last executing test programs: 34.458921627s ago: executing program 3 (id=473): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000040), 0x8) r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x40204) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) write$evdev(r1, &(0x7f0000000340)=[{{r2, r3/1000+10000}, 0x16, 0x9, 0x4}, {{r4, r5/1000+60000}, 0x2, 0xedc8, 0x1}, {{0x0, 0xea60}, 0x16, 0x9, 0x4}, {{r6, r7/1000+10000}, 0x12, 0x7, 0x4}, {{0x77359400}, 0x15, 0x5, 0x695da2ed}, {{0x0, 0x2710}, 0x4, 0x2, 0x4}, {{r8, r9/1000+60000}, 0x3b, 0xd61, 0x100}], 0xa8) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x1, 0x2, 0x301, 0x0, 0x0, {0x0, 0x0, 0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x20004090}, 0x90) listen(r0, 0x3) r11 = accept4(r0, 0x0, 0x0, 0x80800) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) setsockopt$bt_hci_HCI_FILTER(r11, 0x0, 0x2, &(0x7f00000001c0)={0x8, [0x8, 0x81], 0x98aa}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r12 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNADDRESOURCE(r12, 0x89ef, &(0x7f0000000200)=0x1) pipe(&(0x7f0000000300)) creat(&(0x7f0000000000)='./file0\x00', 0x0) open(&(0x7f0000000040)='./file0/file0\x00', 0x559000, 0x50) r13 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) ioctl$TIOCSTI(r13, 0x5412, &(0x7f0000000040)=0x4) readv(r13, &(0x7f00000003c0)=[{&(0x7f00000000c0)=""/179, 0xb3}], 0x1) setns(0xc9, 0x0) r14 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r14, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="700000001000010025bd7004fbdbdf2500000000", @ANYRES32=r14, @ANYBLOB="00000000034a04000a0001"], 0x70}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000000)={0x0, 0x0, 0x7d8b, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) ioctl$XFS_IOC_GOINGDOWN(r0, 0x8004587d, &(0x7f0000000280)=0x1) 33.530343934s ago: executing program 3 (id=486): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000180)={'aio_iiro_16\x00', [0x100, 0x5, 0x2, 0xc, 0x10, 0x5, 0x79, 0x7010000, 0xb, 0x4, 0x2, 0x1, 0x7, 0x8, 0x40, 0x400, 0xfffffffb, 0xdd, 0x4000003, 0x7fff, 0xffffffff, 0xca9f, 0x3, 0x5, 0xffdffffb, 0x4f, 0xffffffff, 0x8, 0x7, 0x0, 0xffffdff8]}) 33.419590409s ago: executing program 3 (id=487): unshare(0x42000000) r0 = socket$inet6(0xa, 0x1, 0x84) socket$netlink(0x10, 0x3, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r1, &(0x7f0000000040), 0x10) sendto$inet6(r0, &(0x7f00000000c0)="9a", 0x1, 0x804, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback, 0x4}, 0x1c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x28700, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x29) getsockopt$bt_hci(r0, 0x84, 0x6d, &(0x7f0000002280)=""/4090, &(0x7f0000000180)=0xffa) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f00000001c0)='3', 0x1) ioctl$KVM_INTERRUPT(r3, 0x4004ae86, &(0x7f0000000100)=0x2) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000000) 32.482359832s ago: executing program 3 (id=492): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000003000000030000000050000000000000001000004080000000000ffef03000000100000000000000000000002000000000300000000000004040000000000002e"], 0x0, 0x4d}, 0x20) 32.456509522s ago: executing program 3 (id=494): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x80000) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x23, 0x0, 0x0, 0xfd00, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 32.447604874s ago: executing program 3 (id=496): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/kcore\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000002140)={0x2020}, 0xeffd) (fail_nth: 7) 16.240495476s ago: executing program 32 (id=496): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/kcore\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000002140)={0x2020}, 0xeffd) (fail_nth: 7) 4.324571609s ago: executing program 2 (id=785): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a32000000001400000011"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0xfffffff8, 0x1, 0x5, 0x9, 0x10008, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0x1, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x6, 0xd, 0x4, 0x12a3, 0x4, 0xffffffff, 0x2, 0x6, 0x7, 0x81, 0x9, 0x79, 0x25713dc3, 0x10000, 0x0, 0x95, 0x4, 0x4, 0x16, 0x2, 0x5, 0x2, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x1000, 0xef1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x8, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x7, 0xf1, 0x4, 0x1, 0xffff, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0xfffffffe, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x200006, 0x8, 0x400, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x5, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x8000, 0x400, 0x3e55, 0x5, 0xd3, 0x408, 0x3437, 0xffff7fff, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x80, 0x8000, 0x4, 0x3, 0xd520, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x8, 0x1], [0xa772, 0x6, 0x5, 0x3, 0x40bfc, 0x8, 0x5, 0x7f, 0x2a29, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x81, 0x1, 0x19d86, 0xd, 0xfffffff7, 0x8, 0x6, 0x5396, 0x3, 0x200006, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x8, 0x7fffffff, 0x9, 0xc, 0x32d, 0x3, 0x201, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8008, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x3, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x40000000000180, 0x2, 0x80000000, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x0, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'gre0\x00', &(0x7f0000000200)=@ethtool_ringparam={0x10, 0x80000001, 0x3, 0x1, 0xd, 0xefe, 0x0, 0x0, 0x8}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) (fail_nth: 13) 4.215123152s ago: executing program 4 (id=787): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x901800, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f00000000c0)="baf80c66b88ed7368366efbafc0cb05beedc7e0064660fc77466260f07f30f090f00c2baf80c66b813e01f8666efbafc0cecdb3eba00f20f205a0f35", 0x3c}], 0x1, 0x0, 0x0, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@multicast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @multicast1=0xac14140f}, {0x4e24, 0x4e20}}}}}, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r3) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000040)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_KEY(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x48, r4, 0x601, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_BYTES={0x14, 0x30, "000102030405060708090a0b0c0d0e0f"}]}, 0x48}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x17, 0x4, &(0x7f0000000080)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x65, '\x00', 0x0, @cgroup_sysctl=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000500)={0x0, 0x0}, 0x1, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x4e20, 0x4e20, r7, r6, 0x0, 0x0, 0x5, 0x10, 0x1000}}}}}}, 0x0) syz_emit_ethernet(0x1062, &(0x7f0000000a00)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2e}, @void, {@ipv4={0x800, @tcp={{0xe, 0x4, 0x2, 0x8, 0x1054, 0x68, 0x0, 0xed, 0x6, 0x0, @loopback, @multicast2, {[@generic={0x7, 0xb, "2b984f26f637e3e3b3"}, @ssrr={0x89, 0x17, 0xe7, [@initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @empty, @local, @dev={0xac, 0x14, 0x14, 0x29}]}]}}, {{0x4e23, 0x4e23, 0x41424344, r7, 0x0, 0x0, 0x7, 0x8, 0x6, 0x0, 0x9, {[@mss={0x2, 0x4, 0x1}, @nop, @window={0x3, 0x3, 0x2}]}}, {"b5e383d672ede391238ca355c7dfcb0e362eb827d292bf62a47fc10af2c4053758b5f920362d0cd21e8c7e51f28148ed9194db04c41b8d098cf2e154dd311abaed14b21300250307244f02923366ee920ecdc4a4f79fd57443499e4383e7d022c68a1bf19d0b6d0e014adbbe78ea9f4387e71e8f282c826f2306a5bcf6b84f16c1eb4fad4b0e0dfc50cae67afbea99a51a41b678d4ab05501c29c476cafd271e791902d558de216a0bd11ccd25534176874a706a57a823bf3464a319a3e44592626257613cf21d43b403ef2704cb51b990fa38238b758d1f2033a7335045d1d5ff4f56abf7ab7e779e9ba5394b3cc386203a17fef1f47fbf3e9a3bc92328ebc6cd037a1069871f496f433a9a5bf0920b80b18c7815f30fe49d2076b35786ac8fddc0f2cc0cd668c74cdf97da39ac569d2f253795ed8fd79b2e560029297f181b5de151dfd698d9edccde582e53a359c8bab9fa2131bc6369ae5eb096ec75a7fd0b79521389f2bda222e3d39195f679c69048f568f7a6e87ca6ff1740814a9cdf6ce64a7cfd2bae4e205031c58a77ab987b05bb00fe8be533a906c25af76678e5e8c1ccedf13fdbd8e2fd457f6762ba91ab31004ee7e31afcfb39291e41afbc1076a108e1c63392d8cef682d0f563c353e0cf3014b2e0297729fe5bf408bccbf1310321321553cb292a7c2668c1546b63493bcee2312e53fecf331d6e8d728b6b5f91383843404835bf724b33b77f2e54196d6723310cba542234dc685981a522f862933e29e0ef96c768c86f58ef67e7c030e6bdd58e93eb06e7da40d28416bea5f5d84dd478a170856c4ec9535238dec901fa86ccb5f590a45f625d5a12d80fab3d906c0e144d87f651b47876b783dd2bc3a125a548556221e4eec5569a2dd17b89692c950478060925500ac1c9372e7448ea0f978b343b4001a50ff6a53299ac2d19bc2601930983ac98f6c0e5f887b2ac65c48dc7b41e228141c9663884811bc6229d5955f11c47d7f7a209e1f244f79431310d48a3b5df74b378894479843e307d7c23bfdd79420f7956dea162e632e77cf6de1ba4e752eff2f066e973e57c4c1026c053985ed0eb0143c1cee913b6cffc90e167007c99638bee18fd1191b770cea3154e506f57125ce033ab3b361d31851fb3b60010c96f9c19b42ac5673717dcdd6853053187ac21267c950a36f9bdf4c9415338e00ac13571f13f1906e24312630eebff64d3def9be4dec1d59c038b6a5601ef9eba76c040bfe2247609d1e90aefb0e10a141b8bf2871ac375df7b21f56bb6d9fa75d094f7989dae5950fc528c0a8707801199930f9b2506eec53a64f4a78896b41683442856b67e3040104c0efb64b69d602f513d6bfdffe14c9112e194341d1981c5e1778eca6c05f2a42112e5dbb97c30610393eef35ddf48afa317b0709f2877f056970bc57864aa7ffd56d35baf387e5986e5a52207a1e177d9af70adb4f9498f90a42f27ede60b5beb0c3c4743fcf721c348152db51f260e78580843ec6796db307649cff9c6c3a3f639b737fdf2a8defd75e6e208d0ea305fa0d0bbc52d465a51aae99080169c832f5370a8989f75255f5edf11f93327349664370c9402198af465340f30f16bb5476df8650b5c05470dc5dfb660a089184db653c8ff916891cf991ac886bdd52cffff3cf5ddd2514abd2a2ccc1b8ae970a4cf4769d011c617cf68a0b8a5f1a2ae3135e5fc61161931cacb83dee440ec8a22a65370cad8bbbf1bb6970ecb1799d323dc41dbc48dabd6c68d94224d435a71552a8ba91f7d7c5ac2030e421cf8a22a3b6577d9b13753318fb2956b4de39f70dc46235e9d916092661d592d6a296e5391bf34dfcf8976c8f9c1323e4c2d6f5e6efbd0c67291e442694bdc6cc609022dd63a84061b80989e609e606ffe5cf54b63542b61767321a7fdf3e47e2060a5ab32bbb61a41a23c066e8dc7c831bb738c5c2d79e0b06235bde440deb03b04aa242ed7c91c0389834f5907afe7b292d4740732a9687607e30f08a9087c0ce41206e6143b842c181c2aa437627b6be649a46994146073de7e64a1dc3e2e5c79af2a96d5adf7501d4fb5b3a447729e42052e089747c58b1b9ce9828abdb844fe22d5851257448adef447b192d15a849a82cbd88f931bd64a5e40ce5f2b427bae3fbcfd5fa1933931071f5a5d280520e233071ee2fe1e8dc7ba9759e679139b8e03eb7fc7bae9ec0db0c1cfc20b591eb6ba714525e351e9414f5840888b9e443ed1906154c79a32b302f7d6484f3a3c1ea8a54596bb133e8380ef356c63d8c4a8dcf29236afcaa9f4ccb89da325fc2011d87f5ab3697b039b21dcaa9da5a5be4d075e988874bdedb783f8f5f97e93cf5113227c371bb583aa54b3c5a2c7a9be7636cabdce6a976b2ed6e074ef9b114cf71471a7b6d000b162626dd58dc7e28208796907ea4cbcfff903ddb380ee375173be459ecde241f979a8442ae7a37873f9f74c8c010c43118052aaaf52411e68ce16608bd8db56d5e370c3d0cc6b580859b782cb058570ee37851b6afb1b46cd651ed47c44c981a50f48c6780b05de06d380644d04df5f2497098562edb56d5478182681d34875c297ccdc7856d0d660b899ee5d8701b7df952805e5e4aac8d19eb026baecfde707bf0dc4fad49a6c32de38e41abd606c4a91b500a1dad7a1cc6419a938c5954d6c1a8722d5e6d090159e656a2e8f8329048a542b9decdbf1d32d9b664a794ee75fd1f9fd34d256349cc18ef96d003d37361c38c5422602c5f6b3b19a1ed92fe11a9cc6d4e4696dbb71e2a2573d6dd121a2ed68d0eb9d56099df594c59671cafd1f35a6e82e9231193c0b97dd2d57e9e5cb7cb8f14bcacf660b486e0e8f3579725b048f5b43b7ce4e028ac4fc84c76cf76ef21e14fb4347d74e520e2126df75f95f5c9c36e7a91977c07c9fb5ba2a4c199ee4b4fc7acf8da4100bf1990b84ca5a6ab1808c0010a60a5b874d9d38e917c354b6df7e6f49b16560f374626de092e7f23dd5e66511272677115bbd766c7037281ece682222e9bb4e65e557c708cbee3405391ef71aee633fc04f9960e3af715b2cdc46f4e13fef46d01fba9011e17c6a43d2a4a4297b1020a4bdfcbb1203719a52c9c045840c82434576c48018237bbab70b7e31a60ec76ed3a653d0cea3d9d5d74554780a558dcd4a51fd1a96d8d4bcd4ba136e91331446a5542d4e1b3fa8a4a32e9ce19d26006a5f2e1404491d7d8020207e9413648dec42131bccf9dcd49131f5044aeec90b3526fc7cb354c81e69c15fe3a2b325c9dfb7cb060b639c75f2533a5fb7c5e07aeb7ec22e839c6c35834728efe42e37f19e07588daa07c7ebeabd5c2fee413f0ed861e7d966143ffda6c57ab04adaa1b9cf28763f67f351811f875940e18057f49b85f5c7f24fee253660e5467337f0e08edeca225ca667f0854d8a9bfcbc8842db47f6c16cb959621917f9549dd5b7a097d0be6d41a1c9b1018259c8895ef25cbee0cb78e9b9091b20a827c4a4dfe03f607c399171e0846e0d7fc7ad490957cb3b787cef19661c0fe45d0a2b4b589a6b2c32b4807cadbfed5f110057f03a830631d21bae969cf28f8aae90637f37c1c2d1f9489b1441704389c8e572a496d96b319dec31f4fceae7716806d96da89a4afdd77e29da84867b0bd2924b7108bcc3bf747d6187c660ababa94b58e1f8df2c86735bef867d8237b24c4874aab384434a0c15e7b3238a12f07a18afd7ac9f4189ad5e6c90c31b9eefc4ea65f382a1e01bcd49ad1eedeca0edbbce30fa0af818612b4bbff23e598d09fb6d5005f0dc00fc8077d5b72700c2b205c98abc92b6d3ca28e53fba847cbe28f89668ae4f3b28941c432c5de489cbfee778ced9a085697e0a9e41d569e02129ff1049e78e9b2ea545d400aa4ddec873368ecec8376c979b7b11edd2b8e7672cb0a3ff0c7b37e13b3bfd44925e1a2a2131c5b4717b5ab3baefded6b0aa1e8ce2446ee5e78bca051858bdc8b337bd3b0a85372718a36e384ee7f1ccf098c6c0bec6bc8ee3c33667854fd498c0b359334fb5e5f0ecb41cf3690391cb7cb77f155eca463ce617f9497bb497603893eb0257e2cadc881f3170955d27d2d190081b54e58e539ea0b7d468761a01c158e175504fa88d29294c7197d6c35500ab53ef04180b8606da75e3873359cf4c6e73dcc432db418e4de27a18450e11dd8f12eb801e35b7dbfba18f45b1f24b53ea722373a3b8d1334008fa411a4bbb1fbf65a95348286a5f219510ef63d29081b38f16921f358381d87f2a0d7f6830a7024e6405fdd28b7b407a47ef924c8e972c2af08f161541c4b42bdfc1e9a93ef66c1f2bbc8b0a4f0363c819947668b88fb9b53f351a1913b5c7cb2a8141fa3fb937a5babad2328020707e99b0bbc70b331ca8ab2dc8e207d78e2e529a49d041367090b854500dd62b6fca4ed584a238586f4709b3ef2db564b7eadb32b44faba1a8e774db4d656f73518a631e719f1ccfbc7779835bcefc0c28eba5abe6aff49647c3ed47f29b1995e5ed0be615385b2b6156ff885f70fd7ed5f70c66e322d03cde9636290ca775f512812c862e2cc13567a21365a8ce0d546b3d2b3ca41e931e6f7961e85e09ac53d52014b79ab75a990c60535511891265574a064c3b23d4cedb409901ff7f4b745de96baa75452f57b7d4f069df889f2e32243470c4c1f70303ea43f9158eb390ffdccfec0506072380281e033559e3ff98cd462432b83e127fdaef3e4563f0a240f660606552947d980018f13990fab79d080a14c2a999c41a73c56bc1b7ee831f6f699e979e62af509ac1fa1a047f518613753ea45b62e266fc394e22d505313eccf323f08cf2e35ee3e1fa12747e02e189c95b004e9fb5967d36304feaa2bf429070f5707f60b7ff8b13a33df377cda2e9561f87d0a512aa86a5b9ce8c6715782f62b0fe435b7417e0fe18e3e93f9536831689ae010e613d72f708f40c5cae1c3f95a146b5efebffe4d9b180eb32d59056c7fb8aefc7f5eceb746b60a78feceb3ac14995fa603342b804dbed40fd8966d801b0b89722ae7aa3650e9f87548acfc169e6730015d185375de7a1e6b1f399fa2dda27c025b699298b662b9fb91594a9acb9f6c339f1a1966d0e73c8e5d9117af3dfd89609a6bbfc1606d3c50c3b21d4e79c614140c5ff1b02eb71038c92aeef215347c684cece7c575cf46917d3299fb7eb976cdb2ca7a6214367368adcfc695e451e20463a89199ec43c9294fe718b3a85121b71ac5e31ab0f1247c220eda53abac5c1a5e158a7ef73a1142ee787f1bedac1c0391459a43a94e773f11ef043622700a9e5045b8cbc4b7e436c812fa9919828cac0cad8b70652c7e0187599b1eb8c514b4c37bfed3ccc4caa7118c2ac3cdd23d60b394cdc63c3dc5e1655e3e791b46c76374ed978d111835346001a935e2fdd89dc8a408e090dccacebcfc7fafe1e05062e855af71fbbf15e3a9723bea1b89182592226ec7eacef4df5005faae5e7ddcb9215324aa86c7dbf4d43c27d15691507fdb18bbc55f59f62f34e5f6645bc6e585454a04314187a34948c7f6edb36694efa04f6ec7f8cb6e868a0a06fb3fa93d58f5af786e466a757e8dbc35cd9b397b2adde4aa21ad855275a21f68b900d2ebbdf9c2013ad6cb700cae1904733c2593871068c2aa209782065a4fb0d30532634a2900082e26d69ecb52febe37752b4038d43e84d86cebffc564e0af8f491d6b87057481ee7463d7a9f5b060ab76bfbb1f33bc2d3806acfc47823f218bbc4bdd"}}}}}}, 0x0) 3.994252511s ago: executing program 2 (id=788): r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/ccp\x00', 0x0, 0x0) openat(r0, &(0x7f0000000280)='./new_id\x00', 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000003c0)={0xffffffffffffffff}, 0x13f, 0x1}}, 0x20) futex(&(0x7f000000cffc)=0x1, 0xd, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0xd, 0x0, 0x0, 0x0, 0x2) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) mmap(&(0x7f0000031000/0x1000)=nil, 0x1000, 0xd, 0x810, 0xffffffffffffffff, 0x94c1c000) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000940)={0x16, 0x98, 0xfa00, {&(0x7f0000000180), 0x0, r1, 0x10, 0x1, @ib={0x1b, 0x4, 0x3, {"712a6a15a9dc387690b7b4326435849e"}, 0x0, 0x5, 0xce}}}, 0xa0) r2 = socket$nl_route(0x10, 0x3, 0x0) clock_adjtime(0x0, &(0x7f00000001c0)={0x4009b9d, 0x2040, 0x8, 0x400, 0x8, 0xfffffffffffffffe, 0xffffbfffffffffff, 0x9, 0xc4e9, 0xffffffffffffffff, 0xf423f, 0x1000000000000000, 0x40008, 0x4b, 0x7ff, 0xe5a, 0x6, 0xffffffff00000000, 0x1000000003, 0x0, 0x8, 0x4, 0xfffd, 0x117000000, 0x3, 0x3ffffd}) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="17a8fffdc75591535a000008eac5000000000008000a00ed15e0d084434f4c2fc069c7d107bce60e739976bf4b40d5f8e69a06123cb41a926df3a1228b699c61d98ddf5e5613cf360687f3fdbbf903615872458910c30e767dca28a2195d4878b90716efbcc246e05b620502a02fba5a903c70ba40c3eabfd1443689a2535220dad64d7d06bc1a3041dd1dd5d99ab70a2d5dacb4efe349fd63a0c0000000000000000000", @ANYRES32=r3, @ANYBLOB="08001b0000000000"], 0x30}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0d0000000400000004000000"], 0x50) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x12) ioctl(0xffffffffffffffff, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d") 3.930075992s ago: executing program 4 (id=789): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000cc0)=ANY=[@ANYBLOB="b7000000e9ff0180bfa30000000000000703000028feffff7a0af0fff8ffffff61a4f0ff0000000015040200000002000f040000000000003404000001ed0a0014040000170000800f340000000000007b0a00fe000000002c04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0c710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf1dbf6d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040bef29b66e3858d051c096e37c4f46010400000000c3da29faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d0cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090d030000003acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931481747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885769754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8269b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347932a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd23834a50d7eb8e327fb5db12cbd6a9efe8e671c4f251fe3bf440cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa2c910fb8de24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe91c921ac1476027772c87d1767e31a3446cd57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c828c02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007f00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d05d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b530500d8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bd9b075f1488d22230592a79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462aa2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783fefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9be0bdd37220e316f2297743dd4731614a50c16c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd08000000e843591d2618e2d2cdc7081c8fafffe9c350a5c554a387de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119d2a673bdae05779208409e6cf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8a9d3374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c7963c2ba910969f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9eed636338f1835fc957729d63dc1bfc7b772cbe536c2d3aff27c22f9a2f876512616a5bdaf22a16e19d1b5f52abb40b433983d0cf50234de659c1a397ce901000000caae1bcfdce33dae6adc260321702f239c25ab181390e7dc8c1e5b1cf3b4fef1cd5c44a89b5e5d8314e02f4673ded90bce9a4025b0232eec970f7aa17f175a14e8dc8de9bac0006b98a8283eee5665f3aede28228e0468dbcf8b776fe4c629d3af183a7cba5adf77f23d31f9d5a183c0da4e95f75b1496a97a46a06e4e1f5a8438d49dbd493ba2482c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1e}, 0x48) socket$inet_sctp(0x2, 0x5, 0x84) (async) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000040)=0xff, 0x4) capset(&(0x7f0000000080)={0x19980330}, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000004240), 0x0, 0x0) io_uring_setup(0x2f4f, &(0x7f0000000000)={0x0, 0x800010, 0x1, 0x0, 0xfb}) (async) r3 = io_uring_setup(0x2f4f, &(0x7f0000000000)={0x0, 0x800010, 0x1, 0x0, 0xfb}) syz_open_dev$tty1(0xc, 0x4, 0x2) (async) r4 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f0000000200)=0x0) capget(&(0x7f0000000180)={0x19980330, r5}, &(0x7f0000000240)={0x40000, 0x3, 0x8, 0x7, 0x7, 0x8}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x802000, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/console\x00', 0x1, 0x0) (async) r6 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/console\x00', 0x1, 0x0) ioctl$TIOCMIWAIT(r6, 0x545c, 0x1f20) (async) ioctl$TIOCMIWAIT(r6, 0x545c, 0x1f20) close_range(r3, 0xffffffffffffffff, 0x0) (async) close_range(r3, 0xffffffffffffffff, 0x0) fcntl$addseals(r3, 0x409, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r6, 0x3b88, &(0x7f0000000140)={0xc, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r6, 0x3ba0, &(0x7f0000000280)={0x48, 0x2, r7, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$SNDRV_PCM_IOCTL_STATUS64(r2, 0x40084146, &(0x7f0000000080)) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x90000, 0x0) ioctl$TUNSETSTEERINGEBPF(r8, 0x800454e0, &(0x7f0000000080)=r0) 3.865469926s ago: executing program 4 (id=790): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f0000000280)=0x6, 0x4) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x2, 0x1000, @empty}, 0x1c) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, '\x00', 0x8, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @mcast2, {[], @echo_reply={0x81, 0x0, 0x0, 0x2, 0x4}}}}}}, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000300)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0xc03, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x5) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, &(0x7f00000000c0)="66baf80cb8d2cf1e89ef66bafc0c66b8000066ef360f219eb972070000b8b10a1c70ba000000000f30d26d000f0119de5a8066b8da008ec0c4c16a10e90f009fb42e00000f01bf4b00c0fe", 0x4b}], 0x1, 0x78, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000400)={0x1, 0x1, 0x0, &(0x7f0000000180)=""/14, 0x0, 