last executing test programs: 22.097786531s ago: executing program 2 (id=352): setresgid(0xffffffffffffffff, 0xee00, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), r0) sendmsg$NL802154_CMD_GET_WPAN_PHY(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010736bd7000ffdbdf2501000000080003"], 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x4000000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000ed170000001800000009000000100000000000001008000000050000000000000201006b0fff834ce7e5d2000000"], &(0x7f0000000080)=""/171, 0x39, 0xab, 0x0, 0x8}, 0x28) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000000000000000400000000000000", @ANYRES32=0x1, @ANYBLOB="2700000000002a000000002f9fd7180000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="03000000010000000300"/28], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000001700)={0x6, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b7030000fcffffff850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd21, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000800000002"], 0x48) (async) r4 = syz_io_uring_setup(0x41ac, &(0x7f0000000140)={0x0, 0x5961, 0x10000, 0x1, 0x783}, &(0x7f00000001c0)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) (async, rerun: 64) r8 = socket$inet_udp(0x2, 0x2, 0x0) (rerun: 64) setsockopt$sock_int(r8, 0x1, 0x6, 0x0, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r8, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x4000000, @mcast1}}}, 0x32) socket$packet(0x11, 0x3, 0x300) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), r9) (async) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r10 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r10, &(0x7f0000000140)={0xa, 0x4e20, 0x6, @local, 0xb}, 0x1c) (async, rerun: 64) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x8, 0x28, r10, 0x0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x835e, 0x80, 0x0, {0x1}}) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) (async) r11 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x101000, 0x41) read$FUSE(r11, &(0x7f0000008ec0)={0x2020}, 0x2020) (async) read$qrtrtun(r11, &(0x7f0000000240)=""/80, 0x50) (async) io_uring_enter(r4, 0x2000, 0xfffffffa, 0x9, 0x0, 0x0) (async) r12 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 64) setsockopt$inet6_int(r13, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4) (async) sendmmsg$inet(r12, &(0x7f0000002e40)=[{{&(0x7f0000000100)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x30}}, 0x10, 0x0}}, {{&(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f00000005c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @multicast2, @private=0xa010100}}}], 0x20}}], 0x2, 0x4000800) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r3}, &(0x7f0000000080), &(0x7f00000000c0)=r2}, 0x20) (async) socket$nl_route(0x10, 0x3, 0x0) 21.995588426s ago: executing program 2 (id=353): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c"], 0x0, 0x8e}, 0x28) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, r0, 0x1, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="bfa200000000000007020000fcffffff620200000000000018110000", @ANYRES32=r1, @ANYBLOB="000000000000000085000000010000001500070000000000bf06000000000000bf6100000000000007010000060000008590ff005d000000bf610000000000000701000004000000850000005e000000b70000000000000095"], &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 21.995428731s ago: executing program 2 (id=354): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="3c010000100001040000000000000000000000000000000000000000000000010080ffffff000000000000000000000112341234000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000001000004d23300000000000000000000000000000000000001ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000e7c400000000000000000400000000000000000000000000000000080000000000000000000000000000000a00000000000000000000004c001400686d616328736861312b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e7ff"], 0x13c}}, 0x0) 21.930747822s ago: executing program 2 (id=355): r0 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 21.930572411s ago: executing program 2 (id=356): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mysys\x00', 0x1) mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:02.0/resource0\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r1, &(0x7f00000007c0)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x404}, 0xe) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) mlock(&(0x7f0000520000/0x1000)=nil, 0x1000) listen(r1, 0xfff) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0xb, 0x6, 0x100}, 0x3c, [0x8000, 0x6, 0xf, 0x8, 0x80, 0x2, 0x3, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x56, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x8, 0x7, 0x81, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x8000004, 0x7, 0x3, 0x8, 0x80004c74, 0x80000000, 0x0, 0x3, 0x40000e, 0x8, 0x8000806e, 0x7, 0x17, 0x1, 0x9, 0x200, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10080007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x80007, 0x6c9, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x9, 0x4, 0x4, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x2, 0xff, 0x6, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x1, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x43, 0x103], [0x6, 0x1000a, 0x4, 0x5, 0xfffffffe, 0x103, 0x4, 0x9, 0x5, 0x2, 0xffffffff, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x10006, 0x8, 0xffffffff, 0x86, 0x3, 0x303c, 0x3e7, 0x4, 0x5, 0x2, 0x9, 0x3, 0x2000000c, 0x2, 0x6d02, 0x6, 0x38, 0x800003, 0x1fd, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x3, 0x2, 0xc2, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120001, 0x3, 0x2006, 0x80a2eb, 0x4, 0x25], [0x9, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xb9, 0xce7, 0x1fd, 0x2, 0x57, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x10000, 0x0, 0x2, 0x5, 0x1, 0x0, 0x14c, 0x60a7, 0x6, 0x96, 0xfffffffb, 0x80000000, 0x0, 0x4, 0xc8, 0x1, 0xfffff000, 0x10080, 0x3, 0x8, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x2, 0x226, 0x5, 0x5, 0x4, 0x30b1d68f, 0xa1f, 0xcb, 0xba, 0x1, 0x6c1b, 0x0, 0x1, 0x5, 0xb1e, 0xd7, 0x200, 0xe, 0xa77e]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) fsetxattr$security_ima(r1, &(0x7f0000000140), &(0x7f0000000880)=@v2={0x3, 0x0, 0x13, 0x9, 0xbe, "efb1f49ba1ccbca2c3b39b22e56ac4283c47dda042204e580b1639cf4feb534a6f7eafeb17fb1f5c628510525a1a22798b504d2d11fed0fb14f3debc8fbd95e41bb0e23b5a09ea0742d337aa2e05965731e55e73391d2191269e69eaec1f3e0c1388ff3f96cd974e3e6248fc23d30672a600fae6cfdbeeb67ae94899cff072b85a6d89586071ea75f13576075db4d7f66b054b9fb98f938e59121cb1d55bc96ca362daf29bf4a607a79bfe9348b1a5f6f40060e10868af80233e18f98335"}, 0xc7, 0x1) mmap(0x0, 0x1012, 0x3, 0x11, r0, 0xf000) 21.749724346s ago: executing program 2 (id=358): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) syz_open_dev$vcsa(0x0, 0x3ff, 0x400800) 6.667900496s ago: executing program 32 (id=358): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) syz_open_dev$vcsa(0x0, 0x3ff, 0x400800) 2.205868027s ago: executing program 4 (id=588): r0 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000140), 0x8) r1 = socket$inet6(0xa, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000001000000000000000100000f0500010002000000f8ff00000a000000000000000005000d0000000000300000cf0000002e00"], &(0x7f00000001c0)=""/257, 0x46, 0x101, 0x6, 0x0, 0x10000, @value=r0}, 0x28) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x9, 0x0, 0x800008a, 0x0, 0x4, 0x2000000, 0x0, 0x0, 0x3}}) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="9fcb010018000000000000000000000000000000080000000000002ca327ef00"], 0x0, 0x20, 0x0, 0x0, 0x0, 0x10000, @value=r0}, 0x28) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000380)={0x0, 0x0, 0x0, 'queue1\x00', 0x4000007}) write$sndseq(0xffffffffffffffff, &(0x7f0000000000)=[{0x22, 0x0, 0x0, 0x0, @tick, {0x8}, {}, @raw32={[0x0, 0x1, 0xfdffffff]}}], 0x1c) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e21, @empty=0x7f000000}}) getsockopt$inet_sctp_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, &(0x7f0000000100)={0xa, [0x8, 0x7fff, 0xf, 0x9, 0x8001, 0x1, 0xec9, 0x2, 0x40, 0x8000]}, &(0x7f0000000580)=0x18) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r3, 0x80489439, &(0x7f0000000480)) r5 = syz_io_uring_setup(0x315b, &(0x7f0000000140)={0x0, 0xc7ca, 0x42, 0xfffffffc, 0x7a}, &(0x7f00000002c0), &(0x7f0000000000), &(0x7f0000000000)) r6 = syz_open_dev$mtd(&(0x7f0000000040), 0x4, 0x121000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014000000110001"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r9 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r8, &(0x7f0000001840)=ANY=[@ANYBLOB="0800080006000600080014000000450a0fc0006600000b06907864010101ffffffff3297e3ba0fa8a2e71bd9fe1a399b5110420b70460c0dad392d66248a43540df968e7fcaab34569c0e36170578c0d3c546a98b26295e2592f360905866eb4720fed03a977a3df4224895629fd6ccec64f13a999f18f518e3ee28798381975e862f1db9dccdb2f1c1fb60f5ffc7a339d40a8bd1f24cede8a32f186f142e194d4fb48224759faf813ea80e6a853e79b4fe27fe3e1aec5897b314a7f0d515b07b1835986b4885e9826d902c40f16cd77c58b6433ab039955ce9db11f36f459e7114ace6c9989eecea80a81fd39f339356c7c3391af83da2486503a7973f6db4806cf3e5ca94cf7e1f79fd00decd76100c18251a59d1474caabf4d3ca6a9a9885df710e68c5b0dc11832dbb5eecb5c88c2f8f02bdbd88569ad4a740359cbca8c378118220d73bdd1e661c3a74f77aa931b11cd38119b0f084bb96e84803fca6566c33ee1e4e34ab0253fbf24f9f5974af5e1fc2a43a4ec9dd9928a8f38a128ea27c429300ae5a6bd7740471f973d8224b2b07879f4fbe7dcbed776a72ebdc713bcf1d7aa45b01c32a1003e6670d58510bd79ba2fde5cb2b82cef2cc315648f4e9d96d848ba327949b8926253cbdef6888a8982108b6ac7a1108533dd3fe125002e2e286362d1055082a9d73ec5ac3080f2a501ff27250b62c8965f371cf92b32d6422d79f66261eb08a2f8fe50049e102c69ce703d116d0834208cc957d0f1376457a90245816d7642412897fdd2f982fdfbc3af65aa0446b00c767b79aec40e460887ea02188e3a0960eea39b144859467b881978378c9fd593259e0f63148179fe2c2f6d40987b63a6e384e63027f03d8039d707522942d5dc88fd842524d006290b6a65e9cc86cc5b401a60ec4aedfb3bf4d0447bb681810a16b9684b72c2f4593ef834a0203e78cd1d9dbc978e9ae8f3ab62c07f1e41d59470decee7b0cc41ac49e4b7589ab6da65849f62ec217bb39ed161e7d337822d96badbd74d66451ea9a74bed591dc9631bf639dcf7846ee428a9fa55bfceedf3b1c23642f3b58dd0a7273664c6c49c9160a4b9cc5b72d0210e305b94e2cb09ae1d4af9d365b5093851f229c8c30aef75d45ccdbab4b86d801a9ad3b27f26ba601d531c0743717aa7aae29d37f496fec7682c5a1abd321ad61941a2d23fcac6af1d1875e308c8d8c64a5152be47b59c09d293f46b857310a99f1885f0a49d432aa0d39a3e8fc885e75e66b61215133175a19267c8d0adf7d8f644e742ed5369d1405e99e63b78727f135e0243f24d9ce354a1562102ee8de4c191508343b86bf7e7519ddd770ce55e17e590561b2f437194c97ad46622a6ae3dd68d9993e6744954f4cd308bd6594fdccedc578e80aed274a65219697229059723ac37d535cca0e9c314e7941b4160bbd2ffba71f26ffe3228431bc81463078ad70583277ef18bce23ca2e5b9a00670956ea8e0e2c739c006106c8c9ee3f92ba728d8490742b74a9a18cbedfc4e69bb87e0da4c7dfb964374c28c837d4641fb99a19b233675f8526af395335e0185cf3934805442ac379980b687a7128e53284ba9e741b5fe9bc969bfbd55cbce76842915e076e2adf844338d16d3802c681bafdcc60465bd34dfc2d1c069ceee40060e0570fc1275ccabfe3f9be3e84ceedf72cd649c082232008e2b0c94594588c00e0fe911bbf1c12eb6c37ce05674a7597feecf27f5e051ffa824d9ff93638dfa9a84c77562aa2cf897f55a97b79c18544ad03480e1011b8f93e0ead9c2c6672448f585c5803ae99be777fbc662ef4450c1e936ed8b3c8047f00e72adc84561f417f8e5e1dde4967005d96a64fc75d9f486b3ebdb5904a0a56ec48542f0efce939f66fd69259e7376ad37e84434ea90f35b2d3bd63b5c36b267d8f2c7dc5a50b46e00ed086dff8b039e07b84c60611269d4f282ad04dc8e0b481eece2f8a614734be73617f0ad5be195446b09dca4cf1f32653dd3e188aece76f3014deb2ba61744835c0f735234b6a4637c948a7b4fd4203b286ca87d669e325d70277075b094f59eb1dff6c9c05c40d5e464c563df79486e1a32e6ed9bcf675aac7968b4e98dc4e210215b0d3b6a2525b2e3df11f3f1490eb39cabffbe32e23659121fde8e4e346e0f595aaf3666a5f6f118c1a1128039502ac04c40b85eb4c54e6c95b8d1c2aac74ae9e1c355ccde9d54d5d833293f5df09224482179e5bcd8e227c99172a6e14c2cd4e6462ceb0a905a1d64804840ce62e350c6efac10a7fcb029f84af64e2256d45afd3b3f59379895740e0cd2fd24c63264f785bb6e3f40ec72ed67d1a7d87dd264743d9c951cb5aa8bc6f1d1bc9b23303d5aa7f8f6f961326757456057000cb2bacf78cc229002777e932c2640b8dfa793846ca49fa93996db95104a8808a1906b19df17e754b90582b6c49efb3ddce067dd9292291cfd2bb0323ce8098f29e4fce0de31cf5c7e2e2da5d0d0996a8be776de8fecfd3ce68e80d21f1701f6b90ac51278abbd727d19415e0ebe001b990b177b8db0c592b18a4b5e4a6221902362e5b20e6e6f2131a5a5e03c1150b179ef40c933c2fef1b79de738652ec4c32565f5cf751a11db177099c4e2e5bd7616cd0dd501d5bfccf5691de3cca590365328648baf8a9487a3c212193c9bb837594460967e823067a9465eba7001eaf609a810488ef5c147aaa5e9e8c75b585ac3582b6915e20b5aa2f79b7a94857122988c56dbce1ea52de1a56652e839bb853be3ee16052b33fb83ca54d8e4e19440a5e81492107043a66286f63ca87a1f7b8a4e9547a7eb6005419cfd28cb37e9e374f4d0143973286e87070754025c1a6fccfdc6858eaca8c35ecb19584ce7141cc79a5bc813469161b87a19fc21f3373d1f25b3427916dd1be2a589b70ea3b39fcc7801e13beaf19b76164faf3dc4ab8faa5648d24eddd6caceaa0d5ac9cad633c19a4a4d059ee823a49b7cf82c5777d376c111f58ea8fd473429907852301a2c856f27bd0c687ab5be0e2bbef64ddee1601375a4440e3f59d60f57caebfe457f82432523ec4a61cdbb7f1e91e4b05fda892df131c274b19929d26f7a5a6d3ca487983f729601ed9bb4bf5c1cc3d453d406e9534688dec6a2dd0b9db149365c125a95e129565e62cc91f7d960abe1055b730ae0994e7eb08392d5745d0e4f529c4defc3d3e43d0815b0cc63effa88d20c13b14e780c2f6c89a1ee5e4db45a5c272186cc3e51b13dab3add5f467e8ca0f4c45a1fc76db2f0cbf794102946aafcd8cd8a3e935a606b9721645c4d550ae0907f345593736506efc626498c974753d474a73626041d3a54f8fb50de2a6335611a3779da3a02daceb2256d9b102d4d30dd3cd389a04b1a7a6076879f36534bb3379debb46ed1fa2c40096c752017dd024345c58313b43070ff7bef94dc3cafbe6ec20d59e5ea3c196ba3b783bfa87384407efc664cd350c80ac397516018e35371956e414755cde304d2a228c1540ba6fd6a7402d11c666964f024da4c016eb556ba2c5fab86c60c12efb1496295d80f0383526e8e0fc55a287bbd3cb966a916f57958d8b6ef97aa0c4b47f7746bab6b99698c1c96b25c4e2e084147866fe0970b109dd26984adc0758eb6442712cc46dcd8ed3038b0595252eed1b8a46525862662d1e67eba66ac341f8d27853eed54854f488f079bd48df6ce7a4be8b1b61fd23a2dc4d3ade0992011539cc63f80fcfc75008c20cb639348cb218f8f476a6d56917f4ca07e67fc20ea2e9642eaf2182b397e279f5f6c70438fb8aa39cba788588c181461ea7efe1a0dd5b95eb26f7158b91012f7ce0ee1b4e79ce4da377bea4551738a0f491a84f19b3be9827b4469a9c20b8bf12f919976a0356bba720fb91010763c79bcbb10d89280f0f97cdd19aa0d54828b308195fac170613cf4b515e340a9ef2c97f618a9f50b30ae34ebeed9a38b4c6969680accc740b154ecb014fb5d543a59ccb98a7de2823a2dec39f331cb503eb74fef61262c6d4050bc723caee834eb28c64ce007f6027375e936b62387cf1778970e88b0574a0106d4c855be7425767c551b2fa644d9d8a59f787e7610581b768057d229673344571c3d6e3f10975b2859f568398b1f38f89524d9ad0c1588617c3883a1227b714c81cdf28da54f33968c1c50f28da01c308eb31d319b3e77f96bec001c9300000000000000009cc0062283ac112868592619db14d629c47bfb793a723dcd2f7b07ae4ec14ca3ef4b955ea5b2b153a279b080f6236d418075b86850974c8850efb306d5c304e726bf2643b4403e6d46b0e0395b02e93308b4b2c3e957308d497dc51c753344a7878f1f0c91295fd76e3d1cc9ef813161c6b92b7ea6068ceb97d8f45a4ce57af7d7632d699951f7fe3c71c3a32b014c74425c67e5030546b10cf7edcec2eca5ba31d0dda49383f35bc2e36b93f15f071bc2537ebe9ca19f86dce4e84272e10323d0ceaa2cc47fe4f6ad101d454c761f9863e94af91199ce5f12469bca7ba39314b84aa7efa4bdc18f7700c19511d48d6132450111d70401a8ac73565d5386ca12345e884d08b23f9c901000a95eb4167865e58c28b112f47c96beeaa6657c923e25e56529107c5c30e65bb485d5ed21b91332db4e09df7e59dcfa05c994570deb3f9b838e22ae4abbf9a9a8c319cc9112c8dba7c2278f78b9578b0254c46a4c04b8fa4fedad6bd275f70b1618971ef6503379bfb0a508c9944328af2c820091a89e3f75e68e7f980ddc9154d273f7f2ce7a6294aefe93136860786679b80e41f6636ff45efeacfb52e2ba2bd9bd9c9030079a46caca5c4b340c17d01ba8ecbc5c561b2038481a8321c009d12136a3ad5461881d998eeaac5236fdcd8f81fb5e53848bb096d9198fd0d38830d1809f2a632b31e2b67754140c907ed58aead048b2d8af9a1c407e48db815212cfdcca97222dabdfe01f311a73e1e82c3e189ec5add48d3f8190eb9e14b58e540f7f1388a7c687629eadb19fd8a133dc8177629270ecaabff79efb6c1f750d89b9e6c5f34c6238066f8e3e425e46a27b3c0d2e9e2ed3cffe2a6f39b8e0137ea5de689b94107fb4748a5feb3902f0feba64dae4c2e69bc8d86463575c6b0ef4a8a64fef41121e57a8c67eda07e9fc8f98299677de198ea0a649ef3c00591940b2c27ba1414aaa1633deb52e3a44cfa8d7a00d014317c026a7d7f42a34b97128e1bf9cda4d8315819ac73ed5061bf9b5631d07b09b85b78ff1b6eb86e9e8c4faa0f991cd6fa0b0eb71b39c20ca9bc7c156f3bd255a5b408df172396bafd7f0fb11c6eaf1eb0a06576d37bee00424bf699584b1dfed68f0d8d8a35f0427c783fe2d79b4373628971e87501a5e4bb05b5058d0b2132741f26e76065b6f4017d963c8ee5605c4c5b6eebb96fca0a41893cb6add3fb0d728abeb860f22cedbd36e464bdaf124a7041460f7af3d64b54e9ffd240b5afad9baf6e5dd8406bc1b205da5848f51fc9dd5197716e144e1b0386614bd3cfd5ddb80ada1e5ca74c8960093a553b1f6288aa7f53663cdd867f658e51b95772dc7a6fa45fa03e14988a33250e6c16fbf0351769080d64ddfbdbf77e1215563bf2e82ecc38a682846d7e2e2ac4e87d715f97f15e84c3df04affee49612a735907d3c4d310a54a6f609873ad56f29a138f4d5661f6865e030487fd506b3ce7232814c9f7fa8f325df1b90ca8e11238efcd98969ea3baafa3f71825a94a9f0c75731dff32fd9f0eeb10aad776ea49dc3339e19e3ede782613cffe99c2c8290d42c8ae23459a33b63adf9776986adb52a093d688abd5dece9c861e606da435a395713217e8775ec5a4c8e6f14637ca52c12a3cd5d9b9303f1adcb1c5baaea5e72254388cdb92b1b79c03953c8255387bd4cad77073cd247efb1d0a0e31f02addd62517fd1f5de35dac6816a9a19f846d067b2b5e440f3ddc102becdeb33e5c6b080a5b343ac11566e0eb54cb8ddefb9748121e1b119659c01070104a734fa9a2f50958b804588e"], 0xfce) ioctl$XFS_IOC_OPEN_BY_HANDLE(r6, 0xc038586b, &(0x7f00000003c0)={r2, &(0x7f0000000700)='\x10\xeej\x80o\xe7', 0x12a40, &(0x7f0000000200)={@align=0xf9, {0x9, 0x3, 0x10000, 0x4}}, 0x9, &(0x7f0000000300), &(0x7f0000000340)=0x957a}) r10 = syz_io_uring_setup(0x3571, 0x0, 0x0, &(0x7f00000005c0), &(0x7f0000000280)) io_uring_register$IORING_REGISTER_RESTRICTIONS(r10, 0xb, &(0x7f0000000100), 0x0) io_uring_register$IORING_REGISTER_ENABLE_RINGS(r5, 0xc, 0x0, 0x0) ioctl$FIGETBSZ(r2, 0x2, &(0x7f0000000440)) r11 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r11, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r11, 0x3b85, &(0x7f00000001c0)={0x28, 0x5, r12, 0x0, &(0x7f000034c000/0x4000)=nil, 0x4000, 0xbc}) ioctl$IOMMU_IOAS_MAP$PAGES(r11, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r12, 0x0, &(0x7f0000343000/0xf000)=nil, 0xf000, 0x8000004004000004}) 1.218964925s ago: executing program 3 (id=685): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="58010000100001002cbc700000000008fc000000000000000000000000000001fe8800000000000000000000000000010000ecdf000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe0000001000000003200000000000000000000000000000000000000fcfffffffffffffffeffffffffffffff030000000000000000000000000000000000dd86ffff0000fcffffffffffffff0000000000000000090000000000000001000000000000000008400000000000090000000000000092020000000000000010000000000000000000000000000007350000020004002c00000000000000600002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000000", @ANYRES16], 0x158}}, 0x44050) 1.158166354s ago: executing program 3 (id=687): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x0, 0x8e}, 0x28) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, r0, 0x1, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="bfa200000000000007020000fcffffff620200000000000018110000", @ANYRES32=r1, @ANYBLOB="000000000000000085000000010000001500070000000000bf06000000000000bf61000000000000070100000600000085000000c2000000bf610000000000000701000004000000850000005e000000b70000000000000095"], &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.050286559s ago: executing program 3 (id=688): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000001740)=ANY=[], 0x8) r1 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/self/make-it-fail\x00', 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x3a, &(0x7f0000000000)={@local, @random="0000ea0700", @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x2d, 0x28, 0x0, 0x0, 0xa3, 0x6, 0x0, @remote, @local}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x80, 0x0, 0x0, 0x4000}}}}}}, 0x0) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002780)=ANY=[@ANYBLOB="640000000206010800000000000000000100000a16000300686173683a6e65742c706f72742c6e6574000000050001000700000005000500020000000900020073797a310000000005000400000000001400078008000840000000f108000640"], 0x64}, 0x1, 0x0, 0x0, 0x2006c0c4}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_ifreq(r3, 0x89f0, &(0x7f0000000040)={'bond0\x00', @ifru_names='ip_vti0\x00'}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="540000000906010200000000000000000500000205000100070000002c0007800c00148008000140e00000020c0001800800014064010100060004404e20000005000700110000000900020073797a31"], 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x4800) write$make_it_fail(r1, 0x0, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e24, 0x0, @rand_addr=' \x01\x00', 0x5}, 0x1c) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r5) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000300)=ANY=[@ANYRES8=0x0, @ANYRESOCT, @ANYRESHEX, @ANYRESDEC, @ANYRES64, @ANYRES16, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESOCT=r0, @ANYRESDEC=r5], 0x8) recvmmsg(r0, &(0x7f0000001dc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001600)=""/26, 0x1a}, 0x1}], 0x1, 0x10003, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x40000, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @mcast2, 0x1}, 0x1c) r6 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x21) mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x309204f, 0x0) mount$bpf(0x200000000000, &(0x7f00000003c0)='./file0\x00', 0x0, 0x28a5079, 0x0) syz_clone3(&(0x7f0000000080)={0xa690b000, &(0x7f0000000040), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_CREATE_PIT2(r6, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(r6, r6, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000480)="baf80c66b82154a48d66efbafc0cb0aeee650f741065666765f3ef0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x40}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r7 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000003, 0x11, r7, 0x485c9000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001740)={&(0x7f0000000640)=ANY=[@ANYBLOB="9feb01001800000000fe004c6ddad7cedf0000800000000000000000"], 0x0, 0x1c, 0x0, 0x1}, 0x20) ioctl$KVM_SET_PIT(r6, 0x8048ae66, &(0x7f0000000240)={[{0x2, 0x1, 0x98, 0x1, 0x0, 0x5f, 0x9, 0x20, 0xa7, 0x2, 0x7, 0xb, 0x3}, {0xfffffffe, 0xfffd, 0x2, 0x8a, 0x1, 0x2, 0x82, 0x0, 0x6, 0xff, 0x0, 0x38, 0x800000000000000}, {0xffffff01, 0x35, 0x20, 0x0, 0x4, 0x1, 0x7, 0xfe, 0x6, 0x8, 0x7d, 0x1, 0x1000000000000005}], 0x7}) 877.671122ms ago: executing program 1 (id=692): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="340000001300050026bd7000ffdbdf2507000000", @ANYRES32=r1, @ANYBLOB="000000000000000014001a80100005800c000880080001"], 0x34}, 0x1, 0x0, 0x0, 0x800c000}, 