last executing test programs: 4.720485222s ago: executing program 0 (id=1214): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000c80)=ANY=[@ANYBLOB="12010000fe76181004160780a6af011703010902120001000000020904"], 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000cc0), 0x10007, 0xbc03) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r0, 0x80dc5521, &(0x7f0000000d00)=""/137) 3.302581165s ago: executing program 2 (id=1221): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0xb, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x3c, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0xffffffff, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0xfffffffe, 0x4, 0x1c, 0x0, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x9, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xeb00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0x8, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x2, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0x8, 0x5, 0xfffffffe], [0xa76f, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0xbbd6, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0xab6b]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000400)={[0x8000, 0x1000000003, 0x1ffffffffffd, 0x5, 0x2d391, 0x3da0000000000, 0x2004cb, 0x80001000, 0xa7c, 0x3, 0x5, 0x9, 0x9, 0x0, 0xfffffffffffffffd, 0x5], 0xeeee8000, 0xa02}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)={0x44, 0x2, 0x6, 0xa03, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x2002c0c4}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000012000100"/19, @ANYBLOB="000000000000000408001d00ff03"], 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.351770167s ago: executing program 2 (id=1226): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x183) mount$9p_virtio(&(0x7f0000000440), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="56c78e3c733d76ac0393f26f2c6e6f657874667379616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000540)='./file0\x00') creat(&(0x7f0000000580)='./file0\x00', 0x10) 2.351608863s ago: executing program 2 (id=1227): r0 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r0, &(0x7f0000000540)={0x2, 0x4e22, @empty}, 0x10) connect$inet(r0, &(0x7f0000000580)={0x2, 0x4e22, @local}, 0x10) sendto$inet(r0, &(0x7f00000005c0)="ab", 0x34, 0xe61e2840a154b0c0, &(0x7f0000000600)={0x2, 0x4e22, @loopback}, 0x10) 2.091281008s ago: executing program 1 (id=1231): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000001c0)={0x34, r0, 0x801, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_KEY={0x18, 0x50, 0x0, 0x1, [@NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "7ee5d52ffd"}]}]}, 0x34}}, 0x0) 1.743396431s ago: executing program 1 (id=1232): ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000240)={0x53, 0xd8, 0x2, {0x20, 0x1}, {0x46, 0x400}, @ramp={0x3, 0x10, {0x6, 0x7fff, 0x1ff, 0xe4}}}) r0 = socket$netlink(0x10, 0x3, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000740)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2, 0x0, 0x0, 0xf500}}}}}}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=@newtaction={0x11c, 0x30, 0x9, 0x0, 0xffffffff, {}, [{0x108, 0x1, [@m_csum={0x104, 0x1f, 0x0, 0x0, {{0x9}, {0x58, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0xb704, 0x6, 0x1, 0x7}, 0x4a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0xa73, 0x8, 0x80000000, 0x3}, 0x74}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x7, 0x5, 0x7, 0x6, 0x6}, 0x1}}]}, {0x82, 0x6, "00bdd6b26cdb5f282bc9641c6ff926fc7d9afdd0c4fafed95f04ceec740555b473d12416fef1da579a87eaf525138c05ef0f2fa0e4c46a7dac49f549b508ae54f9a94845d0f7b7620137ba7fed4ae3ba08c253916418e928151b592b47b451f2a4be7fe55b339cff07abea72e1a2aaa6470c690ba50f0996e1b9b9c9913a"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}, 0x11c}, 0x1, 0x0, 0x0, 0x10}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000280)={0x5, 0x40000}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)={0x14, 0x3, 0x3, 0x301, 0x0, 0x0, {0x1, 0x0, 0xffff}}, 0x14}}, 0x40) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum={0x0, 0x0, 0x0, 0x13}]}}, 0x0, 0x26}, 0x20) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000440)={0x9, 0x4, 0x4, 0x2, 0x80, 0x1, 0x0, '\x00', 0x0, r2, 0x1, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0xd, 0x4, 0x4, 0xa8, 0x0, r3, 0x0, '\x00', 0x0, r2, 0x13, 0x5}, 0x50) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="2c0000001200375f3fbd7000fcffffff07", @ANYRES32], 0x2c}, 0x1, 0x0, 0x0, 0x40010}, 0x8884) socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0xe, &(0x7f0000000380)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}, @empty, @void, {@generic={0x88f7}}}, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f00000001c0)={0xf0f045}) ppoll(&(0x7f0000000200)=[{0xffffffffffffffff, 0x9f712fd3135d632f}], 0x1, 0x0, 0x0, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x8c2b01) write$char_usb(r4, &(0x7f0000000040)="e2", 0x12d8) 1.705757056s ago: executing program 0 (id=1233): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000900), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000940)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="d8010000", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="bc01330080000000ffffffffffff080211000000f7ab87594b3f00000000000801000100dd7118aae49bd5937bad5fda023b2a5a78c05782f92fe27196352514ed223d61c8fc17d2692f2a2eecd8d55db037f220440957ec558232ad7346e19d0ffba41dae1bdf25fc38ceb7a7a77ac466c2bb6feb8de070b227826541a0d118d508fc18f3cc6f5f98db435cd2d27a5c0ce49292e72b43cdadc26f69deb1ef3ede9aec85a6554b2c7cd5af891f933549794b8d0f911ffdaed3ba6833441f94f5721cddaf7e6127b1f68192b4d5902dd5c215d8df43165c4061282fcbe5430fdf2448206d0e1561b338289d64b802476bd7d66916ec22a9ba727a7235efa7d79790006ecf9f6cf9dcdddfd6fc6d331c49964061c06dde5fba9c6d0c3e70ab41f94363dfcae6a3094be521aaeb94d767d83c334beb6c7fb826e4445bc76956fa8925f927e16204df31acbbd681b6d593a68b3b3756ff8a78ffb7134aff", @ANYRESHEX], 0x1d8}, 0x1, 0x0, 0x0, 0x805}, 0x0) 1.612730922s ago: executing program 0 (id=1234): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000d80)=@newsa={0x15c, 0x1a, 0x713, 0x0, 0x25dfdbff, {{@in6=@remote, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4, 0x0, 0x4e21, 0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@local, 0x104d2, 0x32}, @in=@dev={0xac, 0x14, 0x14, 0x38}, {0x5, 0x0, 0x800, 0xe91, 0xffffffff00000001, 0x10000000, 0x80000001, 0x543}, {0x1000000000004, 0x7fffffffffffffff, 0x100, 0xc}, {}, 0x70bd26, 0x3505, 0xa, 0x4, 0x40, 0x54}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}, @offload={0xc, 0x1c, {r2}}]}, 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 1.608109603s ago: executing program 0 (id=1235): mkdir(&(0x7f0000001040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000001080)='./config\x00', &(0x7f00000010c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0) write$P9_RLERROR(r0, &(0x7f0000000040)={0x12, 0x7, 0x1, {0x9, 'configfs\x00'}}, 0x12) 1.605811169s ago: executing program 0 (id=1236): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001f80)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r1, &(0x7f0000001fc0)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000002040)=ANY=[@ANYBLOB="5c0100001000130700000000ffdbdf25fc010000000000000000000000000000ff0200000000000000000000000000010004fffe4e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fe800000000100000000000000000037000004d232000000fc020000000000000000000000000000050000000000000000000000000000000000000000000000090000000000000001000000ffffffff0000000000000000030000800000000043050000000000000400000000000000ffffffffffffff7f000100000000000001000000000000000000000000000000000000002cbd70000535004002000400500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r2, @ANYRES16=r0], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 1.492046979s ago: executing program 0 (id=1237): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000400)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$TIOCMGET(r1, 0x8028c003, 0x0) 1.491784364s ago: executing program 2 (id=1238): syz_emit_ethernet(0xe, &(0x7f0000000100)={@random="aaaaaaaaaaaa", @random="aaaaaaaaaabb", @void, {@generic={0x800}}}, 0x0) r0 = openat$dm_control(0xffffffffffffff9c, 0x0, 0x101002, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, 0x0) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) syz_usb_connect(0x0, 0x3d, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f7902"], 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r3, &(0x7f00000001c0)=[{&(0x7f00000005c0)="8c", 0x1}, {&(0x7f0000000600)='j', 0x1}], 0x2) close_range(r2, 0xffffffffffffffff, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x845, 0x9, 0xfffffffffffffffd, 0x8, 0x10000, 0x0, 0x4002004c2, 0x2000000001000, 0x1400000000000000, 0x0, 0x3fd, 0x80, 0x3, 0x0, 0x8, 0x4000000000008d], 0x100000, 0x80}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 930.497708ms ago: executing program 1 (id=1240): open(&(0x7f0000000180)='./file0\x00', 0x60840, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000340), 0x10001, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$FUSE_DEV_IOC_BACKING_OPEN(r0, 0x4010e501, 0x0) 930.114799ms ago: executing program 1 (id=1241): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x3c, r1, 0x121, 0x70bd2c, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_BSS_BASIC_RATES={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}]]}, 0x3c}, 0x1, 0x0, 0x0, 0xf040}, 0x0) 851.79379ms ago: executing program 1 (id=1242): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000280)=[{&(0x7f00000002c0)="580000001400192340834b80040d8c560a06ffffff7f070000004001000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) 360.309489ms ago: executing program 3 (id=1243): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001240)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0500000000fd000000f20500000008000300", @ANYRES32=r2], 0x24}}, 0x0) 215.65876ms ago: executing program 2 (id=1244): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000840)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000880)=0x2, 0x4) connect$inet(r0, &(0x7f00000008c0)={0x2, 0x4e23, @remote}, 0x10) 214.321029ms ago: executing program 3 (id=1245): syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_mems\x00', 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)=ANY=[@ANYBLOB="180000005a00010029bd7000000000001c00000004"], 0x18}, 0x1, 0x0, 0x0, 0x40040d1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000980)=@base={0x1, 0x4, 0x8001, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000a00)) sendmsg$nl_route(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={0x0, 0x3c}, 0x1, 0x0, 0x0, 0x8004010}, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r3, 0x8922, &(0x7f0000001180)={'dummy0\x00'}) 211.886495ms ago: executing program 2 (id=1246): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000040)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r1, 0x40015b19, &(0x7f00000000c0)={0x100000, 0x0, 0xfffffff9, 0xa4, 0x0, 0x40005}) 193.675836ms ago: executing program 3 (id=1247): r0 = syz_open_dev$media(0x0, 0x4, 0x20801) ioctl$NILFS_IOCTL_GET_SUSTAT(r0, 0x80306e85, &(0x7f0000000040)) r1 = syz_open_dev$usbfs(&(0x7f0000000240), 0xf, 0x2) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f00000002c0)={0x0, 0x1, 'hub\x00'}) 161.816535ms ago: executing program 3 (id=1248): mkdirat(0xffffffffffffff9c, &(0x7f0000004bc0)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000004c80)='./mnt\x00', &(0x7f0000004cc0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000004dc0)='./mnt/trace_pipe\x00', 0x0, 0x0) read(r0, &(0x7f0000004e00)=""/16384, 0x4000) 92.688864ms ago: executing program 3 (id=1249): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000580)={0xa, 0x0, 0x1, @empty, 0x0, 0x4}, 0x20) connect$l2tp6(r0, &(0x7f00000006c0)={0xa, 0x0, 0x0, @empty}, 0x20) sendmmsg$inet6(r0, &(0x7f0000000740)=[{{&(0x7f0000000780)={0xa, 0x0, 0x0, @loopback}, 0x1c, 0x0}}], 0x1, 0x400ff00) 799.187µs ago: executing program 3 (id=1250): mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000780)='./config\x00', &(0x7f00000007c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) rmdir(&(0x7f0000000880)='./config/usb_gadget/g1/functions/uvc.0\x00') 0s ago: executing program 1 (id=1251): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000016c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000001700)={0x0, 0x4788, &(0x7f0000001740)={&(0x7f0000001780)=@bridge_newvlan={0x28, 0x70, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r2}, [@BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0x4, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_ID={0x8, 0x1, 0x34000}}}]}, 0x28}}, 0x0) kernel console output (not intermixed with test programs): vfs_open_consume+0xcc/0x460 [ 74.040825][ T6824] path_openat+0x1547/0x23f0 [ 74.040840][ T6824] ? __pfx_path_openat+0x10/0x10 [ 74.040858][ T6824] do_file_open+0x20e/0x430 [ 74.040873][ T6824] ? __pfx_do_file_open+0x10/0x10 [ 74.040897][ T6824] ? _raw_spin_unlock+0x28/0x50 [ 74.040909][ T6824] ? alloc_fd+0x471/0x7a0 [ 74.040927][ T6824] do_sys_openat2+0x163/0x1d0 [ 74.040942][ T6824] ? __pfx_do_sys_openat2+0x10/0x10 [ 74.040983][ T6824] __x64_sys_openat+0x12d/0x210 [ 74.040999][ T6824] ? __pfx___x64_sys_openat+0x10/0x10 [ 74.041020][ T6824] do_syscall_64+0x123/0x7b0 [ 74.041035][ T6824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.041046][ T6824] RIP: 0033:0x7fbaba59fb19 [ 74.041056][ T6824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.041065][ T6824] RSP: 002b:00007fbabb3d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 74.041076][ T6824] RAX: ffffffffffffffda RBX: 00007fbaba825fa0 RCX: 00007fbaba59fb19 [ 74.041084][ T6824] RDX: 0000000000080200 RSI: 0000200000000a80 RDI: ffffffffffffff9c [ 74.041090][ T6824] RBP: 00007fbaba637b70 R08: 0000000000000000 R09: 0000000000000000 [ 74.041097][ T6824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 74.041104][ T6824] R13: 00007fbaba826038 R14: 00007fbaba825fa0 R15: 00007ffc13239da8 [ 74.041118][ T6824] [ 74.074024][ T6826] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 74.074037][ T6826] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 74.207294][ T6833] netlink: 17 bytes leftover after parsing attributes in process `syz.1.318'. [ 74.211759][ T6833] netlink: 17 bytes leftover after parsing attributes in process `syz.1.318'. [ 74.249391][ T6830] snd_dummy snd_dummy.0: control 0:6:0:syz0:0 is already present [ 74.316406][ T43] audit: type=1400 audit(1794229198.120:465): avc: denied { setopt } for pid=6839 comm="syz.0.321" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 74.420889][ T6851] device-mapper: table: 248:3: crypt: Error decoding and setting key (-ENOKEY) [ 74.420904][ T6851] device-mapper: ioctl: error adding target to table [ 74.524026][ T6860] FAULT_INJECTION: forcing a failure. [ 74.524026][ T6860] name failslab, interval 1, probability 0, space 0, times 0 [ 74.524044][ T6860] CPU: 0 UID: 0 PID: 6860 Comm: syz.0.327 Not tainted syzkaller #0 PREEMPT(full) [ 74.524055][ T6860] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 74.524062][ T6860] Call Trace: [ 74.524067][ T6860] [ 74.524072][ T6860] dump_stack_lvl+0x100/0x190 [ 74.524093][ T6860] should_fail_ex.cold+0x5/0xa [ 74.524110][ T6860] should_failslab+0xc2/0x120 [ 74.524123][ T6860] __kmalloc_cache_noprof+0x91/0x6d0 [ 74.524137][ T6860] ? vidtv_psi_service_list_desc_init+0x3be/0x550 [ 74.524151][ T6860] ? vidtv_psi_eit_table_init+0x4c/0x320 [ 74.524167][ T6860] vidtv_psi_eit_table_init+0x4c/0x320 [ 74.524183][ T6860] vidtv_channel_si_init+0xde5/0x18f0 [ 74.524202][ T6860] vidtv_mux_init+0x522/0xbf0 [ 74.524219][ T6860] vidtv_start_feed+0x34e/0x500 [ 74.524231][ T6860] ? __pfx_vidtv_start_feed+0x10/0x10 [ 74.524242][ T6860] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 74.524256][ T6860] ? find_held_lock+0x2b/0x80 [ 74.524271][ T6860] dmx_section_feed_start_filtering+0x3a8/0x660 [ 74.524289][ T6860] dvb_dmxdev_filter_start+0x767/0xdd0 [ 74.524304][ T6860] dvb_demux_do_ioctl+0xe64/0x1200 [ 74.524319][ T6860] dvb_usercopy+0x167/0x340 [ 74.524333][ T6860] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 74.524344][ T6860] ? __pfx_dvb_usercopy+0x10/0x10 [ 74.524359][ T6860] ? __fget_files+0x34/0x3d0 [ 74.524378][ T6860] ? selinux_file_ioctl+0x1e0/0x290 [ 74.524395][ T6860] dvb_demux_ioctl+0x29/0x40 [ 74.524409][ T6860] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 74.524425][ T6860] __x64_sys_ioctl+0x18e/0x210 [ 74.524439][ T6860] do_syscall_64+0x123/0x7b0 [ 74.524454][ T6860] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.524477][ T6860] RIP: 0033:0x7fbaba59fb19 [ 74.524488][ T6860] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.524499][ T6860] RSP: 002b:00007fbabb3d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 74.524510][ T6860] RAX: ffffffffffffffda RBX: 00007fbaba825fa0 RCX: 00007fbaba59fb19 [ 74.524516][ T6860] RDX: 0000200000000280 RSI: 00000000403c6f2b RDI: 0000000000000005 [ 74.524522][ T6860] RBP: 00007fbaba637b70 R08: 0000000000000000 R09: 0000000000000000 [ 74.524528][ T6860] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 74.524534][ T6860] R13: 00007fbaba826038 R14: 00007fbaba825fa0 R15: 00007ffc13239da8 [ 74.524549][ T6860] [ 74.525984][ T6860] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 74.525995][ T6860] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 74.526460][ T6860] netlink: 28 bytes leftover after parsing attributes in process `syz.0.327'. [ 74.526472][ T6860] netlink: 28 bytes leftover after parsing attributes in process `syz.0.327'. [ 74.526487][ T6860] netlink: 'syz.0.327': attribute type 4 has an invalid length. [ 74.690851][ T5871] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 74.708966][ T6866] snd_dummy snd_dummy.0: control 0:6:0:syz0:0 is already present [ 74.840809][ T5871] usb 7-1: Using ep0 maxpacket: 8 [ 74.841506][ T5871] usb 7-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 74.843962][ T5871] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 74.843980][ T5871] usb 7-1: config 0 has no interface number 0 [ 74.844014][ T5871] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 74.844031][ T5871] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 74.844050][ T5871] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 74.844070][ T5871] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 74.844100][ T5871] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 74.847012][ T5871] usb 7-1: config 0 descriptor?? [ 74.855641][ T5871] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 74.987860][ T6882] FAULT_INJECTION: forcing a failure. [ 74.987860][ T6882] name failslab, interval 1, probability 0, space 0, times 0 [ 74.987895][ T6882] CPU: 1 UID: 0 PID: 6882 Comm: syz.0.336 Not tainted syzkaller #0 PREEMPT(full) [ 74.987918][ T6882] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 74.987928][ T6882] Call Trace: [ 74.987935][ T6882] [ 74.987943][ T6882] dump_stack_lvl+0x100/0x190 [ 74.987979][ T6882] should_fail_ex.cold+0x5/0xa [ 74.988010][ T6882] should_failslab+0xc2/0x120 [ 74.988034][ T6882] __kmalloc_cache_noprof+0x91/0x6d0 [ 74.988058][ T6882] ? vidtv_psi_network_name_desc_init+0x183/0x310 [ 74.988083][ T6882] ? vidtv_psi_service_list_desc_init+0x52/0x550 [ 74.988111][ T6882] vidtv_psi_service_list_desc_init+0x52/0x550 [ 74.988147][ T6882] vidtv_psi_nit_table_init+0x39a/0x5f0 [ 74.988178][ T6882] vidtv_channel_si_init+0xccf/0x18f0 [ 74.988216][ T6882] vidtv_mux_init+0x522/0xbf0 [ 74.988250][ T6882] vidtv_start_feed+0x34e/0x500 [ 74.988272][ T6882] ? __pfx_vidtv_start_feed+0x10/0x10 [ 74.988293][ T6882] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 74.988320][ T6882] ? find_held_lock+0x2b/0x80 [ 74.988348][ T6882] dmx_section_feed_start_filtering+0x3a8/0x660 [ 74.988380][ T6882] dvb_dmxdev_filter_start+0x767/0xdd0 [ 74.988408][ T6882] dvb_demux_do_ioctl+0xe64/0x1200 [ 74.988438][ T6882] dvb_usercopy+0x167/0x340 [ 74.988464][ T6882] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 74.988504][ T6882] ? __pfx_dvb_usercopy+0x10/0x10 [ 74.988531][ T6882] ? __fget_files+0x34/0x3d0 [ 74.988569][ T6882] ? selinux_file_ioctl+0x1e0/0x290 [ 74.988591][ T6882] dvb_demux_ioctl+0x29/0x40 [ 74.988616][ T6882] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 74.988642][ T6882] __x64_sys_ioctl+0x18e/0x210 [ 74.988667][ T6882] do_syscall_64+0x123/0x7b0 [ 74.988694][ T6882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.988714][ T6882] RIP: 0033:0x7fbaba59fb19 [ 74.988732][ T6882] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.988750][ T6882] RSP: 002b:00007fbabb3d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 74.988768][ T6882] RAX: ffffffffffffffda RBX: 00007fbaba825fa0 RCX: 00007fbaba59fb19 [ 74.988782][ T6882] RDX: 0000200000000280 RSI: 00000000403c6f2b RDI: 0000000000000005 [ 74.988794][ T6882] RBP: 00007fbaba637b70 R08: 0000000000000000 R09: 0000000000000000 [ 74.988805][ T6882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 74.988815][ T6882] R13: 00007fbaba826038 R14: 00007fbaba825fa0 R15: 00007ffc13239da8 [ 74.988842][ T6882] [ 74.993308][ T6882] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 74.993320][ T6882] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 74.994779][ T6882] netlink: 28 bytes leftover after parsing attributes in process `syz.0.336'. [ 74.994796][ T6882] netlink: 28 bytes leftover after parsing attributes in process `syz.0.336'. [ 74.994808][ T6882] netlink: 'syz.0.336': attribute type 4 has an invalid length. [ 75.104085][ T974] usb 7-1: USB disconnect, device number 5 [ 75.112505][ T974] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 75.174670][ T5964] usb 8-1: USB disconnect, device number 3 [ 75.186350][ T5964] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 75.190592][ T5964] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 75.191147][ T5964] ti_usb_3410_5052 8-1:2.0: device disconnected [ 75.369052][ T6887] snd_dummy snd_dummy.0: control 0:6:0:syz0:0 is already present [ 75.478343][ T6900] netdevsim netdevsim3 netdevsim3: entered allmulticast mode [ 75.650211][ T6908] FAULT_INJECTION: forcing a failure. [ 75.650211][ T6908] name failslab, interval 1, probability 0, space 0, times 0 [ 75.650229][ T6908] CPU: 0 UID: 0 PID: 6908 Comm: syz.2.346 Not tainted syzkaller #0 PREEMPT(full) [ 75.650242][ T6908] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.650248][ T6908] Call Trace: [ 75.650253][ T6908] [ 75.650258][ T6908] dump_stack_lvl+0x100/0x190 [ 75.650280][ T6908] should_fail_ex.cold+0x5/0xa [ 75.650299][ T6908] should_failslab+0xc2/0x120 [ 75.650313][ T6908] __kmalloc_cache_noprof+0x91/0x6d0 [ 75.650328][ T6908] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 75.650342][ T6908] ? snd_seq_timer_new+0x44/0x1a0 [ 75.650359][ T6908] snd_seq_timer_new+0x44/0x1a0 [ 75.650374][ T6908] snd_seq_queue_alloc+0x177/0x540 [ 75.650388][ T6908] snd_seq_ioctl_create_queue+0xa9/0x370 [ 75.650406][ T6908] call_seq_client_ctl+0xa3/0x130 [ 75.650423][ T6908] snd_seq_kernel_client_ctl+0x7c/0xd0 [ 75.650440][ T6908] alloc_seq_queue+0xdb/0x180 [ 75.650450][ T6908] ? __pfx_alloc_seq_queue+0x10/0x10 [ 75.650466][ T6908] ? find_held_lock+0x2b/0x80 [ 75.650479][ T6908] ? mark_held_locks+0x40/0x70 [ 75.650495][ T6908] snd_seq_oss_open+0x2b2/0xa40 [ 75.650508][ T6908] odev_open+0x6f/0x90 [ 75.650517][ T6908] ? __pfx_odev_open+0x10/0x10 [ 75.650526][ T6908] soundcore_open+0x2e3/0x5a0 [ 75.650543][ T6908] ? __pfx_soundcore_open+0x10/0x10 [ 75.650558][ T6908] chrdev_open+0x234/0x6a0 [ 75.650572][ T6908] ? __pfx_chrdev_open+0x10/0x10 [ 75.650585][ T6908] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 75.650598][ T6908] do_dentry_open+0x674/0x1470 [ 75.650609][ T6908] ? __pfx_chrdev_open+0x10/0x10 [ 75.650627][ T6908] vfs_open_consume+0xcc/0x460 [ 75.650660][ T6908] path_openat+0x1547/0x23f0 [ 75.650678][ T6908] ? __pfx_path_openat+0x10/0x10 [ 75.650696][ T6908] do_file_open+0x20e/0x430 [ 75.650715][ T6908] ? __pfx_do_file_open+0x10/0x10 [ 75.650739][ T6908] ? _raw_spin_unlock+0x28/0x50 [ 75.650750][ T6908] ? alloc_fd+0x471/0x7a0 [ 75.650772][ T6908] do_sys_openat2+0x163/0x1d0 [ 75.650787][ T6908] ? __pfx_do_sys_openat2+0x10/0x10 [ 75.650808][ T6908] __x64_sys_openat+0x12d/0x210 [ 75.650824][ T6908] ? __pfx___x64_sys_openat+0x10/0x10 [ 75.650838][ T6908] ? ksys_write+0x1ac/0x250 [ 75.650854][ T6908] do_syscall_64+0x123/0x7b0 [ 75.650871][ T6908] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.650882][ T6908] RIP: 0033:0x7f7fcb59fb19 [ 75.650892][ T6908] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.650902][ T6908] RSP: 002b:00007f7fcc3bf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 75.650913][ T6908] RAX: ffffffffffffffda RBX: 00007f7fcb825fa0 RCX: 00007f7fcb59fb19 [ 75.650920][ T6908] RDX: 0000000000080200 RSI: 0000200000000a80 RDI: ffffffffffffff9c [ 75.650926][ T6908] RBP: 00007f7fcb637b70 R08: 0000000000000000 R09: 0000000000000000 [ 75.650932][ T6908] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.650940][ T6908] R13: 00007f7fcb826038 R14: 00007f7fcb825fa0 R15: 00007ffd47e961f8 [ 75.650954][ T6908] [ 75.701050][ T6910] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 75.731006][ T6910] netlink: 'syz.2.347': attribute type 4 has an invalid length. [ 75.731025][ T6910] netlink: 17 bytes leftover after parsing attributes in process `syz.2.347'. [ 75.806386][ T6915] xt_hashlimit: size too large, truncated to 1048576 [ 76.095713][ T6934] ecryptfs_validate_options: eCryptfs doesn't support cipher: aey_bytes=16 [ 76.095762][ T6934] Error validating options; rc = [-22] [ 76.477036][ T6945] snd_dummy snd_dummy.0: control 0:6:0:syz0:0 is already present [ 76.692316][ T6971] xt_hashlimit: size too large, truncated to 1048576 [ 76.704130][ T6973] nvmet_fc: nvme_fc_parse_traddr: bad traddr string [ 76.893770][ T6985] device-mapper: table: 248:1: crypt: Error decoding and setting key (-ENOKEY) [ 76.893799][ T6985] device-mapper: ioctl: error adding target to table [ 76.972315][ T6983] snd_dummy snd_dummy.0: control 0:6:0:syz0:0 is already present [ 77.150800][ T5892] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 77.267339][ T43] kauditd_printk_skb: 14 callbacks suppressed [ 77.267360][ T43] audit: type=1400 audit(1794229201.070:480): avc: denied { write } for pid=6995 comm="syz.2.378" name="subsystems" dev="configfs" ino=18781 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 77.281173][ T6996] nvmet_fc: nvme_fc_parse_traddr: bad traddr string [ 77.281573][ T43] audit: type=1400 audit(1794229201.090:481): avc: denied { write } for pid=6995 comm="syz.2.378" name="subsystems" dev="configfs" ino=18781 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 77.310858][ T5892] usb 8-1: Using ep0 maxpacket: 8 [ 77.311459][ T5892] usb 8-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 77.314643][ T5892] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 77.314665][ T5892] usb 8-1: config 0 has no interface number 0 [ 77.314697][ T5892] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 77.314719][ T5892] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 77.314742][ T5892] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 77.314762][ T5892] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 77.314795][ T5892] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.319650][ T5892] usb 8-1: config 0 descriptor?? [ 77.371430][ T5892] ldusb 8-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 77.591365][ T7011] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 77.593326][ T7011] netlink: 'syz.1.385': attribute type 4 has an invalid length. [ 77.593344][ T7011] netlink: 17 bytes leftover after parsing attributes in process `syz.1.385'. [ 77.616768][ T855] usb 8-1: USB disconnect, device number 4 [ 77.617035][ C0] ldusb 8-1:0.55: usb_submit_urb failed (-19) [ 77.630451][ T6985] ldusb 8-1:0.55: Couldn't submit interrupt_out_urb -19 [ 77.630610][ T855] ldusb 8-1:0.55: LD USB Device #0 now disconnected [ 78.049345][ T7026] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 78.120827][ T7034] Mount JFS Failure: -5 [ 78.120839][ T7034] jfs_mount failed w/return code = -5 [ 78.227797][ T7047] Bluetooth: hci0: unsupported parameter 255 [ 78.227817][ T7047] Bluetooth: hci0: unsupported parameter 255 [ 78.276095][ T7050] xt_hashlimit: size too large, truncated to 1048576 [ 78.390016][ T43] audit: type=1400 audit(1794229202.190:482): avc: denied { append } for pid=7056 comm="syz.2.402" name="fb0" dev="devtmpfs" ino=638 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 78.513339][ T7064] FAULT_INJECTION: forcing a failure. [ 78.513339][ T7064] name failslab, interval 1, probability 0, space 0, times 0 [ 78.513368][ T7064] CPU: 1 UID: 0 PID: 7064 Comm: syz.2.405 Not tainted syzkaller #0 PREEMPT(full) [ 78.513390][ T7064] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.513418][ T7064] Call Trace: [ 78.513431][ T7064] [ 78.513439][ T7064] dump_stack_lvl+0x100/0x190 [ 78.513496][ T7064] should_fail_ex.cold+0x5/0xa [ 78.513536][ T7064] should_failslab+0xc2/0x120 [ 78.513564][ T7064] __kmalloc_cache_noprof+0x91/0x6d0 [ 78.513591][ T7064] ? lockdep_init_map_type+0x5c/0x250 [ 78.513619][ T7064] ? snd_seq_prioq_new+0x3f/0x110 [ 78.513654][ T7064] snd_seq_prioq_new+0x3f/0x110 [ 78.513679][ T7064] snd_seq_queue_alloc+0x153/0x540 [ 78.513705][ T7064] snd_seq_ioctl_create_queue+0xa9/0x370 [ 78.513736][ T7064] call_seq_client_ctl+0xa3/0x130 [ 78.513764][ T7064] snd_seq_kernel_client_ctl+0x7c/0xd0 [ 78.513795][ T7064] alloc_seq_queue+0xdb/0x180 [ 78.513813][ T7064] ? __pfx_alloc_seq_queue+0x10/0x10 [ 78.513843][ T7064] ? find_held_lock+0x2b/0x80 [ 78.513866][ T7064] ? mark_held_locks+0x40/0x70 [ 78.513895][ T7064] snd_seq_oss_open+0x2b2/0xa40 [ 78.513918][ T7064] odev_open+0x6f/0x90 [ 78.513933][ T7064] ? __pfx_odev_open+0x10/0x10 [ 78.513949][ T7064] soundcore_open+0x2e3/0x5a0 [ 78.513980][ T7064] ? __pfx_soundcore_open+0x10/0x10 [ 78.514015][ T7064] chrdev_open+0x234/0x6a0 [ 78.514041][ T7064] ? __pfx_chrdev_open+0x10/0x10 [ 78.514067][ T7064] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 78.514092][ T7064] do_dentry_open+0x674/0x1470 [ 78.514112][ T7064] ? __pfx_chrdev_open+0x10/0x10 [ 78.514139][ T7064] vfs_open_consume+0xcc/0x460 [ 78.514168][ T7064] path_openat+0x1547/0x23f0 [ 78.514196][ T7064] ? __pfx_path_openat+0x10/0x10 [ 78.514226][ T7064] do_file_open+0x20e/0x430 [ 78.514253][ T7064] ? __pfx_do_file_open+0x10/0x10 [ 78.514294][ T7064] ? _raw_spin_unlock+0x28/0x50 [ 78.514320][ T7064] ? alloc_fd+0x471/0x7a0 [ 78.514351][ T7064] do_sys_openat2+0x163/0x1d0 [ 78.514375][ T7064] ? __pfx_do_sys_openat2+0x10/0x10 [ 78.514409][ T7064] __x64_sys_openat+0x12d/0x210 [ 78.514435][ T7064] ? __pfx___x64_sys_openat+0x10/0x10 [ 78.514470][ T7064] do_syscall_64+0x123/0x7b0 [ 78.514494][ T7064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.514511][ T7064] RIP: 0033:0x7f7fcb59fb19 [ 78.514528][ T7064] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.514546][ T7064] RSP: 002b:00007f7fcc3bf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 78.514566][ T7064] RAX: ffffffffffffffda RBX: 00007f7fcb825fa0 RCX: 00007f7fcb59fb19 [ 78.514577][ T7064] RDX: 0000000000080200 RSI: 0000200000000a80 RDI: ffffffffffffff9c [ 78.514588][ T7064] RBP: 00007f7fcb637b70 R08: 0000000000000000 R09: 0000000000000000 [ 78.514599][ T7064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 78.514610][ T7064] R13: 00007f7fcb826038 R14: 00007f7fcb825fa0 R15: 00007ffd47e961f8 [ 78.514634][ T7064] [ 78.645947][ T7068] xt_hashlimit: size too large, truncated to 1048576 [ 78.867682][ T7074] netlink: 24 bytes leftover after parsing attributes in process `syz.1.409'. [ 78.997885][ T7083] FAULT_INJECTION: forcing a failure. [ 78.997885][ T7083] name failslab, interval 1, probability 0, space 0, times 0 [ 78.997913][ T7083] CPU: 1 UID: 0 PID: 7083 Comm: syz.2.414 Not tainted syzkaller #0 PREEMPT(full) [ 78.997934][ T7083] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.997944][ T7083] Call Trace: [ 78.997951][ T7083] [ 78.997959][ T7083] dump_stack_lvl+0x100/0x190 [ 78.997993][ T7083] should_fail_ex.cold+0x5/0xa [ 78.998023][ T7083] should_failslab+0xc2/0x120 [ 78.998047][ T7083] __kmalloc_cache_noprof+0x91/0x6d0 [ 78.998083][ T7083] ? lockdep_init_map_type+0x5c/0x250 [ 78.998111][ T7083] ? snd_seq_prioq_new+0x3f/0x110 [ 78.998142][ T7083] snd_seq_prioq_new+0x3f/0x110 [ 78.998171][ T7083] snd_seq_queue_alloc+0x153/0x540 [ 78.998198][ T7083] snd_seq_ioctl_create_queue+0xa9/0x370 [ 78.998227][ T7083] call_seq_client_ctl+0xa3/0x130 [ 78.998255][ T7083] snd_seq_kernel_client_ctl+0x7c/0xd0 [ 78.998279][ T7083] alloc_seq_queue+0xdb/0x180 [ 78.998294][ T7083] ? __pfx_alloc_seq_queue+0x10/0x10 [ 78.998319][ T7083] ? find_held_lock+0x2b/0x80 [ 78.998337][ T7083] ? mark_held_locks+0x40/0x70 [ 78.998360][ T7083] snd_seq_oss_open+0x2b2/0xa40 [ 78.998379][ T7083] odev_open+0x6f/0x90 [ 78.998391][ T7083] ? __pfx_odev_open+0x10/0x10 [ 78.998404][ T7083] soundcore_open+0x2e3/0x5a0 [ 78.998429][ T7083] ? __pfx_soundcore_open+0x10/0x10 [ 78.998451][ T7083] chrdev_open+0x234/0x6a0 [ 78.998470][ T7083] ? __pfx_chrdev_open+0x10/0x10 [ 78.998489][ T7083] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 78.998508][ T7083] do_dentry_open+0x674/0x1470 [ 78.998524][ T7083] ? __pfx_chrdev_open+0x10/0x10 [ 78.998545][ T7083] vfs_open_consume+0xcc/0x460 [ 