0x30000}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000b00)={{r5}, &(0x7f0000000580), &(0x7f0000000ac0)=r5}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000001480)={r5, &(0x7f0000000440)="dfcdb4a27dcc4931a205eef25ef4981d847f23a685316143a2039d61e9d81b6bc0b16482410a7fe47675dd671c7732ee24b94382deb9b2b521aee74ca506fa0cd9175cf49cf3e9a839492456acf78e3816df509c656df7d69e721f69d216923d0646fc53114dd35697f5ea763e4ca8978ac9bac511c8dbd72fc93b501fade55973c9f57f0c403707ebd296d108b68155cd10225267734909b3859b17b555719a764d84dee477e673b849a872753b83ee11e9795aaf68b938a5c200b851a10885167cee7a24908e7c20f7fd751eba35b511fab675917240de170315402126040b7583f144f179456b32f91038c0c0b32b2835abf343cc2e860927e9e3184791134c8f0fdd8c3a38dcc7d404d6d2cea56e4539b52320daae9ed3115e5519494d943b5a176a12cf224ec895b06d5e4a983e8f33ec72434e2d47077f3144cdd17e774c794b8ac824bd0c09d2fb3865dadcac9c37133e278229b8cddbad7f74a733eca3651b2a553e7aee32a744677216a70e66a61d324668fc418b089ed8bfa561e3afd1fbd01b0afb25741767aa9703eb0576d84f13e70dc599f7e1090ace97f61bdff6572150ed3460849c123497fd42ff5d62b155fe8d3c2e8bae81861feaa4fc2e3749830d665e5028f95483253c28ba9234ab0d54b3db7abab2aa020ed5d137dea1fb7c6198356a2a5b10f5086cd57d707fbd9e301b8877196707d156c8537667922818570b98e3daedcf7d129a0f07cc8c24c75a26deef31017ada99768e1edb6a41b0bf20a9eb6183c95e1a5e47d9fd4cd3c0f17a31458245012e1c8ee4158e1348d5181e6c667394ba015899ff120b765b29931ef090a685d19ac2bd82bb7a51da900a71b4cbbdbcce0c740cc4b86cc70ca15cb6821cf1d0092d3f8e8267bfcb285f3cc54c73b7696fba50f294869cf354d989cec01cd35c630db0910fc51dd2cceb07d1b5fee31b37b5015ccf0cfa3092bd8e47c3d3d3a406e44b293a494559b6c3a2d2e4d4247525c0d2c7822fc6e8fc5a4be93e8e1a644974300b959b8488b3b74e8bbac74c5183b3b8902a9e4701f363efaba2e9efc672c64b79064bcbf55da215178f41c1c1d97d0cd9b6645fe0ecd78011433ea5dba6211e1b202583bb064857e8a2fee62f779995cf2b9f1992dfd22300fec1ef77c3ea841f6abc5def91c43a36e5643e937dc1efcfba0d4b39068ba147a5758e5d77d249eaad4ca11b53e863cbfab865aa5ba369672cc7f43074fa6bb90f87dc1c12e855c2a1ff1284321f717e044ab2a23d6777d7cd129aac3d6bae6a0c54f2e9ad3d8cce69e100e87e1dfe46dac9efcf94c8e88c3eacfd3011f36e308a83da919bac5c35497372165ae8fb0836f67b170b78fbf237a1ef638bfc2c9f1370ddc24ee46634ab3200c2b81865470eb2a5820ee1771c100c74d39b9bc51325b1a9555c514bafac0a959e224450240c278601fb09c38e7863ae7d4a5c3052461aef4248f868b1d6e49ca964f93ddf616c37fa5ecb5e47d6b35a2fc85bfb33625db19131866e66060a40150e416b596a291c006dcc57599dda3c1b8dc2e0c3aeffcc4664d389434521a073525d963a2a7f635eda8a6d58f179d8c5e2ad0e42bb2bb9e085f51af786073236e1341a15a4700aa67a2d479d9c9e4ce6442399a3c3868fb3d059f55ced5c25e282568a1ad180e9adea06d68ce075575b12113beed7814fc06a56866a48b9fdd7c11b6522fb4840a89e10b920edb63b7eb8b69e7d2528c684454a077e5af76c17c2c8c17912cad94c7d9ed7fbbb4825559b42e62564e20e0990bf7287e12dde40bfa26d7b1208cde10b5dae1abba73a285bb08c14f8dfcb8ce64633fed7bebc6441ec2e14266b9015031bc0eae09ccd9804b0e37b6e7cd0816e8fd6f4e35a3b0ee717e6b6faafaf3444ea1698054d0c3478feec0e425af08fc6b8455da569d09abda2da70046fc0a5c471ad3fa7a5028d4ad26eda79d05a097ff9a58e7d7534df0e3a95b141a25a307a1ac446979f9a1109043419d694e8ce91ff4db15af98dddab7e5a7f0702190d75c028af6a38952c6e249e2f8f5fdd607f33f083d88291ab4376dc35a63d2bab64d3beb2323de971d22dd474aad7645291f3d35a20003a6d9d2935a2c8d7ca03ecbc22d490f5a4aa837033cecd05b38789096d40dcbb31a3729a89c1ee53b1a3d2784cb034de5eef342ed3f7feec9a698d6793f88e2dbe951057b9c20a74f7d605e2386b9fc62148606d8c4285032edffa694f6b1ce15f86b069f8f12e14fede62e6abe700572ed6aaac2a0b68a3050b868f99c3a39aec2e79c923f935c85beb998a46bec153e61af6eef4218bf4b2089e2c238324434e668787b2d046b1cab8d4dd407b41d8a5fd3a0a6df80ef2338bb6e881cb50d8b4a952755d9f42f394559be859ea8c96151b9f8c42087ed3487ee0fe036ed10aabe88a045ec9aff2bdb8ebed8ce2fdb047745852b898615f1eb1a07fca45ba6473caa5ed4279e5b57edf80d8916ff96de77e9137ccf929578b9b5ce2180f31b6d826010e8b044eb6b29e8e60964eb6341743b5ae8861423e141bfa58e2946a31b5200b9951ce3f3f94387a468881aec9ab764baed5deead0f93c210c6093630cdee41122e69e0c5f50ab7ed1640bb44236fbc8978e5cd33c1d8e9ed56e8c15df97ed7917283c143685116935aa546addc348df05dd1cd900554231cd891e7c7db8280725021b8c1b09b5235e170320f1dc52176a03214d16323947abd123d67ce68c1420c068a8be277875cd8186195c0d2da83f83a0f932825b0de045ff545c30d3be79fc47783f790cf08e3eaa13d397f5baf9ded79909fb3db1907b0a58328f56aeee03fa3abc9098cc65c562e454757dcfda06190dcd840fdfcd89eb69874a93fdebb6d4fb4364005b84928348c7e3464a9f3e1a642b1732d17ee36ed047df5ab992e42f9e6ee979efb80b15d253a3874de00efba6a491262c4da1a982e837499f81519db6b5d4e5f944e1f18807b7615544f0b4a4c0e6d9b5eb1241c7e5e6a99552587db085e0f007ea86a26a74cfcc1b4c0e2728afa01278fc2e39812872d4a099c8e890d0d75a246a3828e49ec618959367871fbafb041f73ca33e47f778dbc0f5b31354bf5951ff393d27b045390393f2c290baec9ae080f902421058b86f6cb39b869551d1ce5549f06533a7727c1b29a873b2a481739131162ee62391e7d6dca258964c2d01bf20cbce2fd2fc9601ce712ec6d4846804d30163b99fdc8f22c79490ca1231ff739b816817ea2ea1f40f435a843c245fe5ef3638df4af6d4aa968ed0d22e4021f5e61e11f18bc38ac722a458fbd1f89f8b9fec579461e48748f5af3b1248311febdbd9a166967c9806c7a7bf5415030c7125412a8602eb86fe0483e6b565e753a4b3ac875de299b571db39bbbc5a1da48e97ef0d32094da656d1b4e66bde71a59017edc032d9fbe837577b3b8890df96785fd9b35c283d73b7c3274e66f6679d5837f7e761b7a40254b6c2f6d53da936a8e7fa8b113f2cda7617b416090bf32e3b363fa01e54e6b8cd4e712b9be974fe96f721c840b637e4dc4ce27a345e06c7650173154cbb55088808e173cbb9e0a7ced16e339c88a43ea218490d014e6be1302d4497348c7a60875cd727c8ffc30003d380c72b25160641c876c752150b2d33d09063625ea6966298102f7095f95939b68ba13af6e6b26b06d64021f55ebeebd1ce31aefc3ee227ba868c1353363df88a8272161fc65b4374175be5a41abb55a959cd98ba67958adfbad6a828930f41dba0a105539e32d3b4d5209a53e909354ff514376a7e1bb7369c1f3f7e41468faaa00c53a773e40d4132e688c6f063d497685a3ec24d91b2b31d634cd491c65e7c546645cc40f927ec91cb54d43e17df030ea1c80df0e19b688a4f000a3382f12ece52374b9ee0454bc78e39119bcb9219756bb4b24f812b44beee29e49ffe04184fcb1cc587160e4b2c4633151befd0fbf91e78d59c382174a903e9ac2efcda426f64ffecfbd71412d36c79aabe2849f448c47e9da1313ffa3c297bd3989c6e5a0f868704367d7304f0a67b9da7a87a0574ab74278ce870ec25ad24a66d6391fd3577c18b7b51b9bc4b50ae5542b9c979e2aa5c34c1ca5a96de9b9809f4009a8bd229088f8f123c19b09cf4e85a88e55fed923cc8de5555781dc0f292e364a9119789762bf1c7116671ae67709e2d12694c16a2d03f8abba50086fb8bd3718915c1fe5d2a494ba646a9c2d934284689fb03b248df71c2d451985e256288ccbfce1040ab15b447b3405ee62d81bfc39aeeff013c2333c647c077501f08a8041b6bdcc193e235f754429325e48171f835fbffa172b0d7dbccc1320183dc5bb4c7db870a4d95a0025fe58aa21fecca6a2309f28db9d695b915953e7f45ee99551f7bcc997aa6827d7e1274708772aafdade16f5c31dc1cce866478bc605c456679e839113418663ef0b9e926eb8087ad80d68479f43bec02ae80e404507155568d5a311ddf723b1382c16e20a0933737d13aff4477bf25f1aa4c492132ee41943f60f12889138b496c3bb83fc64141df4677434685a50e2971a7e295019dae86a7a4db5236792b830ec300e63b0637391ae2e36aa8c4bfd42b511d41fb6c436a122a9c0905d7025587a98232a20e7bbe0ca4e247ab29316b8e4f6f8e646ec83f7e4afb42b8b01731178aa6f0270f7c8cab83c61b93e173f8ba61b5e00a7657d0648a62456dc3aa0fc85e9c96d5b1f43ac7c67d5f184e774b7ada349abc436fcb88f16c39c948c6eb04dd136780e1ba3b7e94e7714bca37adc23cf09e552770af05edac7c11c8f21b09a2aabbd17c4c166272f6b1e6c05097a3a9bdd2c31a7d51eff03b7456e012f01581ed5dbf0e99af5ac61eafab70b36b0dcefaea04493fa581d0b17658be2ca906aaf2b4ceda96cba9b41c7540160bfc2581d8dce623b4e3dc7bef14c20106b7d5ccf880ea545767f09a5f3796f8337629dd6e98f02f06d1b4ed0bebea37d6ebeddbfe123a55f538ca0fbcc8d1e43c67cd957a74c5957324cfa43e5873acf042c20ffdc6ff029beaa8ba519e22f83ad2d61811928bfa7105926d721335ed2d1a3f54348f1432bcd1cb784cab24ef868e6150bcb2096e8ea408d8071864cc863a8bd9c0521c6c170aba77f2985cfd1f0eab7c2d327038e5c5974b668b6371c18bf05552d52fd71fa6ab058f1f3ce9a4beec4ba42e883d3103e1f97d445796d2a08d3e5bddbf9d84a05be27df55afca928954401334c4863b92b176f99462dee218d823f725caf36dd86f12ce352657cb30d8f575311044110a3e2d5409db6450cb61eb8b46d6dd145ba60f5e350be03a538c9d148f24faad4c231a82eb9c20bb647980e0f3c2766e80ca43183ab10298138270d20f08bfa34a9cb3845ec5d3d989385d540c61774b99c02eab40d81c671eab494ff64ad89338f741c88075e8b3995e70e4ca8c3238be875c82ae7f5b1487b5ca62ffb67acdefc6781528227350e37e3835ec0751c8b58eb2fb241a6381479fb5824c0e4ab8545a5cabb48742e3689427c5431fcb591595d66fa6cd76a7bfda6356d5b77a784310d5afcd2e6f96d1d78d289e08c67f8da6f488582ded25d7ab1c908111f691da1c81c473e11e7ae05a8bb8214f683d25e0288ab537ddba05e8e109499cd5e4cbb237d4eac44808665b83b28df5d2aa383aaa4bc00ee5df8a673e18bdeeabfc135f5d54cd363be1937261780579bfef5aad0d1439f6d3d1985327202587bdce8c8be2a8a41d", &(0x7f0000000140)=""/2}, 0x20) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r1, 0x8010661b, &(0x7f0000000100)) syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x100000005) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) pwrite64(r6, &(0x7f0000000040)="46f4b58982ede3e19e", 0x9, 0x4) timer_settime(r7, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 3.342264613s ago: executing program 1 (id=791): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x93, 0x0, &(0x7f0000000240)="b46180230562440700000001000000010000986919d5d5a9080000e42d0000601bee936390009c5bbd000000003632b69f0eb2062818f298ed60abbc6f6322cbfac4000000000000008d63063239d18657d8def274d1347d3865060861c96bbe67808cf339089d46844de51517a756705ab535c084ee3da160dffccc6ecbc132908c2d4588aec206fc0800000000000000423d", 0x0, 0x424, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x80004402}, 0x50) r0 = syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000000)=0x2, 0x4) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000380)=@delqdisc={0x434, 0x25, 0x8, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xd, 0xf}, {0xffe0, 0x7}, {0x0, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x3, 0xfffffff8, 0x4, 0x40, 0x2, 0x2, 0x5, 0x6fff, 0x4, 0x2, 0x6, 0x1c8, 0x7, 0x0, 0x5, 0x0, 0x8, 0x9, 0x9, 0x9, 0xf5, 0x200, 0x1, 0x5, 0x6, 0xfff, 0x9, 0x1, 0x80, 0x10000, 0x0, 0x8, 0xff, 0x4, 0x6, 0x9, 0x40, 0x2, 0x65, 0x6, 0x5, 0x71, 0x1f146d7e, 0x6, 0x89, 0xe9, 0x80000001, 0x2, 0xff, 0xb2, 0x0, 0x400, 0x0, 0x2, 0xffff, 0x10000, 0x3ff, 0x0, 0x1, 0x5, 0x0, 0x5, 0x8, 0x3, 0x4, 0x401, 0x5, 0x8, 0x4ad1, 0x1, 0x25ae, 0x1, 0xe, 0x9, 0xe, 0xffffffff, 0x7, 0xfffffffa, 0x3ff, 0xfff, 0x8, 0xf, 0x0, 0x4, 0x626cfd3b, 0x0, 0x60df8662, 0x2, 0x8, 0x4, 0xea, 0x8, 0x7, 0xfffffffa, 0x9, 0x4, 0x1, 0x3, 0x0, 0x9, 0x2, 0xffff8000, 0xe13, 0x8, 0x7, 0xc, 0xfdc1, 0x7ff, 0x4, 0xfffffff0, 0x4, 0x7fff, 0x1, 0x1, 0x1f1f, 0x3, 0x665195e5, 0xfe3, 0x7, 0x8, 0x8, 0x7, 0x4, 0x801, 0x1, 0x400, 0x2, 0x6, 0x5, 0x9, 0x7, 0xc5, 0x99, 0x4, 0x2e9, 0x4, 0x3, 0x401, 0xfffffffe, 0x7, 0x80000000, 0x2000008, 0x0, 0x4, 0x37, 0x4, 0x31, 0x2, 0x2, 0x3, 0x6, 0x1, 0x690c, 0x368d, 0x2, 0x4850, 0xe, 0x8, 0x8, 0x5597, 0x3, 0x4, 0x7fff, 0x62, 0xf6, 0x5, 0x0, 0x7bffffff, 0x9, 0x9, 0x2, 0x100, 0x6, 0x101, 0x5, 0x6, 0x3, 0x4, 0xfc8d, 0x8, 0x3ff, 0x3, 0x5, 0xd, 0x5, 0x9, 0xfc, 0x8000, 0x1, 0x7, 0x20000, 0x4, 0x2, 0x9f85, 0x7, 0x85, 0x0, 0x2, 0x4, 0x6, 0x7, 0x24000002, 0x40, 0xfff, 0xe1, 0x8, 0x426, 0x5, 0x9, 0x1, 0x1000, 0x9, 0x36ae765f, 0x401, 0x9, 0x200000, 0x3, 0x1, 0x5, 0x0, 0x89, 0x5, 0x80000000, 0x9c4, 0x1, 0x41632842, 0x6, 0x10, 0x20002, 0x8001, 0x6, 0x100, 0x8, 0x9, 0xfe64, 0xd, 0x1c2, 0x2, 0x6, 0x2, 0x80000001, 0xa, 0x6, 0xfff7fffc, 0x5, 0x3, 0x7f, 0x8001, 0x5, 0x3, 0x6, 0x8001, 0x10001, 0x5, 0xb, 0x7]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x40000}, 0x8010) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=@newlink={0x68, 0x10, 0xffffffffffffffff, 0x70bd2b, 0x25dfdbbb, {0x0, 0x0, 0x0, 0x0, 0x50a10, 0x51fa3}, [@IFLA_LINKINFO={0x48, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x34, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0x30}, @IFLA_GRE_REMOTE={0x14, 0x7, @private2}, @IFLA_GRE_LOCAL={0x14, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}}]}}}]}, 0x68}, 0x1, 0x20000, 0x0, 0x240440d5}, 0x9080) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0x85) 3.231428035s ago: executing program 1 (id=792): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f00000000c0)) mount(&(0x7f00000000c0)=@filename='./mnt\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='dax\x00', 0x8491, 0x0) write$evdev(0xffffffffffffffff, &(0x7f0000000000), 0x0) mkdir(&(0x7f0000000940)='./file0\x00', 0x51) readlink(&(0x7f0000000200)='./file0\x00', &(0x7f00000002c0)=""/168, 0xa8) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x7cbd00, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x1, 0x6, 0xfffffffffffffffe}) 3.022013266s ago: executing program 2 (id=793): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x3, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x810}, 0x400d4) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f00000000c0)=ANY=[@ANYBLOB="e0000002ac1414aa0000000003"], 0x1c) syz_emit_ethernet(0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="ffffffffff0300aaaaaaaaaa080045000028006400000402907800000000e000000211009078e0000002000100020020000000000000dcef4532f16cdcdd86630a4ced0fcb00dc90bcc9e097b8395660091449b7212767e5c896b4caef5f7a1646239c043afe01e16006a59eacb2674b8e5dd8fd593c5a11a7e3f297510353023c67aeebbbe237a30c1893b5743c3669152e905c17721156df91c5305e87b71a035af5b20d8dbf3b0e6e8b5c93ceb60121f4007ffe9abb47924b02"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x18410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mremap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0x942, 0x0) rename(&(0x7f0000000000)='./file2\x00', &(0x7f0000000140)='./file1\x00') r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r2, 0x5) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) connect$unix(r3, &(0x7f0000000640)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r4, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) syz_open_procfs(0x0, &(0x7f0000000140)='fdinfo/3\x00') mremap(&(0x7f0000000000/0x9000)=nil, 0x600a00, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, &(0x7f0000000180)='asymmetric\x00', &(0x7f00000000c0)=@secondary) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x20, 0x10, 0x100, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x220, 0x68591}}, 0x20}, 0x1, 0x0, 0x0, 0x8040}, 0x4000804) 2.958277595s ago: executing program 2 (id=794): r0 = socket$inet_udp(0x2, 0x2, 0x0) setpgid(0x0, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @empty}, 0x9) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@multicast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @multicast1=0xac14140f}, {0x4e24, 0x4e20, 0x8}}}}}, 0x0) 2.958062965s ago: executing program 2 (id=795): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/ieee80211/phy0/aql_enable\x00', 0x2, 0x2) write$cgroup_freezer_state(r0, &(0x7f00000003c0)='FROZEN\x00', 0x7) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x82400, 0x0) ioctl$TIOCSPTLCK(r2, 0x40045431, &(0x7f0000000100)) r3 = syz_open_pts(r2, 0x8000) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000100)=0x1) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl(r4, 0x8914, &(0x7f0000000400)="736c300000000000000000000000000001") ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000040)=0xbf) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'syzkaller0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x4) write(r7, &(0x7f00000002c0)="29000000140005b7ff00000004eabdeb0101b6ff02159f7e5520756b1933b49db96ad24d12595fbea5", 0x29) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)) r8 = socket$nl_route(0x10, 0x3, 0x0) write(r8, &(0x7f0000000100)="7c0000001800051105000000000000000a430000fe0400010000000014000b0020010db800d000000000000000e0ff001c00080008000200dc05000008000300e8030000080004000a00000008000400010000000600150003000000200016800c0001001234567890abcdef050ec700010000000500070002000000", 0x7c) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB="300000e91b00010c000000000000000007000000", @ANYRES32=r6, @ANYBLOB="800002000a000200aaaaaaaaaa23000008000d0001000000"], 0x30}}, 0x0) 2.604104727s ago: executing program 2 (id=796): r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = syz_ublk_setup_io_uring(0x21, &(0x7f0000000240)={0x0, 0x1b6c, 0x10, 0x1024002, 0x804d}, &(0x7f0000000000)=0x0, &(0x7f0000000380)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000980)=@IORING_OP_TIMEOUT={0xb, 0x12, 0x0, 0x0, 0xfffffffffffffffb, &(0x7f00000000c0), 0x1, 0x40}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000800)={0x2e, 0x40, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x98c8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@new_dev={0x4, 0x412, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1e0}}}, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000480)='fdinfo/3\x00') read$eventfd(r5, &(0x7f0000000280), 0x33) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r0, 0x8010661b, &(0x7f0000000000)) syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwrite64(r6, &(0x7f0000000040)="46f4b589", 0x4, 0x4) 2.541657263s ago: executing program 1 (id=797): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448cb, 0x0) syz_usb_connect(0x5, 0x2af, &(0x7f0000000140)={{0x12, 0x1, 0x300, 0x2a, 0xc9, 0x99, 0x40, 0x1bc7, 0x10c4, 0x2d44, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x29d, 0x2, 0x0, 0xf0, 0x180, 0xfa, "", [{{0x9, 0x4, 0xaf, 0x0, 0x3, 0xff, 0xf, 0x65, 0xfd, [@uac_control={{0xa, 0x24, 0x1, 0x8000, 0x13}, [@processing_unit={0x9, 0x24, 0x7, 0x4, 0x6, 0x40, "dc65"}]}, @hid_hid={0x9, 0x21, 0xfff8, 0xb5, 0x1, {0x22, 0xf84}}], [{{0x9, 0x5, 0x80, 0x10, 0x20, 0x6, 0x6, 0x5, [@generic={0xc3, 0x8, "a0b2bb051e1d1693de0476b724780eb55de4c9022eb14d4fd885adfcd109650ee768482334169565e5464dea549cd7b34f2b15606c88beb35186d2df620a6e32e258073648535d852207f6bab7f3dfe3d1f265a41f230dc99fb6f9edf46273ebd970d6c20629df65e50ae2d078a5c12befc6abac3226bf4f8285afcbd457b27063e8c207635f75bbc889380a70a13f2a7bd52f2222e1a4f14329810a6381096fa126f9ba057b252da2a2e1af20788e519f1012d63df568ed6d915a9f3f271a34d6"}]}}, {{0x9, 0x5, 0x3, 0x10, 0x10, 0x1, 0x9, 0x9c, [@generic={0xa9, 0xf, "85faadb28a3a5424dfecdf3fc5470171a3f5fdefaf0b7744b9d923b4b9c292272b323bac5cad82c2b35cfc6f18e935c8061d5864647760c0757b8149b25ab4248e953b100817eb1302af1ed23a55acb556f8434631da928af5fd0a10f4699ce8d3d6d7dec2223437b73cc2106e81e1ff6f7882124aba8408f5eea60f548cbc4cdeb91a9a4c8b08295c0f38d484173373822e848d9bc727516c8aacce3532eb00e31970efddeeec"}]}}, {{0x9, 0x5, 0xc, 0x2, 0x10, 0x3, 0x0, 0x5}}]}}, {{0x9, 0x4, 0xfd, 0x9c, 0x4, 0x6f, 0xfb, 0x73, 0x9, [], [{{0x9, 0x5, 0xf, 0x0, 0x8, 0x7f, 0x9, 0x5, [@generic={0x5, 0x28, "526aeb"}]}}, {{0x9, 0x5, 0xb, 0x1, 0x0, 0x8, 0x3, 0xc8, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x3, 0x7}, @generic={0x9f, 0x22, "a2a35791ae4900c5dc073546b94696998cc091c8d9be4a24920c7c7e71d02622e285c5163eb8c77a7556c2385e569d4e0a23801b4ede2dee687152f6920e2c2bbfe963848667922f9ebc2222730ac3931ea5a31e58470534582dfd47646a5fd9d56da5a496db166efda3c274eb081dc120cc6c0a69f349844d515781a96b95157d9d4cf7720247371c2857b3d72d154e8a5f1d4521597fbf073af0da75"}]}}, {{0x9, 0x5, 0x4, 0x10, 0x200, 0xbd, 0x1, 0x7f, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x2, 0x6}, @generic={0x2, 0x5}]}}, {{0x9, 0x5, 0x5, 0x12, 0x410, 0x3, 0xb, 0xf, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x2, 0x4}]}}]}}]}}]}}, &(0x7f00000008c0)={0xa, &(0x7f0000000600)={0xa, 0x6, 0x200, 0x7, 0x2, 0x9, 0x28, 0x4}, 0x21, &(0x7f0000000640)={0x5, 0xf, 0x21, 0x3, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x4, 0x7f, 0x3, 0x8}, @wireless={0xb, 0x10, 0x1, 0xc, 0x0, 0x3, 0x81, 0x1, 0x9}, @ext_cap={0x7, 0x10, 0x2, 0x1c, 0x0, 0x3, 0x8001}]}, 0x8, [{0x4, &(0x7f0000000680)=@lang_id={0x4, 0x3, 0x3801}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x409}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x44c}}, {0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0x44c}}, {0x4, &(0x7f0000000780)=@lang_id={0x4, 0x3, 0x1c01}}, {0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x415}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x439}}, {0x74, &(0x7f0000000840)=@string={0x74, 0x3, "39fe79f85efac6973b9f0c0e9f5e21c3c351af0e4aa98dc2bb77c90e120dcf6e6fe5a1516e685da0e64e2df64be15eff0db38138f340f3459ec0c8db422f3fb446d05fd23f4887fd7f68ca5331205c0007364cd273b5cb288896e032ce7801f995b23ece247bb2b9b83ce9a44bedef149389"}}]}) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) 1.470831085s ago: executing program 0 (id=800): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x5f5b, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000740)='^', 0x1, 0x40000, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[], 0x14}}, 0xc04c055) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80004}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4c000000232c2ed95c8d86160adf2f82389a03ec5bf29e8d2ed7082ec906b8137db5f6884c197033be64871dcd5b9e34d01cb6e8dd4a48c573ba66a480f6602e3320e5c8821260c0c1a4de4b0400830e244a76e8e37a87e9674425d3cb7d314af0f915365645", @ANYRES16=r2, @ANYBLOB="00032bbd7000fddbdf251000000008003c000000480005002f000000000005002f0001000000050037000000000005002f0001000000050038000000000008003c00ff7f0000"], 0x4c}, 0x1, 0x0, 0x0, 0x200000d4}, 0x4040000) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='task\x00') lseek(r3, 0x3, 0x1) getdents(r3, &(0x7f0000000180)=""/152, 0x98) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@timestamp, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x2000000000000061) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) 1.375925862s ago: executing program 0 (id=801): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x33c, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000080)={0x0, 0x8, 0x2, {0x2, @sliced={0x0, [0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x71, 0x10, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x88b, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x3]}}}) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$FBIOBLANK(r1, 0x4611, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) ioctl$EVIOCGBITSND(r2, 0x80404532, &(0x7f00000000c0)=""/15) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(r1, 0x40786e88, &(0x7f0000000480)={{&(0x7f0000000180)=[{0x5, 0x5, 0x4, {0x7b4cdbd2, 0x8}, 0x5, 0x3ff, 0x1000}, {0x101, 0x7, 0x5619, {0x3ff, 0x2}, 0x4, 0x5, 0xfffffff9}, {0x0, 0x7fff, 0x0, {0x3, 0x8}, 0x8, 0x9, 0x1}, {0x354, 0x9, 0x3, {0x3ff, 0xa}, 0xfffffffffffffffc, 0x200, 0x3}, {0x8001, 0x4, 0x3, {0xe, 0x338}, 0x0, 0xe, 0xfffffe3a}, {0x3, 0x1000, 0x73, {0xfffffffffffffe00, 0x1}, 0xfffffffffffffff6, 0xfffffffffffffff9, 0x7}], 0x6, 0x40, 0x7, 0xffffffff80000001}, {&(0x7f0000000300)=[{0x2, 0xfffffffffffffff8}, {0x36a4, 0x4}, {0x3, 0x4}], 0x3, 0x10, 0x3, 0xed}, {&(0x7f0000000340)=[0x0, 0x5, 0x1, 0x5df5, 0x8], 0x5, 0x8, 0x16, 0x100000001}, {&(0x7f0000000380)=[{0x80, 0x100000000, 0xffffffffffffc8ed, 0x7ff, 0xb}, {0x7ff, 0x1, 0x7, 0x6, 0xffff}, {0x3, 0x8, 0x27b, 0x2, 0x8}, {0x7, 0xb38, 0x1000, 0x1, 0x800}], 0x4, 0x28, 0x100, 0x5}, {&(0x7f0000000440)=[0x4, 0x1ff], 0x2, 0x8, 0x9, 0x5}}) 1.313351795s ago: executing program 0 (id=802): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000300)='pids.current\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000002c40)={0x2020}, 0x2020) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_BACKLOG_LIMIT={0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r9 = openat$tun(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) r10 = syz_open_procfs(0x0, &(0x7f0000000140)='task\x00') lseek(r10, 0x3, 0x1) getdents(r10, &(0x7f0000000180)=""/152, 0x98) sendto$inet6(r2, &(0x7f0000000080)="adc495e5877a42210f3b36c3", 0xc, 0x40811, &(0x7f0000000240)={0xa, 0x4e23, 0x1ff, @private0, 0x4}, 0x1c) getsockopt$SO_TIMESTAMP(r2, 0x1, 0x40, &(0x7f0000000000), &(0x7f0000000040)=0x4) 980.743082ms ago: executing program 1 (id=803): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x80002, 0x0) (async) mount$9p_virtio(&(0x7f0000000000), &(0x7f00000001c0)='.