last executing test programs: 3.139042021s ago: executing program 2 (id=15): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x2c0, 0x0, 0x70, 0xe0, 0x150, 0x1c8, 0x238, 0x238, 0x238, 0x238, 0x238, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@inet=@tcp={{0x30}, {[0x0, 0xffff], [0x0, 0xffff], 0x0, 0x2, 0x2}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x400) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind(r1, &(0x7f0000000100)=@in={0x2, 0x1234, @loopback}, 0x10) listen(r1, 0x5) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f0000000200)={0x2, 0x1234, @loopback}, 0x10) 3.138872886s ago: executing program 2 (id=16): r0 = socket$tipc(0x1e, 0x5, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) sendmsg$tipc(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)='\x00\x00\x00\x00', 0x8}], 0x1}, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) connect$tipc(r1, &(0x7f0000000020)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) sendmsg$tipc(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000110)=[{&(0x7f0000000190)='\x00\x00\x00\x00', 0x8}], 0x1}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) 2.970023496s ago: executing program 2 (id=17): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x0, 0x0, [], 0x0, 0x0, 0x0}, 0x0) 2.969830546s ago: executing program 2 (id=18): r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000000)='bridge0\x00') r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000020), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syz_tun\x00', 0x2}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'bridge0\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'syz_tun\x00', 0x1}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={&(0x7f00000000e0), 0xc, &(0x7f0000000120)={&(0x7f0000000140)=@setlink={0x28, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_MASTER={0x8, 0xa, r2}]}, 0x28}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={&(0x7f00000000e0), 0xc, &(0x7f0000000220)={&(0x7f0000000240)=@setlink={0x3c, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x0, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x0, [@IFLA_BR_STP_STATE={0x8, 0x5, 0x1}]}}}]}, 0x3c}}, 0x0) nanosleep(&(0x7f0000000300)={0x1, 0x1dcd6500}, 0x0) 2.088334057s ago: executing program 2 (id=26): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in6=@local, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {@in6=@remote, 0x1234, 0x6c}, @in6=@local, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000300)={'ip6_vti0\x00'}) syz_emit_ethernet(0x6e, &(0x7f0000000340)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0x40, @remote, @local, {[], @dest_unreach={0x1, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, '\x00', 0x20, 0x6c, 0x40, @local, @remote, [], "0000123400000000"}}}}}}}, 0x0) 2.087768911s ago: executing program 2 (id=28): syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040b906614000000102000109021b0002010080300904000000ff0000000904010000ff000000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = socket(0x8, 0x2, 0x0) ioctl(r0, 0x400861f2, &(0x7f0000000000)="6e61733000000000000000000000000000000000dc050000") setsockopt(r0, 0x108, 0x1, &(0x7f0000000100)="000000000000000000000000000200000002000000000000000000000000000000000000000000000002000000020000000000000000000000000500000000000000", 0x40) connect(r0, &(0x7f0000000200)=@generic={0x8, "0000000001002000"}, 0x10) ioctl(r0, 0x400461f1, &(0x7f0000000300)="010000006e61733000"/28) 2.087618223s ago: executing program 0 (id=29): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000040)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x12}, 0x10) listen(r0, 0xa) syz_emit_ethernet(0x11, &(0x7f0000000100)={@local, @remote, @void, {@llc={0x4, {@llc={0x12, 0x20, 'o'}}}}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) r1 = accept4$llc(r0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x12, &(0x7f0000000400)={@local, @remote, @void, {@llc={0x4, {@llc={0x12, 0x21, "0101"}}}}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) recvfrom$llc(r1, &(0x7f0000000500), 0x100, 0x1, 0x0, 0x0) getsockopt$llc_int(r1, 0x1a, 0x1, &(0x7f0000000600), &(0x7f0000000700)=0x4) 1.789581722s ago: executing program 3 (id=36): r0 = socket$inet6(0xa, 0x3, 0xff) socket$inet6(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x45, &(0x7f0000000000)=0x2, 0x4) syz_emit_ethernet(0x40, &(0x7f0000000040)={@local, @empty, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00', 0xa, 0xff, 0xff, @remote, @empty, {[], "00112233445566778899"}}}}}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x2faf080}, 0x0) recvfrom$inet6(r0, &(0x7f0000000200)=""/10, 0x1, 0x20, 0x0, 0x0) 1.190230349s ago: executing program 0 (id=40): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='proc\x00', &(0x7f0000000300)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./proc/sys/net/ipv4/ip_forward\x00', 0x1, 0x0) write(r0, &(0x7f0000000600)='1\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./proc/sys/net/ipv4/conf/all/forwarding\x00', 0x1, 0x0) write(r1, &(0x7f0000000800)='1\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./proc/sys/net/ipv4/conf/all/rp_filter\x00', 0x1, 0x0) write(r2, &(0x7f0000000a00)='0\n', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./proc/sys/net/ipv4/conf/syz_tun/rp_filter\x00', 0x1, 0x0) write(r3, &(0x7f0000000c00)='0\n', 0x2) close(r3) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ifreq(r4, 0x8922, &(0x7f0000000d00)={'syz_tun\x00', @ifru_mtu=0xf4}) ioctl$sock_inet_SIOCADDRT(r4, 0x890b, &(0x7f0000000e00)={0x0, {0x2, 0x0, @local}, {0x2, 0x0, @empty}, {0x2, 0x0, @broadcast}, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)='syz_tun\x00'}) syz_emit_ethernet(0x34, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x26, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x12, 0x0, @opaque='\x00'/10}}}}}, 0x0) 1.190002583s ago: executing program 0 (id=41): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)=@newpolicy={0x0, 0x13, 0x5, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x0, 0x1, [{{@in=@loopback, 0x1234, 0x32}, 0x2, @in=@loopback, 0x1}]}]}}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000400)={&(0x7f0000000500), 0xc, &(0x7f0000000600)={&(0x7f0000000700)=@newsa={0x0, 0x10, 0x5, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in=@loopback, 0x1234, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x1, 0x2}, [@algo_crypt={0x0, 0x2, {{'digest_null\x00'}}}]}}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000800)={&(0x7f0000000900), 0xc, &(0x7f0000000a00)={&(0x7f0000000b00)={{0x0, 0xa0a, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x0, 0x0, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x0, 0x0, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x0, 0x3, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x0, 0x0, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x0, 0x0, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x0, 0x0, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x0, 