0x20000000) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f00000063c0)="c91443d5daaf04b192358b692f84d66c60492a57cffd585b0068ccde45d94ded1e86d3670791c21f8e0b2153d10d45d37b72ee2fa06ad61b0a9354045a8dae1bd1cfb49f3c11fe54c17eee632d95574681e6c472eb8a1beaf3a4b88561847a0a0f05fa4a26639d7e74a0c1c2790d6a59d4073b1c55539b7c21b8550efbd5f835c56642f4be57d170e36a6bf3a995f418554f0cab342769089d0777b28daad5c0c4ba56a0bd6c0515d9bf488fdcf49a9a7bbfcf5ad78733f8119f2568daefbd0985a9916c0d048e38765cc7bb1c82e0f3c81d98e7179ec782331bc3cfb2caf58a99668420795e6a00ef41dcf5283bbb61ebaedbb7a675be4fb2d11c31f9b76936d1112c68978c73f42e145b094490d748c1456a14c23fe25e2fdaeaaa7dc0d35dcc9bbfe86361f99f4d04090d1e66aa9714ee9f4608ad66c60f500bf06a1b5b90fbe2f6c42c4b5f337393b0bb201473712c48f898c514fff84c46b50d3aaf44578f41d312bb5a73526db7818617dcb938ebdb17f92423ca2cf7ea2c611483e0baff012fd97e28558317049e4fe2d27f72796d7260b33900cd61f984c087d3c54f6aa11e389a49069ef99ca86c279598b42dd3485f09fc7e119f707438498316cf2f2bc8a293eeb1a35635989327d4f6c9ba6b2d5b9b8ee89a1e13d538b954479663223bb704af6a63ee497734410ea43bfdb0ad3708cb7155df2432c44e8468a7b77b807d345c9b94fedadfdeba12f4b6d11d16fd6dd5fff6cf896d0f40785ffca538dae61d8a5ffee814e96628cd945553e788b8d915762ca3b40124149b3c186ddd5f7af5b75f4725444f2f7e54b999c93e8c5fd4d4fbd7a3b3d7e85df3053c866f1dd247cac6912ed8b0e491101ca5a0b999a21014b573ba3996c76065c9d8bebf431f8be6435837193efd6e5a565b2ced30d04355435f166b09f9dc91ee50412d0daf72b28ec14c505cb155de1a46362f140ac2b633fa42b12109f0a29fa8ba271d6fc2a77af3b16032ee46b3ddead76a481ef52f6bd25cab4494681f0abc2ffc60ebb36cffcc058a067fcdae6c9de670cd6fde6eb8086a65fc05df17cf69f654516ba30ee04a1427b40fb8e81fe46787d557046854ad342442bacd781c7a6063892402fb0d765397448991206b28193e20f285e50d9219ace39b311e572ebcd80702164315656e7fa92960d0fd28c6489406f0b3061218417548e7e78b8aaaf5a623eb47c92aebfebd1c78343bc781f184e0122a28f56b18832da5646ee8405fa2fc040ab30377c447b42d0bfdddc65e064ccdf1ad52a94309a819caeb523e22b25d1ba288b7f2c726290d50021b9839c5d3c471aadb08025d97619935a9880942cf653508a0b2c43838e5aada8b84d22042928dd372dedec14672266ddceb0744c7464ab282d7fbfb2767e891832aa25d1425b33a60c6894a8d5292fdd73e05a868b8e50cb1a412d1249a77ccfc3d3eb35a67221f80bb8960fd93ceb74e102f2a6946b50caae3ccb86a8ec441d6e58dbf24b3eb962c8a28cffeded9b7cf4a54f524a1ef49fbdc91e125aad65a54df6a0f10cd8799f48aa144f7aec977b4a347c5c9628c4805ecf71f305adc9e5ca7c1f313f9ea3e99b3590efd94d831e1ff5cd7a26b72281109547facfa3abac2cfc9177b117a3757b778e95b5069236abb25d8fb032c38d296f87388fdd364b491cb828732177a2c6bcaaf831d138c898bb60c0d9d8a02d8b4b8e7efa87d3ed66221ac52e31ba9c2da488b999eaf82994bc8f1ac29d5e60b8b1cdc30a1c9829aca1cd7881c8aaac9ede0f5d8b85538d2b13751cfc6b37587b0223b9f6b6dd9340753106b1eecdf4f63c51cc2c63a1f86235bad7602e115d1e0ed78a6b170b88eb9584d2098b187695627612189998171d245797391b2b79bb690a79dac4b769e3f18c4d49359f7b460d997c03c793f51a830d5b21faed2ae1c3eb0fce0cdadde3c789ec931b6397c2a2fb2eda87756fec031e5f50f07619130f8e39f1e00004a1f204e5d87780542bdedf0b1ca5168779ad7cb2ebf27e0a5d760a2492b4d92eab24f2bc9af0a3e51140c415a6f885d0faa38ee6dcffc41652b28e628b859db0e7a0f961e37c5806df137e68c5316667f36051eb05c971e208721fdb8a49b8c49f85114be9dd7288f4e95c5f6fb8c1bc1bc7d79f32ba5419d90130a0328ba70d10c770a1540718f7d890dba9c39a116623d492275a1268c91149bfe026ca1c6a458449d4004d653f4b0a234eacd1f4da495fd1f936b4b335f64514fc8091b1dab132f599e26cb127e25011efa30a922b5a3e8807db9a00a9cc732fd323708767c905c8a3cd53e2e8d377d3b43cb971cbd0e66e2e47f3d601d49e29941b2ea4d3c8b7f5698e1a633ebba00f6c178d6d04b9f1544f04cd173e2d49f129a8725a647e1a9e798b5581c6a461b585012a302353178188e55f8102a49343c9c370ee505d09e4be8580d95f5bf39267b00e93adb6b52b2029160d78ac271e4e0c70ed835484e80302b93efd599707d4d22c806476fd04d18ebd6a9bf88c11dc2c96041ac8c3e04ac0aa5d2ac6740972717b543fb871884a7a0434a433571fd621977777984ea9c06914be966da9f349cb1ef3a116c49f0c716eae1df118cd3d5b350b917c06d853c1e1514213f5a29071e42eecee264ff20529c53c3a060a18a680ade2a08b4549e6998f06e61e4f4c36d578e9ad83dd38d1eeb100e7ab023edb38426d5165b867b9507a6b644aa0322da335b208105f2e74a9841ea7c629ea20cef740f6364e9d84a4485d3bb6b5f4e14c7764f78b65c0647870638a8f618381ec0823faed0424a448f753a59fb22e5138e0ca537b6935befb99fc6eea2d9457c01345afbbaaf3a7a96a39478b222af322f86730d137c3f570b38c7363bb9a89bb4b3b8979b9afd232927becbc91c8d4a276febe47bacd4a84c0bfdd54e685080f2c3be0b1e37bc6d21b13b7b1bfd507880f6ad7fa39bf99eaf6b7088d758d9383e38326381088e9e3e792f75d682cf61cf1176953960b0e160b2a535495d52c28f14fa45ed7a3f91e219dcd05afdda2b7e6c1b742b29f6c5f62a040a5fe6606433fce7de757ed76372dfc0b1af9af10c0128bcd335eff1c6c9660b0893730c3ef8de6e50dba419b35d1766eb9a5dce4c2fa518f8e3e2a27855e04d06b89e97578a4406ac03f3314575143db5e43ae3d03a7e90a590b4c188a5acbe1cf23cd4cf60ca98248d4e740122a55ac6e463511b4c4cd47040aafc0bed7878348a4caad4d977671cf4ac319773767ee28f8ccc4c9deae531b029eff5345470f20865549b2f2c4089306304e13e42ca37fbca6839bbcd2f10bd20c81d44ab73ad5ffcc55f51b53efb00d3c68d8d8505e005247ba23e86a803b199f36447fd01f192994b2fa27c9db59ae66b56b30c1ae5cd717407068a9b13ca941b82db254f4ecdbd1751a3f8f1061031bb41af5c04a33ffc98509f456830cf3c94c14451f04d84844e41c618e82958710d07daeba666329b914f2cc7c1d34ffbf6b50620b7c78c25c5d82a5aadcc4d824b3b68c34231fa7c0befe5241c447f90111c55848feed9d1ee67f61095ec2c0b4ac82f5cf169201516082a804c9d1775990d430d21bc65877041905caf385918f44191c134e493d960724b28f01e79fbf3b99eac1e75fbc8ab8dcfdd98b573fa6d7e6a6ead6b15ed78e2a8d564f61d8c52be8104306c104146696e16c9e9bff79a5fc1d92326cf0f2ff5e5c5c252773f2bd2c554bc409aaec03055f71d439daebc1d8b06c9ca0e1fe4729e8e6119616e8fb861b1e2694d1df267cbc496ba4a87013c3317a16b4c1e369748507794a20ad06aad20e4dbfc1834d789d2a8e9395ddad33a74c6c7cf54e61e533cae228909536eba8020f0c3845d2063270cae4d8e8dd8cfe3f112c46751444546ced9f6434741656dcda2185be13eebcc0392c256f384fc16353e89cbdeef8fb2e3cadc1ed2142f3b6485dc2d540fe799d027413128f624aaf8bc1933d3a0e6a954931bfc914921dec7ec822a31ebb652d4f312ab4068cedc6203b0de98e60c5f82296a3482132b288ba0a8eabdd8ac40faf145928e7563dbcb14d0625c92b542860993bb0388d8390dae727ae4086d4de1b7fea9d79f4844374bcd67fa5e1a3a28cd6d8da3f171fcf9d13062bb149fde18917c6650cdfa2be8de33b556ad34fad454db13a446e8a7c40167117e884d874c786768975df0b201ea0077ba735d31d65a832dc122d13c6559601b83899af1f14808f55f077ad465ed61378c63abff3ad742691168fe1e31bfd0dbb9f43d364ddf0bb185f69e69110c9eb1ab808354fdd2cf571838d5ec63bac3d70ca40878dc3c3cea26adffd5a197206d7c80d6a86c202338e72f17dc7185e1df0cfefa9475a2156738f90c6410c1698d1a160fd396548323c796ec5dca3cd59e468ff6a14caf34b4fdb16f1c92acb6bff2e859f9de1266dea0d1828598319b40a3edef657be02188fc94490c1da088d3ec2f315d6b5bb2f262764b67ba321379f4c93bb3ef9bc7db0c0e5f1e680ebfa84463e904d5351ecf25d1d22a98f81f7a1fc4c4fee3934b7672661f0bcd94109706644d0fdac4b7933b5db2acf39b98c0a8106a7a757408404a4c299a077379458e2118fb0a53b798adc1b85d3eb20b539e572741b9855e44a545809f897dde06730145b5caefe9db1c321783450d25d38834532c3e372fa92a53ac9cb4330eaaf65fe1b69a66459058e02d20c6641b7d8edfa8e356baaeb011b61208ef36ed33235144c86d6ce65da89d66da06291d4acc05e3136559ab77a7c4ad229c5307b48ed642d96c28cd06c82dedd4a16ed90bceda81292120438fd5c47b7b41b2646fe0899643f896ddb2d11e7311f8a0cbb9bfa38106507e06f35b3052ad6b6a11ac5f0129bedc59d04aee3737ebbf10f97c80f1a4e3f51ac8ac4488ad9e3f685a7c0dd4074b07774f4efe4b9f2cba400ef49f73b12fc7d96d8f3283a1eaf8c003931fc24a9248e201ac31bb49226c37d535592e00308d86ba0765a7eda13b72686101d352fb959598038b8dec44a0f18e5c8ec089912d325880390ce5186d4585df46e5662987c164f0ccfb8f12f6144f91349051d3ffa35ba597d2b5920e279ca8e139dfe2ba9923c0190fd444c8bf12a627618791a8781d6b54470777e6a5dac8cb505ae1e534b0c3af7db010dd602b1459964e1e15a812f3b4c8038e6bc1dc568ba482ee4944582abeeda1ed012391706ddb1e0ce60efd15acde8283d3612de5d0cf76185ad3a1ce89488e1cea4009573b55a2766d100ecefc5d53c99876cfec65daea82f55cf9687ec70e45cfdba9fe69fc3a822c29ff4be34857bdcd4313fb23d1d01d8a79cbd0057eeb5c1c0b39f75d5a753a2e10bd0ebb91dab1312bdf1a984332d566ab56dfd838d285995bec8726c5d1358fe10b0b6aaa99b9d9b08894c1dbd06356e5c693ddebb9d8b306062defb160db9d8f02ae3df59697866f5adeb34c8c5b27b63b09675030f344197b3bff097b996819dec9059aaf5ec1a6c585a86d16528091543a9e6bca4d850b7963fd1e7d981814dedb165c1a6444ec0a21743a4de8845b386ad4e1e9c9f2873f6a353487d9a8f8f56ae1d0f69124ee56b5c2b2a48c78cc6ba6b313b889adf0acfaebb4e2dc71054a4992366a2b6ff1f5972d7d2f0e9e3b17d7fbe931f43871819dc6e6040ba239ebce2cfa424ff7344b8a880040321909dcd16956594f5d99fdd39ea5d7209b906d2601572c56c72db899f986185194fe5aab45f27d9ac12aa8600b3c2728ef2e589a6886d711edf4d7f95b2e10d9adde3009560ad754f9e7a52808720a973dc475f8177fd5b199b69925f03a44a8bd9f3c3369861802ce5ca4b40cb47d19e2e1bda1b054f16b66ac7b7c0e5205112e011d6957f1df50505003544631ff4385d8128d46838338930aebc0496348045a7c05abd7a56e1079947d3eb1c50e4d8be001d03d8973f8f08f2f21a415174173ccb90f7ab615be5036947e164a434c059637bfeebb8b9f2e87b9774a4595c71122c9fac74347488b9a054e2e7b9c45b7b12fcca0fe789db614c70d4149d44e50fb64aabccee7447288a5b865a60c2640171f89afecda2cb18b7ecea214bd32f43d5ff66e90741697d085f3ee9bfd8662a3cc570999bb151090160d3bf5bf1d85e896d66276cba7ed97f341f595b13c02ac2a1352aec7a5980de2c8f9d890951108947b7602dcf2bdd2aef680667572b87aadf7c54338492eae763df73e89e3c438c196da83d98bc65233a242e08894f2390d8714f0abb801d9e5c42f169555284b6cf079005b373e9938db71a93ee5945c2a43a06e3df580d372318b3d203503c6e968206d7db8116cca2f2a1fae7f5b5195bea92914d66516bc3ceb2d9dc4de59d0d52ab80910aba7ebb696c7deaddcf0fedf56e2a88c3496bb79897c6420a0ef1b03ad89c76b24f67ffd41c9227d464565457bb25f0b32c83e676b0a3284f2acbed39c6875871c5e866a8284f12e383f87f12dd9bbe3078c68b3711eaa9bc17a7ac8413a8ef486922eddf43f01625671b7c3d0a4c6c2dc38217b4135c8cb46df7d936aabfd253e95e0816dd1f92b257e2f96d2a259a320756ba77d99b709711326f2ea42def974d60f817a1f6779121dd32a1cb194c7809e4c8fd052ba357323436491ec45a49fa601ed373aadd2199e4483704fb2f4edd7bf2815b552fb84d09094cab9700b5125887ee508570217c16799bc11d9e3658de8d9812f30dc8078bbecaf887a6527686b026eea70229df1e61759adf19c1b96673419decb382ae29bd685c5f32120b2d56d3e97c9ef00a2c0598c2181b8fa53172312590a9549ff55dffb9070b042c74654b2ae56371b2a6bac8e2808a40fd5d6d0af184c035101394e347521467e0ddb962e0d63614cf1461ac7b9d744084e9f6f26c88d515dbb1b7392b8e9384b81f186224d5c09e266682d8044d8afb1bd6483962b03ed6884759d2647b8f174a6695a437a1f1aac3e6a2f8ca658ee8a8ae44a77393cec61a9f335a1e859825e73df4125828fbde19d3695125992ddb2826ffbc6c7cfbfdbae19ba864c4170c79cce408e8b280a7632c855d802029ebac8627fbd6fec1c3bd858411c969ca035992f2ab909c423158dffd0dd5a407b3e0c2d9b180440996e09e15f17b4e42f365371d9dd58c4609455253c44c2ba73f592e360ab5fcccdb6e90ae0c60ada9325c4824242c0d866e7dfbefe091067d5c7ff0432814f733591eb0096659738b34cfa8c6c988ec628f34fe08f31dc0156dc39866412932d045168f4f3a48f24fb3b884be1384845d496c3009626f1c41b0189e95c9055d24eb5a0390596f6ccf50d3727e607875a3b2cf076a277e12ac07ddc59da78ee16e1952706ac6a1a9ade80b867d889789c935d196cc4da67aa35ba80ef2077ee4dd69c5f31a0410f7fd0739303ddcdbff2f53e0a44ec5de0f062e533444bd946959a1d9c25b297b6fc7675ca4add9e24e8ff390e0375f3b15e1d3e8129007d743e384659f191bd23ffe02140fa64d5c6d75937b28d51afcaa9d207f57c878f2f54493025e9eff5b5ce0c997d11c9690262e38e1e83c7f1a0ed3f200d9d0472739d59dea3cc6e8783758e3e3201731cf27211267702594356345449b42fa64b64c6f00a8f26665524fe2208b1a7c5fbdc822ea611c1811526471e4f52ab5e3a43de8fd4eba2fb2796a206e348de9b0be78ded78204dc82d9e9adccbe408d7ff538aab3d663eab189927a9cd597388e8dc5063d2db42cd65415fa32d20288da017c9f94e788dfe7cc3a0f6b6ab06116ed3f72f3c048cb1e51abf308ed7169908d1ad5b7ab3a86a3316d164084f8d88c6f96142d888ccb158efa586015914c116db114aa82c44a55d4c33bd901dc34e820d3120d57def03ea4f01b263913cc02ca586b208506d149ef03a706fd5360a12b83acb7bf97ac1f1f85389d4fbfdcf38551e9dbce760a05e8e4023d85038570d3697b3e7de73aac9c7feb39b6ccd1a775c8ce01b08d7190e28866aa7bb8d0cff0fc45b452fcb6a290f98f4b5ec125224c8a93918b1f2888befba6de3d294ee1f13a9c56e92eaac0b8e6c6905e77a60ea7e1d1ed979b6b2606652e7d75750a065c57c7efb1ef5708719ef04e354bd861b15e0a1cbc7cfe65c8a3d9a2b790260d6e6eb60bd4e0fb3f040dfa27fa00797664122add0750a23a8b20fcd68b6be1e21620dda4bf0561f4c5ed74f41612a0676dcdbf669df3436cbf2ce253e69319e3ab36e6e6314f11e0d0882ee3d7f3d3b3dcfe3cd7f061e301369207545676e09801f9bc4bc4c3dcaf48e5320a4b3211051a7525868a0ac1278ed6fc9531ed89cf4205458acc05d5351bcab7ea50250b6cb4c6fdd0cd96f30cdc9a820f495d0a3e14eb6c493a85a87e3b7fb8e5f23431c3c5359f5802f1fc11ff71c3172c6b57b5587ab38579b79e328792edb7a81d60762bc6c88693a00712f811cab9b075a97535c904396dbd2fa0994ba9c9b06fe9c042cb6860d22844b94863bf7b68a1ab8639e4487b38d48e40da4a98dedd7d73ca4b575bf4c604a364a9247c2ea5e3b127ff42f9bce1d3d37c2428edab1708ebd71ac0e4a408a9c6eb97407a4a8b5e912e2c63fadd1abad9a772a96fc4666f7d2b604adbde6f1136de2adfe38994491ab0f34ff1fd20cb8034ad39aae4c5c0076da2e7a157764b770e1c5f35b6f323ce809b2e92be1345204021d74712368e0ef77056afd85f065bba085793c9b6950d3c3fc6c445afbdd5a80cf7b0bb13055fd486700be1500bdf8771e286a63962e56d4771ed5eefbf111ba7380f02d6f96eed174246820b73bd772689c072bb3d8e43ef96f5466dce5c9392e34b7176821d2f4df3dab4c6ef5e0238ffe61582812fdacc987fbb6d98cad5a2d7af0e4c8dd3f800cd75c38a515d4d4c7118c5f81c6f7504e7ae452370c56c4b7fb4daa65bf26919c12081485d09e9d142965320211f483ed2a0a6836fa2488a878eaf9653b0528c3680b75a1920a25b5c5c17548c7ceb9a1656a0cf6a404aec14f7ed8a1dcf8ed32e1cf94dc2f60b65aa102650b7a22d9e708c606ce8403ceb81434bd9938b2c4e5a8530a156a1df7d143b2da54071ba3e673ce11760f72c32273b7bcd9a48da2a6caeb4b782cf1c3a044c1731f3ad61ce32bbd0b52cbb187cb3ecc1e85a67ffe27cf86769a0d69fe293dd30f060b8a0f26ccd0287d0b8d941ee7410a7c6aa430add67c2dd60db292e24f294ce80b0321aaa4d054a6f5d9981e1d5e859b454f5005be082bd59baca5775eedb7994333c62c452ef7b2893e4d03a28c0e368928b4bdd6e31f52a83cd7e162975405fd128321e0a8e3e77fd93257b0c46b309e16203974382ced818faac3a02e74141e9ea36c4a1b98bd859fafce43b2984d856c832f61b1ca562cee96f5843adc14b35bec1ccdafedd214f1a344345373f3c9eccee8324950a23c3e77d55dbde9a7ac1b7804927affb8b0e1488dcd8919d227bd1f50a35abf25e3f120c25b0dfb4d85b4c2a2c69cf7047c76c45e4e901e7396140496f9a322c2c2ac777a27adff5a6daf32e852b1bac89f1086739a603cf0f6838f792351c08e38ab130e5a83aa5a4f2da19df131770a308d810eed0059a2e5546a2169b9d0119f6df7c18981f4b4f119c76fdaac031ce7551f25678b5c4d8815a7ea9565e63389fca6ea0bcd40e71ac72124113dc0041ce26a0c9979ff76d7f1f2c0cd2c16d8c7a36930b909ed7e2d4adfa8352b12b99bdcbc25b485f652539fab7ac983c1ae925967c15ba2345e45d6bafe13b3e9d7acf1a592422ea09c3a45f7fe24e235bd70b106cdaa665584e74cdaf9f39b804bc6c4e7f0bf572225acd4dfe010081b91c2d5970d4f43d2e1a0e05f84baaf50642991b3704034aed74572e6a4715b79276432d06660b39c989570fc0d5d0071a7c690658caee447370d3295db3b5dc625e697e1ca2675b5430b9969024835c7d001fbce86c5165c4fe8f2d46b883daaa3fbf42dc5cf61209379013896df740b9cc32638358ea8079a33f04197f650471086e67e5cf9779268d7973c73bbbde2f1c11e1a8e2b154aaa8b4b74f8a03f14ceb7afc4ba35e6620b7af89c969021d20cb260c1868f3fa432ce7e509db06001ae6540531b126c1e3a851acbf0a9c1354bece05c094d69d9bd87f99391e23306911383d2082997339daebd67d8a707c9b496a309b7921696f39a07864f31208802db7188881e346b41c34f4129fca9c6a13172a4dabfe791584d240fc03685057d53c08737aa1d486233318eb4545f2e8d18087705b9d3a7658564592f56aea3aee53d66c249988bf353853728553a1577062e24af533f47dc012ae90c5c085babc121be2993c063e203ab949a088041271ac0527c56edd4b7a87e98323a0137cd493aa05fe38d02754a66d89348b119e6200d5919bc366788eb67115fc57c4c1a9dd42c7411d6709ad82de8662a1849445b39beb2ba8f894860e41a054f61337179a9214b0884f3964c95ed2a4ab37de8038566bba76fbaa7502c0460558ff4bf4793ca68d78e50f384a81da4cfa23723747e906b82290e0b8ea07e3404bee0915800d4c3c07f94c43e7aafbc7a44d923de97963d0d1586bee06fc90aadbe5758fb9933ff7df346d62e082223741f5cb26ef953ca654ab983a72b30b296891c9e3f1ed5216b0e588eb25f5d4ccad6f96973cc2d26196bbd37c83266473071ccd84d9e3c74f22621e8bd60afa4bcad6c853c7591fe5d4298a954ea5006f682a7a65aeb26b230f3866a28a58bf532aca8fd5eaec64f442ac510a7df4114f00fd6ff7e02d77f8e72797222556959958c4c4d166c5af18a6e25588cac9871a3d5bb453889ff8d13db22024a997bf97a5afdf698b1deaff3101e27868d2de47b92c403ce82e15f3239d8923e8ca0c01e3781b5dd6121f57d2238dc3ff8a1bde3e371efd33838c552e43588042b360f55d7ca92f11987630364b263428e18601d7bf23f6432b3a9aa2c500cd9ac5f73cbe309443858a2806956b0cdcfc19904567bb1703641017c6199e768410e03d8ba603eb34249d567370202f39639ae8f6d52d9d5dbfc544c5b85ac8187095c63f1f613fe4af179fc5c837e6e0ccc21e62ac22ac045c4ac3b1ca6a4cbdbe29ea465240fc0aed1f0e086d7580bcf81d4e2a4d55a8e3bc57110e7cf1e1895df07974f0686dd2ea2b12bbfd64e7a9d0c62c662f0370e6ed495eeb2ee5029042147a1f2e5fcd6068b06567be893cb80e2cbb5fbb12847313811c13cf685698d5e2175959579e510279b9e959ac2c3f94fec653c6b521f8909d633ccedbc1109285ecbd52d27cd2891eaf354db2c966d1e3086718848433c12658fe7f6fbfef930b963139a63f6c4caee5a1964d3a038dd0db403c0a251d702c07a0fba4a3576ec6668a78e9e26efc6ad83a670a47608bf4207979bf196b3160c95e7ccc6406d46f529d34676b76d72396262e1448df051130a21484e0e977df1f7f0a259ac762eef9506877498b9998e1286d6294cf60b95352e81c3", 0x2000, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r4, 0xc040aed5, &(0x7f0000000000)={0x2, 0x11000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 777.940248ms ago: executing program 4 (id=693): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_merged\x00', 0x26e1, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x8d, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, 0x28) ioctl$KVM_RUN(r3, 0xae80, 0x0) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) ioctl$KVM_SET_GUEST_DEBUG_x86(0xffffffffffffffff, 0x4048ae9b, &(0x7f0000000080)={0x70003, 0x0, {[0xffffffffffffffff, 0x1f8, 0x2, 0xffffffffefffff15, 0x3, 0x4, 0x1, 0x4]}}) 777.800871ms ago: executing program 0 (id=694): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="3c0100001000010400000000000000000000000000000000000000000000000100000000000080ffffffffffffff000112341234000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000001000004d23300000000000000000000000000000000000001ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000e7c400000000000000000400000000000000000000000000000000080000000000000000000000000000000a00000000000000000000004c001400686d616328736861312b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e7ff"], 0x13c}}, 0x0) 708.885317ms ago: executing program 1 (id=695): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c"], 0x0, 0x8e}, 0x28) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, r0, 0x1, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="bfa200000000000007020000fcffffff620200000000000018110000", @ANYRES32=r1, @ANYBLOB="000000000000000085000000010000001500070000000000bf06000000000000bf6100000000000007010000060000008500fc005d000000bf610000000000000701000004000000850000005e000000b70000000000000095"], &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 650.114665ms ago: executing program 0 (id=696): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x0, 0x8e}, 0x28) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, r0, 0x1, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="bfa200000000000007020000fcffffff620200000000000018110000", @ANYRES32=r1, @ANYBLOB="000000000000000085000000010000001500070000000000bf06000000000000bf61000000000000070100000600000085000000c2000000bf610000000000000701000004000000850000005e000000b70000000000000095"], &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 649.958953ms ago: executing program 1 (id=697): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x802, 0x104) ioctl$DVB_DVR_DMX_EXPBUF(r1, 0xc00c6f3e, 0x0) 596.276214ms ago: executing program 0 (id=698): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000006000000040000000000000e0400000000000000000000000000000d03000000000000000000000400000000000000000000000b030000000000000063"], 0x0, 0x52}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="183000000100000000000000030000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffff070000000000003eb7030000652b0000850000000600000095"], &(0x7f0000000080)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value=0x7000000}, 0x94) 590.505995ms ago: executing program 1 (id=699): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80}, 0x28) r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) r2 = add_key(&(0x7f0000000d80)='asymmetric\x00', 0x0, &(0x7f0000000780)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180732313232303432343232e8bf00005a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f038094ee301963b7da9314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533a4f5d7f8ebb9347b4f7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02c12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b37bd028f76de73f50fc917c9156d4e5a6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bdaf806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541c1aa8006e97b9ad6f5b89dcb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a056a33a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc", 0x559, r1) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000004000000080000000100000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000008e0000000000", @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="010000000300"/28], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r3, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000400)}, 0x20) keyctl$get_security(0x11, r2, &(0x7f00000000c0)=""/163, 0xa3) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x1, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000004000000b704000000000000850000001c00000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 499.038807ms ago: executing program 0 (id=700): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c"], 0x0, 0x8e}, 0x28) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, r0, 0x1, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="bfa2000000000000070200fdfcffffff620200000000000018110000", @ANYRES32=r1, @ANYBLOB="000000000000000085000000010000001500070000000000bf06000000000000bf610000000000000401000006000000850000005d000000bf610000000000000701000004000000850000005e000000b70000000000000095"], &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 399.898695ms ago: executing program 0 (id=701): setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) r0 = syz_open_dev$loop(&(0x7f0000000140), 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)="180c4552", 0x4) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000207, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000200f97a640d35a7386700", "28094cf00000000000004ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac000000dabeffff0000080000000000000000001900", "90be8b1c55080021000c547d03daa0f4bd00", [0x7f, 0x9]}}) 399.710729ms ago: executing program 1 (id=702): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000001c0), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEV(r0, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYRESHEX=r0, @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f00000001c0), r0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000001c0)={'wpan0\x00'}) (async) sendmsg$NL802154_CMD_GET_SEC_DEV(r0, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYRESHEX=r0, @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) 310.279053ms ago: executing program 0 (id=703): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) socket$igmp(0x2, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) setns(0xc9, 0x0) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r4, 0x0, 0x12, 0x2f, &(0x7f0000000900)="c1dfb080cd21d308098ee68888a8", 0x0, 0xaded, 0x4000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000), 0x141800, 0x0) write$binfmt_misc(r5, &(0x7f0000000040)="85f7fbc7310d5137c65f40be96db50633859a74880ebc2621d4e5927bd792698807441e55a619e9d92964109786e0a96b60a1bc19c89ba1063dbb29e6bafd63f94e285d2419f6f24320ccda811ec3772ede5a4a2f45c44d8a33989a36f9b4512fcc1739a079431991f838ffe854eea1b217c02f4f7a8b0161dc314d0726f48b063b9cbe7742bbe3c415d8f6ab225e6", 0x8f) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@bridge_delvlan={0x50, 0x71, 0x400, 0x70bd28, 0x25dfdbf9, {0x7, 0x0, 0x0, r2}, [@BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_CMD={0x8, 0x2, 0x11}}}, @BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_STATE={0xfffffffffffffcb0, 0x3, 0x2}}, @BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_MCAST_ROUTER={0x5, 0x6, 0x80}}, @BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_ID={0x0, 0x1, 0x1}}}]}, 0x50}}, 0x0) 309.822049ms ago: executing program 1 (id=704): r0 = socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="60000000420001000000000000000000030100000f0000003f00010000112233445566778899aabb86dd2c00001c00002c00011100000101010102538758fe6cbdf0357065ae44132403b1fd606412c3258e3c670000b20004000280040003"], 0x60}}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)='file ne*/sctp/* +', 0x11) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOWNER(r3, 0x400454cc, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r4) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r5 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) ioctl$vim2m_VIDIOC_STREAMOFF(r5, 0x40045612, &(0x7f0000000040)=0x1) close_range(r0, 0xffffffffffffffff, 0x0) 130.636201ms ago: executing program 3 (id=705): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="3c0100001000010400000000000000000000000000000000000000000000000100000000000000ff800000000000000112341234000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000001000004d23300000000000000000000000000000000000001ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000e7c400000000000000000400000000000000000000000000000000080000000000000000000000000000000a00000000000000000000004c001400686d616328736861312b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e7ff"], 0x13c}}, 0x0) 60.528325ms ago: executing program 3 (id=706): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x0, 0x8e}, 0x28) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, r0, 0x1, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="bfa200000000000007020000fcffffff620200000000000018110000", @ANYRES32=r1, @ANYBLOB="000000000000000085000000010000001500070000000000bf06000000000000bf61000000000000070100000600000085000000c2000000bf610000000000000701000004000000850000005e000000b70000000000000095"], &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 0s ago: executing program 3 (id=707): r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) ioctl$CDROMSUBCHNL(r0, 0x530b, &(0x7f0000000180)={0x2, 0x8, 0xf, 0x2, 0x0, 0x0, @msf={0x84, 0x3, 0x37}, @lba=0x10001}) (async) socket$netlink(0x10, 0x3, 0x0) (async) memfd_create(&(0x7f0000000440)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR\xab\xddt\x96s8\xf4\x1c\bi\xe4^\xd5\xfd+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\x8c\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x9a\xc7sn\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b^\xb9\x00\x00\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc5\x1d\xe7jDf\x87@\x8fg\x15RJw\x82\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4kej\f\x8f\x9b\\\x16\xb3)\xf2\x97;\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\x01\x01\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7g\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05}0\xba\xa9\x13\xc4\xd3\xa9\xb6~\x12\xcf.9\xc0\x1e\xbe\x1a:H\xads\x98\xc1m{1YM{d\xec\xff\xff\x8f\xe7j\x9c\xf9+\xc30\x13}\x9e\xff\x8d\xca\xc8)\xc9h(a\xf33\xe8\x90\x03#\xcb\xfb\x14\xe9\x06\xaaQ\x80\xdax=\xf5t-\x88\x9f\xf7\xeavp\aj\xb3\xba\xf4tP>\xf6o\xf2\xb4\xfb\xa9\xe2\x8d\xdf\t\xe9\xcb\xc2wz\x96\xf3)M\xbf\xa8\xba>\xbf\xfe\x16U,Q\x0e\xef\x81\xd55V\n\x8f\xff\xe8d\xc7w;\x92\x19\v\xc0$u\a\xfa\xa7`\xc1@:W<\x96` \xb9\xa1}\x18\xdf\xfbmY\xd2\xb7p<]\\\xec\x84BC\xde\xf3\xf8\x84\xf3f\x99[\xcbD\x93\xbcFo\xd0\xd7\x86\xf7\x98\x95i7\xef\xbe\xf7]z\x17\xd5\xa2\x17\xb5\xa9\x8enU\x0f\b\xa43\x0f\xd1\xfdb\x1eu\xc4\xe9K\xd6\xdf=\xbbL\x8e\xa4o~_\xd7u\xe7+\x86\xf0\x97\xcd\xaa\xbc\x82\xa5\xe3\xe9\x064]5\xa5@\x1bq\xb9\xee\x81.