292eff292dbe1e46767a0a862f7ae716fa0dce18d56567e633ebc9bdcba7ef81291c03ec986657ab3c854bd2a51ee1160277f6b9bb0a7997c696aee3615e7a0000914e77e46f91aa92e0c74b9af7b328b72b6d90a30ec4c9962c64d4d37eee89a7bc0ba5d410fec7a129bd493cdecc7e03b5fd4d582cc05de71553c97b1aba73db5db99a5773ec03bee29fc4e28d1f00b3dcbb82811748c6c3324a295a5c6944934a138c548d8a27e9ae5704c95f6aa3466922b712f5dfe04fae0f586aeac5b0671c08dd07f512553b83eb4a090de0e2fd24851567a91afa4cc134d988c139063b91e31b5be3ae093219a590b39e64d1b1e42a35cd1f66bff5434504d902d866354cc97c0d315f8130186e5e5131e91a6bddac360a111c388365dca30810232b1fc3889015b14ac4af36de0dd5252fa0a24faef8fa2b411fb8ae0c0cbabe42e63bd3755b10af3d3232adb5fe1949d6c3d37e8ec1dab1196c560ad7c3134ebf2f7b084ed8873bf311635caa651fb8485514efd9e0ed44a34d66b68cb260613a59f81b7a4c7fceadcab409f551c097269e9364e6bcd6215d77db7cbc41460faa4d64ec21d48d3151d1d3203fffb19d83abb6e3c77063d9cb60638bce8133c8b72cae684a88c13ded6a4a51aef9dd6ba056b4e77531b00c75c047193263274792080fd637f6bb90e795be1abb6f6f67fde0d5b893daa4f76a8b2094c0d70afe98d5fec6426d80251bd98cb775bc8c020faf1572e4dfa97e319d3e0887a7ce2df397b2d23b6b1b8632ac4860f3f1fb004f3b43bb581876da012a353b4d5dcc81b7cdfc1265fc9737163652d4156a8083bb903580e5f72f7c9877eee93f1e1af9c100f1d2a7bc7ff9f78fe76091063efb65ba3d4921243dee2226fd2c1a760d0e3a727118dc724644f0dfd2b28832d141773dd1efd43656f865736163ed56af3b98272fe2dccb2c68cbf057a2c85738fa376279d27dc5e351fae8fe38f4127d9f262a67c2889c8162a16d8921d50a600047bbe2acb5a3b4819bd57f9e1b2a1398de7bb46d81cca49c0f33a2e6de14f1464745e5ca59b90d0457abc7094416cbd8ac902be944e7672f1f543978988a3675a2de3e207e556360056b889b0fe0a751b376cc1d4febd4bcd46c20295290b4af10f1bc37e7a21536817e6e7d3a7bb235078acd26d6b3fc25e33444dbcb01fb305268b12748321cfef60b7998d8ef6c58eaf0ddfefdf2298efdc9905c48905003132cdd9d09b2ce9c317bf5c4049a176226857dc5da36d588b2d15cdb3af09c3cafdcc12010d79d8864a98edfbe43f01427b210464be4e5942b9720176106a086fe6ba5bea3b67c45d522fa2f65dba6f829b36ac8aa0401d6635e44a89d13cbc6f53b1a41a376e024b0082316d4356b9b593fd65cf83571614c4fdf75efdbc13a3672e09b2958ee0214eab05f2824239c94ac32079fe7ea5fd52bcb0608f5b44e846374f259a8c1338f83df08facb52eea2504789a93f9351ca4fbc3794ed4b47a8675d414efff7497d1b86528d79d847b71fc8f32da332fccb3f9829eca9e3af15dc4260007bab66b004c804b2d6ff9405512ff394c95737d782c3ee5565f27b08ff63c1dda6715a2c3cd1170417be449ac6fe1809253900487adbe8b5ff9a669d6a40d6de5010d7b2e80caa3907715309abef271da80eb4beb77ea4493fc6aba45d33f53e7a617e0c198160367bff6187f03d4d7b23b074d5bd838c35a3d60cb267fc8cece8f323fd608b5f1fab2205396754f7b3eabbd10482baac48a576e3d82a2faa924e2ed6d5adb2cccb9f1659616654bc6655c1baf26c8d78b7601e5afe0d7eb0cd8238e547d363c0198694da79eb26fd8edb0b63a019a4b4135acb9aa984fcfd2d5dc12e264aedd862a8862ac35cd5df0ef39c077d200264667ec01f8d9dea22ac3ba78aa79248dc40b8828f4041c6874868abcbbaea7c618ee94ba1724472ae49f8295da2601ed3cefcb6a6f2d41cb2acb26345c74c6623a7b9c6cf3656fde6ba1e5bba7fb7f715646835a1f16a91178ada76f40bf7c3d8ac3537c4bcbbd2375a39a605bf384f5794b697b19c815b30e768095e479c76c9f0877e138e648d46ff49bfe1f0cb8187264d05fd91302cd6c2c170a5f55a3cc64fbbe7d1e2fb8865ce50721f7a926279ef39b99e96e8717a8f77e3596ef5c514d26c2615c50624f873e39b97dced9bf3545e59480e69d529b4ce599b438c7c01d3e44d8a16932dca736fffbb6bc42f78ea7ff525d980e0f5329fbf0e7e05bfddb324e2bd9ca4f8fe38fcf5b0f22e7f2a888a1a54ccbfa58909979a7cb5739951d1f40706f3b4331f30099c3b4e9af2762de1d8eef2bacd1beedc4af3ac5f98b2c11a445e0e50166ab2a4fce0614d9ff39d80007eeffe4a2b89ed1a26fa18e0e4bf47174b7e34ca9293364127f8d4fb75aeabc93d15ecae6700b2707d888327a4bc87329fb0ff4339d758c3359b19b37ae0afcb19da8d7c966b384a085bcbb33687c1b4a367d2060a27d298238d010576cdc00ef17cd123a50ddd0431d7f837abb8b6e55efbc9deb0f5f0f6ef73ef55fb8fd2cead0502549f1c235871545f79d1962b6a0baf0af5c112a7f257fccfeb9bacf6e986f26a8ae0b42e40033e2671771e6062ce50092a7344617594bc31d28b7cca7e4423f1615e53fab7e71c7fa7378ba7e519624b6f720c427de1501933b2d766cf80f219b2c1fa3b6c3c54f24f06d1f97b8272efb7fb79b00a703e9937fa5b474408bbe330245e4eac7a0064b206725d9f8e1cd921f7663178c2b943f5219c42d7588c44bb12fa3f01fc1175368a5ffa4d3c81889af85f290f13dea657f6a1722d2474cdb2efeb3a9e8a82013d5b33a67e0270d77437b5c6f3cabf53e1179fbc63a50df9ea91e59dc7a41a51dab1ac0484cbac4f097ddfb3e2c469274fcb614f6882e057fac618fe4f3d8be9b846820ee55d11934853e9dc05483cd5e79f1e9c28fc3cdce1b883834de7b138953a5693c7cb827acf5830274ebb96a09f60b1d7fff8b7c183baeb27bae38a8145a4f7a2e0434b47ead442ef9193d4b772fb95e5f0f3833874244165dec06dcc1a079624f1e5131fe32531faf6d801836a3985c71e550253"}}}}}}}}, &(0x7f0000001b80)={0x1, 0x2, [0x79a, 0x434, 0xc2c, 0x628]}) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000840), r3) sendmsg$DEVLINK_CMD_RATE_DEL(0xffffffffffffffff, &(0x7f00000009c0)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000980)={&(0x7f0000000880)={0xe8, r4, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @handle=@pci={{0x8}, {0x11}}, @handle=@pci={{0x8}, {0x11}}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @handle=@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @handle=@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_RATE_NODE_NAME={0xe}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @handle=@pci={{0x8}, {0x11}}]}, 0xe8}, 0x1, 0x0, 0x0, 0x8010}, 0x4) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000005c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="050000000000ffdbdf25060000000300990003000000490000000800050082000000"], 0x28}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000006c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f00000007c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x50, r5, 0x800, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x29c, 0x11}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x594}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x243}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x12ed}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x406}]}, 0x50}, 0x1, 0x0, 0x0, 0x8805}, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001c00)={&(0x7f0000001c40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a310000000028000480080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a310000000058000000050a01020000000000000000010020000c00024000000000000000010900010073797a3100000000200004801400030076657468315f6d616376746170000000080001"], 0xf4}}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000001d40)='./debug\x00', 0xf2) mount(0x0, &(0x7f0000001d80)='./debug\x00', &(0x7f0000001dc0)='debugfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001e00)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000001e40)='./config\x00', &(0x7f0000001e80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001ec0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001f00)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001f40)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001f80)='./config/target/usb_gadget/naa.5001405000000001\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001fc0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000002000)='./debug/dri/0/name\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.cpu/syz0\x00', 