\x00', &(0x7f0000000080), 0x4, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@getnexthop={0x20, 0x6a, 0xe976912f002a1383, 0x0, 0x0, {}, [@NHA_MASTER={0x8, 0xa, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x2000008c}, 0x80) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) (async) chdir(&(0x7f00000001c0)='./bus\x00') (async, rerun: 32) setxattr$trusted_overlay_origin(&(0x7f0000000000)='./file1\x00', &(0x7f0000000180), &(0x7f0000000200), 0x2, 0x0) (async, rerun: 32) syz_emit_ethernet(0xe, &(0x7f0000000240)={@local, @empty, @void, {@ipv6={0x86dd, @gre_packet={0x1, 0x6, "bc4a06", 0x46, 0x2f, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8100, [0xdb05]}, {}, {0xa888, 0x88be, 0x0, {{0xc, 0x1, 0x8, 0x1, 0x1, 0x0, 0x5, 0x14}, 0x1, {0x7b40}}}, {0x8, 0x22eb, 0x2, {{0x3, 0x2, 0x2, 0x3, 0x0, 0x0, 0x1, 0x9}, 0x2, {0x3, 0xeb, 0x0, 0xd, 0x1, 0x1, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x3}}}}}}}, 0x0) (async) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000000)="0f20e06635400000000f22e00f237e3e660f124bfab853058ec80f01ca0f20d86635080000000f22d80f01cad838ddeff20f58f3", 0xfffffffffffffe3c}], 0x1, 0x2, 0x0, 0x0) (async) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000001c40)={0x14, 0x23, 0x409, 0x70bd25, 0x25dfdbff, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x24044811}, 0x0) (async) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000005c0)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) (async) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, 0x0) (async) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4400ae8f, &(0x7f00000000c0)=@arm64={0x6, 0xd8, 0x1, '\x00', 0xcc95}) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async) ioctl$KVM_SET_IRQCHIP(r5, 0x8208ae63, &(0x7f0000000840)={0x2, 0x0, @ioapic={0x8000000, 0x6, 0x10001, 0xfffffffe, 0x0, [{0x2, 0x4, 0x85, '\x00', 0x8}, {0x8, 0x8, 0x40, '\x00', 0xb}, {0xff, 0x60, 0xd, '\x00', 0x67}, {0x0, 0x5, 0xd4, '\x00', 0xff}, {0x7, 0x9, 0xc, '\x00', 0xfb}, {0x0, 0x1, 0x54, '\x00', 0xff}, {0x9, 0xd5, 0xf1, '\x00', 0x7b}, {0x3, 0x4, 0xc}, {0x7f, 0xd, 0xb, '\x00', 0xb}, {0xd7, 0xd, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x80, '\x00', 0x5}, {0xff, 0x1, 0xfe, '\x00', 0x1}, {0xfe, 0x7, 0x26, '\x00', 0x1}, {0xcf, 0x3, 0x1, '\x00', 0x6}, {0x11, 0xee, 0x7, '\x00', 0x3}, {0x39, 0x2, 0x7, '\x00', 0xb}, {0x9, 0x6, 0x1, '\x00', 0x9}, {0x5, 0x9, 0x5, '\x00', 0xc}, {0x7, 0xe1, 0x7, '\x00', 0xc2}, {0x0, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x6, 0x6, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4}]}}) 821.140377ms ago: executing program 1 (id=804): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket(0x1, 0x803, 0x0) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r1) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r3, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000680)={r4, 0x1ff, 0x0, 0x12000, 0x3, [0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x3], [0x0, 0x1001000, 0x800001, 0x4], [0x0, 0x401, 0xfffffffffefffffc, 0x9]}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="58000000020601030000000000000000000000050900020073797a3000000000050004000000000012000300686173683a6e65742c706f72740000000c000780080011400000000c050005000a000000050001000600000042b88c14c3999c9ec8d7df5995ba3edf75ce792eb57c12d99dd6e940c7213d8ae256ccb9455d5bad58f3f0e1b9c9cf3c3939170b2627f485292b318dad29c4c86ae5fd23221fd9fbf88a65d87a03b7157be6f33343364ef036fd7cd9e0a0dec76f0103a449170d44c1b719ba88b317437414aed4689e69f187a2f22c2bbcc42e979d9e4e7cebf0a1679e808da367fc7e85a162ef6773331f38b46796c6c0182946b91aa3269b7e7ad80a54d033a6b621d92d6bca4fe63d27ec15"], 0x58}, 0x1, 0x0, 0x0, 0x40010}, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f00000001c0)={0x0, 0xae, 0x3ff, 0x34325241, 0x1, [r5, 0x0, 0x0, r6], [0xfffeffff], [0x0, 0x4], [0x0, 0xdf2]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./debug/ieee80211/phy0/netdev:wlan0/aqm\x00', 0x0, 0x0) read(r8, &(0x7f0000000200)=""/200, 0xc8) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000440)={r4, 0x6, 0xfffffffc, 0x6, 0x3, [], [0x1df8ddee, 0x9, 0x0, 0x101], [0x9, 0x4, 0x1000, 0x101], [0x4, 0x5, 0x2, 0x6]}) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r10, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0xc0, 0x0, 0x1, 0x101, 0x0, 0x0, {0xa, 0x0, 0x3}, [@CTA_LABELS_MASK={0x24, 0x17, [0x1, 0x4, 0x1, 0x80000000, 0x0, 0x0, 0x7fffffff, 0xfffffffb]}, @CTA_TUPLE_REPLY={0x54, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @loopback}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}, @CTA_NAT_SRC={0x2c, 0x6, 0x0, 0x1, [@CTA_NAT_PROTO={0x14, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e20}]}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x1ff}]}, 0xc0}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=ANY=[@ANYBLOB="2c0000001400b595a5ff77d600000a40000000004572c2a499c4d3f2cef5b7601d6409d540db630de37a6a85aa388a3f453c21673b25c1f54de90798e706f82b62c5f1cdd64375c98345cd1b7cf14da2e8faa67e4ad6f6176b2decd5b110aaf55b1f26642245aa38f795c048cce2c2c38ff1fd237509eff1c1f8ebd2af0744d73b32bdc951e4df12826b31edd674ea37f5c500e8c53b85ab5d8ac5a1b4760df8f5fbcd6dd4f46a07af407bcb1ba264492bb84fd50b94e6f381a416b7b78ab4ec3b0eda7ad7e1d500000000000000000000a07f4fa4f1d5135e9d39d0760f5a0160a31b154d7e7debda170b06af2bbd0034e3c6868ca6f4070d8b946101978c", @ANYRES32=r9, @ANYBLOB="1400020000000000000000000000ffff00000000"], 0x2c}}, 0x0) r12 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=ANY=[@ANYBLOB="340000001400b59500000000000000000a000000271e05fad07af127dd7df97597998f91bc59d15727d83c9bbc3999e88c37ec02e5c612f945f5405ae1a6095b020e6550a1a3e63545a3fc85638470525d712e3e44f315d66af3428917fe7be318e9e659bda075d3bc645dea56cb1a0ad1d1225a7cf4f992652e3cdb2da8dc3c3ba400bacbafb762387f607b20ac00d903f5fbe954a9978bfbce92afef", @ANYRES32=r9, @ANYBLOB="1400020000000000000000000000ffff000000000800080010020000"], 0x34}}, 0x8000) 565.757692ms ago: executing program 4 (id=805): syz_extract_tcp_res$synack(&(0x7f0000000500)={0x0, 0x0}, 0x1, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x4e20, 0x4e20, r1, r0, 0x0, 0x0, 0x5, 0x10, 0x1000}}}}}}, 0x0) syz_emit_ethernet(0x1062, &(0x7f0000000a00)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2e}, @void, {@ipv4={0x800, @tcp={{0xe, 0x4, 0x2, 0x8, 0x1054, 0x68, 0x0, 0xed, 0x6, 0x0, @loopback, @multicast2, {[@generic={0x7, 0xb, "2b984f26f637e3e3b3"}, @ssrr={0x89, 0x17, 0xe7, [@initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @empty=0x700, @local, @dev={0xac, 0x14, 0x14, 0x29}]}]}}, {{0x4e23, 0x4e23, 0x41424344, r1, 0x0, 0x0, 0x7, 0x8, 0x6, 0x0, 0x9, {[@mss={0x2, 0x4, 0x1}, @nop, @window={0x3, 0x3, 0x2}]}}, {"b5e383d672ede391238ca355c7dfcb0e362eb827d292bf62a47fc10af2c4053758b5f920362d0cd21e8c7e51f28148ed9194db04c41b8d098cf2e154dd311abaed14b21300250307244f02923366ee920ecdc4a4f79fd57443499e4383e7d022c68a1bf19d0b6d0e014adbbe78ea9f4387e71e8f282c826f2306a5bcf6b84f16c1eb4fad4b0e0dfc50cae67afbea99a51a41b678d4ab05501c29c476cafd271e791902d558de216a0bd11ccd25534176874a706a57a823bf3464a319a3e44592626257613cf21d43b403ef2704cb51b990fa38238b758d1f2033a7335045d1d5ff4f56abf7ab7e779e9ba5394b3cc386203a17fef1f47fbf3e9a3bc92328ebc6cd037a1069871f496f433a9a5bf0920b80b18c7815f30fe49d2076b35786ac8fddc0f2cc0cd668c74cdf97da39ac569d2f253795ed8fd79b2e560029297f181b5de151dfd698d9edccde582e53a359c8bab9fa2131bc6369ae5eb096ec75a7fd0b79521389f2bda222e3d39195f679c69048f568f7a6e87ca6ff1740814a9cdf6ce64a7cfd2bae4e205031c58a77ab987b05bb00fe8be533a906c25af76678e5e8c1ccedf13fdbd8e2fd457f6762ba91ab31004ee7e31afcfb39291e41afbc1076a108e1c63392d8cef682d0f563c353e0cf3014b2e0297729fe5bf408bccbf1310321321553cb292a7c2668c1546b63493bcee2312e53fecf331d6e8d728b6b5f91383843404835bf724b33b77f2e54196d6723310cba542234dc685981a522f862933e29e0ef96c768c86f58ef67e7c030e6bdd58e93eb06e7da40d28416bea5f5d84dd478a170856c4ec9535238dec901fa86ccb5f590a45f625d5a12d80fab3d906c0e144d87f651b47876b783dd2bc3a125a548556221e4eec5569a2dd17b89692c950478060925500ac1c9372e7448ea0f978b343b4001a50ff6a53299ac2d19bc2601930983ac98f6c0e5f887b2ac65c48dc7b41e228141c9663884811bc6229d5955f11c47d7f7a209e1f244f79431310d48a3b5df74b378894479843e307d7c23bfdd79420f7956dea162e632e77cf6de1ba4e752eff2f066e973e57c4c1026c053985ed0eb0143c1cee913b6cffc90e167007c99638bee18fd1191b770cea3154e506f57125ce033ab3b361d31851fb3b60010c96f9c19b42ac5673717dcdd6853053187ac21267c950a36f9bdf4c9415338e00ac13571f13f1906e24312630eebff64d3def9be4dec1d59c038b6a5601ef9eba76c040bfe2247609d1e90aefb0e10a141b8bf2871ac375df7b21f56bb6d9fa75d094f7989dae5950fc528c0a8707801199930f9b2506eec53a64f4a78896b41683442856b67e3040104c0efb64b69d602f513d6bfdffe14c9112e194341d1981c5e1778eca6c05f2a42112e5dbb97c30610393eef35ddf48afa317b0709f2877f056970bc57864aa7ffd56d35baf387e5986e5a52207a1e177d9af70adb4f9498f90a42f27ede60b5beb0c3c4743fcf721c348152db51f260e78580843ec6796db307649cff9c6c3a3f639b737fdf2a8defd75e6e208d0ea305fa0d0bbc52d465a51aae99080169c832f5370a8989f75255f5edf11f93327349664370c9402198af465340f30f16bb5476df8650b5c05470dc5dfb660a089184db653c8ff916891cf991ac886bdd52cffff3cf5ddd2514abd2a2ccc1b8ae970a4cf4769d011c617cf68a0b8a5f1a2ae3135e5fc61161931cacb83dee440ec8a22a65370cad8bbbf1bb6970ecb1799d323dc41dbc48dabd6c68d94224d435a71552a8ba91f7d7c5ac2030e421cf8a22a3b6577d9b13753318fb2956b4de39f70dc46235e9d916092661d592d6a296e5391bf34dfcf8976c8f9c1323e4c2d6f5e6efbd0c67291e442694bdc6cc609022dd63a84061b80989e609e606ffe5cf54b63542b61767321a7fdf3e47e2060a5ab32bbb61a41a23c066e8dc7c831bb738c5c2d79e0b06235bde440deb03b04aa242ed7c91c0389834f5907afe7b292d4740732a9687607e30f08a9087c0ce41206e6143b842c181c2aa437627b6be649a46994146073de7e64a1dc3e2e5c79af2a96d5adf7501d4fb5b3a447729e42052e089747c58b1b9ce9828abdb844fe22d5851257448adef447b192d15a849a82cbd88f931bd64a5e40ce5f2b427bae3fbcfd5fa1933931071f5a5d280520e233071ee2fe1e8dc7ba9759e679139b8e03eb7fc7bae9ec0db0c1cfc20b591eb6ba714525e351e9414f5840888b9e443ed1906154c79a32b302f7d6484f3a3c1ea8a54596bb133e8380ef356c63d8c4a8dcf29236afcaa9f4ccb89da325fc2011d87f5ab3697b039b21dcaa9da5a5be4d075e988874bdedb783f8f5f97e93cf5113227c371bb583aa54b3c5a2c7a9be7636cabdce6a976b2ed6e074ef9b114cf71471a7b6d000b162626dd58dc7e28208796907ea4cbcfff903ddb380ee375173be459ecde241f979a8442ae7a37873f9f74c8c010c43118052aaaf52411e68ce16608bd8db56d5e370c3d0cc6b580859b782cb058570ee37851b6afb1b46cd651ed47c44c981a50f48c6780b05de06d380644d04df5f2497098562edb56d5478182681d34875c297ccdc7856d0d660b899ee5d8701b7df952805e5e4aac8d19eb026baecfde707bf0dc4fad49a6c32de38e41abd606c4a91b500a1dad7a1cc6419a938c5954d6c1a8722d5e6d090159e656a2e8f8329048a542b9decdbf1d32d9b664a794ee75fd1f9fd34d256349cc18ef96d003d37361c38c5422602c5f6b3b19a1ed92fe11a9cc6d4e4696dbb71e2a2573d6dd121a2ed68d0eb9d56099df594c59671cafd1f35a6e82e9231193c0b97dd2d57e9e5cb7cb8f14bcacf660b486e0e8f3579725b048f5b43b7ce4e028ac4fc84c76cf76ef21e14fb4347d74e520e2126df75f95f5c9c36e7a91977c07c9fb5ba2a4c199ee4b4fc7acf8da4100bf1990b84ca5a6ab1808c0010a60a5b874d9d38e917c354b6df7e6f49b16560f374626de092e7f23dd5e66511272677115bbd766c7037281ece682222e9bb4e65e557c708cbee3405391ef71aee633fc04f9960e3af715b2cdc46f4e13fef46d01fba9011e17c6a43d2a4a4297b1020a4bdfcbb1203719a52c9c045840c82434576c48018237bbab70b7e31a60ec76ed3a653d0cea3d9d5d74554780a558dcd4a51fd1a96d8d4bcd4ba136e91331446a5542d4e1b3fa8a4a32e9ce19d26006a5f2e1404491d7d8020207e9413648dec42131bccf9dcd49131f5044aeec90b3526fc7cb354c81e69c15fe3a2b325c9dfb7cb060b639c75f2533a5fb7c5e07aeb7ec22e839c6c35834728efe42e37f19e07588daa07c7ebeabd5c2fee413f0ed861e7d966143ffda6c57ab04adaa1b9cf28763f67f351811f875940e18057f49b85f5c7f24fee253660e5467337f0e08edeca225ca667f0854d8a9bfcbc8842db47f6c16cb959621917f9549dd5b7a097d0be6d41a1c9b1018259c8895ef25cbee0cb78e9b9091b20a827c4a4dfe03f607c399171e0846e0d7fc7ad490957cb3b787cef19661c0fe45d0a2b4b589a6b2c32b4807cadbfed5f110057f03a830631d21bae969cf28f8aae90637f37c1c2d1f9489b1441704389c8e572a496d96b319dec31f4fceae7716806d96da89a4afdd77e29da84867b0bd2924b7108bcc3bf747d6187c660ababa94b58e1f8df2c86735bef867d8237b24c4874aab384434a0c15e7b3238a12f07a18afd7ac9f4189ad5e6c90c31b9eefc4ea65f382a1e01bcd49ad1eedeca0edbbce30fa0af818612b4bbff23e598d09fb6d5005f0dc00fc8077d5b72700c2b205c98abc92b6d3ca28e53fba847cbe28f89668ae4f3b28941c432c5de489cbfee778ced9a085697e0a9e41d569e02129ff1049e78e9b2ea545d400aa4ddec873368ecec8376c979b7b11edd2b8e7672cb0a3ff0c7b37e13b3bfd44925e1a2a2131c5b4717b5ab3baefded6b0aa1e8ce2446ee5e78bca051858bdc8b337bd3b0a85372718a36e384ee7f1ccf098c6c0bec6bc8ee3c33667854fd498c0b359334fb5e5f0ecb41cf3690391cb7cb77f155eca463ce617f9497bb497603893eb0257e2cadc881f3170955d27d2d190081b54e58e539ea0b7d468761a01c158e175504fa88d29294c7197d6c35500ab53ef04180b8606da75e3873359cf4c6e73dcc432db418e4de27a18450e11dd8f12eb801e35b7dbfba18f45b1f24b53ea722373a3b8d1334008fa411a4bbb1fbf65a95348286a5f219510ef63d29081b38f16921f358381d87f2a0d7f6830a7024e6405fdd28b7b407a47ef924c8e972c2af08f161541c4b42bdfc1e9a93ef66c1f2bbc8b0a4f0363c819947668b88fb9b53f351a1913b5c7cb2a8141fa3fb937a5babad2328020707e99b0bbc70b331ca8ab2dc8e207d78e2e529a49d041367090b854500dd62b6fca4ed584a238586f4709b3ef2db564b7eadb32b44faba1a8e774db4d656f73518a631e719f1ccfbc7779835bcefc0c28eba5abe6aff49647c3ed47f29b1995e5ed0be615385b2b6156ff885f70fd7ed5f70c66e322d03cde9636290ca775f512812c862e2cc13567a21365a8ce0d546b3d2b3ca41e931e6f7961e85e09ac53d52014b79ab75a990c60535511891265574a064c3b23d4cedb409901ff7f4b745de96baa75452f57b7d4f069df889f2e32243470c4c1f70303ea43f9158eb390ffdccfec0506072380281e033559e3ff98cd462432b83e127fdaef3e4563f0a240f660606552947d980018f13990fab79d080a14c2a999c41a73c56bc1b7ee831f6f699e979e62af509ac1fa1a047f518613753ea45b62e266fc394e22d505313eccf323f08cf2e35ee3e1fa12747e02e189c95b004e9fb5967d36304feaa2bf429070f5707f60b7ff8b13a33df377cda2e9561f87d0a512aa86a5b9ce8c6715782f62b0fe435b7417e0fe18e3e93f9536831689ae010e613d72f708f40c5cae1c3f95a146b5efebffe4d9b180eb32d59056c7fb8aefc7f5eceb746b60a78feceb3ac14995fa603342b804dbed40fd8966d801b0b89722ae7aa3650e9f87548acfc169e6730015d185375de7a1e6b1f399fa2dda27c025b699298b662b9fb91594a9acb9f6c339f1a1966d0e73c8e5d9117af3dfd89609a6bbfc1606d3c50c3b21d4e79c614140c5ff1b02eb71038c92aeef215347c684cece7c575cf46917d3299fb7eb976cdb2ca7a6214367368adcfc695e451e20463a89199ec43c9294fe718b3a85121b71ac5e31ab0f1247c220eda53abac5c1a5e158a7ef73a1142ee787f1bedac1c0391459a43a94e773f11ef043622700a9e5045b8cbc4b7e436c812fa9919828cac0cad8b70652c7e0187599b1eb8c514b4c37bfed3ccc4caa7118c2ac3cdd23d60b394cdc63c3dc5e1655e3e791b46c76374ed978d111835346001a935e2fdd89dc8a408e090dccacebcfc7fafe1e05062e855af71fbbf15e3a9723bea1b89182592226ec7eacef4df5005faae5e7ddcb9215324aa86c7dbf4d43c27d15691507fdb18bbc55f59f62f34e5f6645bc6e585454a04314187a34948c7f6edb36694efa04f6ec7f8cb6e868a0a06fb3fa93d58f5af786e466a757e8dbc35cd9b397b2adde4aa21ad855275a21f68b900d2ebbdf9c2013ad6cb700cae1904733c2593871068c2aa209782065a4fb0d30532634a2900082e26d69ecb52febe37752b4038d43e84d86cebffc564e0af8f491d6b87057481ee7463d7a9f5b060ab76bfbb1f33bc2d3806acfc47823f218bbc4bdd"}}}}}}, 0x0) 565.419776ms ago: executing program 4 (id=806): openat$comedi(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/comedi4\x00', 0x8a241, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet_sctp(0x2, 0x5, 0x84) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async, rerun: 32) socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) (async, rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x5, 0x97, &(0x7f0000000200)=""/151, 0x41000, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffe6d, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) (rerun: 64) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) socket$inet_icmp(0x2, 0x2, 0x1) (async, rerun: 32) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) (rerun: 32) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$packet(0x11, 0x2, 0x300) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet_sctp(0x2, 0x1, 0x84) socket$packet(0x11, 0x3, 0x300) (async) socket$nl_route(0x10, 0x3, 0x0) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xe, 0x4, 0x4, 0x100, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x8, &(0x7f0000000280)=@framed={{}, [@map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xbf, 0x2, 0xa}, @generic={0x2, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x100000, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async, rerun: 32) socket$netlink(0x10, 0x3, 0x4) (async, rerun: 32) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008002000800000000800", @ANYRES32=r1], 0x5c}, 0x1, 0x0, 0x0, 0x4040800}, 0x40090) 488.633206ms ago: executing program 1 (id=807): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_udp(0xa, 0x2, 0x0) syz_usb_connect(0x1, 0x36, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r2, 0x400455c8, 0x0) ioctl$TIOCSTI(r2, 0x5412, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) socket(0x2, 0x80805, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000004a80)={0x2c, r6, 0x105, 0x70bd25, 0x25dfdbfb, {0x1c}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40006) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x7a, &(0x7f0000000340)={r4, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) setsockopt(r0, 0x84, 0x7f, &(0x7f0000000080)="010000000980ffff", 0x8) 351.629816ms ago: executing program 4 (id=808): ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0x81, 0x6}]}) openat$kvm(0xffffffffffffff9c, 0x0, 0x901800, 0x0) socket$rxrpc(0x21, 0x2, 0x2) close_range(r2, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYRES32=r4], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r6, 0xc138fd06, &(0x7f0000000700)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d706174683000") bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={r5, r4, 0x25, 0x0, @val=@target_btf_id=0xffffffffffffffff}, 0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x42004}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x34}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x2, 0xb, &(0x7f00000009c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@printk={@lx, {0x3, 0x3, 0x3, 0xa, 0x0}, {0x5}, {0x7, 0x0, 0x5}, {}, {}, {0x85, 0x0, 0x0, 0x19}}]}, &(0x7f0000000000)='syzkaller\x00', 0x6, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x304}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) setxattr$incfs_id(&(0x7f00000001c0)='./cgroup.cpu/memory.limit_in_bytes\x00', &(0x7f0000000280), 0x0, 0x0, 0x2) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r7, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r7, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x1010, 0xffffffffffffffff, 0x0) 299.053246ms ago: executing program 0 (id=809): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_BLKSECTGET(r0, 0x1267, &(0x7f0000000080)) r1 = accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000040)) bind$phonet(r1, &(0x7f0000000080)={0x23, 0x9, 0xc9, 0x1}, 0x10) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) setrlimit(0x7, &(0x7f0000000400)) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000001c0)={0x4}) ioctl$VIDIOC_S_SELECTION(r2, 0xc040565f, &(0x7f0000000280)={0x2, 0x0, 0x4, {0xffff8001, 0x9, 0xe44, 0x6}}) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x400000, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_DELETE(r6, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="000229bd7000ffdbdf25020000000800090001000000080019000a0101000500f5ff010000000c001600fdffffffffffffff0500040001000000d6caf4d18ed98f626b38cd8db77fe1ed5a31a80a71322a693a19f8a37170cf7b42d5c90b4a35fef7c0515c61f7f6731d3359c34385fc6f14b91c3ee25ea02671fdf174a1e3749757f330a1421fbb8a9e40c94f9a2a639ec0ac0c34ca52c5a662eb18efe6e6bc106f710bba4b567ff238a98454b579bb1081b899743151d02c3975e45073cfc1300f2b6dadb277a7d0bee5a920d6b6383d8b713d4744af2997406fce865dc9cd87b9f1c5b06845bc71e9ae7d210df0eeabd945dd5c52605de192e21aa8"], 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x80) 127.804149ms ago: executing program 0 (id=810): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x14, 0x4, 0x4, 0xbf21, 0x4, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x50) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0xc4042, 0x1ff) linkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x400) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000040)={'wpan0\x00', 0x0}) r3 = syz_open_dev$ndb(&(0x7f00000023c0), 0x0, 0x40000) ioctl$NBD_SET_TIMEOUT(r3, 0xab09, 0x0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="48a7f68c", @ANYRES16=r1, @ANYBLOB="010600000000000000002700000008000200", @ANYRES32=r2, @ANYBLOB="05002b000100000005002e0001000000050031000200000014003000000102030405060708090a0b0c0d0e0f"], 0x48}}, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = syz_open_dev$media(&(0x7f0000000100), 0x7, 0x200) ioctl$MEDIA_IOC_ENUM_ENTITIES(r5, 0xc1007c01, &(0x7f0000000240)) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) r6 = syz_open_pts(r4, 0x0) ioctl$TCSETSW2(r6, 0x5437, 0x0) ioctl$TCSETS(r4, 0x5402, &(0x7f00000000c0)={0xfffffffc, 0x4, 0x2, 0x3ff, 0x8, "b426f1e3e7a666b5a12fdca0e04a8ea4f73776"}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) getsockopt$nfc_llcp(r7, 0x118, 0x3, &(0x7f0000000380)=""/122, 0x7a) r8 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$F2FS_IOC_GET_FEATURES(r8, 0x8004f50c, &(0x7f0000000340)) write(r7, &(0x7f00000001c0)='udp 2', 0x5) 0s ago: executing program 0 (id=811): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a64000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a31000000001400048008000240a04b3d02080001400000000308000540000000001c0008800c00014000000000000000090c000240000000000018ab6e14000000110001"], 0x8c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x22, &(0x7f0000001680)=0x1, 0x4) sendmmsg$inet6(r1, &(0x7f0000000140)=[{{&(0x7f0000000000)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000a40)="fb", 0x1}], 0x1}}], 0x1, 0x20080058) io_uring_setup(0x6d1a, &(0x7f00000002c0)={0x0, 0x31cd, 0x200, 0x2, 0x12e}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x428581, 0x0) getsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0xe) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, 0x0, &(0x7f00000001c0)) write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000300)='pcspk', 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ed) symlinkat(&(0x7f0000001500)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') setsockopt$inet_sctp_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000100)={0x4, 0x3, 0x9, 0x80, 0x3, 0x7f, 0xd, 0x0, 0x4, 0x4, 0xe, 0x9f, 0x55, 0x3}, 0xe) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000000c0), 0x3) kernel console output (not intermixed with test programs): 4 has an invalid length. [ 87.873482][ T7200] netlink: 'syz.2.397': attribute type 4 has an invalid length. [ 87.873488][ T7200] netlink: 152 bytes leftover after parsing attributes in process `syz.2.397'. [ 87.878923][ T42] usb 8-1: device descriptor read/8, error -71 [ 87.997313][ T7213] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 87.997330][ T7213] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 87.997843][ T42] usb usb8-port1: unable to enumerate USB device [ 88.428817][ T7236] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 88.434497][ T35] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 88.508932][ T66] Bluetooth: hci1: command 0x0406 tx timeout [ 88.557134][ T7243] netlink: 72 bytes leftover after parsing attributes in process `syz.0.409'. [ 88.606088][ T35] usb 6-1: New USB device found, idVendor=06cd, idProduct=0107, bcdDevice= 1.00 [ 88.607068][ T35] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 88.609011][ T35] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.609030][ T35] usb 6-1: Product: syz [ 88.609042][ T35] usb 6-1: Manufacturer: syz [ 88.609054][ T35] usb 6-1: SerialNumber: syz [ 88.614442][ T35] keyspan 6-1:1.0: Keyspan 1 port adapter converter detected [ 88.614598][ T35] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 84 [ 88.628913][ T35] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 81 [ 88.628978][ T35] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 82 [ 88.629018][ T35] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 1 [ 88.629050][ T35] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 2 [ 88.629123][ T35] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 83 [ 88.629155][ T35] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 3 [ 88.630505][ T35] usb 6-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 88.838832][ T35] usb 6-1: USB disconnect, device number 13 [ 88.854231][ T35] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 88.854513][ T35] keyspan 6-1:1.0: device disconnected [ 88.890738][ T7259] netlink: 184 bytes leftover after parsing attributes in process `syz.0.414'. [ 88.999580][ T7268] smbdirect: ib_dev[©÷Å]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 88.999604][ T7268] smbdirect: ib_dev[©÷Å]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 88.999628][ T7268] smbdirect: ib_dev[©÷Å]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 89.012191][ T7268] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 89.019668][ T7268] infiniband ©÷Å: RDMA CMA: cma_listen_on_dev, error -98 [ 89.372889][ T7298] FAULT_INJECTION: forcing a failure. [ 89.372889][ T7298] name failslab, interval 1, probability 0, space 0, times 0 [ 89.372911][ T7298] CPU: 1 UID: 0 PID: 7298 Comm: syz.2.427 Not tainted syzkaller #0 PREEMPT(full) [ 89.372923][ T7298] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 89.372930][ T7298] Call Trace: [ 89.372934][ T7298] [ 89.372939][ T7298] dump_stack_lvl+0x100/0x190 [ 89.372959][ T7298] should_fail_ex.cold+0x5/0xa [ 89.372982][ T7298] should_failslab+0xc2/0x120 [ 89.373004][ T7298] __kmalloc_noprof+0xfc/0x840 [ 89.373022][ T7298] ? rcu_is_watching+0x13/0xc0 [ 89.373046][ T7298] ? tomoyo_realpath_from_path+0xb6/0x690 [ 89.373077][ T7298] tomoyo_realpath_from_path+0xb6/0x690 [ 89.373109][ T7298] tomoyo_path_number_perm+0x23c/0x580 [ 89.373130][ T7298] ? tomoyo_path_number_perm+0x22e/0x580 [ 89.373159][ T7298] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 89.373190][ T7298] ? __lock_acquire+0x5c0/0x1f40 [ 89.373221][ T7298] ? __fget_files+0x34/0x3d0 [ 89.373270][ T7298] ? find_held_lock+0x2b/0x80 [ 89.373295][ T7298] ? hook_file_ioctl_common+0x140/0x440 [ 89.373328][ T7298] ? __fget_files+0x21f/0x3d0 [ 89.373354][ T7298] security_file_ioctl+0xd3/0x230 [ 89.373373][ T7298] __x64_sys_ioctl+0xb7/0x210 [ 89.373392][ T7298] do_syscall_64+0x123/0x790 [ 89.373410][ T7298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.373425][ T7298] RIP: 0033:0x7f008a99e159 [ 89.373438][ T7298] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 89.373451][ T7298] RSP: 002b:00007f008b861028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 89.373466][ T7298] RAX: ffffffffffffffda RBX: 00007f008ac25fa0 RCX: 00007f008a99e159 [ 89.373475][ T7298] RDX: 0000200000000000 RSI: 0000000000000001 RDI: 0000000000000003 [ 89.373484][ T7298] RBP: 00007f008b861090 R08: 0000000000000000 R09: 0000000000000000 [ 89.373493][ T7298] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 89.373501][ T7298] R13: 00007f008ac26038 R14: 00007f008ac25fa0 