last executing test programs: 24m49.669082507s ago: executing program 0 (id=611): r0 = socket(0x29, 0x2, 0x0) sendmsg$BATADV_CMD_SET_VLAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x33fe0}, 0x1, 0x0, 0x0, 0x4008884}, 0x20004804) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x20, 0xb, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0x9}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x40000) close_range(r0, 0xffffffffffffffff, 0x0) timer_create(0x7, &(0x7f0000000680)={0x0, 0x21}, &(0x7f0000000100)) socket$nl_generic(0x10, 0x3, 0x10) timer_settime(0x0, 0x0, &(0x7f0000000380)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 24m49.53619889s ago: executing program 0 (id=612): getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000000)={{{@in=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f0000000100)=0xe8) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x5, &(0x7f0000000140)=0x2, 0x4) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000180)) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpuset.memory_pressure_enabled\x00', 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000200), 0xffffffff, 0x90000) r3 = dup3(r1, r2, 0x0) r4 = openat$ttyprintk(0xffffff9c, &(0x7f0000000240), 0x2000, 0x0) ioctl$TIOCGLCKTRMIOS(r4, 0x5456, &(0x7f0000000280)={0x8, 0xe, 0x2, 0x9, 0x7, "3a46c117614a643e19c70ab04c8adad8b57617"}) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f00000002c0)={0x8, 0xf6e, 0x8}) r5 = openat2$dir(0xffffff9c, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x80000, 0x2, 0x3}, 0x18) getresgid(&(0x7f00000003c0), &(0x7f0000000400), &(0x7f0000000440)=0x0) fchownat(r5, &(0x7f0000000380)='./file0\x00', r0, r6, 0x100) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000480)={0x10, 0x7, 0x1, {{0x3, '#*\\'}, 0x6}}, 0x10) socket$unix(0x1, 0x2, 0x0) r7 = openat$ptmx(0xffffff9c, &(0x7f00000004c0), 0x2000, 0x0) ioctl$PIO_FONTRESET(r7, 0x4b6d, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x9, 0x3, 0x430, 0x138, 0xffffffff, 0xffffffff, 0x138, 0xffffffff, 0x364, 0xffffffff, 0xffffffff, 0x364, 0xffffffff, 0x3, &(0x7f0000000500), {[{{@uncond, 0x0, 0xf0, 0x138, 0x0, {}, [@common=@eui64={{0x24}}, @common=@icmp6={{0x24}, {0x10, "53de"}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@private=0xa010102, 'bond_slave_0\x00', {0x80000001}}}}, {{@ipv6={@private2, @dev={0xfe, 0x80, '\x00', 0x22}, [0x0, 0x0, 0x0, 0xffffff00], [0xff, 0xffffff00, 0xffffff00, 0xffffff00], 'veth1_vlan\x00', 'syzkaller0\x00', {}, {0xff}, 0x87, 0x2, 0x7, 0x16}, 0x0, 0x20c, 0x22c, 0x0, {}, [@common=@rt={{0x138}, {0x4, [0x9a1], 0xb, 0x2, 0x3, [@loopback, @mcast2, @mcast2, @empty, @private1={0xfc, 0x1, '\x00', 0x1}, @rand_addr=' \x01\x00', @loopback, @dev={0xfe, 0x80, '\x00', 0x26}, @remote, @loopback, @private1, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'], 0xd}}, @common=@srh={{0x2c}, {0x2f, 0x7, 0x7f, 0x3c, 0x3, 0x80, 0x8}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xcc}, {0x24}}}}, 0x48c) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$smc(&(0x7f0000000a40), r3) sendmsg$SMC_PNETID_DEL(r8, &(0x7f0000000b80)={&(0x7f0000000a00), 0xc, &(0x7f0000000b40)={&(0x7f0000000a80)={0x9c, r9, 0x200, 0x70bd25, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_to_team\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x9c}, 0x1, 0x0, 0x0, 0x8805}, 0xc0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), r8) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r10, &(0x7f00000015c0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001580)={&(0x7f0000000c40)={0x91c, r11, 0x100, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x7}}}}, [@NL80211_ATTR_TX_RATES={0x25c, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x50, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x33, 0x2, [{0x0, 0x9}, {0x0, 0x8}, {0x2, 0x8}, {0x7, 0xa}, {0x3, 0x2}, {0x6, 0x6}, {0x6, 0x6}, {0x0, 0x1}, {0x1, 0x7}, {0x2, 0x6}, {0x5, 0x9}, {0x2, 0x3}, {0x5, 0x1}, {0x0, 0x8}, {0x5, 0x6}, {0x4}, {0x6}, {0x0, 0x8}, {0x4, 0x7}, {0x0, 0x5}, {0x4}, {0x7, 0xa}, {0x1, 0x9}, {0x6, 0x9}, {0x0, 0x6}, {0x7, 0x9}, {0x5, 0x4}, {0x4}, {0x7, 0x4}, {0x7, 0x3}, {0x0, 0x5}, {0x2, 0x6}, {0x0, 0x4}, {0x7, 0xa}, {0x4, 0x4}, {0x3, 0x6}, {0x0, 0x7}, {0x2, 0x2}, {0x3, 0x4}, {}, {0x2, 0x6}, {0x3, 0x3}, {0x7, 0x6}, {0x0, 0x7}, {0x6}, {0x6, 0x7}, {0x7, 0x9}]}, @NL80211_TXRATE_HT={0x16, 0x2, [{0x4, 0x7}, {0x5, 0x7}, {0x5, 0x7}, {0x7, 0x9}, {0x5}, {0x3, 0x8}, {0x7, 0x8}, {0x1, 0xa}, {0x2, 0x9}, {0x2, 0x7}, {0x1, 0x7}, {0x7, 0x7}, {0x0, 0x7}, {0x1, 0x7}, {0x7, 0x6}, {0x7, 0x5}, {0x3}, {0x2, 0x2}]}]}, @NL80211_BAND_5GHZ={0x70, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x11, 0x1, [0x48, 0x24, 0x2, 0x5, 0x12, 0x16, 0x4, 0x77, 0x3, 0x24, 0x9, 0x3, 0x18]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7fff, 0x401, 0xa50, 0x7, 0x4, 0x8, 0xb, 0x9]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1ff, 0x5, 0xfff7, 0x1, 0x5, 0x7, 0xb5d, 0x2]}}, @NL80211_TXRATE_HT={0x8, 0x2, [{0x4, 0x2}, {0x6, 0x3}, {0x0, 0x4}, {0x7, 0x1}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x2, 0x10, 0x200, 0xb9, 0x0, 0xfff, 0x8]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x1000, 0x8, 0xfd5, 0xb, 0x4, 0x1, 0xc]}}]}, @NL80211_BAND_5GHZ={0x30, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1000, 0xe, 0x2, 0xb, 0x4, 0xc, 0xaf41, 0x2]}}]}, @NL80211_BAND_60GHZ={0x44, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x40, 0x2, [{0x1, 0xa}, {0x7, 0x5}, {0x1, 0x4}, {0x0, 0x3}, {0x7, 0x6}, {0x2}, {0x0, 0x3}, {0x6, 0x9}, {0x7, 0x5}, {0x7, 0x4}, {0x6, 0x3}, {0x7, 0x3}, {0x2}, {0x1, 0x8}, {0x4, 0x4}, {0x6, 0x8}, {0x0, 0x8}, {0x4, 0xa}, {0x3, 0x5}, {0x0, 0x9}, {0x5}, {0x1, 0xa}, {0x0, 0x3}, {0x5, 0x8}, {0x4, 0x2}, {0x6, 0x9}, {0x5}, {0x5, 0x6}, {0x7, 0x3}, {0x4, 0x1}, {0x7, 0xa}, {0x1, 0x9}, {0x2}, {0x4, 0x9}, {0x3, 0x1}, {0x6, 0xa}, {0x7, 0x7}, {0x6, 0x7}, {0x2, 0x1}, {0x4}, {0x1, 0xa}, {0x7, 0x7}, {}, {0x3, 0x7}, {0x3}, {0x5, 0x6}, {0x7, 0x5}, {0x2, 0x7}, {0x5, 0xa}, {0x0, 0xa}, {0x1, 0x3}, {0x6}, {0x3, 0x2}, {0x0, 0x9}, {0x5, 0x4}, {0x3, 0x9}, {0x4, 0x2}, {0x1, 0x5}, {0x2, 0xa}, {0x4, 0x3}]}]}, @NL80211_BAND_2GHZ={0x6c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0xd5b, 0xffff, 0x8, 0xd34a, 0x4, 0x4, 0x3ff]}}, @NL80211_TXRATE_HT={0x38, 0x2, [{0x7, 0x2}, {0x1, 0x2}, {0x7, 0x2}, {0x1, 0x2}, {0x6, 0x3}, {0x0, 0x2}, {0x0, 0x6}, {0x4, 0x4}, {0x1, 0x8}, {0x3, 0x4}, {0x3}, {0x1, 0x3}, {0x0, 0x8}, {0x6, 0x7}, {0x2, 0x9}, {0x1, 0x5}, {0x4, 0x3}, {0x5, 0x7}, {0x4, 0x6}, {0x6, 0x8}, {0x4, 0x3}, {0x3, 0x2}, {0x3, 0x2}, {0x1, 0x4}, {0x5}, {0x6}, {0x4, 0x7}, {0x2, 0x1}, {0x7, 0x6}, {0x3, 0x5}, {0x4, 0x3}, {}, {0x3, 0xa}, {0x5, 0x1}, {0x7}, {0x0, 0xa}, {0x4}, {0x1, 0x2}, {0x2, 0x7}, {0x2, 0x1}, {0x2, 0x6}, {0x1, 0x6}, {0x3, 0x5}, {0x2, 0x8}, {0x4, 0x6}, {0x7, 0x2}, {0x1, 0x5}, {0x4, 0x1}, {0x6, 0x1}, {0x4, 0x9}, {0x4, 0x1}, {0x4, 0x4}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x3, 0x101, 0x3, 0x5, 0x3, 0x0, 0xa0e]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_2GHZ={0x14, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x44, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x10, 0x1, [0x6, 0x48, 0x36, 0x18, 0x0, 0x24, 0x48, 0x1b, 0x2, 0x60, 0x1b, 0x4]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xa5, 0x4, 0x3, 0x3, 0x1, 0xc, 0x5, 0x7122]}}, @NL80211_TXRATE_LEGACY={0x1b, 0x1, [0x12, 0x1, 0x3, 0x1, 0x2, 0x10, 0x0, 0x1, 0xb, 0x9, 0x60, 0x1b, 0xa, 0x2, 0x1, 0x60, 0x16, 0xb, 0x0, 0x6, 0x2, 0xb, 0x36]}]}, @NL80211_BAND_6GHZ={0x48, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x16, 0x1, [0x9, 0x3, 0xb, 0x12, 0x16, 0xb, 0x4, 0x3, 0x30, 0xc, 0x4, 0x12, 0x79, 0x2, 0x48, 0x6c, 0x30, 0x16]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x24, 0x1, [0x93e4291b4c39b58c, 0x30, 0x4, 0x4, 0x4, 0x12, 0x36, 0x60, 0x5, 0x10, 0x3, 0x12, 0x3, 0x4, 0x6c, 0x12, 0x5, 0x3, 0x5, 0x36, 0x77, 0xc, 0x6, 0x36, 0x24, 0x1, 0x24, 0x1, 0x1, 0x12, 0x0, 0x1]}]}]}, @NL80211_ATTR_TX_RATES={0x27c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe0, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x800, 0x1000, 0x6, 0x4, 0x2, 0x2, 0x6]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x962, 0x7, 0xe, 0xa, 0x7eb9, 0x4, 0x3e2b]}}, @NL80211_TXRATE_HT={0x3c, 0x2, [{0x4, 0x2}, {0x1, 0x8}, {0x3, 0x4}, {0x2, 0xa}, {0x3, 0x5}, {0x1}, {0x1, 0x8}, {0x7}, {0x2, 0x3}, {0x3, 0x8}, {0x7, 0x1}, {0x7, 0x7}, {0x2, 0x5}, {0x4, 0x7}, {0x5, 0x3}, {0x1, 0xa}, {0x3}, {0x0, 0x1}, {0x5, 0x4}, {0x4, 0x9}, {0x0, 0x3}, {0x1}, {0x7, 0x9}, {0x0, 0x2}, {0x1, 0x2}, {0x7, 0x8}, {0x3, 0x8}, {0x4, 0x5}, {0x4, 0x5}, {0x0, 0x4}, {0x4, 0xa}, {0x2, 0x5}, {0x5, 0x4}, {0x5, 0x7}, {0x2, 0x3}, {0x0, 0x3}, {0x1, 0x3}, {0x5, 0x3}, {0x3, 0x3}, {0x3, 0x3}, {0x0, 0x7}, {0x3, 0x4}, {0x2, 0x2}, {0x0, 0x4}, {0x6, 0x1}, {0x6, 0x3}, {0x3, 0x3}, {0x2, 0x1}, {0x2, 0x1}, {0x4, 0x8}, {0x7, 0x6}, {0x7, 0xa}, {0x4}, {0x1, 0x4}, {0x2, 0x6}, {0x3, 0x6}]}, @NL80211_TXRATE_HT={0x50, 0x2, [{0x2, 0x5}, {0x4, 0x6}, {0x2, 0x5}, {0x1, 0x6}, {0x0, 0x3}, {0x5, 0xa}, {0x4, 0x3}, {0x1, 0x9}, {0x0, 0x6}, {0x6, 0x3}, {0x1}, {0x5, 0x7}, {0x0, 0x4}, {0x7, 0x6}, {0x1, 0x4}, {0x6, 0x6}, {0x2, 0x2}, {0x6, 0x8}, {0x6}, {0x5, 0x5}, {0x2, 0x3}, {0x7, 0x3}, {}, {0x7, 0x7}, {0x1, 0x4}, {0x2, 0x6}, {0x6, 0x6}, {0x5}, {0x0, 0x1}, {0x5, 0xa}, {0x2, 0x4}, {0x1, 0x9}, {0x5, 0x7}, {0x1, 0x9}, {0x0, 0x9}, {0x0, 0x9}, {0x4, 0x7}, {0x6, 0x7}, {0x3, 0x4}, {0x6, 0x1}, {0x2, 0x3}, {0x4, 0x7}, {0x4, 0x2}, {0x0, 0x9}, {0x1, 0x2}, {0x0, 0x2}, {0x3, 0x7}, {0x7, 0x2}, {0x3, 0x4}, {0x2, 0x5}, {0x1, 0x7}, {0x5, 0x2}, {0x6, 0x3}, {0x5, 0x9}, {0x1, 0x6}, {0x0, 0x6}, {0x4, 0x9}, {0x1, 0xa}, {0x3, 0x6}, {0x1, 0x6}, {0x5, 0xa}, {0x4, 0x6}, {0x2}, {0x4, 0x5}, {0x0, 0x7}, {0x0, 0xa}, {0x2, 0x5}, {0x1, 0x4}, {0x2, 0x5}, {0x3, 0x3}, {0x1}, {0x0, 0x5}, {0x2, 0x2}, {0x2}, {0x1, 0x7}, {0x7, 0x7}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xffff, 0x1, 0x900, 0x6, 0x4, 0x6, 0xfffc, 0xd]}}]}, @NL80211_BAND_5GHZ={0x20, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x12, 0x1, [0x48, 0x16, 0x1b, 0x36, 0x5, 0xc, 0x6c, 0x24, 0x2, 0x36, 0x71, 0x9, 0x60, 0x30]}]}, @NL80211_BAND_5GHZ={0x88, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x6, 0x9, 0x0, 0x7, 0x2, 0x5, 0x57]}}, @NL80211_TXRATE_HT={0x2c, 0x2, [{0x1, 0x7}, {0x3, 0x5}, {0x5}, {0x3, 0x8}, {0x6, 0xa}, {0x7, 0x9}, {0x1, 0x7}, {0x7}, {0x0, 0xa}, {0x1, 0x4}, {0x2, 0xa}, {0x0, 0x9}, {0x6, 0x1}, {0x7, 0x3}, {0x1, 0x7}, {0x2, 0x5}, {0x3, 0x7}, {0x5, 0x1}, {0x7, 0x6}, {0x6, 0x5}, {0x3, 0x9}, {0x4, 0x6}, {0x0, 0x7}, {0x4, 0x3}, {0x4, 0x9}, {0x6, 0x9}, {0x4, 0xa}, {0x1, 0x5}, {0x0, 0x2}, {0x4, 0x5}, {0x3, 0x4}, {0x4, 0x4}, {0x6, 0x7}, {0x4, 0xa}, {0x4, 0x1}, {0x2, 0xa}, {0x6, 0x3}, {0x6, 0x8}, {0x6, 0x5}, {0x7, 0x2}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_LEGACY={0x10, 0x1, [0xb, 0x1b, 0x30, 0x60, 0x60, 0x12, 0xb, 0x1, 0x3, 0x18, 0x0, 0x1]}, @NL80211_TXRATE_HT={0x21, 0x2, [{0x5, 0x8}, {0x4, 0x8}, {0x1, 0x1}, {0x5, 0x1}, {0x4, 0x9}, {0x4, 0x3}, {0x1, 0x6}, {0x4, 0x3}, {0x0, 0x4}, {0x0, 0xa}, {0x4, 0x3}, {0x4, 0x7}, {0x7, 0x8}, {0x2, 0x6}, {0x3}, {0x0, 0x5}, {0x0, 0xa}, {0x5, 0x7}, {0x6, 0x2}, {0x0, 0x6}, {0x5, 0x1}, {0x2, 0x9}, {0x3, 0x9}, {0x6, 0x1}, {0x4, 0x9}, {0x4, 0x6}, {0x2, 0x8}, {0x3}, {0x2, 0x8}]}]}, @NL80211_BAND_6GHZ={0x64, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x87, 0x9, 0x1, 0x401, 0xff, 0xc, 0x1000, 0x6]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x18, 0x1, [0x9, 0x0, 0x60, 0x5, 0x18, 0x1b, 0x12, 0x60, 0x60, 0x48, 0x4, 0x12, 0x60, 0x12, 0x6, 0x30, 0xccfbc624241a91a8, 0x3, 0x48, 0x12]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0x6, 0x101, 0x5, 0x4, 0xff, 0xffff, 0x3ff]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_6GHZ={0x5c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x3a, 0x2, [{0x3, 0x2}, {0x4, 0xa}, {0x3, 0x4}, {0x7, 0x8}, {0x3, 0x6}, {0x2, 0x4}, {0x0, 0x7}, {0x3, 0x6}, {0x3, 0x7}, {0x0, 0x9}, {0x0, 0x5}, {0x2, 0xa}, {0x3}, {0x0, 0x1}, {0x0, 0x1}, {0x1, 0x9}, {0x3, 0x1}, {0x6, 0x6}, {0x0, 0x7}, {0x6, 0x9}, {0x4, 0x5}, {0x3}, {0x4, 0x8}, {0x6, 0x5}, {0x0, 0x3}, {0x1}, {0x5}, {0x6, 0x5}, {0x6, 0x3}, {0x7, 0x3}, {0x4, 0x2}, {0x7, 0x2}, {0x0, 0x2}, {0x4, 0x2}, {0x4, 0x6}, {0x4, 0xa}, {0x0, 0x3}, {0x2, 0x3}, {0x6, 0x4}, {0x2, 0x7}, {0x2, 0xa}, {0x7, 0x1}, {0x1, 0x3}, {0x6, 0x5}, {0x1, 0x9}, {0x4}, {0x1, 0x2}, {0x7, 0x5}, {0x0, 0x1}, {0x3, 0x9}, {0x6, 0x9}, {0x4, 0x8}, {0x4, 0x9}, {0x4, 0x2}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HT={0x12, 0x2, [{0x7}, {0x1, 0x8}, {0x0, 0xa}, {0x1, 0x6}, {0x4, 0x7}, {0x1, 0x6}, {0x7, 0xa}, {0x5, 0x5}, {0x7, 0x6}, {0x3, 0x8}, {0x1}, {0x0, 0x7}, {0x0, 0x9}, {0x1, 0xa}]}]}, @NL80211_BAND_6GHZ={0x18, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x3, 0x7, 0x8, 0x5, 0x6, 0x9, 0x400]}}]}, @NL80211_BAND_60GHZ={0x18, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x8, 0x7, 0x6, 0x6, 0x8, 0x2]}}]}]}, @NL80211_ATTR_TX_RATES={0xac, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x4c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0xc, 0x1, [0x16, 0x36, 0x13, 0x0, 0x12, 0x6c, 0x18, 0x36]}, @NL80211_TXRATE_HT={0x32, 0x2, [{0x6, 0x8}, {0x1, 0x6}, {0x0, 0x3}, {0x3}, {0x5, 0xa}, {0x6, 0x2}, {}, {0x7, 0x5}, {0x5, 0x9}, {0x7, 0x2}, {0x7, 0x6}, {0x5, 0x8}, {0x7, 0x9}, {0x2, 0x9}, {0x4, 0x4}, {0x4, 0x5}, {0x7, 0x7}, {0x6, 0x8}, {0x1, 0x9}, {0x1, 0x8}, {0x5, 0x2}, {0x5, 0x9}, {0x1}, {0x4, 0x4}, {0x0, 0x6}, {0x6, 0x1}, {0x1, 0x2}, {0x7, 0x1}, {0x0, 0xa}, {0x0, 0x8}, {0x1, 0x8}, {0x1, 0x6}, {0x6, 0x15}, {0x5, 0x2}, {0x3, 0x4}, {0x6, 0x9}, {0x5, 0x4}, {0x7, 0x8}, {0x2}, {0x3, 0x9}, {0x5, 0x8}, {0x7, 0xa}, {0x1, 0xa}, {0x5, 0x8}, {0x5, 0x1}, {0x4, 0x6}]}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0xc]}]}, @NL80211_BAND_2GHZ={0x5c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x24, 0x1, [0x12, 0x0, 0xb, 0x1, 0x5, 0x1, 0x1, 0x1, 0x48, 0x5, 0xd, 0x9, 0x24, 0xe, 0x6, 0x1b, 0x36, 0x18, 0x23, 0x9, 0x5, 0x30, 0x6c, 0x1b, 0x30, 0x7f, 0x1, 0x16, 0xb, 0x48, 0xc, 0x3]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xc, 0xb, 0x3, 0x2, 0xa300, 0x6, 0x2e]}}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x30, 0x36, 0xb, 0x9c, 0x9, 0x5, 0x1, 0x63, 0xb, 0x44, 0xc, 0x48, 0x18, 0xc, 0x30, 0x2, 0x77, 0xb, 0x24, 0x5, 0x24, 0x3, 0x6, 0x12, 0x30]}]}]}, @NL80211_ATTR_TX_RATES={0x188, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x34, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x7, 0x0, 0x0, 0x0, 0x3, 0x9, 0x1]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xbb, 0x800, 0x23d6, 0x90ed, 0x401, 0x8, 0x7f, 0x2]}}]}, @NL80211_BAND_60GHZ={0x78, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x14, 0x1, [0x16, 0x1b, 0x60, 0x9, 0x2, 0x9, 0x9, 0x9, 0x1, 0x1b, 0x4, 0x3, 0x4, 0x36, 0x5, 0x30]}, @NL80211_TXRATE_HT={0x35, 0x2, [{0x2, 0x1}, {0x7, 0x6}, {0x4, 0x8}, {0x1, 0x9}, {0x2, 0x5}, {0x1, 0x4}, {0x5}, {0x1, 0x1}, {0x0, 0xa}, {0x1, 0x4}, {0x3, 0x8}, {0x6, 0xa}, {0x4, 0x6}, {0x1, 0x6}, {0x5, 0x8}, {0x5, 0x5}, {0x3, 0xa}, {0x5, 0x8}, {0x2, 0x9}, {0x4}, {0x3, 0x8}, {0x6, 0xa}, {0x1, 0x4}, {0x2, 0x8}, {0x7}, {0x0, 0x8}, {0x0, 0x2}, {0x2, 0x3}, {0x4, 0xa}, {0x5, 0x5}, {0x4, 0x8}, {0x5, 0x3}, {0x7, 0x2}, {0x3, 0x8}, {0x1, 0x2}, {0x2, 0xa}, {0x4, 0x4}, {0x7, 0xa}, {0x1, 0x8}, {0x4, 0x2}, {0x1, 0x1}, {0x5, 0x2}, {0x3, 0xa}, {0x5, 0x6}, {0x5, 0xa}, {0x3, 0x1}, {0x1}, {0x1, 0x6}, {0x3, 0xa}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x2, 0x9, 0x9b, 0xd4cb, 0x6, 0x3, 0x3]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0xfff, 0x120, 0x3, 0x5, 0x8, 0xfffc, 0xbcab]}}]}, @NL80211_BAND_60GHZ={0x34, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2e, 0x2, [{0x0, 0x5}, {0x1, 0x6}, {0x1, 0x3}, {0x7, 0x9}, {0x6, 0x3}, {0x5, 0x7}, {0x1, 0x5}, {0x7, 0x4}, {0x2, 0x1}, {0x1, 0x3}, {0x2, 0x5}, {0x5, 0xa}, {0x6, 0x4}, {0x2, 0x5}, {0x1, 0x6}, {0x1, 0x8}, {0x0, 0x9}, {0x2}, {0x4, 0x2}, {0x1, 0xa}, {0x7, 0x5}, {0x1, 0x7}, {0x5, 0x1}, {0x3, 0x3}, {0x3, 0x1}, {0x4, 0x5}, {0x3}, {0x0, 0x2}, {0x3, 0x6}, {0x0, 0x5}, {0x5, 0x8}, {0x7, 0x3}, {0x2, 0x6}, {0x3, 0x1}, {0x4, 0x8}, {0x4, 0x3}, {0x2, 0x8}, {0x5, 0xa}, {0x0, 0x9}, {0x2, 0x4}, {0x2, 0xa}, {0x6, 0x3}]}]}, @NL80211_BAND_2GHZ={0x68, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0xd, 0x2, [{0x3}, {0x1, 0x3}, {0x6, 0x3}, {0x4, 0x7}, {0x5, 0x7}, {0x1, 0x1}, {0x5, 0x9}, {0x4, 0x3}, {0x6, 0x5}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x0, 0x0, 0x3, 0x5, 0x400, 0x1]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0x2, 0x800, 0x5, 0x5, 0x0, 0x1, 0xffff]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x5, 0xd, 0x4, 0x3, 0x5, 0x8, 0x5]}}]}, @NL80211_BAND_6GHZ={0x18, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xd8f4, 0x152, 0x6, 0x7400, 0x0, 0x3, 0x9, 0x5]}}]}, @NL80211_BAND_6GHZ={0x20, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x10, 0xe, 0x0, 0xf6c, 0x5, 0x9b, 0x2, 0x5]}}]}, @NL80211_BAND_6GHZ={0x4}]}, @NL80211_ATTR_TX_RATES={0x54, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x50, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1c, 0x1, [0x3, 0x12, 0x6c, 0x1, 0x4, 0x16, 0x4, 0x24, 0x9, 0x30, 0x6, 0x12, 0xc, 0x48, 0x3, 0x48, 0x6, 0x3, 0x12, 0x60, 0x1b, 0x6, 0xc, 0x0]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x7, 0x800, 0x6, 0x6, 0x400, 0x200, 0xb]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xfde, 0x6, 0x4, 0x7, 0x8, 0xdd77, 0x6, 0x120]}}]}]}, @NL80211_ATTR_TX_RATES={0x19c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_60GHZ={0x30, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x5, 0x95f8, 0xac, 0x9, 0xa35, 0x81, 0x5]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_60GHZ={0x30, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x8d, 0x1, 0xc, 0xc, 0x24, 0x78, 0x2]}}]}, @NL80211_BAND_2GHZ={0x20, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x9, 0x7f1, 0x3ff, 0x4, 0x2, 0x101, 0xf5]}}]}, @NL80211_BAND_6GHZ={0x7c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x14, 0x2, [{0x6, 0x1}, {0x5, 0x9}, {0x1, 0x2}, {0x2}, {0x4}, {0x1, 0x2}, {0x7, 0x7}, {0x5, 0x6}, {0x4, 0x6}, {0x5, 0xa}, {0x4, 0x4}, {}, {0x1, 0x7}, {0x3, 0x6}, {0x4, 0x7}, {0x2}]}, @NL80211_TXRATE_HT={0x2e, 0x2, [{0x3, 0x7}, {0x6, 0x2}, {0x1, 0x4}, {0x1, 0x2}, {0x0, 0x6}, {0x7, 0x6}, {0x1, 0x9}, {0x7, 0x4}, {0x4}, {0x1, 0x8}, {0x4, 0xa}, {0x1, 0x9}, {0x5, 0x9}, {0x2}, {0x2}, {0x2}, {0x0, 0x7}, {0x7, 0x1}, {0x7, 0x5}, {0x7, 0x7}, {0x1, 0x8}, {0x1, 0xa}, {0x0, 0x7}, {0x1, 0x2}, {0x4, 0x8}, {0x0, 0x7}, {0x3, 0x5}, {0x0, 0x9}, {0x3, 0x1}, {0x4, 0xa}, {0x7, 0x1}, {0x7, 0x8}, {0x4, 0x1}, {0x7, 0x4}, {0x0, 0x4}, {0x3, 0x7}, {0x0, 0x2}, {0x2}, {0x0, 0x8}, {0x2, 0x6}, {0x4, 0x5}, {0x4, 0x3}]}, @NL80211_TXRATE_HT={0x6, 0x2, [{0x0, 0x2}, {0x4, 0xa}]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x581b, 0x5, 0x3, 0x2, 0x7, 0x2e4, 0xff, 0x3]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x3}]}, @NL80211_BAND_6GHZ={0x44, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x1, 0xfffa, 0x9, 0x1, 0xf577, 0x2a80, 0xc4]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0x13, 0x2, [{0x1, 0x8}, {0x3, 0x5}, {0x0, 0x9}, {0x4, 0x7}, {}, {0x7, 0x3}, {0x1, 0x7}, {0x2, 0x6}, {0x0, 0x4}, {0x5, 0x3}, {0x0, 0x7}, {0x6, 0x9}, {0x7, 0x3}, {0x2, 0xa}, {0x7, 0x7}]}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_6GHZ={0x4c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HT={0x36, 0x2, [{}, {}, {0x5, 0x1}, {0x6, 0x3}, {0x5, 0x4}, {0x4, 0x8}, {0x1, 0x8}, {0x6, 0x1}, {0x4, 0xa}, {0x6, 0x8}, {0x2, 0x5}, {0x5, 0x2}, {0x2, 0x2}, {0x1, 0x8}, {0x6, 0x7}, {0x2, 0x9}, {0x6, 0xa}, {0x1, 0x4}, {0x7, 0x5}, {}, {}, {0x1, 0x6}, {0x3, 0x2}, {0x4, 0x1}, {0x4, 0x5}, {0x6, 0x9}, {0x0, 0x2}, {0x2, 0x2}, {0x4, 0x3}, {0x1, 0xa}, {0x1, 0x3}, {0x1}, {0x7, 0x6}, {0x3, 0x3}, {0x6, 0xa}, {0x6, 0x8}, {0x6, 0xa}, {0x6, 0x9}, {0x4}, {0x1, 0x2}, {0x1, 0x5}, {0x2, 0x6}, {0x5, 0x3}, {0x5, 0x6}, {0x3, 0x3}, {0x1, 0x8}, {0x7, 0x5}, {0x5, 0xa}, {0x1, 0x8}, {0x7, 0x4}]}]}]}]}, 0x91c}, 0x1, 0x0, 0x0, 0x4}, 0x20000020) write$P9_RSTAT(r3, &(0x7f0000001600)={0x44, 0x7d, 0x1, {0x0, 0x3d, 0x1, 0x2, {0x40, 0x1, 0x7}, 0x41018000, 0xfff, 0x2, 0x80, 0x0, '', 0x1, '\x00', 0x8, 'nl80211\x00', 0x1, ':'}}, 0x44) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f00000016c0), r1) sendmsg$NL80211_CMD_FRAME_WAIT_CANCEL(r12, &(0x7f0000001780)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001740)={&(0x7f0000001700)={0x2c, r13, 0x20, 0x70bd26, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x2c}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x1a}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000080}, 0x4000) fsetxattr$security_ima(r7, &(0x7f00000017c0), &(0x7f0000001800)=@v1={0x2, "2a0e5b5a67b4adfc"}, 0x9, 0x1) setsockopt$netlink_NETLINK_NO_ENOBUFS(r8, 0x10e, 0x5, &(0x7f0000001840)=0x1e, 0x4) ioctl$EXT4_IOC_MIGRATE(r8, 0x6609) 24m49.180037334s ago: executing program 0 (id=613): r0 = openat$binderfs(0xffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x2, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000440)={0x3}) (fail_nth: 4) 24m49.070469494s ago: executing program 0 (id=614): r0 = openat$sequencer(0xffffff9c, &(0x7f0000000040), 0x8000, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) (async) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) (async) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000003c0)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r3, 