\x1c*I@\xcf\x8b\xa5\xb5\x97|\x8e=\xdc\x18n\x0fA5\x02\xb9\xf4\xb6\xe27_y\xceU\xb0MDS\xf05\a\xdd\x88lP\x0f\xedG\xff\b\xb4@F#T\x81\x11\xb0a\xfcVkr\xd1\x1b\x1b\a\xe5%/\xc1\xca[\x82\x01[\x11\xc0\xc4\xd7+\xe6<\xcbk\x97\xd1^\xe6\xd3\xbc?H\x03\xb0\xd1\x0f\x13', 0x4) userfaultfd(0x80001) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x2d, 0x0, 0x0) (async) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) (async) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000040)={0x1}) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat(0xffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) (async) r4 = openat(0xffffff9c, &(0x7f0000000080)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0) write(r4, &(0x7f0000000100)='zstd', 0x4) (async) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x382, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000000)=0x40f) ioctl$DRM_IOCTL_GET_CLIENT(r4, 0xc0286405, &(0x7f00000003c0)={0x3, 0x7, {}, {0xffffffffffffffff}, 0x76000, 0xfffffffffffffffd}) mount$overlay(0x0, &(0x7f0000000300)='./sys/module/zswap/parameters/compressor\x00', &(0x7f0000000340), 0x0, &(0x7f0000000780)={[{@uuid_off}, {@default_permissions}, {@verity_require}, {@verity_off}, {@default_permissions}], [{@euid_lt={'euid<', 0xee01}}, {@dont_appraise}, {@euid_eq={'euid', 0x3d, r6}}, {@smackfsdef}, {@dont_hash}]}) ioctl$TCFLSH(r5, 0x400455c8, 0x1000000000) (async) ioctl$sock_bt_hci(r3, 0x400448df, &(0x7f0000000040)) (async) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x400, 0x0, 0x80, 0xfc, 0x0, 0xb8, 0x0, 0x40, 0x3, 0x4}, {0x6, 0x8, 0x0, 0xfd, 0x0, 0x0, 0x7, 0xfe, 0xb, 0x9, 0x5, 0x0, 0x2}, {0xed87, 0x4, 0x1, 0x8, 0x0, 0x0, 0x8, 0x2, 0x9}], 0x20}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x20000000, 0x0, 0xfffffffffffffff8, 0x0, 0x0, 0x2004cb, 0x3, 0x100000000000000, 0xfffffffffffffff8, 0x0, 0xfffffffffffff2ab, 0x2000000000003ff, 0x2], 0x0, 0x200306}) (async) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000002c0)) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) kernel console output (not intermixed with test programs): etooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 47.211107][ T66] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 47.211125][ T5731] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 47.213941][ T43] audit: type=1400 audit(1789403784.984:163): avc: denied { read } for pid=5732 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 47.213968][ T43] audit: type=1400 audit(1789403784.984:164): avc: denied { open } for pid=5732 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 47.213988][ T43] audit: type=1400 audit(1789403784.984:165): avc: denied { mounton } for pid=5732 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 47.216923][ T66] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 47.217388][ T66] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 47.219260][ T43] audit: type=1400 audit(1789403784.994:166): avc: denied { module_request } for pid=5732 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 47.221553][ T5743] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 47.223555][ T66] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 47.239352][ T43] audit: type=1400 audit(1789403785.014:167): avc: denied { sys_module } for pid=5732 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 47.812644][ T5735] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.813126][ T5735] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.813469][ T5735] bridge_slave_0: entered allmulticast mode [ 47.814249][ T5735] bridge_slave_0: entered promiscuous mode [ 47.843297][ T5735] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.843376][ T5735] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.843441][ T5735] bridge_slave_1: entered allmulticast mode [ 47.844180][ T5735] bridge_slave_1: entered promiscuous mode [ 47.881837][ T5737] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.881919][ T5737] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.882725][ T5737] bridge_slave_0: entered allmulticast mode [ 47.884204][ T5737] bridge_slave_0: entered promiscuous mode [ 47.886770][ T5737] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.886809][ T5737] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.886864][ T5737] bridge_slave_1: entered allmulticast mode [ 47.887653][ T5737] bridge_slave_1: entered promiscuous mode [ 47.903956][ T5735] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.935388][ T5737] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.936974][ T5735] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.938568][ T5737] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.938701][ T5729] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.938758][ T5729] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.938837][ T5729] bridge_slave_0: entered allmulticast mode [ 47.940018][ T5729] bridge_slave_0: entered promiscuous mode [ 47.978984][ T5729] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.979298][ T5729] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.979537][ T5729] bridge_slave_1: entered allmulticast mode [ 47.980893][ T5729] bridge_slave_1: entered promiscuous mode [ 48.000119][ T5735] team0: Port device team_slave_0 added [ 48.008899][ T5737] team0: Port device team_slave_0 added [ 48.028039][ T5735] team0: Port device team_slave_1 added [ 48.028916][ T5737] team0: Port device team_slave_1 added [ 48.048782][ T5729] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.074036][ T5735] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.074053][ T5735] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.074070][ T5735] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.075986][ T5729] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.098132][ T5737] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.098147][ T5737] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.098167][ T5737] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.101809][ T5729] team0: Port device team_slave_0 added [ 48.104442][ T5735] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.104456][ T5735] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.104477][ T5735] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.104987][ T5732] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.105060][ T5732] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.105219][ T5732] bridge_slave_0: entered allmulticast mode [ 48.106202][ T5732] bridge_slave_0: entered promiscuous mode [ 48.107428][ T5732] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.107472][ T5732] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.107529][ T5732] bridge_slave_1: entered allmulticast mode [ 48.108256][ T5732] bridge_slave_1: entered promiscuous mode [ 48.110007][ T5737] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.110019][ T5737] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.110037][ T5737] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.116617][ T5729] team0: Port device team_slave_1 added [ 48.159439][ T5732] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.186766][ T5732] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.193610][ T5729] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.193621][ T5729] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.193633][ T5729] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.197531][ T5735] hsr_slave_0: entered promiscuous mode [ 48.198053][ T5735] hsr_slave_1: entered promiscuous mode [ 48.212413][ T5729] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.212422][ T5729] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.212435][ T5729] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.219819][ T5737] hsr_slave_0: entered promiscuous mode [ 48.220265][ T5737] hsr_slave_1: entered promiscuous mode [ 48.220541][ T5737] debugfs: 'hsr0' already exists in 'hsr' [ 48.220594][ T5737] Cannot create hsr debugfs directory [ 48.222565][ T5732] team0: Port device team_slave_0 added [ 48.224820][ T5732] team0: Port device team_slave_1 added [ 48.238658][ T5732] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.238670][ T5732] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.238682][ T5732] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.261618][ T5732] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.261635][ T5732] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.261657][ T5732] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.299684][ T5729] hsr_slave_0: entered promiscuous mode [ 48.300247][ T5729] hsr_slave_1: entered promiscuous mode [ 48.300568][ T5729] debugfs: 'hsr0' already exists in 'hsr' [ 48.300620][ T5729] Cannot create hsr debugfs directory [ 48.345910][ T5732] hsr_slave_0: entered promiscuous mode [ 48.346390][ T5732] hsr_slave_1: entered promiscuous mode [ 48.346668][ T5732] debugfs: 'hsr0' already exists in 'hsr' [ 48.346679][ T5732] Cannot create hsr debugfs directory [ 48.617784][ T5737] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 48.624133][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.624896][ T5737] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 48.632139][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.647083][ T5737] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 48.650428][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.661450][ T5737] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 48.666600][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.710373][ T5729] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 48.713337][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.716773][ T5729] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 48.722288][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.723001][ T5729] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 48.728564][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.732009][ T5729] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 48.735067][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.795544][ T5735] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 48.801400][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.806941][ T5735] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 48.810809][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.832642][ T5735] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 48.836629][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.847349][ T5735] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 48.850136][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.890819][ T5737] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.902667][ T5732] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 48.906428][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.907072][ T5732] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 48.911470][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.914549][ T5732] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 48.920892][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.927276][ T5737] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.933364][ T5732] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 48.937380][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.959932][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.960227][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.973501][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.973588][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.005560][ T5729] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.031713][ T5729] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.060950][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.061034][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.065375][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.065459][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.119567][ T5735] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.150122][ T5732] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.156948][ T5735] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.170088][ T623] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.170174][ T623] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.183740][ T5732] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.186105][ T1164] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.186150][ T1164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.200691][ T1164] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.200742][ T1164] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.202167][ T1164] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.202209][ T1164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.237487][ T5734] Bluetooth: hci3: command tx timeout [ 49.237627][ T66] Bluetooth: hci0: command tx timeout [ 49.237686][ T5731] Bluetooth: hci1: command tx timeout [ 49.237977][ T5743] Bluetooth: hci2: command tx timeout [ 49.418092][ T5737] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.468689][ T5737] veth0_vlan: entered promiscuous mode [ 49.479984][ T5735] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.480247][ T5737] veth1_vlan: entered promiscuous mode [ 49.514887][ T5729] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.527610][ T5737] veth0_macvtap: entered promiscuous mode [ 49.532667][ T5737] veth1_macvtap: entered promiscuous mode [ 49.549156][ T5735] veth0_vlan: entered promiscuous mode [ 49.560297][ T5737] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.569250][ T5737] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.572456][ T5735] veth1_vlan: entered promiscuous mode [ 49.587083][ T5732] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.630794][ T5729] veth0_vlan: entered promiscuous mode [ 49.635319][ T5735] veth0_macvtap: entered promiscuous mode [ 49.639909][ T5735] veth1_macvtap: entered promiscuous mode [ 49.647873][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.668936][ T5729] veth1_vlan: entered promiscuous mode [ 49.712533][ T5735] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.713193][ T74] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.713210][ T74] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.725585][ T5732] veth0_vlan: entered promiscuous mode [ 49.729835][ T5735] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.764076][ T5732] veth1_vlan: entered promiscuous mode [ 49.764357][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.764371][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.783557][ T5729] veth0_macvtap: entered promiscuous mode [ 49.798933][ T5729] veth1_macvtap: entered promiscuous mode [ 49.835999][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.836041][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.836071][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.836100][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.836129][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.836156][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.836183][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.837083][ T5732] veth0_macvtap: entered promiscuous mode [ 49.839712][ T5737] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 49.841402][ T5729] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.865628][ T5732] veth1_macvtap: entered promiscuous mode [ 49.875256][ T1065] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.875276][ T1065] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.881216][ T5729] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.930603][ T5732] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.933605][ T1065] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.933619][ T1065] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.953657][ T5732] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.026691][ T623] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.026712][ T623] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.092921][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.093017][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.094894][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.094935][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.094971][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095007][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095042][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095078][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095114][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095149][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095184][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095248][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095283][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095318][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095354][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095393][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095433][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095470][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095505][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095541][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095576][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095611][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.095648][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.096517][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.096555][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.096586][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.096620][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.096654][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.096690][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.096726][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.096761][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.096796][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.096831][ T5743] Bluetooth: hci3: ACL packet for unknown connection handle 3584 [ 50.126027][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.126047][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.137137][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.137160][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.234053][ T5891] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 50.234080][ T5891] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 50.247093][ T5891] vhci_hcd vhci_hcd.0: Device attached [ 50.250879][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.250899][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.252450][ T5891] vhci_hcd vhci_hcd.0: pdev(2) rhport(1) sockfd(5) [ 50.252471][ T5891] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 50.252546][ T5891] vhci_hcd vhci_hcd.0: Device attached [ 50.254389][ T5895] vhci_hcd: connection closed [ 50.254632][ T5893] vhci_hcd: connection closed [ 50.259100][ T13] vhci_hcd vhci_hcd.2: stop threads [ 50.259363][ T13] vhci_hcd vhci_hcd.2: release socket [ 50.259391][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 50.260874][ T13] vhci_hcd vhci_hcd.2: stop threads [ 50.260891][ T13] vhci_hcd vhci_hcd.2: release socket [ 50.260912][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 50.260945][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.260991][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.261028][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.261064][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.261101][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.261138][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.261173][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.261209][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.427854][ T5903] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1'. [ 50.678701][ T12] nci: nci_ntf_packet: unsupported ntf opcode 0xf00 [ 50.889465][ T5931] loop5: detected capacity change from 0 to 7 [ 50.891468][ T5931] Dev loop5: unable to read RDB block 7 [ 50.891491][ T5931] loop5: unable to read partition table [ 50.891575][ T5931] loop5: partition table beyond EOD, truncated [ 50.891613][ T5931] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 50.939399][ T35] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 51.086295][ T35] usb 8-1: device descriptor read/64, error -71 [ 51.316043][ T5743] Bluetooth: hci2: command tx timeout [ 51.316071][ T5743] Bluetooth: hci3: command tx timeout [ 51.318477][ T5953] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20'. [ 51.325964][ T5731] Bluetooth: hci0: command tx timeout [ 51.345968][ T35] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 51.485903][ T35] usb 8-1: device descriptor read/64, error -71 [ 51.596320][ T35] usb usb8-port1: attempt power cycle [ 51.945794][ T35] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 51.966345][ T35] usb 8-1: device descriptor read/8, error -71 [ 52.205890][ T35] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 52.226928][ T35] usb 8-1: device descriptor read/8, error -71 [ 52.346103][ T35] usb usb8-port1: unable to enumerate USB device [ 52.677317][ T5731] Bluetooth: hci1: command tx timeout [ 52.755027][ T43] kauditd_printk_skb: 61 callbacks suppressed [ 52.755041][ T43] audit: type=1400 audit(1789403790.524:229): avc: denied { unmount } for pid=5737 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 53.081458][ T43] audit: type=1400 audit(1789403790.854:230): avc: denied { read } for pid=5967 comm="syz.1.24" name="card1" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 53.081510][ T43] audit: type=1400 audit(1789403790.854:231): avc: denied { open } for pid=5967 comm="syz.1.24" path="/dev/dri/card1" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 53.084497][ T43] audit: type=1400 audit(1789403790.854:232): avc: denied { ioctl } for pid=5967 comm="syz.1.24" path="/dev/dri/card1" dev="devtmpfs" ino=637 ioctlcmd=0x64a6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 53.293028][ T43] audit: type=1400 audit(1789403791.064:233): avc: denied { create } for pid=5974 comm="syz.1.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 53.296455][ T43] audit: type=1400 audit(1789403791.074:234): avc: denied { write } for pid=5974 comm="syz.1.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 53.304829][ T43] audit: type=1400 audit(1789403791.074:235): avc: denied { ioctl } for pid=5974 comm="syz.1.27" path="socket:[9676]" dev="sockfs" ino=9676 ioctlcmd=0x5417 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 53.345524][ T43] audit: type=1400 audit(1789403791.114:236): avc: denied { allowed } for pid=5976 comm="syz.1.