last executing test programs: 2m14.391064933s ago: executing program 1 (id=1828): openat$fb0(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a4c000000060a01040000000000000000010000000900020073797a3200000000200004801c0001800c00010062697477697365000c00028000000340000000040900010073797a3000000000140000001100010000000000000000000700000af3b384b387077bde72bdcb708bc08adaef39f1d253f2050a96d2d28a36d9dd32e038354dabb555"], 0x74}}, 0x0) socket$kcm(0x2, 0xa, 0x2) socket$kcm(0x21, 0x2, 0x2) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$key(0xf, 0x3, 0x2) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) socket$netlink(0x10, 0x3, 0xa) socket$inet6(0xa, 0x3, 0x7) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000002f00000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r1], 0x5c}, 0x1, 0x0, 0x0, 0x8804}, 0x40) 2m14.388362517s ago: executing program 1 (id=1830): mknod(&(0x7f0000000000)='./file0\x00', 0x8000, 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040)='xfs\x00', 0x10080, &(0x7f00000000c0)='norecovery') r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020}, 0x2020) mknod(&(0x7f0000000000)='./file0\x00', 0x8000, 0x0) (async) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040)='xfs\x00', 0x10080, &(0x7f00000000c0)='norecovery') (async) openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) (async) read$FUSE(r0, &(0x7f0000000180)={0x2020}, 0x2020) (async) 2m14.321469492s ago: executing program 1 (id=1832): ioctl$UI_SET_ABSBIT(0xffffffffffffffff, 0x40045567, 0x39) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000004c0)=ANY=[@ANYBLOB="e0000000120001022bbd7000fcdbdf256374722d74776f666973682d617678000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8a9508fbae537ccd932d2e0be000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400"], 0xe0}, 0x1, 0x0, 0x0, 0x8000}, 0x4800) syz_emit_vhci(&(0x7f00000000c0)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0xc}, @hci_rp_read_local_version={{0x1}, {0x5, 0x81, 0x200, 0xd, 0xff, 0xfe95}}}}, 0xf) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x48, 0x48, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x1, 0x2}]}, @func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{0x1, 0x2}, {0x10, 0x5}, {0x4, 0x4}]}, @func_proto]}}, 0x0, 0x62}, 0x28) syz_open_dev$sndctrl(0x0, 0x0, 0x801) 2m14.320856355s ago: executing program 1 (id=1834): r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) chdir(&(0x7f0000000080)='./file0/file1\x00') mount$bind(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x2125099, 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0xc00, 0x0) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000980)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010026c170000400000015000000180001801400020064756d6d7930"], 0x2c}, 0x1, 0x0, 0x0, 0x2048050}, 0x880) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f00000005c0), 0x10) recvmmsg(r2, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}, 0x32}], 0x1, 0x122, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r3, 0x0) 2m14.211811895s ago: executing program 1 (id=1836): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110e22fff6) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x820c1, 0x0) ioctl$TUNSETOFFLOAD(r3, 0x4004743d, 0x110e22fff6) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe8e, 0x0, 0x0, 0x0, 0x0, 0x4d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000200400001"], 0x48) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000000)=ANY=[@ANYBLOB="d4000000", @ANYRES16=r1, @ANYBLOB="01002abd7000ffdbdf250300000008000100000000000c00060003"], 0xd4}, 0x1, 0x0, 0x0, 0x4000010}, 0x2048000) 2m14.060436387s ago: executing program 1 (id=1837): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="38000000410007012cbd7000fadfdf25037c00000400c280200001801c00108014000d"], 0x38}, 0x1, 0x0, 0x0, 0x4c084}, 0xc000) (async) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x6a0, 0x0, 0xce}]}) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000001000), 0x20702, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) (async) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) syz_io_uring_setup(0x9bc, 0x0, 0x0, 0x0, &(0x7f0000000000)) (async) socket$netlink(0x10, 0x3, 0x0) sendfile(r5, r5, 0x0, 0x200000200003) (async) cachestat(r5, &(0x7f0000000000)={0x9}, &(0x7f0000000040), 0x0) (async) r7 = syz_open_dev$ttys(0xc, 0x2, 0x1) setsockopt$X25_QBITINCL(r6, 0x106, 0x1, &(0x7f0000000180), 0x4) (async) ioctl$TIOCSIG(r7, 0x40045436, 0xd) (async) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000300000000000000000000f195"], 0x0}, 0x94) (async) r9 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r9, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r10 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) (async) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0x0, 0x0}, 0x8) r12 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r11, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000200)={r12, r10, 0x4}, 0x5) r13 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r13, 0x0) (async) syz_io_uring_setup(0x83, &(0x7f0000000580)={0x0, 0xe7b7, 0x13500, 0x0, 0x352}, &(0x7f0000000240)=0x0, &(0x7f0000001880), 0x0) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) clock_gettime(0x17, 0x0) (async) r15 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f00000001c0)=ANY=[@ANYRES8=r1, @ANYBLOB="74f72a37f1ab7b64de7a929ccd5b2005af69e9afbc7afd9f62a29011", @ANYRES8=r12, @ANYRES16=r14, @ANYRES64=r8, @ANYRES64=0x0], &(0x7f0000000140)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000000)={0xffffffff, 0x0, 0xffffffff}, 0x10}, 0x94) ioctl$TUNSETSTEERINGEBPF(r4, 0x800454e0, &(0x7f00000002c0)=r15) 2m14.048474292s ago: executing program 32 (id=1837): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="38000000410007012cbd7000fadfdf25037c00000400c280200001801c00108014000d"], 0x38}, 0x1, 0x0, 0x0, 0x4c084}, 0xc000) (async) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x6a0, 0x0, 0xce}]}) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000001000), 0x20702, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) (async) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) syz_io_uring_setup(0x9bc, 0x0, 0x0, 0x0, &(0x7f0000000000)) (async) socket$netlink(0x10, 0x3, 0x0) sendfile(r5, r5, 0x0, 0x200000200003) (async) cachestat(r5, &(0x7f0000000000)={0x9}, &(0x7f0000000040), 0x0) (async) r7 = syz_open_dev$ttys(0xc, 0x2, 0x1) setsockopt$X25_QBITINCL(r6, 0x106, 0x1, &(0x7f0000000180), 0x4) (async) ioctl$TIOCSIG(r7, 0x40045436, 0xd) (async) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000300000000000000000000f195"], 0x0}, 0x94) (async) r9 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r9, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r10 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) (async) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0x0, 0x0}, 0x8) r12 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r11, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000200)={r12, r10, 0x4}, 0x5) r13 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r13, 0x0) (async) syz_io_uring_setup(0x83, &(0x7f0000000580)={0x0, 0xe7b7, 0x13500, 0x0, 0x352}, &(0x7f0000000240)=0x0, &(0x7f0000001880), 0x0) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) clock_gettime(0x17, 0x0) (async) r15 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f00000001c0)=ANY=[@ANYRES8=r1, @ANYBLOB="74f72a37f1ab7b64de7a929ccd5b2005af69e9afbc7afd9f62a29011", @ANYRES8=r12, @ANYRES16=r14, @ANYRES64=r8, @ANYRES64=0x0], &(0x7f0000000140)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000000)={0xffffffff, 0x0, 0xffffffff}, 0x10}, 0x94) ioctl$TUNSETSTEERINGEBPF(r4, 0x800454e0, &(0x7f00000002c0)=r15) 33.129509089s ago: executing program 0 (id=2895): mount$9p_virtio(&(0x7f0000000040), &(0x7f00000001c0)='.\x00', &(0x7f0000000080), 0x4, &(0x7f00000000c0)={'trans=virtio,', {[{@aname={'aname', 0x3d, ')@)'}}]}}) (async) mount$9p_virtio(&(0x7f0000000040), &(0x7f00000001c0)='.\x00', &(0x7f0000000080), 0x4, &(0x7f00000000c0)={'trans=virtio,', {[{@aname={'aname', 0x3d, ')@)'}}]}}) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x129a02, 0x5) (async) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x129a02, 0x5) r2 = epoll_create1(0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000100)) shutdown(r3, 0x0) epoll_wait(r2, &(0x7f0000000280)=[{}], 0x1, 0x101) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r3, &(0x7f0000000140)={0x2000200b}) (async) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r3, &(0x7f0000000140)={0x2000200b}) r4 = syz_open_dev$ndb(&(0x7f0000000080), 0x0, 0x42) ioctl$BLKROTATIONAL(r4, 0x127e, &(0x7f00000000c0)) (async) ioctl$BLKROTATIONAL(r4, 0x127e, &(0x7f00000000c0)) sendfile(r1, r0, &(0x7f00000001c0)=0x1, 0x8) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff0008000340000000384c0000000c0a01010000000000000000070000000900020073797a31000000000900010073797a3000000000200003801c0000800800034000000002100002800c000280080001800000000014000000020a01"], 0xf4}}, 0x0) (async) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff0008000340000000384c0000000c0a01010000000000000000070000000900020073797a31000000000900010073797a3000000000200003801c0000800800034000000002100002800c000280080001800000000014000000020a01"], 0xf4}}, 0x0) read$FUSE(r5, &(0x7f0000003480)={0x2020}, 0x2020) 33.050095609s ago: executing program 0 (id=2897): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r1, &(0x7f0000000040), 0x10) listen(r1, 0x5) r2 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r2, &(0x7f0000000080), 0x10) sendmmsg(r2, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x40011}], 0x1}}], 0x1, 0x24008094) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x34, 0x6, 0xa, 0x41f, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x6, 0x7, 0x1, 0x0, "8ef5"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x5c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) 32.899587086s ago: executing program 0 (id=2901): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="02180000100000000000000000000000030005000000000002000010e000000100000000000000000800120000000000000000000000000010000000000000000000000000000000ac1414bb000000000000000000000000fc010000000000000000000000000000030006000000000002"], 0x80}}, 0x0) fcntl$notify(r0, 0x402, 0x35) r1 = socket$key(0xf, 0x3, 0x2) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000002c0)={'bridge_slave_1\x00', 0xc201}) write$tun(r2, &(0x7f00000005c0)={@val={0x0, 0x800}, @val={0x3, 0x5, 0x7, 0x3, 0x80, 0x6}, @ipv6=@generic={0x4, 0x6, "84e437", 0x61, 0x0, 0x1, @mcast1, @mcast2, {[], "f0db043c0bdd5fa862ab40e05a5dd2c234dc7773e3831178a890b2a83c13e6f5d1ec7ad9739f588cc88c83a9f836eb8045335fd06dd485c2446031e6847afe2d67d567703ef49b27e9e4936532e95fc00244b2e3f5d127b50a7c3001ae37c96c04"}}}, 0x97) sendmsg$key(r1, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)={0x2, 0x400000000000003, 0x0, 0x9, 0x16, 0x0, 0x0, 0x0, [@sadb_lifetime={0x4, 0x3, 0x4}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @rand_addr, 0x1}}, @sadb_lifetime={0x4, 0x4, 0xc84a}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x60000003}, @sadb_address={0x5, 0x5, 0x0, 0x20, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}}]}, 0xb0}}, 0x84) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) r5 = dup3(r4, r3, 0x0) r6 = fanotify_init(0x20, 0x1000) fanotify_mark(r6, 0x200, 0x8000001, r5, &(0x7f0000000100)='./file1\x00') r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) renameat2(0xffffffffffffff9c, &(0x7f0000000580)='./file1\x00', 0xffffffffffffff9c, 0x0, 0x0) r8 = eventfd(0x6) close(r8) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0x4, {{@in6=@dev={0xfe, 0x80, '\x00', 0x3e}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x800000000000000, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {0x0, 