78.998569][ T7083] path_openat+0x1547/0x23f0 [ 78.998593][ T7083] ? __pfx_path_openat+0x10/0x10 [ 78.998621][ T7083] do_file_open+0x20e/0x430 [ 78.998643][ T7083] ? __pfx_do_file_open+0x10/0x10 [ 78.998683][ T7083] ? _raw_spin_unlock+0x28/0x50 [ 78.998702][ T7083] ? alloc_fd+0x471/0x7a0 [ 78.998738][ T7083] do_sys_openat2+0x163/0x1d0 [ 78.998765][ T7083] ? __pfx_do_sys_openat2+0x10/0x10 [ 78.998800][ T7083] __x64_sys_openat+0x12d/0x210 [ 78.998826][ T7083] ? __pfx___x64_sys_openat+0x10/0x10 [ 78.998855][ T7083] do_syscall_64+0x123/0x7b0 [ 78.998893][ T7083] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.998915][ T7083] RIP: 0033:0x7f7fcb59fb19 [ 78.998932][ T7083] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.998949][ T7083] RSP: 002b:00007f7fcc3bf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 78.998968][ T7083] RAX: ffffffffffffffda RBX: 00007f7fcb825fa0 RCX: 00007f7fcb59fb19 [ 78.998980][ T7083] RDX: 0000000000080200 RSI: 0000200000000a80 RDI: ffffffffffffff9c [ 78.998992][ T7083] RBP: 00007f7fcb637b70 R08: 0000000000000000 R09: 0000000000000000 [ 78.999003][ T7083] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 78.999014][ T7083] R13: 00007f7fcb826038 R14: 00007f7fcb825fa0 R15: 00007ffd47e961f8 [ 78.999039][ T7083] [ 79.143182][ T7090] xt_hashlimit: size too large, truncated to 1048576 [ 79.286865][ T7101] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 79.286886][ T7101] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 79.406724][ T7106] device-mapper: table: 248:3: crypt: Error decoding and setting key (-ENOKEY) [ 79.406746][ T7106] device-mapper: ioctl: error adding target to table [ 79.670779][ T855] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 79.830911][ T855] usb 7-1: Using ep0 maxpacket: 8 [ 79.831361][ T855] usb 7-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 79.832181][ T855] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 79.832193][ T855] usb 7-1: config 0 has no interface number 0 [ 79.832210][ T855] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 79.832221][ T855] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 79.832232][ T855] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 79.832244][ T855] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 79.832263][ T855] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.833926][ T855] usb 7-1: config 0 descriptor?? [ 79.839626][ T855] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 80.088275][ T974] usb 7-1: USB disconnect, device number 6 [ 80.090373][ T974] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 80.126973][ T7118] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 80.128201][ T7118] netlink: 'syz.0.427': attribute type 4 has an invalid length. [ 80.128213][ T7118] netlink: 17 bytes leftover after parsing attributes in process `syz.0.427'. [ 80.129020][ T7118] FAULT_INJECTION: forcing a failure. [ 80.129020][ T7118] name failslab, interval 1, probability 0, space 0, times 0 [ 80.129035][ T7118] CPU: 1 UID: 0 PID: 7118 Comm: syz.0.427 Not tainted syzkaller #0 PREEMPT(full) [ 80.129049][ T7118] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.129058][ T7118] Call Trace: [ 80.129063][ T7118] [ 80.129070][ T7118] dump_stack_lvl+0x100/0x190 [ 80.129102][ T7118] should_fail_ex.cold+0x5/0xa [ 80.129126][ T7118] should_failslab+0xc2/0x120 [ 80.129138][ T7118] kmem_cache_alloc_noprof+0x92/0x6a0 [ 80.129155][ T7118] ? fib_insert_alias+0x43e/0xe30 [ 80.129174][ T7118] fib_insert_alias+0x43e/0xe30 [ 80.129190][ T7118] ? lockdep_rtnl_is_held+0x26/0x40 [ 80.129203][ T7118] ? fib_find_node+0x209/0x280 [ 80.129219][ T7118] fib_trie_unmerge+0x2af/0xc00 [ 80.129232][ T7118] ? __pfx_fib_trie_unmerge+0x10/0x10 [ 80.129245][ T7118] ? lock_acquire+0x1d1/0x380 [ 80.129262][ T7118] fib_unmerge+0xee/0x510 [ 80.129274][ T7118] ? fib_nl2rule_locked+0x3ef/0x740 [ 80.129287][ T7118] fib4_rule_configure+0xaba/0x1160 [ 80.129301][ T7118] ? fib_nl2rule_locked+0x3fe/0x740 [ 80.129312][ T7118] fib_newrule+0x3c3/0x1e50 [ 80.129325][ T7118] ? avc_has_perm_noaudit+0x11e/0x470 [ 80.129340][ T7118] ? __pfx_fib_newrule+0x10/0x10 [ 80.129351][ T7118] ? avc_has_perm_noaudit+0xf0/0x470 [ 80.129375][ T7118] ? rtnetlink_rcv_msg+0x1f6/0xe90 [ 80.129391][ T7118] ? find_held_lock+0x2b/0x80 [ 80.129401][ T7118] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 80.129415][ T7118] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 80.129431][ T7118] ? __pfx_fib_nl_newrule+0x10/0x10 [ 80.129442][ T7118] rtnetlink_rcv_msg+0x95e/0xe90 [ 80.129458][ T7118] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 80.129484][ T7118] netlink_rcv_skb+0x159/0x420 [ 80.129498][ T7118] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 80.129516][ T7118] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 80.129530][ T7118] ? __asan_memcpy+0x3c/0x60 [ 80.129551][ T7118] ? netlink_deliver_tap+0x1ae/0xb50 [ 80.129568][ T7118] netlink_unicast+0x668/0x950 [ 80.129585][ T7118] ? __pfx_netlink_unicast+0x10/0x10 [ 80.129604][ T7118] netlink_sendmsg+0x9ac/0x10c0 [ 80.129621][ T7118] ? __pfx_netlink_sendmsg+0x10/0x10 [ 80.129640][ T7118] ? selinux_socket_sendmsg+0x198/0x2f0 [ 80.129657][ T7118] ? ____sys_sendmsg+0xa99/0xc30 [ 80.129673][ T7118] ____sys_sendmsg+0xa99/0xc30 [ 80.129687][ T7118] ? __pfx_netlink_sendmsg+0x10/0x10 [ 80.129702][ T7118] ? __pfx_____sys_sendmsg+0x10/0x10 [ 80.129721][ T7118] ? plist_del+0x308/0x510 [ 80.129734][ T7118] ___sys_sendmsg+0x190/0x1e0 [ 80.129751][ T7118] ? __pfx____sys_sendmsg+0x10/0x10 [ 80.129767][ T7118] ? futex_wake+0x220/0x5e0 [ 80.129787][ T7118] ? find_held_lock+0x2b/0x80 [ 80.129807][ T7118] __sys_sendmsg+0x160/0x210 [ 80.129820][ T7118] ? __pfx___sys_sendmsg+0x10/0x10 [ 80.129841][ T7118] do_syscall_64+0x123/0x7b0 [ 80.129854][ T7118] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.129865][ T7118] RIP: 0033:0x7fbaba59fb19 [ 80.129875][ T7118] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.129885][ T7118] RSP: 002b:00007fbabb3d6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 80.129895][ T7118] RAX: ffffffffffffffda RBX: 00007fbaba825fa0 RCX: 00007fbaba59fb19 [ 80.129902][ T7118] RDX: 0000000000004000 RSI: 0000200000000300 RDI: 0000000000000006 [ 80.129908][ T7118] RBP: 00007fbaba637b70 R08: 0000000000000000 R09: 0000000000000000 [ 80.129914][ T7118] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 80.129920][ T7118] R13: 00007fbaba826038 R14: 00007fbaba825fa0 R15: 00007ffc13239da8 [ 80.129936][ T7118] [ 80.203060][ T7125] netlink: 'syz.0.430': attribute type 25 has an invalid length. [ 80.205100][ T7126] device-mapper: table: 248:1: verity: Device must be readonly (-EINVAL) [ 80.205122][ T7126] device-mapper: ioctl: error adding target to table [ 80.263965][ T7132] xt_hashlimit: size too large, truncated to 1048576 [ 80.384251][ T43] audit: type=1400 audit(1794229204.190:483): avc: denied { write } for pid=7141 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 80.430405][ T43] audit: type=1400 audit(1794229204.230:484): avc: denied { write } for pid=7146 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 80.485207][ T7152] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 80.486974][ T7152] netlink: 'syz.0.439': attribute type 4 has an invalid length. [ 80.486989][ T7152] netlink: 17 bytes leftover after parsing attributes in process `syz.0.439'. [ 80.487745][ T7152] FAULT_INJECTION: forcing a failure. [ 80.487745][ T7152] name failslab, interval 1, probability 0, space 0, times 0 [ 80.487759][ T7152] CPU: 1 UID: 0 PID: 7152 Comm: syz.0.439 Not tainted syzkaller #0 PREEMPT(full) [ 80.487772][ T7152] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.487779][ T7152] Call Trace: [ 80.487784][ T7152] [ 80.487788][ T7152] dump_stack_lvl+0x100/0x190 [ 80.487812][ T7152] should_fail_ex.cold+0x5/0xa [ 80.487829][ T7152] should_failslab+0xc2/0x120 [ 80.487844][ T7152] __kmalloc_flags_noprof+0x122/0x8e0 [ 80.487860][ T7152] ? alloc_slab_obj_exts+0x6a/0x170 [ 80.487877][ T7152] alloc_slab_obj_exts+0x6a/0x170 [ 80.487893][ T7152] __memcg_slab_post_alloc_hook+0x3f3/0x10b0 [ 80.487914][ T7152] ? kasan_save_track+0x14/0x30 [ 80.487927][ T7152] kmem_cache_alloc_noprof+0x4f5/0x6a0 [ 80.487943][ T7152] ? fib_trie_unmerge+0x246/0xc00 [ 80.487957][ T7152] fib_trie_unmerge+0x246/0xc00 [ 80.487970][ T7152] ? __pfx_fib_trie_unmerge+0x10/0x10 [ 80.487983][ T7152] ? lock_acquire+0x1d1/0x380 [ 80.488000][ T7152] fib_unmerge+0xee/0x510 [ 80.488010][ T7152] ? fib_nl2rule_locked+0x3ef/0x740 [ 80.488024][ T7152] fib4_rule_configure+0xaba/0x1160 [ 80.488039][ T7152] ? fib_nl2rule_locked+0x3fe/0x740 [ 80.488050][ T7152] fib_newrule+0x3c3/0x1e50 [ 80.488062][ T7152] ? avc_has_perm_noaudit+0x11e/0x470 [ 80.488078][ T7152] ? __pfx_fib_newrule+0x10/0x10 [ 80.488088][ T7152] ? avc_has_perm_noaudit+0xf0/0x470 [ 80.488112][ T7152] ? rtnetlink_rcv_msg+0x1f6/0xe90 [ 80.488127][ T7152] ? find_held_lock+0x2b/0x80 [ 80.488138][ T7152] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 80.488152][ T7152] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 80.488172][ T7152] ? __pfx_fib_nl_newrule+0x10/0x10 [ 80.488183][ T7152] rtnetlink_rcv_msg+0x95e/0xe90 [ 80.488199][ T7152] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 80.488220][ T7152] netlink_rcv_skb+0x159/0x420 [ 80.488235][ T7152] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 80.488250][ T7152] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 80.488264][ T7152] ? __asan_memcpy+0x3c/0x60 [ 80.488285][ T7152] ? netlink_deliver_tap+0x1ae/0xb50 [ 80.488303][ T7152] netlink_unicast+0x668/0x950 [ 80.488319][ T7152] ? __pfx_netlink_unicast+0x10/0x10 [ 80.488337][ T7152] netlink_sendmsg+0x9ac/0x10c0 [ 80.488357][ T7152] ? __pfx_netlink_sendmsg+0x10/0x10 [ 80.488378][ T7152] ? selinux_socket_sendmsg+0x198/0x2f0 [ 80.488396][ T7152] ? ____sys_sendmsg+0xa99/0xc30 [ 80.488412][ T7152] ____sys_sendmsg+0xa99/0xc30 [ 80.488428][ T7152] ? __pfx_netlink_sendmsg+0x10/0x10 [ 80.488444][ T7152] ? __pfx_____sys_sendmsg+0x10/0x10 [ 80.488466][ T7152] ___sys_sendmsg+0x190/0x1e0 [ 80.488483][ T7152] ? __pfx____sys_sendmsg+0x10/0x10 [ 80.488501][ T7152] ? futex_wait+0x11e/0x370 [ 80.488522][ T7152] ? find_held_lock+0x2b/0x80 [ 80.488541][ T7152] __sys_sendmsg+0x160/0x210 [ 80.488554][ T7152] ? __pfx___sys_sendmsg+0x10/0x10 [ 80.488575][ T7152] do_syscall_64+0x123/0x7b0 [ 80.488589][ T7152] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.488601][ T7152] RIP: 0033:0x7fbaba59fb19 [ 80.488610][ T7152] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.488621][ T7152] RSP: 002b:00007fbabb3d6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 80.488632][ T7152] RAX: ffffffffffffffda RBX: 00007fbaba825fa0 RCX: 00007fbaba59fb19 [ 80.488639][ T7152] RDX: 0000000000004000 RSI: 0000200000000300 RDI: 0000000000000006 [ 80.488645][ T7152] RBP: 00007fbaba637b70 R08: 0000000000000000 R09: 0000000000000000 [ 80.488651][ T7152] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 80.488657][ T7152] R13: 00007fbaba826038 R14: 00007fbaba825fa0 R15: 00007ffc13239da8 [ 80.488671][ T7152] [ 80.556853][ T7154] batman_adv: batadv0: Adding interface: dummy0 [ 80.556869][ T7154] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.556895][ T7154] batman_adv: batadv0: Interface activated: dummy0 [ 80.570897][ T7154] batadv0: mtu less than device minimum [ 80.571962][ T7154] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 80.573030][ T7154] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 80.573906][ T7154] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 80.574897][ T7154] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 80.575862][ T7154] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 80.576796][ T7154] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 80.577804][ T7154] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 80.659145][ T7156] netlink: 'syz.2.441': attribute type 25 has an invalid length. [ 81.113358][ T7176] tipc: Trying to set illegal importance in message [ 81.157694][ T7182] xt_hashlimit: size too large, truncated to 1048576 [ 81.627131][ T7202] FAULT_INJECTION: forcing a failure. [ 81.627131][ T7202] name failslab, interval 1, probability 0, space 0, times 0 [ 81.627174][ T7202] CPU: 1 UID: 0 PID: 7202 Comm: syz.3.458 Not tainted syzkaller #0 PREEMPT(full) [ 81.627198][ T7202] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 81.627221][ T7202] Call Trace: [ 81.627235][ T7202] [ 81.627244][ T7202] dump_stack_lvl+0x100/0x190 [ 81.627301][ T7202] should_fail_ex.cold+0x5/0xa [ 81.627342][ T7202] should_failslab+0xc2/0x120 [ 81.627370][ T7202] __kmalloc_noprof+0xfc/0x840 [ 81.627401][ T7202] ? vidtv_psi_pmt_create_sec_for_each_pat_entry+0x189/0x670 [ 81.627440][ T7202] vidtv_psi_pmt_create_sec_for_each_pat_entry+0x189/0x670 [ 81.627473][ T7202] vidtv_channel_si_init+0xf2d/0x18f0 [ 81.627508][ T7202] vidtv_mux_init+0x522/0xbf0 [ 81.627537][ T7202] vidtv_start_feed+0x34e/0x500 [ 81.627562][ T7202] ? __pfx_vidtv_start_feed+0x10/0x10 [ 81.627585][ T7202] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 81.627611][ T7202] ? find_held_lock+0x2b/0x80 [ 81.627637][ T7202] dmx_section_feed_start_filtering+0x3a8/0x660 [ 81.627668][ T7202] dvb_dmxdev_filter_start+0x767/0xdd0 [ 81.627693][ T7202] dvb_demux_do_ioctl+0xe64/0x1200 [ 81.627721][ T7202] dvb_usercopy+0x167/0x340 [ 81.627747][ T7202] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 81.627767][ T7202] ? __pfx_dvb_usercopy+0x10/0x10 [ 81.627789][ T7202] ? __fget_files+0x34/0x3d0 [ 81.627824][ T7202] ? selinux_file_ioctl+0x1e0/0x290 [ 81.627849][ T7202] dvb_demux_ioctl+0x29/0x40 [ 81.627873][ T7202] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 81.627904][ T7202] __x64_sys_ioctl+0x18e/0x210 [ 81.627928][ T7202] do_syscall_64+0x123/0x7b0 [ 81.627963][ T7202] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.627982][ T7202] RIP: 0033:0x7fbd9799fb19 [ 81.628000][ T7202] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 81.628020][ T7202] RSP: 002b:00007fbd98819028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 81.628040][ T7202] RAX: ffffffffffffffda RBX: 00007fbd97c25fa0 RCX: 00007fbd9799fb19 [ 81.628050][ T7202] RDX: 0000200000000280 RSI: 00000000403c6f2b RDI: 0000000000000005 [ 81.628060][ T7202] RBP: 00007fbd97a37b70 R08: 0000000000000000 R09: 0000000000000000 [ 81.628071][ T7202] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 81.628081][ T7202] R13: 00007fbd97c26038 R14: 00007fbd97c25fa0 R15: 00007ffc998e8f18 [ 81.628105][ T7202] [ 81.637023][ T7202] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 81.637046][ T7202] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 81.717498][ T43] audit: type=1400 audit(1794229205.520:485): avc: denied { read } for pid=7209 comm="syz.0.461" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 81.762099][ T7215] netlink: 24 bytes leftover after parsing attributes in process `syz.0.464'. [ 81.828157][ T7221] netlink: 20 bytes leftover after parsing attributes in process `syz.0.467'. [ 81.883553][ T7224] nvmet: Invalid value 'f' for adrfam [ 81.884216][ T7224] nvmet_fc: nvme_fc_parse_traddr: bad traddr string [ 81.884316][ T43] audit: type=1400 audit(1794229205.690:486): avc: denied { write } for pid=7223 comm="syz.2.469" name="subsystems" dev="configfs" ino=18781 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 81.884359][ T43] audit: type=1400 audit(1794229205.690:487): avc: denied { write } for pid=7223 comm="syz.2.469" name="subsystems" dev="configfs" ino=18781 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 82.087682][ T43] audit: type=1400 audit(1794229205.890:488): avc: denied { name_bind } for pid=7242 comm="syz.1.478" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 82.182261][ T7249] netlink: 'syz.2.480': attribute type 4 has an invalid length. [ 82.182281][ T7249] netlink: 17 bytes leftover after parsing attributes in process `syz.2.480'. [ 82.241833][ T7252] FAULT_INJECTION: forcing a failure. [ 82.241833][ T7252] name failslab, interval 1, probability 0, space 0, times 0 [ 82.241954][ T7252] CPU: 0 UID: 0 PID: 7252 Comm: syz.2.481 Not tainted syzkaller #0 PREEMPT(full) [ 82.241972][ T7252] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 82.241979][ T7252] Call Trace: [ 82.241983][ T7252] [ 82.241989][ T7252] dump_stack_lvl+0x100/0x190 [ 82.242012][ T7252] should_fail_ex.cold+0x5/0xa [ 82.242031][ T7252] should_failslab+0xc2/0x120 [ 82.242046][ T7252] __kmalloc_cache_noprof+0x91/0x6d0 [ 82.242062][ T7252] ? lockdep_init_map_type+0x5c/0x250 [ 82.242081][ T7252] ? snd_seq_prioq_new+0x3f/0x110 [ 82.242099][ T7252] snd_seq_prioq_new+0x3f/0x110 [ 82.242114][ T7252] snd_seq_queue_alloc+0x153/0x540 [ 82.242129][ T7252] snd_seq_ioctl_create_queue+0xa9/0x370 [ 82.242148][ T7252] call_seq_client_ctl+0xa3/0x130 [ 82.242174][ T7252] snd_seq_kernel_client_ctl+0x7c/0xd0 [ 82.242199][ T7252] alloc_seq_queue+0xdb/0x180 [ 82.242217][ T7252] ? __pfx_alloc_seq_queue+0x10/0x10 [ 82.242246][ T7252] ? find_held_lock+0x2b/0x80 [ 82.242270][ T7252] ? mark_held_locks+0x40/0x70 [ 82.242298][ T7252] snd_seq_oss_open+0x2b2/0xa40 [ 82.242323][ T7252] odev_open+0x6f/0x90 [ 82.242340][ T7252] ? __pfx_odev_open+0x10/0x10 [ 82.242356][ T7252] soundcore_open+0x2e3/0x5a0 [ 82.242387][ T7252] ? __pfx_soundcore_open+0x10/0x10 [ 82.242415][ T7252] chrdev_open+0x234/0x6a0 [ 82.242439][ T7252] ? __pfx_chrdev_open+0x10/0x10 [ 82.242463][ T7252] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 82.242480][ T7252] do_dentry_open+0x674/0x1470 [ 82.242492][ T7252] ? __pfx_chrdev_open+0x10/0x10 [ 82.242507][ T7252] vfs_open_consume+0xcc/0x460 [ 82.242543][ T7252] path_openat+0x1547/0x23f0 [ 82.242562][ T7252] ? __pfx_path_openat+0x10/0x10 [ 82.242585][ T7252] do_file_open+0x20e/0x430 [ 82.242601][ T7252] ? __pfx_do_file_open+0x10/0x10 [ 82.242634][ T7252] ? _raw_spin_unlock+0x28/0x50 [ 82.242651][ T7252] ? alloc_fd+0x471/0x7a0 [ 82.242685][ T7252] do_sys_openat2+0x163/0x1d0 [ 82.242713][ T7252] ? __pfx_do_sys_openat2+0x10/0x10 [ 82.242767][ T7252] __x64_sys_openat+0x12d/0x210 [ 82.242797][ T7252] ? __pfx___x64_sys_openat+0x10/0x10 [ 82.242837][ T7252] do_syscall_64+0x123/0x7b0 [ 82.242861][ T7252] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.242882][ T7252] RIP: 0033:0x7f7fcb59fb19 [ 82.242898][ T7252] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 82.242916][ T7252] RSP: 002b:00007f7fcc3bf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 82.242930][ T7252] RAX: ffffffffffffffda RBX: 00007f7fcb825fa0 RCX: 00007f7fcb59fb19 [ 82.242938][ T7252] RDX: 0000000000080200 RSI: 0000200000000a80 RDI: ffffffffffffff9c [ 82.242946][ T7252] RBP: 00007f7fcb637b70 R08: 0000000000000000 R09: 0000000000000000 [ 82.242953][ T7252] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 82.242961][ T7252] R13: 00007f7fcb826038 R14: 00007f7fcb825fa0 R15: 00007ffd47e961f8 [ 82.242981][ T7252] [ 82.296063][ T7255] netlink: 'syz.2.482': attribute type 25 has an invalid length. [ 82.489572][ T7261] xt_hashlimit: size too large, truncated to 1048576 [ 82.545229][ T7263] netlink: 'syz.3.485': attribute type 2 has an invalid length. [ 82.718820][ T7269] syzkaller0: entered promiscuous mode [ 82.718842][ T7269] syzkaller0: entered allmulticast mode [ 83.003840][ T7289] netlink: 'syz.1.498': attribute type 4 has an invalid length. [ 83.003860][ T7289] netlink: 17 bytes leftover after parsing attributes in process `syz.1.498'. [ 83.137154][ T43] audit: type=1400 audit(1794229206.940:489): avc: denied { ioctl } for pid=7303 comm="syz.2.503" path="/dev/snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 83.137322][ T7304] random: crng reseeded on system resumption [ 83.265457][ T7312] netlink: 'syz.2.507': attribute type 3 has an invalid length. [ 83.316762][ T7317] netlink: 'syz.3.509': attribute type 4 has an invalid length. [ 83.316776][ T7317] netlink: 17 bytes leftover after parsing attributes in process `syz.3.509'. [ 83.317944][ T7317] FAULT_INJECTION: forcing a failure. [ 83.317944][ T7317] name failslab, interval 1, probability 0, space 0, times 0 [ 83.317961][ T7317] CPU: 3 UID: 0 PID: 7317 Comm: syz.3.509 Not tainted syzkaller #0 PREEMPT(full) [ 83.317973][ T7317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 83.317989][ T7317] Call Trace: [ 83.317997][ T7317] [ 83.318001][ T7317] dump_stack_lvl+0x100/0x190 [ 83.318055][ T7317] should_fail_ex.cold+0x5/0xa [ 83.318087][ T7317] should_failslab+0xc2/0x120 [ 83.318111][ T7317] kmem_cache_alloc_noprof+0x92/0x6a0 [ 83.318141][ T7317] ? fib_trie_unmerge+0x246/0xc00 [ 83.318169][ T7317] fib_trie_unmerge+0x246/0xc00 [ 83.318192][ T7317] ? __pfx_fib_trie_unmerge+0x10/0x10 [ 83.318212][ T7317] ? lock_acquire+0x1d1/0x380 [ 83.318239][ T7317] fib_unmerge+0xee/0x510 [ 83.318255][ T7317] ? fib_nl2rule_locked+0x3ef/0x740 [ 83.318277][ T7317] fib4_rule_configure+0xaba/0x1160 [ 83.318300][ T7317] ? fib_nl2rule_locked+0x3fe/0x740 [ 83.318318][ T7317] fib_newrule+0x3c3/0x1e50 [ 83.318339][ T7317] ? avc_has_perm_noaudit+0x11e/0x470 [ 83.318361][ T7317] ? __pfx_fib_newrule+0x10/0x10 [ 83.318377][ T7317] ? avc_has_perm_noaudit+0xf0/0x470 [ 83.318415][ T7317] ? rtnetlink_rcv_msg+0x1f6/0xe90 [ 83.318438][ T7317] ? find_held_lock+0x2b/0x80 [ 83.318456][ T7317] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 83.318477][ T7317] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 83.318501][ T7317] ? __pfx_fib_nl_newrule+0x10/0x10 [ 83.318519][ T7317] rtnetlink_rcv_msg+0x95e/0xe90 [ 83.318542][ T7317] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 83.318577][ T7317] netlink_rcv_skb+0x159/0x420 [ 83.318600][ T7317] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 83.318625][ T7317] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 83.318643][ T7317] ? __asan_memcpy+0x3c/0x60 [ 83.318674][ T7317] ? netlink_deliver_tap+0x1ae/0xb50 [ 83.318700][ T7317] netlink_unicast+0x668/0x950 [ 83.318729][ T7317] ? __pfx_netlink_unicast+0x10/0x10 [ 83.318758][ T7317] netlink_sendmsg+0x9ac/0x10c0 [ 83.318787][ T7317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 83.318816][ T7317] ? selinux_socket_sendmsg+0x198/0x2f0 [ 83.318841][ T7317] ? ____sys_sendmsg+0xa99/0xc30 [ 83.318899][ T7317] ____sys_sendmsg+0xa99/0xc30 [ 83.318925][ T7317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 83.318951][ T7317] ? __pfx_____sys_sendmsg+0x10/0x10 [ 83.318987][ T7317] ___sys_sendmsg+0x190/0x1e0 [ 83.319016][ T7317] ? __pfx____sys_sendmsg+0x10/0x10 [ 83.319039][ T7317] ? futex_wait+0x11e/0x370 [ 83.319081][ T7317] ? find_held_lock+0x2b/0x80 [ 83.319118][ T7317] __sys_sendmsg+0x160/0x210 [ 83.319141][ T7317] ? __pfx___sys_sendmsg+0x10/0x10 [ 83.319174][ T7317] do_syscall_64+0x123/0x7b0 [ 83.319206][ T7317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.319225][ T7317] RIP: 0033:0x7fbd9799fb19 [ 83.319241][ T7317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.319255][ T7317] RSP: 002b:00007fbd98819028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 83.319273][ T7317] RAX: ffffffffffffffda RBX: 00007fbd97c25fa0 RCX: 00007fbd9799fb19 [ 83.319283][ T7317] RDX: 0000000000004000 RSI: 0000200000000300 RDI: 0000000000000006 [ 83.319293][ T7317] RBP: 00007fbd97a37b70 R08: 0000000000000000 R09: 0000000000000000 [ 83.319304][ T7317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.319312][ T7317] R13: 00007fbd97c26038 R14: 00007fbd97c25fa0 R15: 00007ffc998e8f18 [ 83.319335][ T7317] [ 83.389593][ T7325] xt_hashlimit: size too large, truncated to 1048576 [ 83.701923][ T7351] netlink: 17 bytes leftover after parsing attributes in process `syz.2.522'. [ 83.951217][ T7375] netlink: 17 bytes leftover after parsing attributes in process `syz.0.533'. [ 84.031749][ T7386] bond1: (slave lo): Releasing backup interface [ 84.033332][ T7386] bond1: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 84.068609][ T7386] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.069543][ T7386] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.079910][ T7386] batman_adv: batadv0: Interface deactivated: dummy0 [ 84.080587][ T7386] batman_adv: batadv0: Removing interface: dummy0 [ 84.105632][ T7386] bridge_slave_0: left allmulticast mode [ 84.105654][ T7386] bridge_slave_0: left promiscuous mode [ 84.105904][ T7386] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.114175][ T7386] bridge_slave_1: left allmulticast mode [ 84.114197][ T7386] bridge_slave_1: left promiscuous mode [ 84.114371][ T7386] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.125604][ T7386] bond0: (slave bond_slave_0): Releasing backup interface [ 84.128483][ T7386] bond0: (slave bond_slave_1): Releasing backup interface [ 84.135125][ T7386] team0: Port device team_slave_0 removed [ 84.138646][ T7386] team0: Port device team_slave_1 removed [ 84.140118][ T7386] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 84.141329][ T7386] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 84.145177][ T7386] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 84.146542][ T7386] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 84.202485][ T43] audit: type=1400 audit(1794229208.010:490): avc: denied { write } for pid=7396 comm="syz.2.544" name="subsystems" dev="configfs" ino=18781 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 84.202506][ T7398] nvmet_fc: nvme_fc_parse_traddr: bad traddr string [ 84.202545][ T43] audit: type=1400 audit(1794229208.010:491): avc: denied { write } for pid=7396 comm="syz.2.544" name="subsystems" dev="configfs" ino=18781 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 84.250744][ T5964] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 84.294726][ T7405] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.296304][ T7405] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.299655][ T7405] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.364048][ T7405] 8021q: adding VLAN 0 to HW filter on device bond1 [ 84.391392][ T974] syz2: Port: 1 Link ACTIVE [ 84.401056][ T5964] usb 8-1: Using ep0 maxpacket: 8 [ 84.402266][ T5964] usb 8-1: New USB device found: idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 84.403308][ T5964] usb 8-1: config 179 has an invalid interface number: 65 but max is 0 [ 84.403328][ T5964] usb 8-1: config 179 has no interface number 0 [ 84.403389][ T5964] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 84.403410][ T5964] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 84.403430][ T5964] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 84.403448][ T5964] usb 8-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 84.403479][ T5964] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.408675][ T7389] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 84.513134][ T7423] comedi comedi0: Minor 2208 is invalid! [ 84.616715][ T35] usb 8-1: USB disconnect, device number 5 [ 84.872682][ T43] audit: type=1326 audit(1794229208.680:492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7446 comm="syz.1.567" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53eb99fb19 code=0x7ff00000 [ 84.872714][ T43] audit: type=1326 audit(1794229208.680:493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7446 comm="syz.1.567" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53eb99fb19 code=0x7ff00000 [ 84.872734][ T43] audit: type=1326 audit(1794229208.680:494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7446 comm="syz.1.567" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53eb99fb19 code=0x7ff00000 [ 84.872753][ T43] audit: type=1326 audit(1794229208.680:495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7446 comm="syz.1.567" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53eb99fb19 code=0x7ff00000 [ 84.872772][ T43] audit: type=1326 audit(1794229208.680:496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7446 comm="syz.1.567" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53eb99fb19 code=0x7ff00000 [ 84.872791][ T43] audit: type=1326 audit(1794229208.680:497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7446 comm="syz.1.567" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53eb99fb19 code=0x7ff00000 [ 84.872810][ T43] audit: type=1326 audit(1794229208.680:498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7446 comm="syz.1.567" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f53eb99fb19 code=0x7ff00000 [ 85.176652][ T7459] validate_nla: 4 callbacks suppressed [ 85.176672][ T7459] netlink: 'syz.3.572': attribute type 25 has an invalid length. [ 85.333445][ T7468] net_ratelimit: 18 callbacks suppressed [ 85.333466][ T7468] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 85.386724][ T7471] device-mapper: table: 248:1: striped: Not enough destinations specified (-EINVAL) [ 85.386741][ T7471] device-mapper: ioctl: error adding target to table [ 86.353101][ T7525] netlink: 56 bytes leftover after parsing attributes in process `syz.1.603'. [ 86.645865][ T7543] netlink: 'syz.1.612': attribute type 11 has an invalid length. [ 86.645880][ T7543] netlink: 224 bytes leftover after parsing attributes in process `syz.1.612'. [ 86.688737][ T7548] netlink: 'syz.1.613': attribute type 1 has an invalid length. [ 86.854465][ T7560] i801_smbus 0000:00:1f.3: Illegal SMBus block read size 0 [ 87.000360][ T7573] device-mapper: table: 248:0: clone: Error opening source device (-ENOENT) [ 87.000378][ T7573] device-mapper: ioctl: error adding target to table [ 87.027204][ T7575] UBIFS error (pid: 7575): cannot open "ubi0_0", error -19 [ 87.085775][ T7581] xt_hashlimit: size too large, truncated to 1048576 [ 87.224611][ T7587] netlink: 'syz.3.629': attribute type 2 has an invalid length. [ 87.348949][ T7601] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 87.351080][ T7601] netlink: 'syz.2.638': attribute type 4 has an invalid length. [ 87.351091][ T7601] netlink: 17 bytes leftover after parsing attributes in process `syz.2.638'. [ 87.404908][ T7608] netlink: 256 bytes leftover after parsing attributes in process `syz.2.641'. [ 87.414830][ T7614] netlink: 'syz.3.643': attribute type 2 has an invalid length. [ 87.437638][ T7610] FAULT_INJECTION: forcing a failure. [ 87.437638][ T7610] name failslab, interval 1, probability 0, space 0, times 0 [ 87.437659][ T7610] CPU: 0 UID: 0 PID: 7610 Comm: syz.0.642 Not tainted syzkaller #0 PREEMPT(full) [ 87.437673][ T7610] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.437690][ T7610] Call Trace: [ 87.437699][ T7610] [ 87.437704][ T7610] dump_stack_lvl+0x100/0x190 [ 87.437740][ T7610] should_fail_ex.cold+0x5/0xa [ 87.437764][ T7610] should_failslab+0xc2/0x120 [ 87.437782][ T7610] __kmalloc_cache_noprof+0x91/0x6d0 [ 87.437797][ T7610] ? vidtv_psi_service_list_desc_init+0x3be/0x550 [ 87.437815][ T7610] ? vidtv_psi_eit_table_init+0x4c/0x320 [ 87.437835][ T7610] vidtv_psi_eit_table_init+0x4c/0x320 [ 87.437851][ T7610] vidtv_channel_si_init+0xde5/0x18f0 [ 87.437871][ T7610] vidtv_mux_init+0x522/0xbf0 [ 87.437890][ T7610] vidtv_start_feed+0x34e/0x500 [ 87.437902][ T7610] ? __pfx_vidtv_start_feed+0x10/0x10 [ 87.437914][ T7610] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 87.437928][ T7610] ? find_held_lock+0x2b/0x80 [ 87.437946][ T7610] dmx_section_feed_start_filtering+0x3a8/0x660 [ 87.437963][ T7610] dvb_dmxdev_filter_start+0x767/0xdd0 [ 87.437978][ T7610] dvb_demux_do_ioctl+0xe64/0x1200 [ 87.437993][ T7610] dvb_usercopy+0x167/0x340 [ 87.438007][ T7610] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 87.438018][ T7610] ? __pfx_dvb_usercopy+0x10/0x10 [ 87.438033][ T7610] ? __fget_files+0x34/0x3d0 [ 87.438051][ T7610] ? selinux_file_ioctl+0x1e0/0x290 [ 87.438069][ T7610] dvb_demux_ioctl+0x29/0x40 [ 87.438085][ T7610] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 87.438101][ T7610] __x64_sys_ioctl+0x18e/0x210 [ 87.438114][ T7610] do_syscall_64+0x123/0x7b0 [ 87.438132][ T7610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.438143][ T7610] RIP: 0033:0x7fbaba59fb19 [ 87.438153][ T7610] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.438163][ T7610] RSP: 002b:00007fbabb3d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 87.438174][ T7610] RAX: ffffffffffffffda RBX: 00007fbaba825fa0 RCX: 00007fbaba59fb19 [ 87.438181][ T7610] RDX: 0000200000000280 RSI: 00000000403c6f2b RDI: 0000000000000005 [ 87.438188][ T7610] RBP: 00007fbaba637b70 R08: 0000000000000000 R09: 0000000000000000 [ 87.438194][ T7610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.438201][ T7610] R13: 00007fbaba826038 R14: 00007fbaba825fa0 R15: 00007ffc13239da8 [ 87.438216][ T7610] [ 87.448519][ T7610] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 87.448532][ T7610] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 87.453315][ T7610] netlink: 28 bytes leftover after parsing attributes in process `syz.0.642'. [ 87.453329][ T7610] netlink: 28 bytes leftover after parsing attributes in process `syz.0.642'. [ 87.453338][ T7610] netlink: 'syz.0.642': attribute type 4 has an invalid length. [ 87.486407][ T7618] xt_hashlimit: size too large, truncated to 1048576 [ 87.667279][ T7630] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 87.668538][ T7630] netlink: 'syz.2.650': attribute type 4 has an invalid length. [ 87.668550][ T7630] netlink: 17 bytes leftover after parsing attributes in process `syz.2.650'. [ 87.833133][ T7640] netlink: 12 bytes leftover after parsing attributes in process `syz.1.655'. [ 87.990796][ T6992] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 88.151714][ T6992] usb 7-1: Using ep0 