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 53.345555][ T43] audit: type=1400 audit(1789403791.114:237): avc: denied { create } for pid=5976 comm="syz.1.28" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 53.396199][ T5731] Bluetooth: hci0: command tx timeout [ 53.406150][ T5743] Bluetooth: hci2: command tx timeout [ 53.406228][ T5731] Bluetooth: hci3: command tx timeout [ 53.465401][ T5984] ======================================================= [ 53.465401][ T5984] WARNING: The mand mount option has been deprecated and [ 53.465401][ T5984] and is ignored by this kernel. Remove the mand [ 53.465401][ T5984] option from the mount to silence this warning. [ 53.465401][ T5984] ======================================================= [ 53.466672][ T5984] jffs2: notice: (5984) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 53.471352][ T5984] netlink: 'syz.1.31': attribute type 9 has an invalid length. [ 53.475292][ T5984] bridge1: entered allmulticast mode [ 53.588443][ T5917] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 53.621003][ T5993] loop5: detected capacity change from 0 to 7 [ 53.624337][ T5993] Dev loop5: unable to read RDB block 7 [ 53.624371][ T5993] loop5: unable to read partition table [ 53.624511][ T5993] loop5: partition table beyond EOD, truncated [ 53.624526][ T5993] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 53.644666][ T43] audit: type=1400 audit(1789403791.414:238): avc: denied { write } for pid=5994 comm="syz.2.36" name="snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 53.644846][ T5995] random: crng reseeded on system resumption [ 53.702183][ T6004] jffs2: notice: (6004) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 53.920618][ T6035] loop5: detected capacity change from 0 to 7 [ 53.924677][ T6035] Dev loop5: unable to read RDB block 7 [ 53.924700][ T6035] loop5: unable to read partition table [ 53.924788][ T6035] loop5: partition table beyond EOD, truncated [ 53.924798][ T6035] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 53.956836][ T6034] overlayfs: workdir and upperdir must reside under the same mount [ 53.974693][ T6034] netlink: 8 bytes leftover after parsing attributes in process `syz.3.49'. [ 53.975007][ T6034] netlink: 40 bytes leftover after parsing attributes in process `syz.3.49'. [ 54.014524][ T6044] gfs2: Unknown parameter 'barrier°‘§s@œ*ü' [ 54.021559][ T12] nci: nci_ntf_packet: unsupported ntf opcode 0xf00 [ 54.124344][ T6057] faux_driver vgem: [drm] Unknown color mode 43944; guessing buffer size. [ 54.264083][ T6070] loop5: detected capacity change from 0 to 7 [ 54.269631][ T6070] Dev loop5: unable to read RDB block 7 [ 54.269654][ T6070] loop5: unable to read partition table [ 54.269740][ T6070] loop5: partition table beyond EOD, truncated [ 54.269749][ T6070] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 54.471305][ T6072] netlink: 8 bytes leftover after parsing attributes in process `syz.3.61'. [ 54.476602][ T6072] syz_tun: entered promiscuous mode [ 54.755836][ T5731] Bluetooth: hci1: command tx timeout [ 54.893006][ T6081] netlink: 112 bytes leftover after parsing attributes in process `syz.3.63'. [ 55.476671][ T5731] Bluetooth: hci0: command tx timeout [ 55.476703][ T5731] Bluetooth: hci3: command tx timeout [ 56.888280][ T6028] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 57.085671][ T6101] netlink: zone id is out of range [ 57.086113][ T6101] netlink: zone id is out of range [ 57.158146][ T6112] xt_MASQUERADE: bad MAP_IPS. [ 57.164554][ T6113] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 57.165397][ T6114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.73'. [ 57.165569][ T6114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.73'. [ 57.174354][ T6114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.73'. [ 57.174575][ T6114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.73'. [ 57.174737][ T6114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.73'. [ 57.174900][ T6114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.73'. [ 57.175054][ T6114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.73'. [ 57.175231][ T6114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.73'. [ 57.175385][ T6114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.73'. [ 57.178268][ T6110] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 57.178828][ T6114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.73'. [ 57.577913][ T6145] FAULT_INJECTION: forcing a failure. [ 57.577913][ T6145] name fail_futex, interval 1, probability 0, space 0, times 1 [ 57.577934][ T6145] CPU: 2 UID: 0 PID: 6145 Comm: syz.0.82 Not tainted syzkaller #0 PREEMPT(full) [ 57.577946][ T6145] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 57.577968][ T6145] Call Trace: [ 57.577974][ T6145] [ 57.577979][ T6145] dump_stack_lvl+0x100/0x190 [ 57.578000][ T6145] should_fail_ex.cold+0x5/0xa [ 57.578013][ T6145] ? find_held_lock+0x2b/0x80 [ 57.578030][ T6145] get_futex_key+0x1d0/0x14f0 [ 57.578047][ T6145] ? __pfx_get_futex_key+0x10/0x10 [ 57.578061][ T6145] ? __up_read+0x333/0x980 [ 57.578074][ T6145] ? __pfx___up_read+0x10/0x10 [ 57.578087][ T6145] ? __mm_populate+0x33a/0x3a0 [ 57.578103][ T6145] futex_wake+0xf4/0x5e0 [ 57.578122][ T6145] ? __pfx_futex_wake+0x10/0x10 [ 57.578140][ T6145] ? up_write+0x2dc/0x5b0 [ 57.578156][ T6145] do_futex+0x2b2/0x440 [ 57.578171][ T6145] ? __pfx_do_futex+0x10/0x10 [ 57.578186][ T6145] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 57.578204][ T6145] __x64_sys_futex+0x34f/0x4d0 [ 57.578221][ T6145] ? __pfx___x64_sys_futex+0x10/0x10 [ 57.578236][ T6145] ? __pfx___x64_sys_mlock+0x10/0x10 [ 57.578250][ T6145] do_syscall_64+0x123/0x790 [ 57.578266][ T6145] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.578278][ T6145] RIP: 0033:0x7efd59b9e159 [ 57.578287][ T6145] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 57.578297][ T6145] RSP: 002b:00007efd5a98f0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 57.578308][ T6145] RAX: ffffffffffffffda RBX: 00007efd59e25fa8 RCX: 00007efd59b9e159 [ 57.578315][ T6145] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007efd59e25fac [ 57.578321][ T6145] RBP: 00007efd59e25fa0 R08: 0000000000000001 R09: 0000000000000000 [ 57.578327][ T6145] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 57.578333][ T6145] R13: 00007efd59e26038 R14: 00007ffd65189b90 R15: 00007ffd65189c78 [ 57.578346][ T6145] [ 58.005862][ T1041] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 58.157723][ T1041] usb 5-1: not running at top speed; connect to a high speed hub [ 58.157774][ T1041] usb 5-1: New USB device found, idVendor=0944, idProduct=0201, bcdDevice= 0.40 [ 58.158543][ T1041] usb 5-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x12, changing to 0x2 [ 58.160059][ T1041] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 58.160071][ T1041] usb 5-1: Product: syz [ 58.160078][ T1041] usb 5-1: Manufacturer: syz [ 58.160085][ T1041] usb 5-1: SerialNumber: syz [ 58.389348][ T1041] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 58.389391][ T1041] usb 5-1: MIDIStreaming interface descriptor not found [ 58.439963][ T43] kauditd_printk_skb: 58 callbacks suppressed [ 58.439982][ T43] audit: type=1400 audit(1789403796.214:297): avc: denied { mount } for pid=6169 comm="syz.3.89" name="/" dev="hugetlbfs" ino=9186 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 58.489951][ T1041] usb 5-1: USB disconnect, device number 2 [ 58.506211][ T6173] loop2: detected capacity change from 0 to 7 [ 58.508320][ T6173] Dev loop2: unable to read RDB block 7 [ 58.508345][ T6173] loop2: AHDI p1 p2 p3 [ 58.508362][ T6173] loop2: partition table partially beyond EOD, truncated [ 58.509011][ T6173] loop2: p1 start 1601398130 is beyond EOD, truncated [ 58.509031][ T6173] loop2: p2 start 1702059890 is beyond EOD, truncated [ 58.568410][ T6008] udevd[6008]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 58.882028][ T43] audit: type=1400 audit(1789403796.654:298): avc: denied { unmount } for pid=5732 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 60.241129][ T6119] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 60.308084][ T43] audit: type=1400 audit(1789403798.084:299): avc: denied { append } for pid=6190 comm="syz.1.96" name="snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 60.316905][ T43] audit: type=1400 audit(1789403798.094:300): avc: denied { create } for pid=6194 comm="syz.0.95" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 60.317294][ T43] audit: type=1400 audit(1789403798.094:301): avc: denied { setopt } for pid=6194 comm="syz.0.95" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 60.363237][ T6201] netlink: 'syz.2.97': attribute type 1 has an invalid length. [ 60.363280][ T6201] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 60.363301][ T6201] IPv6: NLM_F_CREATE should be set when creating new route [ 60.363319][ T6201] IPv6: NLM_F_CREATE should be set when creating new route [ 60.375560][ T43] audit: type=1400 audit(1789403798.144:302): avc: denied { bind } for pid=6194 comm="syz.0.95" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 60.392726][ T43] audit: type=1400 audit(1789403798.164:303): avc: denied { sqpoll } for pid=6199 comm="syz.2.97" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 60.394966][ T43] audit: type=1400 audit(1789403798.164:304): avc: denied { write } for pid=6194 comm="syz.0.95" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 60.395647][ T43] audit: type=1400 audit(1789403798.164:305): avc: denied { shutdown } for pid=6199 comm="syz.2.97" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 60.399893][ T43] audit: type=1400 audit(1789403798.174:306): avc: denied { connect } for pid=6199 comm="syz.2.97" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 60.407195][ T6205] netlink: 'syz.2.97': attribute type 1 has an invalid length. [ 60.407240][ T6205] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 60.422429][ T6213] loop5: detected capacity change from 0 to 7 [ 60.426759][ T6213] Dev loop5: unable to read RDB block 7 [ 60.426794][ T6213] loop5: unable to read partition table [ 60.426940][ T6213] loop5: partition table beyond EOD, truncated [ 60.426955][ T6213] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 60.479075][ T6195] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.138290][ T6191] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 61.140935][ T6191] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 61.159344][ T6191] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 61.161880][ T6191] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 61.162015][ T6191] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 61.164703][ T6191] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 61.168052][ T6191] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 61.168107][ T6191] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 61.177849][ T6191] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 61.183284][ T6191] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 61.183371][ T6191] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 61.185987][ T6191] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 61.239440][ T6235] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 61.298136][ T6242] loop5: detected capacity change from 0 to 7 [ 61.300006][ T6242] Dev loop5: unable to read RDB block 7 [ 61.300036][ T6242] loop5: unable to read partition table [ 61.300189][ T6242] loop5: partition table beyond EOD, truncated [ 61.304230][ T6242] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 61.464693][ T6244] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=51 sclass=netlink_route_socket pid=6244 comm=syz.1.110 [ 61.638473][ T6265] isofs_fill_super: bread failed, dev=sr0, iso_blknum=32, block=32 [ 61.818558][ T6278] loop5: detected capacity change from 0 to 7 [ 61.824456][ T6278] Dev loop5: unable to read RDB block 7 [ 61.824489][ T6278] loop5: unable to read partition table [ 61.824638][ T6278] loop5: partition table beyond EOD, truncated [ 61.828633][ T6278] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 61.830768][ T6280] netlink: 'syz.2.124': attribute type 2 has an invalid length. [ 61.918353][ T6284] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 62.043879][ T6288] syz.1.127 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 62.387277][ T6300] netlink: 'syz.0.131': attribute type 5 has an invalid length. [ 62.395558][ T6300] ip6erspan0: entered promiscuous mode [ 62.436564][ T5731] Bluetooth: hci0: command 0x0c1a tx timeout [ 62.497396][ T6308] loop5: detected capacity change from 0 to 7 [ 62.498777][ T6308] Dev loop5: unable to read RDB block 7 [ 62.498808][ T6308] loop5: unable to read partition table [ 62.498956][ T6308] loop5: partition table beyond EOD, truncated [ 62.501261][ T6308] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 62.665825][ T6321] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 62.746244][ T6324] __nla_validate_parse: 68 callbacks suppressed [ 62.746262][ T6324] netlink: 16162 bytes leftover after parsing attributes in process `syz.3.138'. [ 62.762541][ T6324] netlink: 20 bytes leftover after parsing attributes in process `syz.3.138'. [ 62.810123][ T6329] netlink: 8 bytes leftover after parsing attributes in process `syz.2.139'. [ 62.824593][ T6332] fuse: Unknown parameter '00000000000000000003' [ 62.830957][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.831034][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.831103][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.831192][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.831639][ T6332] Zero length message leads to an empty skb [ 62.833548][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.833623][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.833691][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.833757][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.833856][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.833924][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.833992][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.834060][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.834170][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.834243][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.834306][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.834371][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.834435][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.834497][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.835250][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.835321][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.835385][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.835447][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.835452][ T6334] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=29282 sclass=netlink_route_socket pid=6334 comm=syz.0.140 [ 62.835513][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.835576][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.835641][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.837884][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.837960][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.838956][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.839029][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.839098][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.839196][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.839271][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.839339][ T5731] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 62.950499][ T6341] loop5: detected capacity change from 0 to 7 [ 62.951164][ T6341] Dev loop5: unable to read RDB block 7 [ 62.951194][ T6341] loop5: unable to read partition table [ 62.951345][ T6341] loop5: partition table beyond EOD, truncated [ 62.951359][ T6341] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 62.993835][ T6344] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow [ 63.000564][ T6342] netlink: 'syz.3.143': attribute type 1 has an invalid length. [ 63.027012][ T6342] 8021q: adding VLAN 0 to HW filter on device bond1 [ 63.043058][ T6342] bond1: (slave geneve2): making interface the new active one [ 63.052917][ T6342] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 63.138978][ T6350] 0x000000000007-0x000000020000 : "" [ 63.167625][ T6350] ftl_cs: FTL header corrupt! [ 63.194223][ T6360] SET target dimension over the limit! [ 63.246074][ T5731] Bluetooth: hci3: command 0x0c1a tx timeout [ 63.246127][ T5731] Bluetooth: hci2: command 0x0c1a tx timeout [ 63.270693][ T6365] kvm: pic: non byte read [ 63.271956][ T6365] kvm: pic: non byte read [ 63.273078][ T6365] kvm: pic: non byte read [ 63.274201][ T6365] kvm: pic: non byte read [ 63.275267][ T6365] kvm: pic: non byte read [ 63.276267][ T6365] kvm: pic: non byte read [ 63.277200][ T6365] kvm: pic: non byte read [ 63.278249][ T6365] kvm: pic: non byte read [ 63.279340][ T6365] kvm: pic: non byte read [ 63.280554][ T6365] kvm: pic: non byte read [ 63.448435][ T43] kauditd_printk_skb: 50 callbacks suppressed [ 63.448448][ T43] audit: type=1400 audit(1789403801.224:357): avc: denied { unmount } for pid=5737 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 64.018197][ T43] audit: type=1400 audit(1789403801.794:358): avc: denied { create } for pid=6377 comm="syz.1.152" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 64.019609][ T43] audit: type=1400 audit(1789403801.794:359): avc: denied { create } for pid=6378 comm="syz.3.153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 64.021235][ T43] audit: type=1400 audit(1789403801.794:360): avc: denied { write } for pid=6378 comm="syz.3.153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 64.021265][ T43] audit: type=1400 audit(1789403801.794:361): avc: denied { connect } for pid=6377 comm="syz.1.152" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 64.023693][ T43] audit: type=1400 audit(1789403801.794:362): avc: denied { nlmsg_write } for pid=6378 comm="syz.3.153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 64.054363][ T43] audit: type=1400 audit(1789403801.814:363): avc: denied { ioctl } for pid=6377 comm="syz.1.152" path="socket:[12802]" dev="sockfs" ino=12802 ioctlcmd=0x7437 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 64.054415][ T43] audit: type=1400 audit(1789403801.814:364): avc: denied { write } for pid=6377 comm="syz.1.152" name="ppp" dev="devtmpfs" ino=729 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 64.054447][ T43] audit: type=1400 audit(1789403801.824:365): avc: denied { unmount } for pid=5735 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 64.081320][ T6389] loop5: detected capacity change from 0 to 7 [ 64.084307][ T6389] Dev loop5: unable to read RDB block 7 [ 64.084336][ T6389] loop5: unable to read partition table [ 64.084456][ T6389] loop5: partition table beyond EOD, truncated [ 64.084467][ T6389] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 64.115161][ T43] audit: type=1400 audit(1789403801.884:366): avc: denied { create } for pid=6390 comm="syz.3.156" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 64.153642][ T6394] comedi comedi3: dt2817: I/O base address or length out of range [ 64.164212][ T6404] netlink: 12 bytes leftover after parsing attributes in process `syz.0.157'. [ 64.321217][ T6414] xt_l2tp: v2 tid > 0xffff: 4294967294 [ 64.373174][ T6414] netlink: 'syz.3.161': attribute type 2 has an invalid length. [ 64.373192][ T6414] netlink: 'syz.3.161': attribute type 2 has an invalid length. [ 64.386115][ T6416] bridge_slave_0: invalid flags given to default FDB implementation [ 64.515878][ T5743] Bluetooth: hci0: command 0x0c1a tx timeout [ 64.541177][ T6439] gadgetfs: bound to dummy_udc driver [ 64.565172][ T6441] netlink: 8 bytes leftover after parsing attributes in process `syz.2.168'. [ 64.626872][ T6449] netlink: 16 bytes leftover after parsing attributes in process `syz.2.170'. [ 64.694432][ T6459] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(192.8192.44), cmd(14) [ 64.718810][ T6465] tmpfs: Bad value for 'mpol' [ 64.817191][ T6451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 64.817504][ T6451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 64.817968][ T6451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 64.818133][ T6451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 64.818519][ T6451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 64.824834][ T6451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 64.828184][ T6451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 64.828382][ T6451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 64.828850][ T6451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 64.829018][ T6451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 64.835825][ T6478] netlink: 8 bytes leftover after parsing attributes in process `syz.1.179'. [ 64.854871][ T6472] qnx4: unable to read the superblock [ 64.885825][ T5822] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 64.930874][ T6488] netlink: 'syz.3.181': attribute type 11 has an invalid length. [ 64.988368][ T6501] gadgetfs: bound to dummy_udc driver [ 65.186793][ T5821] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 65.229347][ T6519] netlink: 8 bytes leftover after parsing attributes in process `syz.3.189'. [ 65.254806][ T6521] sch_tbf: peakrate 216 is lower than or equals to rate 25783 ! [ 65.289367][ T6523] netlink: 'syz.3.191': attribute type 10 has an invalid length. [ 65.289380][ T6523] netlink: 40 bytes leftover after parsing attributes in process `syz.3.191'. [ 65.289587][ T6523] team0: Device veth1_macvtap is up. Set it down before adding it as a team port [ 65.289957][ T6523] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check. [ 65.291174][ T6523] FAULT_INJECTION: forcing a failure. [ 65.291174][ T6523] name failslab, interval 1, probability 0, space 0, times 1 [ 65.291200][ T6523] CPU: 0 UID: 0 PID: 6523 Comm: syz.3.191 Not tainted syzkaller #0 PREEMPT(full) [ 65.291219][ T6523] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 65.291230][ T6523] Call Trace: [ 65.291236][ T6523] [ 65.291244][ T6523] dump_stack_lvl+0x100/0x190 [ 65.291276][ T6523] should_fail_ex.cold+0x5/0xa [ 65.291317][ T6523] should_failslab+0xc2/0x120 [ 65.291342][ T6523] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 65.291361][ T6523] ? sidtab_sid2str_get+0x84/0x670 [ 65.291385][ T6523] ? sidtab_sid2str_get+0x17a/0x670 [ 65.291426][ T6523] kmemdup_noprof+0x29/0x60 [ 65.291456][ T6523] sidtab_sid2str_get+0x17a/0x670 [ 65.291482][ T6523] security_sid_to_context_core+0x373/0x700 [ 65.291508][ T6523] avc_audit_post_callback+0x109/0x910 [ 65.291538][ T6523] ? __pfx_audit_log_lsm_data+0x10/0x10 [ 65.291559][ T6523] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 65.291581][ T6523] ? skb_put+0x138/0x180 [ 65.291607][ T6523] ? audit_log_n_string+0x2a3/0x5a0 [ 65.291632][ T6523] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 65.291654][ T6523] common_lsm_audit+0x23f/0x2b0 [ 65.291676][ T6523] ? __pfx_common_lsm_audit+0x10/0x10 [ 65.291696][ T6523] ? avc_denied+0x14a/0x190 [ 65.291724][ T6523] slow_avc_audit+0x186/0x210 [ 65.291749][ T6523] ? __pfx_slow_avc_audit+0x10/0x10 [ 65.291773][ T6523] ? find_held_lock+0x2b/0x80 [ 65.291799][ T6523] ? avc_has_perm_noaudit+0x2b3/0x3b0 [ 65.291833][ T6523] avc_has_perm+0x1a6/0x1e0 [ 65.291859][ T6523] ? __pfx_avc_has_perm+0x10/0x10 [ 65.291888][ T6523] ? bpf_lsm_capable+0x9/0x10 [ 65.291916][ T6523] selinux_kernel_load_data+0x353/0x590 [ 65.291941][ T6523] security_kernel_load_data+0x91/0x220 [ 65.291962][ T6523] __x64_sys_kexec_load+0xce/0x230 [ 65.291986][ T6523] do_syscall_64+0x123/0x790 [ 65.292012][ T6523] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 65.292031][ T6523] RIP: 0033:0x7f964bf9e159 [ 65.292045][ T6523] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 65.292061][ T6523] RSP: 002b:00007f964ce51028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f6 [ 65.292080][ T6523] RAX: ffffffffffffffda RBX: 00007f964c225fa0 RCX: 00007f964bf9e159 [ 65.292093][ T6523] RDX: 00002000000002c0 RSI: 0000000000000001 RDI: 0000000000000002 [ 65.292105][ T6523] RBP: 00007f964c03503b R08: 0000000000000000 R09: 0000000000000000 [ 65.292115][ T6523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 65.292126][ T6523] R13: 00007f964c226038 R14: 00007f964c225fa0 R15: 00007ffcf3c4ab08 [ 65.292151][ T6523] [ 65.315810][ T5821] usb 5-1: device descriptor read/64, error -71 [ 65.315873][ T5743] Bluetooth: hci2: command 0x0c1a tx timeout [ 65.315889][ T5743] Bluetooth: hci3: command 0x0c1a tx timeout [ 65.331940][ T6523] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6523 comm=syz.3.191 [ 65.413157][ T6529] gadgetfs: bound to dummy_udc driver [ 65.468791][ T6539] loop5: detected capacity change from 0 to 7 [ 65.471651][ T6539] Dev loop5: unable to read RDB block 7 [ 65.471673][ T6539] loop5: unable to read partition table [ 65.471760][ T6539] loop5: partition table beyond EOD, truncated [ 65.471771][ T6539] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 65.569185][ T5821] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 65.648068][ T6551] netlink: 8 bytes leftover after parsing attributes in process `syz.1.201'. [ 65.705774][ T5821] usb 5-1: device descriptor read/64, error -71 [ 65.809100][ T6562] loop5: detected capacity change from 0 to 7 [ 65.809787][ T6562] Dev loop5: unable to read RDB block 7 [ 65.809807][ T6562] loop5: unable to read partition table [ 65.809904][ T6562] loop5: partition table beyond EOD, truncated [ 65.809914][ T6562] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 65.820904][ T5821] usb usb5-port1: attempt power cycle [ 66.075922][ T5881] usb 8-1: new full-speed USB device number 6 using dummy_hcd [ 66.155814][ T5821] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 66.176326][ T5821] usb 5-1: device descriptor read/8, error -71 [ 66.258237][ T5881] usb 8-1: not running at top speed; connect to a high speed hub [ 66.258257][ T5881] usb 8-1: New USB device found, idVendor=12d1, idProduct=de66, bcdDevice= c.bc [ 66.259407][ T5881] usb 8-1: config 6 has an invalid interface number: 64 but max is 3 [ 66.259420][ T5881] usb 8-1: config 6 contains an unexpected descriptor of type 0x2, skipping [ 66.259429][ T5881] usb 8-1: config 6 has an invalid interface number: 61 but max is 3 [ 66.259439][ T5881] usb 8-1: config 6 contains an unexpected descriptor of type 0x2, skipping [ 66.259447][ T5881] usb 8-1: config 6 has an invalid interface number: 7 but max is 3 [ 66.259456][ T5881] usb 8-1: config 6 has an invalid interface number: 190 but max is 3 [ 66.259465][ T5881] usb 8-1: config 6 has an invalid interface number: 43 but max is 3 [ 66.259475][ T5881] usb 8-1: config 6 has 5 interfaces, different from the descriptor's value: 4 [ 66.259486][ T5881] usb 8-1: config 6 has no interface number 0 [ 66.259493][ T5881] usb 8-1: config 6 has no interface number 1 [ 66.259501][ T5881] usb 8-1: config 6 has no interface number 2 [ 66.259508][ T5881] usb 8-1: config 6 has no interface number 3 [ 66.259563][ T5881] usb 8-1: config 6 has no interface number 4 [ 66.259596][ T5881] usb 8-1: config 6 interface 64 altsetting 245 endpoint 0x7 has an invalid bInterval 0, changing to 4 [ 66.259609][ T5881] usb 