0x0, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x0, 0x0}]}, @NFTA_CHAIN_TYPE={0x0, 0x0, 'filter\x00'}]}, @NFT_MSG_NEWRULE={0x0, 0x6, 0xa, 0x1, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x0, 0x0, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x0, 0x0, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x0, 0x0, 0x0, 0x1, [{0x0, 0x0, 0x0, 0x1, @match={{0x0, 0x0}, @val={0x0, 0x0, 0x0, 0x1, [@NFTA_MATCH_NAME={0x0, 0x0, 'policy\x00'}, @NFTA_MATCH_REV={0x0, 0x0}, @NFTA_MATCH_INFO={0x0, 0x0, "000000000000000000000000000000000000000000000000000000000000000000000000000000000200010000000000"}]}}}]}]}], {0x0, 0xa0b, 0x1, 0x0, 0x0, {0x2}}}}}, 0x0) r2 = socket$inet(0x2, 0x2, 0x0) sendto$inet(r2, &(0x7f0000000c00)='\x00', 0x1, 0x0, &(0x7f0000000d00)={0x2, 0x1234, @loopback}, 0x10) 1.110164844s ago: executing program 0 (id=42): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x2}, 0x10) listen(r0, 0x5) syz_emit_ethernet(0x11, &(0x7f0000000040)={@local, @empty, @void, {@llc={0x4, {@llc={0x2, 0x2, 'o'}}}}}, 0x0) r1 = accept4$llc(r0, 0x0, 0x0, 0x800) getpeername$llc(r1, &(0x7f0000000100), &(0x7f0000000140)=0x10) 929.333229ms ago: executing program 3 (id=43): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6}]}, 0x10) listen(r0, 0x1) r1 = socket$inet_tcp(0x2, 0x801, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000040)={0x2}, 0x10) sendto$inet(r1, &(0x7f0000000900)="2e552f5d9f", 0x5, 0x0, 0x0, 0x0) shutdown(r1, 0x2) 929.156091ms ago: executing program 3 (id=44): r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={@private0, 0x40, 0x1}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @private0}, 0x1c) listen(r1, 0x5) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e23, 0x0, @private0}, 0x1c) connect$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @private0}, 0x1c) r3 = accept4$inet6(r1, 0x0, 0x0, 0x0) close(r2) close(r3) close(r1) 880.040887ms ago: executing program 3 (id=45): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="44000000100001060000000000000000000000000000000000000000000000000f00030073797a6b616c6c6572300000140012000d00010076736f636b6d6f6e00000000"], 0x44}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="30000000100001000000000000000000000000000000000001000000010000000f00030073797a6b616c6c6572300000"], 0x30}}, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'syzkaller0\x00', 0x0}) bind$packet(r1, &(0x7f0000000300)={0x11, 0x300, r2}, 0x14) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r3, &(0x7f0000000400)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r3, 0x5) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000500)={0x28, 0x0, 0x2710, @local}, 0x10) accept4(r3, 0x0, 0x0, 0x0) write(r4, &(0x7f0000000600)='hello vsockmon world! payload length > 0', 0x28) recvfrom$packet(r1, &(0x7f0000000700), 0x100, 0x40, 0x0, 0x0) 879.874127ms ago: executing program 3 (id=46): r0 = socket(0x2, 0x2, 0x0) setsockopt(r0, 0x0, 0x40, &(0x7f0000000100)="66696c74657200000000000000000000000000000000000000000000000000000e000000020000005801000000000000000000000000000000000000000000000000000000000000c0000000c0000000c000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009800c00000000000000000000000000000000000000000002800636f6e6e6c6162656c0000000000000000000000000000000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000ffffffff00000000", 0x1b8) sendto$inet(r0, &(0x7f0000000800)='hello\x00', 0x5, 0x0, &(0x7f0000000900)={0x2, 0x1234, @loopback}, 0x10) 809.607222ms ago: executing program 3 (id=47): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x1, 0x1, 0x1}, 0x10) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @remote, 0x1}, 0x1c) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) 259.793303ms ago: executing program 0 (id=49): r0 = socket$inet_sctp(0x2, 0x805, 0x84) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_sctp(0x2, 0x805, 0x84) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) sendto(r1, &(0x7f0000000100)='hello world', 0xb, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000200)={0x1}, &(0x7f0000000240)=0x8) 190.122603ms ago: executing program 1 (id=50): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x1, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x1, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xffffff6a}]}]}, @NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x1, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_SYNPROXY_MSS={0x6, 0x1, 0x1, 0x0, 0x5b4}, @NFTA_SYNPROXY_WSCALE={0x5, 0x2, 0x7}, @NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0xf}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xe8}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r1, &(0x7f0000000400)={0x2, 0x1f90, @loopback}, 0x10) connect$inet(r1, &(0x7f0000000500)={0x2, 0x1f90, @loopback}, 0x10) 189.843684ms ago: executing program 0 (id=51): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x334) r1 = socket(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2000000014000500000000000000000023000000020000000800010004000000"], 0x20}}, 0x0) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r3, &(0x7f0000000300)={0x23, 0x1, 0x4}, 0x10) listen(r3, 0x5) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r4, &(0x7f0000000400)={0x23, 0x1, 0x4}, 0x10) nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0) r5 = accept4$phonet_pipe(r3, 0x0, 0x0, 0x800) nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0) sendto$phonet(r4, &(0x7f0000000500)='hello', 0x5, 0x80, 0x0, 0x0) sendto$phonet(r5, &(0x7f0000000500)='hello', 0x5, 0x80, 0x0, 0x0) 189.690323ms ago: executing program 1 (id=52): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) fcntl$setstatus(r0, 0x4, 0x800) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x2, @broadcast}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x2, @random="fe5400000002"}, 0x10) syz_emit_ethernet(0x11, &(0x7f0000000200)={@broadcast, @random="fe5400000002", @void, {@generic={0x300, "020273"}}}, 0x0) sendto$llc(r0, &(0x7f0000000300)="12345678", 0x8, 0x0, 0x0, 0x0) syz_emit_ethernet(0x12, &(0x7f0000000400)={@broadcast, @random="fe5400000002", @void, {@generic={0x400, "02020900"}}}, 0x0) 98.494443ms ago: executing program 1 (id=53): r0 = socket(0x2, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000040)={0x0, 'lo\x00', {0x1}}) 98.348843ms ago: executing program 1 (id=54): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1002}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syz_tun\x00', 0x1}) write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000000000000000000000000600d0002032f"], 0x12) write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="000000000000000000000000600d000203ff"], 0x12) 176.345µs ago: executing program 1 (id=55): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @local}, 0x10) listen(r0, 0x5) r1 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r1, &(0x7f0000000020)={0x2, 0x4e20, @remote}, 0x10) syz_extract_tcp_res(&(0x7f0000000200)={0x0, 0x0}, 0x0, 0x0) syz_extract_tcp_res(&(0x7f0000000200)={0x0, 0x0}, 0x0, 0x0) syz_extract_tcp_res(&(0x7f0000000200)={0x0, 