maxpacket: 8 [ 88.152482][ T6992] usb 7-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 88.153359][ T6992] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 88.153372][ T6992] usb 7-1: config 0 has no interface number 0 [ 88.153389][ T6992] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 88.153400][ T6992] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 88.153411][ T6992] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 88.153423][ T6992] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 88.153441][ T6992] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.154772][ T6992] usb 7-1: config 0 descriptor?? [ 88.165586][ T6992] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 88.350831][ T7666] FAULT_INJECTION: forcing a failure. [ 88.350831][ T7666] name failslab, interval 1, probability 0, space 0, times 0 [ 88.350849][ T7666] CPU: 2 UID: 0 PID: 7666 Comm: syz.3.667 Not tainted syzkaller #0 PREEMPT(full) [ 88.350861][ T7666] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.350868][ T7666] Call Trace: [ 88.350872][ T7666] [ 88.350877][ T7666] dump_stack_lvl+0x100/0x190 [ 88.350899][ T7666] should_fail_ex.cold+0x5/0xa [ 88.350916][ T7666] should_failslab+0xc2/0x120 [ 88.350931][ T7666] __kmalloc_cache_noprof+0x91/0x6d0 [ 88.350946][ T7666] ? __pfx_sprintf+0x10/0x10 [ 88.350958][ T7666] ? chrdev_open+0x234/0x6a0 [ 88.350971][ T7666] ? snd_seq_queue_alloc+0x56/0x540 [ 88.350987][ T7666] snd_seq_queue_alloc+0x56/0x540 [ 88.351002][ T7666] snd_seq_ioctl_create_queue+0xa9/0x370 [ 88.351019][ T7666] call_seq_client_ctl+0xa3/0x130 [ 88.351039][ T7666] snd_seq_kernel_client_ctl+0x7c/0xd0 [ 88.351056][ T7666] alloc_seq_queue+0xdb/0x180 [ 88.351066][ T7666] ? __pfx_alloc_seq_queue+0x10/0x10 [ 88.351083][ T7666] ? find_held_lock+0x2b/0x80 [ 88.351098][ T7666] ? mark_held_locks+0x40/0x70 [ 88.351114][ T7666] snd_seq_oss_open+0x2b2/0xa40 [ 88.351127][ T7666] odev_open+0x6f/0x90 [ 88.351135][ T7666] ? __pfx_odev_open+0x10/0x10 [ 88.351144][ T7666] soundcore_open+0x2e3/0x5a0 [ 88.351161][ T7666] ? __pfx_soundcore_open+0x10/0x10 [ 88.351177][ T7666] chrdev_open+0x234/0x6a0 [ 88.351190][ T7666] ? __pfx_chrdev_open+0x10/0x10 [ 88.351203][ T7666] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 88.351217][ T7666] do_dentry_open+0x674/0x1470 [ 88.351228][ T7666] ? __pfx_chrdev_open+0x10/0x10 [ 88.351243][ T7666] vfs_open_consume+0xcc/0x460 [ 88.351259][ T7666] path_openat+0x1547/0x23f0 [ 88.351275][ T7666] ? __pfx_path_openat+0x10/0x10 [ 88.351292][ T7666] do_file_open+0x20e/0x430 [ 88.351306][ T7666] ? __pfx_do_file_open+0x10/0x10 [ 88.351328][ T7666] ? _raw_spin_unlock+0x28/0x50 [ 88.351338][ T7666] ? alloc_fd+0x471/0x7a0 [ 88.351356][ T7666] do_sys_openat2+0x163/0x1d0 [ 88.351370][ T7666] ? __pfx_do_sys_openat2+0x10/0x10 [ 88.351389][ T7666] __x64_sys_openat+0x12d/0x210 [ 88.351406][ T7666] ? __pfx___x64_sys_openat+0x10/0x10 [ 88.351434][ T7666] do_syscall_64+0x123/0x7b0 [ 88.351453][ T7666] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.351470][ T7666] RIP: 0033:0x7fbd9799fb19 [ 88.351485][ T7666] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.351502][ T7666] RSP: 002b:00007fbd98819028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 88.351520][ T7666] RAX: ffffffffffffffda RBX: 00007fbd97c25fa0 RCX: 00007fbd9799fb19 [ 88.351534][ T7666] RDX: 0000000000080200 RSI: 0000200000000a80 RDI: ffffffffffffff9c [ 88.351544][ T7666] RBP: 00007fbd97a37b70 R08: 0000000000000000 R09: 0000000000000000 [ 88.351554][ T7666] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 88.351563][ T7666] R13: 00007fbd97c26038 R14: 00007fbd97c25fa0 R15: 00007ffc998e8f18 [ 88.351587][ T7666] [ 88.357975][ T7668] netlink: 68 bytes leftover after parsing attributes in process `syz.0.668'. [ 88.559124][ T7678] xt_hashlimit: size too large, truncated to 1048576 [ 88.598608][ T43] kauditd_printk_skb: 442 callbacks suppressed [ 88.598628][ T43] audit: type=1400 audit(1794229212.400:941): avc: denied { bind } for pid=7680 comm="syz.3.673" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 88.690006][ T7684] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 88.690023][ T7684] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 88.690268][ T7684] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 88.690279][ T7684] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 88.702774][ T7686] xt_hashlimit: size too large, truncated to 1048576 [ 89.062888][ T7700] __nla_validate_parse: 2 callbacks suppressed [ 89.062908][ T7700] netlink: 28 bytes leftover after parsing attributes in process `syz.3.681'. [ 89.155844][ T7704] xt_hashlimit: size too large, truncated to 1048576 [ 89.573250][ T43] audit: type=1400 audit(1794229213.380:942): avc: denied { create } for pid=7721 comm="syz.0.690" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 89.576643][ T43] audit: type=1400 audit(1794229213.380:943): avc: denied { shutdown } for pid=7721 comm="syz.0.690" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 89.720732][ T50] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 89.874722][ T50] usb 8-1: New USB device found: idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 89.876921][ T50] usb 8-1: config index 0 descriptor too short (expected 39, got 27) [ 89.876959][ T50] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 89.876976][ T50] usb 8-1: config 0 interface 0 has no altsetting 0 [ 89.878792][ T50] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 89.878811][ T50] usb 8-1: Product: syz [ 89.878821][ T50] usb 8-1: Manufacturer: syz [ 89.878833][ T50] usb 8-1: SerialNumber: syz [ 89.881441][ T50] usb 8-1: config 0 descriptor?? [ 89.886845][ T50] hub 8-1:0.0: bad descriptor, ignoring hub [ 89.886864][ T50] hub 8-1:0.0: probe with driver hub failed with error -5 [ 89.892183][ T50] usb 8-1: selecting invalid altsetting 0 [ 90.201007][ T50] usb 8-1: USB disconnect, device number 6 [ 90.356317][ T7743] netlink: 4 bytes leftover after parsing attributes in process `syz.1.700'. [ 90.356344][ T7743] openvswitch: netlink: VXLAN extension 2048 out of range max 1 [ 90.472469][ T7747] syzkaller0: entered promiscuous mode [ 90.472484][ T7747] syzkaller0: entered allmulticast mode [ 90.759061][ T6992] usb 7-1: USB disconnect, device number 7 [ 90.766634][ T6992] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 90.848944][ T7766] netlink: 80 bytes leftover after parsing attributes in process `syz.0.711'. [ 90.848964][ T7766] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 90.952673][ T5871] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 91.042801][ T7776] syzkaller0: entered promiscuous mode [ 91.042815][ T7776] syzkaller0: entered allmulticast mode [ 91.078672][ T7784] netlink: 92 bytes leftover after parsing attributes in process `syz.0.718'. [ 91.110852][ T5871] usb 8-1: Using ep0 maxpacket: 8 [ 91.112377][ T5871] usb 8-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 91.113425][ T5871] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 91.113442][ T5871] usb 8-1: config 0 has no interface number 0 [ 91.113468][ T5871] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 91.113482][ T5871] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 91.113498][ T5871] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 91.113515][ T5871] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 91.113539][ T5871] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.116992][ T5871] usb 8-1: config 0 descriptor?? [ 91.145717][ T7788] netlink: 'syz.0.721': attribute type 1 has an invalid length. [ 91.145737][ T7788] netlink: 244 bytes leftover after parsing attributes in process `syz.0.721'. [ 91.165598][ T5871] ldusb 8-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 91.292053][ T7795] netlink: 8 bytes leftover after parsing attributes in process `syz.1.724'. [ 91.373987][ T855] usb 8-1: USB disconnect, device number 7 [ 91.376306][ T855] ldusb 8-1:0.55: LD USB Device #0 now disconnected [ 91.760801][ T6992] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 91.920765][ T6992] usb 7-1: Using ep0 maxpacket: 32 [ 91.923322][ T6992] usb 7-1: New USB device found: idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 91.924529][ T6992] usb 7-1: config 0 has an invalid interface number: 119 but max is 0 [ 91.924548][ T6992] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 91.924563][ T6992] usb 7-1: config 0 has no interface number 0 [ 91.924590][ T6992] usb 7-1: config 0 interface 119 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 91.926441][ T6992] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.926458][ T6992] usb 7-1: Product: syz [ 91.926468][ T6992] usb 7-1: Manufacturer: syz [ 91.926479][ T6992] usb 7-1: SerialNumber: syz [ 91.928542][ T6992] usb 7-1: config 0 descriptor?? [ 91.939449][ T6992] input: bcm5974 as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.119/input/input5 [ 92.043122][ T7835] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 92.045166][ T7835] netlink: 'syz.3.739': attribute type 4 has an invalid length. [ 92.045183][ T7835] netlink: 17 bytes leftover after parsing attributes in process `syz.3.739'. [ 92.090518][ T43] audit: type=1400 audit(1794229215.890:944): avc: denied { append } for pid=7836 comm="syz.0.741" name="frontend0" dev="devtmpfs" ino=948 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 92.124221][ T7842] netlink: 'syz.0.742': attribute type 10 has an invalid length. [ 92.124237][ T7842] netlink: 40 bytes leftover after parsing attributes in process `syz.0.742'. [ 92.124459][ T7842] batadv0: entered promiscuous mode [ 92.124470][ T7842] batadv0: entered allmulticast mode [ 92.124926][ T7842] bridge0: port 3(batadv0) entered blocking state [ 92.124979][ T7842] bridge0: port 3(batadv0) entered disabled state [ 92.126153][ T7842] batman_adv: batadv0: Local translation table size (104) exceeds maximum table response size (-320); Ignoring new VLAN: 1 [ 92.126709][ T7842] batadv0: failed to initialize vlan filtering on this port [ 92.127849][ T7842] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 92.138429][ T43] audit: type=1400 audit(1794229215.940:945): avc: denied { read } for pid=7812 comm="syz.2.731" name="event4" dev="devtmpfs" ino=2977 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 92.182270][ T855] usb 7-1: USB disconnect, device number 8 [ 92.331549][ T7856] ip_tables: iptables: counters copy to user failed while replacing table [ 92.463053][ T7848] netlink: 12 bytes leftover after parsing attributes in process `syz.3.745'. [ 92.463076][ T7848] netlink: 20 bytes leftover after parsing attributes in process `syz.3.745'. [ 92.705705][ T43] audit: type=1400 audit(1794229216.510:946): avc: denied { read write } for pid=7885 comm="syz.0.762" name="vhost-net" dev="devtmpfs" ino=1307 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 92.706416][ T43] audit: type=1400 audit(1794229216.510:947): avc: denied { open } for pid=7885 comm="syz.0.762" path="/dev/vhost-net" dev="devtmpfs" ino=1307 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 92.709176][ T43] audit: type=1400 audit(1794229216.510:948): avc: denied { ioctl } for pid=7885 comm="syz.0.762" path="/dev/vhost-net" dev="devtmpfs" ino=1307 ioctlcmd=0x4008af00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 92.801894][ T7890] openvswitch: netlink: Missing key (keys=40, expected=80) [ 92.803174][ T7888] FAULT_INJECTION: forcing a failure. [ 92.803174][ T7888] name failslab, interval 1, probability 0, space 0, times 0 [ 92.803200][ T7888] CPU: 1 UID: 0 PID: 7888 Comm: syz.0.763 Not tainted syzkaller #0 PREEMPT(full) [ 92.803221][ T7888] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.803231][ T7888] Call Trace: [ 92.803238][ T7888] [ 92.803246][ T7888] dump_stack_lvl+0x100/0x190 [ 92.803284][ T7888] should_fail_ex.cold+0x5/0xa [ 92.803313][ T7888] should_failslab+0xc2/0x120 [ 92.803338][ T7888] __kmalloc_cache_noprof+0x91/0x6d0 [ 92.803364][ T7888] ? vidtv_psi_service_list_desc_init+0x3be/0x550 [ 92.803386][ T7888] ? vidtv_psi_eit_table_init+0x4c/0x320 [ 92.803413][ T7888] vidtv_psi_eit_table_init+0x4c/0x320 [ 92.803439][ T7888] vidtv_channel_si_init+0xde5/0x18f0 [ 92.803486][ T7888] vidtv_mux_init+0x522/0xbf0 [ 92.803520][ T7888] vidtv_start_feed+0x34e/0x500 [ 92.803541][ T7888] ? __pfx_vidtv_start_feed+0x10/0x10 [ 92.803564][ T7888] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 92.803585][ T7888] ? find_held_lock+0x2b/0x80 [ 92.803610][ T7888] dmx_section_feed_start_filtering+0x3a8/0x660 [ 92.803640][ T7888] dvb_dmxdev_filter_start+0x767/0xdd0 [ 92.803665][ T7888] dvb_demux_do_ioctl+0xe64/0x1200 [ 92.803692][ T7888] dvb_usercopy+0x167/0x340 [ 92.803717][ T7888] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 92.803739][ T7888] ? __pfx_dvb_usercopy+0x10/0x10 [ 92.803762][ T7888] ? __fget_files+0x34/0x3d0 [ 92.803797][ T7888] ? selinux_file_ioctl+0x1e0/0x290 [ 92.803818][ T7888] dvb_demux_ioctl+0x29/0x40 [ 92.803843][ T7888] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 92.803865][ T7888] __x64_sys_ioctl+0x18e/0x210 [ 92.803885][ T7888] do_syscall_64+0x123/0x7b0 [ 92.803910][ T7888] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.803929][ T7888] RIP: 0033:0x7fbaba59fb19 [ 92.803946][ T7888] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.803963][ T7888] RSP: 002b:00007fbabb3d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 92.803984][ T7888] RAX: ffffffffffffffda RBX: 00007fbaba825fa0 RCX: 00007fbaba59fb19 [ 92.803997][ T7888] RDX: 0000200000000280 RSI: 00000000403c6f2b RDI: 0000000000000005 [ 92.804007][ T7888] RBP: 00007fbaba637b70 R08: 0000000000000000 R09: 0000000000000000 [ 92.804016][ T7888] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.804025][ T7888] R13: 00007fbaba826038 R14: 00007fbaba825fa0 R15: 00007ffc13239da8 [ 92.804051][ T7888] [ 92.806663][ T7888] netlink: 'syz.0.763': attribute type 4 has an invalid length. [ 93.032528][ T7898] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 93.032552][ T7898] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 93.035729][ T7898] vhci_hcd vhci_hcd.0: Device attached [ 93.178774][ T7904] openvswitch: netlink: IP tunnel dst address not specified [ 93.298120][ T5871] usb 41-1: new low-speed USB device number 2 using vhci_hcd [ 93.299801][ T1363] usb 7-1: new low-speed USB device number 9 using dummy_hcd [ 93.374797][ T7918] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Mapping Info response ret = -22) [ 93.374825][ T7918] iwpm_mapping_info_cb: Unable to parse nlmsg [ 93.416190][ T43] audit: type=1400 audit(1794229217.220:949): avc: denied { setopt } for pid=7921 comm="syz.3.780" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 93.471236][ T1363] usb 7-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 93.471645][ T1363] usb 7-1: config 0 has no interfaces? [ 93.471660][ T1363] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.475770][ T1363] usb 7-1: config 0 descriptor?? [ 93.678230][ T7899] vhci_hcd: cannot find a urb of seqnum 0 max seqnum 1 [ 93.682880][ T5886] vhci_hcd vhci_hcd.2: stop threads [ 93.682892][ T5886] vhci_hcd vhci_hcd.2: release socket [ 93.683656][ T5886] vhci_hcd vhci_hcd.2: disconnect device [ 93.686947][ T1363] usb 7-1: USB disconnect, device number 9 [ 93.690828][ T5892] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 93.851889][ T5892] usb 8-1: Using ep0 maxpacket: 32 [ 93.853088][ T5892] usb 8-1: New USB device found: idVendor=1430, idProduct=474b, bcdDevice=0.40 [ 93.853915][ T5892] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 1536, setting to 1024 [ 93.853930][ T5892] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 1024 [ 93.856359][ T5892] usb 8-1: string descriptor 0 read error: -22 [ 93.856415][ T5892] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.858827][ T7924] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 93.882117][ T5892] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 93.882145][ T5892] usb 8-1: MIDIStreaming interface descriptor not found [ 94.083985][ T50] usb 8-1: USB disconnect, device number 8 [ 94.200986][ T35] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 94.352436][ T35] usb 5-1: New USB device found: idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 94.354986][ T35] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.355001][ T35] usb 5-1: Product: syz [ 94.355008][ T35] usb 5-1: Manufacturer: syz [ 94.355015][ T35] usb 5-1: SerialNumber: syz [ 94.357342][ T35] usb 5-1: config 0 descriptor?? [ 94.565765][ T1363] usb 5-1: USB disconnect, device number 7 [ 94.575595][ T43] audit: type=1400 audit(1794229218.380:950): avc: denied { create } for pid=7946 comm="syz.2.790" name="md0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 