0x1ff) mkdir(&(0x7f00000001c0)='./file0\x00', 0x1ba) mount$bpf(0x200000000000, &(0x7f0000000340)='./file0/../file0\x00', 0x0, 0x989046, 0x0) setpriority(0x1, 0x0, 0x0) mount$cgroup(0x0, &(0x7f0000000380)='./file0\x00', 0x0, 0x8748b2, &(0x7f00000003c0)={[{@name={'name', 0x3d, 'veth1_to_bond\x00'}}]}) kernel console output (not intermixed with test programs): [ 30.157356][ T42] audit: type=1400 audit(1793461336.717:116): avc: denied { write } for pid=5689 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.208075][ T42] audit: type=1400 audit(1793461336.767:117): avc: denied { write } for pid=5692 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.815280][ T42] audit: type=1400 audit(1793461337.367:118): avc: denied { write } for pid=5695 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.869745][ T42] audit: type=1400 audit(1793461337.427:119): avc: denied { write } for pid=5698 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.962521][ T42] audit: type=1400 audit(1793461337.517:120): avc: denied { write } for pid=5701 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 71.277425][ T1329] cfg80211: failed to load regulatory.db Warning: Permanently added '[localhost]:38451' (ED25519) to the list of known hosts. [ 362.525624][ T42] kauditd_printk_skb: 17 callbacks suppressed [ 362.525640][ T42] audit: type=1400 audit(1793461669.077:138): avc: denied { name_bind } for pid=5824 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 362.580791][ T42] audit: type=1400 audit(1793461669.137:139): avc: denied { execute } for pid=5825 comm="sh" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 362.581563][ T42] audit: type=1400 audit(1793461669.137:140): avc: denied { execute_no_trans } for pid=5825 comm="sh" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 364.546048][ T42] audit: type=1400 audit(1793461671.097:141): avc: denied { mounton } for pid=5825 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 364.547768][ T42] audit: type=1400 audit(1793461671.107:142): avc: denied { mount } for pid=5825 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 364.549680][ T5825] cgroup: Unknown subsys name 'net' [ 364.550825][ T42] audit: type=1400 audit(1793461671.107:143): avc: denied { unmount } for pid=5825 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 364.669647][ T5825] cgroup: Unknown subsys name 'cpuset' [ 364.674237][ T5825] cgroup: Unknown subsys name 'rlimit' [ 364.830496][ T42] audit: type=1400 audit(1793461671.387:144): avc: denied { setattr } for pid=5825 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 364.832946][ T42] audit: type=1400 audit(1793461671.387:145): avc: denied { create } for pid=5825 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 364.832979][ T42] audit: type=1400 audit(1793461671.387:146): avc: denied { write } for pid=5825 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 364.833007][ T42] audit: type=1400 audit(1793461671.387:147): avc: denied { read } for pid=5825 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 364.891118][ T5828] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 365.610708][ T5825] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 369.132255][ T42] kauditd_printk_skb: 6 callbacks suppressed [ 369.132267][ T42] audit: type=1400 audit(1793461675.687:154): avc: denied { execmem } for pid=5831 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 369.333094][ T42] audit: type=1400 audit(1793461675.887:155): avc: denied { create } for pid=5835 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 369.333467][ T42] audit: type=1400 audit(1793461675.887:156): avc: denied { read write } for pid=5835 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 369.333867][ T42] audit: type=1400 audit(1793461675.887:157): avc: denied { open } for pid=5835 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 369.348844][ T42] audit: type=1400 audit(1793461675.907:158): avc: denied { ioctl } for pid=5836 comm="syz-executor" path="socket:[7410]" dev="sockfs" ino=7410 ioctlcmd=0x400448c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 369.373667][ T5839] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 369.374024][ T5839] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 369.374947][ T5839] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 369.375102][ T5839] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 369.375295][ T5839] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 369.375984][ T5839] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 369.376975][ T5850] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 369.377112][ T5850] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 369.377572][ T5850] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 369.379196][ T5850] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 369.380584][ T5850] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 369.381762][ T5854] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 369.384205][ T5854] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 369.386437][ T5839] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 369.386598][ T5853] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 369.389628][ T5853] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 369.389891][ T42] audit: type=1400 audit(1793461675.947:159): avc: denied { read } for pid=5835 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 369.390178][ T42] audit: type=1400 audit(1793461675.947:160): avc: denied { open } for pid=5835 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 369.390801][ T5853] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 369.391291][ T5853] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 369.391293][ T42] audit: type=1400 audit(1793461675.947:161): avc: denied { mounton } for pid=5835 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 369.398108][ T5839] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 369.398995][ T5839] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 369.402048][ T42] audit: type=1400 audit(1793461675.947:162): avc: denied { module_request } for pid=5835 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 369.407808][ T42] audit: type=1400 audit(1793461675.967:163): avc: denied { module_request } for pid=5842 comm="syz-executor" kmod="netdev-nr3" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 369.571638][ T5835] rxe_eth0 speed is unknown, defaulting to 1000 [ 369.572101][ T5835] rxe_eth0 speed is unknown, defaulting to 1000 [ 369.572796][ T5835] rxe_eth0 speed is unknown, defaulting to 1000 [ 369.591179][ T5837] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 369.610264][ T5842] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 