0x0, 0x0, 0xe}, 0x3, 0x6e6bb5, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x810}, 0x0) openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000001dc0), 0x1, 0x0) pwrite64(r8, 0x0, 0x0, 0x1) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r7, 0x8000000000000001) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r11 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) dup3(r11, r10, 0x0) r12 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r12, &(0x7f0000000180)={0x0, 0x63, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000100000000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbfffffffffffffffdffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000003382"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r12, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b800000015"], 0xb8}}, 0x0) 32.819262412s ago: executing program 0 (id=2903): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$nfs4(&(0x7f0000000040)='/', &(0x7f0000000080)='./file0\x00', 0x0, 0x197841, 0x0) umount2(&(0x7f00000000c0)='./file0\x00', 0x8) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="640000000206010200000000000000000000fdff140007800800134001a576ea08000640000000010500010006000000050005000a00000005000400000000000900020073797a310000000016000300686173683a6e6574"], 0x64}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r3, 0x4048aec9, &(0x7f0000000380)={0x2, 0x0, @ioapic={0xeeee0000, 0x1, 0x8, 0x83e, 0x0, [{0x7, 0x9, 0x81, '\x00', 0x6}, {0x9, 0x5, 0x6, '\x00', 0x4}, {0x7, 0x28, 0x2, '\x00', 0x1}, {0xc0, 0x3, 0x5, '\x00', 0x7c}, {0x0, 0x1, 0x84, '\x00', 0x7}, {0x9, 0x4, 0x5, '\x00', 0x5}, {0x6, 0x8, 0x7, '\x00', 0x3}, {0x4, 0x2, 0x4, '\x00', 0xcc}, {0x3, 0x9, 0x9, '\x00', 0x8}, {0xe, 0x4, 0x8, '\x00', 0x8}, {0x7f, 0xf, 0xe, '\x00', 0x4}, {0x8, 0xbc, 0x4, '\x00', 0x7a}, {0x6, 0x7, 0x4, '\x00', 0x1}, {0x9, 0x81, 0x5, '\x00', 0x40}, {0x10, 0x4, 0x2, '\x00', 0x4}, {0x1, 0xe, 0x2, '\x00', 0x2}, {0x1, 0x1, 0x2, '\x00', 0x7}, {0xc, 0x6, 0x0, '\x00', 0x20}, {0xf9, 0xb6}, {0x1, 0x4, 0x83, '\x00', 0x4}, {0xf5, 0x0, 0xff, '\x00', 0x7}, {0x9, 0x48, 0x1, '\x00', 0x6}, {0x9, 0x8, 0x8, '\x00', 0x4b}, {0x2, 0x6, 0x4, '\x00', 0x6}]}}) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) recvmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000140)=""/178, 0xb2}, {&(0x7f0000000200)=""/18, 0x12}, {0x0}, {&(0x7f0000001400)=""/84, 0x54}, {0x0}, {0x0}, {0x0}], 0x7}, 0x121) shutdown(r0, 0x1) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000240)=0xb35f6a, 0x4) umount2(&(0x7f0000000340)='./file0\x00', 0x8) 32.707681812s ago: executing program 0 (id=2907): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000009c0)={0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="40000f000000012721dcfe14c639a500ba17162716"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x1, 0xc95a, 0xf, 0x8, 0x80, 0x8, 0x3, 0x10007e, 0x20000006, 0x53, 0x6, 0x10000, 0x80005, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0x10001, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x80000001, 0x26, 0xd, 0x1, 0x6, 0x7, 0xe661, 0x4, 0x7, 0x6, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x800080ee, 0xa, 0x17, 0x1, 0x9, 0x200, 0x3e, 0x8c, 0x6, 0xca9, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x10001, 0x5, 0x6, 0x6, 0x5, 0x1, 0x40], [0x10000007, 0x9, 0x80000130, 0x8004, 0x5, 0xfffffff3, 0x2, 0xc8, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x42f, 0xe, 0x312, 0x78, 0x1, 0x0, 0x2, 0x7, 0x7fff, 0x6, 0x4400, 0x401, 0x6, 0x1, 0xfc, 0x5, 0x1000005, 0x5f31, 0xd, 0x40000101, 0x1, 0x4, 0xffff80f1, 0x8, 0x6, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0xfffffe01, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93694, 0x43, 0x9], [0x7, 0xa, 0x0, 0x5, 0xfffffffe, 0x100, 0x8d2, 0xb42a, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x5, 0x8, 0x5, 0x1, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0xd, 0x800003, 0x200, 0x400080, 0x3, 0x4, 0x2950bfaf, 0x2, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x6, 0x0, 0x2, 0x21c, 0x120000, 0x3, 0x0, 0x80aaed, 0x4, 0x24], [0x9, 0x40bb33, 0x7ffffffd, 0xb, 0x5, 0x93a, 0x9, 0x1000006, 0x100, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x1000, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000001, 0x7, 0x4, 0xc8, 0xfffffffd, 0xfffff000, 0x4010080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d69b, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x928, 0xb1e, 0xc7, 0x200, 0xffff2441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 32.520496917s ago: executing program 0 (id=2910): ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000002c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xb}}, './file0\x00'}) sendmsg$IPSET_CMD_TYPE(r0, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x2c, 0xd, 0x6, 0x5, 0x0, 0x0, {0x2, 0x0, 0x9}, [@IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_FAMILY={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) (async) fsopen(&(0x7f0000000140)='ext3\x00', 0x0) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) r2 = socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x3) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) (async) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) keyctl$chown(0x4, r6, 0xee01, 0x0) (async) add_key(&(0x7f0000000080)='dns_resolver\x00', 0x0, &(0x7f0000000040)="42d7", 0xfffff, 0xfffffffffffffffe) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x100) (async) chroot(&(0x7f0000000100)='./file0\x00') (async) pivot_root(&(0x7f0000000600)='./file0\x00', 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f0000000100)=@newqdisc={0x34, 0x24, 0x3fe3aa0262d8c583, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x6, 0xa}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4, 0x8002}}]}, 0x34}, 0x1, 0x0, 0x0, 0x24000000}, 0x20004000) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newqdisc={0x4c, 0x24, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c}}]}, 0x4c}}, 0x0) (async) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040), 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x74, r1, 0x20, 0x70bd25, 0x25dfdbfc, {}, [@ETHTOOL_A_PAUSE_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}, @ETHTOOL_A_PAUSE_TX={0x5}, @ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}, @ETHTOOL_A_PAUSE_AUTONEG={0x5, 0x2, 0x1}, @ETHTOOL_A_PAUSE_AUTONEG={0x5}, @ETHTOOL_A_PAUSE_AUTONEG={0x5}, @ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}, @ETHTOOL_A_PAUSE_AUTONEG={0x5, 0x2, 0x1}]}, 0x74}, 0x1, 0x0, 0x0, 0x24040082}, 0x8000) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x28, 0x41, 0x1, 0x7fffc, 0x4, {0x1}, [@nested={0x4, 0x48}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x20}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd=r9}]}, 0x28}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) getsockopt(r9, 0xb7, 0x1, &(0x7f0000000400)=""/214, &(0x7f0000000500)=0xd6) 32.512741919s ago: executing program 33 (id=2910): ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000002c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xb}}, './file0\x00'}) sendmsg$IPSET_CMD_TYPE(r0, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x2c, 0xd, 0x6, 0x5, 0x0, 0x0, {0x2, 0x0, 0x9}, [@IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_FAMILY={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) (async) fsopen(&(0x7f0000000140)='ext3\x00', 0x0) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) r2 = socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x3) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) (async) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) keyctl$chown(0x4, r6, 0xee01, 0x0) (async) add_key(&(0x7f0000000080)='dns_resolver\x00', 0x0, &(0x7f0000000040)="42d7", 0xfffff, 0xfffffffffffffffe) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x100) (async) chroot(&(0x7f0000000100)='./file0\x00') (async) pivot_root(&(0x7f0000000600)='./file0\x00', 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f0000000100)=@newqdisc={0x34, 0x24, 0x3fe3aa0262d8c583, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x6, 0xa}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4, 0x8002}}]}, 0x34}, 0x1, 0x0, 0x0, 0x24000000}, 0x20004000) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newqdisc={0x4c, 0x24, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c}}]}, 0x4c}}, 0x0) (async) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040), 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x74, r1, 0x20, 0x70bd25, 0x25dfdbfc, {}, [@ETHTOOL_A_PAUSE_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}, @ETHTOOL_A_PAUSE_TX={0x5}, @ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}, @ETHTOOL_A_PAUSE_AUTONEG={0x5, 0x2, 0x1}, @ETHTOOL_A_PAUSE_AUTONEG={0x5}, @ETHTOOL_A_PAUSE_AUTONEG={0x5}, @ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}, @ETHTOOL_A_PAUSE_AUTONEG={0x5, 0x2, 0x1}]}, 0x74}, 0x1, 0x0, 0x0, 0x24040082}, 0x8000) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x28, 0x41, 0x1, 0x7fffc, 0x4, {0x1}, [@nested={0x4, 0x48}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x20}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd=r9}]}, 0x28}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) getsockopt(r9, 0xb7, 0x1, &(0x7f0000000400)=""/214, &(0x7f0000000500)=0xd6) 4.990089945s ago: executing program 5 (id=3212): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x1e, 0x305, 0x0, 0x25dfdbfe}, 0x14}, 0x1, 0x8000000}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@ipv4_newaddr={0x20, 0x14, 0x2, 0x70bd2b, 0x25dfdbfe, {0x2, 0x40, 0x40, 0xfe}, [@IFA_LOCAL={0x8, 0x2, @empty}]}, 0x20}, 0x1, 0x0, 0x0, 0xfdb79c81181c3caa}, 0x10) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_emit_ethernet(0x74, &(0x7f0000000000)={@link_local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x73, 0x0, @private=0x300, @multicast1=0xac1414aa}, {0x0, 0x0, 0xfffffe9a, 0x0, @gue={{0x2}}}}}}}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000580)='/proc/sys/net/ipv4/tcp_timestamps\x00', 0x1, 0x0) sendfile(r3, r2, &(0x7f00000000c0)=0x8b, 0x100000500) syz_usb_control_io$printer(r1, 0x0, 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r4, 0x5b03, 0x0) ioctl$OCFS2_IOC_UNRESVSP64(r4, 0x4030582b, &(0x7f0000000100)={0x62fba7193b86ac2f, 0x1, 0x32f, 0xfffffffffffffff7, 0x8000}) 3.489632764s ago: executing program 5 (id=3221): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000c80)={'batadv_slave_1\x00', 0x0}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x5}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f00000000c0)={r3, 0x9}, &(0x7f0000000100)=0xc) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000000)=@ipv4_newaddr={0x38, 0x14, 0x509, 0x70bd27, 0x25dfdbfd, {0x2, 0x1f, 0x0, 0xcb, r1}, [@IFA_BROADCAST={0x8, 0x4, @rand_addr=0x64010104}, @IFA_FLAGS={0x8, 0x8, 0x349}, @IFA_LOCAL={0x8, 0x2, @local}, @IFA_RT_PRIORITY={0x8, 0x9, 0x107}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040014}, 0x0) 3.489408538s ago: executing program 5 (id=3222): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f00000001c0), 0x2014042, &(0x7f0000000200)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}], [{@rootcontext={'rootcontext', 0x3d, 'system_u'}}, {@fsname={'fsname', 0x3d, 'hugetlb'}}, {@smackfshat={'smackfshat', 0x3d, '$!{:)-,%7{!:-$[.