8-1: config 6 interface 64 altsetting 245 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 66.259621][ T5881] usb 8-1: config 6 interface 64 altsetting 245 has a duplicate endpoint with address 0x1, skipping [ 66.259632][ T5881] usb 8-1: config 6 interface 64 altsetting 245 has 3 endpoint descriptors, different from the interface descriptor's value: 10 [ 66.259650][ T5881] usb 8-1: config 6 interface 61 altsetting 157 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 66.259662][ T5881] usb 8-1: config 6 interface 61 altsetting 157 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 66.259720][ T5881] usb 8-1: config 6 interface 61 altsetting 157 has an invalid descriptor for endpoint zero, skipping [ 66.259732][ T5881] usb 8-1: config 6 interface 61 altsetting 157 endpoint 0x5 has invalid maxpacket 1024, setting to 64 [ 66.259744][ T5881] usb 8-1: config 6 interface 61 altsetting 157 has a duplicate endpoint with address 0x1, skipping [ 66.259754][ T5881] usb 8-1: config 6 interface 61 altsetting 157 has 7 endpoint descriptors, different from the interface descriptor's value: 26 [ 66.259772][ T5881] usb 8-1: config 6 interface 7 altsetting 5 has a duplicate endpoint with address 0x7, skipping [ 66.259782][ T5881] usb 8-1: config 6 interface 7 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 66.259792][ T5881] usb 8-1: config 6 interface 7 altsetting 5 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 66.259803][ T5881] usb 8-1: config 6 interface 7 altsetting 5 has a duplicate endpoint with address 0x7, skipping [ 66.259814][ T5881] usb 8-1: config 6 interface 7 altsetting 5 has a duplicate endpoint with address 0xF, skipping [ 66.259824][ T5881] usb 8-1: config 6 interface 7 altsetting 5 has a duplicate endpoint with address 0x7, skipping [ 66.259880][ T5881] usb 8-1: config 6 interface 7 altsetting 5 has a duplicate endpoint with address 0x7, skipping [ 66.259897][ T5881] usb 8-1: config 6 interface 190 altsetting 9 endpoint 0x4 has invalid wMaxPacketSize 0 [ 66.259908][ T5881] usb 8-1: config 6 interface 190 altsetting 9 has a duplicate endpoint with address 0x6, skipping [ 66.259918][ T5881] usb 8-1: config 6 interface 190 altsetting 9 has a duplicate endpoint with address 0x2, skipping [ 66.259935][ T5881] usb 8-1: config 6 interface 43 altsetting 4 endpoint 0xD has invalid maxpacket 512, setting to 64 [ 66.259947][ T5881] usb 8-1: config 6 interface 43 altsetting 4 has a duplicate endpoint with address 0xF, skipping [ 66.259958][ T5881] usb 8-1: config 6 interface 43 altsetting 4 has a duplicate endpoint with address 0xD, skipping [ 66.259968][ T5881] usb 8-1: config 6 interface 43 altsetting 4 has a duplicate endpoint with address 0xE, skipping [ 66.259979][ T5881] usb 8-1: config 6 interface 43 altsetting 4 has a duplicate endpoint with address 0x2, skipping [ 66.260025][ T5881] usb 8-1: config 6 interface 43 altsetting 4 has a duplicate endpoint with address 0x7, skipping [ 66.260038][ T5881] usb 8-1: config 6 interface 43 altsetting 4 has a duplicate endpoint with address 0x7, skipping [ 66.260048][ T5881] usb 8-1: config 6 interface 43 altsetting 4 has a duplicate endpoint with address 0xF, skipping [ 66.260059][ T5881] usb 8-1: config 6 interface 43 altsetting 4 endpoint 0x9 has invalid maxpacket 1024, setting to 64 [ 66.260072][ T5881] usb 8-1: config 6 interface 43 altsetting 4 has an endpoint descriptor with address 0x42, changing to 0x2 [ 66.260083][ T5881] usb 8-1: config 6 interface 43 altsetting 4 has a duplicate endpoint with address 0x2, skipping [ 66.260094][ T5881] usb 8-1: config 6 interface 43 altsetting 4 has a duplicate endpoint with address 0xD, skipping [ 66.260105][ T5881] usb 8-1: config 6 interface 43 altsetting 4 has a duplicate endpoint with address 0x5, skipping [ 66.260115][ T5881] usb 8-1: config 6 interface 43 altsetting 4 has a duplicate endpoint with address 0x3, skipping [ 66.260125][ T5881] usb 8-1: config 6 interface 43 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 66.260135][ T5881] usb 8-1: config 6 interface 43 altsetting 4 has 15 endpoint descriptors, different from the interface descriptor's value: 14 [ 66.260208][ T5881] usb 8-1: config 6 interface 64 has no altsetting 0 [ 66.260218][ T5881] usb 8-1: config 6 interface 61 has no altsetting 0 [ 66.260226][ T5881] usb 8-1: config 6 interface 7 has no altsetting 0 [ 66.260235][ T5881] usb 8-1: config 6 interface 190 has no altsetting 0 [ 66.260243][ T5881] usb 8-1: config 6 interface 43 has no altsetting 0 [ 66.261970][ T5881] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 66.261981][ T5881] usb 8-1: Product: syz [ 66.261989][ T5881] usb 8-1: Manufacturer: 泩븷㠕澀鼯è­å¶³ã—ƒì¸‚燈ᤥ짘擷䎾醠æ†à²¬ï»“ઙâ°äºï¸¤é¿¾á¤— [ 66.261998][ T5881] usb 8-1: SerialNumber: syz [ 66.416538][ T5821] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 66.438351][ T5821] usb 5-1: device descriptor read/8, error -71 [ 66.545903][ T5821] usb usb5-port1: unable to enumerate USB device [ 66.595795][ T5731] Bluetooth: hci0: command 0x0c1a tx timeout [ 66.967068][ T6582] batman_adv: batadv0: Adding interface: syzkaller0 [ 66.967080][ T6582] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.967105][ T6582] batman_adv: batadv0: Interface activated: syzkaller0 [ 66.976789][ T6582] jffs2: notice: (6582) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 67.042056][ T5881] option 8-1:6.64: GSM modem (1-port) converter detected [ 67.085121][ T6581] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 67.089844][ T5881] option 8-1:6.190: GSM modem (1-port) converter detected [ 67.102668][ T5881] usb 8-1: USB disconnect, device number 6 [ 67.109628][ T5881] option 8-1:6.64: device disconnected [ 67.122185][ T6581] batman_adv: batadv0: Removing interface: syzkaller0 [ 67.168652][ T5881] option 8-1:6.190: device disconnected [ 67.197019][ T6590] loop5: detected capacity change from 0 to 7 [ 67.199778][ T6590] Dev loop5: unable to read RDB block 7 [ 67.199872][ T6590] loop5: unable to read partition table [ 67.200029][ T6590] loop5: partition table beyond EOD, truncated [ 67.200045][ T6590] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 67.395993][ T5731] Bluetooth: hci3: command 0x0c1a tx timeout [ 67.396017][ T5731] Bluetooth: hci2: command 0x0c1a tx timeout [ 67.422264][ T6606] 8021q: adding VLAN 0 to HW filter on device bond2 [ 67.438684][ T6607] netlink: 'syz.3.219': attribute type 4 has an invalid length. [ 67.441431][ T6607] .`: renamed from bond0 [ 67.672352][ T6623] syz.1.222 uses obsolete (PF_INET,SOCK_PACKET) [ 67.763358][ T6627] loop5: detected capacity change from 0 to 7 [ 67.768981][ T6627] Dev loop5: unable to read RDB block 7 [ 67.769016][ T6627] loop5: unable to read partition table [ 67.769290][ T6627] loop5: partition table beyond EOD, truncated [ 67.769319][ T6627] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 67.854575][ T6629] __nla_validate_parse: 70 callbacks suppressed [ 67.854587][ T6629] netlink: 12 bytes leftover after parsing attributes in process `syz.3.226'. [ 68.079768][ T6644] netlink: 8 bytes leftover after parsing attributes in process `syz.3.230'. [ 68.202262][ T1065] IPVS: starting estimator thread 0... [ 68.221297][ T6648] lo speed is unknown, defaulting to 1000 [ 68.221359][ T6648] lo speed is unknown, defaulting to 1000 [ 68.227318][ T6654] gadgetfs: bound to dummy_udc driver [ 68.252033][ T6648] lo speed is unknown, defaulting to 1000 [ 68.253373][ T6648] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 68.253402][ T6648] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 68.253436][ T6648] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 68.259733][ T6648] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 68.274361][ T6648] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 68.286126][ T6652] IPVS: using max 27 ests per chain, 64800 per kthread [ 68.314683][ T6658] loop5: detected capacity change from 0 to 7 [ 68.318694][ T6658] Dev loop5: unable to read RDB block 7 [ 68.318727][ T6658] loop5: unable to read partition table [ 68.318887][ T6658] loop5: partition table beyond EOD, truncated [ 68.318902][ T6658] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 68.363562][ T6648] lo speed is unknown, defaulting to 1000 [ 68.400088][ T6648] lo speed is unknown, defaulting to 1000 [ 68.401824][ T6648] lo speed is unknown, defaulting to 1000 [ 68.404533][ T6648] lo speed is unknown, defaulting to 1000 [ 68.471518][ T43] kauditd_printk_skb: 66 callbacks suppressed [ 68.471536][ T43] audit: type=1400 audit(1789403806.244:433): avc: denied { relabelfrom } for pid=6662 comm="syz.3.238" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 68.471750][ T43] audit: type=1400 audit(1789403806.244:434): avc: denied { relabelto } for pid=6662 comm="syz.3.238" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 68.492004][ T43] audit: type=1400 audit(1789403806.264:435): avc: denied { append } for pid=6662 comm="syz.3.238" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 68.501505][ T6667] netlink: 8 bytes leftover after parsing attributes in process `syz.0.240'. [ 68.544243][ T43] audit: type=1400 audit(1789403806.314:436): avc: denied { mounton } for pid=6668 comm="syz.1.239" path="/proc/201/task" dev="proc" ino=13766 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 68.547649][ T43] audit: type=1400 audit(1789403806.314:437): avc: denied { associate } for pid=6673 comm="syz.1.239" name="core" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 68.577573][ T43] audit: type=1400 audit(1789403806.354:438): avc: denied { map } for pid=6668 comm="syz.1.239" path="/dev/nullb0" dev="devtmpfs" ino=705 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 68.580148][ T43] audit: type=1400 audit(1789403806.354:439): avc: denied { cmd } for pid=6668 comm="syz.1.239" path="/dev/nullb0" dev="devtmpfs" ino=705 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 68.764482][ T6676] gadgetfs: bound to dummy_udc driver [ 68.849637][ T43] audit: type=1400 audit(1789403806.624:440): avc: denied { execute } for pid=6677 comm="syz.3.243" path="/dev/audio1" dev="devtmpfs" ino=1320 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sound_device_t tclass=chr_file permissive=1 [ 68.854714][ T43] audit: type=1400 audit(1789403806.624:441): avc: denied { mount } for pid=6677 comm="syz.3.243" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 68.860623][ T5822] usb 7-1: device descriptor read/64, error -71 [ 68.862870][ T43] audit: type=1400 audit(1789403806.634:442): avc: denied { unlink } for pid=6677 comm="syz.3.243" name="#3" dev="tmpfs" ino=376 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 69.065567][ T6706] gadgetfs: bound to dummy_udc driver [ 69.105888][ T5822] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 69.143694][ T6711] syzkaller0: entered promiscuous mode [ 69.143709][ T6711] syzkaller0: entered allmulticast mode [ 69.255787][ T5822] usb 7-1: Using ep0 maxpacket: 8 [ 69.256424][ T5822] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 69.257401][ T5822] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 69.257422][ T5822] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 69.257440][ T5822] usb 7-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 69.257458][ T5822] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 69.257478][ T5822] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 69.257495][ T5822] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 69.257522][ T5822] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 69.463524][ T5822] usb 7-1: GET_CAPABILITIES returned 0 [ 69.463562][ T5822] usbtmc 7-1:16.0: can't read capabilities [ 69.671169][ T5822] usb 7-1: USB disconnect, device number 3 [ 69.734327][ T6718] trusted_key: encrypted_key: master key parameter 'ÿÿÿÿÿ' is invalid [ 69.793640][ T6717] netlink: 24 bytes leftover after parsing attributes in process `syz.3.258'. [ 69.868112][ T6723] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6723 comm=syz.0.259 [ 69.956786][ T6729] netlink: 8 bytes leftover after parsing attributes in process `syz.0.262'. [ 69.956809][ T6729] netlink: 20 bytes leftover after parsing attributes in process `syz.0.262'. [ 70.018741][ T6738] netlink: 8 bytes leftover after parsing attributes in process `syz.3.264'. [ 70.282116][ T6769] netlink: 8 bytes leftover after parsing attributes in process `syz.1.276'. [ 70.504604][ T6795] netlink: 8 bytes leftover after parsing attributes in process `syz.1.286'. [ 70.718002][ T6818] netlink: 'syz.3.295': attribute type 8 has an invalid length. [ 70.722547][ T6821] jffs2: notice: (6821) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 70.897662][ T6839] netlink: 8 bytes leftover after parsing attributes in process `syz.1.299'. [ 70.962630][ T6849] warning: `syz.1.302' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 70.965837][ T5822] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 71.126243][ T5822] usb 8-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 71.127082][ T5822] usb 8-1: config 2 has an invalid descriptor of length 100, skipping remainder of the config [ 71.127136][ T5822] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 29282, setting to 1024 [ 71.127154][ T5822] usb 8-1: config 2 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 71.127169][ T5822] usb 8-1: config 2 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 71.127922][ T5822] usb 8-1: config 2 has an invalid descriptor of length 100, skipping remainder of the config [ 71.127942][ T5822] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 29282, setting to 1024 [ 71.127955][ T5822] usb 8-1: config 2 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 71.127965][ T5822] usb 8-1: config 2 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 71.129502][ T5822] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.129513][ T5822] usb 8-1: Product: syz [ 71.129520][ T5822] usb 8-1: Manufacturer: syz [ 71.129527][ T5822] usb 8-1: SerialNumber: syz [ 71.138238][ T6818] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 71.146727][ T5822] ti_usb_3410_5052 8-1:2.0: TI USB 5052 2 port adapter converter detected [ 71.158397][ T5822] usb 8-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 71.163362][ T5822] usb 8-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 71.169398][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.169447][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.210857][ T851] cfg80211: failed to load regulatory.db [ 71.341774][ T6818] ti_usb_3410_5052_2 ttyUSB0: ti_open - no interrupt urb [ 71.342591][ T10] usb 8-1: USB disconnect, device number 7 [ 71.349452][ T10] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 71.352738][ T10] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 71.353870][ T10] ti_usb_3410_5052 8-1:2.0: device disconnected [ 71.403725][ T6891] syz.2.316: attempt to access beyond end of device [ 71.403725][ T6891] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 71.403753][ T6891] gfs2: error -5 reading superblock [ 71.628867][ T6910] vlan2: entered promiscuous mode [ 71.628880][ T6910] hsr0: entered promiscuous mode [ 71.629020][ T6910] vlan2: entered allmulticast mode [ 71.629027][ T6910] hsr0: entered allmulticast mode [ 71.629033][ T6910] hsr_slave_0: entered allmulticast mode [ 71.629041][ T6910] hsr_slave_1: entered allmulticast mode qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. [ 71.993087][ T6934] FAULT_INJECTION: forcing a failure. [ 71.993087][ T6934] name failslab, interval 1, probability 0, space 0, times 0 [ 71.993117][ T6934] CPU: 0 UID: 0 PID: 6934 Comm: syz.3.332 Not tainted syzkaller #0 PREEMPT(full) [ 71.993135][ T6934] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 71.993143][ T6934] Call Trace: [ 71.993148][ T6934] [ 71.993155][ T6934] dump_stack_lvl+0x100/0x190 [ 71.993193][ T6934] should_fail_ex.cold+0x5/0xa [ 71.993216][ T6934] should_failslab+0xc2/0x120 [ 71.993244][ T6934] kmem_cache_alloc_noprof+0x92/0x6a0 [ 71.993262][ T6934] ? __pfx_map_id_range_down+0x10/0x10 [ 71.993280][ T6934] ? rcu_is_watching+0x13/0xc0 [ 71.993304][ T6934] ? security_inode_alloc+0x3b/0x2c0 [ 71.993327][ T6934] security_inode_alloc+0x3b/0x2c0 [ 71.993345][ T6934] inode_init_always_gfp+0xc6f/0xfb0 [ 71.993372][ T6934] alloc_inode+0x8e/0x250 [ 71.993389][ T6934] sock_alloc+0x44/0x280 [ 71.993417][ T6934] ? security_socket_create+0x7f/0x250 [ 71.993444][ T6934] __sock_create+0xc2/0x860 [ 71.993473][ T6934] __sys_socket+0x14d/0x260 [ 71.993491][ T6934] ? __pfx___sys_socket+0x10/0x10 [ 71.993515][ T6934] __x64_sys_socket+0x72/0xb0 [ 71.993532][ T6934] ? lockdep_hardirqs_on+0x7d/0x110 [ 71.993563][ T6934] do_syscall_64+0x123/0x790 [ 71.993592][ T6934] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.993612][ T6934] RIP: 0033:0x7f964bf9e159 [ 71.993626][ T6934] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 71.993643][ T6934] RSP: 002b:00007f964ce51028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 71.993662][ T6934] RAX: ffffffffffffffda RBX: 00007f964c225fa0 RCX: 00007f964bf9e159 [ 71.993674][ T6934] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000021 [ 71.993684][ T6934] RBP: 00007f964c03503b R08: 0000000000000000 R09: 0000000000000000 [ 71.993702][ T6934] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 71.993714][ T6934] R13: 00007f964c226038 R14: 00007f964c225fa0 R15: 00007ffcf3c4ab08 [ 71.993738][ T6934] [ 71.993761][ T6934] socket: no more sockets [ 72.104816][ T6936] loop5: detected capacity change from 0 to 7 [ 72.109878][ T6936] Dev loop5: unable to read RDB block 7 [ 72.109910][ T6936] loop5: unable to read partition table [ 72.110008][ T6936] loop5: partition table beyond EOD, truncated [ 72.110027][ T6936] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 72.127552][ T6938] 9pnet_virtio: no channels available for device syz [ 72.619231][ T6957] netlink: 'syz.3.340': attribute type 7 has an invalid length. [ 72.698895][ T10] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 72.752908][ T6961] process 'syz.3.340' launched './file0' with NULL argv: empty string added [ 72.827374][ T6972] loop5: detected capacity change from 0 to 7 [ 72.829144][ T6972] Dev loop5: unable to read RDB block 7 [ 72.829180][ T6972] loop5: unable to read partition table [ 72.829342][ T6972] loop5: partition table beyond EOD, truncated [ 72.829393][ T6972] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 72.857286][ T10] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 72.859731][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.859746][ T10] usb 6-1: Product: syz [ 72.859753][ T10] usb 6-1: Manufacturer: syz [ 72.859761][ T10] usb 6-1: SerialNumber: syz [ 72.922528][ T5822] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 73.343696][ T5881] usb 6-1: USB disconnect, device number 2 [ 73.436187][ T10] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 73.588780][ T10] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 73.589671][ T10] usb 5-1: config index 0 descriptor too short (expected 64906, got 45) [ 73.591292][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 73.591303][ T10] usb 5-1: Product: syz [ 73.591310][ T10] usb 5-1: Manufacturer: syz [ 73.591317][ T10] usb 5-1: SerialNumber: syz [ 73.801340][ T10] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 73.801367][ T10] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 73.801377][ T10] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 73.808189][ T10] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 73.812040][ T10] usb 5-1: USB disconnect, device number 7 [ 73.824665][ T43] kauditd_printk_skb: 55 callbacks suppressed [ 73.824678][ T43] audit: type=1400 audit(1789403811.594:498): avc: denied { listen } for pid=7006 comm="syz.2.356" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 73.824715][ T43] audit: type=1400 audit(1789403811.594:499): avc: denied { setattr } for pid=7006 comm="syz.2.356" name="L2CAP" dev="sockfs" ino=15965 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 73.965768][ T5822] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 73.966023][ T5822] ath9k_htc: Failed to initialize the device [ 73.968322][ T5881] usb 6-1: ath9k_htc: USB layer deinitialized [ 74.331756][ T43] audit: type=1800 audit(1789403812.104:500): pid=7011 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.357" name="(" dev="sda1" ino=2038 res=0 errno=0 [ 74.396449][ T7013] loop5: detected capacity change from 0 to 7 [ 74.399356][ T7013] Dev loop5: unable to read RDB block 7 [ 74.399378][ T7013] loop5: unable to read partition table [ 74.399460][ T7013] loop5: partition table beyond EOD, truncated [ 74.399470][ T7013] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 74.477227][ T7015] gadgetfs: bound to dummy_udc driver [ 74.574134][ T7022] __nla_validate_parse: 8 callbacks suppressed [ 74.574161][ T7022] netlink: 8 bytes leftover after parsing attributes in process `syz.0.364'. [ 74.623524][ T7024] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=7024 comm=syz.3.363 [ 74.801463][ T43] audit: type=1400 audit(1789403812.574:501): avc: denied { connect } for pid=7036 comm="syz.0.369" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 74.846372][ T7041] gadgetfs: bound to dummy_udc driver [ 74.903775][ T7044] loop5: detected capacity change from 0 to 7 [ 74.906557][ T7044] Dev loop5: unable to read RDB block 7 [ 74.906579][ T7044] loop5: unable to read partition table [ 74.906674][ T7044] loop5: partition table beyond EOD, truncated [ 74.906688][ T7044] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 74.985202][ T7050] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 75.057801][ T7061] FAULT_INJECTION: forcing a failure. [ 75.057801][ T7061] name failslab, interval 1, probability 0, space 0, times 0 [ 75.057822][ T7061] CPU: 3 UID: 0 PID: 7061 Comm: syz.1.377 Not tainted syzkaller #0 PREEMPT(full) [ 75.057834][ T7061] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.057840][ T7061] Call Trace: [ 75.057844][ T7061] [ 75.057848][ T7061] dump_stack_lvl+0x100/0x190 [ 75.057868][ T7061] should_fail_ex.cold+0x5/0xa [ 75.057885][ T7061] should_failslab+0xc2/0x120 [ 75.057899][ T7061] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 75.057913][ T7061] ? copy_process+0x6a2/0x8370 [ 75.057928][ T7061] copy_process+0x6a2/0x8370 [ 75.057947][ T7061] ? __pfx_copy_process+0x10/0x10 [ 75.057959][ T7061] ? kasan_save_track+0x14/0x30 [ 75.057971][ T7061] ? __kasan_kmalloc+0xaa/0xb0 [ 75.057983][ T7061] ? lockdep_init_map_type+0x5c/0x250 [ 75.057995][ T7061] ? lockdep_init_map_type+0x5c/0x250 [ 75.058008][ T7061] ? __pfx_vhost_run_work_list+0x10/0x10 [ 75.058023][ T7061] ? __pfx_vhost_worker_killed+0x10/0x10 [ 75.058038][ T7061] vhost_task_create+0x1db/0x370 [ 75.058055][ T7061] ? __pfx_vhost_task_create+0x10/0x10 [ 75.058075][ T7061] ? __pfx_vhost_task_fn+0x10/0x10 [ 75.058095][ T7061] ? snprintf+0xc7/0x100 [ 75.058111][ T7061] vhost_task_worker_create+0x8d/0x260 [ 75.058126][ T7061] ? __pfx_vhost_task_worker_create+0x10/0x10 [ 75.058141][ T7061] ? lockdep_init_map_type+0x5c/0x250 [ 75.058154][ T7061] ? lockdep_init_map_type+0x5c/0x250 [ 75.058168][ T7061] vhost_worker_create+0x240/0x300 [ 75.058182][ T7061] ? __pfx_vhost_worker_create+0x10/0x10 [ 75.058197][ T7061] ? vhost_dev_set_owner+0x190/0xa30 [ 75.058215][ T7061] vhost_dev_set_owner+0x719/0xa30 [ 75.058235][ T7061] vhost_net_ioctl+0xfa6/0x1910 [ 75.058250][ T7061] ? do_vfs_ioctl+0x226/0x13e0 [ 75.058261][ T7061] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 75.058273][ T7061] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 75.058286][ T7061] ? __pfx_vhost_net_ioctl+0x10/0x10 [ 75.058302][ T7061] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 75.058316][ T7061] ? __fget_files+0x34/0x3d0 [ 75.058335][ T7061] ? selinux_file_ioctl+0xb6/0x290 [ 75.058347][ T7061] ? __pfx_vhost_net_ioctl+0x10/0x10 [ 75.058364][ T7061] __x64_sys_ioctl+0x18e/0x210 [ 75.058375][ T7061] do_syscall_64+0x123/0x790 [ 75.058390][ T7061] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.058401][ T7061] RIP: 0033:0x7f59e299e159 [ 75.058411][ T7061] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.058421][ T7061] RSP: 002b:00007f59e387a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 75.058433][ T7061] RAX: ffffffffffffffda RBX: 00007f59e2c25fa0 RCX: 00007f59e299e159 [ 75.058440][ T7061] RDX: 0000000000000000 RSI: 000040000000af01 RDI: 0000000000000009 [ 75.058446][ T7061] RBP: 00007f59e2a3503b R08: 0000000000000000 R09: 0000000000000000 [ 75.058452][ T7061] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.058458][ T7061] R13: 00007f59e2c26038 R14: 00007f59e2c25fa0 R15: 00007ffc61f92218 [ 75.058472][ T7061] [ 75.200142][ T7070] loop5: detected capacity change from 0 to 7 [ 75.200550][ T7070] Dev loop5: unable to read RDB block 7 [ 75.200570][ T7070] loop5: unable to read partition table [ 75.200660][ T7070] loop5: partition table beyond EOD, truncated [ 75.200669][ T7070] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 75.450959][ T7089] input: syz1 