369.685669][ T5836] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 369.691037][ T5835] infiniband rxe0: set active [ 369.693662][ T5835] infiniband rxe0: added rxe_eth0 [ 369.703359][ T9] rxe_eth0 speed is unknown, defaulting to 1000 [ 369.704112][ T5835] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 369.704138][ T5835] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 369.704167][ T5835] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 369.711808][ T5836] rxe_eth0 speed is unknown, defaulting to 1000 [ 369.730183][ T5835] RDS/IB: rxe0: added [ 369.732703][ T5835] smc: adding ib device rxe0 with port count 1 [ 369.733118][ T5835] smc: ib device rxe0 port 1 has no pnetid [ 369.749724][ T9] rxe_eth0 speed is unknown, defaulting to 1000 [ 369.833161][ T5835] rxe_eth0 speed is unknown, defaulting to 1000 [ 369.937201][ T5842] bridge0: port 1(bridge_slave_0) entered blocking state [ 369.937620][ T5842] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.937723][ T5842] bridge_slave_0: entered allmulticast mode [ 369.939219][ T5842] bridge_slave_0: entered promiscuous mode [ 369.946885][ T5842] bridge0: port 2(bridge_slave_1) entered blocking state [ 369.946925][ T5842] bridge0: port 2(bridge_slave_1) entered disabled state [ 369.946982][ T5842] bridge_slave_1: entered allmulticast mode [ 369.948460][ T5842] bridge_slave_1: entered promiscuous mode [ 369.995934][ T5842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 369.996139][ T5835] rxe_eth0 speed is unknown, defaulting to 1000 [ 369.997781][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state [ 369.998099][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.998165][ T5837] bridge_slave_0: entered allmulticast mode [ 369.998893][ T5837] bridge_slave_0: entered promiscuous mode [ 370.001669][ T5842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 370.040788][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state [ 370.040892][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state [ 370.041001][ T5837] bridge_slave_1: entered allmulticast mode [ 370.042435][ T5837] bridge_slave_1: entered promiscuous mode [ 370.056061][ T5842] team0: Port device team_slave_0 added [ 370.058390][ T5842] team0: Port device team_slave_1 added [ 370.098977][ T5837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 370.117173][ T5837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 370.118065][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 370.118077][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.118096][ T5842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 370.120155][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 370.120166][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.120184][ T5842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 370.143297][ T5837] team0: Port device team_slave_0 added [ 370.145103][ T5837] team0: Port device team_slave_1 added [ 370.171371][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 370.171385][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.171404][ T5837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 370.194034][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 370.194049][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.194069][ T5837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 370.198530][ T5835] rxe_eth0 speed is unknown, defaulting to 1000 [ 370.215301][ T5842] hsr_slave_0: entered promiscuous mode [ 370.215986][ T5842] hsr_slave_1: entered promiscuous mode [ 370.288577][ T5837] hsr_slave_0: entered promiscuous mode [ 370.289165][ T5837] hsr_slave_1: entered promiscuous mode [ 370.289520][ T5837] debugfs: 'hsr0' already exists in 'hsr' [ 370.289529][ T5837] Cannot create hsr debugfs directory [ 370.290170][ T5836] bridge0: port 1(bridge_slave_0) entered blocking state [ 370.290240][ T5836] bridge0: port 1(bridge_slave_0) entered disabled state [ 370.290291][ T5836] bridge_slave_0: entered allmulticast mode [ 370.291498][ T5836] bridge_slave_0: entered promiscuous mode [ 370.293313][ T5836] bridge0: port 2(bridge_slave_1) entered blocking state [ 370.293353][ T5836] bridge0: port 2(bridge_slave_1) entered disabled state [ 370.293507][ T5836] bridge_slave_1: entered allmulticast mode [ 370.294240][ T5836] bridge_slave_1: entered promiscuous mode [ 370.344269][ T5836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 370.365660][ T5836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 370.427353][ T5836] team0: Port device team_slave_0 added [ 370.451941][ T5836] team0: Port device team_slave_1 added [ 370.484370][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 370.484382][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.484422][ T5836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 370.504446][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 370.504457][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.504469][ T5836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 370.565191][ T5836] hsr_slave_0: entered promiscuous mode [ 370.566004][ T5836] hsr_slave_1: entered promiscuous mode [ 370.566485][ T5836] debugfs: 'hsr0' already exists in 'hsr' [ 370.566498][ T5836] Cannot create hsr debugfs directory [ 370.587641][ T5842] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 370.590360][ T5842] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 370.590804][ T5842] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 370.594046][ T5842] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 370.610893][ T5842] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 370.612943][ T5842] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 370.613399][ T5842] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 370.615095][ T5842] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 370.764232][ T5837] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 370.769988][ T5837] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 370.798117][ T5837] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 370.802919][ T5837] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 370.803570][ T5837] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 370.806981][ T5837] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 370.809464][ T5842] bridge0: port 2(bridge_slave_1) entered blocking state [ 370.809557][ T5842] bridge0: port 2(bridge_slave_1) entered forwarding state [ 370.809927][ T5842] bridge0: port 1(bridge_slave_0) entered blocking state [ 370.810085][ T5842] bridge0: port 1(bridge_slave_0) entered forwarding state [ 370.814929][ T1169] bridge0: port 1(bridge_slave_0) entered disabled state [ 370.823517][ T1169] bridge0: port 2(bridge_slave_1) entered disabled state [ 370.846248][ T5835] bridge0: port 1(bridge_slave_0) entered blocking state [ 370.846334][ T5835] bridge0: port 1(bridge_slave_0) entered disabled state [ 370.846439][ T5835] bridge_slave_0: entered allmulticast mode [ 370.847716][ T5835] bridge_slave_0: entered promiscuous mode [ 370.850606][ T5835] bridge0: port 2(bridge_slave_1) entered blocking state [ 370.850685][ T5835] bridge0: port 2(bridge_slave_1) entered disabled state [ 370.850955][ T5835] bridge_slave_1: entered allmulticast mode [ 370.852051][ T5835] bridge_slave_1: entered promiscuous mode [ 370.853156][ T5837] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 370.856749][ T5837] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 370.883497][ T5835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 370.885274][ T5835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 370.928163][ T5835] team0: Port device team_slave_0 added [ 370.938634][ T5835] team0: Port device team_slave_1 added [ 370.977246][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 370.977263][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.977283][ T5835] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 370.980794][ T5836] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 370.984638][ T5836] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 370.985623][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 370.985636][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.985654][ T5835] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 370.986280][ T5836] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 370.990306][ T5836] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 371.000526][ T5836] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 371.005544][ T5836] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 371.007004][ T5836] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 371.009368][ T5836] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 371.049062][ T5835] hsr_slave_0: entered promiscuous mode [ 371.049488][ T5835] hsr_slave_1: entered promiscuous mode [ 371.049790][ T5835] debugfs: 'hsr0' already exists in 'hsr' [ 371.049798][ T5835] Cannot create hsr debugfs directory [ 371.067915][ T5842] 8021q: adding VLAN 0 to HW filter on device bond0 [ 371.156178][ T5842] 8021q: adding VLAN 0 to HW filter on device team0 [ 371.161361][ T5837] 8021q: adding VLAN 0 to HW filter on device bond0 [ 371.165305][ T1169] bridge0: port 1(bridge_slave_0) entered blocking state [ 371.165351][ T1169] bridge0: port 1(bridge_slave_0) entered forwarding state [ 371.186183][ T5837] 8021q: adding VLAN 0 to HW filter on device team0 [ 371.195003][ T1169] bridge0: port 2(bridge_slave_1) entered blocking state [ 371.195053][ T1169] bridge0: port 2(bridge_slave_1) entered forwarding state [ 371.207349][ T1169] bridge0: port 1(bridge_slave_0) entered blocking state [ 371.207394][ T1169] bridge0: port 1(bridge_slave_0) entered forwarding state [ 371.209636][ T1169] bridge0: port 2(bridge_slave_1) entered blocking state [ 371.209678][ T1169] bridge0: port 2(bridge_slave_1) entered forwarding state [ 371.230041][ T5835] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 371.233115][ T5835] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 371.234789][ T5835] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 371.239112][ T5835] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 371.239818][ T5835] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 371.245104][ T5835] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 371.253322][ T5835] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 371.257338][ T5835] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 371.307567][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 371.329796][ T5836] 8021q: adding VLAN 0 to HW filter on device team0 [ 371.336556][ T369] bridge0: port 1(bridge_slave_0) entered blocking state [ 371.336601][ T369] bridge0: port 1(bridge_slave_0) entered forwarding state [ 371.345824][ T369] bridge0: port 2(bridge_slave_1) entered blocking state [ 371.345871][ T369] bridge0: port 2(bridge_slave_1) entered forwarding state [ 371.378333][ T5835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 371.385543][ T5835] 8021q: adding VLAN 0 to HW filter on device team0 [ 371.385730][ T5836] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 371.395934][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 371.396003][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 371.408327][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 371.408372][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 371.438046][ T67] Bluetooth: hci2: command tx timeout [ 371.438055][ T5853] Bluetooth: hci3: command tx timeout [ 371.438300][ T67] Bluetooth: hci1: command tx timeout [ 371.438309][ T5853] Bluetooth: hci0: command tx timeout [ 371.545088][ T5837] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 371.578003][ T5842] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 371.592203][ T5837] veth0_vlan: entered promiscuous mode [ 371.600652][ T5837] veth1_vlan: entered promiscuous mode [ 371.624065][ T5842] veth0_vlan: entered promiscuous mode [ 371.632683][ T5837] veth0_macvtap: entered promiscuous mode [ 371.634951][ T5837] veth1_macvtap: entered promiscuous mode [ 371.640916][ T5842] veth1_vlan: entered promiscuous mode [ 371.660523][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 371.668101][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 371.689321][ T5842] veth0_macvtap: entered promiscuous mode [ 371.691467][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 371.703159][ T5842] veth1_macvtap: entered promiscuous mode [ 371.713712][ T5835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 371.715960][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 371.733098][ T1169] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 371.733112][ T1169] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 371.735941][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 371.736314][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 371.737648][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 371.748877][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 371.773406][ T5836] veth0_vlan: entered promiscuous mode [ 371.775269][ T369] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 371.775283][ T369] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 371.793447][ T5835] veth0_vlan: entered promiscuous mode [ 371.803242][ T5836] veth1_vlan: entered promiscuous mode [ 371.814972][ T5835] veth1_vlan: entered promiscuous mode [ 371.845348][ T369] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 371.845361][ T369] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 371.872781][ T5837] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 371.874544][ T5836] veth0_macvtap: entered promiscuous mode [ 371.875737][ T5858] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 371.875748][ T5858] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 