0x0}, 0x0, 0x0) syz_emit_ethernet(0x3c, &(0x7f0000000040)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x2e, 0x0, 0x0, 0x40, 0x6, 0x0, @remote, @local}, {{0x4e21, 0x4e20, r2, r3, 0x0, 0x0, 0x5, 0x18, 0x1000}, {"000600000000"}}}}}}, 0x0) 0s ago: executing program 1 (id=56): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1a85, @loopback}, 0x10) listen(r0, 0x5) r1 = fsopen(&(0x7f0000000100)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:6789:/\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async) r2 = accept$inet(r0, &(0x7f0000000200), &(0x7f0000000210)=0x10) nanosleep(&(0x7f0000000400)={0x0, 0x989680}, 0x0) write(r2, &(0x7f0000000300)='ceph v027\x00'/278, 0x119) nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0) write(r2, &(0x7f0000000800)="01ffffffffffffffff00"/27, 0x1a) nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0) write(r2, &(0x7f0000000c00)="070100000000000000000000000000000030000000000000000000000000000000000000000100000000000000000000000000000028d7b3ad00"/74, 0x48) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:3786' (ED25519) to the list of known hosts. [ 42.816022][ T42] kauditd_printk_skb: 20 callbacks suppressed [ 42.816033][ T42] audit: type=1400 audit(1785768224.703:141): avc: denied { mounton } for pid=5719 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 42.827504][ T42] audit: type=1400 audit(1785768224.713:142): avc: denied { mount } for pid=5719 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 42.831079][ T5719] cgroup: Unknown subsys name 'net' [ 42.837529][ T42] audit: type=1400 audit(1785768224.723:143): avc: denied { unmount } for pid=5719 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 43.011796][ T5719] cgroup: Unknown subsys name 'cpuset' [ 43.015730][ T5719] cgroup: Unknown subsys name 'rlimit' [ 43.161228][ T42] audit: type=1400 audit(1785768225.053:144): avc: denied { setattr } for pid=5719 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=850 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 43.169271][ T42] audit: type=1400 audit(1785768225.053:145): avc: denied { create } for pid=5719 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 43.175610][ T42] audit: type=1400 audit(1785768225.053:146): avc: denied { write } for pid=5719 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 43.182275][ T42] audit: type=1400 audit(1785768225.053:147): avc: denied { read } for pid=5719 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 43.189374][ T42] audit: type=1400 audit(1785768225.063:148): avc: denied { mounton } for pid=5719 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 43.198292][ T42] audit: type=1400 audit(1785768225.063:149): avc: denied { mount } for pid=5719 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 43.206278][ T42] audit: type=1400 audit(1785768225.073:150): avc: denied { read } for pid=5449 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 43.210437][ T5727] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 43.935736][ T5719] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 47.299569][ T5738] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 47.312904][ T5742] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 47.315715][ T5742] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 47.321298][ T5746] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 47.324117][ T5748] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 47.324814][ T5746] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 47.327465][ T5748] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 47.329079][ T5746] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 47.332129][ T5748] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 47.333733][ T5746] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 47.336362][ T5748] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 47.341354][ T5751] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 47.341644][ T5748] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 47.343676][ T5751] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 47.344972][ T5747] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 47.345468][ T5747] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 47.345736][ T5747] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 47.349143][ T5748] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 47.351199][ T5751] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 47.353251][ T5748] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 47.910383][ T5741] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.913603][ T5741] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.915916][ T5741] bridge_slave_0: entered allmulticast mode [ 47.918560][ T5741] bridge_slave_0: entered promiscuous mode [ 47.952176][ T5741] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.954507][ T5741] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.956922][ T5741] bridge_slave_1: entered allmulticast mode [ 47.959836][ T5741] bridge_slave_1: entered promiscuous mode [ 47.996021][ T5744] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.998288][ T5744] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.001251][ T5744] bridge_slave_0: entered allmulticast mode [ 48.004658][ T5744] bridge_slave_0: entered promiscuous mode [ 48.010383][ T5741] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.019910][ T5741] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.026712][ T5744] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.030281][ T5744] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.032628][ T5744] bridge_slave_1: entered allmulticast mode [ 48.035295][ T5744] bridge_slave_1: entered promiscuous mode [ 48.045725][ T5749] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.047984][ T5749] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.050446][ T5749] bridge_slave_0: entered allmulticast mode [ 48.053072][ T5749] bridge_slave_0: entered promiscuous mode [ 48.097747][ T5744] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.101564][ T5749] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.105123][ T5749] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.108004][ T5749] bridge_slave_1: entered allmulticast mode [ 48.111097][ T5749] bridge_slave_1: entered promiscuous mode [ 48.115576][ T5741] team0: Port device team_slave_0 added [ 48.117628][ T5736] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.120024][ T5736] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.122327][ T5736] bridge_slave_0: entered allmulticast mode [ 48.124984][ T5736] bridge_slave_0: entered promiscuous mode [ 48.129940][ T5744] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.149980][ T5741] team0: Port device team_slave_1 added [ 48.157468][ T5736] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.160173][ T5736] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.162462][ T5736] bridge_slave_1: entered allmulticast mode [ 48.165091][ T5736] bridge_slave_1: entered promiscuous mode [ 