94.578721][ T43] audit: type=1400 audit(1794229218.380:951): avc: denied { read write } for pid=7946 comm="syz.2.790" name="md0" dev="tmpfs" ino=980 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 94.579245][ T43] audit: type=1400 audit(1794229218.380:952): avc: denied { open } for pid=7946 comm="syz.2.790" path="/182/md0" dev="tmpfs" ino=980 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 94.596457][ T7947] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 94.596470][ T7947] block device autoloading is deprecated and will be removed. [ 94.601481][ T43] audit: type=1400 audit(1794229218.410:953): avc: denied { ioctl } for pid=7946 comm="syz.2.790" path="/182/md0" dev="tmpfs" ino=980 ioctlcmd=0x90000915 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 94.616992][ T43] audit: type=1400 audit(1794229218.410:954): avc: denied { unlink } for pid=5786 comm="syz-executor" name="md0" dev="tmpfs" ino=980 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 95.189503][ T7967] __nla_validate_parse: 8 callbacks suppressed [ 95.189525][ T7967] netlink: 12 bytes leftover after parsing attributes in process `syz.1.795'. [ 95.368570][ T7976] netlink: 'syz.0.799': attribute type 1 has an invalid length. [ 95.368586][ T7976] nbd: error processing sock list [ 95.506404][ T7980] jffs2: notice: (7980) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 4 of xref (0 dead, 0 orphan) found. [ 95.515474][ T43] audit: type=1400 audit(1794229219.310:955): avc: denied { mounton } for pid=7979 comm="syz.0.802" path="/198/file0" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 95.584843][ T7985] netlink: 28 bytes leftover after parsing attributes in process `syz.3.800'. [ 95.679340][ T7989] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 96.218195][ T8013] xt_hashlimit: size too large, truncated to 1048576 [ 96.280726][ T8015] netlink: 'syz.3.817': attribute type 2 has an invalid length. [ 96.286270][ T43] audit: type=1400 audit(1794229220.090:956): avc: denied { connect } for pid=8016 comm="syz.1.818" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 96.615886][ T8025] ip_tables: iptables: counters copy to user failed while replacing table [ 96.938591][ T8031] netlink: 28 bytes leftover after parsing attributes in process `syz.1.825'. [ 97.047316][ T43] audit: type=1400 audit(1794229220.850:957): avc: denied { create } for pid=8034 comm="syz.1.828" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 97.058048][ T43] audit: type=1400 audit(1794229220.860:958): avc: denied { setopt } for pid=8034 comm="syz.1.828" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 97.067558][ T43] audit: type=1400 audit(1794229220.880:959): avc: denied { write } for pid=8034 comm="syz.1.828" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 97.476564][ T8061] netlink: 'syz.3.838': attribute type 25 has an invalid length. [ 97.545750][ T8063] program syz.3.839 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 97.545782][ T8063] ata1.00: invalid transfer count 0 [ 97.684124][ T8070] Bluetooth: hci0: unsupported parameter 5161 [ 97.684140][ T8070] Bluetooth: hci0: unsupported parameter 8192 [ 97.684147][ T8070] Bluetooth: hci0: unsupported parameter 5161 [ 97.684153][ T8070] Bluetooth: hci0: unsupported parameter 8192 [ 97.831763][ T8086] pim6reg: entered allmulticast mode [ 97.833127][ T8086] pim6reg: left allmulticast mode [ 97.965458][ T8091] netlink: 224 bytes leftover after parsing attributes in process `syz.0.850'. [ 98.217263][ T8101] smc: net device lo applied user defined pnetid SYZ0 [ 98.217399][ T8101] smc: smcd device lo applied user defined pnetid SYZ0 [ 98.310757][ T6992] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 98.390847][ T5871] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 98.463895][ T6992] usb 5-1: New USB device found: idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 98.468501][ T6992] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.468517][ T6992] usb 5-1: Product: syz [ 98.468524][ T6992] usb 5-1: Manufacturer: syz [ 98.468531][ T6992] usb 5-1: SerialNumber: syz [ 98.469738][ T6992] usb 5-1: config 0 descriptor?? [ 98.491430][ T5889] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 98.535786][ T8109] FAULT_INJECTION: forcing a failure. [ 98.535786][ T8109] name failslab, interval 1, probability 0, space 0, times 0 [ 98.535815][ T8109] CPU: 0 UID: 0 PID: 8109 Comm: syz.3.860 Not tainted syzkaller #0 PREEMPT(full) [ 98.535835][ T8109] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.535847][ T8109] Call Trace: [ 98.535854][ T8109] [ 98.535861][ T8109] dump_stack_lvl+0x100/0x190 [ 98.535898][ T8109] should_fail_ex.cold+0x5/0xa [ 98.535936][ T8109] should_failslab+0xc2/0x120 [ 98.535961][ T8109] __kmalloc_cache_noprof+0x91/0x6d0 [ 98.535988][ T8109] ? __pfx_sprintf+0x10/0x10 [ 98.536008][ T8109] ? chrdev_open+0x234/0x6a0 [ 98.536029][ T8109] ? snd_seq_queue_alloc+0x56/0x540 [ 98.536060][ T8109] snd_seq_queue_alloc+0x56/0x540 [ 98.536087][ T8109] snd_seq_ioctl_create_queue+0xa9/0x370 [ 98.536115][ T8109] call_seq_client_ctl+0xa3/0x130 [ 98.536141][ T8109] snd_seq_kernel_client_ctl+0x7c/0xd0 [ 98.536171][ T8109] alloc_seq_queue+0xdb/0x180 [ 98.536191][ T8109] ? __pfx_alloc_seq_queue+0x10/0x10 [ 98.536218][ T8109] ? find_held_lock+0x2b/0x80 [ 98.536240][ T8109] ? mark_held_locks+0x40/0x70 [ 98.536267][ T8109] snd_seq_oss_open+0x2b2/0xa40 [ 98.536287][ T8109] odev_open+0x6f/0x90 [ 98.536302][ T8109] ? __pfx_odev_open+0x10/0x10 [ 98.536315][ T8109] soundcore_open+0x2e3/0x5a0 [ 98.536343][ T8109] ? __pfx_soundcore_open+0x10/0x10 [ 98.536371][ T8109] chrdev_open+0x234/0x6a0 [ 98.536392][ T8109] ? __pfx_chrdev_open+0x10/0x10 [ 98.536415][ T8109] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 98.536437][ T8109] do_dentry_open+0x674/0x1470 [ 98.536457][ T8109] ? __pfx_chrdev_open+0x10/0x10 [ 98.536482][ T8109] vfs_open_consume+0xcc/0x460 [ 98.536506][ T8109] path_openat+0x1547/0x23f0 [ 98.536525][ T8109] ? __pfx_path_openat+0x10/0x10 [ 98.536552][ T8109] do_file_open+0x20e/0x430 [ 98.536577][ T8109] ? __pfx_do_file_open+0x10/0x10 [ 98.536618][ T8109] ? _raw_spin_unlock+0x28/0x50 [ 98.536636][ T8109] ? alloc_fd+0x471/0x7a0 [ 98.536665][ T8109] do_sys_openat2+0x163/0x1d0 [ 98.536681][ T8109] ? __pfx_do_sys_openat2+0x10/0x10 [ 98.536701][ T8109] __x64_sys_openat+0x12d/0x210 [ 98.536717][ T8109] ? __pfx___x64_sys_openat+0x10/0x10 [ 98.536738][ T8109] do_syscall_64+0x123/0x7b0 [ 98.536752][ T8109] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.536763][ T8109] RIP: 0033:0x7fbd9799fb19 [ 98.536772][ T8109] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.536782][ T8109] RSP: 002b:00007fbd98819028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 98.536794][ T8109] RAX: ffffffffffffffda RBX: 00007fbd97c25fa0 RCX: 00007fbd9799fb19 [ 98.536801][ T8109] RDX: 0000000000080200 RSI: 0000200000000a80 RDI: ffffffffffffff9c [ 98.536809][ T8109] RBP: 00007fbd97a37b70 R08: 0000000000000000 R09: 0000000000000000 [ 98.536815][ T8109] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.536822][ T8109] R13: 00007fbd97c26038 R14: 00007fbd97c25fa0 R15: 00007ffc998e8f18 [ 98.536858][ T8109] [ 98.622080][ T8111] Bluetooth: hci0: load_link_keys: too big key_count value 5121 [ 98.660954][ T5889] usb 7-1: Using ep0 maxpacket: 8 [ 98.661422][ T5889] usb 7-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 98.662286][ T5889] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 98.662299][ T5889] usb 7-1: config 0 has no interface number 0 [ 98.662316][ T5889] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 98.662327][ T5889] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 98.662370][ T8114] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 1, id = 0 [ 98.662433][ T5889] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 98.662449][ T5889] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 98.662467][ T5889] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.663931][ T5889] usb 7-1: config 0 descriptor?? [ 98.671010][ T5889] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 98.681250][ T6992] usb 5-1: USB disconnect, device number 8 [ 98.847496][ T8122] jffs2: notice: (8122) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 4 of xref (0 dead, 0 orphan) found. [ 98.905919][ T8122] jffs2: warning: (8122) do_jffs2_setxattr: jffs2_reserve_space()=-28, request=56 [ 99.603647][ T8144] device-mapper: table: 248:1: multipath: invalid initial priority group (-EINVAL) [ 99.603710][ T8144] device-mapper: ioctl: error adding target to table [ 99.638395][ T8146] netlink: 8 bytes leftover after parsing attributes in process `syz.3.875'. [ 100.091148][ T8152] netlink: 'syz.0.878': attribute type 25 has an invalid length. [ 100.486263][ T8174] netlink: 'syz.3.887': attribute type 25 has an invalid length. [ 100.601057][ T5964] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 100.800699][ T5964] usb 5-1: Using ep0 maxpacket: 32 [ 100.802766][ T5964] usb 5-1: New USB device found: idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 100.803771][ T5964] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 100.803783][ T5964] usb 5-1: config 0 has no interface number 0 [ 100.805474][ T5964] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.805490][ T5964] usb 5-1: Product: syz [ 100.805579][ T5964] usb 5-1: Manufacturer: syz [ 100.805587][ T5964] usb 5-1: SerialNumber: syz [ 100.808334][ T5964] usb 5-1: config 0 descriptor?? [ 100.816371][ T5964] usb 5-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 100.816392][ T5964] usb 5-1: selecting invalid altsetting 1 [ 100.816400][ T5964] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 100.830083][ T5964] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 100.830359][ T5964] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 100.831253][ T5964] usb 5-1: media controller created [ 100.846778][ T5964] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 101.075579][ T5964] usb 5-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 101.075624][ T5964] zl10353_read_register: readreg error (reg=127, ret==-71) [ 101.082351][ T5964] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 101.118430][ T5964] usb 5-1: USB disconnect, device number 9 [ 101.266164][ T35] usb 7-1: USB disconnect, device number 10 [ 101.274363][ T35] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 101.425357][ T43] kauditd_printk_skb: 7 callbacks suppressed [ 101.425386][ T43] audit: type=1400 audit(1794229225.230:967): avc: denied { write } for pid=8194 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.474134][ T43] audit: type=1400 audit(1794229225.280:968): avc: denied { write } for pid=8199 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.592678][ T8204] netlink: 'syz.2.899': attribute type 25 has an invalid length. [ 101.632817][ T43] audit: type=1400 audit(1794229225.410:969): avc: denied { write } for pid=8205 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.649276][ T8213] ip_tables: iptables: counters copy to user failed while replacing table [ 101.729188][ T43] audit: type=1400 audit(1794229225.540:970): avc: denied { write } for pid=8214 comm="syz.2.903" name="sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 101.776384][ T43] audit: type=1400 audit(1794229225.540:971): avc: denied { write } for pid=8216 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.806010][ T8225] jffs2: notice: (8225) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 4 of xref (0 dead, 0 orphan) found. [ 101.822789][ T43] audit: type=1400 audit(1794229225.590:972): avc: denied { connect } for pid=8228 comm="syz.2.908" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 101.852450][ T8225] jffs2: warning: (8225) do_jffs2_setxattr: jffs2_reserve_space()=-28, request=36 [ 101.889067][ T43] audit: type=1400 audit(1794229225.690:973): avc: denied { write } for pid=8227 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.938589][ T43] audit: type=1400 audit(1794229225.690:974): avc: denied { write } for pid=8238 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.987537][ T8243] netlink: 'syz.2.912': attribute type 25 has an invalid length. [ 102.190733][ T8254] netlink: 'syz.0.916': attribute type 10 has an invalid length. [ 102.190878][ T8254] batman_adv: batadv0: Interface deactivated: dummy0 [ 102.191242][ T8254] batman_adv: batadv0: Removing interface: dummy0 [ 102.196013][ T8254] team0: Port device dummy0 added [ 102.200343][ T8254] netlink: 'syz.0.916': attribute type 10 has an invalid length. [ 102.208629][ T8254] team0: Port device dummy0 removed [ 102.658191][ T8264] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 102.658207][ T8264] block device autoloading is deprecated and will be removed. [ 102.698894][ T8266] netlink: 'syz.0.921': attribute type 25 has an invalid length. [ 102.707670][ T8268] FAULT_INJECTION: forcing a failure. [ 102.707670][ T8268] name failslab, interval 1, probability 0, space 0, times 0 [ 102.707689][ T8268] CPU: 2 UID: 0 PID: 8268 Comm: syz.3.922 Not tainted syzkaller #0 PREEMPT(full) [ 102.707703][ T8268] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.707717][ T8268] Call Trace: [ 102.707726][ T8268] [ 102.707730][ T8268] dump_stack_lvl+0x100/0x190 [ 102.707766][ T8268] should_fail_ex.cold+0x5/0xa [ 102.707791][ T8268] should_failslab+0xc2/0x120 [ 102.707808][ T8268] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 102.707820][ T8268] ? __kasan_kmalloc+0xaa/0xb0 [ 102.707831][ T8268] ? vidtv_psi_desc_clone+0x3aa/0x5d0 [ 102.707850][ T8268] kmemdup_noprof+0x29/0x60 [ 102.707862][ T8268] vidtv_psi_desc_clone+0x3aa/0x5d0 [ 102.707876][ T8268] vidtv_channel_si_init+0x12c9/0x18f0 [ 102.707897][ T8268] vidtv_mux_init+0x522/0xbf0 [ 102.707915][ T8268] vidtv_start_feed+0x34e/0x500 [ 102.707928][ T8268] ? __pfx_vidtv_start_feed+0x10/0x10 [ 102.707940][ T8268] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 102.707955][ T8268] ? find_held_lock+0x2b/0x80 [ 102.707972][ T8268] dmx_section_feed_start_filtering+0x3a8/0x660 [ 102.707989][ T8268] dvb_dmxdev_filter_start+0x767/0xdd0 [ 102.708005][ T8268] dvb_demux_do_ioctl+0xe64/0x1200 [ 102.708019][ T8268] dvb_usercopy+0x167/0x340 [ 102.708034][ T8268] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 102.708045][ T8268] ? __pfx_dvb_usercopy+0x10/0x10 [ 102.708059][ T8268] ? __fget_files+0x34/0x3d0 [ 102.708078][ T8268] ? selinux_file_ioctl+0x1e0/0x290 [ 102.708091][ T8268] dvb_demux_ioctl+0x29/0x40 [ 102.708105][ T8268] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 102.708120][ T8268] __x64_sys_ioctl+0x18e/0x210 [ 102.708133][ T8268] do_syscall_64+0x123/0x7b0 [ 102.708151][ T8268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.708162][ T8268] RIP: 0033:0x7fbd9799fb19 [ 102.708172][ T8268] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.708183][ T8268] RSP: 002b:00007fbd98819028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 102.708214][ T8268] RAX: ffffffffffffffda RBX: 00007fbd97c25fa0 RCX: 00007fbd9799fb19 [ 102.708224][ T8268] RDX: 0000200000000280 RSI: 00000000403c6f2b RDI: 0000000000000005 [ 102.708231][ T8268] RBP: 00007fbd97a37b70 R08: 0000000000000000 R09: 0000000000000000 [ 102.708237][ T8268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.708243][ T8268] R13: 00007fbd97c26038 R14: 00007fbd97c25fa0 R15: 00007ffc998e8f18 [ 102.708260][ T8268] [ 102.710471][ T8268] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 102.710483][ T8268] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 102.711026][ T8268] netlink: 28 bytes leftover after parsing attributes in process `syz.3.922'. [ 102.711045][ T8268] netlink: 28 bytes leftover after parsing attributes in process `syz.3.922'. [ 102.711053][ T8268] netlink: 'syz.3.922': attribute type 4 has an invalid length. [ 102.950282][ T8281] device-mapper: raid: Choosing default region size of 4MiB [ 102.950601][ T8281] device-mapper: table: 248:4: raid: RAID device lookup failure (-ENOENT) [ 102.950612][ T8281] device-mapper: ioctl: error adding target to table [ 103.533238][ T43] audit: type=1400 audit(1794229227.320:975): avc: denied { setopt } for pid=8300 comm="syz.2.935" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 103.669204][ T8322] overlayfs: only single ':' or double '::' sequences of unescaped colons in lowerdir mount option allowed. [ 104.090368][ T43] audit: type=1400 audit(1794229227.870:976): avc: denied { connect } for pid=8347 comm="syz.1.954" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 104.319174][ T8352] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 104.470498][ T8358] device-mapper: ioctl: Unable to change uuid of mapped device syza1 to syza1 because uuid is already