%*\']%\''}}, {@fscontext={'fscontext', 0x3d, 'staff_u'}}, {@dont_appraise}]}) 3.489326577s ago: executing program 5 (id=3223): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x585d}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @private2}]}]}, @IFLA_IFNAME={0x14, 0x3, 'ipvlan0\x00'}]}, 0x50}, 0x1, 0x0, 0xfffffffe, 0x840}, 0x4000014) 3.429791702s ago: executing program 5 (id=3224): syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) syz_usb_connect$uac1(0x5, 0xcb, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0xff, 0x499, 0x101f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xb9, 0x3, 0x1, 0x3, 0x80, 0x80, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x3, 0x19}, [@output_terminal={0x9, 0x24, 0x3, 0x6, 0x307, 0x4, 0x2}, @mixer_unit={0x6, 0x24, 0x4, 0x2, 0x1, "e1"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x3, 0x30, 0xab, "513539aa"}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x4, 0x1, 0x6, "2d381d46"}]}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x6, 0x6, 0x2, {0x7, 0x25, 0x1, 0xc, 0x7, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x0, 0xbe41, 0xe, 0x4}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x5, 0x9, 0x8, 0x1, 0x3}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0xbf, 0x2, 0x2, 0x7f, "c095"}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x4, 0x2, 0x7, 0x14}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x7, 0x3, 0x5, 0x4, "53f2", 'K'}]}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x1, 0x3b, 0x7, {0x7, 0x25, 0x1, 0xc, 0x6, 0x2}}}}}}}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x200, 0x7, 0x2, 0x8, 0x10, 0x2}, 0x19, &(0x7f0000000280)={0x5, 0xf, 0x19, 0x2, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x40, 0x5, 0xfffc}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x8, 0xff, 0x6f, 0x1}]}, 0x2, [{0x6c, &(0x7f00000002c0)=@string={0x6c, 0x3, "714b724129e88561340a9dc3eddf805acbb4bf05a35160ba51a42dc4378619cb221a76fa6b5c1f0d652c1db63caa8b22860b248f2f024c440d24f96a9826dea4c1a0951a55617ef703753c88048cbbdedda30a75a6cac106c655d8baf22ace4a25530a58fbda9ebbcbb7"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x200a}}]}) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={0xffffffffffffffff, 0x0, 0x0}, 0x20) r1 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x9, 0x4, 0x4, 0x2, 0x80, 0x1, 0x0, '\x00', 0x0, r1, 0x1, 0x1}, 0x48) mount$binderfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[]) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0) close(r0) 3.429172959s ago: executing program 3 (id=3226): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xa}, {0xffff, 0xffff}, {0x4}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_ECN={0x8}]}}]}, 0x38}}, 0x240080c4) socket$nl_route(0x10, 0x3, 0x0) 3.340288856s ago: executing program 3 (id=3227): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000040)={0xf0f071, 0x1}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0x1, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x10b85}, [@IFLA_IFNAME={0x14, 0x3, 'macsec0\x00'}, @IFLA_ADDRESS={0xa, 0x1, @local}]}, 0x40}, 0x1, 0x0, 0x0, 0x90}, 0x0) 3.340024558s ago: executing program 3 (id=3228): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@newnexthop={0x28, 0x68, 0x400, 0x3, 0x80000000, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x6}]}, @NHA_RES_GROUP={0x4}]}, 0x28}}, 0x40000) 3.339833256s ago: executing program 3 (id=3229): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, 0x0}, 0x94) socket$kcm(0x2, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x18, 0x1, 0x2, 0x801, 0x0, 0x0, {0xa, 0x0, 0xa}, [@CTA_EXPECT_MASTER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) socket$kcm(0x29, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$netlink(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r3, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) socket$inet_udp(0x2, 0x2, 0x0) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x7}, 0x94) sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x40, 0xd, 0xa, 0x3, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4004000}, 0x40000) syz_usb_connect(0x2, 0x2d, &(0x7f0000000a00)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e402010902"], 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000340)={r4, 0x0, 0x0}, 0x10) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/tty/ldiscs\x00', 0x0, 0x0) sendmsg$BATADV_CMD_SET_MESH(r6, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x7}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffffe}]}, 0x3c}}, 0x1) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd700000000000047c00000400c2800c000180060006008848"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 2.180068306s ago: executing program 5 (id=3237): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x10, &(0x7f0000000300)=ANY=[@ANYBLOB="180000005108000000000000000000feff00007017e5fb8d1c9cd15114e67b2da74dfee4aa25154de19cc8e82d6dbfbfaee86c4816ddf51264bdcd3e4c01", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000008520000002000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00'}, 0x94) r1 = socket$kcm(0xa, 0x2, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000180)={0x7, 0x8, 0x2}) r2 = socket(0x10, 0x3, 0x0) write(r2, &(0x7f0000000080)="240000004e0025000307f4f9002304000a04f55f08000100020100020800038005000000", 0x24) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0xffffff1f, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x41800, 0x66840}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @broadcast}]}}}, @IFLA_MTU={0x8, 0x4, 0x500}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000000}, 0x8000) r6 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000140)='dns_resolver\x00', 0x0, &(0x7f0000000080)='\x00\x00\x00\x00\x00\x00', 0x6, r6) bind$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e24, 0x3, @private1}, 0x1c) listen(r4, 0x5) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r7, &(0x7f0000000240)='.', 0x1, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r8 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901"], 0x0) syz_usb_control_io(r8, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) sendmsg$sock(r1, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) 1.114957985s ago: executing program 2 (id=3248): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$inet6(r0, &(0x7f0000000880)={&(0x7f0000000000)={0xa, 0x5e20, 0x2, @dev={0xfe, 0x80, '\x00', 0x44}, 0x2}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000040)="8000e8beec9dbc13", 0x8}], 0x1, &(0x7f0000000200)=ANY=[@ANYBLOB="1400"], 0x18}, 0x4000010) 1.11473599s ago: executing program 2 (id=3249): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x5}}, 0x1c) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @empty, 0x400}, 0x1c) syz_emit_ethernet(0x86, &(0x7f0000000080)={@multicast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x4400, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, {0x2000, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x1, 0x1, "93c9691928972925723d55c712e63c92b492a3c50c9c3d27093a79585e8b73b3", "8aa4c506bcba17a29171be64a1e0f09d", {"c952a7f1f0443ce3114cee3518bfb345"}}}}}}}, 0x0) 1.114665643s ago: executing program 2 (id=3250): chdir(0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x42402, 0x0) fallocate(r0, 0x8, 0x0, 0x8000) 1.059979542s ago: executing program 2 (id=3251): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x25}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x4, r1, 0x0}]) write$tun(r0, &(0x7f0000001400)=ANY=[], 0x152) 961.357652ms ago: executing program 2 (id=3252): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bond0\x00', 0x0}) sendto$packet(r0, &(0x7f00000002c0)="05031600d3fc140000004788031c09103c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 900.000897ms ago: executing program 2 (id=3253): r0 = accept$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00'}) getsockname$packet(r0, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000000c0)=0x14) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r3, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) mkdir(&(0x7f0000000040)='./cgroup/../file0/file0\x00', 0x4) syz_usb_connect(0x2, 0x34, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100002c464708c2153b003e66010203010902220001000000000904000001e3fe11000905000000000000000705936b"], 0x0) mkdir(0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/../file0/file0\x00', 0x200) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x1, 0x13) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {0xa, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) socket$netlink(0x10, 0x3, 0xc) 326.860267ms ago: executing program 4 (id=3263): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x1c) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(0xffffffffffffffff, 0x0, 0x10) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4c0000006d0067382bbd7000ffdadf2500000000", @ANYRES32=0x0, @ANYBLOB="0110040004b90400180034801400350076657468315f746f5f626f6e640000001400030076657468315f746f5f626f6e64"], 0x4c}, 0x1, 0x0, 0x0, 0x4000014}, 0x0) 326.751797ms ago: executing program 4 (id=3264): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$inet6(r0, &(0x7f0000000880)={&(0x7f0000000000)={0xa, 0x5e20, 0x2, @dev={0xfe, 0x80, '\x00', 0x44}, 0x2}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000040)="8000e8beec9dbc13", 0x8}], 0x1, &(0x7f0000000200)=ANY=[@ANYBLOB="1400000000000004"], 0x18}, 0x4000010) 326.703167ms ago: executing program 4 (id=3265): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = creat(0x0, 0x12a) close(r1) io_uring_setup(0x5702, 0x0) ioctl$TIOCOUTQ(r0, 0x4bfb, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x1000, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x18b701) ioctl$USBDEVFS_CLAIM_PORT(r2, 0x80045518, &(0x7f0000001340)=0x1) 323.271949ms ago: executing program 3 (id=3266): socket$packet(0x11, 0x3, 0x300) socket(0xa, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000738000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000530000/0x3000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x400c804) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc89e, 0xc000, 0x8, 0x276}) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffffff}, &(0x7f0000000000)={0x1f, 0xe, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000004"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 250.059615ms ago: executing program 3 (id=3267): syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x8082) syz_open_dev$sg(&(0x7f0000000280), 0x0, 0x103401) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x9, 0x0, &(0x7f0000000080)) 146.008µs ago: executing program 4 (id=3268): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4000003, &(0x7f0000000080)={0xffffffffffffffff}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4e21, 0x9, @mcast1, 0x9}, r1, 0x8001}}, 0x48) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 64.652µs ago: executing program 4 (id=3269): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r0, 0x1) ioctl$SIOCX25SFACILITIES(r0, 0x89e3, &(0x7f0000000140)={0x28, 0x80080000, 0xc, 0x7, 0x0, 0x9f91ea7a15befb90}) 0s ago: executing program 4 (id=3270): unshare(0x400) r0 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x183200) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) 0s ago: executing program 4 (id=3271): bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="2100000000000000000000000001"], 0x48) r0 = syz_io_uring_setup(0x6c8b, &(0x7f00000011c0)={0x0, 0xac0c, 0x800, 0x400000, 0x3c1}, &(0x7f0000001340), &(0x7f0000001380), &(0x7f0000000100)) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000140)=""/4096, 0x1000}], 0x3100) kernel console output (not intermixed with test programs): ? selinux_file_ioctl+0x13b/0x290 [ 241.375278][T13802] ? selinux_file_ioctl+0xb6/0x290 [ 241.375287][T13802] ? __pfx_usbtmc_ioctl+0x10/0x10 [ 241.375303][T13802] __x64_sys_ioctl+0x18e/0x210 [ 241.375316][T13802] do_syscall_64+0x115/0x870 [ 241.375325][T13802] ? clear_bhb_loop+0x40/0x90 [ 241.375337][T13802] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 241.375348][T13802] RIP: 0033:0x7ff67199ce59 [ 241.375356][T13802] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 