R15: 00007ffc9af588e8 [ 89.373521][ T7298] [ 89.373555][ T7298] ERROR: Out of memory at tomoyo_realpath_from_path. [ 89.373568][ T7298] program syz.2.427 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 89.470650][ T6056] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 89.494502][ T7302] program syz.2.429 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 89.526799][ T7304] process 'syz.2.430' launched '/dev/fd/5' with NULL argv: empty string added [ 89.629512][ T5092] Bluetooth: hci3: unexpected event for opcode 0x1804 [ 89.631086][ T6056] usb 5-1: Using ep0 maxpacket: 32 [ 89.633482][ T6056] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 89.634672][ T6056] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 89.634706][ T6056] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 89.634727][ T6056] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 120, changing to 10 [ 89.634746][ T6056] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 8348, setting to 1024 [ 89.634766][ T6056] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 89.638235][ T6056] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.638267][ T6056] usb 5-1: Product: syz [ 89.638274][ T6056] usb 5-1: Manufacturer: syz [ 89.638281][ T6056] usb 5-1: SerialNumber: syz [ 89.653525][ C2] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 89.655791][ T6056] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:155.0/input/input6 [ 89.887377][ T6056] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 89.887399][ T6056] (id 0x00) [ 89.931483][ T6056] rc_core: IR keymap rc-imon-pad not found [ 89.931499][ T6056] Registered IR keymap rc-empty [ 89.931556][ T6056] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 89.931569][ T6056] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 89.983791][ T7326] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 89.985350][ T7326] ======================================================= [ 89.985350][ T7326] WARNING: The mand mount option has been deprecated and [ 89.985350][ T7326] and is ignored by this kernel. Remove the mand [ 89.985350][ T7326] option from the mount to silence this warning. [ 89.985350][ T7326] ======================================================= [ 90.103825][ T6056] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:155.0/rc/rc0 [ 90.106824][ T6056] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:155.0/rc/rc0/input7 [ 90.110544][ T6056] imon 5-1:155.0: iMON device (15c2:ffdc, intf0) on usb<5:8> initialized [ 90.309952][ T7342] FAULT_INJECTION: forcing a failure. [ 90.309952][ T7342] name failslab, interval 1, probability 0, space 0, times 0 [ 90.309987][ T7342] CPU: 3 UID: 0 PID: 7342 Comm: syz.2.442 Not tainted syzkaller #0 PREEMPT(full) [ 90.310009][ T7342] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 90.310021][ T7342] Call Trace: [ 90.310028][ T7342] [ 90.310036][ T7342] dump_stack_lvl+0x100/0x190 [ 90.310086][ T7342] should_fail_ex.cold+0x5/0xa [ 90.310115][ T7342] should_failslab+0xc2/0x120 [ 90.310148][ T7342] __kmalloc_cache_noprof+0x91/0x6d0 [ 90.310170][ T7342] ? drm_atomic_helper_connector_duplicate_state+0x72/0xd0 [ 90.310201][ T7342] drm_atomic_helper_connector_duplicate_state+0x72/0xd0 [ 90.310225][ T7342] drm_atomic_get_connector_state+0x401/0x960 [ 90.310260][ T7342] drm_atomic_add_affected_connectors+0x2e0/0x3f0 [ 90.310292][ T7342] ? __pfx_drm_atomic_add_affected_connectors+0x10/0x10 [ 90.310321][ T7342] ? modeset_lock+0x114/0x6d0 [ 90.310354][ T7342] __drm_atomic_helper_set_config+0x5f6/0xee0 [ 90.310385][ T7342] ? virtio_gpu_plane_duplicate_state+0x72/0xd0 [ 90.310413][ T7342] ? __pfx___drm_atomic_helper_set_config+0x10/0x10 [ 90.310445][ T7342] ? drm_client_rotation+0x451/0x6a0 [ 90.310471][ T7342] drm_client_modeset_commit_atomic+0x53d/0x7e0 [ 90.310504][ T7342] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 90.310525][ T7342] ? __mutex_lock+0x26c/0x1bd0 [ 90.310572][ T7342] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 90.310603][ T7342] drm_client_modeset_commit_locked+0x14d/0x580 [ 90.310629][ T7342] drm_fb_helper_pan_display+0x32d/0xa40 [ 90.310668][ T7342] fb_pan_display+0x195/0x820 [ 90.310696][ T7342] ? __pfx_drm_fb_helper_pan_display+0x10/0x10 [ 90.310723][ T7342] ? queue_delayed_work_on+0x122/0x1e0 [ 90.310747][ T7342] bit_update_start+0x48/0x1f0 [ 90.310770][ T7342] fbcon_switch+0x1119/0x19f0 [ 90.310797][ T7342] ? __pfx_fbcon_switch+0x10/0x10 [ 90.310833][ T7342] ? __pfx_bit_cursor+0x10/0x10 [ 90.310852][ T7342] ? fbcon_cursor+0x24c/0x5e0 [ 90.310888][ T7342] csi_J+0x872/0xad0 [ 90.310909][ T7342] ? fbcon_putcs+0x3b2/0x480 [ 90.310935][ T7342] ? fbcon_putcs+0x19e/0x480 [ 90.310967][ T7342] csi_ECMA.constprop.0+0x51e/0x3b60 [ 90.310995][ T7342] ? find_held_lock+0x2b/0x80 [ 90.311025][ T7342] ? __pfx_csi_ECMA.constprop.0+0x10/0x10 [ 90.311060][ T7342] do_con_write+0x3663/0x4ae0 [ 90.311086][ T7342] ? trace_contention_end+0x126/0x160 [ 90.311111][ T7342] ? __mutex_lock+0x26c/0x1bd0 [ 90.311136][ T7342] ? n_tty_write+0x500/0x1160 [ 90.311159][ T7342] ? __pfx___mutex_lock+0x10/0x10 [ 90.311183][ T7342] ? __pfx_do_con_write+0x10/0x10 [ 90.311210][ T7342] ? add_softcursor+0x220/0x290 [ 90.311238][ T7342] ? con_write+0x96/0xb0 [ 90.311266][ T7342] con_write+0x23/0xb0 [ 90.311293][ T7342] n_tty_write+0x431/0x1160 [ 90.311324][ T7342] ? __pfx_n_tty_write+0x10/0x10 [ 90.311342][ T7342] ? __kasan_kmalloc+0xaa/0xb0 [ 90.311367][ T7342] ? __pfx_woken_wake_function+0x10/0x10 [ 90.311394][ T7342] ? rcu_is_watching+0x13/0xc0 [ 90.311421][ T7342] ? file_tty_write.isra.0+0x694/0x890 [ 90.311445][ T7342] ? kfree+0x1e5/0x6d0 [ 90.311464][ T7342] ? __pfx_n_tty_write+0x10/0x10 [ 90.311485][ T7342] file_tty_write.isra.0+0x4d2/0x890 [ 90.311518][ T7342] vfs_write+0x6af/0x1050 [ 90.311543][ T7342] ? __pfx_tty_write+0x10/0x10 [ 90.311570][ T7342] ? __pfx_vfs_write+0x10/0x10 [ 90.311591][ T7342] ? find_held_lock+0x2b/0x80 [ 90.311637][ T7342] ksys_write+0x12a/0x250 [ 90.311660][ T7342] ? __pfx_ksys_write+0x10/0x10 [ 90.311692][ T7342] do_syscall_64+0x123/0x790 [ 90.311718][ T7342] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.311738][ T7342] RIP: 0033:0x7f008a99e159 [ 90.311755][ T7342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.311772][ T7342] RSP: 002b:00007f008b861028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 90.311792][ T7342] RAX: ffffffffffffffda RBX: 00007f008ac25fa0 RCX: 00007f008a99e159 [ 90.311806][ T7342] RDX: 0000000000001006 RSI: 0000200000002580 RDI: 0000000000000003 [ 90.311822][ T7342] RBP: 00007f008b861090 R08: 0000000000000000 R09: 0000000000000000 [ 90.311834][ T7342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 90.311846][ T7342] R13: 00007f008ac26038 R14: 00007f008ac25fa0 R15: 00007ffc9af588e8 [ 90.311875][ T7342] [ 90.365819][ T50] usb 5-1: USB disconnect, device number 8 [ 90.365849][ T7292] imon:send_packet: packet tx failed (-71) [ 90.381569][ T7292] imon:vfd_write: send packet #0 failed [ 90.407313][ T7345] netlink: 4 bytes leftover after parsing attributes in process `syz.2.443'. [ 90.411591][ T7345] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7345 comm=syz.2.443 [ 90.644001][ T7366] netlink: 44 bytes leftover after parsing attributes in process `syz.1.452'. [ 90.678282][ T7368] FAULT_INJECTION: forcing a failure. [ 90.678282][ T7368] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 90.678315][ T7368] CPU: 2 UID: 0 PID: 7368 Comm: syz.3.453 Not tainted syzkaller #0 PREEMPT(full) [ 90.678332][ T7368] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 90.678341][ T7368] Call Trace: [ 90.678349][ T7368] [ 90.678356][ T7368] dump_stack_lvl+0x100/0x190 [ 90.678385][ T7368] should_fail_ex.cold+0x5/0xa [ 90.678409][ T7368] _copy_to_user+0x32/0xd0 [ 90.678434][ T7368] simple_read_from_buffer+0xcb/0x170 [ 90.678461][ T7368] proc_fail_nth_read+0x1af/0x230 [ 90.678486][ T7368] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 90.678512][ T7368] ? rw_verify_area+0xce/0x6d0 [ 90.678529][ T7368] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 90.678553][ T7368] vfs_read+0x1e4/0xb40 [ 90.678571][ T7368] ? lock_acquire+0x1d1/0x380 [ 90.678592][ T7368] ? __fget_files+0x34/0x3d0 [ 90.678614][ T7368] ? __pfx_vfs_read+0x10/0x10 [ 90.678631][ T7368] ? find_held_lock+0x2b/0x80 [ 90.678657][ T7368] ? __fget_files+0x215/0x3d0 [ 90.678684][ T7368] ? __fget_files+0x21f/0x3d0 [ 90.678713][ T7368] ksys_read+0x12a/0x250 [ 90.678732][ T7368] ? __pfx_ksys_read+0x10/0x10 [ 90.678758][ T7368] do_syscall_64+0x123/0x790 [ 90.678781][ T7368] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.678798][ T7368] RIP: 0033:0x7f0feed5e98e [ 90.678814][ T7368] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 90.678829][ T7368] RSP: 002b:00007f0fecff5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 90.678853][ T7368] RAX: ffffffffffffffda RBX: 00007f0fecff66c0 RCX: 00007f0feed5e98e [ 90.678863][ T7368] RDX: 000000000000000f RSI: 00007f0fecff60a0 RDI: 0000000000000008 [ 90.678875][ T7368] RBP: 00007f0fecff6090 R08: 0000000000000000 R09: 0000000000000000 [ 90.678887][ T7368] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 90.678896][ T7368] R13: 00007f0fef026038 R14: 00007f0fef025fa0 R15: 00007fff7beab818 [ 90.678921][ T7368] [ 90.748371][ T7372] overlayfs: fs on './file1/file0' does not support file handles, falling back to index=off,nfs_export=off. [ 90.848842][ T7382] loop5: detected capacity change from 0 to 7 [ 90.850864][ T7382] Dev loop5: unable to read RDB block 7 [ 90.850881][ T7382] loop5: AHDI p2 [ 90.850892][ T7382] loop5: partition table partially beyond EOD, truncated [ 91.204286][ T7398] netlink: 'syz.2.461': attribute type 1 has an invalid length. [ 91.226601][ T7398] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 91.320500][ T7400] kvm: pic: non byte write [ 91.322152][ T7400] kvm: user requested TSC rate below hardware speed [ 91.323057][ T7400] kvm: vcpu 0: requested 1536 ns lapic timer period limited to 200000 ns [ 91.323176][ T7400] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=540686624 (1081373248 ns) > initial count (200000 ns). Using initial count to start timer. [ 91.412440][ T7412] netlink: 4 bytes leftover after parsing attributes in process `syz.2.466'. [ 91.412674][ T7412] netlink: 4 bytes leftover after parsing attributes in process `syz.2.466'. [ 91.424846][ T43] kauditd_printk_skb: 172 callbacks suppressed [ 91.424862][ T43] audit: type=1400 audit(1791126735.494:846): avc: denied { bpf } for pid=7413 comm="syz.3.467" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 91.425229][ T43] audit: type=1400 audit(1791126735.494:847): avc: denied { perfmon } for pid=7413 comm="syz.3.467" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 91.452318][ T43] audit: type=1400 audit(1791126735.522:848): avc: denied { write } for pid=7411 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 91.504856][ T43] audit: type=1400 audit(1791126735.579:849): avc: denied { write } for pid=7424 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 91.736126][ T50] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 91.896788][ T50] usb 6-1: Using ep0 maxpacket: 8 [ 91.899837][ T50] usb 6-1: unable to get BOS descriptor or descriptor too short [ 91.899875][ T50] usb 6-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=d4.29 [ 91.901185][ T50] usb 6-1: config 8 has an invalid interface number: 109 but max is 0 [ 91.901205][ T50] usb 6-1: config 8 has an invalid descriptor of length 48, skipping remainder of the config [ 91.901233][ T50] usb 6-1: config 8 has no interface number 0 [ 91.901263][ T50] usb 6-1: config 8 interface 109 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 91.901285][ T50] usb 6-1: config 8 interface 109 altsetting 0 endpoint 0x8E has an invalid bInterval 48, changing to 9 [ 91.901306][ T50] usb 6-1: config 8 interface 109 altsetting 0 endpoint 0x8E has invalid maxpacket 8343, setting to 1024 [ 91.904018][ T50] usb 6-1: string descriptor 0 read error: -22 [ 91.904154][ T50] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.909371][ T43] audit: type=1800 audit(1791126735.953:850): pid=7224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=127883 res=0 errno=0 [ 91.917251][ T43] audit: type=1800 audit(1791126735.953:851): pid=7224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=127912 res=0 errno=0 [ 91.918870][ T43] audit: type=1800 audit(1791126735.962:852): pid=7224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=127890 res=0 errno=0 [ 91.919825][ T50] metro_usb 6-1:8.109: Metrologic USB to Serial converter detected [ 91.921185][ T50] usb 6-1: Metrologic USB to Serial converter now attached to ttyUSB0 [ 91.922682][ T43] audit: type=1800 audit(1791126735.962:853): pid=7224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idProduct" dev="sysfs" ino=127891 res=0 errno=0 [ 91.923290][ T43] audit: type=1800 audit(1791126735.962:854): pid=7224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="bcdDevice" dev="sysfs" ino=127892 res=0 errno=0 [ 91.931239][ T43] audit: type=1800 audit(1791126735.972:855): pid=7224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=127932 res=0 errno=0 [ 92.131982][ T50] usb 6-1: USB disconnect, device number 14 [ 92.135434][ T50] metro-usb ttyUSB0: Metrologic USB to Serial converter now disconnected from ttyUSB0 [ 92.135750][ T50] metro_usb 6-1:8.109: device disconnected [ 92.448062][ T7441] netlink: 68 bytes leftover after parsing attributes in process `syz.3.473'. [ 92.551198][ T7444] FAULT_INJECTION: forcing a failure. [ 92.551198][ T7444] name failslab, interval 1, probability 0, space 0, times 0 [ 92.551220][ T7444] CPU: 1 UID: 0 PID: 7444 Comm: syz.0.475 Not tainted syzkaller #0 PREEMPT(full) [ 92.551233][ T7444] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.551240][ T7444] Call Trace: [ 92.551244][ T7444] [ 92.551249][ T7444] dump_stack_lvl+0x100/0x190 [ 92.551282][ T7444] should_fail_ex.cold+0x5/0xa [ 92.551298][ T7444] ? __pfx_fuse_inode_set+0x10/0x10 [ 92.551316][ T7444] should_failslab+0xc2/0x120 [ 92.551332][ T7444] __kmalloc_cache_noprof+0x91/0x6d0 [ 92.551344][ T7444] ? fuse_alloc_inode+0xc7/0x1a0 [ 92.551361][ T7444] ? __pfx_fuse_inode_eq+0x10/0x10 [ 92.551375][ T7444] ? __pfx_fuse_inode_set+0x10/0x10 [ 92.551393][ T7444] fuse_alloc_inode+0xc7/0x1a0 [ 92.551409][ T7444] ? __pfx_fuse_alloc_inode+0x10/0x10 [ 92.551429][ T7444] alloc_inode+0x68/0x250 [ 92.551446][ T7444] iget5_locked+0x5f/0xa0 [ 92.551465][ T7444] fuse_iget+0x165/0x910 [ 92.551489][ T7444] ? __pfx_fuse_iget+0x10/0x10 [ 92.551512][ T7444] ? fuse_chan_send+0x6d3/0x9c0 [ 92.551539][ T7444] fuse_lookup_name+0x47a/0x780 [ 92.551567][ T7444] ? __pfx_fuse_lookup_name+0x10/0x10 [ 92.551592][ T7444] ? __pfx___mutex_lock+0x10/0x10 [ 92.551629][ T7444] ? find_held_lock+0x2b/0x80 [ 92.551660][ T7444] fuse_lookup+0x209/0x590 [ 92.551686][ T7444] ? __pfx_fuse_lookup+0x10/0x10 [ 92.551709][ T7444] ? lock_acquire+0x1d1/0x380 [ 92.551727][ T7444] ? lookup_slow+0x42/0x70 [ 92.551754][ T7444] ? down_read+0x13b/0x4c0 [ 92.551774][ T7444] ? __pfx_down_read+0x10/0x10 [ 92.551797][ T7444] __lookup_slow+0x155/0x320 [ 92.551818][ T7444] lookup_slow+0x50/0x70 [ 92.551834][ T7444] path_lookupat+0x5e8/0xc40 [ 92.551850][ T7444] filename_lookup+0x202/0x590 [ 92.551864][ T7444] ? __kasan_slab_alloc+0x89/0x90 [ 92.551884][ T7444] ? __pfx_filename_lookup+0x10/0x10 [ 92.551911][ T7444] ? lock_acquire+0x1d1/0x380 [ 92.551923][ T7444] ? __might_fault+0xc5/0x140 [ 92.551935][ T7444] filename_linkat+0x145/0x640 [ 92.551954][ T7444] ? __pfx_filename_linkat+0x10/0x10 [ 92.551976][ T7444] ? do_getname+0x191/0x390 [ 92.551987][ T7444] __x64_sys_link+0x81/0xb0 [ 92.552005][ T7444] do_syscall_64+0x123/0x790 [ 92.552019][ T7444] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.552030][ T7444] RIP: 0033:0x7fd92c19e159 [ 92.552041][ T7444] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.552051][ T7444] RSP: 002b:00007fd92d009028 EFLAGS: 00000246 ORIG_RAX: 0000000000000056 [ 92.552063][ T7444] RAX: ffffffffffffffda RBX: 00007fd92c426090 RCX: 00007fd92c19e159 [ 92.552071][ T7444] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000200000000280 [ 92.552077][ T7444] RBP: 00007fd92d009090 R08: 0000000000000000 R09: 0000000000000000 [ 92.552084][ T7444] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 92.552090][ T7444] R13: 00007fd92c426128 R14: 00007fd92c426090 R15: 00007fff0a6f7048 [ 92.552104][ T7444] [ 92.680617][ T7449] program syz.2.477 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 93.029379][ T2206] usb 6-1: new low-speed USB device number 15 using dummy_hcd [ 93.202489][ T2206] usb 6-1: unable to get BOS descriptor or descriptor too short [ 93.202527][ T2206] usb 6-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=d4.29 [ 93.203577][ T2206] usb 6-1: config 8 has an invalid interface number: 109 but max is 0 [ 93.203597][ T2206] usb 6-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 93.203610][ T2206] usb 6-1: config 8 has no interface number 0 [ 93.203637][ T2206] usb 6-1: config 8 interface 109 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 8 [ 93.203656][ T2206] usb 6-1: config 8 interface 109 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 93.203675][ T2206] usb 6-1: config 8 interface 109 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 93.206722][ T2206] usb 6-1: string descriptor 0 read error: -22 [ 93.206825][ T2206] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.225891][ T2206] metro_usb 6-1:8.109: Metrologic USB to Serial converter detected [ 93.232118][ T2206] usb 6-1: Metrologic USB to Serial converter now attached to ttyUSB0 [ 93.442503][ T7457] FAULT_INJECTION: forcing a failure. [ 93.442503][ T7457] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 93.442537][ T7457] CPU: 2 UID: 0 PID: 7457 Comm: syz.1.481 Not tainted syzkaller #0 PREEMPT(full) [ 93.442559][ T7457] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.442570][ T7457] Call Trace: [ 93.442578][ T7457] [ 93.442586][ T7457] dump_stack_lvl+0x100/0x190 [ 93.442618][ T7457] should_fail_ex.cold+0x5/0xa [ 93.442641][ T7457] ? prepare_alloc_pages+0x16d/0x5b0 [ 93.442671][ T7457] should_fail_alloc_page+0xeb/0x140 [ 93.442715][ T7457] prepare_alloc_pages+0x1f0/0x5b0 [ 93.442746][ T7457] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 93.442771][ T7457] ? __pfx_get_page_from_freelist+0x10/0x10 [ 93.442794][ T7457] ? prepare_alloc_pages+0x1f0/0x5b0 [ 93.442824][ T7457] ? rcu_is_watching+0x13/0xc0 [ 93.442852][ T7457] ? __alloc_frozen_pages_noprof+0x56b/0x3300 [ 93.442878][ T7457] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 93.442902][ T7457] ? find_held_lock+0x2b/0x80 [ 93.442930][ T7457] ? is_bpf_text_address+0x8a/0x1a0 [ 93.442957][ T7457] ? is_bpf_text_address+0x8a/0x1a0 [ 93.442984][ T7457] ? bpf_ksym_find+0x128/0x1c0 [ 93.443003][ T7457] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 93.443025][ T7457] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 93.443046][ T7457] ? is_bpf_text_address+0x94/0x1a0 [ 93.443075][ T7457] ? __kernel_text_address+0xd/0x30 [ 93.443112][ T7457] alloc_pages_bulk_noprof+0x5e1/0x13c0 [ 93.443135][ T7457] ? find_held_lock+0x2b/0x80 [ 93.443167][ T7457] ? policy_nodemask+0xed/0x4f0 [ 93.443197][ T7457] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 93.443222][ T7457] ? do_file_open+0x20e/0x430 [ 93.443260][ T7457] __kasan_populate_vmalloc+0xf0/0x210 [ 93.443291][ T7457] alloc_vmap_area+0x95d/0x2bb0 [ 93.443324][ T7457] ? kasan_save_track+0x14/0x30 [ 93.443349][ T7457] ? __kasan_kmalloc+0xaa/0xb0 [ 93.443380][ T7457] ? __pfx_alloc_vmap_area+0x10/0x10 [ 93.443406][ T7457] ? __get_vm_area_node+0x124/0x350 [ 93.443436][ T7457] __get_vm_area_node+0x1ed/0x350 [ 93.443467][ T7457] __vmalloc_node_range_noprof+0x268/0x1420 [ 93.443495][ T7457] ? n_tty_open+0x1a/0x170 [ 93.443528][ T7457] ? lock_acquire+0x1d1/0x380 [ 93.443553][ T7457] ? n_tty_open+0x1a/0x170 [ 93.443585][ T7457] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 93.443615][ T7457] ? __pfx___ldsem_down_write_nested+0x10/0x10 [ 93.443649][ T7457] ? n_tty_open+0x1a/0x170 [ 93.443675][ T7457] __vmalloc_node_noprof+0xad/0xf0 [ 93.443698][ T7457] ? n_tty_open+0x1a/0x170 [ 93.443719][ T7457] ? __pfx_n_tty_open+0x10/0x10 [ 93.443736][ T7457] n_tty_open+0x1a/0x170 [ 93.443753][ T7457] tty_ldisc_open+0xa2/0x120 [ 93.443766][ T7457] tty_ldisc_setup+0x40/0xf0 [ 93.443781][ T7457] tty_init_dev.part.0+0x1b5/0x470 [ 93.443798][ T7457] tty_open+0x953/0xe20 [ 93.443816][ T7457] ? __pfx_tty_open+0x10/0x10 [ 93.443831][ T7457] ? chrdev_open+0x589/0x6a0 [ 93.443845][ T7457] ? chrdev_open+0x589/0x6a0 [ 93.443864][ T7457] ? __pfx_tty_open+0x10/0x10 [ 93.443880][ T7457] chrdev_open+0x234/0x6a0 [ 93.443895][ T7457] ? __pfx_chrdev_open+0x10/0x10 [ 93.443911][ T7457] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 93.443926][ T7457] do_dentry_open+0x6ab/0x14d0 [ 93.443939][ T7457] ? __pfx_chrdev_open+0x10/0x10 [ 93.443957][ T7457] vfs_open+0x82/0x3f0 [ 93.443976][ T7457] path_openat+0x19fa/0x2440 [ 93.443994][ T7457] ? __pfx_path_openat+0x10/0x10 [ 93.444014][ T7457] do_file_open+0x20e/0x430 [ 93.444030][ T7457] ? __pfx_do_file_open+0x10/0x10 [ 93.444056][ T7457] ? _raw_spin_unlock+0x28/0x50 [ 93.444073][ T7457] ? alloc_fd+0x471/0x7a0 [ 93.444093][ T7457] do_sys_openat2+0x10f/0x1e0 [ 93.444110][ T7457] ? __pfx_do_sys_openat2+0x10/0x10 [ 93.444127][ T7457] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 93.444141][ T7457] ? __fget_files+0x21f/0x3d0 [ 93.444159][ T7457] __x64_sys_openat+0x12d/0x210 [ 93.444177][ T7457] ? __pfx___x64_sys_openat+0x10/0x10 [ 93.444193][ T7457] ? ksys_write+0x1ac/0x250 [ 93.444211][ T7457] do_syscall_64+0x123/0x790 [ 93.444224][ T7457] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.444236][ T7457] RIP: 0033:0x7fe0fd79e159 [ 93.444246][ T7457] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.444256][ T7457] RSP: 002b:00007fe0fe61b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 93.444268][ T7457] RAX: ffffffffffffffda RBX: 00007fe0fda25fa0 RCX: 00007fe0fd79e159 [ 93.444275][ T7457] RDX: 0000000000000002 RSI: 0000200000000600 RDI: ffffffffffffff9c [ 93.444282][ T7457] RBP: 00007fe0fe61b090 R08: 0000000000000000 R09: 0000000000000000 [ 93.444288][ T7457] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 93.444295][ T7457] R13: 00007fe0fda26038 R14: 00007fe0fda25fa0 R15: 00007ffc5d22c308 [ 93.444309][ T7457] [ 93.444382][ T7457] warn_alloc: 1 callbacks suppressed [ 93.444390][ T7457] syz.1.481: vmalloc error: size 9112, align 0x1, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 93.444424][ T7457] CPU: 2 UID: 0 PID: 7457 Comm: syz.1.481 Not tainted syzkaller #0 PREEMPT(full) [ 93.444435][ T7457] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.444442][ T7457] Call Trace: [ 93.444445][ T7457] [ 93.444449][ T7457] dump_stack_lvl+0x100/0x190 [ 93.444466][ T7457] warn_alloc.cold+0x9e/0xb2 [ 93.444479][ T7457] ? __pfx_warn_alloc+0x10/0x10 [ 93.444490][ T7457] ? lockdep_hardirqs_on+0x7d/0x110 [ 93.444503][ T7457] ? __get_vm_area_node+0x2f0/0x350 [ 93.444521][ T7457] ? __get_vm_area_node+0x22b/0x350 [ 93.444539][ T7457] __vmalloc_node_range_noprof+0xfa2/0x1420 [ 93.444558][ T7457] ? lock_acquire+0x1d1/0x380 [ 93.444573][ T7457] ? n_tty_open+0x1a/0x170 [ 93.444592][ T7457] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 93.444612][ T7457] ? __pfx___ldsem_down_write_nested+0x10/0x10 [ 93.444632][ T7457] ? n_tty_open+0x1a/0x170 [ 93.444648][ T7457] __vmalloc_node_noprof+0xad/0xf0 [ 93.444664][ T7457] ? n_tty_open+0x1a/0x170 [ 93.444684][ T7457] ? __pfx_n_tty_open+0x10/0x10 [ 93.444707][ T7457] n_tty_open+0x1a/0x170 [ 93.444735][ T7457] tty_ldisc_open+0xa2/0x120 [ 93.444755][ T7457] tty_ldisc_setup+0x40/0xf0 [ 93.444769][ T7457] tty_init_dev.part.0+0x1b5/0x470 [ 93.444787][ T7457] tty_open+0x953/0xe20 [ 93.444805][ T7457] ? __pfx_tty_open+0x10/0x10 [ 93.444820][ T7457] ? chrdev_open+0x589/0x6a0 [ 93.444834][ T7457] ? chrdev_open+0x589/0x6a0 [ 93.444851][ T7457] ? __pfx_tty_open+0x10/0x10 [ 93.444868][ T7457] chrdev_open+0x234/0x6a0 [ 93.444884][ T7457] ? __pfx_chrdev_open+0x10/0x10 [ 93.444900][ T7457] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 93.444915][ T7457] do_dentry_open+0x6ab/0x14d0 [ 93.444927][ T7457] ? __pfx_chrdev_open+0x10/0x10 [ 93.444945][ T7457] vfs_open+0x82/0x3f0 [ 93.444963][ T7457] path_openat+0x19fa/0x2440 [ 93.444981][ T7457] ? __pfx_path_openat+0x10/0x10 [ 93.445000][ T7457] do_file_open+0x20e/0x430 [ 93.445017][ T7457] ? __pfx_do_file_open+0x10/0x10 [ 93.445042][ T7457] ? _raw_spin_unlock+0x28/0x50 [ 93.445059][ T7457] ? alloc_fd+0x471/0x7a0 [ 93.445079][ T7457] do_sys_openat2+0x10f/0x1e0 [ 93.445096][ T7457] ? __pfx_do_sys_openat2+0x10/0x10 [ 93.445114][ T7457] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 93.445128][ T7457] ? __fget_files+0x21f/0x3d0 [ 93.445145][ T7457] __x64_sys_openat+0x12d/0x210 [ 93.445163][ T7457] ? __pfx___x64_sys_openat+0x10/0x10 [ 93.445179][ T7457] ? ksys_write+0x1ac/0x250 [ 93.445196][ T7457] do_syscall_64+0x123/0x790 [ 93.445209][ T7457] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.445221][ T7457] RIP: 0033:0x7fe0fd79e159 [ 93.445229][ T7457] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.445240][ T7457] RSP: 002b:00007fe0fe61b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 93.445250][ T7457] RAX: ffffffffffffffda RBX: 00007fe0fda25fa0 RCX: 00007fe0fd79e159 [ 93.445257][ T7457] RDX: 0000000000000002 RSI: 0000200000000600 RDI: ffffffffffffff9c [ 93.445263][ T7457] RBP: 00007fe0fe61b090 R08: 0000000000000000 R09: 0000000000000000 [ 93.445270][ T7457] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 93.445276][ T7457] R13: 00007fe0fda26038 R14: 00007fe0fda25fa0 R15: 00007ffc5d22c308 [ 93.445290][ T7457] [ 93.445295][ T7457] Mem-Info: [ 93.445301][ T7457] active_anon:28889 inactive_anon:293 isolated_anon:0 [ 93.445301][ T7457] active_file:1978 inactive_file:61288 isolated_file:0 [ 93.445301][ T7457] unevictable:1000 dirty:42 writeback:0 [ 93.445301][ T7457] slab_reclaimable:12043 slab_unreclaimable:68063 [ 93.445301][ T7457] mapped:25242 shmem:18020 pagetables:1367 [ 93.445301][ T7457] sec_pagetables:294 bounce:0 [ 93.445301][ T7457] kernel_misc_reclaimable:0 [ 93.445301][ T7457] free:430802 free_pcp:14847 free_cma:0 [ 93.445327][ T7457] Node 0 active_anon:115556kB inactive_anon:1172kB active_file:7904kB inactive_file:244964kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:100968kB dirty:168kB writeback:0kB shmem:70080kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13568kB pagetables:5260kB sec_pagetables:1176kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 93.445359][ T7457] Node 1 active_anon:0kB inactive_anon:0kB active_file:8kB inactive_file:188kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:2000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:208kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 93.445385][ T7457] Node 0 DMA free:15052kB boost:0kB min:340kB low:424kB high:508kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:308kB local_pcp:60kB free_cma:0kB [ 93.445414][ T7457] lowmem_reserve[]: 0 1223 1223 1223 1223 [ 93.445433][ T7457] Node 0 DMA32 free:59756kB boost:0kB min:27356kB low:34192kB high:41028kB reserved_highatomic:0kB free_highatomic:0kB active_anon:115556kB inactive_anon:1172kB active_file:7904kB inactive_file:244964kB unevictable:2000kB writepending:168kB zspages:632kB present:2080628kB managed:1253104kB mlocked:0kB bounce:0kB free_pcp:55604kB local_pcp:11760kB free_cma:0kB [ 93.445463][ T7457] lowmem_reserve[]: 0 0 0 0 0 [ 93.445482][ T7457] Node 1 Normal free:1648400kB boost:0kB min:39880kB low:49848kB high:59816kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:8kB inactive_file:188kB unevictable:2000kB writepending:0kB zspages:0kB present:2097152kB managed:1781880kB mlocked:0kB bounce:0kB free_pcp:3476kB local_pcp:0kB free_cma:0kB [ 93.445511][ T7457] lowmem_reserve[]: 0 0 0 0 0 [ 93.445528][ T7457] Node 0 DMA: 1*4kB (U) 1*8kB (U) 0*16kB 0*32kB 1*64kB (U) 3*128kB (UM) 3*256kB (UM) 1*512kB (M) 3*1024kB (UM) 1*2048kB (U) 2*4096kB (M) = 15052kB [ 93.445608][ T7457] Node 0 DMA32: 306*4kB (UME) 517*8kB (UE) 210*16kB (UE) 108*32kB (UME) 26*64kB (UME) 25*128kB (UME) 21*256kB (UM) 21*512kB (ME) 4*1024kB (UME) 7*2048kB (UME) 2*4096kB (UM) = 59792kB [ 93.445712][ T7457] Node 1 Normal: 2*4kB (UM) 1*8kB (U) 2*16kB (UM) 3*32kB (M) 2*64kB (M) 4*128kB (UM) 2*256kB (U) 5*512kB (UM) 0*1024kB 3*2048kB (UM) 400*4096kB (M) = 1648400kB [ 93.445927][ T7457] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 93.445936][ T7457] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 93.445944][ T7457] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 93.445952][ T7457] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 93.445960][ T7457] 81288 total pagecache pages [ 93.445964][ T7457] 6 pages in swap cache [ 93.445968][ T7457] Free swap = 124816kB [ 93.445972][ T7457] Total swap = 124996kB [ 93.445976][ T7457] 1048443 pages RAM [ 93.445979][ T7457] 0 pages HighMem/MovableOnly [ 93.445983][ T7457] 285857 pages reserved [ 93.445986][ T7457] 0 pages cma reserved [ 93.445993][ T7457] ttyUSB ttyUSB0: ldisc open failed (-12), clearing slot 0 [ 93.446736][ T50] usb 6-1: USB disconnect, device number 15 [ 93.463089][ T50] metro-usb ttyUSB0: Metrologic USB to Serial converter now disconnected from ttyUSB0 [ 93.463556][ T50] metro_usb 6-1:8.109: device disconnected [ 93.691681][ T42] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 93.875565][ T42] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 93.876935][ T42] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 93.876960][ T42] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 93.876989][ T42] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.881487][ T7480] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 93.885954][ T42] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 94.098830][ T42] usb 5-1: USB disconnect, device number 9 [ 94.103872][ T7480] FAULT_INJECTION: forcing a failure. [ 94.103872][ T7480] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 94.103901][ T7480] CPU: 1 UID: 0 PID: 7480 Comm: syz.0.488 Not tainted syzkaller #0 PREEMPT(full) [ 94.103922][ T7480] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.103933][ T7480] Call Trace: [ 94.103939][ T7480] [ 94.103947][ T7480] dump_stack_lvl+0x100/0x190 [ 94.103980][ T7480] should_fail_ex.cold+0x5/0xa [ 94.104011][ T7480] strncpy_from_user+0x3b/0x2d0 [ 94.104040][ T7480] do_getname+0x78/0x390 [ 94.104061][ T7480] do_sys_openat2+0xc7/0x1e0 [ 94.104089][ T7480] ? __pfx_do_sys_openat2+0x10/0x10 [ 94.104126][ T7480] __x64_sys_openat+0x12d/0x210 [ 94.104153][ T7480] ? __pfx___x64_sys_openat+0x10/0x10 [ 94.104179][ T7480] ? ksys_write+0x1ac/0x250 [ 94.104213][ T7480] do_syscall_64+0x123/0x790 [ 94.104237][ T7480] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.104255][ T7480] RIP: 0033:0x7fd92c19e159 [ 94.104270][ T7480] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.104287][ T7480] RSP: 002b:00007fd92d02a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 94.104305][ T7480] RAX: ffffffffffffffda RBX: 00007fd92c425fa0 RCX: 00007fd92c19e159 [ 94.104318][ T7480] RDX: 00000000000c2882 RSI: 0000200000000240 RDI: ffffffffffffff9c [ 94.104329][ T7480] RBP: 00007fd92d02a090 R08: 0000000000000000 R09: 0000000000000000 [ 94.104340][ T7480] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 94.104351][ T7480] R13: 00007fd92c426038 R14: 00007fd92c425fa0 R15: 00007fff0a6f7048 [ 94.104376][ T7480] [ 94.137791][ T7490] program syz.1.489 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 94.206927][ T7492] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 94.689966][ T7515] bridge_slave_0: left allmulticast mode [ 94.689990][ T7515] bridge_slave_0: left promiscuous mode [ 94.690173][ T7515] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.691044][ T7516] /dev/nullb0: Can't open blockdev [ 94.694106][ T7515] bridge_slave_1: left allmulticast mode [ 94.694126][ T7515] bridge_slave_1: left promiscuous mode [ 94.694292][ T7515] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.712845][ T7515] bond0: (slave bond_slave_0): Releasing backup interface [ 94.720789][ T7515] bond0: (slave bond_slave_1): Releasing backup interface [ 94.732186][ T7515] team0: Port device team_slave_0 removed [ 94.741612][ T7515] team0: Port device team_slave_1 removed [ 94.742141][ T7515] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 94.742152][ T7515] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 94.743342][ T7515] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 94.743352][ T7515] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 94.744368][ T7515] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 94.827287][ T7520] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 94.995477][ T50] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 95.167126][ T50] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 95.168228][ T50] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 95.168253][ T50] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 95.168274][ T50] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 95.171583][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.171602][ T50] usb 5-1: Product: syz [ 95.171615][ T50] usb 5-1: Manufacturer: syz [ 95.171628][ T50] usb 5-1: SerialNumber: syz [ 95.174104][ T50] usb 5-1: config 0 descriptor?? [ 95.174737][ T7518] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 95.241178][ T50] rc_core: IR keymap rc-streamzap not found [ 95.241209][ T50] Registered IR keymap rc-empty [ 95.242978][ T50] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0 [ 95.249601][ T50] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0/input8 [ 95.464820][ T7518] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 95.465641][ T7518] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 95.606853][ T42] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 95.768178][ T42] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 95.769468][ T42] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 95.769496][ T42] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 95.769526][ T42] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.774587][ T7528] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 95.793127][ T42] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 95.821357][ T7532] netlink: 'syz.1.506': attribute type 16 has an invalid length. [ 95.821371][ T7532] netlink: 'syz.1.506': attribute type 17 has an invalid length. [ 95.835688][ T7532] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 95.994422][ T6083] usb 7-1: USB disconnect, device number 11 [ 95.996098][ T7528] FAULT_INJECTION: forcing a failure. [ 95.996098][ T7528] name failslab, interval 1, probability 0, space 0, times 0 [ 95.996179][ T7528] CPU: 3 UID: 0 PID: 7528 Comm: syz.2.505 Not tainted syzkaller #0 PREEMPT(full) [ 95.996201][ T7528] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.996212][ T7528] Call Trace: [ 95.996218][ T7528] [ 95.996226][ T7528] dump_stack_lvl+0x100/0x190 [ 95.996254][ T7528] should_fail_ex.cold+0x5/0xa [ 95.996280][ T7528] should_failslab+0xc2/0x120 [ 95.996305][ T7528] kmem_cache_alloc_noprof+0x92/0x6a0 [ 95.996327][ T7528] ? do_getname+0x35/0x390 [ 95.996349][ T7528] do_getname+0x35/0x390 [ 95.996369][ T7528] do_sys_openat2+0xc7/0x1e0 [ 95.996396][ T7528] ? __pfx_do_sys_openat2+0x10/0x10 [ 95.996431][ T7528] __x64_sys_openat+0x12d/0x210 [ 95.996457][ T7528] ? __pfx___x64_sys_openat+0x10/0x10 [ 95.996483][ T7528] ? ksys_write+0x1ac/0x250 [ 95.996512][ T7528] do_syscall_64+0x123/0x790 [ 95.996535][ T7528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.996568][ T7528] RIP: 0033:0x7f008a95e98e [ 95.996597][ T7528] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 95.996616][ T7528] RSP: 002b:00007f008b860b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 95.996634][ T7528] RAX: ffffffffffffffda RBX: 00007f008b8616c0 RCX: 00007f008a95e98e [ 95.996646][ T7528] RDX: 000000000004a203 RSI: 00007f008b860c00 RDI: ffffffffffffff9c [ 95.996658][ T7528] RBP: 00007f008b860c00 R08: 0000000000000000 R09: 0000000000000000 [ 95.996669][ T7528] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 95.996680][ T7528] R13: 00007f008ac26038 R14: 00007f008ac25fa0 R15: 00007ffc9af588e8 [ 95.996706][ T7528] [ 96.038934][ T50] usb 5-1: USB disconnect, device number 10 [ 96.204246][ T7547] kvm: user requested TSC rate below hardware speed [ 96.207718][ T7547] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 96.581352][ T7553] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 96.655703][ T7560] FAULT_INJECTION: forcing a failure. [ 96.655703][ T7560] name failslab, interval 1, probability 0, space 0, times 0 [ 96.655732][ T7560] CPU: 2 UID: 0 PID: 7560 Comm: syz.2.515 Not tainted syzkaller #0 PREEMPT(full) [ 96.655753][ T7560] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.655763][ T7560] Call Trace: [ 96.655778][ T7560] [ 96.655785][ T7560] dump_stack_lvl+0x100/0x190 [ 96.655818][ T7560] should_fail_ex.cold+0x5/0xa [ 96.655839][ T7560] should_failslab+0xc2/0x120 [ 96.655865][ T7560] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 96.655888][ T7560] ? __alloc_skb+0x5b7/0x710 [ 96.655917][ T7560] ? __alloc_skb+0x140/0x710 [ 96.655942][ T7560] __alloc_skb+0x140/0x710 [ 96.655964][ T7560] ? __alloc_skb+0x5b7/0x710 [ 96.655986][ T7560] ? __pfx___alloc_skb+0x10/0x10 [ 96.656014][ T7560] netlink_alloc_large_skb+0x69/0x150 [ 96.656038][ T7560] netlink_sendmsg+0x680/0xda0 [ 96.656063][ T7560] ? __pfx_netlink_sendmsg+0x10/0x10 [ 96.656089][ T7560] ? selinux_socket_sendmsg+0x198/0x2f0 [ 96.656116][ T7560] ____sys_sendmsg+0xa4d/0xbe0 [ 96.656136][ T7560] ? __pfx_netlink_sendmsg+0x10/0x10 [ 96.656159][ T7560] ? __pfx_____sys_sendmsg+0x10/0x10 [ 96.656181][ T7560] ? lock_acquire+0x1d1/0x380 [ 96.656218][ T7560] ? get_pid_task+0x2a/0x250 [ 96.656242][ T7560] ___sys_sendmsg+0x190/0x1e0 [ 96.656263][ T7560] ? __pfx____sys_sendmsg+0x10/0x10 [ 96.656281][ T7560] ? get_pid_task+0x106/0x250 [ 96.656315][ T7560] ? find_held_lock+0x2b/0x80 [ 96.656353][ T7560] __sys_sendmsg+0x160/0x210 [ 96.656378][ T7560] ? __pfx___sys_sendmsg+0x10/0x10 [ 96.656416][ T7560] do_syscall_64+0x123/0x790 [ 96.656446][ T7560] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.656465][ T7560] RIP: 0033:0x7f008a99e159 [ 96.656481][ T7560] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.656495][ T7560] RSP: 002b:00007f008b861028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 96.656518][ T7560] RAX: ffffffffffffffda RBX: 00007f008ac25fa0 RCX: 00007f008a99e159 [ 96.656529][ T7560] RDX: 0000000004000000 RSI: 0000200000000280 RDI: 0000000000000004 [ 96.656542][ T7560] RBP: 00007f008b861090 R08: 0000000000000000 R09: 0000000000000000 [ 96.656552][ T7560] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 96.656562][ T7560] R13: 00007f008ac26038 R14: 00007f008ac25fa0 R15: 00007ffc9af588e8 [ 96.656586][ T7560] [ 96.660736][ T7555] netlink: 'syz.0.513': attribute type 10 has an invalid length. [ 96.665698][ T7555] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.669231][ T7555] bond0: (slave team0): Enslaving as an active interface with an up link [ 96.843297][ T7570] xt_hashlimit: max too large, truncated to 1048576 [ 96.843430][ T7570] xt_hashlimit: Unknown mode mask 300, kernel too old? [ 96.843559][ T7571] xt_hashlimit: max too large, truncated to 1048576 [ 96.843569][ T7571] xt_hashlimit: Unknown mode mask 300, kernel too old? [ 96.848676][ T43] kauditd_printk_skb: 100 callbacks suppressed [ 96.848692][ T43] audit: type=1800 audit(1791126740.576:956): pid=7570 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.519" name="nf_call_arptables" dev="sysfs" ino=92012 res=0 errno=0 [ 96.855348][ T7573] netlink: 28 bytes leftover after parsing attributes in process `syz.0.520'. [ 96.857413][ T43] audit: type=1400 audit(1791126740.576:957): avc: denied { append } for pid=7569 comm="syz.2.519" name="rtc0" dev="devtmpfs" ino=942 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 96.858051][ T43] audit: type=1400 audit(1791126740.585:958): avc: denied { ioctl } for pid=7569 comm="syz.2.519" path="/dev/rtc0" dev="devtmpfs" ino=942 ioctlcmd=0x7005 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 96.930214][ T43] audit: type=1400 audit(1791126740.651:959): avc: denied { ioctl } for pid=7579 comm="syz.0.523" path="/118/mnt/events/cdns3/cdns3_ep0_queue/format" dev="tracefs" ino=19680823 ioctlcmd=0xaece scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 96.957944][ T7584] openvswitch: netlink: Missing key (keys=c0, expected=480) [ 97.070659][ T7588] ipt_rpfilter: unknown options [ 97.373546][ T43] audit: type=1400 audit(1791126741.062:960): avc: denied { nlmsg_read } for pid=7611 comm="syz.2.536" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 97.373965][ T7612] netlink: 12 bytes leftover after parsing attributes in process `syz.2.536'. [ 97.377390][ T7612] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=7612 comm=syz.2.536 [ 97.382407][ T7614] netlink: 12 bytes leftover after parsing attributes in process `syz.1.537'. [ 97.389812][ T7612] syz.2.536 (7612): /proc/7611/oom_adj is deprecated, please use /proc/7611/oom_score_adj instead. [ 97.495451][ T7623] netlink: 20 bytes leftover after parsing attributes in process `syz.2.540'. [ 97.508176][ T43] audit: type=1400 audit(1791126741.193:961): avc: denied { firmware_load } for pid=7622 comm="syz.2.540" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 97.602129][ T7623] syz.2.540 (7623) used greatest stack depth: 19288 bytes left [ 97.657877][ T7629] CIFS: VFS: UNC: missing delimiter between hostname and share name [ 97.657974][ T7629] CIFS: VFS: Malformed UNC in devname [ 97.658525][ T43] audit: type=1400 audit(1791126741.334:962): avc: denied { write } for pid=7627 comm="syz.2.542" name="ip_vs" dev="proc" ino=4026533358 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 97.667788][ T7629] netlink: 12 bytes leftover after parsing attributes in process `syz.2.542'. [ 97.702895][ T43] audit: type=1400 audit(1791126741.371:963): avc: denied { write } for pid=7628 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 97.791879][ T43] audit: type=1400 audit(1791126741.455:964): avc: denied { write } for pid=7634 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 97.810087][ T7638] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 97.956363][ T7649] netlink: 'syz.0.547': attribute type 21 has an invalid length. [ 97.956483][ T7649] netlink: 152 bytes leftover after parsing attributes in process `syz.0.547'. [ 97.990662][ T7651] netlink: 64 bytes leftover after parsing attributes in process `syz.0.548'. [ 97.996457][ T43] audit: type=1400 audit(1791126741.643:965): avc: denied { name_bind } for pid=7650 comm="syz.0.548" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 97.996882][ T7651] syzkaller1: entered promiscuous mode [ 97.996898][ T7651] syzkaller1: entered allmulticast mode [ 98.116126][ T7656] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 98.126440][ T9] usb 7-1: new full-speed USB device number 12 using dummy_hcd [ 98.211217][ T7666] batman_adv: batadv0: Adding interface: syz_tun [ 98.211228][ T7666] batman_adv: batadv0: The MTU of interface syz_tun is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.211244][ T7666] batman_adv: batadv0: Interface activated: syz_tun [ 98.211254][ T7666] batadv0: mtu less than device minimum [ 98.213026][ T7666] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 98.214417][ T7666] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 98.215167][ T7666] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 98.215642][ T7666] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 98.299352][ T9] usb 7-1: unable to get BOS descriptor or descriptor too short [ 98.299858][ T9] usb 7-1: not running at top speed; connect to a high speed hub [ 98.299881][ T9] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice= 8.13 [ 98.302653][ T9] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 98.302674][ T9] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 98.302689][ T9] usb 7-1: config 14 has no interface number 0 [ 98.302704][ T9] usb 7-1: config 14 has no interface number 1 [ 98.302748][ T9] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 98.302768][ T9] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 98.302786][ T9] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 98.302808][ T9] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 98.302829][ T9] usb 7-1: config 14 interface 57 has no altsetting 0 [ 98.302843][ T9] usb 7-1: config 14 interface 228 has no altsetting 0 [ 98.302868][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.335277][ T7671] overlay: ./file0 is not a directory [ 98.545311][ T7645] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2 sclass=netlink_route_socket pid=7645 comm=syz.2.546 [ 98.708699][ T7686] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 98.708931][ T7686] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 98.813011][ T5092] Bluetooth: hci1: unexpected event for opcode 0x1804 [ 98.959923][ T50] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 98.978450][ T9] legousbtower 7-1:14.57: interrupt endpoints not found [ 99.120863][ T50] usb 6-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 99.121739][ T50] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 99.123345][ T50] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.123357][ T50] usb 6-1: Product: syz [ 99.123364][ T50] usb 6-1: Manufacturer: syz [ 99.123371][ T50] usb 6-1: SerialNumber: syz [ 99.128192][ T50] usbhid 6-1:1.0: couldn't find an input interrupt endpoint [ 99.198084][ C0] raw-gadget.0 gadget.2: ignoring, device is not running [ 99.199488][ T9] legousbtower 7-1:14.228: get version request failed: -71 [ 99.199559][ T9] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 99.205934][ T9] usb 7-1: USB disconnect, device number 12 [ 99.341151][ T50] usb 6-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 99.346038][ T50] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 99.346285][ T50] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 99.346321][ T50] usb 6-1: media controller created [ 99.352817][ T50] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 99.766858][ T7701] bond0: Error: Cannot enslave bond to itself. [ 99.874578][ T7709] netdevsim netdevsim2 ªªªªª»: renamed from netdevsim0 (while UP) [ 99.881810][ T7709] o2cb: This node has not been configured. [ 99.881818][ T7709] o2cb: Cluster check failed. Fix errors before retrying. [ 99.881834][ T7709] (syz.2.568,7709,2):user_dlm_register:674 ERROR: status = -22 [ 99.881856][ T7709] (syz.2.568,7709,2):dlmfs_mkdir:437 ERROR: Error -22 could not register domain "file1" [ 100.138857][ T7721] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 100.138871][ T7721] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 100.161887][ T50] usb 6-1: USB disconnect, device number 16 [ 100.195518][ T7723] syzkaller0: entered promiscuous mode [ 100.195532][ T7723] syzkaller0: entered allmulticast mode [ 100.858670][ T66] Bluetooth: hci3: unexpected event for opcode 0x2006 [ 100.951475][ T7735] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 100.951499][ T7735] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 100.951650][ T7735] vhci_hcd vhci_hcd.0: Device attached [ 100.952343][ T7736] vhci_hcd: cannot find the pending unlink 6 [ 100.954100][ T7736] vhci_hcd: connection closed [ 100.956333][ T5586] vhci_hcd vhci_hcd.0: stop threads [ 100.956354][ T5586] vhci_hcd vhci_hcd.0: release socket [ 100.956371][ T5586] vhci_hcd vhci_hcd.0: disconnect device [ 101.529792][ T7743] FAULT_INJECTION: forcing a failure. [ 101.529792][ T7743] name failslab, interval 1, probability 0, space 0, times 0 [ 101.529812][ T7743] CPU: 1 UID: 0 PID: 7743 Comm: syz.0.581 Not tainted syzkaller #0 PREEMPT(full) [ 101.529825][ T7743] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.529832][ T7743] Call Trace: [ 101.529836][ T7743] [ 101.529840][ T7743] dump_stack_lvl+0x100/0x190 [ 101.529871][ T7743] should_fail_ex.cold+0x5/0xa [ 101.529887][ T7743] should_failslab+0xc2/0x120 [ 101.529910][ T7743] kmem_cache_alloc_noprof+0x92/0x6a0 [ 101.529923][ T7743] ? __pfx_map_id_range_down+0x10/0x10 [ 101.529937][ T7743] ? security_inode_alloc+0x3b/0x2c0 [ 101.529953][ T7743] security_inode_alloc+0x3b/0x2c0 [ 101.529967][ T7743] inode_init_always_gfp+0xc6f/0xfb0 [ 101.529986][ T7743] alloc_inode+0x8e/0x250 [ 101.529998][ T7743] new_inode+0x22/0x1c0 [ 101.530011][ T7743] shmem_get_inode+0x1e3/0xf70 [ 101.530028][ T7743] ? __pfx_shmem_get_inode+0x10/0x10 [ 101.530061][ T7743] __shmem_file_setup+0x382/0x460 [ 101.530077][ T7743] ? __pfx___shmem_file_setup+0x10/0x10 [ 101.530094][ T7743] ? vm_area_alloc+0x1f/0x160 [ 101.530113][ T7743] shmem_zero_setup+0x96/0x1b0 [ 101.530124][ T7743] __mmap_region+0x26b6/0x32e0 [ 101.530139][ T7743] ? __pfx___mmap_region+0x10/0x10 [ 101.530162][ T7743] ? lockdep_hardirqs_on+0x7d/0x110 [ 101.530179][ T7743] ? process_measurement+0x10d0/0x2350 [ 101.530208][ T7743] ? lock_acquire+0x1d1/0x380 [ 101.530243][ T7743] mmap_region+0x3db/0x6d0 [ 101.530257][ T7743] ? __pfx_mmap_region+0x10/0x10 [ 101.530269][ T7743] ? shmem_get_unmapped_area+0x141/0x960 [ 101.530286][ T7743] ? selinux_mmap_addr+0x2b/0x110 [ 101.530299][ T7743] ? bpf_lsm_mmap_addr+0x9/0x30 [ 101.530314][ T7743] ? security_mmap_addr+0x71/0x1e0 [ 101.530330][ T7743] ? __get_unmapped_area+0x255/0x3e0 [ 101.530352][ T7743] do_mmap+0x12c7/0x1c30 [ 101.530369][ T7743] ? lock_acquire+0x1d1/0x380 [ 101.530382][ T7743] ? __pfx_do_mmap+0x10/0x10 [ 101.530402][ T7743] ? __pfx_down_write_killable+0x10/0x10 [ 101.530427][ T7743] ? find_held_lock+0x2b/0x80 [ 101.530447][ T7743] vm_mmap_pgoff+0x28d/0x470 [ 101.530463][ T7743] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 101.530476][ T7743] ? lock_acquire+0x1d1/0x380 [ 101.530490][ T7743] ? __mutex_unlock_slowpath+0x35d/0x930 [ 101.530506][ T7743] ksys_mmap_pgoff+0xe4/0x610 [ 101.530522][ T7743] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 101.530536][ T7743] ? fput+0x7c/0x100 [ 101.530551][ T7743] ? ksys_write+0x1ac/0x250 [ 101.530564][ T7743] ? __pfx_ksys_write+0x10/0x10 [ 101.530578][ T7743] __x64_sys_mmap+0x125/0x190 [ 101.530593][ T7743] do_syscall_64+0x123/0x790 [ 101.530607][ T7743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.530618][ T7743] RIP: 0033:0x7fd92c19e159 [ 101.530628][ T7743] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.530639][ T7743] RSP: 002b:00007fd92d02a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 101.530650][ T7743] RAX: ffffffffffffffda RBX: 00007fd92c425fa0 RCX: 00007fd92c19e159 [ 101.530657][ T7743] RDX: 0000000000000002 RSI: 0000000000fbe000 RDI: 0000200000000000 [ 101.530664][ T7743] RBP: 00007fd92d02a090 R08: ffffffffffffffff R09: 0000000001000000 [ 101.530671][ T7743] R10: 0000000000000031 R11: 0000000000000246 R12: 0000000000000001 [ 101.530677][ T7743] R13: 00007fd92c426038 R14: 00007fd92c425fa0 R15: 00007fff0a6f7048 [ 101.530692][ T7743] [ 101.709894][ T7754] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.735792][ T7766] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 101.916592][ T7774] netlink: 'syz.0.588': attribute type 4 has an invalid length. [ 102.026592][ T5445] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 102.194408][ T7779] netlink: 64 bytes leftover after parsing attributes in process `syz.1.590'. [ 102.333217][ T43] kauditd_printk_skb: 35 callbacks suppressed [ 102.333242][ T43] audit: type=1800 audit(1791126745.704:1001): pid=7224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=133149 res=0 errno=0 [ 102.333329][ T43] audit: type=1400 audit(1791126745.704:1002): avc: denied { append } for pid=7794 comm="syz.1.594" name="sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 102.360217][ T43] audit: type=1800 audit(1791126745.732:1003): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=133160 res=0 errno=0 [ 102.369307][ T56] Bluetooth: hci4: Frame reassembly failed (-84) [ 102.477599][ T43] audit: type=1400 audit(1791126745.844:1004): avc: denied { write } for pid=7807 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 102.535516][ T43] audit: type=1400 audit(1791126745.891:1005): avc: denied { write } for pid=7810 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 102.986080][ T7818] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 102.988913][ T7818] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 103.040454][ T7823] netlink: 28 bytes leftover after parsing attributes in process `syz.2.598'. [ 103.090840][ T7827] netlink: 8 bytes leftover after parsing attributes in process `syz.2.599'. [ 103.128443][ T7829] net_ratelimit: 15 callbacks suppressed [ 103.128459][ T7829] ip_tables: iptables: counters copy to user failed while replacing table [ 103.140496][ T7831] netlink: 8 bytes leftover after parsing attributes in process `syz.0.601'. [ 103.140563][ T7831] netlink: 12 bytes leftover after parsing attributes in process `syz.0.601'. [ 103.211690][ T7840] netlink: 96 bytes leftover after parsing attributes in process `syz.0.605'. [ 103.269123][ T7842] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(3276804.0.63), cmd(3) [ 103.461961][ T43] audit: type=1400 audit(1791126746.761:1006): avc: denied { write } for pid=7858 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 103.518767][ T43] audit: type=1400 audit(1791126746.818:1007): avc: denied { write } for pid=7861 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 103.571361][ T43] audit: type=1400 audit(1791126746.864:1008): avc: denied { watch } for pid=7868 comm="syz.0.616" path=2F6D656D66643A2D42D54E49C56A9A707070F00884A26D202864656C6574656429 dev="hugetlbfs" ino=26421 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 103.572093][ T43] audit: type=1400 audit(1791126746.864:1009): avc: denied { execute } for pid=7868 comm="syz.0.616" dev="hugetlbfs" ino=26421 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 103.575880][ T43] audit: type=1400 audit(1791126746.864:1010): avc: denied { execute_no_trans } for pid=7868 comm="syz.0.616" path=2F6D656D66643A2D42D54E49C56A9A707070F00884A26D202864656C6574656429 dev="hugetlbfs" ino=26421 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 103.640693][ T58] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 103.801508][ T58] usb 7-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 103.802366][ T58] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 103.805857][ T58] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.805871][ T58] usb 7-1: Product: syz [ 103.805884][ T58] usb 7-1: Manufacturer: syz [ 103.805891][ T58] usb 7-1: SerialNumber: syz [ 103.817064][ T58] usbhid 7-1:1.0: couldn't find an input interrupt endpoint [ 104.030345][ T58] usb 7-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 104.034251][ T58] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 104.034455][ T58] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 104.034478][ T58] usb 7-1: media controller created [ 104.039583][ T58] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 104.246380][ T58] i2c i2c-2: ec100: i2c rd failed=-32 reg=33 [ 104.290364][ T7886] comedi comedi4: bad chanlist[0]=0x00010001 chan=1 range length=1 [ 104.290721][ T7886] FAULT_INJECTION: forcing a failure. [ 104.290721][ T7886] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 104.290748][ T7886] CPU: 0 UID: 0 PID: 7886 Comm: syz.0.620 Not tainted syzkaller #0 PREEMPT(full) [ 104.290768][ T7886] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.290778][ T7886] Call Trace: [ 104.290793][ T7886] [ 104.290800][ T7886] dump_stack_lvl+0x100/0x190 [ 104.290838][ T7886] should_fail_ex.cold+0x5/0xa [ 104.290859][ T7886] ? prepare_alloc_pages+0x16d/0x5b0 [ 104.290890][ T7886] should_fail_alloc_page+0xeb/0x140 [ 104.290916][ T7886] prepare_alloc_pages+0x1f0/0x5b0 [ 104.290945][ T7886] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 104.290967][ T7886] ? __lock_acquire+0x5c0/0x1f40 [ 104.290994][ T7886] ? __lock_acquire+0x5c0/0x1f40 [ 104.291017][ T7886] ? lock_acquire+0x1d1/0x380 [ 104.291037][ T7886] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 104.291060][ T7886] ? lock_acquire+0x1d1/0x380 [ 104.291078][ T7886] ? is_bpf_text_address+0x25/0x1a0 [ 104.291102][ T7886] ? find_held_lock+0x2b/0x80 [ 104.291125][ T7886] ? is_bpf_text_address+0x8a/0x1a0 [ 104.291148][ T7886] ? is_bpf_text_address+0x8a/0x1a0 [ 104.291170][ T7886] ? bpf_ksym_find+0x128/0x1c0 [ 104.291186][ T7886] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 104.291209][ T7886] ? kernel_text_address+0x8d/0x100 [ 104.291236][ T7886] ? __kernel_text_address+0xd/0x30 [ 104.291253][ T7886] ? unwind_get_return_address+0x59/0xa0 [ 104.291306][ T7886] ? arch_stack_walk+0xa6/0xf0 [ 104.291338][ T7886] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 104.291365][ T7886] ? policy_nodemask+0xed/0x4f0 [ 104.291394][ T7886] alloc_pages_mpol+0x201/0x550 [ 104.291421][ T7886] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 104.291446][ T7886] ? __lock_acquire+0x5c0/0x1f40 [ 104.291471][ T7886] folio_alloc_mpol_noprof+0x36/0x260 [ 104.291490][ T7886] vma_alloc_folio_noprof+0xed/0x1d0 [ 104.291509][ T7886] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 104.291536][ T7886] do_anonymous_page+0xac9/0x2050 [ 104.291568][ T7886] ? __pfx_do_anonymous_page+0x10/0x10 [ 104.291593][ T7886] ? rcu_read_unlock+0x2d/0xb0 [ 104.291609][ T7886] ? rcu_read_unlock+0x2d/0xb0 [ 104.291625][ T7886] ? __pte_offset_map+0x179/0x310 [ 104.291652][ T7886] __handle_mm_fault+0x1ff3/0x2f60 [ 104.291682][ T7886] ? lock_vma_under_rcu+0x11d/0x590 [ 104.291706][ T7886] ? __pfx___handle_mm_fault+0x10/0x10 [ 104.291736][ T7886] ? lock_vma_under_rcu+0x17c/0x590 [ 104.291776][ T7886] handle_mm_fault+0x363/0xa20 [ 104.291807][ T7886] do_user_addr_fault+0x59c/0x12f0 [ 104.291838][ T7886] exc_page_fault+0x6f/0xd0 [ 104.291868][ T7886] asm_exc_page_fault+0x26/0x30 [ 104.291886][ T7886] RIP: 0033:0x7fd92c065aba [ 104.291903][ T7886] Code: 4d 69 ff 68 08 00 00 b9 0c 01 00 00 4c 89 74 24 18 31 ed 4a 8d 54 3e 08 4e 8d 0c 3e 4c 89 fb 48 89 d7 4d 89 cf ba 01 00 00 00 48 ab 49 8d 45 12 4d 89 69 08 49 89 41 10 41 0f b6 45 04 41 88 [ 104.291921][ T7886] RSP: 002b:00007fd92d027f60 EFLAGS: 00010246 [ 104.291944][ T7886] RAX: 0000000000000000 RBX: 0000000000000868 RCX: 000000000000007e [ 104.291957][ T7886] RDX: 0000000000000001 RSI: 00007fd92c550320 RDI: 00007fd92c551000 [ 104.291969][ T7886] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007fd92c550b88 [ 104.291980][ T7886] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000036 [ 104.291992][ T7886] R13: 0000200000000100 R14: 0000000000000005 R15: 00007fd92c550b88 [ 104.292022][ T7886] [ 104.292503][ T7886] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 104.570146][ T2206] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 104.582693][ T66] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 104.708970][ T2206] usb 5-1: device descriptor read/64, error -71 [ 104.965464][ T2206] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 105.104356][ T2206] usb 5-1: device descriptor read/64, error -71 [ 105.222280][ T2206] usb usb5-port1: attempt power cycle [ 105.259674][ T58] usb 7-1: USB disconnect, device number 13 [ 105.606610][ T2206] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 105.617794][ T7898] smc: net device veth1_macvtap applied user defined pnetid SYZ2 [ 105.618098][ T7898] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=60 sclass=netlink_tcpdiag_socket pid=7898 comm=syz.1.623 [ 105.628687][ T2206] usb 5-1: device descriptor read/8, error -71 [ 105.795363][ T7902] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 105.895214][ T2206] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 105.916902][ T2206] usb 5-1: device descriptor read/8, error -71 [ 106.036549][ T2206] usb usb5-port1: unable to enumerate USB device [ 106.130261][ T30] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 106.291892][ T30] usb 7-1: New USB device found, idVendor=1bc7, idProduct=10c4, bcdDevice=2d.44 [ 106.292705][ T30] usb 7-1: config 0 has an invalid interface number: 175 but max is 1 [ 106.292718][ T30] usb 7-1: config 0 has an invalid interface number: 253 but max is 1 [ 106.292729][ T30] usb 7-1: config 0 has no interface number 0 [ 106.292736][ T30] usb 7-1: config 0 has no interface number 1 [ 106.292757][ T30] usb 7-1: config 0 interface 175 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 106.292769][ T30] usb 7-1: config 0 interface 175 altsetting 0 bulk endpoint 0xC has invalid maxpacket 16 [ 106.292785][ T30] usb 7-1: config 0 interface 253 altsetting 156 endpoint 0xB has invalid wMaxPacketSize 0 [ 106.292796][ T30] usb 7-1: config 0 interface 253 altsetting 156 endpoint 0x4 has invalid maxpacket 512, setting to 64 [ 106.292808][ T30] usb 7-1: config 0 interface 253 altsetting 156 has an invalid endpoint descriptor of length 2, skipping [ 106.292819][ T30] usb 7-1: config 0 interface 253 altsetting 156 endpoint 0x5 has invalid maxpacket 1040, setting to 1024 [ 106.292831][ T30] usb 7-1: config 0 interface 253 altsetting 156 bulk endpoint 0x5 has invalid maxpacket 1024 [ 106.292842][ T30] usb 7-1: config 0 interface 253 altsetting 156 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 106.292855][ T30] usb 7-1: config 0 interface 253 has no altsetting 0 [ 106.294528][ T30] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.294540][ T30] usb 7-1: Product: ÑŒ [ 106.294548][ T30] usb 7-1: Manufacturer: Љ [ 106.294555][ T30] usb 7-1: SerialNumber: ÑŒ [ 106.296452][ T30] usb 7-1: config 0 descriptor?? [ 106.298358][ T7906] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 106.520013][ T30] option 7-1:0.175: GSM modem (1-port) converter detected [ 106.528567][ T30] usb 7-1: USB disconnect, device number 14 [ 106.532998][ T30] option 7-1:0.175: device disconnected [ 106.796025][ T13] nci: nci_ntf_packet: unknown ntf opcode 0x13e [ 107.918687][ T43] kauditd_printk_skb: 21 callbacks suppressed [ 107.918704][ T43] audit: type=1400 audit(1791126750.935:1032): avc: denied { read write } for pid=7927 comm="syz.0.631" name="fuse" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 107.918876][ T43] audit: type=1400 audit(1791126750.935:1033): avc: denied { open } for pid=7927 comm="syz.0.631" path="/dev/fuse" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 107.922032][ T43] audit: type=1800 audit(1791126750.935:1034): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=133679 res=0 errno=0 [ 108.808395][ T43] audit: type=1800 audit(1791126751.768:1035): pid=7928 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.631" name="/" dev="fuse" ino=1 res=0 errno=0 [ 108.880911][ T7934] netlink: 'syz.0.633': attribute type 3 has an invalid length. [ 108.880926][ T7934] netlink: 64 bytes leftover after parsing attributes in process `syz.0.633'. [ 108.927430][ T7936] batman_adv: batadv0: Local translation table size (108) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 108.951586][ T30] batman_adv: batadv0: Local translation table size (108) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 109.933268][ T7910] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 109.975366][ T43] audit: type=1400 audit(1791126752.853:1036): avc: denied { getopt } for pid=7939 comm="syz.1.636" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 109.993958][ T7945] program syz.0.637 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 110.055195][ T30] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 110.297798][ T50] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 110.353729][ T43] audit: type=1800 audit(1791126753.218:1037): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=134566 res=0 errno=0 [ 110.459310][ T50] usb 7-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 110.460126][ T50] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 110.460141][ T50] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 110.460160][ T50] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.462131][ T50] usb 7-1: config 0 descriptor?? [ 110.462988][ T43] audit: type=1800 audit(1791126753.312:1038): pid=7224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=134585 res=0 errno=0 [ 110.464197][ T43] audit: type=1800 audit(1791126753.312:1039): pid=7224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=134614 res=0 errno=0 [ 110.465777][ T43] audit: type=1800 audit(1791126753.312:1040): pid=7224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=134592 res=0 errno=0 [ 110.466241][ T43] audit: type=1800 audit(1791126753.312:1041): pid=7224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idProduct" dev="sysfs" ino=134593 res=0 errno=0 [ 110.467303][ T50] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 110.693752][ T5740] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 110.696029][ T7975] No control pipe specified [ 110.699702][ T5740] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 110.701025][ T5740] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 110.701651][ T7975] se_dev->se_dev_ptr already set for storage object [ 110.701898][ T5740] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 110.702381][ T5740] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 111.039547][ T7996] program syz.1.651 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 111.131356][ T7973] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.131440][ T7973] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.131495][ T7973] bridge_slave_0: entered allmulticast mode [ 111.132231][ T7973] bridge_slave_0: entered promiscuous mode [ 111.133822][ T7973] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.133891][ T7973] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.134039][ T7973] bridge_slave_1: entered allmulticast mode [ 111.134738][ T7973] bridge_slave_1: entered promiscuous mode [ 111.150225][ T7973] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 111.151839][ T7973] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 111.166738][ T7973] team0: Port device team_slave_0 added [ 111.167972][ T7973] team0: Port device team_slave_1 added [ 111.179854][ T7973] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 111.179864][ T7973] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 111.179876][ T7973] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 111.182433][ T7973] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 111.182442][ T7973] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 111.182458][ T7973] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 111.210041][ T7973] hsr_slave_0: entered promiscuous mode [ 111.210754][ T7973] hsr_slave_1: entered promiscuous mode [ 111.211265][ T7973] debugfs: 'hsr0' already exists in 'hsr' [ 111.211281][ T7973] Cannot create hsr debugfs directory [ 111.340824][ T7973] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 111.343911][ T7973] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 111.344523][ T7973] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 111.348007][ T7973] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 111.348545][ T7973] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 111.352831][ T7973] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 111.353629][ T7973] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 111.359051][ T7973] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 111.379672][ T7973] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.379721][ T7973] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.379823][ T7973] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.379867][ T7973] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.410159][ T6056] usb 5-1: new low-speed USB device number 15 using dummy_hcd [ 111.412826][ T7973] 8021q: adding VLAN 0 to HW filter on device bond0 [ 111.423263][ T56] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.425808][ T56] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.435992][ T7973] 8021q: adding VLAN 0 to HW filter on device team0 [ 111.439188][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.439282][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.448587][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.448634][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.569466][ T6056] usb 5-1: Invalid ep0 maxpacket: 16 [ 111.708385][ T6056] usb 5-1: new low-speed USB device number 16 using dummy_hcd [ 111.722232][ T7973] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.869065][ T6056] usb 5-1: Invalid ep0 maxpacket: 16 [ 111.869629][ T6056] usb usb5-port1: attempt power cycle [ 111.872501][ T7973] veth0_vlan: entered promiscuous mode [ 111.878658][ T7973] veth1_vlan: entered promiscuous mode [ 111.903045][ T7973] veth0_macvtap: entered promiscuous mode [ 111.905211][ T7973] veth1_macvtap: entered promiscuous mode [ 111.912235][ T7973] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.917980][ T7973] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.000444][ T238] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.000467][ T238] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.047674][ T238] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.047692][ T238] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.056402][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.071856][ T5807] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.071882][ T5807] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.071901][ T5807] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.253422][ T6056] usb 5-1: new low-speed USB device number 17 using dummy_hcd [ 112.276459][ T6056] usb 5-1: Invalid ep0 maxpacket: 16 [ 112.374461][ T8040] tipc: Enabling of bearer rejected, failed to enable media [ 112.413974][ T6056] usb 5-1: new low-speed USB device number 18 using dummy_hcd [ 112.435898][ T6056] usb 5-1: Invalid ep0 maxpacket: 16 [ 112.436175][ T6056] usb usb5-port1: unable to enumerate USB device [ 112.877190][ T66] Bluetooth: hci4: command tx timeout [ 112.960985][ T8072] kernel read not supported for file /policy (pid: 8072 comm: syz.4.670) [ 113.193357][ T8083] befs: (loop4): unable to read superblock [ 113.234061][ T8085] FAULT_INJECTION: forcing a failure. [ 113.234061][ T8085] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 113.234173][ T8085] CPU: 2 UID: 0 PID: 8085 Comm: syz.4.674 Not tainted syzkaller #0 PREEMPT(full) [ 113.234187][ T8085] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 113.234198][ T8085] Call Trace: [ 113.234202][ T8085] [ 113.234207][ T8085] dump_stack_lvl+0x100/0x190 [ 113.234238][ T8085] should_fail_ex.cold+0x5/0xa [ 113.234255][ T8085] _copy_to_user+0x32/0xd0 [ 113.234273][ T8085] bpf_test_finish.isra.0+0x4aa/0x650 [ 113.234292][ T8085] ? __pfx_bpf_test_finish.isra.0+0x10/0x10 [ 113.234308][ T8085] ? 