0x3}, 0x18) (async) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r3, 0x3}, 0x18) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r2) sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x40) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000300)='./file0/../file0\x00', &(0x7f00000002c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) openat$zero(0xffffff9c, &(0x7f0000000200), 0x100, 0x0) (async) r4 = openat$zero(0xffffff9c, &(0x7f0000000200), 0x100, 0x0) ioctl$BTRFS_IOC_SYNC(r4, 0x9408, 0x0) (async) ioctl$BTRFS_IOC_SYNC(r4, 0x9408, 0x0) eventfd(0x0) (async) r5 = eventfd(0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r5, 0x5421, &(0x7f0000000080)={'sit0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) recvmsg$unix(r6, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)=@delneigh={0x1c, 0x1d, 0x1}, 0x1c}}, 0x0) ioctl$AUTOFS_IOC_EXPIRE(r4, 0x810c9365, &(0x7f0000000080)={{0x3ff, 0x7}, 0x100, './file0\x00'}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) ioctl$FIOCLEX(r1, 0x5451) 24m47.919390883s ago: executing program 0 (id=617): getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000000)={{{@in=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f0000000100)=0xe8) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x5, &(0x7f0000000140)=0x2, 0x4) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000180)) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpuset.memory_pressure_enabled\x00', 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000200), 0xffffffff, 0x90000) r3 = dup3(r1, r2, 0x0) r4 = openat$ttyprintk(0xffffff9c, &(0x7f0000000240), 0x2000, 0x0) ioctl$TIOCGLCKTRMIOS(r4, 0x5456, &(0x7f0000000280)={0x8, 0xe, 0x2, 0x9, 0x7, "3a46c117614a643e19c70ab04c8adad8b57617"}) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f00000002c0)={0x8, 0xf6e, 0x8}) r5 = openat2$dir(0xffffff9c, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x80000, 0x2, 0x3}, 0x18) getresgid(&(0x7f00000003c0), &(0x7f0000000400), &(0x7f0000000440)=0x0) fchownat(r5, &(0x7f0000000380)='./file0\x00', r0, r6, 0x100) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000480)={0x10, 0x7, 0x1, {{0x3, '#*\\'}, 0x6}}, 0x10) socket$unix(0x1, 0x2, 0x0) r7 = openat$ptmx(0xffffff9c, &(0x7f00000004c0), 0x2000, 0x0) ioctl$PIO_FONTRESET(r7, 0x4b6d, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x9, 0x3, 0x430, 0x138, 0xffffffff, 0xffffffff, 0x138, 0xffffffff, 0x364, 0xffffffff, 0xffffffff, 0x364, 0xffffffff, 0x3, &(0x7f0000000500), {[{{@uncond, 0x0, 0xf0, 0x138, 0x0, {}, [@common=@eui64={{0x24}}, @common=@icmp6={{0x24}, {0x10, "53de"}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@private=0xa010102, 'bond_slave_0\x00', {0x80000001}}}}, {{@ipv6={@private2, @dev={0xfe, 0x80, '\x00', 0x22}, [0x0, 0x0, 0x0, 0xffffff00], [0xff, 0xffffff00, 0xffffff00, 0xffffff00], 'veth1_vlan\x00', 'syzkaller0\x00', {}, {0xff}, 0x87, 0x2, 0x7, 0x16}, 0x0, 0x20c, 0x22c, 0x0, {}, [@common=@rt={{0x138}, {0x4, [0x9a1], 0xb, 0x2, 0x3, [@loopback, @mcast2, @mcast2, @empty, @private1={0xfc, 0x1, '\x00', 0x1}, @rand_addr=' \x01\x00', @loopback, @dev={0xfe, 0x80, '\x00', 0x26}, @remote, @loopback, @private1, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'], 0xd}}, @common=@srh={{0x2c}, {0x2f, 0x7, 0x7f, 0x3c, 0x3, 0x80, 0x8}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xcc}, {0x24}}}}, 0x48c) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$smc(&(0x7f0000000a40), r3) sendmsg$SMC_PNETID_DEL(r8, &(0x7f0000000b80)={&(0x7f0000000a00), 0xc, &(0x7f0000000b40)={&(0x7f0000000a80)={0x9c, r9, 0x200, 0x70bd25, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_to_team\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x9c}, 0x1, 0x0, 0x0, 0x8805}, 0xc0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), r8) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r10, &(0x7f00000015c0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001580)={&(0x7f0000000c40)={0x91c, r11, 0x100, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x7}}}}, [@NL80211_ATTR_TX_RATES={0x25c, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x50, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x33, 0x2, [{0x0, 0x9}, {0x0, 0x8}, {0x2, 0x8}, {0x7, 0xa}, {0x3, 0x2}, {0x6, 0x6}, {0x6, 0x6}, {0x0, 0x1}, {0x1, 0x7}, {0x2, 0x6}, {0x5, 0x9}, {0x2, 0x3}, {0x5, 0x1}, {0x0, 0x8}, {0x5, 0x6}, {0x4}, {0x6}, {0x0, 0x8}, {0x4, 0x7}, {0x0, 0x5}, {0x4}, {0x7, 0xa}, {0x1, 0x9}, {0x6, 0x9}, {0x0, 0x6}, {0x7, 0x9}, {0x5, 0x4}, {0x4}, {0x7, 0x4}, {0x7, 0x3}, {0x0, 0x5}, {0x2, 0x6}, {0x0, 0x4}, {0x7, 0xa}, {0x4, 0x4}, {0x3, 0x6}, {0x0, 0x7}, {0x2, 0x2}, {0x3, 0x4}, {}, {0x2, 0x6}, {0x3, 0x3}, {0x7, 0x6}, {0x0, 0x7}, {0x6}, {0x6, 0x7}, {0x7, 0x9}]}, @NL80211_TXRATE_HT={0x16, 0x2, [{0x4, 0x7}, {0x5, 0x7}, {0x5, 0x7}, {0x7, 0x9}, {0x5}, {0x3, 0x8}, {0x7, 0x8}, {0x1, 0xa}, {0x2, 0x9}, {0x2, 0x7}, {0x1, 0x7}, {0x7, 0x7}, {0x0, 0x7}, {0x1, 0x7}, {0x7, 0x6}, {0x7, 0x5}, {0x3}, {0x2, 0x2}]}]}, @NL80211_BAND_5GHZ={0x70, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x11, 0x1, [0x48, 0x24, 0x2, 0x5, 0x12, 0x16, 0x4, 0x77, 0x3, 0x24, 0x9, 0x3, 0x18]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7fff, 0x401, 0xa50, 0x7, 0x4, 0x8, 0xb, 0x9]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1ff, 0x5, 0xfff7, 0x1, 0x5, 0x7, 0xb5d, 0x2]}}, @NL80211_TXRATE_HT={0x8, 0x2, [{0x4, 0x2}, {0x6, 0x3}, {0x0, 0x4}, {0x7, 0x1}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x2, 0x10, 0x200, 0xb9, 0x0, 0xfff, 0x8]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x1000, 0x8, 0xfd5, 0xb, 0x4, 0x1, 0xc]}}]}, @NL80211_BAND_5GHZ={0x30, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1000, 0xe, 0x2, 0xb, 0x4, 0xc, 0xaf41, 0x2]}}]}, @NL80211_BAND_60GHZ={0x44, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x40, 0x2, [{0x1, 0xa}, {0x7, 0x5}, {0x1, 0x4}, {0x0, 0x3}, {0x7, 0x6}, {0x2}, {0x0, 0x3}, {0x6, 0x9}, {0x7, 0x5}, {0x7, 0x4}, {0x6, 0x3}, {0x7, 0x3}, {0x2}, {0x1, 0x8}, {0x4, 0x4}, {0x6, 0x8}, {0x0, 0x8}, {0x4, 0xa}, {0x3, 0x5}, {0x0, 0x9}, {0x5}, {0x1, 0xa}, {0x0, 0x3}, {0x5, 0x8}, {0x4, 0x2}, {0x6, 0x9}, {0x5}, {0x5, 0x6}, {0x7, 0x3}, {0x4, 0x1}, {0x7, 0xa}, {0x1, 0x9}, {0x2}, {0x4, 0x9}, {0x3, 0x1}, {0x6, 0xa}, {0x7, 0x7}, {0x6, 0x7}, {0x2, 0x1}, {0x4}, {0x1, 0xa}, {0x7, 0x7}, {}, {0x3, 0x7}, {0x3}, {0x5, 0x6}, {0x7, 0x5}, {0x2, 0x7}, {0x5, 0xa}, {0x0, 0xa}, {0x1, 0x3}, {0x6}, {0x3, 0x2}, {0x0, 0x9}, {0x5, 0x4}, {0x3, 0x9}, {0x4, 0x2}, {0x1, 0x5}, {0x2, 0xa}, {0x4, 0x3}]}]}, @NL80211_BAND_2GHZ={0x6c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0xd5b, 0xffff, 0x8, 0xd34a, 0x4, 0x4, 0x3ff]}}, @NL80211_TXRATE_HT={0x38, 0x2, [{0x7, 0x2}, {0x1, 0x2}, {0x7, 0x2}, {0x1, 0x2}, {0x6, 0x3}, {0x0, 0x2}, {0x0, 0x6}, {0x4, 0x4}, {0x1, 0x8}, {0x3, 0x4}, {0x3}, {0x1, 0x3}, {0x0, 0x8}, {0x6, 0x7}, {0x2, 0x9}, {0x1, 0x5}, {0x4, 0x3}, {0x5, 0x7}, {0x4, 0x6}, {0x6, 0x8}, {0x4, 0x3}, {0x3, 0x2}, {0x3, 0x2}, {0x1, 0x4}, {0x5}, {0x6}, {0x4, 0x7}, {0x2, 0x1}, {0x7, 0x6}, {0x3, 0x5}, {0x4, 0x3}, {}, {0x3, 0xa}, {0x5, 0x1}, {0x7}, {0x0, 0xa}, {0x4}, {0x1, 0x2}, {0x2, 0x7}, {0x2, 0x1}, {0x2, 0x6}, {0x1, 0x6}, {0x3, 0x5}, {0x2, 0x8}, {0x4, 0x6}, {0x7, 0x2}, {0x1, 0x5}, {0x4, 0x1}, {0x6, 0x1}, {0x4, 0x9}, {0x4, 0x1}, {0x4, 0x4}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x3, 0x101, 0x3, 0x5, 0x3, 0x0, 0xa0e]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_2GHZ={0x14, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x44, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x10, 0x1, [0x6, 0x48, 0x36, 0x18, 0x0, 0x24, 0x48, 0x1b, 0x2, 0x60, 0x1b, 0x4]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xa5, 0x4, 0x3, 0x3, 0x1, 0xc, 0x5, 0x7122]}}, @NL80211_TXRATE_LEGACY={0x1b, 0x1, [0x12, 0x1, 0x3, 0x1, 0x2, 0x10, 0x0, 0x1, 0xb, 0x9, 0x60, 0x1b, 0xa, 0x2, 0x1, 0x60, 0x16, 0xb, 0x0, 0x6, 0x2, 0xb, 0x36]}]}, @NL80211_BAND_6GHZ={0x48, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x16, 0x1, [0x9, 0x3, 0xb, 0x12, 0x16, 0xb, 0x4, 0x3, 0x30, 0xc, 0x4, 0x12, 0x79, 0x2, 0x48, 0x6c, 0x30, 0x16]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x24, 0x1, [0x93e4291b4c39b58c, 0x30, 0x4, 0x4, 0x4, 0x12, 0x36, 0x60, 0x5, 0x10, 0x3, 0x12, 0x3, 0x4, 0x6c, 0x12, 0x5, 0x3, 0x5, 0x36, 0x77, 0xc, 0x6, 0x36, 0x24, 0x1, 0x24, 0x1, 0x1, 0x12, 0x0, 0x1]}]}]}, @NL80211_ATTR_TX_RATES={0x27c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe0, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x800, 0x1000, 0x6, 0x4, 0x2, 0x2, 0x6]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x962, 0x7, 0xe, 0xa, 0x7eb9, 0x4, 0x3e2b]}}, @NL80211_TXRATE_HT={0x3c, 0x2, [{0x4, 0x2}, {0x1, 0x8}, {0x3, 0x4}, {0x2, 0xa}, {0x3, 0x5}, {0x1}, {0x1, 0x8}, {0x7}, {0x2, 0x3}, {0x3, 0x8}, {0x7, 0x1}, {0x7, 0x7}, {0x2, 0x5}, {0x4, 0x7}, {0x5, 0x3}, {0x1, 0xa}, {0x3}, {0x0, 0x1}, {0x5, 0x4}, {0x4, 0x9}, {0x0, 0x3}, {0x1}, {0x7, 0x9}, {0x0, 0x2}, {0x1, 0x2}, {0x7, 0x8}, {0x3, 0x8}, {0x4, 0x5}, {0x4, 0x5}, {0x0, 0x4}, {0x4, 0xa}, {0x2, 0x5}, {0x5, 0x4}, {0x5, 0x7}, {0x2, 0x3}, {0x0, 0x3}, {0x1, 0x3}, {0x5, 0x3}, {0x3, 0x3}, {0x3, 0x3}, {0x0, 0x7}, {0x3, 0x4}, {0x2, 0x2}, {0x0, 0x4}, {0x6, 0x1}, {0x6, 0x3}, {0x3, 0x3}, {0x2, 0x1}, {0x2, 0x1}, {0x4, 0x8}, {0x7, 0x6}, {0x7, 0xa}, {0x4}, {0x1, 0x4}, {0x2, 0x6}, {0x3, 0x6}]}, @NL80211_TXRATE_HT={0x50, 0x2, [{0x2, 0x5}, {0x4, 0x6}, {0x2, 0x5}, {0x1, 0x6}, {0x0, 0x3}, {0x5, 0xa}, {0x4, 0x3}, {0x1, 0x9}, {0x0, 0x6}, {0x6, 0x3}, {0x1}, {0x5, 0x7}, {0x0, 0x4}, {0x7, 0x6}, {0x1, 0x4}, {0x6, 0x6}, {0x2, 0x2}, {0x6, 0x8}, {0x6}, {0x5, 0x5}, {0x2, 0x3}, {0x7, 0x3}, {}, {0x7, 0x7}, {0x1, 0x4}, {0x2, 0x6}, {0x6, 0x6}, {0x5}, {0x0, 0x1}, {0x5, 0xa}, {0x2, 0x4}, {0x1, 0x9}, {0x5, 0x7}, {0x1, 0x9}, {0x0, 0x9}, {0x0, 0x9}, {0x4, 0x7}, {0x6, 0x7}, {0x3, 0x4}, {0x6, 0x1}, {0x2, 0x3}, {0x4, 0x7}, {0x4, 0x2}, {0x0, 0x9}, {0x1, 0x2}, {0x0, 0x2}, {0x3, 0x7}, {0x7, 0x2}, {0x3, 0x4}, {0x2, 0x5}, {0x1, 0x7}, {0x5, 0x2}, {0x6, 0x3}, {0x5, 0x9}, {0x1, 0x6}, {0x0, 0x6}, {0x4, 0x9}, {0x1, 0xa}, {0x3, 0x6}, {0x1, 0x6}, {0x5, 0xa}, {0x4, 0x6}, {0x2}, {0x4, 0x5}, {0x0, 0x7}, {0x0, 0xa}, {0x2, 0x5}, {0x1, 0x4}, {0x2, 0x5}, {0x4, 0xa}, {0x1}, {0x0, 0x5}, {0x2, 0x2}, {0x2}, {0x1, 0x7}, {0x7, 0x7}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xffff, 0x1, 0x900, 0x6, 0x4, 0x6, 0xfffc, 0xd]}}]}, @NL80211_BAND_5GHZ={0x20, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x12, 0x1, [0x48, 0x16, 0x1b, 0x36, 0x5, 0xc, 0x6c, 0x24, 0x2, 0x36, 0x71, 0x9, 0x60, 0x30]}]}, @NL80211_BAND_5GHZ={0x88, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x6, 0x9, 0x0, 0x7, 0x2, 0x5, 0x57]}}, @NL80211_TXRATE_HT={0x2c, 0x2, [{0x1, 0x7}, {0x3, 0x5}, {0x5}, {0x3, 0x8}, {0x6, 0xa}, {0x7, 0x9}, {0x1, 0x7}, {0x7}, {0x0, 0xa}, {0x1, 0x4}, {0x2, 0xa}, {0x0, 0x9}, {0x6, 0x1}, {0x7, 0x3}, {0x1, 0x7}, {0x2, 0x5}, {0x3, 0x7}, {0x5, 0x1}, {0x7, 0x6}, {0x6, 0x5}, {0x3, 0x9}, {0x4, 0x6}, {0x0, 0x7}, {0x4, 0x3}, {0x4, 0x9}, {0x6, 0x9}, {0x4, 0xa}, {0x1, 0x5}, {0x0, 0x2}, {0x4, 0x5}, {0x3, 0x4}, {0x4, 0x4}, {0x6, 0x7}, {0x4, 0xa}, {0x4, 0x1}, {0x2, 0xa}, {0x6, 0x3}, {0x6, 0x8}, {0x6, 0x5}, {0x7, 0x2}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_LEGACY={0x10, 0x1, [0xb, 0x1b, 0x30, 0x60, 0x60, 0x12, 0xb, 0x1, 0x3, 0x18, 0x0, 0x1]}, @NL80211_TXRATE_HT={0x21, 0x2, [{0x5, 0x8}, {0x4, 0x8}, {0x1, 0x1}, {0x5, 0x1}, {0x4, 0x9}, {0x4, 0x3}, {0x1, 0x6}, {0x4, 0x3}, {0x0, 0x4}, {0x0, 0xa}, {0x4, 0x3}, {0x4, 0x7}, {0x7, 0x8}, {0x2, 0x6}, {0x3}, {0x0, 0x5}, {0x0, 0xa}, {0x5, 0x7}, {0x6, 0x2}, {0x0, 0x6}, {0x5, 0x1}, {0x2, 0x9}, {0x3, 0x9}, {0x6, 0x1}, {0x4, 0x9}, {0x4, 0x6}, {0x2, 0x8}, {0x3}, {0x2, 0x8}]}]}, @NL80211_BAND_6GHZ={0x64, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x87, 0x9, 0x1, 0x401, 0xff, 0xc, 0x1000, 0x6]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x18, 0x1, [0x9, 0x0, 0x60, 0x5, 0x18, 0x1b, 0x12, 0x60, 0x60, 0x48, 0x4, 0x12, 0x60, 0x12, 0x6, 0x30, 0xccfbc624241a91a8, 0x3, 0x48, 0x12]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0x6, 0x101, 0x5, 0x4, 0xff, 0xffff, 0x3ff]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_6GHZ={0x5c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x3a, 0x2, [{0x3, 0x2}, {0x4, 0xa}, {0x3, 0x4}, {0x7, 0x8}, {0x3, 0x6}, {0x2, 0x4}, {0x0, 0x7}, {0x3, 0x6}, {0x3, 0x7}, {0x0, 0x9}, {0x0, 0x5}, {0x2, 0xa}, {0x3}, {0x0, 0x1}, {0x0, 0x1}, {0x1, 0x9}, {0x3, 0x1}, {0x6, 0x6}, {0x0, 0x7}, {0x6, 0x9}, {0x4, 0x5}, {0x3}, {0x4, 0x8}, {0x6, 0x5}, {0x0, 0x3}, {0x1}, {0x5}, {0x6, 0x5}, {0x6, 0x3}, {0x7, 0x3}, {0x4, 0x2}, {0x7, 0x2}, {0x0, 0x2}, {0x4, 0x2}, {0x4, 0x6}, {0x4, 0xa}, {0x0, 0x3}, {0x2, 0x3}, {0x6, 0x4}, {0x2, 0x7}, {0x2, 0xa}, {0x7, 0x1}, {0x1, 0x3}, {0x6, 0x5}, {0x1, 0x9}, {0x4}, {0x1, 0x2}, {0x7, 0x5}, {0x0, 0x1}, {0x3, 0x9}, {0x6, 0x9}, {0x4, 0x8}, {0x4, 0x9}, {0x4, 0x2}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HT={0x12, 0x2, [{0x7}, {0x1, 0x8}, {0x0, 0xa}, {0x1, 0x6}, {0x4, 0x7}, {0x1, 0x6}, {0x7, 0xa}, {0x5, 0x5}, {0x7, 0x6}, {0x3, 0x8}, {0x1}, {0x0, 0x7}, {0x0, 0x9}, {0x1, 0xa}]}]}, @NL80211_BAND_6GHZ={0x18, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x3, 0x7, 0x8, 0x5, 0x6, 0x9, 0x400]}}]}, @NL80211_BAND_60GHZ={0x18, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x8, 0x7, 0x6, 0x6, 0x8, 0x2]}}]}]}, @NL80211_ATTR_TX_RATES={0xac, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x4c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0xc, 0x1, [0x16, 0x36, 0x13, 0x0, 0x12, 0x6c, 0x18, 0x36]}, @NL80211_TXRATE_HT={0x32, 0x2, [{0x6, 0x8}, {0x1, 0x6}, {0x0, 0x3}, {0x3}, {0x5, 0xa}, {0x6, 0x2}, {}, {0x7, 0x5}, {0x5, 0x9}, {0x7, 0x2}, {0x7, 0x6}, {0x5, 0x8}, {0x7, 0x9}, {0x2, 0x9}, {0x4, 0x4}, {0x4, 0x5}, {0x7, 0x7}, {0x6, 0x8}, {0x1, 0x9}, {0x1, 0x8}, {0x5, 0x2}, {0x5, 0x9}, {0x1}, {0x4, 0x4}, {0x0, 0x6}, {0x6, 0x1}, {0x1, 0x2}, {0x7, 0x1}, {0x0, 0xa}, {0x0, 0x8}, {0x1, 0x8}, {0x1, 0x6}, {0x6, 0x15}, {0x5, 0x2}, {0x3, 0x4}, {0x6, 0x9}, {0x5, 0x4}, {0x7, 0x8}, {0x2}, {0x3, 0x9}, {0x5, 0x8}, {0x7, 0xa}, {0x1, 0xa}, {0x5, 0x8}, {0x5, 0x1}, {0x4, 0x6}]}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0xc]}]}, @NL80211_BAND_2GHZ={0x5c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x24, 0x1, [0x12, 0x0, 0xb, 0x1, 0x5, 0x1, 0x1, 0x1, 0x48, 0x5, 0xd, 0x9, 0x24, 0xe, 0x6, 0x1b, 0x36, 0x18, 0x23, 0x9, 0x5, 0x30, 0x6c, 0x1b, 0x30, 0x7f, 0x1, 0x16, 0xb, 0x48, 0xc, 0x3]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xc, 0xb, 0x3, 0x2, 0xa300, 0x6, 0x2e]}}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x30, 0x36, 0xb, 0x9c, 0x9, 0x5, 0x1, 0x63, 0xb, 0x44, 0xc, 0x48, 0x18, 0xc, 0x30, 0x2, 0x77, 0xb, 0x24, 0x5, 0x24, 0x3, 0x6, 0x12, 0x30]}]}]}, @NL80211_ATTR_TX_RATES={0x188, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x34, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x7, 0x0, 0x0, 0x0, 0x3, 0x9, 0x1]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xbb, 0x800, 0x23d6, 0x90ed, 0x401, 0x8, 0x7f, 0x2]}}]}, @NL80211_BAND_60GHZ={0x78, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x14, 0x1, [0x16, 0x1b, 0x60, 0x9, 0x2, 0x9, 0x9, 0x9, 0x1, 0x1b, 0x4, 0x3, 0x4, 0x36, 0x5, 0x30]}, @NL80211_TXRATE_HT={0x35, 0x2, [{0x2, 0x1}, {0x7, 0x6}, {0x4, 0x8}, {0x1, 0x9}, {0x2, 0x5}, {0x1, 0x4}, {0x5}, {0x1, 0x1}, {0x0, 0xa}, {0x1, 0x4}, {0x3, 0x8}, {0x6, 0xa}, {0x4, 0x6}, {0x1, 0x6}, {0x5, 0x8}, {0x5, 0x5}, {0x3, 0xa}, {0x5, 0x8}, {0x2, 0x9}, {0x4}, {0x3, 0x8}, {0x6, 0xa}, {0x1, 0x4}, {0x2, 0x8}, {0x7}, {0x0, 0x8}, {0x0, 0x2}, {0x2, 0x3}, {0x4, 0xa}, {0x5, 0x5}, {0x4, 0x8}, {0x5, 0x3}, {0x7, 0x2}, {0x3, 0x8}, {0x1, 0x2}, {0x2, 0xa}, {0x4, 0x4}, {0x7, 0xa}, {0x1, 0x8}, {0x4, 0x2}, {0x1, 0x1}, {0x5, 0x2}, {0x3, 0xa}, {0x5, 0x6}, {0x5, 0xa}, {0x3, 0x1}, {0x1}, {0x1, 0x6}, {0x3, 0xa}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x2, 0x9, 0x9b, 0xd4cb, 0x6, 0x3, 0x3]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0xfff, 0x120, 0x3, 0x5, 0x8, 0xfffc, 0xbcab]}}]}, @NL80211_BAND_60GHZ={0x34, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2e, 0x2, [{0x0, 0x5}, {0x1, 0x6}, {0x1, 0x3}, {0x7, 0x9}, {0x6, 0x3}, {0x5, 0x7}, {0x1, 0x5}, {0x7, 0x4}, {0x2, 0x1}, {0x1, 0x3}, {0x2, 0x5}, {0x5, 0xa}, {0x6, 0x4}, {0x2, 0x5}, {0x1, 0x6}, {0x1, 0x8}, {0x0, 0x9}, {0x2}, {0x4, 0x2}, {0x1, 0xa}, {0x7, 0x5}, {0x1, 0x7}, {0x5, 0x1}, {0x3, 0x3}, {0x3, 0x1}, {0x4, 0x5}, {0x3}, {0x0, 0x2}, {0x3, 0x6}, {0x0, 0x5}, {0x5, 0x8}, {0x7, 0x3}, {0x2, 0x6}, {0x3, 0x1}, {0x4, 0x8}, {0x4, 0x3}, {0x2, 0x8}, {0x5, 0xa}, {0x0, 0x9}, {0x2, 0x4}, {0x2, 0xa}, {0x6, 0x3}]}]}, @NL80211_BAND_2GHZ={0x68, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0xd, 0x2, [{0x3}, {0x1, 0x3}, {0x6, 0x3}, {0x4, 0x7}, {0x5, 0x7}, {0x1, 0x1}, {0x5, 0x9}, {0x4, 0x3}, {0x6, 0x5}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x0, 0x0, 0x3, 0x5, 0x400, 0x1]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0x2, 0x800, 0x5, 0x5, 0x0, 0x1, 0xffff]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x5, 0xd, 0x4, 0x3, 0x5, 0x8, 0x5]}}]}, @NL80211_BAND_6GHZ={0x18, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xd8f4, 0x152, 0x6, 0x7400, 0x0, 0x3, 0x9, 0x5]}}]}, @NL80211_BAND_6GHZ={0x20, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x10, 0xe, 0x0, 0xf6c, 0x5, 0x9b, 0x2, 0x5]}}]}, @NL80211_BAND_6GHZ={0x4}]}, @NL80211_ATTR_TX_RATES={0x54, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x50, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1c, 0x1, [0x3, 0x12, 0x6c, 0x1, 0x4, 0x16, 0x4, 0x24, 0x9, 0x30, 0x6, 0x12, 0xc, 0x48, 0x3, 0x48, 0x6, 0x3, 0x12, 0x60, 0x1b, 0x6, 0xc, 0x0]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x7, 0x800, 0x6, 0x6, 0x400, 0x200, 0xb]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xfde, 0x6, 0x4, 0x7, 0x8, 0xdd77, 0x6, 0x120]}}]}]}, @NL80211_ATTR_TX_RATES={0x19c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_60GHZ={0x30, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x5, 0x95f8, 0xac, 0x9, 0xa35, 0x81, 0x5]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_60GHZ={0x30, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x8d, 0x1, 0xc, 0xc, 0x24, 0x78, 0x2]}}]}, @NL80211_BAND_2GHZ={0x20, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x9, 0x7f1, 0x3ff, 0x4, 0x2, 0x101, 0xf5]}}]}, @NL80211_BAND_6GHZ={0x7c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x14, 0x2, [{0x6, 0x1}, {0x5, 0x9}, {0x1, 0x2}, {0x2}, {0x4}, {0x1, 0x2}, {0x7, 0x7}, {0x5, 0x6}, {0x4, 0x6}, {0x5, 0xa}, {0x4, 0x4}, {}, {0x1, 0x7}, {0x3, 0x6}, {0x4, 0x7}, {0x2}]}, @NL80211_TXRATE_HT={0x2e, 0x2, [{0x3, 0x7}, {0x6, 0x2}, {0x1, 0x4}, {0x1, 0x2}, {0x0, 0x6}, {0x7, 0x6}, {0x1, 0x9}, {0x7, 0x4}, {0x4}, {0x1, 0x8}, {0x4, 0xa}, {0x1, 0x9}, {0x5, 0x9}, {0x2}, {0x2}, {0x2}, {0x0, 0x7}, {0x7, 0x1}, {0x7, 0x5}, {0x7, 0x7}, {0x1, 0x8}, {0x1, 0xa}, {0x0, 0x7}, {0x1, 0x2}, {0x4, 0x8}, {0x0, 0x7}, {0x3, 0x5}, {0x0, 0x9}, {0x3, 0x1}, {0x4, 0xa}, {0x7, 0x1}, {0x7, 0x8}, {0x4, 0x1}, {0x7, 0x4}, {0x0, 0x4}, {0x3, 0x7}, {0x0, 0x2}, {0x2}, {0x0, 0x8}, {0x2, 0x6}, {0x4, 0x5}, {0x4, 0x3}]}, @NL80211_TXRATE_HT={0x6, 0x2, [{0x0, 0x2}, {0x4, 0xa}]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x581b, 0x5, 0x3, 0x2, 0x7, 0x2e4, 0xff, 0x3]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x3}]}, @NL80211_BAND_6GHZ={0x44, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x1, 0xfffa, 0x9, 0x1, 0xf577, 0x2a80, 0xc4]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0x13, 0x2, [{0x1, 0x8}, {0x3, 0x5}, {0x0, 0x9}, {0x4, 0x7}, {}, {0x7, 0x3}, {0x1, 0x7}, {0x2, 0x6}, {0x0, 0x4}, {0x5, 0x3}, {0x0, 0x7}, {0x6, 0x9}, {0x7, 0x3}, {0x2, 0xa}, {0x7, 0x7}]}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_6GHZ={0x4c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HT={0x36, 0x2, [{}, {}, {0x5, 0x1}, {0x6, 0x3}, {0x5, 0x4}, {0x4, 0x8}, {0x1, 0x8}, {0x6, 0x1}, {0x4, 0xa}, {0x6, 0x8}, {0x2, 0x5}, {0x5, 0x2}, {0x2, 0x2}, {0x1, 0x8}, {0x6, 0x7}, {0x2, 0x9}, {0x6, 0xa}, {0x1, 0x4}, {0x7, 0x5}, {}, {}, {0x1, 0x6}, {0x3, 0x2}, {0x4, 0x1}, {0x4, 0x5}, {0x6, 0x9}, {0x0, 0x2}, {0x2, 0x2}, {0x4, 0x3}, {0x1, 0xa}, {0x1, 0x3}, {0x1}, {0x7, 0x6}, {0x3, 0x3}, {0x6, 0xa}, {0x6, 0x8}, {0x6, 0xa}, {0x6, 0x9}, {0x4}, {0x1, 0x2}, {0x1, 0x5}, {0x2, 0x6}, {0x5, 0x3}, {0x5, 0x6}, {0x3, 0x3}, {0x1, 0x8}, {0x7, 0x5}, {0x5, 0xa}, {0x1, 0x8}, {0x7, 0x4}]}]}]}]}, 0x91c}, 0x1, 0x0, 0x0, 0x4}, 0x20000020) write$P9_RSTAT(r3, &(0x7f0000001600)={0x44, 0x7d, 0x1, {0x0, 0x3d, 0x1, 0x2, {0x40, 0x1, 0x7}, 0x41018000, 0xfff, 0x2, 0x80, 0x0, '', 0x1, '\x00', 0x8, 'nl80211\x00', 0x1, ':'}}, 0x44) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f00000016c0), r1) sendmsg$NL80211_CMD_FRAME_WAIT_CANCEL(r12, &(0x7f0000001780)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001740)={&(0x7f0000001700)={0x2c, r13, 0x20, 0x70bd26, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x2c}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x1a}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000080}, 0x4000) fsetxattr$security_ima(r7, &(0x7f00000017c0), &(0x7f0000001800)=@v1={0x2, "2a0e5b5a67b4adfc"}, 0x9, 0x1) setsockopt$netlink_NETLINK_NO_ENOBUFS(r8, 0x10e, 0x5, &(0x7f0000001840)=0x1e, 0x4) ioctl$EXT4_IOC_MIGRATE(r8, 0x6609) 24m47.566646066s ago: executing program 0 (id=618): r0 = socket(0x29, 