241.375366][T13802] RSP: 002b:00007ff66fbd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 241.375377][T13802] RAX: ffffffffffffffda RBX: 00007ff671c16090 RCX: 00007ff67199ce59 [ 241.375384][T13802] RDX: 0000000000000000 RSI: 0000000000005b03 RDI: 0000000000000004 [ 241.375390][T13802] RBP: 00007ff66fbd5090 R08: 0000000000000000 R09: 0000000000000000 [ 241.375397][T13802] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 241.375403][T13802] R13: 00007ff671c16128 R14: 00007ff671c16090 R15: 00007ffdf8aac4c8 [ 241.375413][T13802] [ 241.448592][T13803] usbtmc 5-1:16.0: usb_control_msg returned -32 [ 241.458497][ T6603] usb 5-1: USB disconnect, device number 54 [ 241.753217][T13808] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 241.944449][T13819] SELinux: policydb version -1255545995 does not match my version range 15-35 [ 241.947792][T13819] SELinux: failed to load policy [ 241.989992][T13823] tipc: Started in network mode [ 241.992987][T13823] tipc: Node identity a7080000000000000d, cluster identity 4711 [ 242.012255][ T41] audit: type=1400 audit(241.785:888): avc: denied { mounton } for pid=13825 comm="syz.0.2569" path="/81/file0" dev="tmpfs" ino=433 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 242.040511][ T1355] net_ratelimit: 1 callbacks suppressed [ 242.040524][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 242.047474][T13832] evm: overlay not supported [ 242.237636][T13839] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2573'. [ 242.429138][T13851] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=19 sclass=netlink_tcpdiag_socket pid=13851 comm=syz.3.2574 [ 243.091704][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 243.244544][T13859] xt_policy: neither incoming nor outgoing policy selected [ 243.270326][ T1355] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 243.309982][T13867] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 243.430182][ T1355] usb 5-1: Using ep0 maxpacket: 8 [ 243.433926][ T1355] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 243.437125][ T1355] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 243.440474][ T1355] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 243.443770][ T1355] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 243.447005][ T1355] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 243.452179][ T1355] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 243.456113][ T1355] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.478423][ T6577] usb 7-1: USB disconnect, device number 58 [ 243.507589][T13880] netlink: 6 bytes leftover after parsing attributes in process `syz.2.2585'. [ 243.513446][T13880] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 243.615429][T13887] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2586'. [ 243.662145][ T1355] usb 5-1: usb_control_msg returned -32 [ 243.664625][ T1355] usbtmc 5-1:16.0: can't read capabilities [ 243.721720][ T5808] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 243.796606][ T41] audit: type=1400 audit(243.565:889): avc: denied { mounton } for pid=13888 comm="syz.2.2588" path="/file0" dev="hugetlbfs" ino=73663 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=dir permissive=1 [ 244.014299][T13891] FAULT_INJECTION: forcing a failure. [ 244.014299][T13891] name failslab, interval 1, probability 0, space 0, times 0 [ 244.019598][T13891] CPU: 3 UID: 0 PID: 13891 Comm: syz.0.2576 Tainted: G L syzkaller #0 PREEMPT(full) [ 244.019627][T13891] Tainted: [L]=SOFTLOCKUP [ 244.019634][T13891] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 244.019645][T13891] Call Trace: [ 244.019653][T13891] [ 244.019661][T13891] dump_stack_lvl+0x100/0x190 [ 244.019688][T13891] should_fail_ex.cold+0x5/0xa [ 244.019710][T13891] ? __kmalloc_cache_noprof+0x53/0x6e0 [ 244.019734][T13891] should_failslab+0xc2/0x120 [ 244.019751][T13891] __kmalloc_cache_noprof+0x7a/0x6e0 [ 244.019772][T13891] ? usbtmc_ioctl_abort_bulk_out_tag+0x79/0x580 [ 244.019801][T13891] usbtmc_ioctl_abort_bulk_out_tag+0x79/0x580 [ 244.019831][T13891] usbtmc_ioctl+0x1d9e/0x2840 [ 244.019857][T13891] ? do_vfs_ioctl+0x226/0x13e0 [ 244.019878][T13891] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 244.019899][T13891] ? __pfx_usbtmc_ioctl+0x10/0x10 [ 244.019924][T13891] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 244.019945][T13891] ? rcu_is_watching+0x12/0xc0 [ 244.019969][T13891] ? hook_file_ioctl_common+0x140/0x440 [ 244.019993][T13891] ? selinux_file_ioctl+0x13b/0x290 [ 244.020009][T13891] ? selinux_file_ioctl+0xb6/0x290 [ 244.020026][T13891] ? __pfx_usbtmc_ioctl+0x10/0x10 [ 244.020052][T13891] __x64_sys_ioctl+0x18e/0x210 [ 244.020074][T13891] do_syscall_64+0x115/0x870 [ 244.020109][T13891] ? clear_bhb_loop+0x40/0x90 [ 244.020131][T13891] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 244.020149][T13891] RIP: 0033:0x7ff67199ce59 [ 244.020164][T13891] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 244.020181][T13891] RSP: 002b:00007ff66fbd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 244.020200][T13891] RAX: ffffffffffffffda RBX: 00007ff671c16090 RCX: 00007ff67199ce59 [ 244.020212][T13891] RDX: 0000000000000000 RSI: 0000000000005b03 RDI: 0000000000000004 [ 244.020222][T13891] RBP: 00007ff66fbd5090 R08: 0000000000000000 R09: 0000000000000000 [ 244.020233][T13891] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 244.020244][T13891] R13: 00007ff671c16128 R14: 00007ff671c16090 R15: 00007ffdf8aac4c8 [ 244.020261][T13891] [ 244.120374][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 244.486885][T13896] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2590'. [ 244.711433][T13899] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 244.904945][ T41] audit: type=1400 audit(244.675:890): avc: denied { append } for pid=13915 comm="syz.2.2596" name="usbmon3" dev="devtmpfs" ino=747 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 244.990204][ T5808] usb 8-1: new high-speed USB device number 37 using dummy_hcd [ 245.141145][ T5808] usb 8-1: Using ep0 maxpacket: 8 [ 245.144630][ T5808] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 245.148078][ T5808] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 245.151280][ T5808] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 245.154271][ T5808] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 245.157506][ T5808] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 245.162965][ T5808] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 245.166869][ T5808] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 245.170870][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 245.374521][ T5808] usb 8-1: usb_control_msg returned -32 [ 245.376335][ T5808] usbtmc 8-1:16.0: can't read capabilities [ 245.727874][T13923] loop8: detected capacity change from 0 to 7 [ 245.731471][T13923] loop8: [CUMANA/ADFS] p1 [Linux] p2 [ADFS] p1 [Linux] p2 [ 245.734987][T13923] loop8: partition table partially beyond EOD, truncated [ 245.738454][T13923] loop8: p1 size 1905483274 extends beyond EOD, truncated [ 245.742592][T13923] loop8: p2 start 121280928 is beyond EOD, truncated [ 245.746687][T13923] usbtmc 5-1:16.0: usb_control_msg returned -32 [ 245.750699][ T6019] usb 5-1: USB disconnect, device number 55 [ 245.911064][T13928] CUSE: info not properly terminated [ 246.185562][T13939] Only authenc() type AEADs are supported by ESSIV [ 246.200485][ T7266] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 246.204421][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 246.208223][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 246.761803][ T7266] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 246.990953][T13936] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 246.993624][T13936] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 246.996776][T13936] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 246.999198][T13936] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 247.002420][T13936] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 247.005332][T13936] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 247.007702][T13936] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 247.010836][T13936] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 247.013171][T13936] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 247.015026][T13936] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 247.017192][T13936] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 247.065043][T13958] FAULT_INJECTION: forcing a failure. [ 247.065043][T13958] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 247.070817][T13958] CPU: 3 UID: 0 PID: 13958 Comm: syz.0.2608 Tainted: G L syzkaller #0 PREEMPT(full) [ 247.070846][T13958] Tainted: [L]=SOFTLOCKUP [ 247.070853][T13958] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 247.070863][T13958] Call Trace: [ 247.070869][T13958] [ 247.070876][T13958] dump_stack_lvl+0x100/0x190 [ 247.070901][T13958] should_fail_ex.cold+0x5/0xa [ 247.070924][T13958] _copy_from_iter+0x1f4/0x1690 [ 247.070950][T13958] ? _copy_from_iter+0x270/0x1690 [ 247.070972][T13958] ? __pfx__copy_from_iter+0x10/0x10 [ 247.071024][T13958] ? __pfx__copy_from_iter+0x10/0x10 [ 247.071047][T13958] ? _copy_from_iter+0x270/0x1690 [ 247.071076][T13958] copy_page_from_iter+0x238/0x300 [ 247.071101][T13958] skb_copy_datagram_from_iter+0x399/0x720 [ 247.071129][T13958] tun_get_user+0x1889/0x3c20 [ 247.071160][T13958] ? __pfx_tun_get_user+0x10/0x10 [ 247.071186][T13958] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 247.071215][T13958] ? tun_get+0x191/0x370 [ 247.071238][T13958] ? rcu_is_watching+0x12/0xc0 [ 247.071261][T13958] ? tun_get+0x191/0x370 [ 247.071283][T13958] ? lock_release+0x24d/0x310 [ 247.071304][T13958] tun_chr_write_iter+0xdc/0x200 [ 247.071330][T13958] vfs_write+0x6ac/0x1050 [ 247.071353][T13958] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 247.071380][T13958] ? __pfx_vfs_write+0x10/0x10 [ 247.071402][T13958] ? lock_release+0x24d/0x310 [ 247.071425][T13958] ksys_write+0x12a/0x250 [ 247.071446][T13958] ? __pfx_ksys_write+0x10/0x10 [ 247.071469][T13958] ? rcu_is_watching+0x12/0xc0 [ 247.071493][T13958] do_syscall_64+0x115/0x870 [ 247.071509][T13958] ? clear_bhb_loop+0x40/0x90 [ 247.071529][T13958] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.071546][T13958] RIP: 0033:0x7ff67199ce59 [ 247.071560][T13958] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 247.071577][T13958] RSP: 002b:00007ff66fbf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 247.071595][T13958] RAX: ffffffffffffffda RBX: 00007ff671c15fa0 RCX: 00007ff67199ce59 [ 247.071607][T13958] RDX: 000000000000fdef RSI: 0000200000000300 RDI: 0000000000000005 [ 247.071618][T13958] RBP: 00007ff66fbf6090 R08: 0000000000000000 R09: 0000000000000000 [ 247.071628][T13958] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 247.071638][T13958] R13: 00007ff671c16038 R14: 00007ff671c15fa0 R15: 00007ffdf8aac4c8 [ 247.071655][T13958] [ 247.242130][ T6577] net_ratelimit: 2 callbacks suppressed [ 247.242144][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 247.732674][T13970] FAULT_INJECTION: forcing a failure. [ 247.732674][T13970] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 247.737336][T13970] CPU: 3 UID: 0 PID: 13970 Comm: syz.2.2612 Tainted: G L syzkaller #0 PREEMPT(full) [ 247.737354][T13970] Tainted: [L]=SOFTLOCKUP [ 247.737358][T13970] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 247.737365][T13970] Call Trace: [ 247.737369][T13970] [ 247.737374][T13970] dump_stack_lvl+0x100/0x190 [ 247.737390][T13970] should_fail_ex.cold+0x5/0xa [ 247.737404][T13970] copy_folio_from_iter_atomic+0x5c8/0x2000 [ 247.737423][T13970] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 