set to CRP-syza3 [ 104.664780][ T8368] xt_hashlimit: size too large, truncated to 1048576 [ 104.746869][ T8368] netlink: 'syz.2.963': attribute type 2 has an invalid length. [ 104.774481][ T8374] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 105.864887][ T8408] smc: removing ib device rxe0 [ 105.898609][ T8408] smbdirect: ib_dev[rxe0] removed [ 106.075337][ T8417] netlink: 8 bytes leftover after parsing attributes in process `syz.1.985'. [ 106.549044][ T43] kauditd_printk_skb: 4 callbacks suppressed [ 106.549058][ T43] audit: type=1400 audit(1794229230.330:981): avc: denied { accept } for pid=8435 comm="syz.2.994" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 106.577413][ T43] audit: type=1400 audit(1794229230.380:982): avc: denied { setopt } for pid=8440 comm="syz.2.996" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 106.580761][ T8443] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_team, syncid = 4, id = 0 [ 106.581299][ T8441] IPVS: stopping backup sync thread 8443 ... [ 106.707940][ T43] audit: type=1400 audit(1794229230.470:983): avc: denied { write } for pid=8453 comm="syz.0.1000" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 106.848318][ T8464] xt_hashlimit: size too large, truncated to 1048576 [ 106.875063][ T43] audit: type=1400 audit(1794229230.640:984): avc: denied { map } for pid=8466 comm="syz.3.1005" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=757 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 106.897833][ T8468] netlink: 'syz.0.1004': attribute type 2 has an invalid length. [ 106.945176][ T43] audit: type=1400 audit(1794229230.750:985): avc: denied { setopt } for pid=8469 comm="syz.3.1006" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 107.180175][ T43] audit: type=1400 audit(1794229230.970:986): avc: denied { setopt } for pid=8482 comm="syz.2.1010" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 107.572928][ T8500] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1016'. [ 108.389452][ T43] audit: type=1400 audit(1794229232.140:987): avc: denied { associate } for pid=8516 comm="syz.2.1024" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 108.436916][ T8520] xt_hashlimit: size too large, truncated to 1048576 [ 108.494950][ T8522] netlink: 'syz.2.1025': attribute type 2 has an invalid length. [ 108.777608][ T43] audit: type=1400 audit(1794229232.570:988): avc: denied { write } for pid=8525 comm="syz.3.1026" name="usb_gadget" dev="configfs" ino=1114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 108.791914][ T43] audit: type=1400 audit(1794229232.570:989): avc: denied { remove_name } for pid=8525 comm="syz.3.1026" name="g1" dev="configfs" ino=13781 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 108.792576][ T43] audit: type=1400 audit(1794229232.570:990): avc: denied { rmdir } for pid=8525 comm="syz.3.1026" name="g1" dev="configfs" ino=13781 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 109.280372][ T8549] netlink: 'syz.0.1034': attribute type 6 has an invalid length. [ 109.590891][ T8578] xt_hashlimit: size too large, truncated to 1048576 [ 110.375720][ T8609] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1059'. [ 110.581426][ T8626] device-mapper: table: 248:7: crypt: Not enough arguments (-EINVAL) [ 110.581449][ T8626] device-mapper: ioctl: error adding target to table [ 110.607658][ T8631] FAULT_INJECTION: forcing a failure. [ 110.607658][ T8631] name failslab, interval 1, probability 0, space 0, times 0 [ 110.607679][ T8631] CPU: 0 UID: 0 PID: 8631 Comm: syz.0.1069 Not tainted syzkaller #0 PREEMPT(full) [ 110.607691][ T8631] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 110.607706][ T8631] Call Trace: [ 110.607713][ T8631] [ 110.607718][ T8631] dump_stack_lvl+0x100/0x190 [ 110.607753][ T8631] should_fail_ex.cold+0x5/0xa [ 110.607776][ T8631] should_failslab+0xc2/0x120 [ 110.607793][ T8631] __kmalloc_cache_noprof+0x91/0x6d0 [ 110.607809][ T8631] ? __pfx___debug_object_init+0x10/0x10 [ 110.607825][ T8631] ? vidtv_mux_create_pid_ctx_once.part.0+0x49/0x200 [ 110.607848][ T8631] vidtv_mux_create_pid_ctx_once.part.0+0x49/0x200 [ 110.607865][ T8631] vidtv_mux_create_pid_ctx_once+0xe6/0x140 [ 110.607882][ T8631] vidtv_mux_init+0x725/0xbf0 [ 110.607900][ T8631] vidtv_start_feed+0x34e/0x500 [ 110.607912][ T8631] ? __pfx_vidtv_start_feed+0x10/0x10 [ 110.607923][ T8631] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 110.607937][ T8631] ? find_held_lock+0x2b/0x80 [ 110.607954][ T8631] dmx_section_feed_start_filtering+0x3a8/0x660 [ 110.607972][ T8631] dvb_dmxdev_filter_start+0x767/0xdd0 [ 110.607988][ T8631] dvb_demux_do_ioctl+0xe64/0x1200 [ 110.608002][ T8631] dvb_usercopy+0x167/0x340 [ 110.608021][ T8631] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 110.608032][ T8631] ? __pfx_dvb_usercopy+0x10/0x10 [ 110.608046][ T8631] ? __fget_files+0x34/0x3d0 [ 110.608066][ T8631] ? selinux_file_ioctl+0x1e0/0x290 [ 110.608081][ T8631] dvb_demux_ioctl+0x29/0x40 [ 110.608096][ T8631] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 110.608112][ T8631] __x64_sys_ioctl+0x18e/0x210 [ 110.608125][ T8631] do_syscall_64+0x123/0x7b0 [ 110.608144][ T8631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.608156][ T8631] RIP: 0033:0x7fbaba59fb19 [ 110.608165][ T8631] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 110.608175][ T8631] RSP: 002b:00007fbabb3d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 110.608187][ T8631] RAX: ffffffffffffffda RBX: 00007fbaba825fa0 RCX: 00007fbaba59fb19 [ 110.608194][ T8631] RDX: 0000200000000280 RSI: 00000000403c6f2b RDI: 0000000000000005 [ 110.608201][ T8631] RBP: 00007fbaba637b70 R08: 0000000000000000 R09: 0000000000000000 [ 110.608208][ T8631] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 110.608214][ T8631] R13: 00007fbaba826038 R14: 00007fbaba825fa0 R15: 00007ffc13239da8 [ 110.608230][ T8631] [ 110.610006][ T8631] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 110.610028][ T8631] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 110.610530][ T8631] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1069'. [ 110.610543][ T8631] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1069'. [ 110.610554][ T8631] netlink: 'syz.0.1069': attribute type 4 has an invalid length. [ 110.776410][ T8638] Illegal XDP return value 4294967274 on prog (id 25) dev N/A, expect packet loss! [ 110.825252][ T8647] xt_hashlimit: size too large, truncated to 1048576 [ 110.938520][ T8654] netlink: 'syz.1.1077': attribute type 2 has an invalid length. [ 111.389430][ T8678] FAULT_INJECTION: forcing a failure. [ 111.389430][ T8678] name failslab, interval 1, probability 0, space 0, times 0 [ 111.389458][ T8678] CPU: 3 UID: 0 PID: 8678 Comm: syz.3.1091 Not tainted syzkaller #0 PREEMPT(full) [ 111.389479][ T8678] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 111.389490][ T8678] Call Trace: [ 111.389498][ T8678] [ 111.389506][ T8678] dump_stack_lvl+0x100/0x190 [ 111.389541][ T8678] should_fail_ex.cold+0x5/0xa [ 111.389572][ T8678] should_failslab+0xc2/0x120 [ 111.389595][ T8678] __kmalloc_cache_noprof+0x91/0x6d0 [ 111.389621][ T8678] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 111.389648][ T8678] ? snd_seq_timer_new+0x44/0x1a0 [ 111.389680][ T8678] snd_seq_timer_new+0x44/0x1a0 [ 111.389708][ T8678] snd_seq_queue_alloc+0x177/0x540 [ 111.389736][ T8678] snd_seq_ioctl_create_queue+0xa9/0x370 [ 111.389768][ T8678] call_seq_client_ctl+0xa3/0x130 [ 111.389800][ T8678] snd_seq_kernel_client_ctl+0x7c/0xd0 [ 111.389830][ T8678] alloc_seq_queue+0xdb/0x180 [ 111.389849][ T8678] ? __pfx_alloc_seq_queue+0x10/0x10 [ 111.389878][ T8678] ? find_held_lock+0x2b/0x80 [ 111.389899][ T8678] ? mark_held_locks+0x40/0x70 [ 111.389933][ T8678] snd_seq_oss_open+0x2b2/0xa40 [ 111.389958][ T8678] odev_open+0x6f/0x90 [ 111.389976][ T8678] ? __pfx_odev_open+0x10/0x10 [ 111.389994][ T8678] soundcore_open+0x2e3/0x5a0 [ 111.390028][ T8678] ? __pfx_soundcore_open+0x10/0x10 [ 111.390058][ T8678] chrdev_open+0x234/0x6a0 [ 111.390084][ T8678] ? __pfx_chrdev_open+0x10/0x10 [ 111.390109][ T8678] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 111.390153][ T8678] do_dentry_open+0x674/0x1470 [ 111.390174][ T8678] ? __pfx_chrdev_open+0x10/0x10 [ 111.390203][ T8678] vfs_open_consume+0xcc/0x460 [ 111.390235][ T8678] path_openat+0x1547/0x23f0 [ 111.390266][ T8678] ? __pfx_path_openat+0x10/0x10 [ 111.390300][ T8678] do_file_open+0x20e/0x430 [ 111.390327][ T8678] ? __pfx_do_file_open+0x10/0x10 [ 111.390372][ T8678] ? _raw_spin_unlock+0x28/0x50 [ 111.390392][ T8678] ? alloc_fd+0x471/0x7a0 [ 111.390423][ T8678] do_sys_openat2+0x163/0x1d0 [ 111.390450][ T8678] ? __pfx_do_sys_openat2+0x10/0x10 [ 111.390487][ T8678] __x64_sys_openat+0x12d/0x210 [ 111.390514][ T8678] ? __pfx___x64_sys_openat+0x10/0x10 [ 111.390552][ T8678] do_syscall_64+0x123/0x7b0 [ 111.390577][ T8678] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.390597][ T8678] RIP: 0033:0x7fbd9799fb19 [ 111.390613][ T8678] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 111.390631][ T8678] RSP: 002b:00007fbd98819028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 111.390650][ T8678] RAX: ffffffffffffffda RBX: 00007fbd97c25fa0 RCX: 00007fbd9799fb19 [ 111.390662][ T8678] RDX: 0000000000080200 RSI: 0000200000000a80 RDI: ffffffffffffff9c [ 111.390675][ T8678] RBP: 00007fbd97a37b70 R08: 0000000000000000 R09: 0000000000000000 [ 111.390686][ T8678] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 111.390697][ T8678] R13: 00007fbd97c26038 R14: 00007fbd97c25fa0 R15: 00007ffc998e8f18 [ 111.390725][ T8678] [ 111.496467][ T8685] netlink: 'syz.2.1094': attribute type 25 has an invalid length. [ 112.017591][ T8708] FAULT_INJECTION: forcing a failure. [ 112.017591][ T8708] name failslab, interval 1, probability 0, space 0, times 0 [ 112.017629][ T8708] CPU: 0 UID: 0 PID: 8708 Comm: syz.2.1104 Not tainted syzkaller #0 PREEMPT(full) [ 112.017651][ T8708] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 112.017669][ T8708] Call Trace: [ 112.017680][ T8708] [ 112.017688][ T8708] dump_stack_lvl+0x100/0x190 [ 112.017739][ T8708] should_fail_ex.cold+0x5/0xa [ 112.017777][ T8708] should_failslab+0xc2/0x120 [ 112.017804][ T8708] __kmalloc_cache_noprof+0x91/0x6d0 [ 112.017829][ T8708] ? vidtv_psi_network_name_desc_init+0x183/0x310 [ 112.017857][ T8708] ? vidtv_psi_service_list_desc_init+0x52/0x550 [ 112.017884][ T8708] vidtv_psi_service_list_desc_init+0x52/0x550 [ 112.017913][ T8708] vidtv_psi_nit_table_init+0x39a/0x5f0 [ 112.017941][ T8708] vidtv_channel_si_init+0xccf/0x18f0 [ 112.017975][ T8708] vidtv_mux_init+0x522/0xbf0 [ 112.018004][ T8708] vidtv_start_feed+0x34e/0x500 [ 112.018023][ T8708] ? __pfx_vidtv_start_feed+0x10/0x10 [ 112.018043][ T8708] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 112.018067][ T8708] ? find_held_lock+0x2b/0x80 [ 112.018095][ T8708] dmx_section_feed_start_filtering+0x3a8/0x660 [ 112.018124][ T8708] dvb_dmxdev_filter_start+0x767/0xdd0 [ 112.018151][ T8708] dvb_demux_do_ioctl+0xe64/0x1200 [ 112.018178][ T8708] dvb_usercopy+0x167/0x340 [ 112.018202][ T8708] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 112.018222][ T8708] ? __pfx_dvb_usercopy+0x10/0x10 [ 112.018247][ T8708] ? __fget_files+0x34/0x3d0 [ 112.018281][ T8708] ? selinux_file_ioctl+0x1e0/0x290 [ 112.018304][ T8708] dvb_demux_ioctl+0x29/0x40 [ 112.018328][ T8708] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 112.018354][ T8708] __x64_sys_ioctl+0x18e/0x210 [ 112.018375][ T8708] do_syscall_64+0x123/0x7b0 [ 112.018406][ T8708] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.018426][ T8708] RIP: 0033:0x7f7fcb59fb19 [ 112.018442][ T8708] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.018480][ T8708] RSP: 002b:00007f7fcc3bf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 112.018501][ T8708] RAX: ffffffffffffffda RBX: 00007f7fcb825fa0 RCX: 00007f7fcb59fb19 [ 112.018514][ T8708] RDX: 0000200000000280 RSI: 00000000403c6f2b RDI: 0000000000000005 [ 112.018532][ T8708] RBP: 00007f7fcb637b70 R08: 0000000000000000 R09: 0000000000000000 [ 112.018543][ T8708] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 112.018555][ T8708] R13: 00007f7fcb826038 R14: 00007f7fcb825fa0 R15: 00007ffd47e961f8 [ 112.018583][ T8708] [ 112.021587][ T8710] jffs2: notice: (8710) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 4 of xref (0 dead, 0 orphan) found. [ 112.032016][ T8708] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 112.032031][ T8708] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 112.032589][ T8708] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1104'. [ 112.032601][ T8708] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1104'. [ 112.032617][ T8708] netlink: 'syz.2.1104': attribute type 4 has an invalid length. [ 112.268469][ T8724] FAULT_INJECTION: forcing a failure. [ 112.268469][ T8724] name failslab, interval 1, probability 0, space 0, times 0 [ 112.268495][ T8724] CPU: 2 UID: 0 PID: 8724 Comm: syz.0.1110 Not tainted syzkaller #0 PREEMPT(full) [ 112.268536][ T8724] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 112.268548][ T8724] Call Trace: [ 112.268555][ T8724] [ 112.268563][ T8724] dump_stack_lvl+0x100/0x190 [ 112.268603][ T8724] should_fail_ex.cold+0x5/0xa [ 112.268630][ T8724] should_failslab+0xc2/0x120 [ 112.268653][ T8724] __kmalloc_cache_noprof+0x91/0x6d0 [ 112.268678][ T8724] ? snd_seq_create_port+0xcd/0x500 [ 112.268711][ T8724] snd_seq_create_port+0xcd/0x500 [ 112.268737][ T8724] snd_seq_ioctl_create_port+0x250/0x9e0 [ 112.268764][ T8724] ? __pfx_snd_seq_ioctl_create_port+0x10/0x10 [ 112.268819][ T8724] ? __pfx_sprintf+0x10/0x10 [ 112.268839][ T8724] ? chrdev_open+0x234/0x6a0 [ 112.268862][ T8724] ? do_file_open+0x20e/0x430 [ 112.268888][ T8724] call_seq_client_ctl+0xa3/0x130 [ 112.268919][ T8724] snd_seq_kernel_client_ctl+0x7c/0xd0 [ 112.268946][ T8724] create_port+0x19b/0x270 [ 112.268963][ T8724] ? __pfx_create_port+0x10/0x10 [ 112.268984][ T8724] ? __pfx_snd_seq_oss_event_input+0x10/0x10 [ 112.269003][ T8724] ? __pfx_free_devinfo+0x10/0x10 [ 112.269042][ T8724] ? find_held_lock+0x2b/0x80 [ 112.269064][ T8724] ? mark_held_locks+0x40/0x70 [ 112.269093][ T8724] snd_seq_oss_open+0x292/0xa40 [ 112.269117][ T8724] odev_open+0x6f/0x90 [ 112.269133][ T8724] ? __pfx_odev_open+0x10/0x10 [ 112.269150][ T8724] soundcore_open+0x2e3/0x5a0 [ 112.269179][ T8724] ? __pfx_soundcore_open+0x10/0x10 [ 112.269204][ T8724] chrdev_open+0x234/0x6a0 [ 112.269225][ T8724] ? __pfx_chrdev_open+0x10/0x10 [ 112.269247][ T8724] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 112.269269][ T8724] do_dentry_open+0x674/0x1470 [ 112.269288][ T8724] ? __pfx_chrdev_open+0x10/0x10 [ 112.269312][ T8724] vfs_open_consume+0xcc/0x460 [ 112.269339][ T8724] path_openat+0x1547/0x23f0 [ 112.269365][ T8724] ? __pfx_path_openat+0x10/0x10 [ 112.269393][ T8724] do_file_open+0x20e/0x430 [ 112.269418][ T8724] ? __pfx_do_file_open+0x10/0x10 [ 112.269458][ T8724] ? _raw_spin_unlock+0x28/0x50 [ 112.269475][ T8724] ? alloc_fd+0x471/0x7a0 [ 112.269505][ T8724] do_sys_openat2+0x163/0x1d0 [ 112.269530][ T8724] ? __pfx_do_sys_openat2+0x10/0x10 [ 112.269562][ T8724] __x64_sys_openat+0x12d/0x210 [ 112.269587][ T8724] ? __pfx___x64_sys_openat+0x10/0x10 [ 112.269621][ T8724] do_syscall_64+0x123/0x7b0 [ 112.269643][ T8724] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.269661][ T8724] RIP: 0033:0x7fbaba59fb19 [ 112.269676][ T8724] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.269692][ T8724] RSP: 002b:00007fbabb3d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 112.269712][ T8724] RAX: ffffffffffffffda RBX: 00007fbaba825fa0 RCX: 00007fbaba59fb19 [ 112.269724][ T8724] RDX: 0000000000080200 RSI: 0000200000000a80 RDI: ffffffffffffff9c [ 112.269736][ T8724] RBP: 00007fbaba637b70 R08: 0000000000000000 R09: 0000000000000000 [ 112.269747][ T8724] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 112.269758][ T8724] R13: 00007fbaba826038 R14: 00007fbaba825fa0 R15: 00007ffc13239da8 [ 112.269784][ T8724] [ 112.269833][ T8724] ALSA: seq_oss: can't create port [ 112.457532][ T43] kauditd_printk_skb: 11 callbacks suppressed [ 112.457558][ T43] audit: type=1400 audit(1794229236.250:1002): avc: denied { write } for pid=8730 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 112.514098][ T43] audit: type=1400 audit(1794229236.300:1003): avc: denied { write } for pid=8735 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 113.003398][ T8764] ip_tables: iptables: counters copy to user failed while replacing table [ 113.506077][ T8792] xt_hashlimit: size too large, truncated to 1048576 [ 113.613140][ T8793] netlink: 'syz.2.1138': attribute type 2 has an invalid length. [ 113.944969][ T8804] Unknown cursor 12 [ 