48.175755][ T5749] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.196576][ T5749] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.200309][ T5741] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.202497][ T5741] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.210448][ T5741] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.222052][ T5744] team0: Port device team_slave_0 added [ 48.225155][ T5744] team0: Port device team_slave_1 added [ 48.233328][ T5741] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.235542][ T5741] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.243720][ T5741] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.249593][ T5736] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.276169][ T5736] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.279501][ T5744] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.281677][ T5744] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.290024][ T5744] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.294609][ T5749] team0: Port device team_slave_0 added [ 48.298000][ T5749] team0: Port device team_slave_1 added [ 48.312333][ T5744] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.314823][ T5744] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.322758][ T5744] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.344082][ T5749] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.346268][ T5749] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.354156][ T5749] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.363502][ T5749] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.365720][ T5749] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.373652][ T5749] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.379375][ T5736] team0: Port device team_slave_0 added [ 48.396862][ T5741] hsr_slave_0: entered promiscuous mode [ 48.399418][ T5741] hsr_slave_1: entered promiscuous mode [ 48.406447][ T5736] team0: Port device team_slave_1 added [ 48.421884][ T5744] hsr_slave_0: entered promiscuous mode [ 48.424111][ T5744] hsr_slave_1: entered promiscuous mode [ 48.426161][ T5744] debugfs: 'hsr0' already exists in 'hsr' [ 48.428062][ T5744] Cannot create hsr debugfs directory [ 48.448606][ T5736] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.450988][ T5736] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.458850][ T5736] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.482190][ T5736] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.484383][ T5736] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.492277][ T5736] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.502923][ T5749] hsr_slave_0: entered promiscuous mode [ 48.505250][ T5749] hsr_slave_1: entered promiscuous mode [ 48.507388][ T5749] debugfs: 'hsr0' already exists in 'hsr' [ 48.509280][ T5749] Cannot create hsr debugfs directory [ 48.614639][ T5736] hsr_slave_0: entered promiscuous mode [ 48.616885][ T5736] hsr_slave_1: entered promiscuous mode [ 48.619049][ T5736] debugfs: 'hsr0' already exists in 'hsr' [ 48.620857][ T5736] Cannot create hsr debugfs directory [ 48.768464][ T5741] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 48.774727][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.785401][ T5741] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 48.790846][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.803198][ T5741] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 48.807378][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.810175][ T5741] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 48.814995][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.860864][ T5749] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 48.865767][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.872127][ T5749] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 48.877693][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.881446][ T5749] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 48.885075][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.887638][ T5749] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 48.893196][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.938823][ T5744] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 48.942805][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.945649][ T5744] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 48.949390][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.954809][ T5744] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 48.959547][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.962624][ T5744] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 48.966379][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.024873][ T5736] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 49.029920][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.033289][ T5736] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 49.039943][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.043220][ T5736] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 49.047390][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.053981][ T5741] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.057308][ T5736] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 49.061679][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.089458][ T5741] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.099996][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.102579][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.115153][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.117454][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.127490][ T5749] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.152591][ T5749] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.161263][ T1277] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.163564][ T1277] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.178241][ T1277] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.180585][ T1277] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.185722][ T5744] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.208139][ T5744] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.215704][ T1277] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.217984][ T1277] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.230593][ T1277] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.233450][ T1277] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.276412][ T5736] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.285915][ T5736] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.293979][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.296547][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.303181][ T5744] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 49.320647][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.323452][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.352879][ T5736] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 49.379783][ T5752] Bluetooth: hci0: command tx timeout [ 49.380070][ T64] Bluetooth: hci2: command tx timeout [ 49.385096][ T5748] Bluetooth: hci3: command tx timeout [ 49.390649][ T5748] Bluetooth: hci1: command tx timeout [ 49.445556][ T5741] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.480617][ T5741] veth0_vlan: entered promiscuous mode [ 49.486416][ T5741] veth1_vlan: entered promiscuous mode [ 49.498034][ T5749] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.511035][ T5741] veth0_macvtap: entered promiscuous mode [ 49.515904][ T5741] veth1_macvtap: entered promiscuous mode [ 49.524359][ T5744] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.541159][ T5741] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.554271][ T5741] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.573621][ T5749] veth0_vlan: entered promiscuous mode [ 49.584103][ T5749] veth1_vlan: entered promiscuous mode [ 49.590801][ T5736] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.614013][ T5744] veth0_vlan: entered promiscuous mode [ 49.642736][ T5744] veth1_vlan: entered promiscuous mode [ 49.665626][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.668440][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.669346][ T5816] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.676869][ T5749] veth0_macvtap: entered promiscuous mode [ 49.696356][ T5749] veth1_macvtap: entered promiscuous mode [ 49.709186][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.709446][ T5816] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.711792][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.719960][ T5816] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.724987][ T5736] veth0_vlan: entered promiscuous mode [ 49.733738][ T42] kauditd_printk_skb: 17 callbacks suppressed [ 49.733749][ T42] audit: type=1400 audit(1785768231.623:168): avc: denied { mount } for pid=5741 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 49.739475][ T5749] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.742860][ T42] audit: type=1400 audit(1785768231.623:169): avc: denied { mounton } for pid=5741 comm="syz-executor" path="/syzkaller.Aws3K7/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 49.747090][ T5736] veth1_vlan: entered promiscuous mode [ 49.753076][ T42] audit: type=1400 audit(1785768231.623:170): avc: denied { mount } for pid=5741 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 49.753099][ T42] audit: type=1400 audit(1785768231.623:171): avc: denied { mounton } for pid=5741 comm="syz-executor" path="/syzkaller.Aws3K7/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 49.753123][ T42] audit: type=1400 audit(1785768231.623:172): avc: denied { mounton } for pid=5741 comm="syz-executor" path="/syzkaller.Aws3K7/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=9634 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 49.753147][ T42] audit: type=1400 audit(1785768231.633:173): avc: denied { unmount } for pid=5741 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 49.789373][ T42] audit: type=1400 audit(1785768231.683:174): avc: denied { mounton } for pid=5741 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2838 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 49.796477][ T42] audit: type=1400 audit(1785768231.683:175): avc: denied { mount } for pid=5741 comm="syz-executor" name="/" dev="gadgetfs" ino=7698 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 49.799688][ T5749] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.803722][ T42] audit: type=1400 audit(1785768231.683:176): avc: denied { mount } for pid=5741 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 49.811786][ T5744] veth0_macvtap: entered promiscuous mode [ 49.813445][ T42] audit: type=1400 audit(1785768231.683:177): avc: denied { mounton } for pid=5741 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 49.819431][ T5548] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.826179][ T5744] veth1_macvtap: entered promiscuous mode [ 49.829810][ T5741] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 49.855943][ T5736] veth0_macvtap: entered promiscuous mode [ 49.866428][ T5744] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.882647][ T5744] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.885725][ T5736] veth1_macvtap: entered promiscuous mode [ 49.899971][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.903712][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.916834][ T5736] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.935907][ T5736] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.937317][ T5850] libceph: connect to (1)127.0.0.1:6789 got bad banner [ 49.940973][ T5850] libceph: mon0 (1)127.0.0.1:6789 protocol error, bad banner [ 49.942174][ T1277] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.946296][ T1277] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.978019][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.980716][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.989100][ T5816] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.995948][ T5816] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.027052][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.029795][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.042744][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.045798][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.064320][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.067336][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.082015][ T5548] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.086700][ T5548] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.090972][ T5548] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.109850][ T5816] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.114984][ T5816] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.117815][ T5816] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.121097][ T5816] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.123870][ T5816] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.126639][ T5816] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.131097][ T5816] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.213990][ T5906] Zero length message leads to an empty skb [ 50.277003][ T5913] netlink: 'syz.1.11': attribute type 1 has an invalid length. [ 50.282097][ T5913] netlink: 'syz.1.11': attribute type 1 has an invalid length. [ 50.286666][ T5913] netlink: 11 bytes leftover after parsing attributes in process `syz.1.11'. [ 50.290310][ T5913] netlink: 11 bytes leftover after parsing attributes in process `syz.1.11'. [ 50.295830][ T5913] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11'. [ 50.326158][ T5915] ip_tables: iptables: counters copy to user failed while replacing table [ 50.754806][ T34] libceph: mon0 (1)127.0.0.1:6789 socket closed (con state V1_BANNER) [ 50.760212][ T5887] ceph: No mds server is up or the cluster is laggy [ 50.793788][ T5935] lo speed is unknown, defaulting to 1000 [ 50.796695][ T5935] lo