247.737440][T13970] ? fault_in_readable+0x14c/0x190 [ 247.737451][T13970] ? __pfx_fault_in_readable+0x10/0x10 [ 247.737462][T13970] ? filemap_dirty_folio+0x82/0x1c0 [ 247.737474][T13970] iomap_file_buffered_write+0x532/0xaf0 [ 247.737487][T13970] ? __pfx_iomap_file_buffered_write+0x10/0x10 [ 247.737502][T13970] ? __pfx_generic_write_checks+0x10/0x10 [ 247.737515][T13970] ? file_update_time_flags+0x373/0x500 [ 247.737528][T13970] fuse_file_write_iter+0x6ce/0x960 [ 247.737543][T13970] vfs_write+0x6ac/0x1050 [ 247.737557][T13970] ? __pfx_fuse_file_write_iter+0x10/0x10 [ 247.737571][T13970] ? __pfx_vfs_write+0x10/0x10 [ 247.737584][T13970] ? lock_release+0x24d/0x310 [ 247.737598][T13970] ksys_write+0x1f8/0x250 [ 247.737612][T13970] ? __pfx_ksys_write+0x10/0x10 [ 247.737631][T13970] ? rcu_is_watching+0x12/0xc0 [ 247.737652][T13970] do_syscall_64+0x115/0x870 [ 247.737670][T13970] ? clear_bhb_loop+0x40/0x90 [ 247.737690][T13970] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.737707][T13970] RIP: 0033:0x7fb780f9ce59 [ 247.737719][T13970] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 247.737735][T13970] RSP: 002b:00007fb781d70028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 247.737747][T13970] RAX: ffffffffffffffda RBX: 00007fb781216090 RCX: 00007fb780f9ce59 [ 247.737754][T13970] RDX: 00000000ffffffe8 RSI: 0000200000000100 RDI: 0000000000000003 [ 247.737761][T13970] RBP: 00007fb781d70090 R08: 0000000000000000 R09: 0000000000000000 [ 247.737767][T13970] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 247.737773][T13970] R13: 00007fb781216128 R14: 00007fb781216090 R15: 00007ffd49d2a358 [ 247.737783][T13970] [ 247.817561][ T5808] usb 8-1: USB disconnect, device number 37 [ 247.875408][ T41] audit: type=1400 audit(247.645:891): avc: denied { setattr } for pid=13979 comm="syz.3.2615" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 247.902927][T13982] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 247.984558][T13990] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2618'. [ 248.025079][T13994] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2620'. [ 248.101084][T14010] IPVS: set_ctl: invalid protocol: 43 172.30.1.3:20257 [ 248.103944][ T60] IPVS: starting estimator thread 0... [ 248.200410][T14011] IPVS: using max 53 ests per chain, 127200 per kthread [ 248.240167][ T41] audit: type=1400 audit(248.005:892): avc: denied { ioctl } for pid=14036 comm="syz.2.2636" path="socket:[74950]" dev="sockfs" ino=74950 ioctlcmd=0x8981 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 248.270326][T14042] fuse: Bad value for 'rootmode' [ 248.280736][ T5738] Bluetooth: hci2: command 0x0c1a tx timeout [ 248.285494][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 248.335393][T14016] FAULT_INJECTION: forcing a failure. [ 248.335393][T14016] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 248.340018][T14016] CPU: 1 UID: 0 PID: 14016 Comm: syz.4.2625 Tainted: G L syzkaller #0 PREEMPT(full) [ 248.340047][T14016] Tainted: [L]=SOFTLOCKUP [ 248.340054][T14016] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 248.340064][T14016] Call Trace: [ 248.340070][T14016] [ 248.340077][T14016] dump_stack_lvl+0x100/0x190 [ 248.340114][T14016] should_fail_ex.cold+0x5/0xa [ 248.340137][T14016] copy_folio_from_iter_atomic+0x5c8/0x2000 [ 248.340165][T14016] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 248.340189][T14016] ? fault_in_readable+0x14c/0x190 [ 248.340208][T14016] ? __pfx_fault_in_readable+0x10/0x10 [ 248.340225][T14016] ? filemap_dirty_folio+0x82/0x1c0 [ 248.340246][T14016] iomap_file_buffered_write+0x532/0xaf0 [ 248.340267][T14016] ? __pfx_iomap_file_buffered_write+0x10/0x10 [ 248.340291][T14016] ? __pfx_generic_write_checks+0x10/0x10 [ 248.340310][T14016] ? file_update_time_flags+0x373/0x500 [ 248.340330][T14016] fuse_file_write_iter+0x6ce/0x960 [ 248.340353][T14016] vfs_write+0x6ac/0x1050 [ 248.340373][T14016] ? __pfx_fuse_file_write_iter+0x10/0x10 [ 248.340394][T14016] ? __pfx_vfs_write+0x10/0x10 [ 248.340415][T14016] ? lock_release+0x24d/0x310 [ 248.340438][T14016] ksys_write+0x1f8/0x250 [ 248.340458][T14016] ? __pfx_ksys_write+0x10/0x10 [ 248.340479][T14016] ? rcu_is_watching+0x12/0xc0 [ 248.340503][T14016] do_syscall_64+0x115/0x870 [ 248.340517][T14016] ? clear_bhb_loop+0x40/0x90 [ 248.340535][T14016] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 248.340551][T14016] RIP: 0033:0x7f15da39ce59 [ 248.340564][T14016] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 248.340580][T14016] RSP: 002b:00007f15db2d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 248.340602][T14016] RAX: ffffffffffffffda RBX: 00007f15da616090 RCX: 00007f15da39ce59 [ 248.340613][T14016] RDX: 00000000ffffffe8 RSI: 0000200000000100 RDI: 0000000000000003 [ 248.340623][T14016] RBP: 00007f15db2d6090 R08: 0000000000000000 R09: 0000000000000000 [ 248.340632][T14016] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 248.340643][T14016] R13: 00007f15da616128 R14: 00007f15da616090 R15: 00007ffc9f756c28 [ 248.340657][T14016] [ 248.418562][ T55] usb 8-1: new high-speed USB device number 38 using dummy_hcd [ 248.575954][ T41] audit: type=1400 audit(248.345:893): avc: denied { create } for pid=14060 comm="syz.4.2643" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 248.581278][ T55] usb 8-1: Using ep0 maxpacket: 8 [ 248.585718][ T55] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 248.588412][ T55] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 248.592611][ T55] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 248.596455][ T55] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 248.600908][ T55] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 248.606421][ T55] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 248.610056][ T55] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 248.621016][ T41] audit: type=1400 audit(248.395:894): avc: denied { view } for pid=14063 comm="syz.4.2644" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 248.659553][T14072] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2646'. [ 248.728302][T14077] syzkaller0: entered promiscuous mode [ 248.730326][T14077] syzkaller0: entered allmulticast mode [ 248.885064][T14080] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2649'. [ 249.000216][ T5738] Bluetooth: hci4: command 0x0c1a tx timeout [ 249.080505][ T5738] Bluetooth: hci0: command 0x0c1a tx timeout [ 249.080511][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 249.320965][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 249.329881][T14086] rdma_op ffff888034a0d9f0 conn xmit_rdma 0000000000000000 [ 249.480511][T14097] kvm: kvm [14096]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 249.485024][T14097] kvm: kvm [14096]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 249.618044][T14104] syzkaller0: entered promiscuous mode [ 249.620984][T14104] syzkaller0: entered allmulticast mode [ 249.804965][ T5808] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 249.858651][ T41] audit: type=1400 audit(249.625:895): avc: denied { accept } for pid=14113 comm="syz.0.2660" path="/105/file0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 250.160620][T14128] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2664'. [ 250.360241][ T64] Bluetooth: hci2: command 0x0c1a tx timeout [ 250.360585][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 250.705861][T14135] syzkaller0: entered promiscuous mode [ 250.708399][T14135] syzkaller0: entered allmulticast mode [ 251.079115][T14147] binder: 14146:14147 ioctl c0306201 200000000640 returned -22 [ 251.082973][T14147] binder: 14146:14147 ioctl c08c5332 200000001240 returned -22 [ 251.090242][ T64] Bluetooth: hci4: command 0x0c1a tx timeout [ 251.124381][ T6577] usb 8-1: USB disconnect, device number 38 [ 251.141620][T14153] netlink: 4436 bytes leftover after parsing attributes in process `syz.3.2674'. [ 251.143883][T14154] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2675'. [ 251.160532][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 251.160893][ T5738] Bluetooth: hci0: command 0x0c1a tx timeout [ 251.161300][ T55] usb 7-1: new high-speed USB device number 59 using dummy_hcd [ 251.177235][T14156] syzkaller0: entered promiscuous mode [ 251.179335][T14156] syzkaller0: entered allmulticast mode [ 251.276288][T14162] FAULT_INJECTION: forcing a failure. [ 251.276288][T14162] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 251.281642][T14162] CPU: 0 UID: 0 PID: 14162 Comm: syz.3.2677 Tainted: G L syzkaller #0 PREEMPT(full) [ 251.281669][T14162] Tainted: [L]=SOFTLOCKUP [ 251.281675][T14162] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 251.281685][T14162] Call Trace: [ 251.281693][T14162] [ 251.281699][T14162] dump_stack_lvl+0x100/0x190 [ 251.281725][T14162] should_fail_ex.cold+0x5/0xa [ 251.281748][T14162] _copy_from_iter+0x1f4/0x1690 [ 251.281774][T14162] ? _copy_from_iter+0x270/0x1690 [ 251.281796][T14162] ? __pfx__copy_from_iter+0x10/0x10 [ 251.281819][T14162] ? __pfx__copy_from_iter+0x10/0x10 [ 251.281842][T14162] ? _copy_from_iter+0x270/0x1690 [ 251.281865][T14162] copy_page_from_iter+0x238/0x300 [ 251.281890][T14162] skb_copy_datagram_from_iter+0x399/0x720 [ 251.281911][T14162] tun_get_user+0x1889/0x3c20 [ 251.281942][T14162] ? __pfx_tun_get_user+0x10/0x10 [ 251.281967][T14162] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 251.281996][T14162] ? tun_get+0x191/0x370 [ 251.282019][T14162] ? rcu_is_watching+0x12/0xc0 [ 251.282041][T14162] ? tun_get+0x191/0x370 [ 251.282063][T14162] ? lock_release+0x24d/0x310 [ 251.282080][T14162] tun_chr_write_iter+0xdc/0x200 [ 251.282101][T14162] vfs_write+0x6ac/0x1050 [ 251.282122][T14162] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 251.282146][T14162] ? __pfx_vfs_write+0x10/0x10 [ 251.282167][T14162] ? lock_release+0x24d/0x310 [ 251.282188][T14162] ksys_write+0x12a/0x250 [ 251.282210][T14162] ? __pfx_ksys_write+0x10/0x10 [ 251.282232][T14162] ? rcu_is_watching+0x12/0xc0 [ 251.282255][T14162] do_syscall_64+0x115/0x870 [ 251.282270][T14162] ? clear_bhb_loop+0x40/0x90 [ 251.282291][T14162] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 251.282308][T14162] RIP: 0033:0x7f5b58d9ce59 [ 251.282322][T14162] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 251.282339][T14162] RSP: 002b:00007f5b56ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 251.282356][T14162] RAX: ffffffffffffffda RBX: 00007f5b59015fa0 RCX: 00007f5b58d9ce59 [ 251.282368][T14162] RDX: 000000000000fdef RSI: 0000200000000300 RDI: 0000000000000005 [ 251.282378][T14162] RBP: 00007f5b56ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 251.282389][T14162] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 251.282399][T14162] R13: 00007f5b59016038 R14: 00007f5b59015fa0 R15: 00007ffefd918778 [ 251.282427][T14162] [ 251.291075][ T55] usb 7-1: device descriptor read/64, error -71 [ 251.410774][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 251.620198][ T55] usb 7-1: new high-speed USB device number 60 using dummy_hcd [ 251.760249][ T55] usb 7-1: device descriptor read/64, error -71 [ 251.870515][ T55] usb usb7-port1: attempt power cycle [ 252.131827][T14175] openvswitch: netlink: VXLAN extension 1 has unexpected len 0 expected 4 [ 252.220454][ T55] usb 7-1: new high-speed USB device number 61 using dummy_hcd [ 252.225643][T14175] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2682'. [ 252.242301][ T55] usb 7-1: device descriptor read/8, error -71 [ 252.283898][T14195] FAULT_INJECTION: forcing a failure. [ 252.283898][T14195] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 252.287916][T14195] CPU: 1 UID: 0 PID: 14195 Comm: syz.3.2686 Tainted: G L syzkaller #0 PREEMPT(full) [ 252.287934][T14195] Tainted: [L]=SOFTLOCKUP [ 252.287938][T14195] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 