0xffffffffa0405d00 [ 113.234317][ T8085] ? bpf_dispatcher_change_prog+0x2de/0xa50 [ 113.234330][ T8085] bpf_prog_test_run_xdp+0xa79/0x1670 [ 113.234351][ T8085] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 113.234369][ T8085] ? fput+0x7c/0x100 [ 113.234385][ T8085] ? __bpf_prog_get+0x97/0x290 [ 113.234401][ T8085] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 113.234415][ T8085] __sys_bpf+0x2265/0x4a30 [ 113.234431][ T8085] ? __pfx___sys_bpf+0x10/0x10 [ 113.234443][ T8085] ? find_held_lock+0x2b/0x80 [ 113.234459][ T8085] ? get_pid_task+0xfc/0x250 [ 113.234473][ T8085] ? get_pid_task+0xfc/0x250 [ 113.234493][ T8085] ? find_held_lock+0x2b/0x80 [ 113.234512][ T8085] ? rcu_read_lock_any_held+0x6a/0x90 [ 113.234529][ T8085] ? find_held_lock+0x2b/0x80 [ 113.234545][ T8085] ? ksys_write+0x190/0x250 [ 113.234557][ T8085] ? ksys_write+0x190/0x250 [ 113.234569][ T8085] ? lock_acquire+0x1d1/0x380 [ 113.234591][ T8085] ? fput+0x7c/0x100 [ 113.234606][ T8085] ? ksys_write+0x1ac/0x250 [ 113.234620][ T8085] ? __x64_sys_bpf+0xce/0x140 [ 113.234631][ T8085] __x64_sys_bpf+0xce/0x140 [ 113.234644][ T8085] ? do_syscall_64+0xae/0x790 [ 113.234660][ T8085] do_syscall_64+0x123/0x790 [ 113.234674][ T8085] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.234686][ T8085] RIP: 0033:0x7f770359e159 [ 113.234697][ T8085] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 113.234708][ T8085] RSP: 002b:00007f770448c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 113.234719][ T8085] RAX: ffffffffffffffda RBX: 00007f7703825fa0 RCX: 00007f770359e159 [ 113.234726][ T8085] RDX: 0000000000000050 RSI: 0000200000000c80 RDI: 000000000000000a [ 113.234733][ T8085] RBP: 00007f770448c090 R08: 0000000000000000 R09: 0000000000000000 [ 113.234741][ T8085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 113.234750][ T8085] R13: 00007f7703826038 R14: 00007f7703825fa0 R15: 00007ffc48cdd3b8 [ 113.234773][ T8085] [ 113.281426][ T43] kauditd_printk_skb: 26 callbacks suppressed [ 113.281440][ T43] audit: type=1800 audit(1791126755.942:1068): pid=8087 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.675" name="new_id" dev="sysfs" ino=52442 res=0 errno=0 [ 113.289940][ T851] usb 7-1: USB disconnect, device number 15 [ 113.354993][ T43] audit: type=1400 audit(1791126756.016:1069): avc: denied { read } for pid=8088 comm="syz.2.676" path="socket:[28402]" dev="sockfs" ino=28402 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 113.411069][ T43] audit: type=1800 audit(1791126756.073:1070): pid=8096 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.677" name="cur_state" dev="sysfs" ino=6186 res=0 errno=0 [ 113.414950][ T43] audit: type=1800 audit(1791126756.073:1071): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=141968 res=0 errno=0 [ 113.415999][ T43] audit: type=1800 audit(1791126756.073:1072): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=141980 res=0 errno=0 [ 113.441246][ T43] audit: type=1800 audit(1791126756.082:1073): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=141992 res=0 errno=0 [ 113.441289][ T43] audit: type=1800 audit(1791126756.082:1074): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=142004 res=0 errno=0 [ 113.441322][ T43] audit: type=1800 audit(1791126756.082:1075): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=142016 res=0 errno=0 [ 113.441355][ T43] audit: type=1800 audit(1791126756.082:1076): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=142028 res=0 errno=0 [ 113.441389][ T43] audit: type=1800 audit(1791126756.082:1077): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=142040 res=0 errno=0 [ 113.728324][ C2] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 113.929511][ T8118] netlink: 'syz.1.683': attribute type 2 has an invalid length. [ 114.252856][ T66] Bluetooth: hci3: unexpected event for opcode 0x2027 [ 114.540224][ T5803] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 114.701334][ T5803] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 114.702698][ T5803] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 114.703713][ T5803] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 114.703727][ T5803] usb 5-1: SerialNumber: syz [ 114.850101][ T30] usb 7-1: new low-speed USB device number 16 using dummy_hcd [ 114.873876][ T8148] netlink: 16 bytes leftover after parsing attributes in process `syz.1.694'. [ 114.874287][ T8148] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=13 sclass=netlink_route_socket pid=8148 comm=syz.1.694 [ 114.874646][ T8148] netlink: 8 bytes leftover after parsing attributes in process `syz.1.694'. [ 114.882973][ T8148] x_tables: duplicate underflow at hook 1 [ 114.928174][ T5803] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -71 [ 114.931755][ T5803] usb 5-1: USB disconnect, device number 19 [ 114.999728][ T30] usb 7-1: device descriptor read/64, error -71 [ 115.277504][ T30] usb 7-1: new low-speed USB device number 17 using dummy_hcd [ 115.423774][ T30] usb 7-1: device descriptor read/64, error -71 [ 115.534365][ T30] usb usb7-port1: attempt power cycle [ 115.624180][ T5807] nci: nci_rx_work: unknown MT 0x1 [ 115.683639][ T58] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 115.705014][ T66] Bluetooth: hci4: command tx timeout [ 115.866261][ T58] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 115.867219][ T58] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 115.867236][ T58] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 115.867254][ T58] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.873878][ T8155] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 115.876168][ T58] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 115.897300][ T30] usb 7-1: new low-speed USB device number 18 using dummy_hcd [ 115.919134][ T30] usb 7-1: device descriptor read/8, error -71 [ 116.091176][ T851] usb 9-1: USB disconnect, device number 2 [ 116.095142][ T8155] FAULT_INJECTION: forcing a failure. [ 116.095142][ T8155] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 116.095171][ T8155] CPU: 0 UID: 0 PID: 8155 Comm: syz.4.697 Not tainted syzkaller #0 PREEMPT(full) [ 116.095191][ T8155] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.095202][ T8155] Call Trace: [ 116.095209][ T8155] [ 116.095217][ T8155] dump_stack_lvl+0x100/0x190 [ 116.095247][ T8155] should_fail_ex.cold+0x5/0xa [ 116.095282][ T8155] strncpy_from_user+0x3b/0x2d0 [ 116.095310][ T8155] do_getname+0x78/0x390 [ 116.095333][ T8155] do_sys_openat2+0xc7/0x1e0 [ 116.095361][ T8155] ? __pfx_do_sys_openat2+0x10/0x10 [ 116.095398][ T8155] __x64_sys_openat+0x12d/0x210 [ 116.095425][ T8155] ? __pfx___x64_sys_openat+0x10/0x10 [ 116.095451][ T8155] ? ksys_write+0x1ac/0x250 [ 116.095499][ T8155] do_syscall_64+0x123/0x790 [ 116.095523][ T8155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.095541][ T8155] RIP: 0033:0x7f770355e98e [ 116.095557][ T8155] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 116.095574][ T8155] RSP: 002b:00007f770448bb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 116.095592][ T8155] RAX: ffffffffffffffda RBX: 00007f770448c6c0 RCX: 00007f770355e98e [ 116.095604][ T8155] RDX: 000000000004a203 RSI: 00007f770448bc00 RDI: ffffffffffffff9c [ 116.095615][ T8155] RBP: 00007f770448bc00 R08: 0000000000000000 R09: 0000000000000000 [ 116.095627][ T8155] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 116.095638][ T8155] R13: 00007f7703826038 R14: 00007f7703825fa0 R15: 00007ffc48cdd3b8 [ 116.095663][ T8155] [ 116.196464][ T30] usb 7-1: new low-speed USB device number 19 using dummy_hcd [ 116.218349][ T30] usb 7-1: device descriptor read/8, error -71 [ 116.336904][ T30] usb usb7-port1: unable to enumerate USB device [ 116.756848][ T66] Bluetooth: hci4: unexpected cc 0x204b length: 34 > 3 [ 117.867297][ T8179] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 117.867324][ T8179] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 117.867413][ T8179] vhci_hcd vhci_hcd.0: Device attached [ 117.882293][ T8180] vhci_hcd: connection closed [ 117.885905][ T5807] vhci_hcd vhci_hcd.2: stop threads [ 117.885928][ T5807] vhci_hcd vhci_hcd.2: release socket [ 117.885944][ T5807] vhci_hcd vhci_hcd.2: disconnect device [ 118.771560][ T8161] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 118.821477][ T8185] input: syz1 as /devices/virtual/input/input9 [ 118.822403][ T43] kauditd_printk_skb: 90 callbacks suppressed [ 118.822419][ T43] audit: type=1800 audit(1791126761.135:1168): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=143183 res=0 errno=0 [ 118.826378][ T43] audit: type=1800 audit(1791126761.135:1169): pid=8101 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="ev" dev="sysfs" ino=143198 res=0 errno=0 [ 118.836644][ T43] audit: type=1800 audit(1791126761.154:1170): pid=8101 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="abs" dev="sysfs" ino=143201 res=0 errno=0 [ 118.839204][ T43] audit: type=1800 audit(1791126761.154:1171): pid=8101 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="rel" dev="sysfs" ino=143200 res=0 errno=0 [ 118.841074][ T43] audit: type=1800 audit(1791126761.154:1172): pid=8101 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="key" dev="sysfs" ino=143199 res=0 errno=0 [ 118.841915][ T43] audit: type=1800 audit(1791126761.154:1173): pid=8101 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="properties" dev="sysfs" ino=143190 res=0 errno=0 [ 118.843011][ T43] audit: type=1800 audit(1791126761.154:1174): pid=8101 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="bustype" dev="sysfs" ino=143193 res=0 errno=0 [ 118.843909][ T43] audit: type=1800 audit(1791126761.154:1175): pid=8101 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="name" dev="sysfs" ino=143186 res=0 errno=0 [ 118.868644][ T43] audit: type=1800 audit(1791126761.182:1176): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=143214 res=0 errno=0 [ 118.943391][ T43] audit: type=1800 audit(1791126761.248:1177): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=143236 res=0 errno=0 [ 119.092694][ T2206] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 119.253180][ T2206] usb 7-1: New USB device found, idVendor=0a99, idProduct=0001, bcdDevice= 0.00 [ 119.254048][ T2206] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.255323][ T2206] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 119.255335][ T2206] usb 7-1: Product: syz [ 119.255343][ T2206] usb 7-1: Manufacturer: syz [ 119.260684][ T2206] navman 7-1:1.0: navman converter detected [ 119.268328][ T2206] usb 7-1: navman converter now attached to ttyUSB0 [ 119.339066][ T1349] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 119.391390][ T8229] wg0: entered promiscuous mode [ 119.414534][ T8229] team0: Device wg0 is of different type [ 119.420001][ T8229] team0: Device wg0 is of different type [ 119.472977][ T2206] usb 7-1: USB disconnect, device number 20 [ 119.481580][ T2206] navman ttyUSB0: navman converter now disconnected from ttyUSB0 [ 119.481816][ T2206] navman 7-1:1.0: device disconnected [ 119.509161][ T8235] No control pipe specified [ 119.510607][ T1349] usb 6-1: New USB device found, idVendor=1bc7, idProduct=10c4, bcdDevice=2d.44 [ 119.511397][ T1349] usb 6-1: config 0 has an invalid interface number: 175 but max is 1 [ 119.511411][ T1349] usb 6-1: config 0 has an invalid interface number: 253 but max is 1 [ 119.511421][ T1349] usb 6-1: config 0 has no interface number 0 [ 119.511429][ T1349] usb 6-1: config 0 has no interface number 1 [ 119.511449][ T1349] usb 6-1: config 0 interface 175 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 119.511462][ T1349] usb 6-1: config 0 interface 175 altsetting 0 bulk endpoint 0xC has invalid maxpacket 16 [ 119.511479][ T1349] usb 6-1: config 0 interface 253 altsetting 156 endpoint 0xB has invalid wMaxPacketSize 0 [ 119.511490][ T1349] usb 6-1: config 0 interface 253 altsetting 156 endpoint 0x4 has invalid maxpacket 512, setting to 64 [ 119.511502][ T1349] usb 6-1: config 0 interface 253 altsetting 156 has an invalid endpoint descriptor of length 2, skipping [ 119.511514][ T1349] usb 6-1: config 0 interface 253 altsetting 156 endpoint 0x5 has invalid maxpacket 1040, setting to 1024 [ 119.511526][ T1349] usb 6-1: config 0 interface 253 altsetting 156 bulk endpoint 0x5 has invalid maxpacket 1024 [ 119.511537][ T1349] usb 6-1: config 0 interface 253 altsetting 156 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 119.511550][ T1349] usb 6-1: config 0 interface 253 has no altsetting 0 [ 119.513100][ T1349] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.513112][ T1349] usb 6-1: Product: ÑŒ [ 119.513119][ T1349] usb 6-1: Manufacturer: Љ [ 119.513126][ T1349] usb 6-1: SerialNumber: ÑŒ [ 119.518345][ T1349] usb 6-1: config 0 descriptor?? [ 119.519819][ T8213] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 119.645114][ T8240] xt_connbytes: Forcing CT accounting to be enabled [ 119.672440][ T8242] fuse: blksize only supported for fuseblk [ 119.750538][ T1349] option 6-1:0.175: GSM modem (1-port) converter detected [ 119.782607][ T1349] usb 6-1: USB disconnect, device number 17 [ 119.785133][ T1349] option 6-1:0.175: device disconnected [ 119.933674][ T8259] netlink: 20 bytes leftover after parsing attributes in process `syz.4.732'. [ 119.970854][ T8259] netlink: 20 bytes leftover after parsing attributes in process `syz.4.732'. [ 119.970881][ T8259] nbd: nbd64 already in use [ 119.979121][ T7224] block nbd64: NBD_DISCONNECT [ 120.038798][ T8101] udevd[8101]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 120.144115][ T238] IPVS: starting estimator thread 0... [ 120.144907][ T8266] IPVS: rr: UDP [fe80::aa]:8080 - no destination available [ 120.171672][ T58] usb 5-1: new low-speed USB device number 20 using dummy_hcd [ 120.246753][ T8267] IPVS: using max 45 ests per chain, 108000 per kthread [ 120.332590][ T58] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 120.333466][ T58] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 120.333489][ T58] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 120.333504][ T58] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 120.333517][ T58] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 120.333531][ T58] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 120.334385][ T58] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 120.334406][ T58] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 120.334420][ T58] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 120.334433][ T58] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 120.334447][ T58] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 120.338201][ T58] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 120.338226][ T58] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 120.338240][ T58] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 120.338253][ T58] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 120.338272][ T58] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 120.341821][ T58] usb 5-1: string descriptor 0 read error: -22 [ 120.341881][ T58] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.355301][ T58] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 120.380350][ T8276] netlink: 8 bytes leftover after parsing attributes in process `syz.1.738'. [ 120.460535][ T8278] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 120.467036][ T8278] netlink: 'syz.4.739': attribute type 11 has an invalid length. [ 120.563336][ T1349] usb 5-1: USB disconnect, device number 20 [ 120.626137][ T8286] overlayfs: failed to clone upperpath [ 120.655894][ T8288] netlink: 32 bytes leftover after parsing attributes in process `syz.1.742'. [ 120.966368][ T8300] Failed to enqueue queue_pair DETACH event datagram for context (ID=0x0) [ 121.057110][ T8309] Invalid logical block size (1536) [ 121.081700][ T66] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 121.081761][ T66] Bluetooth: hci4: Injecting HCI hardware error event [ 121.082875][ T5740] Bluetooth: hci4: hardware error 0x00 [ 121.190107][ T8319] netlink: 12 bytes leftover after parsing attributes in process `syz.1.753'. [ 121.194777][ T8319] xfrm1: entered promiscuous mode [ 121.194793][ T8319] xfrm1: entered allmulticast mode [ 121.211417][ T8319] batman_adv: batadv0: Adding interface: syz_tun [ 121.211428][ T8319] batman_adv: batadv0: The MTU of interface syz_tun is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 121.211681][ T8319] batman_adv: batadv0: Interface activated: syz_tun [ 121.281034][ T8314] openvswitch: netlink: IP tunnel dst address not specified [ 121.319283][ T8331] FAULT_INJECTION: forcing a failure. [ 121.319283][ T8331] name failslab, interval 1, probability 0, space 0, times 0 [ 121.319307][ T8331] CPU: 1 UID: 0 PID: 8331 Comm: syz.1.756 Tainted: G L syzkaller #0 PREEMPT(full) [ 121.319322][ T8331] Tainted: [L]=SOFTLOCKUP [ 121.319326][ T8331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 121.319333][ T8331] Call Trace: [ 121.319336][ T8331] [ 121.319341][ T8331] dump_stack_lvl+0x100/0x190 [ 121.319362][ T8331] should_fail_ex.cold+0x5/0xa [ 121.319379][ T8331] should_failslab+0xc2/0x120 [ 121.319395][ T8331] __kmalloc_cache_noprof+0x91/0x6d0 [ 121.319407][ T8331] ? nfnetlink_rcv_batch+0x780/0x2880 [ 121.319421][ T8331] nfnetlink_rcv_batch+0x780/0x2880 [ 121.319439][ T8331] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 121.319453][ T8331] ? lock_acquire+0x1d1/0x380 [ 121.319465][ T8331] ? avc_has_perm_noaudit+0x56/0x470 [ 121.319488][ T8331] ? avc_has_perm_noaudit+0x145/0x470 [ 121.319519][ T8331] ? __nla_parse+0x40/0x60 [ 121.319532][ T8331] nfnetlink_rcv+0x3bd/0x440 [ 121.319543][ T8331] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 121.319570][ T8331] netlink_unicast+0x585/0x850 [ 121.319590][ T8331] ? __pfx_netlink_unicast+0x10/0x10 [ 121.319611][ T8331] netlink_sendmsg+0x8b0/0xda0 [ 121.319631][ T8331] ? __pfx_netlink_sendmsg+0x10/0x10 [ 121.319647][ T8331] ? selinux_socket_sendmsg+0x198/0x2f0 [ 121.319663][ T8331] ____sys_sendmsg+0xa4d/0xbe0 [ 121.319675][ T8331] ? __pfx_netlink_sendmsg+0x10/0x10 [ 121.319691][ T8331] ? __pfx_____sys_sendmsg+0x10/0x10 [ 121.319706][ T8331] ? lock_acquire+0x1d1/0x380 [ 121.319718][ T8331] ? get_pid_task+0x2a/0x250 [ 121.319735][ T8331] ___sys_sendmsg+0x190/0x1e0 [ 121.319748][ T8331] ? __pfx____sys_sendmsg+0x10/0x10 [ 121.319761][ T8331] ? get_pid_task+0x106/0x250 [ 121.319782][ T8331] ? find_held_lock+0x2b/0x80 [ 121.319807][ T8331] __sys_sendmsg+0x160/0x210 [ 121.319824][ T8331] ? __pfx___sys_sendmsg+0x10/0x10 [ 121.319847][ T8331] do_syscall_64+0x123/0x790 [ 121.319861][ T8331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.319873][ T8331] RIP: 0033:0x7fe0fd79e159 [ 121.319883][ T8331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 121.319893][ T8331] RSP: 002b:00007fe0fe61b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 121.319906][ T8331] RAX: ffffffffffffffda RBX: 00007fe0fda25fa0 RCX: 00007fe0fd79e159 [ 121.319913][ T8331] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 121.319919][ T8331] RBP: 00007fe0fe61b090 R08: 0000000000000000 R09: 0000000000000000 [ 121.319926][ T8331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 121.319932][ T8331] R13: 00007fe0fda26038 R14: 00007fe0fda25fa0 R15: 00007ffc5d22c308 [ 121.319947][ T8331] [ 121.480891][ T8345] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 121.664629][ T8358] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 121.758432][ T8363] syzkaller0: entered promiscuous mode [ 121.758447][ T8363] syzkaller0: entered allmulticast mode [ 122.050158][ T8368] FAULT_INJECTION: forcing a failure. [ 122.050158][ T8368] name failslab, interval 1, probability 0, space 0, times 0 [ 122.050191][ T8368] CPU: 1 UID: 0 PID: 8368 Comm: syz.2.769 Tainted: G L syzkaller #0 PREEMPT(full) [ 122.050217][ T8368] Tainted: [L]=SOFTLOCKUP [ 122.050222][ T8368] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 122.050231][ T8368] Call Trace: [ 122.050237][ T8368] [ 122.050245][ T8368] dump_stack_lvl+0x100/0x190 [ 122.050275][ T8368] should_fail_ex.cold+0x5/0xa [ 122.050300][ T8368] should_failslab+0xc2/0x120 [ 122.050326][ T8368] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 122.050349][ T8368] ? __d_alloc+0x35/0xa50 [ 122.050379][ T8368] __d_alloc+0x35/0xa50 [ 122.050406][ T8368] d_alloc_pseudo+0x1c/0xc0 [ 122.050427][ T8368] alloc_file_pseudo+0x118/0x290 [ 122.050452][ T8368] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 122.050486][ T8368] __shmem_file_setup+0x205/0x460 [ 122.050510][ T8368] ? __pfx___shmem_file_setup+0x10/0x10 [ 122.050536][ T8368] ? vm_area_alloc+0x1f/0x160 [ 122.050564][ T8368] shmem_zero_setup+0x96/0x1b0 [ 122.050584][ T8368] __mmap_region+0x26b6/0x32e0 [ 122.050606][ T8368] ? __pfx___mmap_region+0x10/0x10 [ 122.050646][ T8368] ? lockdep_hardirqs_on+0x7d/0x110 [ 122.050666][ T8368] ? process_measurement+0x10d0/0x2350 [ 122.050714][ T8368] ? lock_acquire+0x1d1/0x380 [ 122.050779][ T8368] mmap_region+0x3db/0x6d0 [ 122.050800][ T8368] ? __pfx_mmap_region+0x10/0x10 [ 122.050820][ T8368] ? shmem_get_unmapped_area+0x141/0x960 [ 122.050846][ T8368] ? selinux_mmap_addr+0x2b/0x110 [ 122.050865][ T8368] ? bpf_lsm_mmap_addr+0x9/0x30 [ 122.050888][ T8368] ? security_mmap_addr+0x71/0x1e0 [ 122.050912][ T8368] ? __get_unmapped_area+0x255/0x3e0 [ 122.050938][ T8368] do_mmap+0x12c7/0x1c30 [ 122.050965][ T8368] ? lock_acquire+0x1d1/0x380 [ 122.050985][ T8368] ? __pfx_do_mmap+0x10/0x10 [ 122.051016][ T8368] ? __pfx_down_write_killable+0x10/0x10 [ 122.051037][ T8368] ? find_held_lock+0x2b/0x80 [ 122.051066][ T8368] vm_mmap_pgoff+0x28d/0x470 [ 122.051091][ T8368] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 122.051111][ T8368] ? lock_acquire+0x1d1/0x380 [ 122.051133][ T8368] ? __mutex_unlock_slowpath+0x35d/0x930 [ 122.051159][ T8368] ksys_mmap_pgoff+0xe4/0x610 [ 122.051184][ T8368] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 122.051205][ T8368] ? fput+0x7c/0x100 [ 122.051228][ T8368] ? ksys_write+0x1ac/0x250 [ 122.051246][ T8368] ? __pfx_ksys_write+0x10/0x10 [ 122.051269][ T8368] __x64_sys_mmap+0x125/0x190 [ 122.051292][ T8368] do_syscall_64+0x123/0x790 [ 122.051313][ T8368] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.051332][ T8368] RIP: 0033:0x7f008a99e159 [ 122.051346][ T8368] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.051379][ T8368] RSP: 002b:00007f008b861028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 122.051397][ T8368] RAX: ffffffffffffffda RBX: 00007f008ac25fa0 RCX: 00007f008a99e159 [ 122.051408][ T8368] RDX: 0000000000000002 RSI: 0000000000fbe000 RDI: 0000200000000000 [ 122.051417][ T8368] RBP: 00007f008b861090 R08: ffffffffffffffff R09: 0000000001000000 [ 122.051430][ T8368] R10: 0000000000000031 R11: 0000000000000246 R12: 0000000000000001 [ 122.051439][ T8368] R13: 00007f008ac26038 R14: 00007f008ac25fa0 R15: 00007ffc9af588e8 [ 122.051463][ T8368] [ 122.194576][ T8379] syzkaller0: entered promiscuous mode [ 122.194594][ T8379] syzkaller0: entered allmulticast mode [ 122.311140][ T8386] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 122.405043][ T8399] netlink: 28 bytes leftover after parsing attributes in process `syz.1.780'. [ 122.571839][ T8407] netlink: 'syz.4.784': attribute type 10 has an invalid length. [ 122.617644][ T8410] FAULT_INJECTION: forcing a failure. [ 122.617644][ T8410] name failslab, interval 1, probability 0, space 0, times 0 [ 122.617675][ T8410] CPU: 1 UID: 0 PID: 8410 Comm: syz.2.785 Tainted: G L syzkaller #0 PREEMPT(full) [ 122.617696][ T8410] Tainted: [L]=SOFTLOCKUP [ 122.617700][ T8410] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 122.617706][ T8410] Call Trace: [ 122.617710][ T8410] [ 122.617715][ T8410] dump_stack_lvl+0x100/0x190 [ 122.617736][ T8410] should_fail_ex.cold+0x5/0xa [ 122.617752][ T8410] should_failslab+0xc2/0x120 [ 122.617768][ T8410] kmem_cache_alloc_noprof+0x92/0x6a0 [ 122.617782][ T8410] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 122.617802][ T8410] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 122.617823][ T8410] mmu_topup_memory_caches+0x25/0x170 [ 122.617837][ T8410] kvm_mmu_load+0xe8/0x2580 [ 122.617850][ T8410] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 122.617867][ T8410] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 122.617886][ T8410] ? __pfx_kvm_mmu_load+0x10/0x10 [ 122.617898][ T8410] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 122.617911][ T8410] ? kvm_check_and_inject_events+0x896/0x1050 [ 122.617926][ T8410] vcpu_run+0x419f/0x61a0 [ 122.617939][ T8410] ? vmx_vcpu_load_vmcs+0x21d/0x760 [ 122.617960][ T8410] ? __pfx_vcpu_run+0x10/0x10 [ 122.617975][ T8410] ? lock_acquire+0x1d1/0x380 [ 122.617988][ T8410] ? kvm_arch_vcpu_ioctl_run+0x2e9/0x1dd0 [ 122.618004][ T8410] ? fpu_swap_kvm_fpstate+0x217/0x460 [ 122.618019][ T8410] ? __local_bh_enable_ip+0xa5/0x120 [ 122.618033][ T8410] ? kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 122.618047][ T8410] kvm_arch_vcpu_ioctl_run+0xf8a/0x1dd0 [ 122.618065][ T8410] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 122.618078][ T8410] ? lock_acquire+0x1d1/0x380 [ 122.618091][ T8410] ? do_raw_write_lock+0x11e/0x260 [ 122.618106][ T8410] ? find_held_lock+0x2b/0x80 [ 122.618122][ T8410] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 122.618137][ T8410] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 122.618156][ T8410] kvm_vcpu_ioctl+0x730/0x1700 [ 122.618173][ T8410] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 122.618190][ T8410] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 122.618206][ T8410] ? do_vfs_ioctl+0x226/0x13e0 [ 122.618219][ T8410] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 122.618231][ T8410] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 122.618248][ T8410] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 122.618265][ T8410] ? __fget_files+0x34/0x3d0 [ 122.618286][ T8410] ? selinux_file_ioctl+0x13b/0x290 [ 122.618300][ T8410] ? selinux_file_ioctl+0xb6/0x290 [ 122.618315][ T8410] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 122.618331][ T8410] __x64_sys_ioctl+0x18e/0x210 [ 122.618345][ T8410] do_syscall_64+0x123/0x790 [ 122.618358][ T8410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.618370][ T8410] RIP: 0033:0x7f008a99e159 [ 122.618379][ T8410] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.618390][ T8410] RSP: 002b:00007f008b861028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 122.618401][ T8410] RAX: ffffffffffffffda RBX: 00007f008ac25fa0 RCX: 00007f008a99e159 [ 122.618408][ T8410] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000a [ 122.618415][ T8410] RBP: 00007f008b861090 R08: 0000000000000000 R09: 0000000000000000 [ 122.618421][ T8410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 122.618428][ T8410] R13: 00007f008ac26038 R14: 00007f008ac25fa0 R15: 00007ffc9af588e8 [ 122.618441][ T8410] [ 122.923540][ T8430] netlink: 16 bytes leftover after parsing attributes in process `syz.2.788'. [ 123.238775][ T30] usb 9-1: new low-speed USB device number 3 using dummy_hcd [ 123.306254][ T5740] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 123.409907][ T30] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 123.410979][ T30] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 123.411015][ T30] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 123.411036][ T30] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 123.411056][ T30] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 123.414706][ T30] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 123.414742][ T30] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 123.414762][ T30] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 123.414788][ T30] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 123.416008][ T30] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 123.416036][ T30] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 123.416052][ T30] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 123.416067][ T30] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 123.506624][ T8439] ip6erspan0: entered allmulticast mode [ 123.510019][ T8439] program syz.1.791 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 124.024815][ T8447] netlink: 16 bytes leftover after parsing attributes in process `syz.2.795'. [ 124.192028][ T43] kauditd_printk_skb: 66 callbacks suppressed [ 124.192042][ T43] audit: type=1400 audit(1791126766.164:1244): avc: denied { write } for pid=8460 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 124.269703][ T43] audit: type=1400 audit(1791126766.239:1245): avc: denied { write } for pid=8466 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 124.336068][ T43] audit: type=1400 audit(1791126766.295:1246): avc: denied { write } for pid=8470 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 124.362157][ T5731] svc: failed to register nfsdv3 RPC service (errno 111). [ 124.363168][ T5731] svc: failed to register nfsaclv3 RPC service (errno 111). [ 124.363180][ T5731] failed to unregister udp with rpcbind [ 124.363256][ T5731] svc: failed to register nfsdv3 RPC service (errno 97). [ 124.363265][ T5731] svc: failed to register nfsaclv3 RPC service (errno 97). [ 124.363272][ T5731] failed to unregister udp with rpcbind [ 124.399961][ T43] audit: type=1326 audit(1791126766.351:1247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8474 comm="syz.0.799" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd92c19e159 code=0x0 [ 124.402698][ T43] audit: type=1400 audit(1791126766.360:1248): avc: denied { write } for pid=8473 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 124.488155][ T851] usb 7-1: new low-speed USB device number 21 using dummy_hcd [ 124.488641][ T43] audit: type=1400 audit(1791126766.445:1249): avc: denied { write } for pid=8477 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 124.556759][ T43] audit: type=1400 audit(1791126766.501:1250): avc: denied { write } for pid=8481 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 124.659578][ T851] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 124.662190][ T851] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 124.662216][ T851] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 124.662229][ T851] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 124.662242][ T851] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 124.662254][ T851] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 124.663263][ T851] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 124.663284][ T851] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 124.663297][ T851] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 124.663309][ T851] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 124.663321][ T851] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 124.664193][ T851] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 124.664220][ T851] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 124.664232][ T851] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 124.664244][ T851] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 124.664256][ T851] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 124.666977][ T851] usb 7-1: string descriptor 0 read error: -22 [ 124.667077][ T851] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.671028][ T43] audit: type=1800 audit(1791126766.613:1251): pid=8101 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=144768 res=0 errno=0 [ 124.672408][ T43] audit: type=1800 audit(1791126766.613:1252): pid=8101 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=144797 res=0 errno=0 [ 124.673489][ T43] audit: type=1800 audit(1791126766.613:1253): pid=8101 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=144775 res=0 errno=0 [ 124.681286][ T851] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 124.841353][ T1349] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 125.002652][ T1349] usb 6-1: New USB device found, idVendor=1bc7, idProduct=10c4, bcdDevice=2d.44 [ 125.003572][ T1349] usb 6-1: config 0 has an invalid interface number: 175 but max is 1 [ 125.003588][ T1349] usb 6-1: config 0 has an invalid interface number: 253 but max is 1 [ 125.003598][ T1349] usb 6-1: config 0 has no interface number 0 [ 125.003605][ T1349] usb 6-1: config 0 has no interface number 1 [ 125.003680][ T1349] usb 6-1: config 0 interface 175 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 125.003693][ T1349] usb 6-1: config 0 interface 175 altsetting 0 bulk endpoint 0xC has invalid maxpacket 16 [ 125.003710][ T1349] usb 6-1: config 0 interface 253 altsetting 156 endpoint 0xB has invalid wMaxPacketSize 0 [ 125.003721][ T1349] usb 6-1: config 0 interface 253 altsetting 156 endpoint 0x4 has invalid maxpacket 512, setting to 64 [ 125.003734][ T1349] usb 6-1: config 0 interface 253 altsetting 156 has an invalid endpoint descriptor of length 2, skipping [ 125.003745][ T1349] usb 6-1: config 0 interface 253 altsetting 156 endpoint 0x5 has invalid maxpacket 1040, setting to 1024 [ 125.003764][ T1349] usb 6-1: config 0 interface 253 altsetting 156 bulk endpoint 0x5 has invalid maxpacket 1024 [ 125.003775][ T1349] usb 6-1: config 0 interface 253 altsetting 156 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 125.003837][ T1349] usb 6-1: config 0 interface 253 has no altsetting 0 [ 125.005814][ T1349] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.005828][ T1349] usb 6-1: Product: ÑŒ [ 125.005835][ T1349] usb 6-1: Manufacturer: Љ [ 125.005843][ T1349] usb 6-1: SerialNumber: ÑŒ [ 125.008690][ T1349] usb 6-1: config 0 descriptor?? [ 125.011474][ T8484] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 125.237031][ T1349] option 6-1:0.175: GSM modem (1-port) converter detected [ 125.254840][ T1349] usb 6-1: USB disconnect, device number 18 [ 125.258646][ T1349] option 6-1:0.175: device disconnected [ 125.496275][ T8492] syzkaller0: entered promiscuous mode [ 125.496295][ T8492] syzkaller0: entered allmulticast mode [ 125.500651][ T8492] tipc: Started in network mode [ 125.500673][ T8492] tipc: Node identity e6f93ca09836, cluster identity 4711 [ 125.500819][ T8492] tipc: Enabled bearer , priority 0 [ 125.843542][ T8499] kvm: apic: phys broadcast and lowest prio [ 126.123676][ T30] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.131294][ T30] usb 9-1: can't set config #168, error -71 [ 126.134200][ T30] usb 9-1: USB disconnect, device number 3 [ 126.266610][ T8504] netlink: 28 bytes leftover after parsing attributes in process `syz.1.804'. [ 126.326961][ T226] Bluetooth: hci5: Frame reassembly failed (-84) [ 126.373892][ T8491] tipc: Resetting bearer [ 126.393004][ T8491] tipc: Disabling bearer [ 126.780452][ T5731] svc: failed to register nfsdv3 RPC service (errno 111). [ 126.781492][ T5731] svc: failed to register nfsaclv3 RPC service (errno 111). [ 126.781507][ T5731] failed to unregister udp with rpcbind [ 126.781642][ T5731] svc: failed to register nfsdv3 RPC service (errno 97). [ 126.781655][ T5731] svc: failed to register nfsaclv3 RPC service (errno 97). [ 126.781664][ T5731] failed to unregister udp with rpcbind [ 126.824658][ T8528] [ 126.825669][ T8528] ====================================================== [ 126.828831][ T8528] WARNING: possible circular locking dependency detected [ 126.831039][ T8528] syzkaller #0 Tainted: G L SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 126.833598][ T8528] ------------------------------------------------------ [ 126.836045][ T8528] syz.0.811/8528 is trying to acquire lock: [ 126.838139][ T8528] ffffffff903fec68 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_streaming_header_allow_link+0x7c/0x650 [ 126.842430][ T8528] [ 126.842430][ T8528] but task is already holding lock: [ 126.844993][ T8528] ffff888055fac3c0 (&sb->s_type->i_mutex_key#25){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 126.848681][ T8528] [ 126.848681][ T8528] which lock already depends on the new lock. [ 126.848681][ T8528] [ 126.852473][ T8528] [ 126.852473][ T8528] the existing dependency chain (in reverse order) is: [ 126.855528][ T8528] [ 126.855528][ T8528] -> #3 (&sb->s_type->i_mutex_key#25){++++}-{4:4}: [ 126.858694][ T8528] lock_acquire+0x1d1/0x380 [ 126.860461][ T8528] down_write+0x8b/0x1f0 [ 126.862456][ T8528] configfs_depend_item_unlocked+0xf3/0x6a0 [ 126.864536][ T8528] usbg_make_tpg+0x251/0x610 [ 126.866302][ T8528] target_fabric_make_tpg+0xab/0x8c0 [ 126.868598][ T8528] configfs_mkdir+0x525/0xd40 [ 126.870276][ T8528] vfs_mkdir+0x364/0x850 [ 126.872169][ T8528] filename_mkdirat+0x48b/0x5e0 [ 126.874208][ T8528] __x64_sys_mkdirat+0x89/0xc0 [ 126.875865][ T8528] do_syscall_64+0x123/0x790 [ 126.877876][ T8528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.880159][ T8528] [ 126.880159][ T8528] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 126.882984][ T8528] lock_acquire+0x1d1/0x380 [ 126.884905][ T8528] __mutex_lock+0x1a4/0x1bd0 [ 126.886515][ T8528] tcm_alloc_inst+0x5f/0x1e0 [ 126.888569][ T8528] try_get_usb_function_instance+0x136/0x1f0 [ 126.890925][ T8528] usb_get_function_instance+0x16/0x70 [ 126.892946][ T8528] function_make+0x18c/0x3f0 [ 126.895049][ T8528] configfs_mkdir+0x525/0xd40 [ 126.896794][ T8528] vfs_mkdir+0x364/0x850 [ 126.898429][ T8528] filename_mkdirat+0x48b/0x5e0 [ 126.900650][ T8528] __x64_sys_mkdirat+0x89/0xc0 [ 126.902575][ T8528] do_syscall_64+0x123/0x790 [ 126.904184][ T8528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.906810][ T8528] [ 126.906810][ T8528] -> #1 (func_lock){+.+.}-{4:4}: [ 126.909300][ T8528] lock_acquire+0x1d1/0x380 [ 126.911093][ T8528] __mutex_lock+0x1a4/0x1bd0 [ 126.913145][ T8528] try_get_usb_function_instance+0x26/0x1f0 [ 126.915195][ T8528] usb_get_function_instance+0x16/0x70 [ 126.917298][ T8528] function_make+0x18c/0x3f0 [ 126.919247][ T8528] configfs_mkdir+0x525/0xd40 [ 126.920839][ T8528] vfs_mkdir+0x364/0x850 [ 126.922669][ T8528] filename_mkdirat+0x48b/0x5e0 [ 126.924765][ T8528] __x64_sys_mkdirat+0x89/0xc0 [ 126.926433][ T8528] do_syscall_64+0x123/0x790 [ 126.928411][ T8528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.930821][ T8528] [ 126.930821][ T8528] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 126.933491][ T8528] check_prev_add+0xeb/0xe60 [ 126.935527][ T8528] __lock_acquire+0x1528/0x1f40 [ 126.937161][ T8528] lock_acquire+0x1d1/0x380 [ 126.938985][ T8528] __mutex_lock+0x1a4/0x1bd0 [ 126.940995][ T8528] uvcg_streaming_header_allow_link+0x7c/0x650 [ 126.943136][ T8528] configfs_symlink+0x695/0x1340 [ 126.945099][ T8528] vfs_symlink+0x178/0x4d0 [ 126.946982][ T8528] filename_symlinkat+0x2a6/0x560 [ 126.948797][ T8528] __x64_sys_symlinkat+0x9c/0xe0 [ 126.950908][ T8528] do_syscall_64+0x123/0x790 [ 126.952717][ T8528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.954794][ T8528] [ 126.954794][ T8528] other info that might help us debug this: [ 126.954794][ T8528] [ 126.958479][ T8528] Chain exists of: [ 126.958479][ T8528] gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#25 [ 126.958479][ T8528] [ 126.963946][ T8528] Possible unsafe locking scenario: [ 126.963946][ T8528] [ 126.966475][ T8528] CPU0 CPU1 [ 126.968715][ T8528] ---- ---- [ 126.970784][ T8528] lock(&sb->s_type->i_mutex_key#25); [ 126.973090][ T8528] lock(tpg_instances_lock); [ 126.975960][ T8528] lock(&sb->s_type->i_mutex_key#25); [ 126.979239][ T8528] lock(gadget_subsys.su_mutex); [ 126.981273][ T8528] [ 126.981273][ T8528] *** DEADLOCK *** [ 126.981273][ T8528] [ 126.984425][ T8528] locks held by syz.0.811/8528: 2, last CPU#0: [ 126.986999][ T8528] #0: ffff88802426a460 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 126.990951][ T8528] #1: ffff888055fac3c0 (&sb->s_type->i_mutex_key#25){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 126.995475][ T8528] [ 126.995475][ T8528] stack backtrace: [ 126.997949][ T8528] CPU: 0 UID: 0 PID: 8528 Comm: syz.0.811 Tainted: G L syzkaller #0 PREEMPT(full) [ 127.002370][ T8528] Tainted: [L]=SOFTLOCKUP [ 127.004123][ T8528] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 127.007280][ T8528] Call Trace: [ 127.008400][ T8528] [ 127.009300][ T8528] dump_stack_lvl+0x100/0x190 [ 127.010754][ T8528] print_circular_bug.cold+0x178/0x1be [ 127.012383][ T8528] check_noncircular+0x146/0x160 [ 127.013919][ T8528] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 127.016049][ T8528] check_prev_add+0xeb/0xe60 [ 127.017551][ T8528] __lock_acquire+0x1528/0x1f40 [ 127.019143][ T8528] lock_acquire+0x1d1/0x380 [ 127.020586][ T8528] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 127.022602][ T8528] ? __pfx___might_resched+0x10/0x10 [ 127.024262][ T8528] ? audit_inode_permission+0x1ea/0x2a0 [ 127.026086][ T8528] __mutex_lock+0x1a4/0x1bd0 [ 127.027551][ T8528] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 127.029588][ T8528] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 127.031707][ T8528] ? __lock_acquire+0xe8b/0x1f40 [ 127.033765][ T8528] ? __pfx___mutex_lock+0x10/0x10 [ 127.035776][ T8528] ? selinux_inode_permission+0x14a/0x1130 [ 127.038194][ T8528] ? __pfx___might_resched+0x10/0x10 [ 127.039853][ T8528] ? make_vfsgid+0xf1/0x140 [ 127.041279][ T8528] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 127.043275][ T8528] ? security_inode_permission+0xbf/0x250 [ 127.045069][ T8528] uvcg_streaming_header_allow_link+0x7c/0x650 [ 127.047104][ T8528] ? inode_permission+0x374/0x620 [ 127.049071][ T8528] ? mntput_no_expire+0xe7/0x220 [ 127.051206][ T8528] configfs_symlink+0x695/0x1340 [ 127.053290][ T8528] ? __pfx_configfs_symlink+0x10/0x10 [ 127.055552][ T8528] vfs_symlink+0x178/0x4d0 [ 127.057443][ T8528] filename_symlinkat+0x2a6/0x560 [ 127.059565][ T8528] ? __pfx_filename_symlinkat+0x10/0x10 [ 127.061902][ T8528] ? strncpy_from_user+0x19d/0x2d0 [ 127.063969][ T8528] ? do_getname+0x191/0x390 [ 127.065413][ T30] usb 7-1: USB disconnect, device number 21 [ 127.068207][ T8528] __x64_sys_symlinkat+0x9c/0xe0 [ 127.070252][ T8528] do_syscall_64+0x123/0x790 [ 127.072223][ T8528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.074736][ T8528] RIP: 0033:0x7fd92c19e159 [ 127.076558][ T8528] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 127.084343][ T8528] RSP: 002b:00007fd92d02a028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 127.087845][ T8528] RAX: ffffffffffffffda RBX: 00007fd92c425fa0 RCX: 00007fd92c19e159 [ 127.091156][ T8528] RDX: 0000200000001600 RSI: ffffffffffffff9c RDI: 0000200000001500 [ 127.094436][ T8528] RBP: 00007fd92c23506b R08: 0000000000000000 R09: 0000000000000000 [ 127.097715][ T8528] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.101025][ T8528] R13: 00007fd92c426038 R14: 00007fd92c425fa0 R15: 00007fff0a6f7048 [ 127.104375][ T8528] [ 127.210383][ T7621] batman_adv: batadv0: Interface deactivated: syz_tun [ 127.219924][ T7621] batman_adv: batadv0: Removing interface: syz_tun [ 127.250210][ T8528] batman_adv: batadv0: Interface deactivated: syz_tun [ 127.250228][ T8528] batadv0: mtu less than device minimum [ 127.250453][ T8528] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 127.250668][ T8528] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 127.250881][ T8528] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 127.251098][ T8528] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 127.251313][ T8528] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 127.251527][ T8528] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 127.251742][ T8528] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 127.251964][ T8528] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 127.252176][ T8528] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 127.269273][ T8528] batman_adv: batadv0: Removing interface: syz_tun [ 127.270686][ T1272] smbdirect: ib_dev[©÷Å] removed [ 127.288871][ T30] infiniband ©÷Å: ib_query_port failed (-19) [ 127.302791][ T8464] bridge0: port 3(syz_tun) entered disabled state [ 127.307301][ T8464] syz_tun (unregistering): left allmulticast mode [ 127.307316][ T8464] syz_tun (unregistering): left promiscuous mode [ 127.307344][ T8464] bridge0: port 3(syz_tun) entered disabled state [ 127.396892][ T5586] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 127.398337][ T5586] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 127.399710][ T5586] bond0 (unregistering): (slave team0): Releasing backup interface [ 127.400668][ T5586] bond0 (unregistering): Released all slaves [ 127.402646][ T5586] bond1 (unregistering): Released all slaves [ 127.467818][ T5586] tipc: Left network mode [ 127.611410][ T5586] hsr_slave_0: left promiscuous mode [ 127.611768][ T5586] hsr_slave_1: left promiscuous mode [ 127.612207][ T5586] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 127.620489][ T5586] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 127.621373][ T5586] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 127.629579][ T5586] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 127.630026][ T5586] batman_adv: batadv0: Interface deactivated: dummy0 [ 127.630038][ T5586] batman_adv: batadv0: Removing interface: dummy0 [ 127.632063][ T5586] veth1_macvtap: left promiscuous mode [ 127.632091][ T5586] veth0_macvtap: left promiscuous mode [ 127.632141][ T5586] veth1_vlan: left promiscuous mode [ 127.632184][ T5586] veth0_vlan: left promiscuous mode [ 127.744085][ T5586] team0 (unregistering): Port device team_slave_1 removed [ 127.753222][ T5586] team0 (unregistering): Port device team_slave_0 removed [ 128.208508][ T5586] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.272609][ T5586] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.326589][ T5586] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.380777][ T5586] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.462756][ T5586] bridge_slave_1: left allmulticast mode [ 128.462773][ T5586] bridge_slave_1: left promiscuous mode [ 128.462850][ T5586] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.464466][ T5586] bridge_slave_0: left allmulticast mode [ 128.464484][ T5586] bridge_slave_0: left promiscuous mode [ 128.464605][ T5586] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.502381][ T5586] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 128.503403][ T5586] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 128.505852][ T5586] bond0 (unregistering): Released all slaves [ 128.514714][ T5740] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 128.619393][ T5445] 8021q: adding VLAN 0 to HW filter on device eth2 [ 128.716964][ T5445] 8021q: adding VLAN 0 to HW filter on device eth3 [ 128.786923][ T5586] hsr_slave_0: left promiscuous mode [ 128.787275][ T5586] hsr_slave_1: left promiscuous mode [ 128.787487][ T5586] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.787497][ T5586] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 128.787786][ T5586] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 128.787795][ T5586] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 128.789772][ T5586] veth1_macvtap: left promiscuous mode [ 128.789786][ T5586] veth0_macvtap: left promiscuous mode [ 128.789814][ T5586] veth1_vlan: left promiscuous mode [ 128.789834][ T5586] veth0_vlan: left promiscuous mode [ 128.870584][ T5586] team0 (unregistering): Port device team_slave_1 removed [ 128.873876][ T5586] team0 (unregistering): Port device team_slave_0 removed [ 128.904978][ T5445] 8021q: adding VLAN 0 to HW filter on device eth4 [ 129.041062][ T5445] 8021q: adding VLAN 0 to HW filter on device eth5 [ 129.136945][ T5586] IPVS: stop unused estimator thread 0... [ 129.191098][ T5586] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 129.191122][ T5586] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.287047][ T5586] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 129.287068][ T5586] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.404075][ T5586] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 129.404096][ T5586] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.457910][ T5586] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 129.457931][ T5586] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.608250][ T5586] bond0 (unregistering): Released all slaves [ 129.609548][ T5586] bond1 (unregistering): Released all slaves [ 129.647175][ T43] kauditd_printk_skb: 74 callbacks suppressed [ 129.647190][ T43] audit: type=1400 audit(1791126771.276:1328): avc: denied { write } for pid=8558 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.677397][ T43] audit: type=1400 audit(1791126771.295:1329): avc: denied { write } for pid=8561 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.709525][ T5445] 8021q: adding VLAN 0 to HW filter on device eth6 [ 129.773112][ T43] audit: type=1400 audit(1791126771.388:1330): avc: denied { write } for pid=8564 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.811229][ T43] audit: type=1800 audit(1791126771.426:1331): pid=5143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=111478 res=0 errno=0 [ 129.815124][ T43] audit: type=1400 audit(1791126771.426:1332): avc: denied { write } for pid=8567 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.836138][ T5445] 8021q: adding VLAN 0 to HW filter on device eth7 [ 129.884293][ T43] audit: type=1400 audit(1791126771.491:1333): avc: denied { write } for pid=8570 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.921276][ T43] audit: type=1400 audit(1791126771.529:1334): avc: denied { write } for pid=8573 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.952594][ T5445] 8021q: adding VLAN 0 to HW filter on device eth8 [ 129.954345][ T5586] hsr_slave_0: left promiscuous mode [ 129.954599][ T5586] hsr_slave_1: left promiscuous mode [ 129.956131][ T5586] veth1_macvtap: left promiscuous mode [ 129.956154][ T5586] veth0_macvtap: left promiscuous mode [ 129.956205][ T5586] veth1_vlan: left promiscuous mode [ 129.956244][ T5586] veth0_vlan: left promiscuous mode [ 129.995783][ T5586] smc: removing net device veth1_macvtap with user defined pnetid SYZ2 [ 130.170290][ T43] audit: type=1400 audit(1791126771.753:1335): avc: denied { write } for pid=8577 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.213287][ T43] audit: type=1400 audit(1791126771.791:1336): avc: denied { write } for pid=8580 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.247993][ T5445] 8021q: adding VLAN 0 to HW filter on device eth9 [ 130.279710][ T5586] IPVS: stop unused estimator thread 0...