371.878966][ T5836] veth1_macvtap: entered promiscuous mode [ 371.893898][ T5835] veth0_macvtap: entered promiscuous mode [ 371.903044][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 371.905040][ T5835] veth1_macvtap: entered promiscuous mode [ 371.911792][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 371.934873][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 371.948624][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 371.998610][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.016063][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.016230][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.016520][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.019662][ T5864] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 372.019677][ T5864] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 372.048345][ T5864] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 372.048362][ T5864] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 372.074037][ T5864] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 372.074158][ T5864] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 372.084769][ T5864] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 372.084786][ T5864] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 372.096659][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.096693][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.096718][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.096744][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.096769][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.096789][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.096814][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.096838][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.096886][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.182384][ T6002] syz_tun: entered allmulticast mode [ 372.188883][ T6002] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(12) [ 372.188897][ T6002] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 372.190665][ T6002] vhci_hcd vhci_hcd.0: Device attached [ 372.199796][ T6000] fuse: Bad value for 'fd' [ 372.205678][ T6009] vhci_hcd: connection closed [ 372.207296][ T13] vhci_hcd vhci_hcd.3: stop threads [ 372.207502][ T13] vhci_hcd vhci_hcd.3: release socket [ 372.207608][ T13] vhci_hcd vhci_hcd.3: disconnect device [ 372.208411][ T6001] syz_tun: left allmulticast mode [ 373.515974][ T5853] Bluetooth: hci0: command tx timeout [ 373.515997][ T5853] Bluetooth: hci3: command tx timeout [ 373.517316][ T6064] Zero length message leads to an empty skb [ 373.525933][ T5849] Bluetooth: hci1: command tx timeout [ 373.525952][ T5849] Bluetooth: hci2: command tx timeout [ 373.641469][ T6069] null_blk: disk my_zoned_dev created [ 373.921328][ T6081] FAULT_INJECTION: forcing a failure. [ 373.921328][ T6081] name failslab, interval 1, probability 0, space 0, times 1 [ 373.921368][ T6081] CPU: 0 UID: 0 PID: 6081 Comm: syz.3.26 Not tainted syzkaller #0 PREEMPT(full) [ 373.921382][ T6081] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 373.921400][ T6081] Call Trace: [ 373.921405][ T6081] [ 373.921410][ T6081] dump_stack_lvl+0x100/0x190 [ 373.921432][ T6081] should_fail_ex.cold+0x5/0xa [ 373.921450][ T6081] should_failslab+0xc2/0x120 [ 373.921463][ T6081] kmem_cache_alloc_noprof+0x92/0x6a0 [ 373.921479][ T6081] ? mempool_init_node+0x2f7/0x6f0 [ 373.921492][ T6081] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 373.921504][ T6081] mempool_init_node+0x2f7/0x6f0 [ 373.921517][ T6081] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 373.921527][ T6081] ? __pfx_mempool_free_slab+0x10/0x10 [ 373.921537][ T6081] mempool_init_noprof+0x3a/0x50 [ 373.921550][ T6081] bioset_init+0x37e/0x8a0 [ 373.921564][ T6081] ? __pfx_bioset_init+0x10/0x10 [ 373.921576][ T6081] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 373.921594][ T6081] ? percpu_ref_init+0x244/0x3f0 [ 373.921611][ T6081] mddev_init+0x17c/0x820 [ 373.921625][ T6081] md_alloc+0xc7/0x10c0 [ 373.921642][ T6081] md_alloc_and_put+0x16/0xb0 [ 373.921658][ T6081] add_named_array+0x360/0x3a0 [ 373.921673][ T6081] ? __pfx_add_named_array+0x10/0x10 [ 373.921705][ T6081] param_attr_store+0x199/0x300 [ 373.921728][ T6081] ? __pfx_param_attr_store+0x10/0x10 [ 373.921753][ T6081] module_attr_store+0x58/0x80 [ 373.921770][ T6081] ? __pfx_module_attr_store+0x10/0x10 [ 373.921798][ T6081] sysfs_kf_write+0xf2/0x150 [ 373.921815][ T6081] kernfs_fop_write_iter+0x3e0/0x5f0 [ 373.921827][ T6081] ? __pfx_sysfs_kf_write+0x10/0x10 [ 373.921842][ T6081] vfs_write+0x6af/0x1050 [ 373.921854][ T6081] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 373.921867][ T6081] ? __pfx_vfs_write+0x10/0x10 [ 373.921877][ T6081] ? find_held_lock+0x2b/0x80 [ 373.921901][ T6081] ksys_write+0x12a/0x250 [ 373.921911][ T6081] ? __pfx_ksys_write+0x10/0x10 [ 373.921927][ T6081] do_syscall_64+0x123/0x790 [ 373.921940][ T6081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.921951][ T6081] RIP: 0033:0x7faaa959f559 [ 373.921961][ T6081] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 373.921971][ T6081] RSP: 002b:00007faaaa4d3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 373.921982][ T6081] RAX: ffffffffffffffda RBX: 00007faaa9825fa0 RCX: 00007faaa959f559 [ 373.921989][ T6081] RDX: 0000000000000008 RSI: 0000200000000040 RDI: 0000000000000005 [ 373.921995][ T6081] RBP: 00007faaa9636b50 R08: 0000000000000000 R09: 0000000000000000 [ 373.922002][ T6081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 373.922008][ T6081] R13: 00007faaa9826038 R14: 00007faaa9825fa0 R15: 00007fff8c4769b8 [ 373.922023][ T6081] [ 374.156997][ T6081] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 374.175000][ T42] kauditd_printk_skb: 93 callbacks suppressed [ 374.175012][ T42] audit: type=1400 audit(1793461680.727:257): avc: denied { unmount } for pid=5842 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 374.196179][ T42] audit: type=1400 audit(1793461680.757:258): avc: denied { name_bind } for pid=6086 comm="syz.3.28" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 374.197429][ T42] audit: type=1400 audit(1793461680.757:259): avc: denied { node_bind } for pid=6086 comm="syz.3.28" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 374.411821][ T42] audit: type=1400 audit(1793461680.967:260): avc: denied { append } for pid=6088 comm="syz.2.29" name="001" dev="devtmpfs" ino=753 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 374.450620][ T6091] syzkaller0: entered promiscuous mode [ 374.450639][ T6091] syzkaller0: entered allmulticast mode [ 374.454633][ T42] audit: type=1400 audit(1793461681.007:261): avc: denied { create } for pid=6090 comm="syz.2.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 374.456854][ T42] audit: type=1400 audit(1793461681.017:262): avc: denied { write } for pid=6090 comm="syz.2.