speed is unknown, defaulting to 1000 [ 50.800269][ T5935] lo speed is unknown, defaulting to 1000 [ 50.897450][ T5935] infiniband syz1: set active [ 50.900899][ T5935] infiniband syz1: added lo [ 50.906654][ T34] lo speed is unknown, defaulting to 1000 [ 50.913793][ T5935] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 50.918876][ T5935] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 50.924215][ T5935] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 50.937448][ T5935] RDS/IB: syz1: added [ 50.939343][ T5935] smc: adding ib device syz1 with port count 1 [ 50.941439][ T5935] smc: ib device syz1 port 1 has no pnetid [ 50.944550][ T10] lo speed is unknown, defaulting to 1000 [ 50.950038][ T5935] lo speed is unknown, defaulting to 1000 [ 51.037141][ T5935] lo speed is unknown, defaulting to 1000 [ 51.117548][ T5935] lo speed is unknown, defaulting to 1000 [ 51.200672][ T5935] lo speed is unknown, defaulting to 1000 [ 51.460430][ T64] Bluetooth: hci1: command tx timeout [ 51.460480][ T5752] Bluetooth: hci3: command tx timeout [ 51.460642][ T5742] Bluetooth: hci2: command tx timeout [ 51.462229][ T5748] Bluetooth: hci0: command tx timeout [ 51.732934][ T5964] netlink: 8 bytes leftover after parsing attributes in process `syz.3.31'. [ 51.840199][ T5970] netlink: 20 bytes leftover after parsing attributes in process `syz.1.33'. [ 51.843315][ T5970] netlink: 40 bytes leftover after parsing attributes in process `syz.1.33'. [ 51.878947][ T5817] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 52.053991][ T5817] usb 7-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 0.00 [ 52.057397][ T5817] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 52.060373][ T5817] usb 7-1: Product: syz [ 52.061715][ T5817] usb 7-1: Manufacturer: syz [ 52.180275][ T5980] FAULT_INJECTION: forcing a failure. [ 52.180275][ T5980] name failslab, interval 1, probability 100, space 0, times 10 [ 52.180358][ T34] FAULT_INJECTION: forcing a failure. [ 52.180358][ T34] name failslab, interval 1, probability 100, space 0, times 10 [ 52.184469][ T5980] CPU: 2 UID: 0 PID: 5980 Comm: syz.1.38 Not tainted syzkaller #0 PREEMPT(full) [ 52.184484][ T5980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 52.184502][ T5980] Call Trace: [ 52.184513][ T5980] [ 52.184518][ T5980] dump_stack_lvl+0x100/0x190 [ 52.184536][ T5980] should_fail_ex.cold+0x5/0xa [ 52.184552][ T5980] should_failslab+0xc2/0x120 [ 52.184569][ T5980] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 52.184584][ T5980] ? __alloc_skb+0x5b7/0x710 [ 52.184598][ T5980] ? __alloc_skb+0x140/0x710 [ 52.184613][ T5980] __alloc_skb+0x140/0x710 [ 52.184624][ T5980] ? __alloc_skb+0x5b7/0x710 [ 52.184637][ T5980] ? __pfx___alloc_skb+0x10/0x10 [ 52.184653][ T5980] netlink_alloc_large_skb+0x69/0x150 [ 52.184667][ T5980] netlink_sendmsg+0x680/0xda0 [ 52.184681][ T5980] ? __pfx_netlink_sendmsg+0x10/0x10 [ 52.184695][ T5980] ? selinux_socket_sendmsg+0x198/0x2f0 [ 52.184713][ T5980] ____sys_sendmsg+0xa4d/0xbe0 [ 52.184729][ T5980] ? __pfx_netlink_sendmsg+0x10/0x10 [ 52.184741][ T5980] ? __pfx_____sys_sendmsg+0x10/0x10 [ 52.184761][ T5980] ? plist_check_list+0x1b8/0x280 [ 52.184772][ T5980] ? plist_del+0x308/0x510 [ 52.184784][ T5980] ___sys_sendmsg+0x190/0x1e0 [ 52.184797][ T5980] ? __pfx____sys_sendmsg+0x10/0x10 [ 52.184809][ T5980] ? __lock_acquire+0x49f/0x1a40 [ 52.184825][ T5980] ? futex_wake+0x220/0x5e0 [ 52.184852][ T5980] __sys_sendmsg+0x160/0x210 [ 52.184867][ T5980] ? __pfx___sys_sendmsg+0x10/0x10 [ 52.184896][ T5980] do_syscall_64+0x115/0x870 [ 52.184913][ T5980] ? clear_bhb_loop+0x40/0x90 [ 52.184930][ T5980] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 52.184944][ T5980] RIP: 0033:0x7fadc3b9e019 [ 52.184959][ T5980] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 52.184969][ T5980] RSP: 002b:00007fadc1df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 52.184981][ T5980] RAX: ffffffffffffffda RBX: 00007fadc3e25fa0 RCX: 00007fadc3b9e019 [ 52.184996][ T5980] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 52.185003][ T5980] RBP: 00007fadc3c3500c R08: 0000000000000000 R09: 0000000000000000 [ 52.185009][ T5980] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 52.185016][ T5980] R13: 00007fadc3e26038 R14: 00007fadc3e25fa0 R15: 00007ffe3ce59bf8 [ 52.185031][ T5980] [ 52.185678][ T5979] FAULT_INJECTION: forcing a failure. [ 52.185678][ T5979] name failslab, interval 1, probability 100, space 0, times 4 [ 52.186024][ T5980] FAULT_INJECTION: forcing a failure. [ 52.186024][ T5980] name failslab, interval 1, probability 100, space 0, times 4 [ 52.186049][ T5980] CPU: 1 UID: 0 PID: 5980 Comm: syz.1.38 Not tainted syzkaller #0 PREEMPT(full) [ 52.186065][ T5980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 52.186074][ T5980] Call Trace: [ 52.186079][ T5980] [ 52.186086][ T5980] dump_stack_lvl+0x100/0x190 [ 52.186109][ T5980] should_fail_ex.cold+0x5/0xa [ 52.186129][ T5980] should_failslab+0xc2/0x120 [ 52.186150][ T5980] kmem_cache_alloc_noprof+0x91/0x6a0 [ 52.186168][ T5980] ? __pfx_acct_collect+0x10/0x10 [ 52.186184][ T5980] ? taskstats_exit+0x6d3/0xca0 [ 52.186206][ T5980] taskstats_exit+0x6d3/0xca0 [ 52.186225][ T5980] ? __pfx_taskstats_exit+0x10/0x10 [ 52.186255][ T5980] do_exit+0x65c/0x2ae0 [ 52.186283][ T5980] ? __pfx_do_exit+0x10/0x10 [ 52.186307][ T5980] ? do_raw_spin_lock+0x128/0x260 [ 52.186328][ T5980] ? find_held_lock+0x2b/0x80 [ 52.186342][ T5980] ? get_signal+0x7e0/0x21e0 [ 52.186365][ T5980] do_group_exit+0xd5/0x2a0 [ 52.186383][ T5980] get_signal+0x1ec7/0x21e0 [ 52.186403][ T5980] ? __pfx_futex_wake+0x10/0x10 [ 52.186425][ T5980] ? __pfx_get_signal+0x10/0x10 [ 52.186447][ T5980] ? do_futex+0x190/0x440 [ 52.186472][ T5980] arch_do_signal_or_restart+0x91/0x7e0 [ 52.186492][ T5980] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 52.186546][ T5980] exit_to_user_mode_loop+0x139/0x6f0 [ 52.186568][ T5980] ? rcu_is_watching+0x12/0xc0 [ 52.186595][ T5980] do_syscall_64+0x666/0x870 [ 52.186614][ T5980] ? clear_bhb_loop+0x40/0x90 [ 52.186634][ T5980] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 52.186650][ T5980] RIP: 0033:0x7fadc3b9e019 [ 52.186663][ T5980] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 52.186677][ T5980] RSP: 002b:00007fadc1df60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 52.186693][ T5980] RAX: 0000000000000001 RBX: 00007fadc3e25fa8 RCX: 00007fadc3b9e019 [ 52.186702][ T5980] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fadc3e25fac [ 52.186712][ T5980] RBP: 00007fadc3e25fa0 R08: 0000000000000001 R09: 0000000000000000 [ 52.186721][ T5980] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 52.186730][ T5980] R13: 00007fadc3e26038 R14: 00007ffe3ce59b10 R15: 00007ffe3ce59bf8 [ 52.186751][ T5980] [ 52.188596][ T34] CPU: 3 UID: 0 PID: 34 Comm: kworker/3:0 Not tainted syzkaller #0 PREEMPT(full) [ 52.188610][ T34] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 52.188628][ T34] Workqueue: mld mld_dad_work [ 52.188646][ T34] Call Trace: [ 52.188650][ T34] [ 52.188654][ T34] dump_stack_lvl+0x100/0x190 [ 52.188669][ T34] should_fail_ex.cold+0x5/0xa [ 52.188696][ T34] should_failslab+0xc2/0x120 [ 52.188710][ T34] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 52.188724][ T34] ? __alloc_skb+0x140/0x710 [ 52.188739][ T34] __alloc_skb+0x140/0x710 [ 52.188750][ T34] ? __alloc_skb+0x5b7/0x710 [ 52.188762][ T34] ? __pfx___alloc_skb+0x10/0x10 [ 52.188775][ T34] ? __lock_acquire+0x49f/0x1a40 [ 52.188788][ T34] ? NF_HOOK.constprop.0+0x277/0x5a0 [ 52.188804][ T34] mld_newpack.isra.0+0x18e/0xa20 [ 52.188821][ T34] ? __pfx_mld_newpack.isra.0+0x10/0x10 [ 52.188838][ T34] ? rcu_is_watching+0x12/0xc0 [ 52.188860][ T34] ? add_grhead+0x299/0x340 [ 52.188873][ T34] add_grhead+0x299/0x340 [ 52.188888][ T34] add_grec+0x1389/0x1930 [ 52.188902][ T34] ? __pfx___mutex_lock+0x10/0x10 [ 52.188919][ T34] ? __pfx_add_grec+0x10/0x10 [ 52.188937][ T34] mld_send_initial_cr+0x156/0x320 [ 52.188953][ T34] mld_dad_work+0x32/0x1f0 [ 52.188968][ T34] process_one_work+0xa23/0x1940 [ 52.188986][ T34] ? __pfx_process_one_work+0x10/0x10 [ 52.189001][ T34] ? __pfx_mld_dad_work+0x10/0x10 [ 52.189017][ T34] worker_thread+0x5ef/0xe50 [ 52.189033][ T34] ? kthread+0x13a/0x450 [ 52.189044][ T34] ? __pfx_worker_thread+0x10/0x10 [ 52.189054][ T34] kthread+0x370/0x450 [ 52.189064][ T34] ? __pfx_kthread+0x10/0x10 [ 52.189075][ T34] ret_from_fork+0x72b/0xd50 [ 52.189091][ T34] ? __pfx_ret_from_fork+0x10/0x10 [ 52.189106][ T34] ? __switch_to+0x800/0x10f0 [ 52.189117][ T34] ? __pfx_kthread+0x10/0x10 [ 52.189128][ T34] ret_from_fork_asm+0x1a/0x30 [ 52.189150][ T34] [ 52.189495][ T1044] FAULT_INJECTION: forcing a failure. [ 52.189495][ T1044] name failslab, interval 1, probability 100, space 0, times 3 [ 52.189624][ T5136] FAULT_INJECTION: forcing a failure. [ 52.189624][ T5136] name failslab, interval 1, probability 100, space 0, times 1 [ 52.189645][ T5136] CPU: 1 UID: 0 PID: 5136 Comm: klogd Not tainted syzkaller #0 PREEMPT(full) [ 52.189663][ T5136] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 52.189672][ T5136] Call Trace: [ 52.189677][ T5136] [ 52.189682][ T5136] dump_stack_lvl+0x100/0x190 [ 52.189705][ T5136] should_fail_ex.cold+0x5/0xa [ 52.189724][ T5136] should_failslab+0xc2/0x120 [ 52.189745][ T5136] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 52.189765][ T5136] ? sock_alloc_inode+0x26/0x2c0 [ 52.189789][ T5136] ? __pfx_sock_alloc_inode+0x10/0x10 [ 52.189812][ T5136] sock_alloc_inode+0x26/0x2c0 [ 52.189833][ T5136] ? __pfx_sock_alloc_inode+0x10/0x10 [ 52.189855][ T5136] alloc_inode+0x68/0x250 [ 52.189877][ T5136] sock_alloc+0x44/0x280 [ 52.189897][ T5136] ? security_socket_create+0x7f/0x250 [ 52.189920][ T5136] __sock_create+0xc2/0x860 [ 52.189939][ T5136] __sys_socket+0x14d/0x260 [ 52.189955][ T5136] ? __pfx___sys_socket+0x10/0x10 [ 52.189977][ T5136] __x64_sys_socket+0x72/0xb0 [ 52.189992][ T5136] ? lockdep_hardirqs_on+0x78/0x100 [ 52.190011][ T5136] do_syscall_64+0x115/0x870 [ 52.190029][ T5136] ? clear_bhb_loop+0x40/0x90 [ 52.190048][ T5136] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 52.190064][ T5136] RIP: 0033:0x7f50cc7ef707 [ 52.190076][ T5136] Code: 54 24 0c e8 6b ac ff ff 83 f8 ff 74 04 8b 44 24 0c 48 83 c4 18 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c1 e6 0c 00 f7 d8 64 89 01 48 [ 52.190090][ T5136] RSP: 002b:00007fff98367118 EFLAGS: 00000202 ORIG_RAX: 0000000000000029 [ 52.190105][ T5136] RAX: ffffffffffffffda RBX: 0000000000000055 RCX: 00007f50cc7ef707 [ 52.190115][ T5136] RDX: 0000000000000000 RSI: 0000000000080002 RDI: 0000000000000001 [ 52.190124][ T5136] RBP: 00007f50cc87b560 R08: 0000000000000000 R09: 0000000000000000 [ 52.190133][ T5136] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002 [ 52.190142][ T5136] R13: 00007fff98367240 R14: 000000000000003a R15: 00007fff98367240 [ 52.190163][ T5136] [ 52.190171][ T5136] socket: no more sockets [ 52.191510][ T5979] CPU: 2 UID: 0 PID: 5979 Comm: syz.1.38 Not tainted syzkaller #0 PREEMPT(full) [ 52.191524][ T5979] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 52.191530][ T5979] Call Trace: [ 52.191534][ T5979] [ 52.191538][ T5979] dump_stack_lvl+0x100/0x190 [ 52.191553][ T5979] should_fail_ex.cold+0x5/0xa [ 52.191566][ T5979] should_failslab+0xc2/0x120 [ 52.191580][ T5979] kmem_cache_alloc_noprof+0x91/0x6a0 [ 52.191592][ T5979] ? __pfx_acct_collect+0x10/0x10 [ 52.191602][ T5979] ? taskstats_exit+0x6d3/0xca0 [ 52.191617][ T5979] taskstats_exit+0x6d3/0xca0 [ 52.191629][ T5979] ? __pfx_acct_update_integrals+0x10/0x10 [ 52.191642][ T5979] ? __pfx_taskstats_exit+0x10/0x10 [ 52.191655][ T5979] ? rcu_read_lock_any_held+0x6a/0xa0 [ 52.191667][ T5979] do_exit+0x65c/0x2ae0 [ 52.191684][ T5979] ? signal_wake_up_state+0xa8/0x130 [ 52.191696][ T5979] ? __pfx_do_exit+0x10/0x10 [ 52.191711][ T5979] ? do_group_exit+0x1bd/0x2a0 [ 52.191724][ T5979] ? rcu_is_watching+0x12/0xc0 [ 52.191750][ T5979] do_group_exit+0xd5/0x2a0 [ 52.191769][ T5979] __x64_sys_exit_group+0x3e/0x50 [ 52.191785][ T5979] x64_sys_call+0x102c/0x1530 [ 52.191809][ T5979] do_syscall_64+0x115/0x870 [ 52.191830][ T5979] ? clear_bhb_loop+0x40/0x90 [ 52.191846][ T5979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 52.191856][ T5979] RIP: 0033:0x7fadc3b9e019 [ 52.191866][ T5979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 52.191875][ T5979] RSP: 002b:00007ffe3ce59f38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 52.191885][ T5979] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fadc3b9e019 [ 52.191892][ T5979] RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 [ 52.191898][ T5979] RBP: 00007ffe3ce59f9c R08: 0000000000000000 R09: 00000000000927c0 [ 52.191904][ T5979] R10: 0000000000000001 R11: 0000000000000246 R12: 000000000000000a [ 52.191910][ T5979] R13: 00000000000927c0 R14: 000000000000cb49 R15: 00007ffe3ce59ff0 [ 52.191923][ T5979] [ 52.551650][ T1044] CPU: 3 UID: 0 PID: 1044 Comm: kworker/3:2 Not tainted syzkaller #0 PREEMPT(full) [ 52.551665][ T1044] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 52.551672][ T1044] Workqueue: events nsim_fib_event_work [ 52.551695][ T1044] Call Trace: [ 52.551699][ T1044] [ 52.551703][ T1044] dump_stack_lvl+0x100/0x190 [ 52.551719][ T1044] should_fail_ex.cold+0x5/0xa [ 52.551734][ T1044] should_failslab+0xc2/0x120 [ 52.551763][ T1044] __kmalloc_cache_noprof+0x91/0x6c0 [ 52.551781][ T1044] ? nsim_fib_event_work+0x156d/0x6310 [ 52.551800][ T1044] nsim_fib_event_work+0x156d/0x6310 [ 52.551821][ T1044] ? debug_object_deactivate+0x2e4/0x3b0 [ 52.551837][ T1044] ? __pfx_nsim_fib_event_work+0x10/0x10 [ 52.551857][ T1044] ? rcu_is_watching+0x12/0xc0 [ 52.551876][ T1044] process_one_work+0xa23/0x1940 [ 52.551893][ T1044] ? __pfx_process_one_work+0x10/0x10 [ 52.551909][ T1044] ? __pfx_nsim_fib_event_work+0x10/0x10 [ 52.551927][ T1044] worker_thread+0x5ef/0xe50 [ 52.551942][ T1044] ? __pfx_worker_thread+0x10/0x10 [ 52.551954][ T1044] ? kthread+0x13a/0x450 [ 52.551964][ T1044] ? __pfx_worker_thread+0x10/0x10 [ 52.551974][ T1044] kthread+0x370/0x450 [ 52.551984][ T1044] ? __pfx_kthread+0x10/0x10 [ 52.551995][ T1044] ret_from_fork+0x72b/0xd50 [ 52.552011][ T1044] ? __pfx_ret_from_fork+0x10/0x10 [ 52.552026][ T1044] ? __switch_to+0x800/0x10f0 [ 52.552038][ T1044] ? __pfx_kthread+0x10/0x10 [ 52.552049][ T1044] ret_from_fork_asm+0x1a/0x30 [ 52.552071][ T1044] [ 53.276378][ T5817] speedtch 7-1:1.0: speedtch_bind: wrong device class 0 [ 53.279053][ T5817] speedtch 7-1:1.0: usbatm_usb_probe: bind failed: -19! [ 53.283376][ T5817] speedtch 7-1:1.1: speedtch_bind: wrong device class 0 [ 53.285540][ T5817] speedtch 7-1:1.1: usbatm_usb_probe: bind failed: -19! [ 53.292027][ T5817] usb 7-1: USB disconnect, device number 2 [ 53.539039][ T5752] Bluetooth: hci1: command tx timeout [ 53.539747][ T5748] Bluetooth: hci0: command tx timeout [ 53.539776][ T64] Bluetooth: hci3: command tx timeout [ 53.548847][ T5748] Bluetooth: hci2: command tx timeout [ 53.581537][ T6015] 8021q: VLANs not supported on lo [ 53.758741][ T6027] lo speed is unknown, defaulting to 1000 [ 53.768720][ T41] ------------[ cut here ]------------ [ 53.771115][ T41] con->v1.connect_seq != le32_to_cpu(con->v1.in_reply.connect_seq) [ 53.771125][ T41] WARNING: net/ceph/messenger_v1.c:901 at ceph_con_v1_try_read+0x447d/0x6ca0, CPU#3: kworker/3:1/41 [ 53.777472][ T41] Modules linked in: [ 53.779836][ T41] CPU: 3 UID: 0 PID: 41 Comm: kworker/3:1 Not tainted syzkaller #0 PREEMPT(full) [ 53.783569][ T41] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 53.787451][ T41] Workqueue: ceph-msgr ceph_con_workfn [ 53.789655][ T41] RIP: 0010:ceph_con_v1_try_read+0x447d/0x6ca0 [ 53.792086][ T41] Code: f6 84 db 0f 84 1b ee ff ff e9 d2 60 f4 f5 e8 ca 87 8a f6 90 0f 0b 90 e9 9f db ff ff e8 bc 87 8a f6 90 0f 0b e8 b4 87 8a f6 90 <0f> 0b 90 e9 84 e5 ff ff e8 a6 87 8a f6 90 0f 0b e8 9e 87 8a f6 90 [ 53.799596][ T41] RSP: 0018:ffffc90000757a08 EFLAGS: 00010293 [ 53.801958][ T41] RAX: 0000000000000000 RBX: ffff88802464888b RCX: ffffffff8b7fbff0 [ 53.805022][ T41] RDX: ffff88801c3b8000 RSI: ffffffff8b7fda6c RDI: ffff88801c3b8000 [ 53.808074][ T41] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000000 [ 53.811365][ T41] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 53.814704][ T41] R13: ffff888024648950 R14: ffff888024648418 R15: dffffc0000000000 [ 53.817760][ T41] FS: 0000000000000000(0000) GS:ffff8880d60d8000(0000) knlGS:0000000000000000 [ 53.821247][ T41] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 53.823843][ T41] CR2: 000000110c3866bb CR3: 000000005a2c0000 CR4: 0000000000352ef0 [ 53.826910][ T41] Call Trace: [ 53.828042][ T41] [ 53.829097][ T41] ? ceph_con_workfn+0x48/0x13e0 [ 53.830708][ T41] ? register_lock_class+0x40/0x560 [ 53.832403][ T41] ? do_raw_spin_lock+0x128/0x260 [ 53.834012][ T41] ? __pfx___mutex_lock+0x10/0x10 [ 53.835627][ T41] ? __lock_acquire+0x49f/0x1a40 [ 53.837214][ T41] ? __pfx_ceph_con_v1_try_read+0x10/0x10 [ 53.839084][ T41] ? debug_object_deactivate+0x2e4/0x3b0 [ 53.840885][ T41] ceph_con_workfn+0x9a5/0x13e0 [ 53.842468][ T41] process_one_work+0xa23/0x1940 [ 53.844067][ T41] ? __pfx_process_one_work+0x10/0x10 [ 53.845765][ T41] ? __pfx_ceph_con_workfn+0x10/0x10 [ 53.847442][ T41] worker_thread+0x5ef/0xe50 [ 53.848985][ T41] ? kthread+0x13a/0x450 [ 53.850340][ T41] ? __pfx_worker_thread+0x10/0x10 [ 53.852007][ T41] kthread+0x370/0x450 [ 53.853310][ T41] ? __pfx_kthread+0x10/0x10 [ 53.854792][ T41] ret_from_fork+0x72b/0xd50 [ 53.856273][ T41] ? __pfx_ret_from_fork+0x10/0x10 [ 53.857916][ T41] ? __switch_to+0x800/0x10f0 [ 53.859524][ T41] ? __pfx_kthread+0x10/0x10 [ 53.861010][ T41] ret_from_fork_asm+0x1a/0x30 [ 53.862592][ T41] [ 53.863606][ T41] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 53.865917][ T41] CPU: 3 UID: 0 PID: 41 Comm: kworker/3:1 Not tainted syzkaller #0 PREEMPT(full) [ 53.868792][ T41] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 53.871956][ T41] Workqueue: ceph-msgr ceph_con_workfn [ 53.873684][ T41] Call Trace: [ 53.874771][ T41] [ 53.875722][ T41] dump_stack_lvl+0x100/0x190 [ 53.877237][ T41] vpanic+0x552/0x970 [ 53.878531][ T41] ? __pfx_vpanic+0x10/0x10 [ 53.880012][ T41] panic+0xd1/0xe0 [ 53.881214][ T41] ? __pfx_panic+0x10/0x10 [ 53.882647][ T41] ? check_panic_on_warn+0x1f/0x90 [ 53.884272][ T41] check_panic_on_warn.cold+0x19/0x34 [ 53.885963][ T41] ? ceph_con_v1_try_read+0x447d/0x6ca0 [ 53.887717][ T41] __warn.cold+0x191/0x318 [ 53.889127][ T41] __report_bug+0x30f/0x440 [ 53.890582][ T41] ? ceph_con_v1_try_read+0x447d/0x6ca0 [ 53.892319][ T41] ? __pfx___report_bug+0x10/0x10 [ 53.893909][ T41] ? __pfx_tcp_recvmsg+0x10/0x10 [ 53.895474][ T41] ? inet_recvmsg+0xdc/0x4c0 [ 53.896944][ T41] ? bpf_lsm_socket_recvmsg+0x9/0x10 [ 53.898617][ T41] ? rcu_is_watching+0x12/0xc0 [ 53.900145][ T41] ? ceph_con_v1_try_read+0x447d/0x6ca0 [ 53.901882][ T41] report_bug+0xb2/0x220 [ 53.903233][ T41] ? ceph_con_v1_try_read+0x447d/0x6ca0 [ 53.904972][ T41] handle_bug+0x16a/0x2a0 [ 53.906342][ T41] exc_invalid_op+0x17/0x50 [ 53.907799][ T41] asm_exc_invalid_op+0x1a/0x20 [ 53.909338][ T41] RIP: 0010:ceph_con_v1_try_read+0x447d/0x6ca0 [ 53.911302][ T41] Code: f6 84 db 0f 84 1b ee ff ff e9 d2 60 f4 f5 e8 ca 87 8a f6 90 0f 0b 90 e9 9f db ff ff e8 bc 87 8a f6 90 0f 0b e8 b4 87 8a f6 90 <0f> 0b 90 e9 84 e5 ff ff e8 a6 87 8a f6 90 0f 0b e8 9e 87 8a f6 90 [ 53.917280][ T41] RSP: 0018:ffffc90000757a08 EFLAGS: 00010293 [ 53.919200][ T41] RAX: 0000000000000000 RBX: ffff88802464888b RCX: ffffffff8b7fbff0 [ 53.921726][ T41] RDX: ffff88801c3b8000 RSI: ffffffff8b7fda6c RDI: ffff88801c3b8000 [ 53.924211][ T41] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000000 [ 53.926698][ T41] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 53.929137][ T41] R13: ffff888024648950 R14: ffff888024648418 R15: dffffc0000000000 [ 53.931653][ T41] ? ceph_con_v1_try_read+0x2a00/0x6ca0 [ 53.933392][ T41] ? ceph_con_v1_try_read+0x447c/0x6ca0 [ 53.935173][ T41] ? ceph_con_v1_try_read+0x447c/0x6ca0 [ 53.936926][ T41] ? ceph_con_workfn+0x48/0x13e0 [ 53.938479][ T41] ? register_lock_class+0x40/0x560 [ 53.940148][ T41] ? do_raw_spin_lock+0x128/0x260 [ 53.941741][ T41] ? __pfx___mutex_lock+0x10/0x10 [ 53.943338][ T41] ? __lock_acquire+0x49f/0x1a40 [ 53.944902][ T41] ? __pfx_ceph_con_v1_try_read+0x10/0x10 [ 53.946692][ T41] ? debug_object_deactivate+0x2e4/0x3b0 [ 53.948458][ T41] ceph_con_workfn+0x9a5/0x13e0 [ 53.950020][ T41] process_one_work+0xa23/0x1940 [ 53.951591][ T41] ? __pfx_process_one_work+0x10/0x10 [ 53.953283][ T41] ? __pfx_ceph_con_workfn+0x10/0x10 [ 53.954960][ T41] worker_thread+0x5ef/0xe50 [ 53.956437][ T41] ? kthread+0x13a/0x450 [ 53.957783][ T41] ? __pfx_worker_thread+0x10/0x10 [ 53.959395][ T41] kthread+0x370/0x450 [ 53.960705][ T41] ? __pfx_kthread+0x10/0x10 [ 53.962172][ T41] ret_from_fork+0x72b/0xd50 [ 53.963647][ T41] ? __pfx_ret_from_fork+0x10/0x10 [ 53.965259][ T41] ? __switch_to+0x800/0x10f0 [ 53.966751][ T41] ? __pfx_kthread+0x10/0x10 [ 53.968231][ T41] ret_from_fork_asm+0x1a/0x30 [ 53.969750][ T41] [ 53.971295][ T41] Kernel Offset: disabled [ 53.972665][ T41] Rebooting in 86400 seconds..