0x2, 0x0) sendmsg$BATADV_CMD_SET_VLAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[], 0x33fe0}}, 0x4004050) sendmsg$NL80211_CMD_ADD_NAN_FUNCTION(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x4000}, 0x4) r1 = syz_open_dev$vcsn(&(0x7f0000000000), 0x8, 0x191840) close_range(r1, 0xffffffffffffffff, 0x0) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, r2, 0x200, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x0) getpeername$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$BATADV_CMD_SET_VLAN(r0, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRES16=r2, @ANYBLOB="04002cbd7000fcdbdf25120000000600280001000000080039000f00000008000300", @ANYRES32=r3, @ANYBLOB="08000b0025b0ffff08003a000000000005003800010000000800340002000000060028000100000008003100ba000000"], 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) 24m47.563462776s ago: executing program 32 (id=618): r0 = socket(0x29, 0x2, 0x0) sendmsg$BATADV_CMD_SET_VLAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[], 0x33fe0}}, 0x4004050) sendmsg$NL80211_CMD_ADD_NAN_FUNCTION(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x4000}, 0x4) r1 = syz_open_dev$vcsn(&(0x7f0000000000), 0x8, 0x191840) close_range(r1, 0xffffffffffffffff, 0x0) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, r2, 0x200, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x0) getpeername$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$BATADV_CMD_SET_VLAN(r0, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRES16=r2, @ANYBLOB="04002cbd7000fcdbdf25120000000600280001000000080039000f00000008000300", @ANYRES32=r3, @ANYBLOB="08000b0025b0ffff08003a000000000005003800010000000800340002000000060028000100000008003100ba000000"], 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) 49.320552089s ago: executing program 1 (id=2791): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv4_newrule={0x28, 0x20, 0x301, 0x0, 0x8000, {0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x10002}, [@FRA_GENERIC_POLICY=@FRA_UID_RANGE={0xc, 0x14, {0x0, 0xffffffffffffffff}}]}, 0x28}}, 0x44004) 48.573479419s ago: executing program 1 (id=2792): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x11, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x6, 0x9, 0x0, 0x1, 0x40000000}, {0x66, 0x0, 0x0, 0x80ffffff}}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x1, 0x5, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x56}}], {{0x4, 0x1, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x41000, 0x4a, '\x00', 0x0, @fallback=0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff}, 0x94) 47.967594096s ago: executing program 1 (id=2793): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b18, &(0x7f0000000000)={'wlan1\x00'}) 47.472900413s ago: executing program 1 (id=2794): bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="19000000040000000800000005"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000300)={r3, r1, 0x25, 0x2, @val=@tcx}, 0x1c) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000040)={@random="e90c610faca2", @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2, 0x1, 0x2, 0xc, 0x100}}}}}}}, 0x0) 46.969337671s ago: executing program 1 (id=2796): r0 = socket$inet6(0xa, 0x80002, 0x0) listen(r0, 0xc98e) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e2a, 0xffffffff, @mcast2, 0x9}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 45.431074536s ago: executing program 1 (id=2798): epoll_create1(0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000001980)=[{{0x0, 0x20, 0x0, 0x0, &(0x7f0000000040)=""/26, 0x11}}, {{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f00000000c0)=""/47}, {&(0x7f0000000100)=""/224}, {&(0x7f0000000200)=""/4096}, {&(0x7f0000001200)=""/124}, {&(0x7f0000001280)=""/60}]}}, {{&(0x7f0000001380)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x0, &(0x7f0000001840)=[{&(0x7f0000001400)=""/149}, {&(0x7f0000001b00)=""/118}, {&(0x7f0000001540)=""/188}, {&(0x7f0000001600)=""/57}, {&(0x7f0000001640)=""/135}, {&(0x7f00000014c0)=""/101}, {&(0x7f0000001780)=""/171}], 0x0, &(0x7f00000018c0)=""/176}}], 0x15cbc1ab4c0933f, 0x0, 0x0) 6.230618194s ago: executing program 2 (id=2856): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r0, 0x0, 0xffffffffffffffff}, 0x18) r1 = socket(0x15, 0x5, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_pid(r2, &(0x7f00000004c0), 0x12) getsockopt(r1, 0x200000000114, 0x2710, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) 4.358970401s ago: executing program 2 (id=2857): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000540)=@gcm_128={{0x304}, "55706e44cacc494f", "24ff0573669961d742cbfb62b94f9592", 'U~\'T', "d5c0017c6ee203ad"}, 0x28) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) listen(0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0xffffff6a) sendfile(r0, r1, 0x0, 0xffffffff004) connect$inet6(0xffffffffffffffff, 0x0, 0x0) close(0x3) 3.880146906s ago: executing program 2 (id=2858): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000005f40)={'syztnl2\x00', &(0x7f0000005ec0)={'syztnl0\x00', 0x0, 0x4, 0x9, 0x2, 0x80000001, 0x1, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @mcast2, 0x40, 0x8740, 0x3, 0x8}}) sendmmsg$inet6(r0, 0x0, 0x0, 0x2000c040) 3.701488833s ago: executing program 2 (id=2859): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socket$kcm(0x10, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$alg(0x26, 0x5, 0x0) socket$key(0xf, 0x3, 0x2) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) 3.347630146s ago: executing program 2 (id=2860): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000020c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="24000000000000001701"], 0x28, 0x2000c000}}], 0x2, 0x88) 1.096516917s ago: executing program 2 (id=2861): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r0, 0x0, 0xffffffffffffffff}, 0x18) r1 = socket(0x15, 0x5, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_pid(r2, &(0x7f00000004c0), 0x12) getsockopt(r1, 0x200000000114, 0x2710, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) 0s ago: executing program 33 (id=2798): epoll_create1(0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000001980)=[{{0x0, 0x20, 0x0, 0x0, &(0x7f0000000040)=""/26, 0x11}}, {{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f00000000c0)=""/47}, {&(0x7f0000000100)=""/224}, {&(0x7f0000000200)=""/4096}, {&(0x7f0000001200)=""/124}, {&(0x7f0000001280)=""/60}]}}, {{&(0x7f0000001380)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x0, &(0x7f0000001840)=[{&(0x7f0000001400)=""/149}, {&(0x7f0000001b00)=""/118}, {&(0x7f0000001540)=""/188}, {&(0x7f0000001600)=""/57}, {&(0x7f0000001640)=""/135}, {&(0x7f00000014c0)=""/101}, {&(0x7f0000001780)=""/171}], 0x0, &(0x7f00000018c0)=""/176}}], 0x15cbc1ab4c0933f, 0x0, 0x0) kernel console output (not intermixed with test programs): 000f r4:88ce0540 [ 1406.628564][T10966] [<8055ef7c>] (vfs_read) from [<8055fd24>] (ksys_read+0x74/0xe8) [ 1406.628663][T10966] r10:00000003 r9:84226c00 r8:8020029c r7:00000000 r6:00000000 r5:88ce0540 [ 1406.628776][T10966] r4:88ce0543 [ 1406.628808][T10966] [<8055fcb0>] (ksys_read) from [<8055fda8>] (sys_read+0x10/0x14) [ 1406.628887][T10966] r7:00000003 r6:00000005 r5:76f31f30 r4:0000000f [ 1406.628931][T10966] [<8055fd98>] (sys_read) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1406.629030][T10966] Exception stack(0xedd99fa8 to 0xedd99ff0) [ 1406.629053][T10966] 9fa0: 0000000f 76f31f30 00000005 76f31f30 0000000f 00000000 [ 1406.629112][T10966] 9fc0: 0000000f 76f31f30 00000005 00000003 00300000 00000000 00006364 76f320bc [ 1406.629148][T10966] 9fe0: 00000158 76f31ed0 000d862c 0013083c [ 1408.681373][ T29] audit: type=1400 audit(1408.280:484): avc: denied { create } for pid=10980 comm="syz.2.1888" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1409.958577][T10986] FAULT_INJECTION: forcing a failure. [ 1409.958577][T10986] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1409.965127][T10986] CPU: 1 UID: 0 PID: 10986 Comm: syz.1.1889 Not tainted syzkaller #0 PREEMPT [ 1409.965277][T10986] Hardware name: ARM-Versatile Express [ 1409.965302][T10986] Call trace: [ 1409.965342][T10986] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1409.965432][T10986] r7:00000000 r6:00000000 r5:60000113 r4:82252458 [ 1409.965452][T10986] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1409.965494][T10986] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1409.965538][T10986] r5:84169800 r4:8294f590 [ 1409.965550][T10986] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1409.965599][T10986] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1409.965646][T10986] r8:76f31f30 r7:00000000 r6:00000000 r5:eded5f68 r4:00000002 [ 1409.965660][T10986] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1409.965693][T10986] [<80986ef4>] (should_fail_usercopy) from [<8059a064>] (simple_read_from_buffer+0x80/0x13c) [ 1409.965737][T10986] [<80599fe4>] (simple_read_from_buffer) from [<8061618c>] (proc_fail_nth_read+0xb8/0x108) [ 1409.965790][T10986] r10:00000001 r9:806160d4 r8:00000002 r7:eded5f68 r6:0000000f r5:76f31f30 [ 1409.965808][T10986] r4:84169800 r3:eded5e9f [ 1409.965822][T10986] [<806160d4>] (proc_fail_nth_read) from [<8055f014>] (vfs_read+0x98/0x324) [ 1409.965871][T10986] r8:76f31f30 r7:eded5f68 r6:84169800 r5:0000000f r4:855e5b40 [ 1409.965886][T10986] [<8055ef7c>] (vfs_read) from [<8055fd24>] (ksys_read+0x74/0xe8) [ 1409.965936][T10986] r10:00000003 r9:84169800 r8:8020029c r7:00000000 r6:00000000 r5:855e5b40 [ 1409.965953][T10986] r4:855e5b43 [ 1409.965968][T10986] [<8055fcb0>] (ksys_read) from [<8055fda8>] (sys_read+0x10/0x14) [ 1409.966016][T10986] r7:00000003 r6:00000006 r5:76f31f30 r4:0000000f [ 1409.966029][T10986] [<8055fd98>] (sys_read) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1409.966066][T10986] Exception stack(0xeded5fa8 to 0xeded5ff0) [ 1409.966098][T10986] 5fa0: 0000000f 76f31f30 00000006 76f31f30 0000000f 00000000 [ 1409.966126][T10986] 5fc0: 0000000f 76f31f30 00000006 00000003 00300000 00000000 00006364 76f320bc [ 1409.966147][T10986] 5fe0: 00000158 76f31ed0 000d862c 0013083c [ 1410.644880][T10990] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1410.650498][T10990] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1410.808005][T10990] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1410.812855][T10990] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1411.095088][T10990] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1411.099176][T10990] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1413.951907][ T29] audit: type=1400 audit(1413.550:485): avc: denied { write } for pid=11004 comm="syz.1.1895" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 1414.914575][ T41] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 1415.104913][ T41] usb 2-1: Using ep0 maxpacket: 32 [ 1415.180046][ T41] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1415.180394][ T41] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1415.180694][ T41] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1415.217066][ T41] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1415.217389][ T41] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1415.217674][ T41] usb 2-1: Product: syz [ 1415.217850][ T41] usb 2-1: Manufacturer: syz [ 1415.218016][ T41] usb 2-1: SerialNumber: syz [ 1415.538402][T11013] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1415.543326][T11013] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1415.576281][ T41] cdc_ncm 2-1:1.0: bind() failure [ 1415.581115][ T41] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1415.581478][ T41] cdc_ncm 2-1:1.1: bind() failure [ 1415.589066][ T41] usb 2-1: USB disconnect, device number 38 [ 1416.055741][ T3789] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 1416.214666][ T3789] usb 2-1: Using ep0 maxpacket: 32 [ 1416.254867][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1416.255136][ T3789] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1416.255333][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1416.290641][ T3789] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1416.290935][ T3789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1416.291101][ T3789] usb 2-1: Product: } [ 1416.291127][ T3789] usb 2-1: Manufacturer: 쭻ඇ凿ꅺ備䖝넀쩼踥洤끡䤋扇갬繅뤃⛣⒳艼댾ᰴ䷴텕㛋宸ﴁ䕩폓骼䇰Ꮹ툪婚橸๟쏿降 굉倳埞徯쇗覞Ⱛ㧑⫯ [ 1416.291145][ T3789] usb 2-1: SerialNumber: Ф [ 1416.746342][ T3789] cdc_ncm 2-1:1.0: bind() failure [ 1416.749669][ T3789] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1416.749935][ T3789] cdc_ncm 2-1:1.1: bind() failure [ 1416.758212][ T3789] usb 2-1: USB disconnect, device number 39 [ 1416.864847][T11047] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1416.867106][T11047] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1417.435673][T11054] FAULT_INJECTION: forcing a failure. [ 1417.435673][T11054] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1417.436042][T11054] CPU: 1 UID: 0 PID: 11054 Comm: syz.2.1900 Not tainted syzkaller #0 PREEMPT [ 1417.436102][T11054] Hardware name: ARM-Versatile Express [ 1417.436116][T11054] Call trace: [ 1417.436180][T11054] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1417.436269][T11054] r7:00000000 r6:00000000 r5:60000013 r4:82252458 [ 1417.436280][T11054] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1417.436307][T11054] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1417.436334][T11054] r5:84225400 r4:8294f590 [ 1417.436341][T11054] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1417.436372][T11054] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1417.436401][T11054] r8:76fb4f30 r7:00000000 r6:00000000 r5:ee0c9f68 r4:00000002 [ 1417.436410][T11054] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1417.436430][T11054] [<80986ef4>] (should_fail_usercopy) from [<8059a064>] (simple_read_from_buffer+0x80/0x13c) [ 1417.436458][T11054] [<80599fe4>] (simple_read_from_buffer) from [<8061618c>] (proc_fail_nth_read+0xb8/0x108) [ 1417.436491][T11054] r10:00000001 r9:806160d4 r8:00000002 r7:ee0c9f68 r6:0000000f r5:76fb4f30 [ 1417.436502][T11054] r4:84225400 r3:ee0c9e9f [ 1417.436509][T11054] [<806160d4>] (proc_fail_nth_read) from [<8055f014>] (vfs_read+0x98/0x324) [ 1417.436540][T11054] r8:76fb4f30 r7:ee0c9f68 r6:84225400 r5:0000000f r4:855e5d80 [ 1417.436548][T11054] [<8055ef7c>] (vfs_read) from [<8055fd24>] (ksys_read+0x74/0xe8) [ 1417.436580][T11054] r10:00000003 r9:84225400 r8:8020029c r7:00000000 r6:00000000 r5:855e5d80 [ 1417.436589][T11054] r4:855e5d83 [ 1417.436597][T11054] [<8055fcb0>] (ksys_read) from [<8055fda8>] (sys_read+0x10/0x14) [ 1417.436626][T11054] r7:00000003 r6:00000004 r5:76fb4f30 r4:0000000f [ 1417.436634][T11054] [<8055fd98>] (sys_read) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1417.436657][T11054] Exception stack(0xee0c9fa8 to 0xee0c9ff0) [ 1417.436693][T11054] 9fa0: 0000000f 76fb4f30 00000004 76fb4f30 0000000f 00000000 [ 1417.436750][T11054] 9fc0: 0000000f 76fb4f30 00000004 00000003 00300000 00000000 00006364 76fb50bc [ 1417.436765][T11054] 9fe0: 00000158 76fb4ed0 000d862c 0013083c [ 1428.637512][ T29] audit: type=1400 audit(1428.240:486): avc: denied { ioctl } for pid=11079 comm="syz.2.1906" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=22308 ioctlcmd=0x943c scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1428.765301][T11081] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11081 comm=syz.2.1906 [ 1428.825840][ T29] audit: type=1400 audit(1428.430:487): avc: denied { accept } for pid=11079 comm="syz.2.1906" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 1428.839945][T11081] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11081 comm=syz.2.1906 [ 1428.850912][T11081] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11081 comm=syz.2.1906 [ 1430.479097][T11095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1430.480310][T11095] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1430.628527][T11095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1430.676562][T11095] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1430.965005][T11095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1430.987879][T11095] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1433.665129][ T41] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 1433.825091][ T41] usb 2-1: Using ep0 maxpacket: 32 [ 1433.856536][ T41] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1433.868082][ T41] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1433.869463][ T41] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1433.870545][ T41] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1433.909161][ T41] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1433.910464][ T41] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1433.911743][ T41] usb 2-1: Product: syz [ 1433.912551][ T41] usb 2-1: Manufacturer: syz [ 1433.913312][ T41] usb 2-1: SerialNumber: syz [ 1434.267696][T11119] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1434.287489][T11119] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1434.319982][ T41] cdc_ncm 2-1:1.0: bind() failure [ 1434.336885][ T41] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1434.338158][ T41] cdc_ncm 2-1:1.1: bind() failure [ 1434.346262][ T41] usb 2-1: USB disconnect, device number 40 [ 1434.884790][ T41] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 1435.084513][ T41] usb 2-1: Using ep0 maxpacket: 32 [ 1435.244465][ T41] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1435.244826][ T41] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1435.244995][ T41] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1435.265936][ T41] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1435.266134][ T41] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1435.266288][ T41] usb 2-1: Product: } [ 1435.266376][ T41] usb 2-1: Manufacturer: 쭻ඇ凿ꅺ備䖝넀쩼踥洤끡䤋扇갬繅뤃⛣⒳艼댾ᰴ䷴텕㛋宸ﴁ䕩폓骼䇰Ꮹ툪婚橸๟쏿降 굉倳埞徯쇗覞Ⱛ㧑⫯ [ 1435.266460][ T41] usb 2-1: SerialNumber: Ф [ 1435.695046][ T41] cdc_ncm 2-1:1.0: bind() failure [ 1435.700552][ T41] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1435.700944][ T41] cdc_ncm 2-1:1.1: bind() failure [ 1435.714984][ T41] usb 2-1: USB disconnect, device number 41 [ 1436.154783][ T41] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 1436.388188][ T41] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1436.400112][ T41] usb 2-1: config 1 interface 0 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 32 [ 1436.401300][ T41] usb 2-1: config 1 interface 0 has no altsetting 0 [ 1436.456179][ T41] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1436.457241][ T41] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1436.458260][ T41] usb 2-1: Product: syz [ 1436.458998][ T41] usb 2-1: Manufacturer: syz [ 1436.459666][ T41] usb 2-1: SerialNumber: syz [ 1436.484921][T11155] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1436.735401][ T41] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 1436.742740][ T41] usb 2-1: USB disconnect, device number 42 [ 1439.389557][T11185] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1439.408442][T11185] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1439.433789][T11185] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1439.445548][T11185] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1439.702117][T11185] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1439.798273][T11185] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1440.413726][ T29] audit: type=1400 audit(1440.010:488): avc: denied { setopt } for pid=11194 comm="syz.1.1931" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1442.000663][ T29] audit: type=1400 audit(1441.600:489): avc: denied { lock } for pid=11194 comm="syz.1.1931" path="socket:[23272]" dev="sockfs" ino=23272 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1442.129458][T11204] FAULT_INJECTION: forcing a failure. [ 1442.129458][T11204] name failslab, interval 1, probability 0, space 0, times 0 [ 1442.130053][T11204] CPU: 0 UID: 0 PID: 11204 Comm: syz.2.1932 Not tainted syzkaller #0 PREEMPT [ 1442.130167][T11204] Hardware name: ARM-Versatile Express [ 1442.130197][T11204] Call trace: [ 1442.130248][T11204] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1442.130369][T11204] r7:00000c40 r6:00000000 r5:60000013 r4:82252458 [ 1442.130389][T11204] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1442.130440][T11204] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1442.130496][T11204] r5:83a66c00 r4:82918810 [ 1442.130512][T11204] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1442.130582][T11204] [<80986cb4>] (should_fail_ex) from [<8052efdc>] (should_failslab+0x6c/0x94) [ 1442.130659][T11204] r8:00000000 r7:00000c40 r6:00001000 r5:00001000 r4:830016c0 [ 1442.130681][T11204] [<8052ef70>] (should_failslab) from [<8050a4c0>] (__kmalloc_noprof+0x9c/0x568) [ 1442.130737][T11204] [<8050a424>] (__kmalloc_noprof) from [<807d3258>] (tomoyo_realpath_from_path+0x3c/0x17c) [ 1442.130834][T11204] r10:83a66c00 r9:8309e400 r8:00000000 r7:83428d48 r6:84cdd0e8 r5:00001000 [ 1442.130855][T11204] r4:00000000 [ 