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 374.623222][ T42] audit: type=1400 audit(1793461681.177:263): avc: denied { read write } for pid=6092 comm="syz.1.31" name="raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 374.623491][ T42] audit: type=1400 audit(1793461681.177:264): avc: denied { open } for pid=6092 comm="syz.1.31" path="/dev/raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 374.623719][ T42] audit: type=1400 audit(1793461681.177:265): avc: denied { ioctl } for pid=6092 comm="syz.1.31" path="/dev/raw-gadget" dev="devtmpfs" ino=848 ioctlcmd=0x41015500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 374.746053][ T42] audit: type=1400 audit(1793461681.307:266): avc: denied { setopt } for pid=6094 comm="syz.0.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 374.768080][ T6097] syzkaller0: entered promiscuous mode [ 374.768107][ T6097] syzkaller0: entered allmulticast mode [ 374.866005][ T5936] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 374.910698][ T6110] syzkaller0: entered promiscuous mode [ 374.910711][ T6110] syzkaller0: entered allmulticast mode [ 375.027215][ T5936] usb 6-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 375.029226][ T5936] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 375.029258][ T5936] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 375.032637][ T5936] usb 6-1: config 0 descriptor?? [ 375.037690][ T5936] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 375.430138][ T29] usb 6-1: USB disconnect, device number 2 [ 375.596134][ T5849] Bluetooth: hci3: command tx timeout [ 375.596190][ T5849] Bluetooth: hci1: command tx timeout [ 375.596203][ T5849] Bluetooth: hci0: command tx timeout [ 375.596330][ T5853] Bluetooth: hci2: command tx timeout [ 375.745887][ T6145] xt_hashlimit: size too large, truncated to 1048576 [ 375.903460][ T6150] syz_tun: entered allmulticast mode [ 375.907180][ T6150] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(13) [ 375.907202][ T6150] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 375.907315][ T6150] vhci_hcd vhci_hcd.0: Device attached [ 375.913038][ T6151] vhci_hcd: connection closed [ 375.913587][ T6149] syz_tun: left allmulticast mode [ 375.914969][ T12] vhci_hcd vhci_hcd.3: stop threads [ 375.914982][ T12] vhci_hcd vhci_hcd.3: release socket [ 375.914991][ T12] vhci_hcd vhci_hcd.3: disconnect device [ 376.081576][ T6162] netlink: 9 bytes leftover after parsing attributes in process `syz.1.61'. [ 376.254581][ T6177] netlink: 12 bytes leftover after parsing attributes in process `syz.2.68'. [ 376.725943][ T24] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 376.876650][ T24] usb 5-1: New USB device found: idVendor=0525, idProduct=a4a1, bcdDevice=0.40 [ 376.877794][ T24] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 376.878636][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 376.878648][ T24] usb 5-1: SerialNumber: syz [ 377.141818][ T6207] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 377.337169][ T6216] syz_tun: entered allmulticast mode [ 377.341103][ T6216] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(12) [ 377.341118][ T6216] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 377.341266][ T6216] vhci_hcd vhci_hcd.0: Device attached [ 377.342565][ T6219] netlink: 8 bytes leftover after parsing attributes in process `syz.1.82'. [ 377.344561][ T6217] vhci_hcd: connection closed [ 377.345487][ T12] vhci_hcd vhci_hcd.2: stop threads [ 377.345502][ T6215] syz_tun: left allmulticast mode [ 377.345507][ T12] vhci_hcd vhci_hcd.2: release socket [ 377.345524][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 377.352082][ T6219] FAULT_INJECTION: forcing a failure. [ 377.352082][ T6219] name failslab, interval 1, probability 0, space 0, times 0 [ 377.352100][ T6219] CPU: 3 UID: 0 PID: 6219 Comm: syz.1.82 Not tainted syzkaller #0 PREEMPT(full) [ 377.352112][ T6219] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 377.352118][ T6219] Call Trace: [ 377.352123][ T6219] [ 377.352127][ T6219] dump_stack_lvl+0x100/0x190 [ 377.352148][ T6219] should_fail_ex.cold+0x5/0xa [ 377.352165][ T6219] should_failslab+0xc2/0x120 [ 377.352177][ T6219] __kmalloc_cache_noprof+0x91/0x6d0 [ 377.352190][ T6219] ? key_user_lookup+0x16e/0x5a0 [ 377.352205][ T6219] ? key_user_lookup+0x1a3/0x5a0 [ 377.352222][ T6219] key_user_lookup+0x1a3/0x5a0 [ 377.352237][ T6219] ? __pfx_key_user_lookup+0x10/0x10 [ 377.352252][ T6219] ? find_held_lock+0x2b/0x80 [ 377.352263][ T6219] ? keyring_search+0x216/0x400 [ 377.352274][ T6219] ? keyring_search+0x216/0x400 [ 377.352286][ T6219] key_alloc+0x18b/0x1310 [ 377.352303][ T6219] ? lock_acquire+0x1d1/0x380 [ 377.352319][ T6219] ? __pfx_key_alloc+0x10/0x10 [ 377.352334][ T6219] ? __pfx_keyring_search_iterator+0x10/0x10 [ 377.352347][ T6219] keyring_alloc+0x44/0xc0 [ 377.352358][ T6219] look_up_user_keyrings+0x438/0x760 [ 377.352375][ T6219] ? __pfx_look_up_user_keyrings+0x10/0x10 [ 377.352388][ T6219] ? futex_wake+0x4ea/0x5e0 [ 377.352407][ T6219] lookup_user_key+0x275/0x14f0 [ 377.352422][ T6219] ? __pfx_lookup_user_key+0x10/0x10 [ 377.352441][ T6219] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 377.352460][ T6219] ? strncpy_from_user+0x19d/0x2d0 [ 377.352476][ T6219] __do_sys_add_key+0x2a6/0x460 [ 377.352488][ T6219] ? __pfx___do_sys_add_key+0x10/0x10 [ 377.352504][ T6219] do_syscall_64+0x123/0x790 [ 377.352516][ T6219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.352526][ T6219] RIP: 0033:0x7f20ebd9f559 [ 377.352541][ T6219] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 377.352552][ T6219] RSP: 002b:00007f20e9fd5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 377.352563][ T6219] RAX: ffffffffffffffda RBX: 00007f20ec026090 RCX: 00007f20ebd9f559 [ 377.352570][ T6219] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000400 [ 377.352576][ T6219] RBP: 00007f20ebe36b50 R08: fffffffffffffffc R09: 0000000000000000 [ 377.352582][ T6219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 377.352589][ T6219] R13: 00007f20ec026128 R14: 00007f20ec026090 R15: 00007ffdeec9d938 [ 377.352603][ T6219] [ 377.353320][ T6219] netlink: 'syz.1.82': attribute type 10 has an invalid length. [ 377.361755][ T6219] syz_tun: entered promiscuous mode [ 377.369486][ T6219] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 377.511383][ T24] cdc_ether 5-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.0-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 377.637783][ T6231] FAULT_INJECTION: forcing a failure. [ 377.637783][ T6231] name failslab, interval 1, probability 0, space 0, times 0 [ 377.637808][ T6231] CPU: 0 UID: 0 PID: 6231 Comm: syz.1.86 Not tainted syzkaller #0 PREEMPT(full) [ 377.637825][ T6231] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 377.637834][ T6231] Call Trace: [ 377.637839][ T6231] [ 377.637845][ T6231] dump_stack_lvl+0x100/0x190 [ 377.637874][ T6231] should_fail_ex.cold+0x5/0xa [ 377.637898][ T6231] should_failslab+0xc2/0x120 [ 377.637916][ T6231] kmem_cache_alloc_noprof+0x92/0x6a0 [ 377.637940][ T6231] ? mempool_init_node+0x2f7/0x6f0 [ 377.637956][ T6231] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 377.637972][ T6231] mempool_init_node+0x2f7/0x6f0 [ 377.637997][ T6231] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 377.638012][ T6231] ? __pfx_mempool_free_slab+0x10/0x10 [ 377.638028][ T6231] mempool_init_noprof+0x3a/0x50 [ 377.638047][ T6231] bioset_init+0x45e/0x8a0 [ 377.638067][ T6231] ? __pfx_bioset_init+0x10/0x10 [ 377.638086][ T6231] ? mempool_init_node+0x4ca/0x6f0 [ 377.638107][ T6231] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 377.638122][ T6231] ? __pfx_mempool_free_slab+0x10/0x10 [ 377.638142][ T6231] dm_io_client_create+0xce/0x110 [ 377.638165][ T6231] dm_integrity_ctr+0x139c/0x64b0 [ 377.638189][ T6231] ? __pfx_dm_integrity_ctr+0x10/0x10 [ 377.638203][ T6231] ? dm_split_args+0xc1/0x570 [ 377.638216][ T6231] ? rcu_is_watching+0x13/0xc0 [ 377.638232][ T6231] ? dm_split_args+0xc1/0x570 [ 377.638247][ T6231] ? skip_spaces+0xee/0x130 [ 377.638273][ T6231] dm_table_add_target+0x58b/0xee0 [ 377.638293][ T6231] ? __pfx_dm_table_add_target+0x10/0x10 [ 377.638312][ T6231] ? dm_table_create+0x2d3/0x3d0 [ 377.638331][ T6231] table_load+0x3b9/0x7b0 [ 377.638357][ T6231] ? __pfx_table_load+0x10/0x10 [ 377.638376][ T6231] ? __might_fault+0xc5/0x140 [ 377.638392][ T6231] ? __might_fault+0xc5/0x140 [ 377.638417][ T6231] ctl_ioctl+0x4d2/0xcc0 [ 377.638435][ T6231] ? __pfx_table_load+0x10/0x10 [ 377.638456][ T6231] ? __pfx_ctl_ioctl+0x10/0x10 [ 377.638499][ T6231] ? selinux_file_ioctl+0x1e0/0x290 [ 377.638524][ T6231] dm_ctl_ioctl+0x22/0x30 [ 377.638541][ T6231] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 377.638560][ T6231] __x64_sys_ioctl+0x18e/0x210 [ 377.638587][ T6231] do_syscall_64+0x123/0x790 [ 377.638608][ T6231] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.638623][ T6231] RIP: 0033:0x7f20ebd9f559 [ 377.638636][ T6231] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 377.638651][ T6231] RSP: 002b:00007f20e9ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 377.638667][ T6231] RAX: ffffffffffffffda RBX: 00007f20ec025fa0 RCX: 00007f20ebd9f559 [ 377.638677][ T6231] RDX: 0000200000000880 RSI: 00000000c138fd09 RDI: 0000000000000001 [ 377.638687][ T6231] RBP: 00007f20ebe36b50 R08: 0000000000000000 R09: 0000000000000000 [ 377.638696][ T6231] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 377.638705][ T6231] R13: 00007f20ec026038 R14: 00007f20ec025fa0 R15: 00007ffdeec9d938 [ 377.638741][ T6231] [ 377.639538][ T6231] device-mapper: table: 248:0: integrity: Cannot allocate dm io (-ENOMEM) [ 377.639549][ T6231] device-mapper: ioctl: error adding target to table [ 377.676614][ T67] Bluetooth: hci0: command tx timeout [ 377.676646][ T67] Bluetooth: hci1: command tx timeout [ 377.676664][ T67] Bluetooth: hci3: command tx timeout [ 377.677690][ T5853] Bluetooth: hci2: command tx timeout [ 377.726683][ T5810] usb 5-1: USB disconnect, device number 2 [ 377.752699][ T5810] cdc_ether 5-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.0-1, CDC Ethernet Device [ 377.777555][ T6224] syz.3.85 (6224) used greatest stack depth: 16840 bytes left [ 377.793101][ T6240] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 377.871435][ T6246] netlink: 20 bytes leftover after parsing attributes in process `syz.1.91'. [ 377.872839][ T6246] netlink: 12 bytes leftover after parsing attributes in process `syz.1.91'. [ 377.887165][ T6246] [ 377.887985][ T6246] ====================================================== [ 377.890166][ T6246] WARNING: possible circular locking dependency detected [ 377.892439][ T6246] syzkaller #0 Not tainted [ 377.893879][ T6246] ------------------------------------------------------ [ 377.896047][ T6246] syz.1.91/6246 is trying to acquire lock: [ 377.897881][ T6246] ffff888021a62280 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_depend_item_unlocked+0xf3/0x6a0 [ 377.901449][ T6246] [ 377.901449][ T6246] but task is already holding lock: [ 377.901782][ T6254] FAULT_INJECTION: forcing a failure. [ 377.901782][ T6254] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 377.901798][ T6254] CPU: 3 UID: 0 PID: 6254 Comm: syz.3.92 Not tainted syzkaller #0 PREEMPT(full) [ 377.901810][ T6254] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 377.901816][ T6254] Call Trace: [ 377.901819][ T6254] [ 377.901823][ T6254] dump_stack_lvl+0x100/0x190 [ 377.901842][ T6254] should_fail_ex.cold+0x5/0xa [ 377.901856][ T6254] _copy_from_user+0x2e/0xd0 [ 377.901868][ T6254] copy_msghdr_from_user+0x9f/0x4c0 [ 377.901882][ T6254] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 377.901898][ T6254] ? kstrtouint_from_user+0x13c/0x1d0 [ 377.901913][ T6254] ___sys_sendmsg+0x106/0x1e0 [ 377.901928][ T6254] ? __pfx____sys_sendmsg+0x10/0x10 [ 377.901941][ T6254] ? get_pid_task+0x106/0x250 [ 377.901953][ T6254] ? rcu_is_watching+0x13/0xc0 [ 377.901967][ T6254] __sys_sendmsg+0x160/0x210 [ 377.901978][ T6254] ? __pfx___sys_sendmsg+0x10/0x10 [ 377.901990][ T6254] ? rcu_is_watching+0x13/0xc0 [ 377.902001][ T6254] do_syscall_64+0x123/0x790 [ 377.902011][ T6254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.902021][ T6254] RIP: 0033:0x7faaa959f559 [ 377.902029][ T6254] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 377.902039][ T6254] RSP: 002b:00007faaaa4d3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 377.902049][ T6254] RAX: ffffffffffffffda RBX: 00007faaa9825fa0 RCX: 00007faaa959f559 [ 377.902055][ T6254] RDX: 0000000000008410 RSI: 0000200000000000 RDI: 0000000000000003 [ 377.902061][ T6254] RBP: 00007faaaa4d3090 R08: 0000000000000000 R09: 0000000000000000 [ 377.902067][ T6254] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 377.902073][ T6254] R13: 00007faaa9826038 R14: 00007faaa9825fa0 R15: 00007fff8c4769b8 [ 377.902082][ T6254] [ 377.961511][ T6246] ffffffff916b68e0 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x10b/0x610 [ 377.964383][ T6246] [ 377.964383][ T6246] which lock already depends on the new lock. [ 377.964383][ T6246] [ 377.967570][ T6246] [ 377.967570][ T6246] the existing dependency chain (in reverse order) is: [ 377.970357][ T6246] [ 377.970357][ T6246] -> #3 (tpg_instances_lock){+.+.}-{4:4}: [ 377.972801][ T6246] lock_acquire+0x1d1/0x380 [ 377.974401][ T6246] __mutex_lock+0x19f/0x1c10 [ 377.976008][ T6246] tcm_alloc_inst+0x5f/0x1e0 [ 377.977619][ T6246] try_get_usb_function_instance+0x136/0x1f0 [ 377.979630][ T6246] usb_get_function_instance+0x16/0x70 [ 377.981566][ T6246] function_make+0x18c/0x3f0 [ 377.983164][ T6246] configfs_mkdir+0x525/0xd40 [ 377.984799][ T6246] vfs_mkdir+0x36d/0x8a0 [ 377.986358][ T6246] filename_mkdirat+0x4c4/0x630 [ 377.988043][ T6246] __x64_sys_mkdirat+0x89/0xc0 [ 377.989697][ T6246] do_syscall_64+0x123/0x790 [ 377.991303][ T6246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.993302][ T6246] [ 377.993302][ T6246] -> #2 (func_lock){+.