114.378177][ T43] audit: type=1400 audit(1794229238.170:1004): avc: denied { mount } for pid=8815 comm="syz.2.1149" name="/" dev="loop0" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 114.614485][ T8832] xt_hashlimit: size too large, truncated to 1048576 [ 114.741044][ T8832] netlink: 'syz.1.1157': attribute type 2 has an invalid length. [ 115.027342][ T8842] usb usb1: usbfs: interface 0 claimed by hub while 'syz.2.1161' resets device [ 115.643847][ T42] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 116.315079][ T8870] jffs2: notice: (8870) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 4 of xref (0 dead, 0 orphan) found. [ 116.318104][ T43] audit: type=1400 audit(1794229240.110:1005): avc: denied { remount } for pid=8869 comm="syz.0.1173" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 116.866147][ T42] usb 7-1: New USB device found: idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 117.222078][ T8887] jffs2: notice: (8887) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 4 of xref (0 dead, 0 orphan) found. [ 117.225236][ T43] audit: type=1400 audit(1794229241.000:1006): avc: denied { write } for pid=8886 comm="syz.3.1180" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 117.226154][ T43] audit: type=1400 audit(1794229241.000:1007): avc: denied { create } for pid=8886 comm="syz.3.1180" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 117.241182][ T43] audit: type=1400 audit(1794229241.000:1008): avc: denied { read append } for pid=8886 comm="syz.3.1180" name="file0" dev="jffs2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 117.241216][ T43] audit: type=1400 audit(1794229241.000:1009): avc: denied { open } for pid=8886 comm="syz.3.1180" path="/291/file0/file0" dev="jffs2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 117.438283][ T8896] jffs2: notice: (8896) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 4 of xref (0 dead, 0 orphan) found. [ 117.441149][ T43] audit: type=1400 audit(1794229241.220:1010): avc: denied { write } for pid=8895 comm="syz.3.1183" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 117.455624][ T43] audit: type=1400 audit(1794229241.220:1011): avc: denied { write } for pid=8895 comm="syz.3.1183" name="file0" dev="jffs2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 117.506972][ T42] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 117.506992][ T42] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 117.507014][ T42] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.648212][ T8848] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 117.818220][ T42] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 118.009003][ T8903] tmpfs: Bad value for 'mpol' [ 118.014264][ T5964] usb 7-1: USB disconnect, device number 11 [ 118.439508][ T8923] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.573691][ T8931] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1197'. [ 118.823425][ T8937] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1200'. [ 119.240721][ T50] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 119.451167][ T50] usb 7-1: New USB device found: idVendor=0451, idProduct=505f, bcdDevice=1.00 [ 119.451997][ T50] usb 7-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 119.452021][ T50] usb 7-1: config 2 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 119.452031][ T50] usb 7-1: config 2 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 119.452042][ T50] usb 7-1: config 2 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 119.452787][ T50] usb 7-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 119.452816][ T50] usb 7-1: config 2 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 119.452831][ T50] usb 7-1: config 2 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 119.452847][ T50] usb 7-1: config 2 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 119.454391][ T50] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.454403][ T50] usb 7-1: Product: syz [ 119.454410][ T50] usb 7-1: Manufacturer: syz [ 119.454416][ T50] usb 7-1: SerialNumber: syz [ 119.457978][ T50] ti_usb_3410_5052 7-1:2.0: TI USB 5052 2 port adapter converter detected [ 119.465622][ T50] usb 7-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 119.469408][ T50] usb 7-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 119.669511][ T8951] ti_usb_3410_5052_2 ttyUSB0: ti_open - no interrupt urb [ 119.674297][ T50] usb 7-1: USB disconnect, device number 12 [ 119.683098][ T50] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 119.684832][ T50] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 119.685397][ T50] ti_usb_3410_5052 7-1:2.0: device disconnected [ 120.248211][ T8979] comedi comedi0: fl512: I/O base address not correctly aligned [ 121.809171][ T43] audit: type=1400 audit(1794229245.600:1012): avc: denied { write } for pid=9003 comm="syz.2.1226" name="/" dev="9p" ino=76021865 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 121.809282][ T43] audit: type=1400 audit(1794229245.600:1013): avc: denied { associate } for pid=9003 comm="syz.2.1226" name="file0" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 121.812047][ T43] audit: type=1400 audit(1794229245.600:1014): avc: denied { write } for pid=9003 comm="syz.2.1226" name="file0" dev="9p" ino=76021867 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 122.657132][ T9027] netdevsim netdevsim0 netdevsim0: IPsec offload requires 128 bit authentication [ 122.789064][ T43] audit: type=1400 audit(1794229246.590:1015): avc: denied { ioctl } for pid=9030 comm="syz.0.1236" path="socket:[38439]" dev="sockfs" ino=38439 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 123.140887][ T50] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 123.326471][ T9041] fuse: Bad value for 'fd' [ 123.350791][ T50] usb 7-1: Using ep0 maxpacket: 8 [ 123.351554][ T50] usb 7-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 123.352514][ T50] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 123.352533][ T50] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 123.352547][ T50] usb 7-1: config 0 has no interface number 0 [ 123.352577][ T50] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 123.352594][ T50] usb 7-1: config 0 interface 55 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 123.352625][ T50] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.354965][ T50] usb 7-1: config 0 descriptor?? [ 123.357369][ T50] ldusb 7-1:0.55: Interrupt in endpoint not found [ 123.560694][ T5871] usb 7-1: USB disconnect, device number 13 [ 123.984284][ T9048] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1243'. [ 124.194246][ T43] audit: type=1400 audit(1794229247.990:1016): avc: denied { search } for pid=9057 comm="syz.3.1248" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 124.194337][ T43] audit: type=1400 audit(1794229247.990:1017): avc: denied { read } for pid=9057 comm="syz.3.1248" name="trace_pipe" dev="tracefs" ino=5432 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 124.194375][ T43] audit: type=1400 audit(1794229247.990:1018): avc: denied { open } for pid=9057 comm="syz.3.1248" path="/308/mnt/trace_pipe" dev="tracefs" ino=5432 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 124.278244][ T43] audit: type=1400 audit(1794229248.080:1019): avc: denied { create } for pid=9059 comm="syz.3.1249" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 124.280081][ T43] audit: type=1400 audit(1794229248.080:1020): avc: denied { bind } for pid=9059 comm="syz.3.1249" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 124.280448][ T43] audit: type=1400 audit(1794229248.080:1021): avc: denied { connect } for pid=9059 comm="syz.3.1249" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 124.281008][ T43] audit: type=1400 audit(1794229248.080:1022): avc: denied { write } for pid=9059 comm="syz.3.1249" laddr=::1 faddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 124.318748][ T43] audit: type=1400 audit(1794229248.080:1023): avc: denied { write } for pid=9061 comm="syz.3.1250" name="functions" dev="configfs" ino=13782 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 124.325439][ T43] audit: type=1400 audit(1794229248.130:1024): avc: denied { write } for pid=9061 comm="syz.3.1250" name="functions" dev="configfs" ino=13782 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclas ** replaying previous printk message ** [ 124.325439][ T43] audit: type=1400 audit(1794229248.130:1024): avc: denied { write } for pid=9061 comm="syz.3.1250" name="functions" dev="configfs" ino=13782 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 124.337915][ T9062] [ 124.347825][ T9062] ====================================================== [ 124.351039][ T9062] WARNING: possible circular locking dependency detected [ 124.353979][ T9062] syzkaller #0 Not tainted [ 124.355944][ T9062] ------------------------------------------------------ [ 124.358856][ T9062] syz.3.1250/9062 is trying to acquire lock: [ 124.361267][ T9062] ffffffff91637388 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x5ae/0x950 [ 124.364320][ T9062] [ 124.364320][ T9062] but task is already holding lock: [ 124.367232][ T9062] ffff88806387d6c0 (&sb->s_type->i_mutex_key#31){++++}-{4:4}, at: vfs_rmdir+0xed/0x8e0 [ 124.370963][ T9062] [ 124.370963][ T9062] which lock already depends on the new lock. [ 124.370963][ T9062] [ 124.374631][ T9062] [ 124.374631][ T9062] the existing dependency chain (in reverse order) is: [ 124.378104][ T9062] [ 124.378104][ T9062] -> #3 (&sb->s_type->i_mutex_key#31){++++}-{4:4}: [ 124.381145][ T9062] lock_acquire+0x1d1/0x380 [ 124.382909][ T9062] down_write+0x86/0x1f0 [ 124.384494][ T9062] configfs_depend_item_unlocked+0xf3/0x6a0 [ 124.386525][ T9062] usbg_make_tpg+0x251/0x610 [ 124.388138][ T9062] target_fabric_make_tpg+0xab/0x8c0 [ 124.390025][ T9062] configfs_mkdir+0x525/0xd40 [ 124.391728][ T9062] vfs_mkdir+0x36d/0x8a0 [ 124.393416][ T9062] filename_mkdirat+0x4c4/0x630 [ 124.395255][ T9062] __x64_sys_mkdirat+0x89/0xc0 [ 124.396941][ T9062] do_syscall_64+0x123/0x7b0 [ 124.398549][ T9062] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.400530][ T9062] [ 124.400530][ T9062] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 124.403056][ T9062] lock_acquire+0x1d1/0x380 [ 124.404658][ T9062] __mutex_lock+0x19f/0x1c10 [ 124.406269][ T9062] tcm_alloc_inst+0x5f/0x1e0 [ 124.407842][ T9062] try_get_usb_function_instance+0x136/0x1f0 [ 124.409864][ T9062] usb_get_function_instance+0x16/0x70 [ 124.411735][ T9062] function_make+0x18c/0x3f0 [ 124.413406][ T9062] configfs_mkdir+0x525/0xd40 [ 124.415134][ T9062] vfs_mkdir+0x36d/0x8a0 [ 124.416965][ T9062] filename_mkdirat+0x4c4/0x630 [ 124.419134][ T9062] __x64_sys_mkdirat+0x89/0xc0 [ 124.421338][ T9062] do_syscall_64+0x123/0x7b0 [ 124.423438][ T9062] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.426186][ T9062] [ 124.426186][ T9062] -> #1 (func_lock){+.+.}-{4:4}: [ 124.429139][ T9062] lock_acquire+0x1d1/0x380 [ 124.431260][ T9062] __mutex_lock+0x19f/0x1c10 [ 124.433430][ T9062] try_get_usb_function_instance+0x26/0x1f0 [ 124.435973][ T9062] usb_get_function_instance+0x16/0x70 [ 124.438403][ T9062] function_make+0x18c/0x3f0 [ 124.440495][ T9062] configfs_mkdir+0x525/0xd40 [ 124.442707][ T9062] vfs_mkdir+0x36d/0x8a0 [ 124.444798][ T9062] filename_mkdirat+0x4c4/0x630 [ 124.447093][ T9062] __x64_sys_mkdirat+0x89/0xc0 [ 124.449328][ T9062] do_syscall_64+0x123/0x7b0 [ 124.451492][ T9062] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.454191][ T9062] [ 124.454191][ T9062] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 124.457590][ T9062] check_prev_add+0xeb/0xe60 [ 124.459561][ T9062] __lock_acquire+0x1528/0x1f40 [ 124.461664][ T9062] lock_acquire+0x1d1/0x380 [ 124.463757][ T9062] __mutex_lock+0x19f/0x1c10 [ 124.466008][ T9062] configfs_rmdir+0x5ae/0x950 [ 124.468079][ T9062] vfs_rmdir+0x328/0x8e0 [ 124.470050][ T9062] filename_rmdir+0x31a/0x610 [ 124.472212][ T9062] __x64_sys_rmdir+0x46/0x70 [ 124.474379][ T9062] do_syscall_64+0x123/0x7b0 [ 124.476525][ T9062] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.479223][ T9062] [ 124.479223][ T9062] other info that might help us debug this: [ 124.479223][ T9062] [ 124.483402][ T9062] Chain exists of: [ 124.483402][ T9062] gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#31 [ 124.483402][ T9062] [ 124.489371][ T9062] Possible unsafe locking scenario: [ 124.489371][ T9062] [ 124.492388][ T9062] CPU0 CPU1 [ 124.494666][ T9062] ---- ---- [ 124.496955][ T9062] lock(&sb->s_type->i_mutex_key#31); [ 124.499176][ T9062] lock(tpg_instances_lock); [ 124.502125][ T9062] lock(&sb->s_type->i_mutex_key#31); [ 124.505485][ T9062] lock(gadget_subsys.su_mutex); [ 124.507548][ T9062] [ 124.507548][ T9062] *** DEADLOCK *** [ 124.507548][ T9062] [ 124.510949][ T9062] locks held by syz.3.1250/9062: 3, on CPU#2: [ 124.513430][ T9062] #0: ffff888025fa6478 (sb_writers#20){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 [ 124.517294][ T9062] #1: ffff888059c6bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 [ 124.522038][ T9062] #2: ffff88806387d6c0 (&sb->s_type->i_mutex_key#31){++++}-{4:4}, at: vfs_rmdir+0xed/0x8e0 [ 124.526252][ T9062] [ 124.526252][ T9062] stack backtrace: [ 124.527904][ T855] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 124.531678][ T9062] CPU: 2 UID: 0 PID: 9062 Comm: syz.3.1250 Not tainted syzkaller #0 PREEMPT(full) [ 124.535468][ T9062] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 124.539496][ T9062] Call Trace: [ 124.540931][ T9062] [ 124.542177][ T9062] dump_stack_lvl+0x100/0x190 [ 124.544195][ T9062] print_circular_bug.cold+0x178/0x1be [ 124.546530][ T9062] check_noncircular+0x146/0x160 [ 124.548617][ T9062] ? detach_attrs+0x58b/0x7d0 [ 124.550608][ T9062] check_prev_add+0xeb/0xe60 [ 124.552549][ T9062] ? detach_attrs+0x58b/0x7d0 [ 124.554444][ T9062] ? configfs_rmdir+0x598/0x950 [ 124.556221][ T9062] __lock_acquire+0x1528/0x1f40 [ 124.558183][ T9062] lock_acquire+0x1d1/0x380 [ 124.560113][ T9062] ? configfs_rmdir+0x5ae/0x950 [ 124.562109][ T9062] ? __pfx___might_resched+0x10/0x10 [ 124.564376][ T9062] ? __lock_acquire+0x5c0/0x1f40 [ 124.566480][ T9062] __mutex_lock+0x19f/0x1c10 [ 124.568373][ T9062] ? configfs_rmdir+0x5ae/0x950 [ 124.570454][ T9062] ? configfs_rmdir+0x5ae/0x950 [ 124.572546][ T9062] ? reacquire_held_locks+0xdd/0x1f0 [ 124.574806][ T9062] ? __pfx___mutex_lock+0x10/0x10 [ 124.576976][ T9062] ? do_raw_spin_lock+0x128/0x260 [ 124.579072][ T9062] ? find_held_lock+0x2b/0x80 [ 124.581095][ T9062] ? fast_dput+0x2fe/0x6f0 [ 124.583004][ T9062] ? do_raw_spin_unlock+0x145/0x1e0 [ 124.585259][ T9062] ? _raw_spin_unlock+0x28/0x50 [ 124.587332][ T9062] ? fast_dput+0x168/0x6f0 [ 124.589228][ T9062] ? configfs_rmdir+0x5ae/0x950 [ 124.591281][ T9062] configfs_rmdir+0x5ae/0x950 [ 124.593338][ T9062] ? __pfx_configfs_rmdir+0x10/0x10 [ 124.595532][ T9062] ? __pfx_down_write+0x10/0x10 [ 124.597661][ T9062] vfs_rmdir+0x328/0x8e0 [ 124.599493][ T9062] filename_rmdir+0x31a/0x610 [ 124.601516][ T9062] ? __pfx_filename_rmdir+0x10/0x10 [ 124.603719][ T9062] ? do_getname+0x191/0x390 [ 124.605696][ T9062] __x64_sys_rmdir+0x46/0x70 [ 124.607663][ T9062] do_syscall_64+0x123/0x7b0 [ 124.609628][ T9062] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.612003][ T9062] RIP: 0033:0x7fbd9799fb19 [ 124.613869][ T9062] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.620238][ T9062] RSP: 002b:00007fbd98819028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 124.623427][ T9062] RAX: ffffffffffffffda RBX: 00007fbd97c25fa0 RCX: 00007fbd9799fb19 [ 124.626573][ T9062] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000880 [ 124.629661][ T9062] RBP: 00007fbd97a37b70 R08: 0000000000000000 R09: 0000000000000000 [ 124.632686][ T9062] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.635818][ T9062] R13: 00007fbd97c26038 R14: 00007fbd97c25fa0 R15: 00007ffc998e8f18 [ 124.638796][ T9062] [ 125.281197][ T855] usb 7-1: Using ep0 maxpacket: 8 [ 125.525116][ T855] usb 7-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 126.018567][ T855] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 126.018783][ T855] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 126.018797][ T855] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 126.018817][ T855] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 126.018836][ T855] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 126.018864][ T855] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.546026][ T855] usb 7-1: GET_CAPABILITIES returned 0 [ 126.546047][ T855] usbtmc 7-1:16.0: can't read capabilities [ 126.748499][ T5871] usb 7-1: USB disconnect, device number 14 [ 132.791014][ T1447] ieee802154 phy0 wpan0: encryption failed: -22