as /devices/virtual/input/input6 [ 75.456907][ T43] audit: type=1400 audit(1789403813.224:502): avc: denied { read } for pid=5123 comm="acpid" name="event4" dev="devtmpfs" ino=2920 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 75.457439][ T43] audit: type=1400 audit(1789403813.224:503): avc: denied { open } for pid=5123 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=2920 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 75.457477][ T43] audit: type=1400 audit(1789403813.234:504): avc: denied { ioctl } for pid=5123 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=2920 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 75.571004][ T43] audit: type=1400 audit(1789403813.344:505): avc: denied { setopt } for pid=7097 comm="syz.1.390" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 75.770961][ T7108] FAULT_INJECTION: forcing a failure. [ 75.770961][ T7108] name failslab, interval 1, probability 0, space 0, times 0 [ 75.770991][ T7108] CPU: 2 UID: 0 PID: 7108 Comm: syz.0.395 Not tainted syzkaller #0 PREEMPT(full) [ 75.771009][ T7108] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.771019][ T7108] Call Trace: [ 75.771026][ T7108] [ 75.771033][ T7108] dump_stack_lvl+0x100/0x190 [ 75.771063][ T7108] should_fail_ex.cold+0x5/0xa [ 75.771110][ T7108] should_failslab+0xc2/0x120 [ 75.771134][ T7108] kmem_cache_alloc_noprof+0x92/0x6a0 [ 75.771154][ T7108] ? alloc_empty_file+0x5b/0x1c0 [ 75.771179][ T7108] alloc_empty_file+0x5b/0x1c0 [ 75.771203][ T7108] path_openat+0xdb/0x2440 [ 75.771229][ T7108] ? __pfx_path_openat+0x10/0x10 [ 75.771250][ T7108] do_file_open+0x20e/0x430 [ 75.771267][ T7108] ? __pfx_do_file_open+0x10/0x10 [ 75.771310][ T7108] ? _raw_spin_unlock+0x28/0x50 [ 75.771331][ T7108] ? alloc_fd+0x471/0x7a0 [ 75.771360][ T7108] do_sys_openat2+0x10f/0x1e0 [ 75.771386][ T7108] ? __pfx_do_sys_openat2+0x10/0x10 [ 75.771410][ T7108] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 75.771440][ T7108] __x64_sys_openat+0x12d/0x210 [ 75.771464][ T7108] ? __pfx___x64_sys_openat+0x10/0x10 [ 75.771495][ T7108] do_syscall_64+0x123/0x790 [ 75.771518][ T7108] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.771536][ T7108] RIP: 0033:0x7efd59b9e159 [ 75.771550][ T7108] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.771565][ T7108] RSP: 002b:00007efd5a98f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 75.771582][ T7108] RAX: ffffffffffffffda RBX: 00007efd59e25fa0 RCX: 00007efd59b9e159 [ 75.771594][ T7108] RDX: 00000000000026e1 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 75.771606][ T7108] RBP: 00007efd59c3503b R08: 0000000000000000 R09: 0000000000000000 [ 75.771615][ T7108] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.771624][ T7108] R13: 00007efd59e26038 R14: 00007efd59e25fa0 R15: 00007ffd65189c78 [ 75.771645][ T7108] [ 75.780259][ T7110] netlink: 8 bytes leftover after parsing attributes in process `syz.1.396'. [ 75.931149][ T7119] loop5: detected capacity change from 0 to 7 [ 75.943657][ T7119] Dev loop5: unable to read RDB block 7 [ 75.943708][ T7119] loop5: unable to read partition table [ 75.943857][ T7119] loop5: partition table beyond EOD, truncated [ 75.943912][ T7119] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 76.037556][ T43] audit: type=1400 audit(1789403813.814:506): avc: denied { create } for pid=7123 comm="syz.1.401" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 76.037997][ T43] audit: type=1400 audit(1789403813.814:507): avc: denied { write } for pid=7123 comm="syz.1.401" name="file0" dev="tmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 76.040358][ T7125] netlink: 8 bytes leftover after parsing attributes in process `syz.1.401'. [ 76.105747][ T7133] netlink: 8 bytes leftover after parsing attributes in process `syz.0.405'. [ 76.165126][ T7136] binder: 7135:7136 ioctl c018aa3f 200000000740 returned -22 [ 76.226661][ T7147] loop5: detected capacity change from 0 to 7 [ 76.227030][ T7147] Dev loop5: unable to read RDB block 7 [ 76.227049][ T7147] loop5: unable to read partition table [ 76.227175][ T7147] loop5: partition table beyond EOD, truncated [ 76.227186][ T7147] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 76.269074][ T7140] netlink: 12 bytes leftover after parsing attributes in process `syz.1.409'. [ 76.270683][ T7140] netlink: 8 bytes leftover after parsing attributes in process `syz.1.409'. [ 76.270693][ T7140] netlink: 4 bytes leftover after parsing attributes in process `syz.1.409'. [ 76.270707][ T7140] netlink: 'syz.1.409': attribute type 11 has an invalid length. [ 76.270714][ T7140] netlink: 'syz.1.409': attribute type 7 has an invalid length. [ 76.375056][ T7157] loop0: detected capacity change from 0 to 1 [ 76.446723][ T7161] netlink: 8 bytes leftover after parsing attributes in process `syz.1.418'. [ 76.533067][ T7168] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 76.537831][ T7167] loop5: detected capacity change from 0 to 7 [ 76.538486][ T7167] Dev loop5: unable to read RDB block 7 [ 76.538515][ T7167] loop5: unable to read partition table [ 76.538642][ T7167] loop5: partition table beyond EOD, truncated [ 76.538655][ T7167] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 76.780289][ T7191] netlink: 12 bytes leftover after parsing attributes in process `syz.1.428'. [ 76.803331][ T7196] netlink: 8 bytes leftover after parsing attributes in process `syz.0.429'. [ 76.903091][ T7193] bond1: entered promiscuous mode [ 76.903114][ T7193] bond1: entered allmulticast mode [ 76.925480][ T7210] loop5: detected capacity change from 0 to 7 [ 76.950367][ T7210] Dev loop5: unable to read RDB block 7 [ 76.950405][ T7210] loop5: unable to read partition table [ 76.950563][ T7210] loop5: partition table beyond EOD, truncated [ 76.950579][ T7210] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 77.215813][ T30] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 77.366494][ T30] usb 5-1: Using ep0 maxpacket: 32 [ 77.367505][ T30] usb 5-1: New USB device found, idVendor=04da, idProduct=2372, bcdDevice= 3.d4 [ 77.368978][ T30] usb 5-1: config 7 has an invalid interface number: 188 but max is 0 [ 77.368992][ T30] usb 5-1: config 7 has no interface number 0 [ 77.369013][ T30] usb 5-1: config 7 interface 188 altsetting 12 endpoint 0xB has invalid maxpacket 1096, setting to 64 [ 77.369026][ T30] usb 5-1: config 7 interface 188 altsetting 12 bulk endpoint 0x4 has invalid maxpacket 1023 [ 77.369039][ T30] usb 5-1: config 7 interface 188 altsetting 12 bulk endpoint 0x8 has invalid maxpacket 1023 [ 77.369050][ T30] usb 5-1: config 7 interface 188 altsetting 12 has an endpoint descriptor with address 0x17, changing to 0x7 [ 77.369063][ T30] usb 5-1: config 7 interface 188 has no altsetting 0 [ 77.370980][ T30] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.370999][ T30] usb 5-1: Product: 硨ᩓ노봴ﶅë¯â·»ê‘†íŠ‘錋괘硿줲㖮磅ㆊ嶱ꩃ๧ԙã¹ê£Ÿé‘¶á™¨å¸ˆè¤žë©á²ä„”迮틸î¿å¬©ï³­å…™ã¯¼ë³—檟먢鿅⃧繇à´î±îžŠê’’濤ᬨோ䗩꾥渶졷뒞왖ḅê”濥Ѧă슞瀱奖瞂㿤í¶ê“´á…’럣ᰀᣕî²á¾¬é¶ˆï®¿æƒë£­â«î¦‹è†¬åž·ï»±ïºç•®æž›ì½·è‡áš–ë‹´ç§ [ 77.371025][ T30] usb 5-1: Manufacturer: 껪쌅ã´ä½¹ä¥Šäž€è¨«äµ¼é›¶î© é´³å£»ë‚ˆé‰‡å¦»êƒ• [ 77.371040][ T30] usb 5-1: SerialNumber: 㦻木莤굧ꈴ戀쇵꓿痹룧節⴩㿜씚ල꒳ìˆá†¿ç“¯ï¶¶ä¿Œï“£î¹î»•á©—쉕맆洀娰풶㣦斌࣎킳很ꟼ꫋æ§å±¡ï±ºêµºè˜žÝ˜ï¤¥å£– [ 77.380430][ T7211] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 77.380585][ T7211] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 77.455356][ T7240] FAULT_INJECTION: forcing a failure. [ 77.455356][ T7240] name failslab, interval 1, probability 0, space 0, times 0 [ 77.455387][ T7240] CPU: 0 UID: 0 PID: 7240 Comm: syz.1.443 Not tainted syzkaller #0 PREEMPT(full) [ 77.455408][ T7240] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.455419][ T7240] Call Trace: [ 77.455426][ T7240] [ 77.455474][ T7240] dump_stack_lvl+0x100/0x190 [ 77.455507][ T7240] should_fail_ex.cold+0x5/0xa [ 77.455533][ T7240] should_failslab+0xc2/0x120 [ 77.455557][ T7240] kmem_cache_alloc_noprof+0x92/0x6a0 [ 77.455577][ T7240] ? do_getname+0x35/0x390 [ 77.455608][ T7240] do_getname+0x35/0x390 [ 77.455637][ T7240] do_sys_openat2+0xc7/0x1e0 [ 77.455662][ T7240] ? __pfx_do_sys_openat2+0x10/0x10 [ 77.455702][ T7240] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 77.455730][ T7240] ? __fget_files+0x21f/0x3d0 [ 77.455757][ T7240] __x64_sys_openat+0x12d/0x210 [ 77.455783][ T7240] ? __pfx___x64_sys_openat+0x10/0x10 [ 77.455807][ T7240] ? ksys_write+0x1ac/0x250 [ 77.455834][ T7240] do_syscall_64+0x123/0x790 [ 77.455865][ T7240] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.455883][ T7240] RIP: 0033:0x7f59e299e159 [ 77.455929][ T7240] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.455946][ T7240] RSP: 002b:00007f59e387a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 77.455965][ T7240] RAX: ffffffffffffffda RBX: 00007f59e2c25fa0 RCX: 00007f59e299e159 [ 77.455978][ T7240] RDX: 0000000000121682 RSI: 0000200000000380 RDI: ffffffffffffff9c [ 77.455990][ T7240] RBP: 00007f59e387a090 R08: 0000000000000000 R09: 0000000000000000 [ 77.456001][ T7240] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.456011][ T7240] R13: 00007f59e2c26038 R14: 00007f59e2c25fa0 R15: 00007ffc61f92218 [ 77.456037][ T7240] [ 77.595531][ T7207] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.599837][ T7207] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.630623][ T30] usb-storage 5-1:7.188: USB Mass Storage device detected [ 77.646038][ T30] usb-storage 5-1:7.188: Quirks match for vid 04da pid 2372: 90 [ 77.747665][ T30] usb 5-1: USB disconnect, device number 8 [ 78.172629][ T7262] syz_tun: entered allmulticast mode [ 78.230762][ T7261] syz_tun: left allmulticast mode [ 78.419976][ T7277] loop5: detected capacity change from 0 to 7 [ 78.432146][ T7277] Dev loop5: unable to read RDB block 7 [ 78.432169][ T7277] loop5: unable to read partition table [ 78.432258][ T7277] loop5: partition table beyond EOD, truncated [ 78.432277][ T7277] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 79.155960][ T7290] kvm: MONITOR instruction emulated as NOP! [ 79.255947][ T7285] FAULT_INJECTION: forcing a failure. [ 79.255947][ T7285] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 79.256008][ T7285] CPU: 0 UID: 0 PID: 7285 Comm: syz.1.457 Not tainted syzkaller #0 PREEMPT(full) [ 79.256032][ T7285] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 79.256044][ T7285] Call Trace: [ 79.256052][ T7285] [ 79.256060][ T7285] dump_stack_lvl+0x100/0x190 [ 79.256092][ T7285] should_fail_ex.cold+0x5/0xa [ 79.256117][ T7285] __fpu_restore_sig+0x100/0x13b0 [ 79.256148][ T7285] ? __lock_acquire+0x5c0/0x1f40 [ 79.256167][ T7285] ? __pfx___fpu_restore_sig+0x10/0x10 [ 79.256208][ T7285] ? __might_fault+0xc5/0x140 [ 79.256240][ T7285] fpu__restore_sig+0x151/0x190 [ 79.256277][ T7285] restore_sigcontext+0x4cb/0x6a0 [ 79.256305][ T7285] ? __pfx_restore_sigcontext+0x10/0x10 [ 79.256348][ T7285] ? __pfx_restore_altstack+0x10/0x10 [ 79.256376][ T7285] ? _raw_spin_unlock_irq+0x23/0x50 [ 79.256398][ T7285] ? lockdep_hardirqs_on+0x7d/0x110 [ 79.256428][ T7285] __do_sys_rt_sigreturn+0x229/0x2c0 [ 79.256454][ T7285] ? __pfx___ia32_sys_rt_sigreturn+0x10/0x10 [ 79.256490][ T7285] do_syscall_64+0x123/0x790 [ 79.256518][ T7285] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.256535][ T7285] RIP: 0033:0x7f59e299e157 [ 79.256551][ T7285] Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 [ 79.256566][ T7285] RSP: 002b:00007f59e387a0e8 EFLAGS: 00000246 [ 79.256583][ T7285] RAX: 00000000000000ca RBX: 00007f59e2c25fa8 RCX: 00007f59e299e159 [ 79.256595][ T7285] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f59e2c25fa8 [ 79.256606][ T7285] RBP: 00007f59e2c25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 79.256617][ T7285] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 79.256628][ T7285] R13: 00007f59e2c26038 R14: 00007ffc61f92130 R15: 00007ffc61f92218 [ 79.256654][ T7285] [ 79.549598][ T7307] loop5: detected capacity change from 0 to 7 [ 79.549996][ T7307] Dev loop5: unable to read RDB block 7 [ 79.550015][ T7307] loop5: unable to read partition table [ 79.550097][ T7307] loop5: partition table beyond EOD, truncated [ 79.550107][ T7307] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 79.714038][ T7319] fuse: Unknown parameter '\õ0x0000000000000003' [ 79.714859][ T43] kauditd_printk_skb: 23 callbacks suppressed [ 79.714868][ T43] audit: type=1400 audit(1789403817.484:531): avc: denied { create } for pid=7318 comm="syz.0.470" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 79.753454][ T43] audit: type=1400 audit(1789403817.524:532): avc: denied { write } for pid=7318 comm="syz.0.470" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 79.830639][ T7328] EXT4-fs (nbd1): unable to read superblock [ 79.840382][ T7328] overlay: Unknown parameter 'euid>00000000000000000000' [ 79.974462][ T7340] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 79.985884][ T7342] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 80.437572][ T7361] bond1: down delay (12) is not a multiple of miimon (100), value rounded to 0 ms [ 80.828157][ T43] audit: type=1400 audit(1789403818.604:533): avc: denied { create } for pid=7373 comm="syz.0.490" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 80.865808][ T7374] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 81.160062][ T43] audit: type=1400 audit(1789403818.934:534): avc: denied { ioctl } for pid=7380 comm="syz.0.493" path="socket:[18706]" dev="sockfs" ino=18706 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 81.834463][ T7405] gadgetfs: bound to dummy_udc driver [ 81.924738][ T7409] loop5: detected capacity change from 0 to 7 [ 81.929282][ T7409] Dev loop5: unable to read RDB block 7 [ 81.929304][ T7409] loop5: unable to read partition table [ 81.929394][ T7409] loop5: partition table beyond EOD, truncated [ 81.929404][ T7409] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 82.168470][ T7428] __nla_validate_parse: 10 callbacks suppressed [ 82.168484][ T7428] netlink: 8 bytes leftover after parsing attributes in process `syz.1.506'. [ 82.302438][ T7433] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 83.475858][ T5929] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 83.605877][ T5929] usb 6-1: device descriptor read/64, error -71 [ 83.845875][ T5929] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 83.975808][ T5929] usb 6-1: device descriptor read/64, error -71 [ 84.088168][ T5929] usb usb6-port1: attempt power cycle [ 84.426192][ T5929] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 84.446385][ T5929] usb 6-1: device descriptor read/8, error -71 [ 84.638314][ T7399] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 84.688044][ T5929] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 84.706288][ T5929] usb 6-1: device descriptor read/8, error -71 [ 84.725432][ T7448] loop5: detected capacity change from 0 to 7 [ 84.730179][ T7448] Dev loop5: unable to read RDB block 7 [ 84.730207][ T7448] loop5: unable to read partition table [ 84.730358][ T7448] loop5: partition table beyond EOD, truncated [ 84.730377][ T7448] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 84.789419][ T7451] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 84.817747][ T5929] usb usb6-port1: unable to enumerate USB device [ 84.849459][ T7454] netlink: 8 bytes leftover after parsing attributes in process `syz.0.517'. [ 85.137428][ T5822] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 85.285774][ T5822] usb 5-1: Using ep0 maxpacket: 8 [ 85.286210][ T5822] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 85.287107][ T5822] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 85.287121][ T5822] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 85.287133][ T5822] usb 5-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 85.287146][ T5822] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 85.287158][ T5822] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 85.287169][ T5822] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 85.287188][ T5822] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.495044][ T5822] usb 5-1: GET_CAPABILITIES returned 0 [ 85.495069][ T5822] usbtmc 5-1:16.0: can't read capabilities [ 85.667613][ T7482] netlink: 8 bytes leftover after parsing attributes in process `syz.3.525'. [ 85.703101][ T43] audit: type=1400 audit(1789403823.474:535): avc: denied { write } for pid=7455 comm="syz.0.519" name="usbtmc0" dev="devtmpfs" ino=2937 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 85.705275][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.705711][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.705751][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.705785][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.705820][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.710537][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.710577][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.710618][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.710651][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.710682][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.710926][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.710964][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.710998][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.711056][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.711093][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.711332][ C2] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 85.765483][ T5101] usb 5-1: USB disconnect, device number 9 [ 85.829106][ T43] audit: type=1400 audit(1789403823.604:536): avc: denied { name_bind } for pid=7488 comm="syz.3.527" src=65532 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 85.832544][ T43] audit: type=1400 audit(1789403823.604:537): avc: denied { setopt } for pid=7488 comm="syz.3.527" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 85.862191][ T7489] team0: Port device vlan2 added [ 85.957424][ T43] audit: type=1400 audit(1789403823.734:538): avc: denied { read } for pid=7492 comm="syz.3.529" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 85.990609][ T43] audit: type=1400 audit(1789403823.764:539): avc: denied { map } for pid=7494 comm="syz.3.530" path="/dev/zero" dev="devtmpfs" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:zero_device_t tclass=chr_file permissive=1 [ 85.994333][ T7497] Cannot find add_set index 0 as target [ 86.277411][ T43] audit: type=1400 audit(1789403824.054:540): avc: denied { create } for pid=7511 comm="syz.1.535" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 86.344555][ T43] audit: type=1400 audit(1789403824.114:541): avc: denied { write } for pid=7511 comm="syz.1.535" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 86.345152][ T7514] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 86.349848][ T43] audit: type=1400 audit(1789403824.124:542): avc: denied { ioctl } for pid=7511 comm="syz.1.535" path="socket:[11017]" dev="sockfs" ino=11017 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 86.523175][ T7529] netlink: 8 bytes leftover after parsing attributes in process `syz.3.541'. [ 86.527479][ T7525] netlink: 8 bytes leftover after parsing attributes in process `syz.1.540'. [ 86.568904][ T43] audit: type=1400 audit(1789403824.344:543): avc: denied { mounton } for pid=7533 comm="syz.0.543" path="/146/file0" dev="tmpfs" ino=793 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 86.595537][ T43] audit: type=1400 audit(1789403824.364:544): avc: denied { mount } for pid=7533 comm="syz.0.543" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 86.773200][ T7557] capability: warning: `syz.1.550' uses deprecated v2 capabilities in a way that may be insecure [ 86.826023][ T7561] netlink: 8 bytes leftover after parsing attributes in process `syz.1.552'. [ 86.848809][ T7563] Bluetooth: MGMT ver 1.23 [ 86.852278][ T7563] netlink: 64 bytes leftover after parsing attributes in process `syz.0.553'. [ 87.023553][ T7574] binder: 7573:7574 ioctl c0306201 2000000004c0 returned -22 [ 87.118608][ T7580] Bluetooth: hci0: unsupported parameter 5135 [ 87.118622][ T7580] Bluetooth: hci0: unsupported parameter 8192 [ 87.118628][ T7580] Bluetooth: hci0: unsupported parameter 5135 [ 87.118635][ T7580] Bluetooth: hci0: unsupported parameter 8192 [ 87.119876][ T7581] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 87.195448][ T7586] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 87.267335][ T7588] bond0: entered promiscuous mode [ 87.267349][ T7588] bond_slave_0: entered promiscuous mode [ 87.267455][ T7588] bond_slave_1: entered promiscuous mode [ 87.268523][ T7588] batadv0: entered promiscuous mode [ 87.269163][ T7591] 9p: Bad value for 'wfdno' [ 87.269914][ T7588] hsr1: entered promiscuous mode [ 87.270140][ T7588] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 87.271647][ T7588] bond0: left promiscuous mode [ 87.271658][ T7588] bond_slave_0: left promiscuous mode [ 87.271758][ T7588] bond_slave_1: left promiscuous mode [ 87.273455][ T7588] batadv0: left promiscuous mode [ 87.495832][ T5929] usb 5-1: new low-speed USB device number 10 using dummy_hcd [ 87.525085][ T7602] netlink: 8 bytes leftover after parsing attributes in process `syz.1.566'. [ 87.646248][ T5929] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 87.647085][ T5929] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 87.647102][ T5929] usb 5-1: config 0 has no interface number 0 [ 87.647129][ T5929] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 87.647149][ T5929] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 87.647177][ T5929] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.673807][ T5929] usb 5-1: config 0 descriptor?? [ 87.674333][ T7590] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 87.680990][ T5929] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 87.743760][ T7608] veth1_macvtap: left promiscuous mode [ 87.837836][ T74] IPVS: starting estimator thread 0... [ 87.885005][ C0] iowarrior 5-1:0.1: iowarrior_callback - usb_submit_urb failed with result -1 [ 87.886974][ T10] usb 5-1: USB disconnect, device number 10 [ 87.935828][ T7622] IPVS: using max 42 ests per chain, 100800 per kthread [ 87.948201][ T7624] netlink: 'syz.3.572': attribute type 11 has an invalid length. [ 87.999461][ T7625] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7625 comm=syz.3.572 [ 88.235416][ T7641] netlink: 8 bytes leftover after parsing attributes in process `syz.1.578'. [ 88.366945][ T7648] netlink: 20 bytes leftover after parsing attributes in process `syz.1.580'. [ 88.366966][ T7648] netlink: 24 bytes leftover after parsing attributes in process `syz.1.580'. [ 88.381264][ T7648] zero sized request [ 88.457038][ T5440] veth1_vlan: left promiscuous mode [ 88.804594][ T5440] veth1_vlan: entered promiscuous mode [ 89.067286][ T7689] netlink: 8 bytes leftover after parsing attributes in process `syz.3.589'. [ 89.169684][ T5731] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 89.170849][ T5731] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 89.182933][ T5731] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 89.188595][ T5731] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 89.192929][ T5731] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 89.587894][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.624260][ T7692] lo speed is unknown, defaulting to 1000 [ 89.728081][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.736280][ T5101] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 89.822654][ T7740] loop5: detected capacity change from 0 to 7 [ 89.846723][ T7740] Dev loop5: unable to read RDB block 7 [ 89.846754][ T7740] loop5: unable to read partition table [ 89.846871][ T7740] loop5: partition table beyond EOD, truncated [ 89.846906][ T7740] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 89.895903][ T5101] usb 8-1: Using ep0 maxpacket: 8 [ 89.896504][ T5101] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 89.897357][ T5101] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 89.897373][ T5101] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 89.897391][ T5101] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 89.897408][ T5101] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 89.897440][ T5101] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.974965][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.111535][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.144605][ T7755] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60 sclass=netlink_route_socket pid=7755 comm=syz.1.601 [ 90.166939][ T5101] usb 8-1: GET_CAPABILITIES returned 0 [ 90.166962][ T5101] usbtmc 8-1:16.0: can't read capabilities [ 90.233589][ T7692] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.233715][ T7692] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.235155][ T7692] bridge_slave_0: entered allmulticast mode [ 90.240232][ T7692] bridge_slave_0: entered promiscuous mode [ 90.249099][ T7692] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.249179][ T7692] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.249503][ T7692] bridge_slave_1: entered allmulticast mode [ 90.259044][ T7692] bridge_slave_1: entered promiscuous mode [ 90.290845][ T7692] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.293042][ T7692] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.335617][ T7692] team0: Port device team_slave_0 added [ 90.338476][ T7692] team0: Port device team_slave_1 added [ 90.374434][ T50] usb 8-1: USB disconnect, device number 8 [ 90.442046][ T7692] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.442062][ T7692] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.442085][ T7692] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.443686][ T7692] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.443698][ T7692] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.443725][ T7692] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.640641][ T7692] hsr_slave_0: entered promiscuous mode [ 90.641530][ T7692] hsr_slave_1: entered promiscuous mode [ 90.642104][ T7692] debugfs: 'hsr0' already exists in 'hsr' [ 90.642121][ T7692] Cannot create hsr debugfs directory [ 90.649066][ T7774] loop5: detected capacity change from 0 to 7 [ 90.654776][ T7774] Dev loop5: unable to read RDB block 7 [ 90.654803][ T7774] loop5: unable to read partition table [ 90.654920][ T7774] loop5: partition table beyond EOD, truncated [ 90.654942][ T7774] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 90.669456][ T12] bridge_slave_1: left allmulticast mode [ 90.669490][ T12] bridge_slave_1: left promiscuous mode [ 90.670434][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.710445][ T43] kauditd_printk_skb: 917 callbacks suppressed [ 90.710466][ T43] audit: type=1400 audit(1789403828.484:649): avc: denied { read } for pid=7776 comm="syz.0.607" name="usbmon5" dev="devtmpfs" ino=752 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 90.710509][ T43] audit: type=1400 audit(1789403828.484:650): avc: denied { open } for pid=7776 comm="syz.0.607" path="/dev/usbmon5" dev="devtmpfs" ino=752 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 90.718717][ T12] bridge_slave_0: left allmulticast mode [ 90.718741][ T12] bridge_slave_0: left promiscuous mode [ 90.718928][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.725771][ T7777] netlink: 8 bytes leftover after parsing attributes in process `syz.0.607'. [ 90.726329][ T7777] netlink: 20 bytes leftover after parsing attributes in process `syz.0.607'. [ 90.951942][ T7796] netlink: 8 bytes leftover after parsing attributes in process `syz.1.612'. [ 91.068589][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 91.077376][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 91.082071][ T43] audit: type=1400 audit(1789403828.854:651): avc: denied { create } for pid=7785 comm="syz.0.609" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 91.094117][ T12] bond0 (unregistering): Released all slaves [ 91.131464][ T7808] netlink: 'syz.0.617': attribute type 1 has an invalid length. [ 91.131479][ T7808] netlink: 104088 bytes leftover after parsing attributes in process `syz.0.617'. [ 91.155198][ T5440] 8021q: adding VLAN 0 to HW filter on device eth2 [ 91.189502][ T43] audit: type=1400 audit(1789403828.964:652): avc: denied { create } for pid=7807 comm="syz.0.617" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 91.201182][ T43] audit: type=1400 audit(1789403828.974:653): avc: denied { setopt } for pid=7807 comm="syz.0.617" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 91.237469][ T5743] Bluetooth: hci4: command tx timeout [ 91.316257][ T7825] netlink: 8 bytes leftover after parsing attributes in process `syz.0.621'. [ 91.417645][ T7837] loop5: detected capacity change from 0 to 7 [ 91.418401][ T7837] Dev loop5: unable to read RDB block 7 [ 91.418421][ T7837] loop5: unable to read partition table [ 91.418503][ T7837] loop5: partition table beyond EOD, truncated [ 91.418544][ T7837] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 91.496934][ T43] audit: type=1400 audit(1789403829.274:654): avc: denied { mount } for pid=7839 comm="syz.1.625" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 91.499333][ T7834] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 91.529591][ T43] audit: type=1400 audit(1789403829.304:655): avc: denied { unmount } for pid=5737 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 91.587391][ T7834] nvme_fabrics: unknown parameter or missing value 'Jû' in ctrl creation request [ 91.608671][ T43] audit: type=1400 audit(1789403829.384:656): avc: denied { write } for pid=7844 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 91.704827][ T43] audit: type=1400 audit(1789403829.474:657): avc: denied { write } for pid=7853 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 91.765175][ T43] audit: type=1400 audit(1789403829.534:658): avc: denied { mount } for pid=7857 comm="syz.3.631" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 91.862873][ T7869] loop5: detected capacity change from 0 to 7 [ 91.864384][ T7869] Dev loop5: unable to read RDB block 7 [ 91.864416][ T7869] loop5: unable to read partition table [ 91.864556][ T7869] loop5: partition table beyond EOD, truncated [ 91.864572][ T7869] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 91.910587][ T5440] 8021q: adding VLAN 0 to HW filter on device eth3 [ 92.053899][ T7692] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 92.061760][ T7692] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 92.062392][ T7692] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 92.067982][ T7692] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 92.068334][ T7692] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 92.083871][ T7692] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 92.092268][ T7692] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 92.104721][ T7692] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 92.182288][ T12] hsr_slave_0: left promiscuous mode [ 92.184095][ T12] hsr_slave_1: left promiscuous mode [ 92.184568][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 92.184590][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 92.199312][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 92.199327][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 92.276740][ T12] veth1_macvtap: left promiscuous mode [ 92.276789][ T12] veth0_macvtap: left promiscuous mode [ 92.276905][ T12] veth1_vlan: left promiscuous mode [ 92.276974][ T12] veth0_vlan: left promiscuous mode [ 92.484488][ T12] team0 (unregistering): Port device team_slave_1 removed [ 92.496652][ T12] team0 (unregistering): Port device team_slave_0 removed [ 92.567983][ T5440] 8021q: adding VLAN 0 to HW filter on device eth4 [ 92.703826][ T7692] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.712728][ T7692] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.731905][ T623] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.731950][ T623] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.735117][ T623] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.735159][ T623] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.888795][ T7941] __nla_validate_parse: 2 callbacks suppressed [ 92.888806][ T7941] netlink: 36 bytes leftover after parsing attributes in process `syz.0.647'. [ 92.979425][ T5440] 8021q: adding VLAN 0 to HW filter on device eth5 [ 93.009535][ T7956] gadgetfs: bound to dummy_udc driver [ 93.020157][ T7958] netlink: 8 bytes leftover after parsing attributes in process `syz.3.653'. [ 93.069577][ T7692] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.102835][ T7967] misc userio: Begin command sent, but we're already running [ 93.142036][ T7966] ipvlan2: entered allmulticast mode [ 93.142050][ T7966] batadv0: entered allmulticast mode [ 93.144208][ T7966] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 93.235539][ T7692] veth0_vlan: entered promiscuous mode [ 93.240499][ T7692] veth1_vlan: entered promiscuous mode [ 93.261641][ T7692] veth0_macvtap: entered promiscuous mode [ 93.263717][ T7692] veth1_macvtap: entered promiscuous mode [ 93.271326][ T7692] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.274661][ T7692] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.316709][ T5743] Bluetooth: hci4: command tx timeout [ 93.327627][ T5807] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.327651][ T5807] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.327669][ T5807] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.327686][ T5807] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.359925][ T74] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.359939][ T74] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.403866][ T1168] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.403880][ T1168] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.461580][ T7989] gadgetfs: bound to dummy_udc driver [ 93.524573][ T5743] Bluetooth: hci1: SCO packet for unknown connection handle 768 [ 93.565782][ T7991] syzkaller1: entered promiscuous mode [ 93.565797][ T7991] syzkaller1: entered allmulticast mode [ 93.573108][ T7996] netlink: 8 bytes leftover after parsing attributes in process `syz.3.664'. [ 93.792039][ T5822] Process accounting resumed [ 93.831394][ T8010] gadgetfs: bound to dummy_udc driver [ 93.852612][ T8012] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8012 comm=syz.3.673 [ 93.853818][ T8012] netlink: 8 bytes leftover after parsing attributes in process `syz.3.673'. [ 93.853837][ T8012] netlink: 12 bytes leftover after parsing attributes in process `syz.3.673'. [ 93.900493][ T8012] netlink: 8 bytes leftover after parsing attributes in process `syz.3.673'. [ 93.900525][ T8012] netlink: 12 bytes leftover after parsing attributes in process `syz.3.673'. [ 93.906383][ T12] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 93.906879][ T12] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 93.907428][ T12] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 93.908032][ T12] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 93.910028][ T8017] netlink: 8 bytes leftover after parsing attributes in process `syz.1.674'. [ 94.328964][ T8042] lo speed is unknown, defaulting to 1000 [ 94.355198][ T8046] gadgetfs: bound to dummy_udc driver [ 94.488262][ T8053] netlink: 8 bytes leftover after parsing attributes in process `syz.3.685'. [ 94.754230][ T8061] bond0: (slave ip_vti0): Error: Device can not be enslaved while up [ 95.031078][ T8081] gadgetfs: bound to dummy_udc driver [ 95.290310][ T8100] loop5: detected capacity change from 0 to 7 [ 95.294584][ T8100] Dev loop5: unable to read RDB block 7 [ 95.294618][ T8100] loop5: unable to read partition table [ 95.294774][ T8100] loop5: partition table beyond EOD, truncated [ 95.295323][ T8100] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 95.395959][ T5743] Bluetooth: hci4: command tx timeout [ 95.708862][ T8113] overlay: Unknown parameter 'euid<00000000000000060929' [ 95.762752][ T8114] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 96.203645][ T8103] check_preemption_disabled: 83 callbacks suppressed [ 96.203673][ T8103] BUG: using smp_processor_id() in preemptible [00000000] code: syz.0.703/8103 [ 96.203688][ T8103] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 96.203728][ T8103] CPU: 3 UID: 0 PID: 8103 Comm: syz.0.703 Tainted: G L syzkaller #0 PREEMPT(full) [ 96.203755][ T8103] Tainted: [L]=SOFTLOCKUP [ 96.203761][ T8103] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.203772][ T8103] Call Trace: [ 96.203779][ T8103] [ 96.203787][ T8103] dump_stack_lvl+0x100/0x190 [ 96.203817][ T8103] check_preemption_disabled+0xd2/0xe0 [ 96.203855][ T8103] ? bpf_prog_test_run_skb+0x12c5/0x3530 [ 96.203875][ T8103] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 96.203904][ T8103] ? bpf_prog_test_run_skb+0x12c5/0x3530 [ 96.203925][ T8103] trace_kfree_skb+0x18b/0x230 [ 96.203954][ T8103] sk_skb_reason_drop+0xb7/0x1b0 [ 96.203980][ T8103] bpf_prog_test_run_skb+0x12c5/0x3530 [ 96.204004][ T8103] ? lock_acquire+0x1d1/0x380 [ 96.204028][ T8103] ? __fget_files+0x1e1/0x3d0 [ 96.204064][ T8103] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 96.204086][ T8103] ? fput+0x7c/0x100 [ 96.204113][ T8103] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 96.204134][ T8103] __sys_bpf+0x2265/0x4a30 [ 96.204159][ T8103] ? __pfx___sys_bpf+0x10/0x10 [ 96.204176][ T8103] ? find_held_lock+0x2b/0x80 [ 96.204201][ T8103] ? futex_wake+0x4ea/0x5e0 [ 96.204267][ T8103] ? __x64_sys_futex+0x34f/0x4d0 [ 96.204290][ T8103] ? __x64_sys_futex+0x358/0x4d0 [ 96.204313][ T8103] ? __sys_socket+0xac/0x260 [ 96.204331][ T8103] ? xfd_validate_state+0x129/0x190 [ 96.204353][ T8103] ? __x64_sys_bpf+0xce/0x140 [ 96.204369][ T8103] __x64_sys_bpf+0xce/0x140 [ 96.204388][ T8103] ? do_syscall_64+0xae/0x790 [ 96.204414][ T8103] do_syscall_64+0x123/0x790 [ 96.204440][ T8103] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.204460][ T8103] RIP: 0033:0x7efd59b9e159 [ 96.204477][ T8103] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.204494][ T8103] RSP: 002b:00007efd5a98f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 96.204515][ T8103] RAX: ffffffffffffffda RBX: 00007efd59e25fa0 RCX: 00007efd59b9e159 [ 96.204528][ T8103] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 96.204540][ T8103] RBP: 00007efd59c3503b R08: 0000000000000000 R09: 0000000000000000 [ 96.204551][ T8103] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.204562][ T8103] R13: 00007efd59e26038 R14: 00007efd59e25fa0 R15: 00007ffd65189c78 [ 96.204588][ T8103] [ 96.204859][ T8104] BUG: using smp_processor_id() in preemptible [00000000] code: syz.1.704/8104 [ 96.204874][ T8104] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 96.204899][ T8104] CPU: 0 UID: 0 PID: 8104 Comm: syz.1.704 Tainted: G L syzkaller #0 PREEMPT(full) [ 96.204915][ T8104] Tainted: [L]=SOFTLOCKUP [ 96.204920][ T8104] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.204927][ T8104] Call Trace: [ 96.204931][ T8104] [ 96.204936][ T8104] dump_stack_lvl+0x100/0x190 [ 96.204954][ T8104] check_preemption_disabled+0xd2/0xe0 [ 96.204971][ T8104] ? tun_queue_purge+0x1ee/0x340 [ 96.204996][ T8104] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 96.205013][ T8104] ? tun_queue_purge+0x1ee/0x340 [ 96.205025][ T8104] trace_kfree_skb+0x18b/0x230 [ 96.205041][ T8104] sk_skb_reason_drop+0xb7/0x1b0 [ 96.205056][ T8104] tun_queue_purge+0x1ee/0x340 [ 96.205070][ T8104] __tun_detach+0xb70/0x1850 [ 96.205081][ T8104] ? locks_remove_file+0xd1/0x600 [ 96.205095][ T8104] ? __pfx_tun_chr_close+0x10/0x10 [ 96.205106][ T8104] tun_chr_close+0xc2/0x220 [ 96.205117][ T8104] ? __pfx_tun_chr_close+0x10/0x10 [ 96.205131][ T8104] __fput+0x3ff/0xb50 [ 96.205148][ T8104] task_work_run+0x150/0x240 [ 96.205165][ T8104] ? __pfx_task_work_run+0x10/0x10 [ 96.205185][ T8104] exit_to_user_mode_loop+0x1d8/0x700 [ 96.205200][ T8104] ? rcu_is_watching+0x13/0xc0 [ 96.205216][ T8104] do_syscall_64+0x661/0x790 [ 96.205231][ T8104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.205243][ T8104] RIP: 0033:0x7f59e299e159 [ 96.205252][ T8104] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.205263][ T8104] RSP: 002b:00007f59e387a028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 96.205274][ T8104] RAX: 0000000000000000 RBX: 00007f59e2c25fa0 RCX: 00007f59e299e159 [ 96.205280][ T8104] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000003 [ 96.205287][ T8104] RBP: 00007f59e2a3503b R08: 0000000000000000 R09: 0000000000000000 [ 96.205293][ T8104] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.205300][ T8104] R13: 00007f59e2c26038 R14: 00007f59e2c25fa0 R15: 00007ffc61f92218 [ 96.205313][ T8104] [ 96.205367][ T8104] BUG: using smp_processor_id() in preemptible [00000000] code: syz.1.704/8104 [ 96.205410][ T8104] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 96.205432][ T8104] CPU: 0 UID: 0 PID: 8104 Comm: syz.1.704 Tainted: G L syzkaller #0 PREEMPT(full) [ 96.205447][ T8104] Tainted: [L]=SOFTLOCKUP [ 96.205451][ T8104] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.205458][ T8104] Call Trace: [ 96.205462][ T8104] [ 96.205467][ T8104] dump_stack_lvl+0x100/0x190 [ 96.205483][ T8104] check_preemption_disabled+0xd2/0xe0 [ 96.205500][ T8104] ? tun_queue_purge+0x1ee/0x340 [ 96.205511][ T8104] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 96.205528][ T8104] ? tun_queue_purge+0x1ee/0x340 [ 96.205539][ T8104] trace_kfree_skb+0x18b/0x230 [ 96.205568][ T8104] sk_skb_reason_drop+0xb7/0x1b0 [ 96.205585][ T8104] tun_queue_purge+0x1ee/0x340 [ 96.205599][ T8104] __tun_detach+0xb70/0x1850 [ 96.205609][ T8104] ? locks_remove_file+0xd1/0x600 [ 96.205628][ T8104] ? __pfx_tun_chr_close+0x10/0x10 [ 96.205641][ T8104] tun_chr_close+0xc2/0x220 [ 96.205653][ T8104] ? __pfx_tun_chr_close+0x10/0x10 [ 96.205665][ T8104] __fput+0x3ff/0xb50 [ 96.205682][ T8104] task_work_run+0x150/0x240 [ 96.205700][ T8104] ? __pfx_task_work_run+0x10/0x10 [ 96.205721][ T8104] exit_to_user_mode_loop+0x1d8/0x700 [ 96.205734][ T8104] ? rcu_is_watching+0x13/0xc0 [ 96.205751][ T8104] do_syscall_64+0x661/0x790 [ 96.205767][ T8104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.205778][ T8104] RIP: 0033:0x7f59e299e159 [ 96.205787][ T8104] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.205797][ T8104] RSP: 002b:00007f59e387a028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 96.205807][ T8104] RAX: 0000000000000000 RBX: 00007f59e2c25fa0 RCX: 00007f59e299e159 [ 96.205813][ T8104] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000003 [ 96.205819][ T8104] RBP: 00007f59e2a3503b R08: 0000000000000000 R09: 0000000000000000 [ 96.205826][ T8104] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.205832][ T8104] R13: 00007f59e2c26038 R14: 00007f59e2c25fa0 R15: 00007ffc61f92218 [ 96.205845][ T8104] [ 96.219274][ T43] audit: type=1400 audit(1789403833.994:737): avc: denied { write } for pid=5715 comm="syz-executor" path="pipe:[1571]" dev="pipefs" ino=1571 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 96.221452][ T8104] BUG: using smp_processor_id() in preemptible [00000000] code: syz.1.704/8104 [ 96.221466][ T8104] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 96.221499][ T8104] CPU: 0 UID: 0 PID: 8104 Comm: syz.1.704 Tainted: G L syzkaller #0 PREEMPT(full) [ 96.221523][ T8104] Tainted: [L]=SOFTLOCKUP [ 96.221529][ T8104] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.221539][ T8104] Call Trace: [ 96.221544][ T8104] [ 96.221551][ T8104] dump_stack_lvl+0x100/0x190 [ 96.221569][ T8104] check_preemption_disabled+0xd2/0xe0 [ 96.221601][ T8104] ? tun_queue_purge+0x1ee/0x340 [ 96.221617][ T8104] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 96.221644][ T8104] ? tun_queue_purge+0x1ee/0x340 [ 96.221663][ T8104] trace_kfree_skb+0x18b/0x230 [ 96.221691][ T8104] sk_skb_reason_drop+0xb7/0x1b0 [ 96.221709][ T8104] tun_queue_purge+0x1ee/0x340 [ 96.221723][ T8104] __tun_detach+0xb70/0x1850 [ 96.221734][ T8104] ? locks_remove_file+0xd1/0x600 [ 96.221748][ T8104] ? __pfx_tun_chr_close+0x10/0x10 [ 96.221762][ T8104] tun_chr_close+0xc2/0x220 [ 96.221781][ T8104] ? __pfx_tun_chr_close+0x10/0x10 [ 96.221798][ T8104] __fput+0x3ff/0xb50 [ 96.221826][ T8104] task_work_run+0x150/0x240 [ 96.221844][ T8104] ? __pfx_task_work_run+0x10/0x10 [ 96.221868][ T8104] exit_to_user_mode_loop+0x1d8/0x700 [ 96.221889][ T8104] ? rcu_is_watching+0x13/0xc0 [ 96.221915][ T8104] do_syscall_64+0x661/0x790 [ 96.221938][ T8104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.221949][ T8104] RIP: 0033:0x7f59e299e159 [ 96.221962][ T8104] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.221978][ T8104] RSP: 002b:00007f59e387a028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 96.221996][ T8104] RAX: 0000000000000000 RBX: 00007f59e2c25fa0 RCX: 00007f59e299e159 [ 96.222008][ T8104] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000003 [ 96.222020][ T8104] RBP: 00007f59e2a3503b R08: 0000000000000000 R09: 0000000000000000 [ 96.222030][ T8104] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.222036][ T8104] R13: 00007f59e2c26038 R14: 00007f59e2c25fa0 R15: 00007ffc61f92218 [ 96.222049][ T8104] [ 97.941630][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.075087][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.083387][ T6125] BUG: using smp_processor_id() in preemptible [00000000] code: syz.0.74/6125 [ 98.083409][ T6125] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 98.083448][ T6125] CPU: 0 UID: 0 PID: 6125 Comm: syz.0.74 Tainted: G L syzkaller #0 PREEMPT(full) [ 98.083472][ T6125] Tainted: [L]=SOFTLOCKUP [ 98.083480][ T6125] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.083490][ T6125] Call Trace: [ 98.083498][ T6125] [ 98.083505][ T6125] dump_stack_lvl+0x100/0x190 [ 98.083535][ T6125] check_preemption_disabled+0xd2/0xe0 [ 98.083563][ T6125] ? skb_queue_purge_reason+0x2aa/0x420 [ 98.083585][ T6125] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 98.083613][ T6125] ? skb_queue_purge_reason+0x2aa/0x420 [ 98.083637][ T6125] trace_kfree_skb+0x18b/0x230 [ 98.083665][ T6125] sk_skb_reason_drop+0xb7/0x1b0 [ 98.083689][ T6125] skb_queue_purge_reason+0x2aa/0x420 [ 98.083712][ T6125] ? synchronize_rcu_expedited+0x3c3/0x450 [ 98.083736][ T6125] ? __pfx_skb_queue_purge_reason+0x10/0x10 [ 98.083776][ T6125] packet_release+0x839/0xd70 [ 98.083803][ T6125] ? __pfx_packet_release+0x10/0x10 [ 98.083824][ T6125] ? __pfx_down_write+0x10/0x10 [ 98.083851][ T6125] ? __pfx_locks_remove_file+0x10/0x10 [ 98.083872][ T6125] __sock_release+0xb3/0x260 [ 98.083893][ T6125] ? __pfx_sock_close+0x10/0x10 [ 98.083913][ T6125] sock_close+0x1c/0x30 [ 98.083933][ T6125] __fput+0x3ff/0xb50 [ 98.083962][ T6125] task_work_run+0x150/0x240 [ 98.083990][ T6125] ? __pfx_task_work_run+0x10/0x10 [ 98.084023][ T6125] do_exit+0x951/0x2ae0 [ 98.084051][ T6125] ? __pfx_do_exit+0x10/0x10 [ 98.084077][ T6125] ? cgroup_update_frozen_flag+0x125/0x240 [ 98.084106][ T6125] ? find_held_lock+0x2b/0x80 [ 98.084130][ T6125] ? get_signal+0x184f/0x21e0 [ 98.084153][ T6125] do_group_exit+0xd5/0x2a0 [ 98.084179][ T6125] get_signal+0x1ec7/0x21e0 [ 98.084209][ T6125] ? __pfx_get_signal+0x10/0x10 [ 98.084227][ T6125] ? __pfx_hrtimer_nanosleep+0x10/0x10 [ 98.084262][ T6125] arch_do_signal_or_restart+0x91/0x7e0 [ 98.084288][ T6125] ? get_timespec64+0x147/0x240 [ 98.084308][ T6125] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 98.084339][ T6125] ? __x64_sys_clock_nanosleep+0x347/0x480 [ 98.084359][ T6125] exit_to_user_mode_loop+0x139/0x700 [ 98.084378][ T6125] ? rcu_is_watching+0x13/0xc0 [ 98.084401][ T6125] do_syscall_64+0x661/0x790 [ 98.084424][ T6125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.084442][ T6125] RIP: 0033:0x7efd59b5e98e [ 98.084457][ T6125] Code: Unable to access opcode bytes at 0x7efd59b5e964. [ 98.084465][ T6125] RSP: 002b:00007efd5a98ef58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 98.084483][ T6125] RAX: fffffffffffffdfc RBX: 00007efd5a98f6c0 RCX: 00007efd59b5e98e [ 98.084494][ T6125] RDX: 00007efd5a98efb0 RSI: 0000000000000000 RDI: 0000000000000000 [ 98.084505][ T6125] RBP: 00007efd59c3503b R08: 0000000000000000 R09: 0000000000000000 [ 98.084515][ T6125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.084526][ T6125] R13: 00007efd59e26038 R14: 00007efd59e25fa0 R15: 00007ffd65189c78 [ 98.084550][ T6125] [ 98.084788][ T6125] BUG: using smp_processor_id() in preemptible [00000000] code: syz.0.74/6125 [ 98.084802][ T6125] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 98.084834][ T6125] CPU: 0 UID: 0 PID: 6125 Comm: syz.0.74 Tainted: G L syzkaller #0 PREEMPT(full) [ 98.084858][ T6125] Tainted: [L]=SOFTLOCKUP [ 98.084864][ T6125] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.084874][ T6125] Call Trace: [ 98.084880][ T6125] [ 98.084887][ T6125] dump_stack_lvl+0x100/0x190 [ 98.084913][ T6125] check_preemption_disabled+0xd2/0xe0 [ 98.084939][ T6125] ? skb_queue_purge_reason+0x2aa/0x420 [ 98.084977][ T6125] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 98.085005][ T6125] ? skb_queue_purge_reason+0x2aa/0x420 [ 98.085028][ T6125] trace_kfree_skb+0x18b/0x230 [ 98.085054][ T6125] sk_skb_reason_drop+0xb7/0x1b0 [ 98.085084][ T6125] skb_queue_purge_reason+0x2aa/0x420 [ 98.085107][ T6125] ? synchronize_rcu_expedited+0x3c3/0x450 [ 98.085129][ T6125] ? __pfx_skb_queue_purge_reason+0x10/0x10 [ 98.085169][ T6125] packet_release+0x839/0xd70 [ 98.085194][ T6125] ? __pfx_packet_release+0x10/0x10 [ 98.085216][ T6125] ? __pfx_down_write+0x10/0x10 [ 98.085242][ T6125] ? __pfx_locks_remove_file+0x10/0x10 [ 98.085263][ T6125] __sock_release+0xb3/0x260 [ 98.085284][ T6125] ? __pfx_sock_close+0x10/0x10 [ 98.085305][ T6125] sock_close+0x1c/0x30 [ 98.085326][ T6125] __fput+0x3ff/0xb50 [ 98.085355][ T6125] task_work_run+0x150/0x240 [ 98.085383][ T6125] ? __pfx_task_work_run+0x10/0x10 [ 98.085416][ T6125] do_exit+0x951/0x2ae0 [ 98.085444][ T6125] ? __pfx_do_exit+0x10/0x10 [ 98.085464][ T6125] ? cgroup_update_frozen_flag+0x125/0x240 [ 98.085492][ T6125] ? find_held_lock+0x2b/0x80 [ 98.085516][ T6125] ? get_signal+0x184f/0x21e0 [ 98.085537][ T6125] do_group_exit+0xd5/0x2a0 [ 98.085579][ T6125] get_signal+0x1ec7/0x21e0 [ 98.085607][ T6125] ? __pfx_get_signal+0x10/0x10 [ 98.085625][ T6125] ? __pfx_hrtimer_nanosleep+0x10/0x10 [ 98.085659][ T6125] arch_do_signal_or_restart+0x91/0x7e0 [ 98.085684][ T6125] ? get_timespec64+0x147/0x240 [ 98.085703][ T6125] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 98.085737][ T6125] ? __x64_sys_clock_nanosleep+0x347/0x480 [ 98.085763][ T6125] exit_to_user_mode_loop+0x139/0x700 [ 98.085784][ T6125] ? rcu_is_watching+0x13/0xc0 [ 98.085809][ T6125] do_syscall_64+0x661/0x790 [ 98.085836][ T6125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.085855][ T6125] RIP: 0033:0x7efd59b5e98e [ 98.085869][ T6125] Code: Unable to access opcode bytes at 0x7efd59b5e964. [ 98.085877][ T6125] RSP: 002b:00007efd5a98ef58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 98.085894][ T6125] RAX: fffffffffffffdfc RBX: 00007efd5a98f6c0 RCX: 00007efd59b5e98e [ 98.085906][ T6125] RDX: 00007efd5a98efb0 RSI: 0000000000000000 RDI: 0000000000000000 [ 98.085916][ T6125] RBP: 00007efd59c3503b R08: 0000000000000000 R09: 0000000000000000 [ 98.085927][ T6125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.085937][ T6125] R13: 00007efd59e26038 R14: 00007efd59e25fa0 R15: 00007ffd65189c78 [ 98.085961][ T6125] [ 98.089580][ T6125] BUG: using smp_processor_id() in preemptible [00000000] code: syz.0.74/6125 [ 98.089594][ T6125] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 98.089621][ T6125] CPU: 0 UID: 0 PID: 6125 Comm: syz.0.74 Tainted: G L syzkaller #0 PREEMPT(full) [ 98.089643][ T6125] Tainted: [L]=SOFTLOCKUP [ 98.089648][ T6125] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.089658][ T6125] Call Trace: [ 98.089664][ T6125] [ 98.089671][ T6125] dump_stack_lvl+0x100/0x190 [ 98.089696][ T6125] check_preemption_disabled+0xd2/0xe0 [ 98.089722][ T6125] ? skb_queue_purge_reason+0x2aa/0x420 [ 98.089744][ T6125] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 98.089771][ T6125] ? skb_queue_purge_reason+0x2aa/0x420 [ 98.089793][ T6125] trace_kfree_skb+0x18b/0x230 [ 98.089836][ T6125] sk_skb_reason_drop+0xb7/0x1b0 [ 98.089861][ T6125] skb_queue_purge_reason+0x2aa/0x420 [ 98.089883][ T6125] ? synchronize_rcu_expedited+0x3c3/0x450 [ 98.089905][ T6125] ? __pfx_skb_queue_purge_reason+0x10/0x10 [ 98.089945][ T6125] packet_release+0x839/0xd70 [ 98.089971][ T6125] ? __pfx_packet_release+0x10/0x10 [ 98.089993][ T6125] ? __pfx_down_write+0x10/0x10 [ 98.090019][ T6125] ? __pfx_locks_remove_file+0x10/0x10 [ 98.090040][ T6125] __sock_release+0xb3/0x260 [ 98.090068][ T6125] ? __pfx_sock_close+0x10/0x10 [ 98.090090][ T6125] sock_close+0x1c/0x30 [ 98.090110][ T6125] __fput+0x3ff/0xb50 [ 98.090139][ T6125] task_work_run+0x150/0x240 [ 98.090167][ T6125] ? __pfx_task_work_run+0x10/0x10 [ 98.090200][ T6125] do_exit+0x951/0x2ae0 [ 98.090227][ T6125] ? __pfx_do_exit+0x10/0x10 [ 98.090249][ T6125] ? cgroup_update_frozen_flag+0x125/0x240 [ 98.090276][ T6125] ? find_held_lock+0x2b/0x80 [ 98.090300][ T6125] ? get_signal+0x184f/0x21e0 [ 98.090323][ T6125] do_group_exit+0xd5/0x2a0 [ 98.090348][ T6125] get_signal+0x1ec7/0x21e0 [ 98.090377][ T6125] ? __pfx_get_signal+0x10/0x10 [ 98.090396][ T6125] ? __pfx_hrtimer_nanosleep+0x10/0x10 [ 98.090430][ T6125] arch_do_signal_or_restart+0x91/0x7e0 [ 98.090456][ T6125] ? get_timespec64+0x147/0x240 [ 98.090475][ T6125] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 98.090509][ T6125] ? __x64_sys_clock_nanosleep+0x347/0x480 [ 98.090534][ T6125] exit_to_user_mode_loop+0x139/0x700 [ 98.090555][ T6125] ? rcu_is_watching+0x13/0xc0 [ 98.090580][ T6125] do_syscall_64+0x661/0x790 [ 98.090607][ T6125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.090625][ T6125] RIP: 0033:0x7efd59b5e98e [ 98.090640][ T6125] Code: Unable to access opcode bytes at 0x7efd59b5e964. [ 98.090648][ T6125] RSP: 002b:00007efd5a98ef58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 98.090666][ T6125] RAX: fffffffffffffdfc RBX: 00007efd5a98f6c0 RCX: 00007efd59b5e98e [ 98.090678][ T6125] RDX: 00007efd5a98efb0 RSI: 0000000000000000 RDI: 0000000000000000 [ 98.090688][ T6125] RBP: 00007efd59c3503b R08: 0000000000000000 R09: 0000000000000000 [ 98.090699][ T6125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.090710][ T6125] R13: 00007efd59e26038 R14: 00007efd59e25fa0 R15: 00007ffd65189c78 [ 98.090735][ T6125] [ 98.090814][ T6125] BUG: using smp_processor_id() in preemptible [00000000] code: syz.0.74/6125 [ 98.090828][ T6125] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 98.090858][ T6125] CPU: 0 UID: 0 PID: 6125 Comm: syz.0.74 Tainted: G L syzkaller #0 PREEMPT(full) [ 98.090881][ T6125] Tainted: [L]=SOFTLOCKUP [ 98.090887][ T6125] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.090898][ T6125] Call Trace: [ 98.090903][ T6125] [ 98.090910][ T6125] dump_stack_lvl+0x100/0x190 [ 98.090936][ T6125] check_preemption_disabled+0xd2/0xe0 [ 98.090985][ T6125] ? skb_queue_purge_reason+0x2aa/0x420 [ 98.091009][ T6125] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 98.091036][ T6125] ? skb_queue_purge_reason+0x2aa/0x420 [ 98.091061][ T6125] trace_kfree_skb+0x18b/0x230 [ 98.091094][ T6125] sk_skb_reason_drop+0xb7/0x1b0 [ 98.091119][ T6125] skb_queue_purge_reason+0x2aa/0x420 [ 98.091145][ T6125] ? synchronize_rcu_expedited+0x3c3/0x450 [ 98.091168][ T6125] ? __pfx_skb_queue_purge_reason+0x10/0x10 [ 98.091208][ T6125] packet_release+0x839/0xd70 [ 98.091233][ T6125] ? __pfx_packet_release+0x10/0x10 [ 98.091255][ T6125] ? __pfx_down_write+0x10/0x10 [ 98.091281][ T6125] ? __pfx_locks_remove_file+0x10/0x10 [ 98.091302][ T6125] __sock_release+0xb3/0x260 [ 98.091323][ T6125] ? __pfx_sock_close+0x10/0x10 [ 98.091345][ T6125] sock_close+0x1c/0x30 [ 98.091365][ T6125] __fput+0x3ff/0xb50 [ 98.091411][ T6125] task_work_run+0x150/0x240 [ 98.091440][ T6125] ? __pfx_task_work_run+0x10/0x10 [ 98.091474][ T6125] do_exit+0x951/0x2ae0 [ 98.091501][ T6125] ? __pfx_do_exit+0x10/0x10 [ 98.091522][ T6125] ? cgroup_update_frozen_flag+0x125/0x240 [ 98.091550][ T6125] ? find_held_lock+0x2b/0x80 [ 98.091573][ T6125] ? get_signal+0x184f/0x21e0 [ 98.091595][ T6125] do_group_exit+0xd5/0x2a0 [ 98.091620][ T6125] get_signal+0x1ec7/0x21e0 [ 98.091649][ T6125] ? __pfx_get_signal+0x10/0x10 [ 98.091667][ T6125] ? __pfx_hrtimer_nanosleep+0x10/0x10 [ 98.091701][ T6125] arch_do_signal_or_restart+0x91/0x7e0 [ 98.091726][ T6125] ? get_timespec64+0x147/0x240 [ 98.091745][ T6125] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 98.091779][ T6125] ? __x64_sys_clock_nanosleep+0x347/0x480 [ 98.091803][ T6125] exit_to_user_mode_loop+0x139/0x700 [ 98.091825][ T6125] ? rcu_is_watching+0x13/0xc0 [ 98.091851][ T6125] do_syscall_64+0x661/0x790 [ 98.091877][ T6125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.091895][ T6125] RIP: 0033:0x7efd59b5e98e [ 98.091909][ T6125] Code: Unable to access opcode bytes at 0x7efd59b5e964. [ 98.091917][ T6125] RSP: 002b:00007efd5a98ef58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 98.091933][ T6125] RAX: fffffffffffffdfc RBX: 00007efd5a98f6c0 RCX: 00007efd59b5e98e [ 98.091945][ T6125] RDX: 00007efd5a98efb0 RSI: 0000000000000000 RDI: 0000000000000000 [ 98.091955][ T6125] RBP: 00007efd59c3503b R08: 0000000000000000 R09: 0000000000000000 [ 98.091966][ T6125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.091976][ T6125] R13: 00007efd59e26038 R14: 00007efd59e25fa0 R15: 00007ffd65189c78 [ 98.092001][ T6125] [ 98.096415][ T6125] BUG: using smp_processor_id() in preemptible [00000000] code: syz.0.74/6125 [ 98.096426][ T6125] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 98.096447][ T6125] CPU: 0 UID: 0 PID: 6125 Comm: syz.0.74 Tainted: G L syzkaller #0 PREEMPT(full) [ 98.096461][ T6125] Tainted: [L]=SOFTLOCKUP [ 98.096465][ T6125] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.096471][ T6125] Call Trace: [ 98.096475][ T6125] [ 98.096479][ T6125] dump_stack_lvl+0x100/0x190 [ 98.096495][ T6125] check_preemption_disabled+0xd2/0xe0 [ 98.096513][ T6125] ? skb_queue_purge_reason+0x2aa/0x420 [ 98.096526][ T6125] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 98.096543][ T6125] ? skb_queue_purge_reason+0x2aa/0x420 [ 98.096558][ T6125] trace_kfree_skb+0x18b/0x230 [ 98.096577][ T6125] sk_skb_reason_drop+0xb7/0x1b0 [ 98.096591][ T6125] skb_queue_purge_reason+0x2aa/0x420 [ 98.096605][ T6125] ? synchronize_rcu_expedited+0x3c3/0x450 [ 98.096619][ T6125] ? __pfx_skb_queue_purge_reason+0x10/0x10 [ 98.096640][ T6125] packet_release+0x839/0xd70 [ 98.096655][ T6125] ? __pfx_packet_release+0x10/0x10 [ 98.096668][ T6125] ? __pfx_down_write+0x10/0x10 [ 98.096684][ T6125] ? __pfx_locks_remove_file+0x10/0x10 [ 98.096696][ T6125] __sock_release+0xb3/0x260 [ 98.096710][ T6125] ? __pfx_sock_close+0x10/0x10 [ 98.096723][ T6125] sock_close+0x1c/0x30 [ 98.096736][ T6125] __fput+0x3ff/0xb50 [ 98.096752][ T6125] task_work_run+0x150/0x240 [ 98.096769][ T6125] ? __pfx_task_work_run+0x10/0x10 [ 98.096789][ T6125] do_exit+0x951/0x2ae0 [ 98.096805][ T6125] ? __pfx_do_exit+0x10/0x10 [ 98.096818][ T6125] ? cgroup_update_frozen_flag+0x125/0x240 [ 98.096835][ T6125] ? find_held_lock+0x2b/0x80 [ 98.096850][ T6125] ? get_signal+0x184f/0x21e0 [ 98.096863][ T6125] do_group_exit+0xd5/0x2a0 [ 98.096878][ T6125] get_signal+0x1ec7/0x21e0 [ 98.096894][ T6125] ? __pfx_get_signal+0x10/0x10 [ 98.096905][ T6125] ? __pfx_hrtimer_nanosleep+0x10/0x10 [ 98.096925][ T6125] arch_do_signal_or_restart+0x91/0x7e0 [ 98.096942][ T6125] ? get_timespec64+0x147/0x240 [ 98.096953][ T6125] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 98.096973][ T6125] ? __x64_sys_clock_nanosleep+0x347/0x480 [ 98.096987][ T6125] exit_to_user_mode_loop+0x139/0x700 [ 98.097000][ T6125] ? rcu_is_watching+0x13/0xc0 [ 98.097015][ T6125] do_syscall_64+0x661/0x790 [ 98.097031][ T6125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.097042][ T6125] RIP: 0033:0x7efd59b5e98e [ 98.097051][ T6125] Code: Unable to access opcode bytes at 0x7efd59b5e964. [ 98.097056][ T6125] RSP: 002b:00007efd5a98ef58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 98.097071][ T6125] RAX: fffffffffffffdfc RBX: 00007efd5a98f6c0 RCX: 00007efd59b5e98e [ 98.097078][ T6125] RDX: 00007efd5a98efb0 RSI: 0000000000000000 RDI: 0000000000000000 [ 98.097084][ T6125] RBP: 00007efd59c3503b R08: 0000000000000000 R09: 0000000000000000 [ 98.097090][ T6125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.097096][ T6125] R13: 00007efd59e26038 R14: 00007efd59e25fa0 R15: 00007ffd65189c78 [ 98.097109][ T6125] [ 98.239218][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.409376][ T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.577794][ T12] bridge_slave_1: left allmulticast mode [ 98.577819][ T12] bridge_slave_1: left promiscuous mode [ 98.577983][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.584318][ T12] bridge_slave_0: left allmulticast mode [ 98.584340][ T12] bridge_slave_0: left promiscuous mode [ 98.586495][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.806636][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 98.808890][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 98.810228][ T12] bond0 (unregistering): Released all slaves [ 98.815054][ T12] bond1 (unregistering): Released all slaves [ 98.828924][ T5440] 8021q: adding VLAN 0 to HW filter on device eth6 [ 99.015948][ T5440] 8021q: adding VLAN 0 to HW filter on device eth7 [ 99.144036][ T12] hsr_slave_0: left promiscuous mode [ 99.144651][ T12] hsr_slave_1: left promiscuous mode [ 99.145253][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 99.145270][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 99.148218][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 99.148232][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 99.169767][ T12] veth0_macvtap: left promiscuous mode [ 99.169878][ T12] veth1_vlan: left promiscuous mode [ 99.169936][ T12] veth0_vlan: left promiscuous mode [ 99.391872][ T12] team0 (unregistering): Port device team_slave_1 removed [ 99.400156][ T12] team0 (unregistering): Port device team_slave_0 removed [ 99.483821][ T5440] 8021q: adding VLAN 0 to HW filter on device eth8 [ 99.692874][ T5440] 8021q: adding VLAN 0 to HW filter on device eth9 [ 99.718573][ T12] IPVS: stop unused estimator thread 0... [ 99.869558][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.943997][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.008184][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.084437][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.231065][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 100.231089][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.299197][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 100.299219][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.360956][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 100.360978][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.423853][ T5440] 8021q: adding VLAN 0 to HW filter on device eth10 [ 100.452862][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 100.452895][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.619849][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.693181][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.784770][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.824664][ T5440] 8021q: adding VLAN 0 to HW filter on device eth11 [ 100.844071][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.957048][ T12] bridge_slave_1: left allmulticast mode [ 100.957064][ T12] bridge_slave_1: left promiscuous mode [ 100.957188][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.959327][ T12] bridge_slave_0: left allmulticast mode [ 100.959345][ T12] bridge_slave_0: left promiscuous mode [ 100.960381][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.979206][ T12] bridge_slave_1: left allmulticast mode [ 100.979227][ T12] bridge_slave_1: left promiscuous mode [ 100.979383][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.985197][ T12] bridge_slave_0: left allmulticast mode [ 100.985219][ T12] bridge_slave_0: left promiscuous mode [ 100.985351][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.012904][ T12] bridge_slave_1: left allmulticast mode [ 101.012928][ T12] bridge_slave_1: left promiscuous mode [ 101.013083][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.021539][ T12] bridge_slave_0: left allmulticast mode [ 101.021566][ T12] bridge_slave_0: left promiscuous mode [ 101.021711][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.194313][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 101.199981][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 101.201275][ T12] bond0 (unregistering): Released all slaves [ 101.211335][ T12] bond1 (unregistering): Released all slaves [ 101.269928][ T12] bond1 (unregistering): (slave geneve2): Releasing active interface [ 101.293726][ T12] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 101.294930][ T12] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 101.295619][ T12] .` (unregistering): Released all slaves [ 101.301943][ T12] bond1 (unregistering): Released all slaves [ 101.307057][ T12] bond2 (unregistering): Released all slaves [ 101.312025][ T12] bond0 (unregistering): Released all slaves [ 101.378690][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 101.380296][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 101.381069][ T12] bond0 (unregistering): Released all slaves [ 101.384300][ T5440] 8021q: adding VLAN 0 to HW filter on device eth12 [ 101.452928][ T43] kauditd_printk_skb: 87 callbacks suppressed [ 101.452945][ T43] audit: type=1400 audit(1789403839.224:754): avc: denied { write } for pid=8185 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.506151][ T43] audit: type=1400 audit(1789403839.274:755): avc: denied { write } for pid=8188 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.540307][ T5440] 8021q: adding VLAN 0 to HW filter on device eth13 [ 101.570682][ T43] audit: type=1400 audit(1789403839.344:756): avc: denied { write } for pid=8190 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.637190][ T43] audit: type=1400 audit(1789403839.414:757): avc: denied { write } for pid=8193 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.723954][ T43] audit: type=1400 audit(1789403839.494:758): avc: denied { write } for pid=8196 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.787491][ T43] audit: type=1400 audit(1789403839.564:759): avc: denied { write } for pid=8199 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 102.005119][ T43] audit: type=1400 audit(1789403839.774:760): avc: denied { write } for pid=8205 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 102.066812][ T12] hsr_slave_0: left promiscuous mode [ 102.067470][ T12] hsr_slave_1: left promiscuous mode [ 102.068126][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 102.068142][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 102.069070][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 102.069085][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 102.073242][ T12] hsr_slave_0: left promiscuous mode [ 102.073725][ T43] audit: type=1400 audit(1789403839.844:761): avc: denied { write } for pid=8208 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 102.073908][ T12] hsr_slave_1: left promiscuous mode [ 102.074557][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 102.074573][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 102.076325][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 102.076336][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 102.094789][ T12] hsr_slave_0: left promiscuous mode [ 102.103694][ T12] hsr_slave_1: left promiscuous mode [ 102.104422][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 102.104439][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 102.106732][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 102.106750][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 102.134663][ T12] veth1_macvtap: left promiscuous mode [ 102.134693][ T12] veth0_macvtap: left promiscuous mode [ 102.134768][ T12] veth1_vlan: left promiscuous mode [ 102.134816][ T12] veth0_vlan: left promiscuous mode [ 102.144592][ T12] veth1_macvtap: left promiscuous mode [ 102.144623][ T12] veth0_macvtap: left promiscuous mode [ 102.144773][ T12] veth0_vlan: left promiscuous mode [ 102.151439][ T12] veth1_macvtap: left promiscuous mode [ 102.151473][ T12] veth0_macvtap: left promiscuous mode [ 102.151554][ T12] veth1_vlan: left promiscuous mode [ 102.151609][ T12] veth0_vlan: left promiscuous mode [ 102.494912][ T12] team0 (unregistering): Port device team_slave_1 removed [ 102.506437][ T12] team0 (unregistering): Port device team_slave_0 removed [ 102.578143][ T12] team0 (unregistering): Port device vlan2 removed [ 102.603484][ T38] smbdirect: ib_dev[syz0] removed [ 102.731184][ T12] team0 (unregistering): Port device team_slave_1 removed [ 102.735639][ T12] team0 (unregistering): Port device team_slave_0 removed [ 102.886223][ T12] team0 (unregistering): Port device team_slave_1 removed [ 102.890982][ T12] team0 (unregistering): Port device team_slave_0 removed [ 102.950438][ T12] BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u32:0/12 [ 102.950460][ T12] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 102.950494][ T12] CPU: 1 UID: 0 PID: 12 Comm: kworker/u32:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 102.950517][ T12] Tainted: [L]=SOFTLOCKUP [ 102.950524][ T12] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.950536][ T12] Workqueue: netns cleanup_net [ 102.950561][ T12] Call Trace: [ 102.950567][ T12] [ 102.950575][ T12] dump_stack_lvl+0x100/0x190 [ 102.950603][ T12] check_preemption_disabled+0xd2/0xe0 [ 102.950631][ T12] ? __rtnl_unlock+0x97/0xf0 [ 102.950655][ T12] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 102.950680][ T12] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 102.950704][ T12] ? __rtnl_unlock+0x97/0xf0 [ 102.950726][ T12] trace_kfree_skb+0x18b/0x230 [ 102.950750][ T12] sk_skb_reason_drop+0xb7/0x1b0 [ 102.950772][ T12] __rtnl_unlock+0x97/0xf0 [ 102.950793][ T12] netdev_run_todo+0x2e1/0x1600 [ 102.950816][ T12] ? unregister_netdevice_many_notify+0x187e/0x2150 [ 102.950844][ T12] ? __pfx_netdev_run_todo+0x10/0x10 [ 102.950870][ T12] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 102.950896][ T12] ? unregister_netdevice_queue+0x22e/0x3c0 [ 102.950920][ T12] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 102.950977][ T12] default_device_exit_batch+0x6cb/0x890 [ 102.951005][ T12] ? __pfx_default_device_exit_batch+0x10/0x10 [ 102.951032][ T12] ? __pfx___might_resched+0x10/0x10 [ 102.951052][ T12] ? __pfx_default_device_exit_batch+0x10/0x10 [ 102.951080][ T12] ops_undo_list+0x363/0xab0 [ 102.951107][ T12] ? __pfx_ops_undo_list+0x10/0x10 [ 102.951130][ T12] ? idr_destroy+0x62/0x2e0 [ 102.951151][ T12] cleanup_net+0x499/0x920 [ 102.951176][ T12] ? __pfx_cleanup_net+0x10/0x10 [ 102.951198][ T12] ? process_one_work+0xa2c/0x1b10 [ 102.951227][ T12] ? process_one_work+0x906/0x1b10 [ 102.951256][ T12] process_one_work+0xac7/0x1b10 [ 102.951291][ T12] ? __pfx_process_one_work+0x10/0x10 [ 102.951317][ T12] ? lock_acquire+0x1d1/0x380 [ 102.951342][ T12] ? __pfx_cleanup_net+0x10/0x10 [ 102.951367][ T12] worker_thread+0x5ef/0xe50 [ 102.951404][ T12] ? kthread+0x13a/0x450 [ 102.951427][ T12] ? __pfx_worker_thread+0x10/0x10 [ 102.951449][ T12] kthread+0x373/0x450 [ 102.951471][ T12] ? __pfx_kthread+0x10/0x10 [ 102.951496][ T12] ret_from_fork+0x730/0xd60 [ 102.951516][ T12] ? __pfx_ret_from_fork+0x10/0x10 [ 102.951537][ T12] ? __switch_to+0x800/0x10f0 [ 102.951560][ T12] ? __pfx_kthread+0x10/0x10 [ 102.951583][ T12] ret_from_fork_asm+0x1a/0x30 [ 102.951615][ T12] [ 102.951654][ T5440] 8021q: adding VLAN 0 to HW filter on device eth14 [ 102.951705][ T12] BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u32:0/12 [ 102.951719][ T12] caller is net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 102.951749][ T12] CPU: 1 UID: 0 PID: 12 Comm: kworker/u32:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 102.951771][ T12] Tainted: [L]=SOFTLOCKUP [ 102.951777][ T12] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.951788][ T12] Workqueue: netns cleanup_net [ 102.951809][ T12] Call Trace: [ 102.951815][ T12] [ 102.951822][ T12] dump_stack_lvl+0x100/0x190 [ 102.951848][ T12] check_preemption_disabled+0xd2/0xe0 [ 102.951872][ T12] ? __rtnl_unlock+0x97/0xf0 [ 102.951892][ T12] net_dm_packet_trace_kfree_skb_hit+0x119/0x350 [ 102.951918][ T12] ? __rtnl_unlock+0x97/0xf0 [ 102.951958][ T12] trace_kfree_skb+0x18b/0x230 [ 102.951983][ T12] sk_skb_reason_drop+0xb7/0x1b0 [ 102.952006][ T12] __rtnl_unlock+0x97/0xf0 [ 102.952029][ T12] netdev_run_todo+0x2e1/0x1600 [ 102.952050][ T12] ? unregister_netdevice_many_notify+0x187e/0x2150 [ 102.952082][ T12] ? __pfx_netdev_run_todo+0x10/0x10 [ 102.952105][ T12] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 102.952127][ T12] ? unregister_netdevice_queue+0x22e/0x3c0 [ 102.952148][ T12] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 102.952176][ T12] default_device_exit_batch+0x6cb/0x890 [ 102.952201][ T12] ? __pfx_default_device_exit_batch+0x10/0x10 [ 102.952224][ T12] ? __pfx___might_resched+0x10/0x10 [ 102.952241][ T12] ? __pfx_default_device_exit_batch+0x10/0x10 [ 102.952264][ T12] ops_undo_list+0x363/0xab0 [ 102.952290][ T12] ? __pfx_ops_undo_list+0x10/0x10 [ 102.952325][ T12] ? idr_destroy+0x62/0x2e0 [ 102.952343][ T12] cleanup_net+0x499/0x920 [ 102.952363][ T12] ? __pfx_cleanup_net+0x10/0x10 [ 102.952381][ T12] ? process_one_work+0xa2c/0x1b10 [ 102.952404][ T12] ? process_one_work+0x906/0x1b10 [ 102.952428][ T12] process_one_work+0xac7/0x1b10 [ 102.952457][ T12] ? __pfx_process_one_work+0x10/0x10 [ 102.952479][ T12] ? lock_acquire+0x1d1/0x380 [ 102.952499][ T12] ? __pfx_cleanup_net+0x10/0x10 [ 102.952520][ T12] worker_thread+0x5ef/0xe50 [ 102.952549][ T12] ? kthread+0x13a/0x450 [ 102.952567][ T12] ? __pfx_worker_thread+0x10/0x10 [ 102.952587][ T12] kthread+0x373/0x450 [ 102.952608][ T12] ? __pfx_kthread+0x10/0x10 [ 102.952633][ T12] ret_from_fork+0x730/0xd60 [ 102.952651][ T12] ? __pfx_ret_from_fork+0x10/0x10 [ 102.952670][ T12] ? __switch_to+0x800/0x10f0 [ 102.952695][ T12] ? __pfx_kthread+0x10/0x10 [ 102.952716][ T12] ret_from_fork_asm+0x1a/0x30 [ 102.952742][ T12] [ 102.959633][ T5879] lo speed is unknown, defaulting to 1000 [ 102.959654][ T5879] infiniband syz0: ib_query_port failed (-19) [ 103.171625][ T5440] 8021q: adding VLAN 0 to HW filter on device eth15 [ 103.382042][ T5440] 8021q: adding VLAN 0 to HW filter on device eth16 [ 103.585328][ T5440] 8021q: adding VLAN 0 to HW filter on device eth17 [ 103.799509][ T12] IPVS: stop unused estimator thread 0... [ 103.972867][ T5440] 8021q: adding VLAN 0 to HW filter on device eth18 [ 104.348265][ T5440] 8021q: adding VLAN 0 to HW filter on device eth19 [ 104.533817][ T5440] 8021q: adding VLAN 0 to HW filter on device eth20 [ 104.688915][ T5440] 8021q: adding VLAN 0 to HW filter on device eth21