+.}-{4:4}: [ 377.995480][ T6246] lock_acquire+0x1d1/0x380 [ 377.997081][ T6246] __mutex_lock+0x19f/0x1c10 [ 377.998672][ T6246] try_get_usb_function_instance+0x26/0x1f0 [ 378.000658][ T6246] usb_get_function_instance+0x16/0x70 [ 378.002558][ T6246] function_make+0x18c/0x3f0 [ 378.004156][ T6246] configfs_mkdir+0x525/0xd40 [ 378.005828][ T6246] vfs_mkdir+0x36d/0x8a0 [ 378.007355][ T6246] filename_mkdirat+0x4c4/0x630 [ 378.009041][ T6246] __x64_sys_mkdirat+0x89/0xc0 [ 378.010801][ T6246] do_syscall_64+0x123/0x790 [ 378.012398][ T6246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.014420][ T6246] [ 378.014420][ T6246] -> #1 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 378.016988][ T6246] lock_acquire+0x1d1/0x380 [ 378.018579][ T6246] __mutex_lock+0x19f/0x1c10 [ 378.020219][ T6246] configfs_rmdir+0x5ae/0x950 [ 378.021914][ T6246] vfs_rmdir+0x328/0x8e0 [ 378.023480][ T6246] filename_rmdir+0x31a/0x610 [ 378.025134][ T6246] __x64_sys_rmdir+0x46/0x70 [ 378.026749][ T6246] do_syscall_64+0x123/0x790 [ 378.028357][ T6246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.030366][ T6246] [ 378.030366][ T6246] -> #0 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 378.033062][ T6246] check_prev_add+0xeb/0xe60 [ 378.034668][ T6246] __lock_acquire+0x1528/0x1f40 [ 378.036361][ T6246] lock_acquire+0x1d1/0x380 [ 378.037954][ T6246] down_write+0x86/0x1f0 [ 378.039453][ T6246] configfs_depend_item_unlocked+0xf3/0x6a0 [ 378.041463][ T6246] usbg_make_tpg+0x251/0x610 [ 378.043062][ T6246] target_fabric_make_tpg+0xab/0x8c0 [ 378.044913][ T6246] configfs_mkdir+0x525/0xd40 [ 378.046557][ T6246] vfs_mkdir+0x36d/0x8a0 [ 378.048070][ T6246] filename_mkdirat+0x4c4/0x630 [ 378.049763][ T6246] __x64_sys_mkdirat+0x89/0xc0 [ 378.051452][ T6246] do_syscall_64+0x123/0x790 [ 378.053066][ T6246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.055052][ T6246] [ 378.055052][ T6246] other info that might help us debug this: [ 378.055052][ T6246] [ 378.058204][ T6246] Chain exists of: [ 378.058204][ T6246] &sb->s_type->i_mutex_key#24 --> func_lock --> tpg_instances_lock [ 378.058204][ T6246] [ 378.062502][ T6246] Possible unsafe locking scenario: [ 378.062502][ T6246] [ 378.064839][ T6246] CPU0 CPU1 [ 378.066523][ T6246] ---- ---- [ 378.068196][ T6246] lock(tpg_instances_lock); [ 378.069678][ T6246] lock(func_lock); [ 378.071669][ T6246] lock(tpg_instances_lock); [ 378.073903][ T6246] lock(&sb->s_type->i_mutex_key#24); [ 378.075597][ T6246] [ 378.075597][ T6246] *** DEADLOCK *** [ 378.075597][ T6246] [ 378.078103][ T6246] locks held by syz.1.91/6246: 4, last CPU#2: [ 378.079978][ T6246] #0: ffff88802579e478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 378.082901][ T6246] #1: ffff888056b23580 (&sb->s_type->i_mutex_key#7/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 [ 378.086282][ T6246] #2: ffffffff911e6788 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_mkdir+0x4c0/0xd40 [ 378.089284][ T6246] #3: ffffffff916b68e0 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x10b/0x610 [ 378.092282][ T6246] [ 378.092282][ T6246] stack backtrace: [ 378.094135][ T6246] CPU: 2 UID: 0 PID: 6246 Comm: syz.1.91 Not tainted syzkaller #0 PREEMPT(full) [ 378.096939][ T6246] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 378.100021][ T6246] Call Trace: [ 378.101098][ T6246] [ 378.102029][ T6246] dump_stack_lvl+0x100/0x190 [ 378.103504][ T6246] print_circular_bug.cold+0x178/0x1be [ 378.105185][ T6246] check_noncircular+0x146/0x160 [ 378.106744][ T6246] check_prev_add+0xeb/0xe60 [ 378.108203][ T6246] __lock_acquire+0x1528/0x1f40 [ 378.109778][ T6246] ? rcu_is_watching+0x13/0xc0 [ 378.111283][ T6246] lock_acquire+0x1d1/0x380 [ 378.112705][ T6246] ? configfs_depend_item_unlocked+0xf3/0x6a0 [ 378.114601][ T6246] ? __pfx___might_resched+0x10/0x10 [ 378.116255][ T6246] down_write+0x86/0x1f0 [ 378.117603][ T6246] ? configfs_depend_item_unlocked+0xf3/0x6a0 [ 378.119481][ T6246] ? __pfx_down_write+0x10/0x10 [ 378.121035][ T6246] ? kstrtou16+0xde/0x130 [ 378.122391][ T6246] configfs_depend_item_unlocked+0xf3/0x6a0 [ 378.124224][ T6246] usbg_make_tpg+0x251/0x610 [ 378.125698][ T6246] ? __pfx_usbg_make_tpg+0x10/0x10 [ 378.127287][ T6246] ? find_held_lock+0x2b/0x80 [ 378.128762][ T6246] ? __pfx_usbg_make_tpg+0x10/0x10 [ 378.130401][ T6246] ? __pfx_target_fabric_make_tpg+0x10/0x10 [ 378.132272][ T6246] target_fabric_make_tpg+0xab/0x8c0 [ 378.133945][ T6246] ? __pfx_target_fabric_make_tpg+0x10/0x10 [ 378.135794][ T6246] configfs_mkdir+0x525/0xd40 [ 378.137296][ T6246] ? may_create+0x280/0x430 [ 378.138733][ T6246] ? __pfx_configfs_mkdir+0x10/0x10 [ 378.140350][ T6246] vfs_mkdir+0x36d/0x8a0 [ 378.141677][ T6246] filename_mkdirat+0x4c4/0x630 [ 378.143222][ T6246] ? __pfx_filename_mkdirat+0x10/0x10 [ 378.144901][ T6246] ? strncpy_from_user+0x19d/0x2d0 [ 378.146476][ T6246] ? do_getname+0x191/0x390 [ 378.147893][ T6246] __x64_sys_mkdirat+0x89/0xc0 [ 378.149330][ T6246] do_syscall_64+0x123/0x790 [ 378.150727][ T6246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.152562][ T6246] RIP: 0033:0x7f20ebd9f559 [ 378.153994][ T6246] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 378.160058][ T6246] RSP: 002b:00007f20e9ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 378.162698][ T6246] RAX: ffffffffffffffda RBX: 00007f20ec025fa0 RCX: 00007f20ebd9f559 [ 378.165194][ T6246] RDX: 00000000000001ff RSI: 0000200000001fc0 RDI: ffffffffffffff9c [ 378.167700][ T6246] RBP: 00007f20ebe36b50 R08: 0000000000000000 R09: 0000000000000000 [ 378.170200][ T6246] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 378.172675][ T6246] R13: 00007f20ec026038 R14: 00007f20ec025fa0 R15: 00007ffdeec9d938 [ 378.175138][ T6246] [ 378.199743][ T6246] ======================================================= [ 378.199743][ T6246] WARNING: The mand mount option has been deprecated and [ 378.199743][ T6246] and is ignored by this kernel. Remove the mand [ 378.199743][ T6246] option from the mount to silence this warning. [ 378.199743][ T6246] ======================================================= [ 378.476432][ T1452] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.476473][ T1452] ieee802154 phy1 wpan1: encryption failed: -22 [ 381.229264][ T5810] rxe_eth0 speed is unknown, defaulting to 1000 [ 381.255166][ T42] kauditd_printk_skb: 42 callbacks suppressed [ 381.255183][ T42] audit: type=1400 audit(1793461687.807:309): avc: denied { write } for pid=6258 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 381.293880][ T42] audit: type=1400 audit(1793461687.847:310): avc: denied { write } for pid=6261 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1