252.287944][T14195] Call Trace: [ 252.287948][T14195] [ 252.287952][T14195] dump_stack_lvl+0x100/0x190 [ 252.287967][T14195] should_fail_ex.cold+0x5/0xa [ 252.287982][T14195] _copy_from_iter+0x1f4/0x1690 [ 252.287998][T14195] ? _copy_from_iter+0x270/0x1690 [ 252.288017][T14195] ? __pfx__copy_from_iter+0x10/0x10 [ 252.288032][T14195] ? __pfx__copy_from_iter+0x10/0x10 [ 252.288058][T14195] ? _copy_from_iter+0x270/0x1690 [ 252.288074][T14195] copy_page_from_iter+0x238/0x300 [ 252.288103][T14195] skb_copy_datagram_from_iter+0x399/0x720 [ 252.288117][T14195] tun_get_user+0x1889/0x3c20 [ 252.288135][T14195] ? __pfx_tun_get_user+0x10/0x10 [ 252.288151][T14195] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 252.288169][T14195] ? tun_get+0x191/0x370 [ 252.288182][T14195] ? rcu_is_watching+0x12/0xc0 [ 252.288197][T14195] ? tun_get+0x191/0x370 [ 252.288210][T14195] ? lock_release+0x24d/0x310 [ 252.288223][T14195] tun_chr_write_iter+0xdc/0x200 [ 252.288239][T14195] vfs_write+0x6ac/0x1050 [ 252.288252][T14195] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 252.288269][T14195] ? __pfx_vfs_write+0x10/0x10 [ 252.288282][T14195] ? lock_release+0x24d/0x310 [ 252.288295][T14195] ksys_write+0x12a/0x250 [ 252.288308][T14195] ? __pfx_ksys_write+0x10/0x10 [ 252.288322][T14195] ? rcu_is_watching+0x12/0xc0 [ 252.288336][T14195] do_syscall_64+0x115/0x870 [ 252.288345][T14195] ? clear_bhb_loop+0x40/0x90 [ 252.288357][T14195] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.288367][T14195] RIP: 0033:0x7f5b58d9ce59 [ 252.288376][T14195] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 252.288387][T14195] RSP: 002b:00007f5b56ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 252.288397][T14195] RAX: ffffffffffffffda RBX: 00007f5b59015fa0 RCX: 00007f5b58d9ce59 [ 252.288404][T14195] RDX: 000000000000fdef RSI: 0000200000000300 RDI: 0000000000000005 [ 252.288410][T14195] RBP: 00007f5b56ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 252.288416][T14195] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 252.288422][T14195] R13: 00007f5b59016038 R14: 00007f5b59015fa0 R15: 00007ffefd918778 [ 252.288432][T14195] [ 252.431878][T14179] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 252.450458][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 252.471724][T14202] mac80211_hwsim hwsim14 : renamed from wlan0 (while UP) [ 252.488548][T14200] syz.4.2688 (14200): /proc/14199/oom_adj is deprecated, please use /proc/14199/oom_score_adj instead. [ 252.492630][ T41] audit: type=1400 audit(252.265:896): avc: denied { map } for pid=14199 comm="syz.4.2688" path="/proc/464/oom_adj" dev="proc" ino=75251 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 252.509993][T14204] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2690'. [ 252.510586][ T55] usb 7-1: new high-speed USB device number 62 using dummy_hcd [ 252.531195][ T55] usb 7-1: device descriptor read/8, error -71 [ 252.586350][T14209] netlink: 596 bytes leftover after parsing attributes in process `syz.4.2691'. [ 252.597311][ T41] audit: type=1400 audit(252.365:897): avc: denied { write } for pid=14208 comm="syz.4.2691" name="/" dev="9p" ino=72878889 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 252.607455][ T41] audit: type=1400 audit(252.365:898): avc: denied { write } for pid=14208 comm="syz.4.2691" name="/" dev="9p" ino=72878889 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 252.616679][ T41] audit: type=1400 audit(252.365:899): avc: denied { associate } for pid=14208 comm="syz.4.2691" name="file0" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 252.640401][ T55] usb usb7-port1: unable to enumerate USB device [ 252.842822][ T3266] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 253.160278][ T5738] Bluetooth: hci4: command 0x0c1a tx timeout [ 253.240201][ T5738] Bluetooth: hci0: command 0x0c1a tx timeout [ 253.250461][ T5738] Bluetooth: hci3: command 0x0c1a tx timeout [ 253.418342][ T41] audit: type=1400 audit(253.185:900): avc: denied { watch watch_reads } for pid=14238 comm="syz.0.2700" path="/123/file1" dev="tmpfs" ino=651 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 253.491068][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 253.642434][T14254] netlink: 'syz.0.2705': attribute type 2 has an invalid length. [ 253.653016][T14255] bond1: Removing last arp target with arp_interval on [ 253.657514][T14254] macsec1: entered promiscuous mode [ 253.657942][ T5738] Bluetooth: hci0: unexpected event for opcode 0x0c46 [ 253.659160][T14254] macsec1: entered allmulticast mode [ 253.699011][T14268] tmpfs: Group quota block hardlimit too large. [ 253.811308][T14285] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2711'. [ 253.931406][T14293] 9pnet_virtio: no channels available for device 127.0.0.1 [ 254.055446][T14309] SELinux: policydb magic number 0x8ed8837 does not match expected magic number 0xf97cff8c [ 254.058480][T14309] SELinux: failed to load policy [ 254.060769][T14309] overlay: Bad value for 'workdir' [ 254.081919][ T41] audit: type=1400 audit(253.855:901): avc: denied { mounton } for pid=14310 comm="syz.2.2721" path="/59/file0" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 254.093942][T14309] SELinux: policydb string length 0 does not match expected length 8 [ 254.097500][T14309] SELinux: failed to load policy [ 254.135504][T14309] xt_connbytes: Forcing CT accounting to be enabled [ 254.137794][T14309] Cannot find set identified by id 0 to match [ 254.148810][T14311] libceph: resolve '.RHe'ˠ/' (ret=-3): failed [ 254.161017][ T41] audit: type=1400 audit(253.935:902): avc: denied { unmount } for pid=13333 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 254.255567][ T41] audit: type=1400 audit(254.025:903): avc: denied { append } for pid=14330 comm="syz.3.2727" name="mouse0" dev="devtmpfs" ino=947 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 254.288934][T14336] macvtap0: entered promiscuous mode [ 254.292620][T14336] macvtap0: left promiscuous mode [ 254.371002][T14340] tmpfs: Unknown parameter '|K [ 255.017565][T14400] dump_stack_lvl+0x100/0x190 [ 255.017581][T14400] should_fail_ex.cold+0x5/0xa [ 255.017594][T14400] _copy_from_iter+0x1f4/0x1690 [ 255.017611][T14400] ? _copy_from_iter+0x270/0x1690 [ 255.017624][T14400] ? __pfx__copy_from_iter+0x10/0x10 [ 255.017639][T14400] ? __pfx__copy_from_iter+0x10/0x10 [ 255.017653][T14400] ? _copy_from_iter+0x270/0x1690 [ 255.017681][T14400] copy_page_from_iter+0x238/0x300 [ 255.017697][T14400] skb_copy_datagram_from_iter+0x399/0x720 [ 255.017710][T14400] tun_get_user+0x1889/0x3c20 [ 255.017729][T14400] ? __pfx_tun_get_user+0x10/0x10 [ 255.017745][T14400] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 255.017763][T14400] ? tun_get+0x191/0x370 [ 255.017777][T14400] ? rcu_is_watching+0x12/0xc0 [ 255.017791][T14400] ? tun_get+0x191/0x370 [ 255.017804][T14400] ? lock_release+0x24d/0x310 [ 255.017816][T14400] tun_chr_write_iter+0xdc/0x200 [ 255.017833][T14400] vfs_write+0x6ac/0x1050 [ 255.017846][T14400] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 255.017862][T14400] ? __pfx_vfs_write+0x10/0x10 [ 255.017876][T14400] ? lock_release+0x24d/0x310 [ 255.017889][T14400] ksys_write+0x12a/0x250 [ 255.017902][T14400] ? __pfx_ksys_write+0x10/0x10 [ 255.017916][T14400] ? rcu_is_watching+0x12/0xc0 [ 255.017930][T14400] do_syscall_64+0x115/0x870 [ 255.017940][T14400] ? clear_bhb_loop+0x40/0x90 [ 255.017952][T14400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.017962][T14400] RIP: 0033:0x7ff67199ce59 [ 255.017971][T14400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 255.017981][T14400] RSP: 002b:00007ff66fbf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 255.017992][T14400] RAX: ffffffffffffffda RBX: 00007ff671c15fa0 RCX: 00007ff67199ce59 [ 255.017999][T14400] RDX: 000000000000fdef RSI: 0000200000000300 RDI: 0000000000000005 [ 255.018006][T14400] RBP: 00007ff66fbf6090 R08: 0000000000000000 R09: 0000000000000000 [ 255.018012][T14400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 255.018018][T14400] R13: 00007ff671c16038 R14: 00007ff671c15fa0 R15: 00007ffdf8aac4c8 [ 255.018028][T14400] [ 255.296166][T14409] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2754'. [ 255.299890][T14410] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2754'. [ 255.341339][T14410] tmpfs: Bad value for 'mpol' [ 255.343511][T14409] tmpfs: Bad value for 'mpol' [ 255.383414][ T41] audit: type=1400 audit(255.155:904): avc: denied { write } for pid=14405 comm="syz.2.2753" name="/" dev="9p" ino=72878889 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 255.560504][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 255.675940][ T41] audit: type=1400 audit(255.445:905): avc: denied { listen } for pid=14417 comm="syz.2.2757" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 255.682823][ T41] audit: type=1400 audit(255.445:906): avc: denied { accept } for pid=14417 comm="syz.2.2757" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 255.795008][T14432] syzkaller0: entered promiscuous mode [ 255.797032][T14432] syzkaller0: entered allmulticast mode [ 255.882138][ T3266] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 256.600322][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 257.650598][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 258.680620][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 258.930440][ T5808] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 259.721373][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 260.760358][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 261.001276][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 261.003686][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 261.800450][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 261.960524][ T3266] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 262.850377][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 263.880643][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 264.920811][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 265.000410][ T3266] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 265.960337][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 266.656409][ T41] audit: type=1400 audit(266.425:907): avc: denied { read write } for pid=14435 comm="syz.2.2765" dev="sockfs" ino=77603 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 266.729158][T14439] binder: 14435:14439 ioctl c018620c 200000000300 returned -1 [ 266.736880][T14448] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2764'. [ 266.808866][T14463] hfsplus: unable to find HFS+ superblock [ 266.827767][T14457] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2770'. [ 266.850975][T14463] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 267.007423][T14475] Invalid source name [ 267.008956][T14475] UBIFS error (pid: 14475): cannot open "ubifs", error -22 [ 267.010398][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 267.101701][T14477] IPVS: Error connecting to the multicast addr [ 267.207121][T14485] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 267.236181][ T41] audit: type=1400 audit(267.005:908): avc: denied { ioctl } for pid=14488 comm="syz.4.2782" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1294 ioctlcmd=0x6f02 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 267.243346][T14491] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2783'. [ 267.264506][T14493] netlink: 'syz.4.2784': attribute type 21 has an invalid length. [ 267.264546][T14494] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2784'. [ 267.272761][T14494] xfrm1: entered promiscuous mode [ 267.274272][ T41] audit: type=1400 audit(267.045:909): avc: denied { audit_write } for pid=14496 comm="syz.2.2785" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 