1442.130871][T11204] [<807d321c>] (tomoyo_realpath_from_path) from [<807cf39c>] (tomoyo_path_number_perm+0xcc/0x22c) [ 1442.130936][T11204] r10:83a66c00 r9:00000000 r8:84cdd0c0 r7:80044dfb r6:00000004 r5:81cd65c8 [ 1442.130962][T11204] r4:84cdd0e8 r3:826c1240 [ 1442.130981][T11204] [<807cf2d0>] (tomoyo_path_number_perm) from [<807d3c7c>] (tomoyo_file_ioctl+0x1c/0x20) [ 1442.131081][T11204] r9:00000003 r8:84cdd0c0 r7:20000240 r6:20000240 r5:80044dfb r4:84cdd0c0 [ 1442.131106][T11204] [<807d3c60>] (tomoyo_file_ioctl) from [<80780540>] (security_file_ioctl+0x64/0x1e4) [ 1442.131166][T11204] [<807804dc>] (security_file_ioctl) from [<805787d4>] (sys_ioctl+0x4c/0xba0) [ 1442.131235][T11204] r7:20000240 r6:84cdd0c1 r5:00000000 r4:80044dfb [ 1442.131259][T11204] [<80578788>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1442.131307][T11204] Exception stack(0xee5a9fa8 to 0xee5a9ff0) [ 1442.131352][T11204] 9fa0: 00000000 00000000 00000003 80044dfb 20000240 00000000 [ 1442.131388][T11204] 9fc0: 00000000 00000000 00130918 00000036 00300000 00000000 00006364 76fb50bc [ 1442.131415][T11204] 9fe0: 76fb4ec0 76fb4eb0 0001928c 00132970 [ 1442.131448][T11204] r10:00000036 r9:83a66c00 r8:8020029c r7:00000036 r6:00130918 r5:00000000 [ 1442.131467][T11204] r4:00000000 [ 1442.162521][T11204] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1443.946565][T11208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1443.959824][T11208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1444.040124][T11208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1444.040789][T11208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1444.354659][T11208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1444.357113][T11208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1453.604812][ T3789] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 1453.794873][ T3789] usb 2-1: Using ep0 maxpacket: 32 [ 1453.834624][ T3789] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1453.854829][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1453.855296][ T3789] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1453.855367][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1453.895383][ T3789] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1453.895738][ T3789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1453.895797][ T3789] usb 2-1: Product: syz [ 1453.895826][ T3789] usb 2-1: Manufacturer: syz [ 1453.895852][ T3789] usb 2-1: SerialNumber: syz [ 1454.219071][T11224] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1454.266380][T11224] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1454.295719][ T3789] cdc_ncm 2-1:1.0: bind() failure [ 1454.301265][ T3789] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1454.301816][ T3789] cdc_ncm 2-1:1.1: bind() failure [ 1454.319816][ T3789] usb 2-1: USB disconnect, device number 43 [ 1454.864427][ T9844] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 1455.054430][ T9844] usb 2-1: Using ep0 maxpacket: 32 [ 1455.118502][ T9844] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1455.118715][ T9844] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1455.118958][ T9844] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1455.140780][ T9844] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1455.140995][ T9844] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1455.141166][ T9844] usb 2-1: Product: } [ 1455.141263][ T9844] usb 2-1: Manufacturer: 쭻ඇ凿ꅺ備䖝넀쩼踥洤끡䤋扇갬繅뤃⛣⒳艼댾ᰴ䷴텕㛋宸ﴁ䕩폓骼䇰Ꮹ툪婚橸๟쏿降 굉倳埞徯쇗覞Ⱛ㧑⫯ [ 1455.141350][ T9844] usb 2-1: SerialNumber: Ф [ 1455.371254][ T29] audit: type=1400 audit(1454.970:490): avc: denied { ioctl } for pid=11246 comm="syz.2.1940" path="socket:[22425]" dev="sockfs" ino=22425 ioctlcmd=0x5450 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sock_file permissive=1 [ 1455.567295][ T29] audit: type=1400 audit(1455.170:491): avc: denied { create } for pid=11246 comm="syz.2.1940" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 1455.586124][ T29] audit: type=1400 audit(1455.190:492): avc: denied { write } for pid=11246 comm="syz.2.1940" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 1455.603529][ T9844] cdc_ncm 2-1:1.0: bind() failure [ 1455.607242][ T9844] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1455.608129][ T9844] cdc_ncm 2-1:1.1: bind() failure [ 1455.611395][ T9844] usb 2-1: USB disconnect, device number 44 [ 1457.546949][ T29] audit: type=1400 audit(1457.150:493): avc: denied { setopt } for pid=11269 comm="syz.1.1944" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1457.585715][ T29] audit: type=1400 audit(1457.180:494): avc: denied { mount } for pid=11269 comm="syz.1.1944" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 1459.925024][ T29] audit: type=1400 audit(1459.520:495): avc: denied { mount } for pid=11282 comm="syz.1.1949" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 1459.976144][ T29] audit: type=1400 audit(1459.580:496): avc: denied { ioctl } for pid=11282 comm="syz.1.1949" path="/dev/binderfs/binder1" dev="binder" ino=5 ioctlcmd=0x620c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1459.977018][T11283] binder: 11282:11283 ioctl c018620c 20000440 returned -1 [ 1460.757875][T11285] 8021q: VLANs not supported on xfrm0 [ 1462.256041][ T29] audit: type=1400 audit(1461.850:497): avc: denied { unmount } for pid=8112 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 1465.061346][T11306] binder: 11305:11306 ioctl c018620c 20000440 returned -1 [ 1482.435034][T11343] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11343 comm=syz.2.1958 [ 1488.050431][ T29] audit: type=1400 audit(1487.650:498): avc: denied { create } for pid=11357 comm="syz.2.1970" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1488.399573][T11360] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=11360 comm=syz.2.1970 [ 1492.018623][T11372] FAULT_INJECTION: forcing a failure. [ 1492.018623][T11372] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1492.024402][T11372] CPU: 1 UID: 0 PID: 11372 Comm: syz.1.1977 Not tainted syzkaller #0 PREEMPT [ 1492.024499][T11372] Hardware name: ARM-Versatile Express [ 1492.024515][T11372] Call trace: [ 1492.024540][T11372] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1492.024605][T11372] r7:0000006c r6:00000000 r5:60000113 r4:82252458 [ 1492.024616][T11372] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1492.024643][T11372] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1492.024670][T11372] r5:85b56000 r4:8294f590 [ 1492.024677][T11372] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1492.024707][T11372] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1492.024736][T11372] r8:8020029c r7:0000006c r6:85b56000 r5:20001ec0 r4:dfb59eb8 [ 1492.024744][T11372] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1492.024764][T11372] [<80986ef4>] (should_fail_usercopy) from [<80566c50>] (cp_new_stat+0x16c/0x21c) [ 1492.024789][T11372] [<80566ae4>] (cp_new_stat) from [<805673b4>] (__do_sys_newfstat+0x58/0x7c) [ 1492.024815][T11372] r6:00130918 r5:20001ec0 r4:00000003 [ 1492.024823][T11372] [<8056735c>] (__do_sys_newfstat) from [<805678ac>] (sys_newfstat+0x10/0x14) [ 1492.024848][T11372] r5:00000000 r4:00000000 [ 1492.024856][T11372] [<8056789c>] (sys_newfstat) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1492.024878][T11372] Exception stack(0xdfb59fa8 to 0xdfb59ff0) [ 1492.024906][T11372] 9fa0: 00000000 00000000 00000003 20001ec0 00000000 00000000 [ 1492.024954][T11372] 9fc0: 00000000 00000000 00130918 0000006c 00300000 00000000 00006364 76f320bc [ 1492.024978][T11372] 9fe0: 76f31ec0 76f31eb0 0001928c 00132970 [ 1499.146181][T11406] FAULT_INJECTION: forcing a failure. [ 1499.146181][T11406] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1499.148734][T11406] CPU: 1 UID: 0 PID: 11406 Comm: syz.2.1988 Not tainted syzkaller #0 PREEMPT [ 1499.148836][T11406] Hardware name: ARM-Versatile Express [ 1499.148864][T11406] Call trace: [ 1499.148907][T11406] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1499.149029][T11406] r7:00000000 r6:00000000 r5:60000013 r4:82252458 [ 1499.149050][T11406] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1499.149098][T11406] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1499.149152][T11406] r5:85b53000 r4:8294f590 [ 1499.149166][T11406] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1499.149233][T11406] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1499.149292][T11406] r8:dfcd9eb8 r7:00000000 r6:00000001 r5:76fb4f30 r4:00000001 [ 1499.149311][T11406] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1499.149352][T11406] [<80986ef4>] (should_fail_usercopy) from [<808d02b0>] (kstrtouint_from_user+0x54/0x13c) [ 1499.149402][T11406] [<808d025c>] (kstrtouint_from_user) from [<80617644>] (proc_fail_nth_write+0x40/0xf0) [ 1499.149465][T11406] r8:dfcd9f68 r7:85b53000 r6:00000001 r5:855e59c0 r4:00000001 [ 1499.149484][T11406] [<80617604>] (proc_fail_nth_write) from [<8055f910>] (vfs_write+0xac/0x44c) [ 1499.149540][T11406] r5:855e59c0 r4:80617604 [ 1499.149556][T11406] [<8055f864>] (vfs_write) from [<8055fe20>] (ksys_write+0x74/0xe8) [ 1499.149615][T11406] r10:00000004 r9:85b53000 r8:8020029c r7:00000000 r6:00000002 r5:855e59c0 [ 1499.149636][T11406] r4:855e59c3 [ 1499.149651][T11406] [<8055fdac>] (ksys_write) from [<8055fea4>] (sys_write+0x10/0x14) [ 1499.149705][T11406] r7:00000004 r6:00000004 r5:76fb4f30 r4:00000001 [ 1499.149722][T11406] [<8055fe94>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1499.149771][T11406] Exception stack(0xdfcd9fa8 to 0xdfcd9ff0) [ 1499.149812][T11406] 9fa0: 00000001 76fb4f30 00000004 76fb4f30 00000001 00000000 [ 1499.149841][T11406] 9fc0: 00000001 76fb4f30 00000004 00000004 00300000 00000000 00006364 76fb50bc [ 1499.149871][T11406] 9fe0: 00000158 76fb4ed0 000d862c 00130904 [ 1500.180105][T11412] block nbd1: shutting down sockets [ 1505.438499][T11446] FAULT_INJECTION: forcing a failure. [ 1505.438499][T11446] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1505.440294][T11446] CPU: 1 UID: 0 PID: 11446 Comm: syz.2.2001 Not tainted syzkaller #0 PREEMPT [ 1505.440385][T11446] Hardware name: ARM-Versatile Express [ 1505.440414][T11446] Call trace: [ 1505.440455][T11446] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1505.440571][T11446] r7:00006364 r6:00000000 r5:60000013 r4:82252458 [ 1505.440592][T11446] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1505.440643][T11446] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1505.440696][T11446] r5:8416c800 r4:8294f590 [ 1505.440714][T11446] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1505.440779][T11446] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1505.440840][T11446] r8:00000000 r7:00006364 r6:76f940bc r5:8416d030 r4:76f93bb8 [ 1505.440860][T11446] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1505.440905][T11446] [<80986ef4>] (should_fail_usercopy) from [<8022b414>] (setup_sigframe+0xe4/0x1c4) [ 1505.440957][T11446] [<8022b330>] (setup_sigframe) from [<8022babc>] (do_work_pending+0x2e4/0x4e8) [ 1505.441019][T11446] r10:00000077 r9:b5403587 r8:00000000 r7:8416d030 r6:76f93bb8 r5:e835dfb0 [ 1505.441040][T11446] r4:8416c800 [ 1505.441058][T11446] [<8022b7d8>] (do_work_pending) from [<80200088>] (slow_work_pending+0xc/0x24) [ 1505.441120][T11446] Exception stack(0xe835dfb0 to 0xe835dff8) [ 1505.441161][T11446] dfa0: ffffffa4 00000114 00000007 200002c0 [ 1505.441195][T11446] dfc0: 000000a0 00000000 00130918 00000126 00300000 00000000 00006364 76f940bc [ 1505.441225][T11446] dfe0: 76f93ec0 76f93eb0 0001928c 00132970 60000010 00000011 [ 1505.441259][T11446] r10:00000077 r9:8416c800 r8:00000000 r7:00000077 r6:00130918 r5:00000000 [ 1505.441278][T11446] r4:000000a0 [ 1507.486912][T11463] fuse: Bad value for 'fd' [ 1513.736639][T11475] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=11475 comm=syz.1.2008 [ 1513.745037][T11475] FAULT_INJECTION: forcing a failure. [ 1513.745037][T11475] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1513.746019][T11475] CPU: 1 UID: 0 PID: 11475 Comm: syz.1.2008 Not tainted syzkaller #0 PREEMPT [ 1513.746073][T11475] Hardware name: ARM-Versatile Express [ 1513.746088][T11475] Call trace: [ 1513.746110][T11475] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1513.746172][T11475] r7:00000000 r6:00000000 r5:60000013 r4:82252458 [ 1513.746181][T11475] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1513.746222][T11475] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1513.746250][T11475] r5:85b52400 r4:8294f590 [ 1513.746257][T11475] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1513.746289][T11475] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1513.746318][T11475] r8:e8359eb8 r7:00000000 r6:00000001 r5:76f31f30 r4:00000001 [ 1513.746326][T11475] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1513.746347][T11475] [<80986ef4>] (should_fail_usercopy) from [<808d02b0>] (kstrtouint_from_user+0x54/0x13c) [ 1513.746373][T11475] [<808d025c>] (kstrtouint_from_user) from [<80617644>] (proc_fail_nth_write+0x40/0xf0) [ 1513.746405][T11475] r8:e8359f68 r7:85b52400 r6:00000001 r5:855e56c0 r4:00000001 [ 1513.746413][T11475] [<80617604>] (proc_fail_nth_write) from [<8055f910>] (vfs_write+0xac/0x44c) [ 1513.746441][T11475] r5:855e56c0 r4:80617604 [ 1513.746449][T11475] [<8055f864>] (vfs_write) from [<8055fe20>] (ksys_write+0x74/0xe8) [ 1513.746480][T11475] r10:00000004 r9:85b52400 r8:8020029c r7:00000000 r6:00000002 r5:855e56c0 [ 1513.746489][T11475] r4:855e56c3 [ 1513.746496][T11475] [<8055fdac>] (ksys_write) from [<8055fea4>] (sys_write+0x10/0x14) [ 1513.746525][T11475] r7:00000004 r6:00000003 r5:76f31f30 r4:00000001 [ 1513.746533][T11475] [<8055fe94>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1513.746555][T11475] Exception stack(0xe8359fa8 to 0xe8359ff0) [ 1513.746576][T11475] 9fa0: 00000001 76f31f30 00000003 76f31f30 00000001 00000000 [ 1513.746593][T11475] 9fc0: 00000001 76f31f30 00000003 00000004 00300000 00000000 00006364 76f320bc [ 1513.746605][T11475] 9fe0: 00000158 76f31ed0 000d862c 00130904 [ 1522.235726][T11512] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=11512 comm=syz.2.2024 [ 1523.663124][T11523] FAULT_INJECTION: forcing a failure. [ 1523.663124][T11523] name failslab, interval 1, probability 0, space 0, times 0 [ 1523.666399][T11523] CPU: 1 UID: 0 PID: 11523 Comm: syz.1.2029 Not tainted syzkaller #0 PREEMPT [ 1523.666551][T11523] Hardware name: ARM-Versatile Express [ 1523.666581][T11523] Call trace: [ 1523.666628][T11523] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1523.666780][T11523] r7:00000820 r6:00000000 r5:60000013 r4:82252458 [ 1523.666811][T11523] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1523.666865][T11523] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1523.666920][T11523] r5:85b53c00 r4:82918810 [ 1523.666936][T11523] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1523.667047][T11523] [<80986cb4>] (should_fail_ex) from [<8052efdc>] (should_failslab+0x6c/0x94) [ 1523.667123][T11523] r8:00000000 r7:00000820 r6:0000001b r5:ea8f9d70 r4:83001240 [ 1523.667141][T11523] [<8052ef70>] (should_failslab) from [<8051154c>] (__kmalloc_node_track_caller_noprof+0xa0/0x574) [ 1523.667204][T11523] [<805114ac>] (__kmalloc_node_track_caller_noprof) from [<804a475c>] (kmemdup_noprof+0x28/0x44) [ 1523.667278][T11523] r10:000000e7 r9:84fb7604 r8:ea8f9d6c r7:83a53000 r6:8480c898 r5:ea8f9d70 [ 1523.667297][T11523] r4:0000001b [ 1523.667315][T11523] [<804a4734>] (kmemdup_noprof) from [<807b1bb0>] (sidtab_sid2str_get+0x54/0xa4) [ 1523.667382][T11523] r7:83a53000 r6:ea8f9d6c r5:ea8f9d70 r4:84234180 [ 1523.667400][T11523] [<807b1b5c>] (sidtab_sid2str_get) from [<807b90cc>] (sidtab_entry_to_string+0x34/0x94) [ 1523.667461][T11523] r7:83a53000 r6:84234180 r5:ea8f9d70 r4:00000022 [ 1523.667479][T11523] [<807b9098>] (sidtab_entry_to_string) from [<807b9244>] (security_sid_to_context_core+0x118/0x17c) [ 1523.667539][T11523] r9:807a7124 r8:83a53000 r7:84fb7604 r6:ea8f9d6c r5:ea8f9d70 r4:00000022 [ 1523.667556][T11523] [<807b912c>] (security_sid_to_context_core) from [<807bc280>] (security_sid_to_context_force+0x20/0x28) [ 1523.667617][T11523] r8:83838c28 r7:82ae9f24 r6:00000000 r5:ea8f9dd8 r4:83897174 [ 1523.667638][T11523] [<807bc260>] (security_sid_to_context_force) from [<807a7218>] (selinux_inode_getsecurity+0xf4/0x128) [ 1523.667687][T11523] [<807a7124>] (selinux_inode_getsecurity) from [<8078e780>] (security_inode_getsecurity+0xb4/0x248) [ 1523.667753][T11523] r8:83838c28 r7:00000000 r6:ea8f9dd8 r5:ea8f9e6d r4:8291f61c [ 1523.667771][T11523] [<8078e6cc>] (security_inode_getsecurity) from [<80596bc4>] (vfs_getxattr+0x118/0x14c) [ 1523.667841][T11523] r9:83838c28 r8:8291f61c r7:00000000 r6:ea8f9e64 r5:834c4bb0 r4:00000000 [ 1523.667860][T11523] [<80596aac>] (vfs_getxattr) from [<80596ce8>] (do_getxattr+0xf0/0x194) [ 1523.667921][T11523] r9:00000000 r8:ea8f9e64 r7:834c4bb0 r6:00000000 r5:ea8f9e50 r4:8291f61c [ 1523.667948][T11523] [<80596bf8>] (do_getxattr) from [<80597ee0>] (file_getxattr+0x44/0x50) [ 1523.668010][T11523] r9:00000000 r8:00000003 r7:20000700 r6:855e5600 r5:ea8f9e50 r4:855e5600 [ 1523.668030][T11523] [<80597e9c>] (file_getxattr) from [<805980c0>] (path_getxattrat+0x110/0x17c) [ 1523.668082][T11523] r5:855e5601 r4:00000010 [ 1523.668097][T11523] [<80597fb0>] (path_getxattrat) from [<80598324>] (sys_fgetxattr+0x2c/0x34) [ 1523.668158][T11523] r9:85b53c00 r8:8020029c r7:000000e7 r6:00130918 r5:00000000 r4:00000000 [ 1523.668177][T11523] [<805982f8>] (sys_fgetxattr) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1523.668227][T11523] Exception stack(0xea8f9fa8 to 0xea8f9ff0) [ 1523.668271][T11523] 9fa0: 00000000 00000000 00000003 20000700 00000000 00000000 [ 1523.668307][T11523] 9fc0: 00000000 00000000 00130918 000000e7 00300000 00000000 00006364 76f320bc [ 1523.668335][T11523] 9fe0: 76f31ec0 76f31eb0 0001928c 00132970 [ 1527.805010][T11549] raw_sendmsg: syz.1.2037 forgot to set AF_INET. Fix it! [ 1527.850632][T11549] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11549 comm=syz.1.2037 [ 1529.785544][T11566] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=11566 comm=syz.1.2044 [ 1536.886386][T11582] fuse: Bad value for 'fd' [ 1538.217603][ T41] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 1538.438114][ T41] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 1538.439452][ T41] usb 2-1: can't read configurations, error -22 [ 1538.574699][ T41] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 1538.744742][ T41] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 1538.745852][ T41] usb 2-1: can't read configurations, error -22 [ 1538.747363][ T41] usb usb2-port1: attempt power cycle [ 1539.095008][ T41] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 1539.157476][ T41] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 1539.158938][ T41] usb 2-1: can't read configurations, error -22 [ 1539.295500][ T41] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 1539.374576][ T41] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 1539.375888][ T41] usb 2-1: can't read configurations, error -22 [ 1539.377815][ T41] usb usb2-port1: unable to enumerate USB device [ 1540.724907][ T29] audit: type=1400 audit(1540.300:499): avc: denied { setattr } for pid=11597 comm="syz.2.2054" name="ALG" dev="sockfs" ino=24981 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1548.848108][T11629] fuse: Unknown parameter '000000000000000000000050x0000000000000005' [ 1552.735076][ T29] audit: type=1400 audit(1552.340:500): avc: denied { read } for pid=11641 comm="syz.2.2069" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1561.304549][ T3789] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 1561.474381][ T3789] usb 2-1: Using ep0 maxpacket: 32 [ 1561.514336][ T3789] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1561.551751][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1561.551950][ T3789] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1561.552050][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1561.664484][ T3789] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1561.664780][ T3789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1561.664973][ T3789] usb 2-1: Product: syz [ 1561.665062][ T3789] usb 2-1: Manufacturer: syz [ 1561.665142][ T3789] usb 2-1: SerialNumber: syz [ 1562.007325][T11677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1562.025227][T11677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1562.082278][ T3789] cdc_ncm 2-1:1.0: bind() failure [ 1562.090095][ T3789] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1562.090436][ T3789] cdc_ncm 2-1:1.1: bind() failure [ 1562.105956][ T3789] usb 2-1: USB disconnect, device number 49 [ 1562.575320][ T9844] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 1562.744638][ T9844] usb 2-1: Using ep0 maxpacket: 32 [ 1562.778085][ T9844] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1562.780656][ T9844] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1562.782259][ T9844] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1562.803524][ T9844] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1562.805762][ T9844] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1562.806997][ T9844] usb 2-1: Product: } [ 1562.807702][ T9844] usb 2-1: Manufacturer: 쭻ඇ凿ꅺ備䖝넀쩼踥洤끡䤋扇갬繅뤃⛣⒳艼댾ᰴ䷴텕㛋宸ﴁ䕩폓骼䇰Ꮹ툪婚橸๟쏿降 굉倳埞徯쇗覞Ⱛ㧑⫯ [ 1562.810376][ T9844] usb 2-1: SerialNumber: Ф [ 1563.264942][ T9844] cdc_ncm 2-1:1.0: bind() failure [ 1563.271467][ T9844] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1563.272818][ T9844] cdc_ncm 2-1:1.1: bind() failure [ 1563.292585][ T9844] usb 2-1: USB disconnect, device number 50 [ 1563.630289][T11709] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=11709 comm=syz.1.2082 [ 1563.685649][T11709] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11709 comm=syz.1.2082 [ 1566.905111][ T3789] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 1567.135587][ T3789] usb 2-1: Using ep0 maxpacket: 32 [ 1567.192488][ T3789] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1567.247477][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1567.247849][ T3789] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1567.248149][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1567.387454][ T3789] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1567.387823][ T3789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1567.388108][ T3789] usb 2-1: Product: syz [ 1567.388159][ T3789] usb 2-1: Manufacturer: syz [ 1567.388187][ T3789] usb 2-1: SerialNumber: syz [ 1567.757152][T11719] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1567.761211][T11719] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1567.825181][ T3789] cdc_ncm 2-1:1.0: bind() failure [ 1567.847365][ T3789] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1567.847737][ T3789] cdc_ncm 2-1:1.1: bind() failure [ 1567.868859][ T3789] usb 2-1: USB disconnect, device number 51 [ 1568.324801][ T3789] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 1568.484769][ T3789] usb 2-1: Using ep0 maxpacket: 32 [ 1568.564667][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1568.565019][ T3789] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1568.565080][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1568.678878][ T3789] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1568.679276][ T3789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1568.679622][ T3789] usb 2-1: Product: } [ 1568.679703][ T3789] usb 2-1: Manufacturer: 쭻ඇ凿ꅺ備䖝넀쩼踥洤끡䤋扇갬繅뤃⛣⒳艼댾ᰴ䷴텕㛋宸ﴁ䕩폓骼䇰Ꮹ툪婚橸๟쏿降 굉倳埞徯쇗覞Ⱛ㧑⫯ [ 1568.679743][ T3789] usb 2-1: SerialNumber: Ф [ 1569.161701][ T3789] cdc_ncm 2-1:1.0: bind() failure [ 1569.167671][ T3789] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1569.168066][ T3789] cdc_ncm 2-1:1.1: bind() failure [ 1569.176430][ T3789] usb 2-1: USB disconnect, device number 52 [ 1569.784604][ T9844] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 1570.020335][ T9844] usb 2-1: Using ep0 maxpacket: 16 [ 1570.109806][ T9844] usb 2-1: config 1 interface 0 altsetting 93 bulk endpoint 0x82 has invalid maxpacket 96 [ 1570.110023][ T9844] usb 2-1: config 1 interface 0 altsetting 93 bulk endpoint 0x3 has invalid maxpacket 8 [ 1570.110223][ T9844] usb 2-1: config 1 interface 0 altsetting 93 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1570.110321][ T9844] usb 2-1: config 1 interface 0 has no altsetting 0 [ 1570.157602][ T9844] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1570.157782][ T9844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1570.157931][ T9844] usb 2-1: SerialNumber: syz [ 1570.177008][T11751] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1570.177833][T11751] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1570.437586][T11751] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1570.438824][T11751] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1571.239063][ T9844] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 1571.248179][ T9844] usb 2-1: USB disconnect, device number 53 [ 1571.495941][T11767] FAULT_INJECTION: forcing a failure. [ 1571.495941][T11767] name failslab, interval 1, probability 0, space 0, times 0 [ 1571.496302][T11767] CPU: 0 UID: 0 PID: 11767 Comm: syz.1.2088 Not tainted syzkaller #0 PREEMPT [ 1571.496360][T11767] Hardware name: ARM-Versatile Express [ 1571.496374][T11767] Call trace: [ 1571.496400][T11767] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1571.496462][T11767] r7:00000000 r6:00000000 r5:60000013 r4:82252458 [ 1571.496473][T11767] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1571.496499][T11767] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1571.496527][T11767] r5:8416bc00 r4:82918810 [ 1571.496534][T11767] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1571.496568][T11767] [<80986cb4>] (should_fail_ex) from [<8052efdc>] (should_failslab+0x6c/0x94) [ 1571.496605][T11767] r8:8416bc00 r7:00000000 r6:00000820 r5:848b8240 r4:832ac000 [ 1571.496614][T11767] [<8052ef70>] (should_failslab) from [<8050ec74>] (kmem_cache_alloc_noprof+0x4c/0x444) [ 1571.496643][T11767] [<8050ec28>] (kmem_cache_alloc_noprof) from [<8156aa80>] (skb_clone+0x60/0x1c8) [ 1571.497062][T11767] r10:00000014 r9:84be0600 r8:85785400 r7:848b8240 r6:85919ec0 r5:848b8240 [ 1571.497131][T11767] r4:00000820 [ 1571.497565][T11767] [<8156aa20>] (skb_clone) from [<816849a8>] (__netlink_deliver_tap+0x1f0/0x288) [ 1571.497646][T11767] r5:85785464 r4:85919800 [ 1571.497932][T11767] [<816847b8>] (__netlink_deliver_tap) from [<816869d0>] (netlink_unicast+0x360/0x384) [ 1571.498029][T11767] r10:00000014 r9:85458d80 r8:85938000 r7:848b8240 r6:84be0600 r5:85785464 [ 1571.498223][T11767] r4:85785400 [ 1571.498617][T11767] [<81686670>] (netlink_unicast) from [<81686bc0>] (netlink_sendmsg+0x1cc/0x444) [ 1571.498684][T11767] r10:00000000 r9:00000000 r8:00000000 r7:85458c00 r6:00000014 r5:848b8240 [ 1571.498726][T11767] r4:ebbadf20 [ 1571.498735][T11767] [<816869f4>] (netlink_sendmsg) from [<81556d34>] (__sock_sendmsg+0x44/0x78) [ 1571.498831][T11767] r10:00000000 r9:ebbaddc4 r8:ebbaddc4 r7:00000000 r6:837c9180 r5:ebbadf20 [ 1571.498849][T11767] r4:00000000 [ 1571.498858][T11767] [<81556cf0>] (__sock_sendmsg) from [<815574fc>] (____sys_sendmsg+0x298/0x2cc) [ 1571.498888][T11767] r7:00000000 r6:837c9180 r5:000000c0 r4:ebbadf20 [ 1571.498896][T11767] [<81557264>] (____sys_sendmsg) from [<815594c4>] (___sys_sendmsg+0x9c/0xd0) [ 1571.498926][T11767] r10:ebbade24 r9:20000280 r8:000000c0 r7:00000000 r6:837c9180 r5:ebbadf20 [ 1571.498935][T11767] r4:00000000 [ 1571.498943][T11767] [<81559428>] (___sys_sendmsg) from [<8155995c>] (__sys_sendmsg+0x8c/0xe0) [ 1571.498983][T11767] r10:00000128 r9:8416bc00 r8:88ce0d80 r7:000000c0 r6:20000280 r5:88ce0d81 [ 1571.498993][T11767] r4:00000003 [ 1571.499040][T11767] [<815598d0>] (__sys_sendmsg) from [<815599c4>] (sys_sendmsg+0x14/0x18) [ 1571.499074][T11767] r8:8020029c r7:00000128 r6:00130918 r5:00000000 r4:00000000 [ 1571.499082][T11767] [<815599b0>] (sys_sendmsg) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1571.499106][T11767] Exception stack(0xebbadfa8 to 0xebbadff0) [ 1571.499126][T11767] dfa0: 00000000 00000000 00000003 20000280 000000c0 00000000 [ 1571.499142][T11767] dfc0: 00000000 00000000 00130918 00000128 00300000 00000000 00006364 76f320bc [ 1571.499155][T11767] dfe0: 76f31ec0 76f31eb0 0001928c 00132970 [ 1572.354289][ T5756] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 1572.530092][ T5756] usb 2-1: Using ep0 maxpacket: 32 [ 1572.549039][ T5756] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1572.557807][ T5756] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1572.558019][ T5756] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1572.558166][ T5756] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1572.578049][ T5756] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1572.578252][ T5756] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1572.578410][ T5756] usb 2-1: Product: syz [ 1572.578436][ T5756] usb 2-1: Manufacturer: syz [ 1572.578449][ T5756] usb 2-1: SerialNumber: syz [ 1572.893349][T11772] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1572.929809][T11772] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1572.946651][ T5756] cdc_ncm 2-1:1.0: bind() failure [ 1572.949750][ T5756] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1572.949978][ T5756] cdc_ncm 2-1:1.1: bind() failure [ 1572.971993][ T5756] usb 2-1: USB disconnect, device number 54 [ 1574.097736][T11794] FAULT_INJECTION: forcing a failure. [ 1574.097736][T11794] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1574.098133][T11794] CPU: 0 UID: 0 PID: 11794 Comm: syz.1.2093 Not tainted syzkaller #0 PREEMPT [ 1574.098210][T11794] Hardware name: ARM-Versatile Express [ 1574.098225][T11794] Call trace: [ 1574.098249][T11794] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1574.098309][T11794] r7:76f31b58 r6:00000000 r5:60000013 r4:82252458 [ 1574.098319][T11794] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1574.098345][T11794] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1574.098372][T11794] r5:85b53000 r4:8294f590 [ 1574.098457][T11794] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1574.098593][T11794] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1574.098803][T11794] r8:b5003587 r7:76f31b58 r6:76f31b38 r5:ebc51f58 r4:76f31b38 [ 1574.098932][T11794] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1574.099042][T11794] [<80986ef4>] (should_fail_usercopy) from [<8026ad70>] (copy_siginfo_to_user+0x1c/0xa4) [ 1574.099113][T11794] [<8026ad54>] (copy_siginfo_to_user) from [<8022bb50>] (do_work_pending+0x378/0x4e8) [ 1574.099213][T11794] r9:fffffe00 r8:b5003587 r7:85b53830 r6:76f31b38 r5:ebc51fb0 r4:85b53000 [ 1574.099348][T11794] [<8022b7d8>] (do_work_pending) from [<80200088>] (slow_work_pending+0xc/0x24) [ 1574.099396][T11794] Exception stack(0xebc51fb0 to 0xebc51ff8) [ 1574.099507][T11794] 1fa0: 00000003 20000340 00040000 00000000 [ 1574.099556][T11794] 1fc0: 00000000 00000000 00130918 00000128 00300000 00000000 00006364 76f320bc [ 1574.099592][T11794] 1fe0: 76f31ec0 76f31eb0 0001928c 0013296c 60000010 00000003 [ 1574.099638][T11794] r10:00000128 r9:85b53000 r8:8020029c r7:00000128 r6:00130918 r5:00000000 [ 1574.099857][T11794] r4:00000000 [ 1577.325136][ T9844] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 1577.507272][ T9844] usb 2-1: Using ep0 maxpacket: 32 [ 1577.533728][ T9844] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1577.557504][ T9844] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1577.558806][ T9844] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1577.559993][ T9844] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1577.567402][ T9844] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1577.568427][ T9844] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1577.569581][ T9844] usb 2-1: Product: syz [ 1577.570315][ T9844] usb 2-1: Manufacturer: syz [ 1577.571059][ T9844] usb 2-1: SerialNumber: syz [ 1577.821936][T11805] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1577.822633][T11805] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1577.860372][ T9844] cdc_ncm 2-1:1.0: bind() failure [ 1577.867220][ T9844] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1577.869479][ T9844] cdc_ncm 2-1:1.1: bind() failure [ 1577.878233][ T9844] usb 2-1: USB disconnect, device number 55 [ 1579.647485][ T5756] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 1579.824790][ T5756] usb 2-1: Using ep0 maxpacket: 32 [ 1579.859520][ T5756] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1579.882481][ T5756] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1579.882866][ T5756] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1579.883071][ T5756] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1580.059279][ T5756] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1580.059613][ T5756] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1580.059917][ T5756] usb 2-1: Product: syz [ 1580.059974][ T5756] usb 2-1: Manufacturer: syz [ 1580.060000][ T5756] usb 2-1: SerialNumber: syz [ 1580.416234][T11834] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1580.418877][T11834] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1580.474854][ T5756] cdc_ncm 2-1:1.0: bind() failure [ 1580.486111][ T5756] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1580.486420][ T5756] cdc_ncm 2-1:1.1: bind() failure [ 1580.497128][ T5756] usb 2-1: USB disconnect, device number 56 [ 1581.536127][T11853] FAULT_INJECTION: forcing a failure. [ 1581.536127][T11853] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1581.545235][T11853] CPU: 1 UID: 0 PID: 11853 Comm: syz.1.2104 Not tainted syzkaller #0 PREEMPT [ 1581.545400][T11853] Hardware name: ARM-Versatile Express [ 1581.545460][T11853] Call trace: [ 1581.545514][T11853] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1581.545623][T11853] r7:b5403587 r6:00000000 r5:60000113 r4:82252458 [ 1581.545647][T11853] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1581.545701][T11853] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1581.545757][T11853] r5:85b53000 r4:8294f590 [ 1581.545774][T11853] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1581.545834][T11853] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1581.545894][T11853] r8:00000000 r7:b5403587 r6:76f31bb8 r5:00000000 r4:ebe35fb0 [ 1581.545912][T11853] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1581.546027][T11853] [<80986ef4>] (should_fail_usercopy) from [<8022b588>] (restore_sigframe+0x94/0x210) [ 1581.546087][T11853] [<8022b4f4>] (restore_sigframe) from [<8022b7a8>] (sys_rt_sigreturn+0x44/0x74) [ 1581.546174][T11853] r7:000000ad r6:00130918 r5:76f31b38 r4:ebe35fb0 [ 1581.546195][T11853] [<8022b764>] (sys_rt_sigreturn) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1581.546244][T11853] Exception stack(0xebe35fa8 to 0xebe35ff0) [ 1581.546283][T11853] 5fa0: 00000000 00000000 000005f9 76f31b38 76f31bb8 00000000 [ 1581.546315][T11853] 5fc0: 00000000 00000000 00130918 000000ad 00300000 00000000 00006364 76f320bc [ 1581.546343][T11853] 5fe0: 76f31ec0 76f31b38 0015b300 000efa48 [ 1581.546390][T11853] r5:00000000 r4:00000000 [ 1581.982502][ T29] audit: type=1400 audit(1581.580:501): avc: denied { remount } for pid=11855 comm="syz.1.2105" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 1582.437605][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1582.485834][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1582.569541][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1582.637734][ T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1583.059035][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1583.068370][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1583.082060][ T12] bond0 (unregistering): Released all slaves [ 1583.186618][ T12] hsr_slave_0: left promiscuous mode [ 1583.202969][ T12] hsr_slave_1: left promiscuous mode [ 1583.225753][ T12] veth1_macvtap: left promiscuous mode [ 1583.226280][ T12] veth0_macvtap: left promiscuous mode [ 1583.226517][ T12] veth1_vlan: left promiscuous mode [ 1583.226666][ T12] veth0_vlan: left promiscuous mode [ 1585.881272][T11862] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1585.912877][T11862] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1587.389023][T11862] hsr_slave_0: entered promiscuous mode [ 1587.390992][T11862] hsr_slave_1: entered promiscuous mode [ 1588.187086][T11862] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1588.202907][T11862] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1588.219381][T11862] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1588.241104][T11862] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1589.409230][T11862] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1590.906775][T12252] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1590.956168][T12252] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1590.977013][T12252] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1590.985765][T12252] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1591.526401][T12252] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1591.537761][T12252] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1593.445431][T11862] veth0_vlan: entered promiscuous mode [ 1593.480931][T11862] veth1_vlan: entered promiscuous mode [ 1593.578116][T11862] veth0_macvtap: entered promiscuous mode [ 1593.590840][T11862] veth1_macvtap: entered promiscuous mode [ 1593.771833][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1593.773375][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1593.776807][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1593.782485][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1594.929602][T11928] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1594.990128][T11928] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1595.053099][T11928] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1595.131552][T11928] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1595.469040][T11928] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1595.478005][T11928] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1595.489482][T11928] bond0 (unregistering): Released all slaves [ 1595.582199][T11928] hsr_slave_0: left promiscuous mode [ 1595.585167][T11928] hsr_slave_1: left promiscuous mode [ 1595.606970][T11928] veth1_macvtap: left promiscuous mode [ 1595.614242][T11928] veth0_macvtap: left promiscuous mode [ 1595.615186][T11928] veth1_vlan: left promiscuous mode [ 1595.615868][T11928] veth0_vlan: left promiscuous mode [ 1598.236765][T12308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1598.258929][T12308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1598.594514][ T9] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 1598.744863][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 1598.760680][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1598.782200][ T9] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1598.782463][ T9] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1598.782669][ T9] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1598.806600][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1598.806841][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1598.807079][ T9] usb 2-1: Product: syz [ 1598.807114][ T9] usb 2-1: Manufacturer: syz [ 1598.807129][ T9] usb 2-1: SerialNumber: syz [ 1598.852526][T12308] hsr_slave_0: entered promiscuous mode [ 1598.855311][T12308] hsr_slave_1: entered promiscuous mode [ 1598.856678][T12308] debugfs: 'hsr0' already exists in 'hsr' [ 1598.857391][T12308] Cannot create hsr debugfs directory [ 1599.057795][T12515] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1599.059550][T12515] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1599.075730][ T9] cdc_ncm 2-1:1.0: bind() failure [ 1599.085245][ T9] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1599.085456][ T9] cdc_ncm 2-1:1.1: bind() failure [ 1599.090805][ T9] usb 2-1: USB disconnect, device number 57 [ 1599.409155][T12308] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1599.420098][T12308] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1599.430650][T12308] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1599.442339][T12308] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1599.525517][ T41] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 1599.675050][ T41] usb 2-1: Using ep0 maxpacket: 32 [ 1599.711228][ T41] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1599.712755][ T41] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1599.715631][ T41] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1599.745428][ T41] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1599.747382][ T41] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1599.748558][ T41] usb 2-1: Product: } [ 1599.749257][ T41] usb 2-1: Manufacturer: 쭻ඇ凿ꅺ備䖝넀쩼踥洤끡䤋扇갬繅뤃⛣⒳艼댾ᰴ䷴텕㛋宸ﴁ䕩폓骼䇰Ꮹ툪婚橸๟쏿降 굉倳埞徯쇗覞Ⱛ㧑⫯ [ 1599.750881][ T41] usb 2-1: SerialNumber: Ф [ 1600.184642][ T41] cdc_ncm 2-1:1.0: bind() failure [ 1600.190722][ T41] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1600.204467][ T41] cdc_ncm 2-1:1.1: bind() failure [ 1600.210240][ T41] usb 2-1: USB disconnect, device number 58 [ 1600.679495][T12308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1600.709323][ T29] audit: type=1400 audit(1600.310:502): avc: denied { setopt } for pid=12717 comm="syz.1.2115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 1601.025439][ T41] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 1601.185721][ T41] usb 2-1: Using ep0 maxpacket: 32 [ 1601.192566][ T41] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1601.199113][ T41] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1601.199902][ T41] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1601.200479][ T41] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1601.213726][ T41] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1601.223447][ T41] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1601.223768][ T41] usb 2-1: Product: syz [ 1601.224411][ T41] usb 2-1: Manufacturer: syz [ 1601.224563][ T41] usb 2-1: SerialNumber: syz [ 1601.451064][T12724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1601.466476][T12724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1601.474246][ T41] cdc_ncm 2-1:1.0: bind() failure [ 1601.477747][ T41] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1601.482320][ T41] cdc_ncm 2-1:1.1: bind() failure [ 1601.490111][ T41] usb 2-1: USB disconnect, device number 59 [ 1601.925154][ T41] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 1602.094930][ T41] usb 2-1: Using ep0 maxpacket: 32 [ 1602.127768][ T41] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1602.129149][ T41] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1602.130381][ T41] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1602.146389][ T41] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1602.147668][ T41] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1602.148855][ T41] usb 2-1: Product: } [ 1602.149584][ T41] usb 2-1: Manufacturer: 쭻ඇ凿ꅺ備䖝넀쩼踥洤끡䤋扇갬繅뤃⛣⒳艼댾ᰴ䷴텕㛋宸ﴁ䕩폓骼䇰Ꮹ툪婚橸๟쏿降 굉倳埞徯쇗覞Ⱛ㧑⫯ [ 1602.151199][ T41] usb 2-1: SerialNumber: Ф [ 1602.622135][ T41] cdc_ncm 2-1:1.0: bind() failure [ 1602.643700][ T41] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1602.650129][ T41] cdc_ncm 2-1:1.1: bind() failure [ 1602.667081][ T41] usb 2-1: USB disconnect, device number 60 [ 1602.698000][T12308] veth0_vlan: entered promiscuous mode [ 1602.731894][T12308] veth1_vlan: entered promiscuous mode [ 1602.823495][T12308] veth0_macvtap: entered promiscuous mode [ 1602.836541][T12308] veth1_macvtap: entered promiscuous mode [ 1602.887288][T11928] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1602.887555][T11928] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1602.887752][T11928] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1602.887823][T11928] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1603.342713][ T29] audit: type=1400 audit(1602.940:503): avc: denied { ioctl } for pid=12796 comm="syz.1.2117" path="socket:[27079]" dev="sockfs" ino=27079 ioctlcmd=0x5450 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 1603.728529][T12812] FAULT_INJECTION: forcing a failure. [ 1603.728529][T12812] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1603.729137][T12812] CPU: 0 UID: 0 PID: 12812 Comm: syz.1.2119 Not tainted syzkaller #0 PREEMPT [ 1603.729247][T12812] Hardware name: ARM-Versatile Express [ 1603.729279][T12812] Call trace: [ 1603.729331][T12812] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1603.729602][T12812] r7:ec64de20 r6:00000000 r5:60000013 r4:82252458 [ 1603.729905][T12812] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1603.730004][T12812] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1603.730130][T12812] r5:85813c00 r4:8294f590 [ 1603.730608][T12812] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1603.730998][T12812] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1603.731169][T12812] r8:00000000 r7:ec64de20 r6:20001140 r5:00000000 r4:ec64df20 [ 1603.731460][T12812] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1603.731795][T12812] [<80986ef4>] (should_fail_usercopy) from [<81559348>] (copy_msghdr_from_user+0x50/0x130) [ 1603.731874][T12812] [<815592f8>] (copy_msghdr_from_user) from [<815594a0>] (___sys_sendmsg+0x78/0xd0) [ 1603.731987][T12812] r8:00000000 r7:00000000 r6:850a7400 r5:ec64df20 r4:ec64de64 [ 1603.732449][T12812] [<81559428>] (___sys_sendmsg) from [<8155995c>] (__sys_sendmsg+0x8c/0xe0) [ 1603.732587][T12812] r10:00000128 r9:85813c00 r8:88d439c0 r7:00000000 r6:20001140 r5:88d439c1 [ 1603.732612][T12812] r4:00000003 [ 1603.732706][T12812] [<815598d0>] (__sys_sendmsg) from [<815599c4>] (sys_sendmsg+0x14/0x18) [ 1603.732933][T12812] r8:8020029c r7:00000128 r6:00130918 r5:00000000 r4:00000000 [ 1603.732963][T12812] [<815599b0>] (sys_sendmsg) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1603.733055][T12812] Exception stack(0xec64dfa8 to 0xec64dff0) [ 1603.733164][T12812] dfa0: 00000000 00000000 00000003 20001140 00000000 00000000 [ 1603.733207][T12812] dfc0: 00000000 00000000 00130918 00000128 00300000 00000000 00006364 76f730bc [ 1603.733536][T12812] dfe0: 76f72ec0 76f72eb0 0001928c 00132970 [ 1604.183186][ T3789] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 1604.354901][ T3789] usb 2-1: Using ep0 maxpacket: 32 [ 1604.380298][ T3789] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1604.401635][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1604.401994][ T3789] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1604.402452][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1604.447739][ T3789] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1604.448091][ T3789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1604.448361][ T3789] usb 2-1: Product: syz [ 1604.448411][ T3789] usb 2-1: Manufacturer: syz [ 1604.448438][ T3789] usb 2-1: SerialNumber: syz [ 1604.751066][T12816] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1604.776984][T12816] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1604.843566][ T3789] cdc_ncm 2-1:1.0: bind() failure [ 1604.852351][ T3789] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1604.855191][ T3789] cdc_ncm 2-1:1.1: bind() failure [ 1604.875765][ T3789] usb 2-1: USB disconnect, device number 61 [ 1605.385215][ T3789] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 1605.554972][ T3789] usb 2-1: Using ep0 maxpacket: 32 [ 1605.580176][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1605.580566][ T3789] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1605.580935][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1605.619230][ T3789] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1605.619559][ T3789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1605.619844][ T3789] usb 2-1: Product: } [ 1605.620012][ T3789] usb 2-1: Manufacturer: 쭻ඇ凿ꅺ備䖝넀쩼踥洤끡䤋扇갬繅뤃⛣⒳艼댾ᰴ䷴텕㛋宸ﴁ䕩폓骼䇰Ꮹ툪婚橸๟쏿降 굉倳埞徯쇗覞Ⱛ㧑⫯ [ 1605.620066][ T3789] usb 2-1: SerialNumber: Ф [ 1606.086302][ T3789] cdc_ncm 2-1:1.0: bind() failure [ 1606.096798][ T3789] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1606.097170][ T3789] cdc_ncm 2-1:1.1: bind() failure [ 1606.105433][ T3789] usb 2-1: USB disconnect, device number 62 [ 1611.214717][ T6229] usb 2-1: new full-speed USB device number 63 using dummy_hcd [ 1611.404396][ T6229] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1611.407137][ T6229] usb 2-1: not running at top speed; connect to a high speed hub [ 1611.419909][ T6229] usb 2-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1611.420312][ T6229] usb 2-1: config 1 interface 0 has no altsetting 0 [ 1611.450996][ T6229] usb 2-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 1611.451344][ T6229] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1611.451710][ T6229] usb 2-1: Product: syz [ 1611.451822][ T6229] usb 2-1: Manufacturer: syz [ 1611.451864][ T6229] usb 2-1: SerialNumber: syz [ 1611.810379][ T6229] usb 2-1: USB disconnect, device number 63 [ 1612.752005][T12958] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12958 comm=syz.2.2144 [ 1617.094827][T12994] fuse: Bad value for 'fd' [ 1617.810061][T12998] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12998 comm=syz.2.2155 [ 1617.812056][T12999] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12999 comm=syz.2.2155 [ 1618.067723][T13003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1618.070334][T13003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1618.080148][T13003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1618.081622][T13003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1618.297315][T13003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1618.298281][T13003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1621.463081][T13034] binder: 13033:13034 ioctl 400c620e 20001440 returned -22 [ 1621.491062][ T29] audit: type=1400 audit(1621.090:504): avc: denied { setattr } for pid=13033 comm="syz.2.2167" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1623.647023][ T29] audit: type=1400 audit(1623.250:505): avc: denied { unmount } for pid=11862 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 1625.295254][ T29] audit: type=1400 audit(1624.890:506): avc: denied { name_bind } for pid=13080 comm="syz.2.2186" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 1630.014951][T13135] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=7 sclass=netlink_route_socket pid=13135 comm=syz.1.2204 [ 1630.174912][ T29] audit: type=1400 audit(1629.780:507): avc: denied { read } for pid=13136 comm="syz.2.2205" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1630.817487][ T29] audit: type=1400 audit(1630.420:508): avc: denied { setopt } for pid=13145 comm="syz.2.2208" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1636.069350][ T29] audit: type=1400 audit(1635.670:509): avc: denied { write } for pid=13189 comm="syz.1.2222" name="userio" dev="devtmpfs" ino=693 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 trawcon="system_u:object_r:v4l_device_t:s0" [ 1645.312967][ T29] audit: type=1400 audit(1644.910:510): avc: denied { nlmsg_read } for pid=13224 comm="syz.1.2232" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 1645.449837][ T29] audit: type=1400 audit(1645.050:511): avc: denied { nlmsg_write } for pid=13224 comm="syz.1.2232" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 1647.776050][T13239] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13239 comm=syz.1.2236 [ 1648.240960][T13241] FAULT_INJECTION: forcing a failure. [ 1648.240960][T13241] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1648.242649][T13241] CPU: 1 UID: 0 PID: 13241 Comm: syz.2.2237 Not tainted syzkaller #0 PREEMPT [ 1648.242839][T13241] Hardware name: ARM-Versatile Express [ 1648.242872][T13241] Call trace: [ 1648.242925][T13241] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1648.243049][T13241] r7:20000240 r6:00000000 r5:60000013 r4:82252458 [ 1648.243071][T13241] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1648.243127][T13241] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1648.243187][T13241] r5:85b54800 r4:8294f590 [ 1648.243212][T13241] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1648.243279][T13241] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1648.243434][T13241] r8:00000000 r7:20000240 r6:84d8a900 r5:00000000 r4:dfaddf20 [ 1648.243530][T13241] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1648.243694][T13241] [<80986ef4>] (should_fail_usercopy) from [<808c75ec>] (_copy_from_iter+0x6c/0x7d8) [ 1648.244063][T13241] [<808c7580>] (_copy_from_iter) from [<81686b80>] (netlink_sendmsg+0x18c/0x444) [ 1648.244190][T13241] r10:00000000 r9:00000000 r8:dfaddf30 r7:84efa000 r6:00000014 r5:848ac000 [ 1648.244329][T13241] r4:dfaddf20 [ 1648.244669][T13241] [<816869f4>] (netlink_sendmsg) from [<81556d34>] (__sock_sendmsg+0x44/0x78) [ 1648.244984][T13241] r10:00000000 r9:dfadddc4 r8:dfadddc4 r7:00000000 r6:8505ac80 r5:dfaddf20 [ 1648.245250][T13241] r4:00000000 [ 1648.245344][T13241] [<81556cf0>] (__sock_sendmsg) from [<815574fc>] (____sys_sendmsg+0x298/0x2cc) [ 1648.245414][T13241] r7:00000000 r6:8505ac80 r5:00000010 r4:dfaddf20 [ 1648.245438][T13241] [<81557264>] (____sys_sendmsg) from [<815594c4>] (___sys_sendmsg+0x9c/0xd0) [ 1648.245514][T13241] r10:dfadde24 r9:20000480 r8:00000010 r7:00000000 r6:8505ac80 r5:dfaddf20 [ 1648.245541][T13241] r4:00000000 [ 1648.245559][T13241] [<81559428>] (___sys_sendmsg) from [<8155995c>] (__sys_sendmsg+0x8c/0xe0) [ 1648.245633][T13241] r10:00000128 r9:85b54800 r8:85cf8480 r7:00000010 r6:20000480 r5:85cf8481 [ 1648.245656][T13241] r4:00000003 [ 1648.245677][T13241] [<815598d0>] (__sys_sendmsg) from [<815599c4>] (sys_sendmsg+0x14/0x18) [ 1648.245739][T13241] r8:8020029c r7:00000128 r6:00130918 r5:00000000 r4:00000000 [ 1648.245757][T13241] [<815599b0>] (sys_sendmsg) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1648.245899][T13241] Exception stack(0xdfaddfa8 to 0xdfaddff0) [ 1648.245978][T13241] dfa0: 00000000 00000000 00000003 20000480 00000010 00000000 [ 1648.246016][T13241] dfc0: 00000000 00000000 00130918 00000128 00300000 00000000 00006364 76f260bc [ 1648.246044][T13241] dfe0: 76f25ec0 76f25eb0 0001928c 00132970 [ 1651.130182][T13281] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13281 comm=syz.1.2250 [ 1651.238742][T13283] FAULT_INJECTION: forcing a failure. [ 1651.238742][T13283] name failslab, interval 1, probability 0, space 0, times 0 [ 1651.239208][T13283] CPU: 1 UID: 0 PID: 13283 Comm: syz.1.2251 Not tainted syzkaller #0 PREEMPT [ 1651.239299][T13283] Hardware name: ARM-Versatile Express [ 1651.239324][T13283] Call trace: [ 1651.239369][T13283] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1651.239474][T13283] r7:00000000 r6:00000000 r5:60000013 r4:82252458 [ 1651.239491][T13283] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1651.239538][T13283] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1651.239588][T13283] r5:85b53000 r4:82918810 [ 1651.239602][T13283] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1651.239658][T13283] [<80986cb4>] (should_fail_ex) from [<8052efdc>] (should_failslab+0x6c/0x94) [ 1651.239725][T13283] r8:85b53000 r7:00000000 r6:00000cc0 r5:88df1a00 r4:830a4300 [ 1651.239742][T13283] [<8052ef70>] (should_failslab) from [<8050ec74>] (kmem_cache_alloc_noprof+0x4c/0x444) [ 1651.239793][T13283] [<8050ec28>] (kmem_cache_alloc_noprof) from [<804c7884>] (vm_area_alloc+0x24/0x64) [ 1651.239859][T13283] r10:dfc91cb8 r9:00000001 r8:00000000 r7:00000000 r6:20001000 r5:88df1a00 [ 1651.239989][T13283] r4:a9065c00 [ 1651.240010][T13283] [<804c7860>] (vm_area_alloc) from [<804f35a0>] (__mmap_region+0x470/0xd7c) [ 1651.240109][T13283] r5:8541c680 r4:a9065c00 [ 1651.240185][T13283] [<804f3130>] (__mmap_region) from [<804f4af0>] (mmap_region+0x88/0x160) [ 1651.240314][T13283] r10:00000000 r9:88df1a00 r8:85b53000 r7:00c00000 r6:20001000 r5:00000000 [ 1651.240364][T13283] r4:00002070 [ 1651.240548][T13283] [<804f4a68>] (mmap_region) from [<804d9384>] (do_mmap+0x368/0x538) [ 1651.240676][T13283] r8:20001000 r7:85b53000 r6:00000000 r5:00003032 r4:00c00000 [ 1651.241012][T13283] [<804d901c>] (do_mmap) from [<804a5c9c>] (vm_mmap_pgoff+0x144/0x20c) [ 1651.241194][T13283] r10:88df1a00 r9:20001000 r8:00c00000 r7:dfc91f18 r6:00000000 r5:00000000 [ 1651.241212][T13283] r4:00000000 [ 1651.241262][T13283] [<804a5b58>] (vm_mmap_pgoff) from [<804d8540>] (ksys_mmap_pgoff+0x48/0xec) [ 1651.241370][T13283] r10:000000c0 r9:85b53000 r8:8020029c r7:20001000 r6:00c00000 r5:00000000 [ 1651.241554][T13283] r4:00003032 [ 1651.241806][T13283] [<804d84f8>] (ksys_mmap_pgoff) from [<804d8600>] (sys_mmap_pgoff+0x1c/0x24) [ 1651.241948][T13283] r8:8020029c r7:000000c0 r6:00130918 r5:00000000 r4:00000003 [ 1651.242168][T13283] [<804d85e4>] (sys_mmap_pgoff) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1651.242294][T13283] Exception stack(0xdfc91fa8 to 0xdfc91ff0) [ 1651.242331][T13283] 1fa0: 00000003 00000000 20001000 00c00000 00000000 00003032 [ 1651.242360][T13283] 1fc0: 00000003 00000000 00130918 000000c0 00300000 00000000 00006364 76f730bc [ 1651.242602][T13283] 1fe0: 76f72ec0 76f72eb0 0001928c 00132970 [ 1651.356179][T13285] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13285 comm=syz.1.2252 [ 1651.999689][T13287] FAULT_INJECTION: forcing a failure. [ 1651.999689][T13287] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1651.999957][T13287] CPU: 1 UID: 0 PID: 13287 Comm: syz.1.2253 Not tainted syzkaller #0 PREEMPT [ 1652.000011][T13287] Hardware name: ARM-Versatile Express [ 1652.000026][T13287] Call trace: [ 1652.000050][T13287] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1652.000153][T13287] r7:76f72b58 r6:00000000 r5:60000013 r4:82252458 [ 1652.000164][T13287] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1652.000194][T13287] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1652.000222][T13287] r5:85b55400 r4:8294f590 [ 1652.000228][T13287] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1652.000259][T13287] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1652.000288][T13287] r8:b5003587 r7:76f72b58 r6:76f72b38 r5:dfc91f58 r4:76f72b38 [ 1652.000296][T13287] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1652.000317][T13287] [<80986ef4>] (should_fail_usercopy) from [<8026ad70>] (copy_siginfo_to_user+0x1c/0xa4) [ 1652.000343][T13287] [<8026ad54>] (copy_siginfo_to_user) from [<8022bb50>] (do_work_pending+0x378/0x4e8) [ 1652.000375][T13287] r9:fffffe00 r8:b5003587 r7:85b55c30 r6:76f72b38 r5:dfc91fb0 r4:85b55400 [ 1652.000385][T13287] [<8022b7d8>] (do_work_pending) from [<80200088>] (slow_work_pending+0xc/0x24) [ 1652.000496][T13287] Exception stack(0xdfc91fb0 to 0xdfc91ff8) [ 1652.000618][T13287] 1fa0: 00000003 20000340 00040000 00000000 [ 1652.000685][T13287] 1fc0: 00000000 00000000 00130918 00000128 00300000 00000000 00006364 76f730bc [ 1652.000912][T13287] 1fe0: 76f72ec0 76f72eb0 0001928c 0013296c 60000010 00000003 [ 1652.001145][T13287] r10:00000128 r9:85b55400 r8:8020029c r7:00000128 r6:00130918 r5:00000000 [ 1652.001160][T13287] r4:00000000 [ 1652.417180][T13298] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=5135 sclass=netlink_audit_socket pid=13298 comm=syz.1.2257 [ 1653.115115][ T5756] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 1653.275165][ T5756] usb 2-1: Using ep0 maxpacket: 32 [ 1653.311841][ T5756] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1653.317755][ T5756] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1653.319403][ T5756] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1653.321001][ T5756] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1653.343464][ T5756] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1653.345275][ T5756] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1653.345360][ T5756] usb 2-1: Product: syz [ 1653.345388][ T5756] usb 2-1: Manufacturer: syz [ 1653.345416][ T5756] usb 2-1: SerialNumber: syz [ 1653.582241][ T5756] cdc_ncm 2-1:1.0: bind() failure [ 1653.586432][ T5756] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1653.586707][ T5756] cdc_ncm 2-1:1.1: bind() failure [ 1653.599178][ T5756] usb 2-1: USB disconnect, device number 64 [ 1653.811787][ T29] audit: type=1400 audit(1653.410:512): avc: denied { ioctl } for pid=13316 comm="syz.2.2261" path="socket:[28036]" dev="sockfs" ino=28036 ioctlcmd=0x8917 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 1653.920785][T13333] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=769 sclass=netlink_route_socket pid=13333 comm=syz.1.2262 [ 1654.086594][T13338] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13338 comm=syz.2.2264 [ 1655.044452][ T5756] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 1655.204392][ T5756] usb 2-1: Using ep0 maxpacket: 32 [ 1655.214534][ T5756] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1655.221384][ T5756] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1655.221705][ T5756] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1655.222047][ T5756] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1655.230670][ T5756] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1655.231422][ T5756] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1655.231575][ T5756] usb 2-1: Product: syz [ 1655.231669][ T5756] usb 2-1: Manufacturer: syz [ 1655.231801][ T5756] usb 2-1: SerialNumber: syz [ 1655.464564][ T5756] cdc_ncm 2-1:1.0: bind() failure [ 1655.469422][ T5756] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1655.471122][ T5756] cdc_ncm 2-1:1.1: bind() failure [ 1655.477541][ T5756] usb 2-1: USB disconnect, device number 65 [ 1658.248895][T13377] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1658.251919][T13377] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1660.135200][T13395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1660.136475][T13395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1660.149535][T13395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1660.150933][T13395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1661.139892][T13404] FAULT_INJECTION: forcing a failure. [ 1661.139892][T13404] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1661.141603][T13404] CPU: 0 UID: 0 PID: 13404 Comm: syz.1.2279 Not tainted syzkaller #0 PREEMPT [ 1661.141694][T13404] Hardware name: ARM-Versatile Express [ 1661.141721][T13404] Call trace: [ 1661.141764][T13404] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1661.141880][T13404] r7:00000000 r6:00000000 r5:60000013 r4:82252458 [ 1661.141900][T13404] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1661.141953][T13404] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1661.142012][T13404] r5:85b50000 r4:8294f590 [ 1661.142029][T13404] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1661.142099][T13404] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1661.142230][T13404] r8:76f51f30 r7:00000000 r6:00000000 r5:e42cdf68 r4:00000002 [ 1661.142278][T13404] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1661.142359][T13404] [<80986ef4>] (should_fail_usercopy) from [<8059a064>] (simple_read_from_buffer+0x80/0x13c) [ 1661.142419][T13404] [<80599fe4>] (simple_read_from_buffer) from [<8061618c>] (proc_fail_nth_read+0xb8/0x108) [ 1661.142485][T13404] r10:00000001 r9:806160d4 r8:00000002 r7:e42cdf68 r6:0000000f r5:76f51f30 [ 1661.142509][T13404] r4:85b50000 r3:e42cde9f [ 1661.142529][T13404] [<806160d4>] (proc_fail_nth_read) from [<8055f014>] (vfs_read+0x98/0x324) [ 1661.142593][T13404] r8:76f51f30 r7:e42cdf68 r6:85b50000 r5:0000000f r4:83898900 [ 1661.142611][T13404] [<8055ef7c>] (vfs_read) from [<8055fd24>] (ksys_read+0x74/0xe8) [ 1661.142825][T13404] r10:00000003 r9:85b50000 r8:8020029c r7:00000000 r6:00000000 r5:83898900 [ 1661.142872][T13404] r4:83898903 [ 1661.142888][T13404] [<8055fcb0>] (ksys_read) from [<8055fda8>] (sys_read+0x10/0x14) [ 1661.142949][T13404] r7:00000003 r6:00000006 r5:76f51f30 r4:0000000f [ 1661.142967][T13404] [<8055fd98>] (sys_read) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1661.143011][T13404] Exception stack(0xe42cdfa8 to 0xe42cdff0) [ 1661.143055][T13404] dfa0: 0000000f 76f51f30 00000006 76f51f30 0000000f 00000000 [ 1661.143088][T13404] dfc0: 0000000f 76f51f30 00000006 00000003 00300000 00000000 00006364 76f520bc [ 1661.143121][T13404] dfe0: 00000158 76f51ed0 000d862c 0013083c [ 1661.930244][T13413] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1661.933440][T13413] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1661.954717][T13413] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1661.970989][T13413] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1665.001316][T13437] FAULT_INJECTION: forcing a failure. [ 1665.001316][T13437] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1665.012079][T13437] CPU: 1 UID: 0 PID: 13437 Comm: syz.1.2291 Not tainted syzkaller #0 PREEMPT [ 1665.012269][T13437] Hardware name: ARM-Versatile Express [ 1665.012299][T13437] Call trace: [ 1665.012381][T13437] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1665.012504][T13437] r7:00000000 r6:00000000 r5:600f0013 r4:82252458 [ 1665.012528][T13437] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1665.012581][T13437] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1665.012636][T13437] r5:83a74800 r4:8294f590 [ 1665.012652][T13437] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1665.012711][T13437] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1665.012772][T13437] r8:76f72f30 r7:00000000 r6:00000000 r5:ea6e1f68 r4:00000002 [ 1665.012789][T13437] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1665.012835][T13437] [<80986ef4>] (should_fail_usercopy) from [<8059a064>] (simple_read_from_buffer+0x80/0x13c) [ 1665.012899][T13437] [<80599fe4>] (simple_read_from_buffer) from [<8061618c>] (proc_fail_nth_read+0xb8/0x108) [ 1665.012965][T13437] r10:00000001 r9:806160d4 r8:00000002 r7:ea6e1f68 r6:0000000f r5:76f72f30 [ 1665.012988][T13437] r4:83a74800 r3:ea6e1e9f [ 1665.013007][T13437] [<806160d4>] (proc_fail_nth_read) from [<8055f014>] (vfs_read+0x98/0x324) [ 1665.013068][T13437] r8:76f72f30 r7:ea6e1f68 r6:83a74800 r5:0000000f r4:8485c540 [ 1665.013088][T13437] [<8055ef7c>] (vfs_read) from [<8055fd24>] (ksys_read+0x74/0xe8) [ 1665.013160][T13437] r10:00000003 r9:83a74800 r8:8020029c r7:00000000 r6:00000000 r5:8485c540 [ 1665.013182][T13437] r4:8485c543 [ 1665.013227][T13437] [<8055fcb0>] (ksys_read) from [<8055fda8>] (sys_read+0x10/0x14) [ 1665.013294][T13437] r7:00000003 r6:00000005 r5:76f72f30 r4:0000000f [ 1665.013312][T13437] [<8055fd98>] (sys_read) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1665.013359][T13437] Exception stack(0xea6e1fa8 to 0xea6e1ff0) [ 1665.013400][T13437] 1fa0: 0000000f 76f72f30 00000005 76f72f30 0000000f 00000000 [ 1665.013436][T13437] 1fc0: 0000000f 76f72f30 00000005 00000003 00300000 00000000 00006364 76f730bc [ 1665.013467][T13437] 1fe0: 00000158 76f72ed0 000d862c 0013083c [ 1668.675816][T13461] fuse: Bad value for 'fd' [ 1668.675867][ T29] audit: type=1400 audit(1668.280:513): avc: denied { mounton } for pid=13460 comm="syz.2.2297" path="/file0" dev="tmpfs" ino=445 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 1669.731575][ T29] audit: type=1400 audit(1669.330:514): avc: denied { read } for pid=13487 comm="syz.2.2308" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1672.417581][ T29] audit: type=1400 audit(1672.020:515): avc: denied { ioctl } for pid=13504 comm="syz.2.2315" path="socket:[28337]" dev="sockfs" ino=28337 ioctlcmd=0x5828 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1672.599673][T13513] FAULT_INJECTION: forcing a failure. [ 1672.599673][T13513] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1672.602252][T13513] CPU: 0 UID: 0 PID: 13513 Comm: syz.2.2316 Not tainted syzkaller #0 PREEMPT [ 1672.602489][T13513] Hardware name: ARM-Versatile Express [ 1672.602520][T13513] Call trace: [ 1672.602566][T13513] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1672.602682][T13513] r7:dfc85e20 r6:00000000 r5:60000013 r4:82252458 [ 1672.602703][T13513] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1672.602789][T13513] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1672.602844][T13513] r5:85b55400 r4:8294f590 [ 1672.602860][T13513] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1672.602915][T13513] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1672.602975][T13513] r8:20000004 r7:dfc85e20 r6:200003c0 r5:00000000 r4:dfc85f20 [ 1672.602996][T13513] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1672.603039][T13513] [<80986ef4>] (should_fail_usercopy) from [<81559348>] (copy_msghdr_from_user+0x50/0x130) [ 1672.603095][T13513] [<815592f8>] (copy_msghdr_from_user) from [<815594a0>] (___sys_sendmsg+0x78/0xd0) [ 1672.603158][T13513] r8:20000004 r7:00000000 r6:85058a00 r5:dfc85f20 r4:dfc85e64 [ 1672.603178][T13513] [<81559428>] (___sys_sendmsg) from [<8155995c>] (__sys_sendmsg+0x8c/0xe0) [ 1672.603254][T13513] r10:00000128 r9:85b55400 r8:8567d000 r7:20000004 r6:200003c0 r5:8567d001 [ 1672.603276][T13513] r4:00000003 [ 1672.603293][T13513] [<815598d0>] (__sys_sendmsg) from [<815599c4>] (sys_sendmsg+0x14/0x18) [ 1672.603354][T13513] r8:8020029c r7:00000128 r6:00130918 r5:00000000 r4:00000000 [ 1672.603373][T13513] [<815599b0>] (sys_sendmsg) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1672.603417][T13513] Exception stack(0xdfc85fa8 to 0xdfc85ff0) [ 1672.603460][T13513] 5fa0: 00000000 00000000 00000003 200003c0 20000004 00000000 [ 1672.603494][T13513] 5fc0: 00000000 00000000 00130918 00000128 00300000 00000000 00006364 76f260bc [ 1672.603520][T13513] 5fe0: 76f25ec0 76f25eb0 0001928c 00132970 [ 1673.038805][T13523] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13523 comm=syz.2.2321 [ 1673.632614][ T29] audit: type=1400 audit(1673.230:516): avc: denied { create } for pid=13530 comm="syz.2.2324" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1674.430414][T13546] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=13546 comm=syz.1.2330 [ 1677.194822][ T3789] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 1677.345353][ T3789] usb 2-1: Using ep0 maxpacket: 32 [ 1677.355171][ T3789] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1677.364717][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1677.365279][ T3789] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1677.365352][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1677.381705][ T3789] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1677.381946][ T3789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1677.382173][ T3789] usb 2-1: Product: syz [ 1677.382219][ T3789] usb 2-1: Manufacturer: syz [ 1677.382233][ T3789] usb 2-1: SerialNumber: syz [ 1677.612787][T13563] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1677.617443][T13563] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1677.655420][ T3789] cdc_ncm 2-1:1.0: bind() failure [ 1677.661725][ T3789] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1677.662161][ T3789] cdc_ncm 2-1:1.1: bind() failure [ 1677.687522][ T3789] usb 2-1: USB disconnect, device number 66 [ 1678.174887][ T3789] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 1678.324653][ T3789] usb 2-1: Using ep0 maxpacket: 32 [ 1678.346812][ T3789] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1678.361492][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1678.364786][ T3789] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1678.365055][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1678.377253][ T3789] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1678.378035][ T3789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1678.379747][ T3789] usb 2-1: Product: } [ 1678.381091][ T3789] usb 2-1: Manufacturer: 쭻ඇ凿ꅺ備䖝넀쩼踥洤끡䤋扇갬繅뤃⛣⒳艼댾ᰴ䷴텕㛋宸ﴁ䕩폓骼䇰Ꮹ툪婚橸๟쏿降 굉倳埞徯쇗覞Ⱛ㧑⫯ [ 1678.382494][ T3789] usb 2-1: SerialNumber: Ф [ 1678.809731][ T3789] cdc_ncm 2-1:1.0: bind() failure [ 1678.816822][ T3789] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1678.818842][ T3789] cdc_ncm 2-1:1.1: bind() failure [ 1678.822100][ T3789] usb 2-1: USB disconnect, device number 67 [ 1678.947731][T13610] FAULT_INJECTION: forcing a failure. [ 1678.947731][T13610] name failslab, interval 1, probability 0, space 0, times 0 [ 1678.950599][T13610] CPU: 1 UID: 0 PID: 13610 Comm: syz.1.2342 Not tainted syzkaller #0 PREEMPT [ 1678.950787][T13610] Hardware name: ARM-Versatile Express [ 1678.950818][T13610] Call trace: [ 1678.950865][T13610] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1678.950987][T13610] r7:00000000 r6:00000000 r5:60000013 r4:82252458 [ 1678.951006][T13610] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1678.951060][T13610] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1678.951117][T13610] r5:83a69800 r4:82918810 [ 1678.951135][T13610] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1678.951213][T13610] [<80986cb4>] (should_fail_ex) from [<8052efdc>] (should_failslab+0x6c/0x94) [ 1678.951294][T13610] r8:0000025c r7:00000000 r6:00000cc0 r5:841ef800 r4:83001540 [ 1678.951314][T13610] [<8052ef70>] (should_failslab) from [<8050f948>] (__kmalloc_cache_noprof+0x4c/0x44c) [ 1678.951375][T13610] [<8050f8fc>] (__kmalloc_cache_noprof) from [<8148f1e8>] (snd_pcm_oss_change_params_locked+0x98/0xc88) [ 1678.951451][T13610] r10:83a69800 r9:ea60ded4 r8:84c47c00 r7:8543a640 r6:824576c0 r5:841ef800 [ 1678.951470][T13610] r4:84dfd300 [ 1678.951487][T13610] [<8148f150>] (snd_pcm_oss_change_params_locked) from [<81490048>] (snd_pcm_oss_get_active_substream+0x94/0xc0) [ 1678.951556][T13610] r10:83a69800 r9:ea60ded4 r8:84c47eb8 r7:8543a640 r6:8543a644 r5:841ef800 [ 1678.951578][T13610] r4:841ef800 [ 1678.951594][T13610] [<8148ffb4>] (snd_pcm_oss_get_active_substream) from [<81491a1c>] (snd_pcm_oss_ioctl+0xb0c/0x1010) [ 1678.951663][T13610] r9:00000003 r8:8485c6c0 r7:8543a640 r6:200000c0 r5:00000000 r4:80045006 [ 1678.951683][T13610] [<81490f10>] (snd_pcm_oss_ioctl) from [<805788b8>] (sys_ioctl+0x130/0xba0) [ 1678.951754][T13610] r10:83a69800 r9:00000003 r8:8485c6c0 r7:200000c0 r6:8485c6c1 r5:00000000 [ 1678.951775][T13610] r4:80045006 [ 1678.951791][T13610] [<80578788>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 1678.951836][T13610] Exception stack(0xea60dfa8 to 0xea60dff0) [ 1678.951876][T13610] dfa0: 00000000 00000000 00000003 80045006 200000c0 00000000 [ 1678.951910][T13610] dfc0: 00000000 00000000 00130918 00000036 00300000 00000000 00006364 76f730bc [ 1678.951936][T13610] dfe0: 76f72ec0 76f72eb0 0001928c 00132970 [ 1678.952165][T13610] r10:00000036 r9:83a69800 r8:8020029c r7:00000036 r6:00130918 r5:00000000 [ 1678.952193][T13610] r4:00000000 [ 1681.420814][T13624] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1681.422838][T13624] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1681.440475][T13624] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1681.442045][T13624] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1681.655081][T13624] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1681.657121][T13624] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1681.885454][ T29] audit: type=1400 audit(1681.480:517): avc: denied { getopt } for pid=13636 comm="syz.2.2349" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1682.215143][ T6229] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 1682.364909][ T6229] usb 2-1: Using ep0 maxpacket: 32 [ 1682.384844][ T6229] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1682.393374][ T6229] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1682.394612][ T6229] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1682.394837][ T6229] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1682.417306][ T6229] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1682.417613][ T6229] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1682.418243][ T6229] usb 2-1: Product: syz [ 1682.418457][ T6229] usb 2-1: Manufacturer: syz [ 1682.418492][ T6229] usb 2-1: SerialNumber: syz [ 1682.651628][T13640] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1682.658013][T13640] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1682.679217][ T6229] cdc_ncm 2-1:1.0: bind() failure [ 1682.686017][ T6229] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1682.686419][ T6229] cdc_ncm 2-1:1.1: bind() failure [ 1682.695699][ T6229] usb 2-1: USB disconnect, device number 68 [ 1683.114796][ T9844] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 1683.265151][ T9844] usb 2-1: Using ep0 maxpacket: 32 [ 1683.278080][ T9844] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1683.282775][ T9844] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1683.283424][ T9844] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1683.283496][ T9844] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1683.293038][ T9844] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1683.293678][ T9844] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1683.293749][ T9844] usb 2-1: Product: syz [ 1683.293778][ T9844] usb 2-1: Manufacturer: syz [ 1683.300101][ T9844] usb 2-1: SerialNumber: syz [ 1683.728219][ T9844] cdc_ncm 2-1:1.0: bind() failure [ 1683.738458][ T9844] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1683.739001][ T9844] cdc_ncm 2-1:1.1: bind() failure [ 1683.758417][ T9844] usb 2-1: USB disconnect, device number 69 [ 1683.863644][T13675] fuse: Unknown parameter '00000000000000000000004000000000000000000050x0000000000000003000000000000000000050x000000000000000500000000000000000000' [ 1684.555788][ T9844] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 1684.714924][ T9844] usb 2-1: Using ep0 maxpacket: 32 [ 1684.726282][ T9844] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1684.734920][ T9844] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1684.735260][ T9844] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1684.735429][ T9844] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1684.754824][ T9844] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1684.755367][ T9844] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1684.755678][ T9844] usb 2-1: Product: syz [ 1684.755729][ T9844] usb 2-1: Manufacturer: syz [ 1684.755758][ T9844] usb 2-1: SerialNumber: syz [ 1684.992535][T13683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1684.999909][T13683] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1685.020266][ T9844] cdc_ncm 2-1:1.0: bind() failure [ 1685.025981][ T9844] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1685.026390][ T9844] cdc_ncm 2-1:1.1: bind() failure [ 1685.035643][ T9844] usb 2-1: USB disconnect, device number 70 [ 1685.465671][ T9844] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 1685.625808][ T9844] usb 2-1: Using ep0 maxpacket: 32 [ 1685.634527][ T9844] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1685.643471][ T9844] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1685.644477][ T9844] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1685.644562][ T9844] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1685.669853][ T9844] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1685.670271][ T9844] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1685.670556][ T9844] usb 2-1: Product: syz [ 1685.670607][ T9844] usb 2-1: Manufacturer: syz [ 1685.670640][ T9844] usb 2-1: SerialNumber: syz [ 1685.689775][T13688] FAULT_INJECTION: forcing a failure. [ 1685.689775][T13688] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1685.693684][T13688] CPU: 0 UID: 0 PID: 13688 Comm: syz.2.2358 Not tainted syzkaller #0 PREEMPT [ 1685.693863][T13688] Hardware name: ARM-Versatile Express [ 1685.693895][T13688] Call trace: [ 1685.693942][T13688] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1685.694056][T13688] r7:00006364 r6:00000000 r5:60000013 r4:82252458 [ 1685.694104][T13688] [<80201b08>] (show_stack) from [<8021f8b0>] (dump_stack_lvl+0x70/0x7c) [ 1685.694159][T13688] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1685.694220][T13688] r5:83a70c00 r4:8294f590 [ 1685.694237][T13688] [<8021f8bc>] (dump_stack) from [<80986e78>] (should_fail_ex+0x1c4/0x228) [ 1685.694296][T13688] [<80986cb4>] (should_fail_ex) from [<80986ef0>] (should_fail+0x14/0x18) [ 1685.694355][T13688] r8:00000000 r7:00006364 r6:76f260bc r5:83a71430 r4:76f25bb8 [ 1685.694372][T13688] [<80986edc>] (should_fail) from [<80986f10>] (should_fail_usercopy+0x1c/0x20) [ 1685.694549][T13688] [<80986ef4>] (should_fail_usercopy) from [<8022b414>] (setup_sigframe+0xe4/0x1c4) [ 1685.694625][T13688] [<8022b330>] (setup_sigframe) from [<8022bbc4>] (do_work_pending+0x3ec/0x4e8) [ 1685.694790][T13688] r10:b5403587 r9:76f25bb8 r8:00000000 r7:83a71430 r6:76f25b38 r5:eaf1dfb0 [ 1685.694819][T13688] r4:83a70c00 [ 1685.694885][T13688] [<8022b7d8>] (do_work_pending) from [<80200088>] (slow_work_pending+0xc/0x24) [ 1685.694984][T13688] Exception stack(0xeaf1dfb0 to 0xeaf1dff8) [ 1685.695092][T13688] dfa0: 00000003 20000200 20004011 00000000 [ 1685.695132][T13688] dfc0: 00000000 00000000 00130918 00000128 00300000 00000000 00006364 76f260bc [ 1685.695210][T13688] dfe0: 76f25ec0 76f25eb0 0001928c 0013296c 60000010 00000003 [ 1685.695245][T13688] r10:00000128 r9:83a70c00 r8:8020029c r7:00000128 r6:00130918 r5:00000000 [ 1685.695271][T13688] r4:00000000 [ 1685.931481][ C1] raw-gadget.0 gadget.1: ignoring, device is not running [ 1685.948231][ T9844] cdc_ncm 2-1:1.0: bind() failure [ 1685.975502][ T9844] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1685.975927][ T9844] cdc_ncm 2-1:1.1: bind() failure [ 1685.982701][ T9844] usb 2-1: USB disconnect, device number 71 [ 1687.522419][T13726] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=13726 comm=syz.2.2362 [ 1687.644743][T13728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1687.645941][T13728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1687.663503][T13728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1687.665778][T13728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1687.880575][T13728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1687.881694][T13728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1688.027165][ T29] audit: type=1400 audit(1687.630:518): avc: denied { wake_alarm } for pid=13735 comm="syz.2.2364" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1688.287679][ T29] audit: type=1400 audit(1687.890:519): avc: denied { ioctl } for pid=13739 comm="syz.2.2366" path="socket:[29194]" dev="sockfs" ino=29194 ioctlcmd=0x941f scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1694.574726][ T41] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 1694.725081][ T41] usb 2-1: Using ep0 maxpacket: 32 [ 1694.738441][ T41] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1694.746698][ T41] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1694.747092][ T41] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1694.747348][ T41] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1694.766253][ T41] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1694.766524][ T41] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1694.766881][ T41] usb 2-1: Product: syz [ 1694.766926][ T41] usb 2-1: Manufacturer: syz [ 1694.766962][ T41] usb 2-1: SerialNumber: syz [ 1694.990199][T13744] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1694.991308][T13744] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1695.003545][ T41] cdc_ncm 2-1:1.0: bind() failure [ 1695.010157][ T41] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1695.010658][ T41] cdc_ncm 2-1:1.1: bind() failure [ 1695.019331][ T41] usb 2-1: USB disconnect, device number 72 [ 1695.445032][ T3789] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 1695.595099][ T3789] usb 2-1: Using ep0 maxpacket: 32 [ 1695.610936][ T3789] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1695.619619][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1695.620013][ T3789] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1695.620210][ T3789] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 1695.638856][ T3789] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1695.639155][ T3789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1695.639508][ T3789] usb 2-1: Product: syz [ 1695.640968][ T3789] usb 2-1: Manufacturer: syz [ 1695.641023][ T3789] usb 2-1: SerialNumber: syz [ 1695.872118][ T3789] cdc_ncm 2-1:1.0: bind() failure [ 1695.876401][ T3789] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1695.876748][ T3789] cdc_ncm 2-1:1.1: bind() failure [ 1695.882851][ T3789] usb 2-1: USB disconnect, device number 73 [ 1702.517908][T13787] netlink: 596 bytes leftover after parsing attributes in process `syz.2.2374'. [ 1710.301135][ T29] audit: type=1400 audit(1709.880:520): avc: denied { name_bind } for pid=13844 comm="syz.2.2394" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 1711.033382][ T29] audit: type=1400 audit(1710.630:521): avc: denied { create } for pid=13852 comm="syz.1.2396" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 1712.409632][ T29] audit: type=1400 audit(1712.010:522): avc: denied { bind } for pid=13870 comm="syz.1.2400" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1714.627983][ T29] audit: type=1400 audit(1714.230:523): avc: denied { connect } for pid=13894 comm="syz.2.2407" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1715.168539][T13898] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2407'. [ 1716.582172][T13914] netlink: 'syz.2.2413': attribute type 4 has an invalid length. [ 1716.878414][T13914] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2413'. [ 1717.652186][ T12] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1717.653112][ T12] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1717.655827][ T12] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1717.660523][ T12] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1718.361746][T13930] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2419'. [ 1726.266885][T13960] netlink: 'syz.2.2428': attribute type 9 has an invalid length. [ 1726.270678][T13960] netlink: 'syz.2.2428': attribute type 6 has an invalid length. [ 1727.121342][T13962] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=258 sclass=netlink_tcpdiag_socket pid=13962 comm=syz.2.2429 [ 1727.156883][T13962] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=256 sclass=netlink_route_socket pid=13962 comm=syz.2.2429 [ 1729.571583][ T29] audit: type=1400 audit(1729.170:524): avc: denied { create } for pid=13967 comm="syz.2.2430" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1738.184861][ T29] audit: type=1400 audit(1737.780:525): avc: denied { map } for pid=13994 comm="syz.2.2442" path="socket:[29902]" dev="sockfs" ino=29902 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1738.187281][ T29] audit: type=1400 audit(1737.780:526): avc: denied { accept } for pid=13994 comm="syz.2.2442" path="socket:[29902]" dev="sockfs" ino=29902 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1738.335876][ T29] audit: type=1400 audit(1737.940:527): avc: denied { bind } for pid=13994 comm="syz.2.2442" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1740.276283][T14003] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2444'. [ 1746.333568][T14036] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2453'. [ 1748.815531][T14065] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2467'. [ 1750.196646][T14081] pim6reg: entered allmulticast mode [ 1750.635556][ T29] audit: type=1400 audit(1750.240:528): avc: denied { bind } for pid=14077 comm="syz.2.2471" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1751.151853][ T29] audit: type=1400 audit(1750.750:529): avc: denied { connect } for pid=14077 comm="syz.2.2471" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1751.214736][ T29] audit: type=1400 audit(1750.810:530): avc: denied { getopt } for pid=14077 comm="syz.2.2471" lport=43564 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1763.497672][T14159] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2495'. [ 1763.877578][ T29] audit: type=1400 audit(1763.480:531): avc: denied { ioctl } for pid=14160 comm="syz.1.2496" path="time:[4026531834]" dev="nsfs" ino=4026531834 ioctlcmd=0xb706 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1766.792732][T14171] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1767.798508][T14176] syzkaller0: entered promiscuous mode [ 1767.799088][T14176] syzkaller0: entered allmulticast mode [ 1770.408933][ T29] audit: type=1400 audit(1770.010:532): avc: denied { create } for pid=14193 comm="syz.1.2506" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1771.119593][ T29] audit: type=1400 audit(1770.720:533): avc: denied { listen } for pid=14198 comm="syz.1.2507" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1771.160097][ T29] audit: type=1400 audit(1770.760:534): avc: denied { shutdown } for pid=14198 comm="syz.1.2507" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1771.169222][ T29] audit: type=1400 audit(1770.770:535): avc: denied { write } for pid=14198 comm="syz.1.2507" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1773.823613][T14222] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1773.835135][T14222] syzkaller1: linktype set to 1 [ 1774.264816][T14228] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2518'. [ 1775.364890][ T29] audit: type=1400 audit(1774.960:536): avc: denied { name_bind } for pid=14237 comm="syz.1.2521" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 1778.610572][T14254] syzkaller0: entered promiscuous mode [ 1778.611085][T14254] syzkaller0: entered allmulticast mode [ 1782.179324][ T29] audit: type=1400 audit(1781.780:537): avc: denied { block_suspend } for pid=14285 comm="syz.1.2536" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1786.260715][ T29] audit: type=1400 audit(1785.860:538): avc: denied { bind } for pid=14297 comm="syz.2.2539" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1787.949782][ T29] audit: type=1400 audit(1787.550:539): avc: denied { create } for pid=14304 comm="syz.1.2542" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ipx_socket permissive=1 [ 1789.750349][T14316] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2544'. [ 1789.814648][ T29] audit: type=1400 audit(1789.400:540): avc: denied { map } for pid=14315 comm="syz.2.2544" path="socket:[30938]" dev="sockfs" ino=30938 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 1790.775681][T14332] netlink: 1028 bytes leftover after parsing attributes in process `syz.1.2550'. [ 1790.797040][T14332] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 1790.948723][T14335] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14335 comm=syz.2.2548 [ 1790.989133][T14335] ip6tnl1: entered allmulticast mode [ 1791.187684][ T29] audit: type=1400 audit(1790.790:541): avc: denied { relabelfrom } for pid=14334 comm="syz.1.2551" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 1791.191126][ T29] audit: type=1400 audit(1790.790:542): avc: denied { relabelto } for pid=14334 comm="syz.1.2551" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 1794.740112][T14387] *** NOT YET: opcode db *** [ 1795.687459][T14399] syzkaller0: entered promiscuous mode [ 1795.687926][T14399] syzkaller0: entered allmulticast mode [ 1801.556347][ T29] audit: type=1400 audit(1801.160:543): avc: denied { write } for pid=14434 comm="syz.2.2578" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1809.001885][T14496] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.2598'. [ 1810.276858][T14508] bond0: (slave bond_slave_0): Releasing backup interface [ 1810.327500][T14508] bond0: (slave bond_slave_1): Releasing backup interface [ 1810.420294][T14508] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1812.607373][T14554] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1812.800641][T14554] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1818.094738][ T29] audit: type=1400 audit(1817.680:544): avc: denied { bind } for pid=14564 comm="syz.1.2609" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1818.135986][ T29] audit: type=1400 audit(1817.690:545): avc: denied { name_bind } for pid=14564 comm="syz.1.2609" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 1818.146210][ T29] audit: type=1400 audit(1817.730:546): avc: denied { node_bind } for pid=14564 comm="syz.1.2609" saddr=224.0.0.1 src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 1819.973713][T14571] netlink: 180 bytes leftover after parsing attributes in process `syz.1.2611'. [ 1820.187923][T14571] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 64993 [ 1822.592539][T14582] netlink: 'syz.1.2614': attribute type 12 has an invalid length. [ 1822.985358][ T29] audit: type=1400 audit(1822.580:547): avc: denied { setopt } for pid=14586 comm="syz.2.2616" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1823.152343][T14588] netlink: 'syz.1.2614': attribute type 4 has an invalid length. [ 1823.381318][ T29] audit: type=1400 audit(1822.980:548): avc: denied { bind } for pid=14586 comm="syz.2.2616" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1824.901378][T14594] netlink: 'syz.1.2619': attribute type 1 has an invalid length. [ 1825.148749][T14594] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1825.301311][T14594] bond1: (slave geneve2): making interface the new active one [ 1825.372374][T14594] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 1831.733404][ T29] audit: type=1400 audit(1831.320:549): avc: denied { map } for pid=14667 comm="syz.2.2631" path="socket:[30601]" dev="sockfs" ino=30601 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1831.743238][ T29] audit: type=1400 audit(1831.330:550): avc: denied { read } for pid=14667 comm="syz.2.2631" path="socket:[30601]" dev="sockfs" ino=30601 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1844.106550][T14776] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2657'. [ 1844.850797][T14792] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2660'. [ 1846.401355][T14807] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2666'. [ 1850.531633][T14844] netlink: 256 bytes leftover after parsing attributes in process `syz.2.2678'. [ 1851.085575][T14847] netlink: 'syz.2.2680': attribute type 5 has an invalid length. [ 1852.543146][T14861] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1853.246671][T14904] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 1853.247194][T14904] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 1856.370863][ T29] audit: type=1400 audit(1855.960:551): avc: denied { getopt } for pid=14917 comm="syz.2.2691" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1856.848442][T14922] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2693'. [ 1857.221291][T14922] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1857.270727][T14922] erspan0: entered allmulticast mode [ 1857.289456][T14922] bond3: (slave erspan0): Enslaving as an active interface with an up link [ 1858.447850][T14970] netlink: 108 bytes leftover after parsing attributes in process `syz.1.2696'. [ 1871.127895][T15057] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2725'. [ 1871.645835][T15059] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=258 sclass=netlink_tcpdiag_socket pid=15059 comm=syz.1.2728 [ 1873.512664][T15075] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1879.126959][T15115] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2745'. [ 1888.728520][T15141] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2756'. [ 1889.342560][ T29] audit: type=1400 audit(1888.930:552): avc: denied { recv } for pid=3094 comm="syz-executor" saddr=127.0.0.1 src=43946 daddr=127.0.0.1 dest=30000 netif=lo scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 1889.406441][ T29] audit: type=1400 audit(1888.990:553): avc: denied { recv } for pid=22 comm="ksoftirqd/1" saddr=127.0.0.1 src=30000 daddr=127.0.0.1 dest=43946 netif=lo scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 1904.387546][T15212] syzkaller0: entered promiscuous mode [ 1904.388078][T15212] syzkaller0: entered allmulticast mode [ 1907.141698][T15229] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2784'. [ 1917.151505][T15278] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2802'. [ 1917.158726][T15278] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2802'. [ 1918.427737][T15287] netlink: 92 bytes leftover after parsing attributes in process `syz.2.2806'. [ 1918.428838][T15287] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2806'. [ 1924.249006][T15316] netlink: 'syz.2.2815': attribute type 1 has an invalid length. [ 1924.251768][T15316] netlink: 'syz.2.2815': attribute type 3 has an invalid length. [ 1928.750192][T15325] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2819'. [ 1928.750485][T15325] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2819'. [ 1935.142597][T15361] syzkaller0: entered promiscuous mode [ 1935.152599][T15361] syzkaller0: entered allmulticast mode [ 1941.505163][T15386] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2839'. [ 1941.509371][T15386] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2839'. [ 1950.421586][T15419] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-6) [ 1950.441374][T15419] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2853'. [ 1950.800248][T15430] smc: net device bond0 applied user defined pnetid S [ 1950.808416][T15430] smc: net device bond0 erased user defined pnetid S [ 1954.100867][T15440] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2859'. [ 1954.101351][T15440] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2859'. [ 1954.139200][T15440] syz_tun: entered promiscuous mode [ 1954.141552][T15440] erspan0: entered promiscuous mode Connection to localhost closed by remote host. [ 1958.348691][T15453] syz_tun (unregistering): left promiscuous mode [ 1960.115231][T10325] erspan0 (unregistering): left promiscuous mode [ 1960.288464][T10325] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1960.319366][T10325] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1960.348920][T10325] bond0 (unregistering): Released all slaves [ 1960.390650][T10325] bond1 (unregistering): Released all slaves [ 1960.762729][T10325] hsr_slave_0: left promiscuous mode [ 1960.786779][T10325] hsr_slave_1: left promiscuous mode [ 1963.174416][T10325] ------------[ cut here ]------------ [ 1963.175098][T10325] WARNING: CPU: 1 PID: 10325 at net/xfrm/xfrm_state.c:3306 xfrm_state_fini+0xd4/0x15c [ 1963.177260][T10325] Modules linked in: [ 1963.178109][T10325] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1963.178556][T10325] CPU: 1 UID: 0 PID: 10325 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT [ 1963.178893][T10325] Hardware name: ARM-Versatile Express [ 1963.179286][T10325] Workqueue: netns cleanup_net [ 1963.179628][T10325] Call trace: [ 1963.179809][T10325] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 1963.182842][T10325] r7:822406f4 r6:85b56c00 r5:00000000 r4:82252458 [ 1963.183207][T10325] [<80201b08>] (show_stack) from [<8021f894>] (dump_stack_lvl+0x54/0x7c) [ 1963.186565][T10325] [<8021f840>] (dump_stack_lvl) from [<8021f8d4>] (dump_stack+0x18/0x1c) [ 1963.187032][T10325] r5:00000000 r4:82a78d18 [ 1963.187249][T10325] [<8021f8bc>] (dump_stack) from [<802025f8>] (vpanic+0xe0/0x2e8) [ 1963.187644][T10325] [<80202518>] (vpanic) from [<80202834>] (trace_suspend_resume+0x0/0xd8) [ 1963.188291][T10325] r7:818208c0 [ 1963.188495][T10325] [<80202800>] (panic) from [<80252948>] (get_taint+0x0/0x1c) [ 1963.188905][T10325] r3:8280c684 r2:00000001 r1:82238c58 r0:822406f4 [ 1963.189226][T10325] [<802528d0>] (check_panic_on_warn) from [<80252aac>] (__warn+0x80/0x188) [ 1963.189647][T10325] [<80252a2c>] (__warn) from [<80252d2c>] (warn_slowpath_fmt+0x178/0x1f4) [ 1963.190051][T10325] r8:00000009 r7:8242ee3c r6:ec361dd4 r5:85b56c00 r4:00000000 [ 1963.190367][T10325] [<80252bb8>] (warn_slowpath_fmt) from [<818208c0>] (xfrm_state_fini+0xd4/0x15c) [ 1963.190797][T10325] r10:00000001 r9:00000001 r8:829de39c r7:829f04d0 r6:829de39c r5:85938000 [ 1963.191151][T10325] r4:85938000 [ 1963.191325][T10325] [<818207ec>] (xfrm_state_fini) from [<81812d34>] (xfrm_net_exit+0x2c/0x40) [ 1963.191690][T10325] r5:85938000 r4:85938000 [ 1963.191909][T10325] [<81812d08>] (xfrm_net_exit) from [<81577458>] (ops_undo_list+0xe8/0x238) [ 1963.197301][T10325] r5:85938000 r4:ec361e98 [ 1963.198499][T10325] [<81577370>] (ops_undo_list) from [<815795f0>] (cleanup_net+0x220/0x3a0) [ 1963.200738][T10325] r10:00000000 r9:ffffffd4 r8:85938f00 r7:829de380 r6:829de358 r5:82c2c240 [ 1963.202949][T10325] r4:85938020 [ 1963.204017][T10325] [<815793d0>] (cleanup_net) from [<802785a0>] (process_one_work+0x1b4/0x4f4) [ 1963.205932][T10325] r10:8300f470 r9:8301c815 r8:85b56c00 r7:8300e600 r6:8301c800 r5:829de370 [ 1963.207266][T10325] r4:848d2c00 [ 1963.208277][T10325] [<802783ec>] (process_one_work) from [<802791e8>] (worker_thread+0x1fc/0x3d8) [ 1963.208837][T10325] r10:61c88647 r9:85b56c00 r8:848d2c2c r7:82804d40 r6:8300e600 r5:8300e620 [ 1963.210649][T10325] r4:848d2c00 [ 1963.211492][T10325] [<80278fec>] (worker_thread) from [<8028020c>] (kthread+0x12c/0x280) [ 1963.213407][T10325] r10:00000000 r9:848d2c00 r8:80278fec r7:df849e60 r6:88d08100 r5:85b56c00 [ 1963.219904][T10325] r4:00000001 [ 1963.220262][T10325] [<802800e0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20) [ 1963.220678][T10325] Exception stack(0xec361fb0 to 0xec361ff8) [ 1963.220962][T10325] 1fa0: 00000000 00000000 00000000 00000000 [ 1963.221336][T10325] 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 1963.221724][T10325] 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 1963.222071][T10325] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:802800e0 [ 1963.222436][T10325] r4:85a4c200 [ 1963.231943][T10325] Rebooting in 86400 seconds.. VM DIAGNOSIS: 20:58:59 Registers: info registers vcpu 0 CPU#0 R00=00000000 R01=00000000 R02=00000000 R03=8485c3c0 R04=dfbe9ee0 R05=8589bc00 R06=8505b180 R07=8183f64c R08=dfbe9d18 R09=8589bc00 R10=dfbe9d4c R11=dfbe9c5c R12=dfbe9c38 R13=dfbe9c78 R14=81a6d3b0 R15=8025c434 PSR=20000113 --C- A S svc32 s00=f4000000 s01=ffffffff d00=fffffffff4000000 s02=04000000 s03=fff16fb1 d01=fff16fb104000000 s04=fc000000 s05=ffffffff d02=fffffffffc000000 s06=fc000000 s07=ffffffff d03=fffffffffc000000 s08=ff180887 s09=ffaa78f4 d04=ffaa78f4ff180887 s10=ffffffff s11=ffffffff d05=ffffffffffffffff s12=01edff2e s13=ff27aca4 d06=ff27aca401edff2e s14=00000000 s15=ffffffff d07=ffffffff00000000 s16=00000000 s17=09ee42a7 d08=09ee42a700000000 s18=06000000 s19=fffe73bb d09=fffe73bb06000000 s20=fe2312d8 s21=ff27aca9 d10=ff27aca9fe2312d8 s22=ffffffff s23=ffffffff d11=ffffffffffffffff s24=f5180887 s25=ffffffff d12=fffffffff5180887 s26=04000000 s27=fff16fb1 d13=fff16fb104000000 s28=02000000 s29=00000000 d14=0000000002000000 s30=02000000 s31=00000000 d15=0000000002000000 s32=fea102a5 s33=00f2c093 d16=00f2c093fea102a5 s34=ffffffff s35=00000000 d17=00000000ffffffff s36=004abd2e s37=ff6d7884 d18=ff6d7884004abd2e s38=00000000 s39=ffffffff d19=ffffffff00000000 s40=01000000 s41=00000000 d20=0000000001000000 s42=fdad9889 s43=ffffffff d21=fffffffffdad9889 s44=fffffffd s45=ffffffff d22=fffffffffffffffd s46=ff39dd83 s47=ffffffff d23=ffffffffff39dd83 s48=001d8bf1 s49=09ee42a7 d24=09ee42a7001d8bf1 s50=f14b70b9 s51=ffffffff d25=fffffffff14b70b9 s52=00ea097b s53=feb228e4 d26=feb228e400ea097b s54=0152f33d s55=0054efd6 d27=0054efd60152f33d s56=ffb90b05 s57=fe1af76c d28=fe1af76cffb90b05 s58=ff0d7bb6 s59=0152f33d d29=0152f33dff0d7bb6 s60=0bebbed0 s61=fff16fb1 d30=fff16fb10bebbed0 s62=e5cc97ce s63=00133be8 d31=00133be8e5cc97ce FPSCR: 00000000 info registers vcpu 1 CPU#1 R00=840f3440 R01=00000063 R02=eb063000 R03=eb063018 R04=82abc157 R05=840f3440 R06=80a8efac R07=82abc159 R08=82827128 R09=00000000 R10=000017f6 R11=ec361aa0 R12=00000002 R13=ec361a94 R14=82959484 R15=80a8efbc PSR=80000193 N--- A S svc32 s00=00000000 s01=00000000 d00=0000000000000000 s02=00000000 s03=00000000 d01=0000000000000000 s04=00000000 s05=00000000 d02=0000000000000000 s06=00000000 s07=00000000 d03=0000000000000000 s08=00000000 s09=00000000 d04=0000000000000000 s10=00000000 s11=00000000 d05=0000000000000000 s12=00000000 s13=00000000 d06=0000000000000000 s14=00000000 s15=00000000 d07=0000000000000000 s16=00000000 s17=00000000 d08=0000000000000000 s18=00000000 s19=00000000 d09=0000000000000000 s20=00000000 s21=00000000 d10=0000000000000000 s22=00000000 s23=00000000 d11=0000000000000000 s24=00000000 s25=00000000 d12=0000000000000000 s26=00000000 s27=00000000 d13=0000000000000000 s28=00000000 s29=00000000 d14=0000000000000000 s30=00000000 s31=00000000 d15=0000000000000000 s32=00000000 s33=00000000 d16=0000000000000000 s34=00000000 s35=00000000 d17=0000000000000000 s36=00000000 s37=00000000 d18=0000000000000000 s38=00000000 s39=00000000 d19=0000000000000000 s40=00000000 s41=00000000 d20=0000000000000000 s42=00000000 s43=00000000 d21=0000000000000000 s44=00000000 s45=00000000 d22=0000000000000000 s46=00000000 s47=00000000 d23=0000000000000000 s48=00000000 s49=00000000 d24=0000000000000000 s50=00000000 s51=00000000 d25=0000000000000000 s52=00000000 s53=00000000 d26=0000000000000000 s54=00000000 s55=00000000 d27=0000000000000000 s56=00000000 s57=00000000 d28=0000000000000000 s58=00000000 s59=00000000 d29=0000000000000000 s60=00000000 s61=00000000 d30=0000000000000000 s62=00000000 s63=00000000 d31=0000000000000000 FPSCR: 00000000