267.274829][T14494] xfrm1: entered allmulticast mode [ 267.415905][ T55] IPVS: starting estimator thread 0... [ 267.418675][T14515] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 267.425412][T14518] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2793'. [ 267.460026][T14524] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2796'. [ 267.466572][T14524] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2796'. [ 267.471161][T14524] netlink: 'syz.4.2796': attribute type 12 has an invalid length. [ 267.478927][ T41] audit: type=1400 audit(267.245:910): avc: denied { mount } for pid=14523 comm="syz.4.2796" name="/" dev="pstore" ino=3492 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 267.479768][T14524] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2796'. [ 267.492317][T14524] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2796'. [ 267.498563][ T41] audit: type=1400 audit(267.265:911): avc: denied { ioctl } for pid=14523 comm="syz.4.2796" path="socket:[75663]" dev="sockfs" ino=75663 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sock_file permissive=1 [ 267.506267][T14516] IPVS: using max 55 ests per chain, 132000 per kthread [ 267.638091][ T41] audit: type=1326 audit(267.405:912): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14538 comm="syz.2.2802" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb780f9ce59 code=0x0 [ 267.736129][T14527] FAULT_INJECTION: forcing a failure. [ 267.736129][T14527] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 267.741523][T14527] CPU: 1 UID: 0 PID: 14527 Comm: syz.0.2794 Tainted: G L syzkaller #0 PREEMPT(full) [ 267.741541][T14527] Tainted: [L]=SOFTLOCKUP [ 267.741545][T14527] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 267.741552][T14527] Call Trace: [ 267.741555][T14527] [ 267.741559][T14527] dump_stack_lvl+0x100/0x190 [ 267.741575][T14527] should_fail_ex.cold+0x5/0xa [ 267.741602][T14527] copy_folio_from_iter_atomic+0x5c8/0x2000 [ 267.741622][T14527] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 267.741637][T14527] ? fault_in_readable+0x14c/0x190 [ 267.741648][T14527] ? __pfx_fault_in_readable+0x10/0x10 [ 267.741658][T14527] ? filemap_dirty_folio+0x82/0x1c0 [ 267.741671][T14527] iomap_file_buffered_write+0x532/0xaf0 [ 267.741684][T14527] ? __pfx_iomap_file_buffered_write+0x10/0x10 [ 267.741700][T14527] ? __pfx_generic_write_checks+0x10/0x10 [ 267.741713][T14527] ? file_update_time_flags+0x373/0x500 [ 267.741725][T14527] fuse_file_write_iter+0x6ce/0x960 [ 267.741740][T14527] vfs_write+0x6ac/0x1050 [ 267.741754][T14527] ? __pfx_fuse_file_write_iter+0x10/0x10 [ 267.741768][T14527] ? __pfx_vfs_write+0x10/0x10 [ 267.741784][T14527] ? lock_release+0x24d/0x310 [ 267.741799][T14527] ksys_write+0x1f8/0x250 [ 267.741812][T14527] ? __pfx_ksys_write+0x10/0x10 [ 267.741825][T14527] ? rcu_is_watching+0x12/0xc0 [ 267.741840][T14527] do_syscall_64+0x115/0x870 [ 267.741850][T14527] ? clear_bhb_loop+0x40/0x90 [ 267.741862][T14527] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.741872][T14527] RIP: 0033:0x7ff67199ce59 [ 267.741881][T14527] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 267.741891][T14527] RSP: 002b:00007ff66fbd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 267.741902][T14527] RAX: ffffffffffffffda RBX: 00007ff671c16090 RCX: 00007ff67199ce59 [ 267.741909][T14527] RDX: 00000000ffffffe8 RSI: 0000200000000100 RDI: 0000000000000003 [ 267.741915][T14527] RBP: 00007ff66fbd5090 R08: 0000000000000000 R09: 0000000000000000 [ 267.741922][T14527] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 267.741928][T14527] R13: 00007ff671c16128 R14: 00007ff671c16090 R15: 00007ffdf8aac4c8 [ 267.741937][T14527] [ 267.891839][ T6577] IPVS: starting estimator thread 0... [ 267.892492][T14548] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 267.914243][T14551] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2805'. [ 267.966293][T14557] FAULT_INJECTION: forcing a failure. [ 267.966293][T14557] name failslab, interval 1, probability 0, space 0, times 0 [ 267.970969][T14557] CPU: 2 UID: 0 PID: 14557 Comm: syz.3.2808 Tainted: G L syzkaller #0 PREEMPT(full) [ 267.970988][T14557] Tainted: [L]=SOFTLOCKUP [ 267.970992][T14557] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 267.970998][T14557] Call Trace: [ 267.971002][T14557] [ 267.971006][T14557] dump_stack_lvl+0x100/0x190 [ 267.971022][T14557] should_fail_ex.cold+0x5/0xa [ 267.971036][T14557] should_failslab+0xc2/0x120 [ 267.971047][T14557] kmem_cache_alloc_noprof+0x7b/0x6d0 [ 267.971064][T14557] ? skb_clone+0x190/0x400 [ 267.971077][T14557] skb_clone+0x190/0x400 [ 267.971089][T14557] netlink_deliver_tap+0xaed/0xcc0 [ 267.971106][T14557] netlink_unicast+0x6a5/0x850 [ 267.971123][T14557] ? __pfx_netlink_unicast+0x10/0x10 [ 267.971139][T14557] ? genl_rcv_msg+0x4be/0x800 [ 267.971163][T14557] netlink_ack+0x655/0xb80 [ 267.971180][T14557] netlink_rcv_skb+0x333/0x420 [ 267.971190][T14557] ? __pfx_genl_rcv_msg+0x10/0x10 [ 267.971201][T14557] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 267.971213][T14557] ? netlink_deliver_tap+0x1ae/0xcc0 [ 267.971232][T14557] genl_rcv+0x28/0x40 [ 267.971241][T14557] netlink_unicast+0x585/0x850 [ 267.971258][T14557] ? __pfx_netlink_unicast+0x10/0x10 [ 267.971276][T14557] netlink_sendmsg+0x8b0/0xda0 [ 267.971286][T14557] ? __pfx_netlink_sendmsg+0x10/0x10 [ 267.971297][T14557] ____sys_sendmsg+0xa4d/0xbe0 [ 267.971312][T14557] ? __pfx_netlink_sendmsg+0x10/0x10 [ 267.971322][T14557] ? __pfx_____sys_sendmsg+0x10/0x10 [ 267.971338][T14557] ? kstrtouint_from_user+0x13c/0x1d0 [ 267.971351][T14557] ___sys_sendmsg+0x190/0x1e0 [ 267.971368][T14557] ? __pfx____sys_sendmsg+0x10/0x10 [ 267.971384][T14557] ? get_pid_task+0x106/0x250 [ 267.971400][T14557] ? rcu_is_watching+0x12/0xc0 [ 267.971418][T14557] __sys_sendmsg+0x160/0x210 [ 267.971430][T14557] ? __pfx___sys_sendmsg+0x10/0x10 [ 267.971445][T14557] ? rcu_is_watching+0x12/0xc0 [ 267.971459][T14557] do_syscall_64+0x115/0x870 [ 267.971469][T14557] ? clear_bhb_loop+0x40/0x90 [ 267.971480][T14557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.971491][T14557] RIP: 0033:0x7f5b58d9ce59 [ 267.971500][T14557] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 267.971510][T14557] RSP: 002b:00007f5b56ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 267.971521][T14557] RAX: ffffffffffffffda RBX: 00007f5b59015fa0 RCX: 00007f5b58d9ce59 [ 267.971528][T14557] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 267.971534][T14557] RBP: 00007f5b56ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 267.971540][T14557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 267.971546][T14557] R13: 00007f5b59016038 R14: 00007f5b59015fa0 R15: 00007ffefd918778 [ 267.971556][T14557] [ 267.987999][T14559] overlayfs: failed to resolve './bus': -2 [ 268.010479][T14549] IPVS: using max 35 ests per chain, 84000 per kthread [ 268.041062][ T5808] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 268.094296][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 268.441384][T14576] syzkaller0: entered promiscuous mode [ 268.443075][T14576] syzkaller0: entered allmulticast mode [ 268.570490][ T847] usb 5-1: new low-speed USB device number 56 using dummy_hcd [ 268.700214][ T847] usb 5-1: device descriptor read/64, error -71 [ 268.910387][ T5837] usb 7-1: new high-speed USB device number 63 using dummy_hcd [ 268.940231][ T847] usb 5-1: new low-speed USB device number 57 using dummy_hcd [ 269.070461][ T5837] usb 7-1: Using ep0 maxpacket: 32 [ 269.070664][ T847] usb 5-1: device descriptor read/64, error -71 [ 269.073794][ T5837] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 269.079472][ T5837] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 269.080569][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 269.084113][ T5837] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 269.092709][ T5837] usb 7-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 269.096461][ T5837] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.099697][ T5837] usb 7-1: Product: syz [ 269.101550][ T5837] usb 7-1: Manufacturer: syz [ 269.103518][ T5837] usb 7-1: SerialNumber: syz [ 269.106943][ T5837] usb 7-1: config 0 descriptor?? [ 269.112627][ T5837] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/input/input37 [ 269.180489][ T847] usb usb5-port1: attempt power cycle [ 269.312482][T14587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 269.315898][T14587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 269.321129][ T5808] usb 7-1: USB disconnect, device number 63 [ 269.321136][ C2] xpad 7-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 269.520242][ T847] usb 5-1: new low-speed USB device number 58 using dummy_hcd [ 269.540629][ T847] usb 5-1: device descriptor read/8, error -71 [ 269.780205][ T847] usb 5-1: new low-speed USB device number 59 using dummy_hcd [ 269.800831][ T847] usb 5-1: device descriptor read/8, error -71 [ 269.847786][ T41] audit: type=1400 audit(269.615:913): avc: denied { getopt } for pid=14588 comm="syz.2.2819" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 269.911277][ T847] usb usb5-port1: unable to enumerate USB device [ 269.931505][T14593] gfs2: error -5 reading superblock [ 270.120351][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 270.420294][ T5837] usb 7-1: new high-speed USB device number 64 using dummy_hcd [ 270.570533][ T5837] usb 7-1: Using ep0 maxpacket: 8 [ 270.573718][ T5837] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 270.577889][ T5837] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 270.583393][ T5837] usb 7-1: config 0 interface 0 has no altsetting 0 [ 270.585909][ T5837] usb 7-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 270.588701][ T5837] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.591556][T14614] BTRFS info: 'norecovery' is for compatibility only, recommended to use 'rescue=nologreplay' [ 270.592403][ T5837] usb 7-1: config 0 descriptor?? [ 270.771417][ T41] audit: type=1400 audit(270.545:914): avc: denied { write } for pid=14622 comm="syz.4.2831" name="/" dev="9p" ino=72878889 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 270.782143][T14623] 8021q: VLANs not supported on ip_vti0 [ 270.788424][T14623] cgroup: subsys name conflicts with all [ 270.800084][ T5837] mcp2221 0003:04D8:00DD.0006: unknown main item tag 0x0 [ 270.804035][ T5837] mcp2221 0003:04D8:00DD.0006: unknown main item tag 0x0 [ 270.806774][ T5837] mcp2221 0003:04D8:00DD.0006: unknown main item tag 0x0 [ 270.809196][ T5837] mcp2221 0003:04D8:00DD.0006: unknown main item tag 0x0 [ 270.811705][ T5837] mcp2221 0003:04D8:00DD.0006: unknown main item tag 0x0 [ 270.814814][ T5837] mcp2221 0003:04D8:00DD.0006: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 270.819400][T14627] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14627 comm=syz.2.2832 [ 270.874136][ T5837] usb 7-1: USB disconnect, device number 64 [ 270.876705][ T41] audit: type=1400 audit(270.645:915): avc: denied { shutdown } for pid=14626 comm="syz.2.2832" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 271.090384][ T5808] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 271.170282][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 271.271560][T14650] netlink: 'syz.4.2841': attribute type 1 has an invalid length. [ 271.280085][T14650] 8021q: adding VLAN 0 to HW filter on device bond3 [ 271.286117][T14650] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 271.292505][T14650] macvlan4: entered promiscuous mode [ 271.294254][T14650] macvlan4: entered allmulticast mode [ 271.296155][T14650] bond3: entered promiscuous mode [ 271.297757][T14650] veth0_to_bond: entered promiscuous mode [ 271.299846][T14650] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 271.302738][T14650] bond3: left promiscuous mode [ 271.304878][T14650] veth0_to_bond: left promiscuous mode [ 271.711679][T14662] FAULT_INJECTION: forcing a failure. [ 271.711679][T14662] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 271.717203][T14662] CPU: 1 UID: 0 PID: 14662 Comm: syz.0.2843 Tainted: G L syzkaller #0 PREEMPT(full) [ 271.717233][T14662] Tainted: [L]=SOFTLOCKUP [ 271.717240][T14662] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 271.717252][T14662] Call Trace: [ 271.717258][T14662] [ 271.717267][T14662] dump_stack_lvl+0x100/0x190 [ 271.717294][T14662] should_fail_ex.cold+0x5/0xa [ 271.717318][T14662] copy_folio_from_iter_atomic+0x5c8/0x2000 [ 271.717351][T14662] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 271.717377][T14662] ? fault_in_readable+0x14c/0x190 [ 271.717397][T14662] ? __pfx_fault_in_readable+0x10/0x10 [ 271.717415][T14662] ? filemap_dirty_folio+0x82/0x1c0 [ 271.717440][T14662] iomap_file_buffered_write+0x532/0xaf0 [ 271.717465][T14662] ? __pfx_iomap_file_buffered_write+0x10/0x10 [ 271.717494][T14662] ? __pfx_generic_write_checks+0x10/0x10 [ 271.717516][T14662] ? file_update_time_flags+0x373/0x500 [ 271.717539][T14662] fuse_file_write_iter+0x6ce/0x960 [ 271.717564][T14662] vfs_write+0x6ac/0x1050 [ 271.717588][T14662] ? __pfx_fuse_file_write_iter+0x10/0x10 [ 271.717613][T14662] ? __pfx_vfs_write+0x10/0x10 [ 271.717637][T14662] ? lock_release+0x24d/0x310 [ 271.717662][T14662] ksys_write+0x1f8/0x250 [ 271.717685][T14662] ? __pfx_ksys_write+0x10/0x10 [ 271.717709][T14662] ? rcu_is_watching+0x12/0xc0 [ 271.717735][T14662] do_syscall_64+0x115/0x870 [ 271.717753][T14662] ? clear_bhb_loop+0x40/0x90 [ 271.717774][T14662] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.717793][T14662] RIP: 0033:0x7ff67199ce59 [ 271.717809][T14662] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 271.717828][T14662] RSP: 002b:00007ff66fbd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 271.717849][T14662] RAX: ffffffffffffffda RBX: 00007ff671c16090 RCX: 00007ff67199ce59 [ 271.717862][T14662] RDX: 00000000ffffffe8 RSI: 0000200000000100 RDI: 0000000000000003 [ 271.717873][T14662] RBP: 00007ff66fbd5090 R08: 0000000000000000 R09: 0000000000000000 [ 271.717885][T14662] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 271.717897][T14662] R13: 00007ff671c16128 R14: 00007ff671c16090 R15: 00007ffdf8aac4c8 [ 271.717915][T14662] [ 272.006510][T14673] __nla_validate_parse: 7 callbacks suppressed [ 272.006522][T14673] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2847'. [ 272.147919][T14694] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 272.173990][T14696] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2854'. [ 272.174317][T14697] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2854'. [ 272.177606][T14696] netlink: 1 bytes leftover after parsing attributes in process `syz.3.2854'. [ 272.185217][T14697] netlink: 1 bytes leftover after parsing attributes in process `syz.3.2854'. [ 272.189021][T14696] netlink: 112 bytes leftover after parsing attributes in process `syz.3.2854'. [ 272.200828][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 272.616075][T14711] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2859'. [ 272.620919][T14711] bridge0: port 2(bridge_slave_1) entered disabled state [ 272.624064][T14711] bridge0: port 1(bridge_slave_0) entered disabled state [ 272.807010][T14726] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2864'. [ 272.846181][T14728] nvme_fabrics: missing parameter 'transport=%s' [ 272.848362][T14728] nvme_fabrics: missing parameter 'nqn=%s' [ 272.853515][T14728] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2865'. [ 272.924712][T14739] program syz.2.2869 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 272.924915][ T5738] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 272.990003][T14741] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2870'. [ 273.140948][T14752] can0: slcan on ttynull. [ 273.197576][ T41] audit: type=1400 audit(272.965:916): avc: denied { write } for pid=14757 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 273.242643][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 273.246106][ T41] audit: type=1400 audit(273.015:917): avc: denied { write } for pid=14768 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 273.460255][ T10] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 273.634637][ T10] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 273.638817][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.642719][ T10] usb 5-1: Product: syz [ 273.644748][ T10] usb 5-1: Manufacturer: syz [ 273.646795][ T10] usb 5-1: SerialNumber: syz [ 273.652863][ T10] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 273.672483][ T5808] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 273.684774][ T41] audit: type=1400 audit(273.455:918): avc: denied { write } for pid=14771 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 273.720722][T14752] can0 (unregistered): slcan off ttynull. [ 273.727629][ T41] audit: type=1400 audit(273.495:919): avc: denied { write } for pid=14774 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 273.792340][ T41] audit: type=1400 audit(273.565:920): avc: denied { write } for pid=14778 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 273.842239][ T41] audit: type=1400 audit(273.605:921): avc: denied { write } for pid=14788 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 273.876268][T14766] binder: 14765:14766 ioctl 4018620d 0 returned -22 [ 273.885522][T14766] SELinux: Context system_u:object_r:netlabel_mgmt_exec_t:s0 is not valid (left unmapped). [ 273.889318][ T41] audit: type=1400 audit(273.655:922): avc: denied { relabelto } for pid=14765 comm="syz.0.2877" name="adsp1" dev="devtmpfs" ino=1325 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 trawcon="system_u:object_r:netlabel_mgmt_exec_t:s0" [ 273.902309][ T41] audit: type=1400 audit(273.655:923): avc: denied { associate } for pid=14765 comm="syz.0.2877" name="adsp1" dev="devtmpfs" ino=1325 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 srawcon="system_u:object_r:netlabel_mgmt_exec_t:s0" [ 273.904361][ T6577] usb 5-1: USB disconnect, device number 60 [ 274.120932][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 274.161019][T14799] Cannot find add_set index 0 as target [ 274.290350][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 274.525238][T14836] 9pnet_virtio: no channels available for device syz [ 274.593699][T14839] loop9: detected capacity change from 0 to 255852544 [ 274.640947][T14839] Invalid logical block size (4) [ 274.690235][ T5808] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 274.693430][ T5808] ath9k_htc: Failed to initialize the device [ 274.696860][ T6577] usb 5-1: ath9k_htc: USB layer deinitialized [ 274.717517][T14845] netlink: del zone limit has 8 unknown bytes [ 274.743944][T14851] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27429 sclass=netlink_route_socket pid=14851 comm=syz.4.2900 [ 274.807803][ T41] audit: type=1400 audit(274.575:924): avc: denied { map } for pid=14858 comm="syz.4.2902" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 274.934021][T14867] openvswitch: netlink: Actions may not be safe on all matching packets [ 275.145791][ T5842] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 275.214942][ T64] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 275.217387][ T64] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 275.219622][ T64] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 275.222171][ T64] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 275.224709][ T64] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 275.235000][ T5842] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 275.304762][ T5842] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 275.320447][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 275.352634][T14879] virt_wifi0 speed is unknown, defaulting to 1000 [ 275.369001][ T5842] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 275.448834][T14879] bridge0: port 1(bridge_slave_0) entered blocking state [ 275.452082][T14879] bridge0: port 1(bridge_slave_0) entered disabled state [ 275.454432][T14879] bridge_slave_0: entered allmulticast mode [ 275.456920][T14879] bridge_slave_0: entered promiscuous mode [ 275.460555][T14879] bridge0: port 2(bridge_slave_1) entered blocking state [ 275.463200][T14879] bridge0: port 2(bridge_slave_1) entered disabled state [ 275.465545][T14879] bridge_slave_1: entered allmulticast mode [ 275.467883][T14879] bridge_slave_1: entered promiscuous mode [ 275.487740][T14879] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 275.491758][ T5842] bridge_slave_1: left allmulticast mode [ 275.493609][ T5842] bridge_slave_1: left promiscuous mode [ 275.495770][ T5842] bridge0: port 2(bridge_slave_1) entered disabled state [ 275.499876][ T5842] bridge_slave_0: left allmulticast mode [ 275.503344][ T5842] bridge0: port 1(bridge_slave_0) entered disabled state [ 275.551785][ T5842] bond1 (unregistering): (slave bridge3): Releasing backup interface [ 275.554505][ T5842] bridge3 (unregistering): left promiscuous mode [ 275.565772][ T5842] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 275.570086][ T5842] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 275.573979][ T5842] bond0 (unregistering): Released all slaves [ 275.579510][ T5842] bond1 (unregistering): Released all slaves [ 275.591457][T14879] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 275.606548][T14879] team0: Port device team_slave_0 added [ 275.609216][T14879] team0: Port device team_slave_1 added [ 275.621954][T14879] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 275.625403][T14879] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 275.629111][ T41] audit: type=1400 audit(275.395:925): avc: denied { write } for pid=14897 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 275.635304][T14879] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 275.646318][T14879] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 275.648549][T14879] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 275.656595][T14879] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 275.660221][ T5842] tipc: Left network mode [ 275.671335][T14879] hsr_slave_0: entered promiscuous mode [ 275.673640][T14879] hsr_slave_1: entered promiscuous mode [ 275.675632][T14879] debugfs: 'hsr0' already exists in 'hsr' [ 275.677442][T14879] Cannot create hsr debugfs directory [ 275.723677][ T5442] 8021q: adding VLAN 0 to HW filter on device eth2 [ 275.726317][T14903] x_tables: duplicate underflow at hook 1 [ 275.763043][T14879] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 275.766642][T14879] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 275.769263][T14879] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 275.773947][T14879] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 275.778683][T14879] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 275.782180][T14879] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 275.784732][T14879] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 275.787890][T14879] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 275.826079][ T5842] hsr_slave_0: left promiscuous mode [ 275.829025][ T5842] hsr_slave_1: left promiscuous mode [ 275.834433][ T5842] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 275.837562][ T5842] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 275.843235][ T5842] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 275.846334][ T5842] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 275.852138][ T5842] veth1_macvtap: left promiscuous mode [ 275.853906][ T5842] veth0_macvtap: left promiscuous mode [ 275.855632][ T5842] veth1_vlan: left promiscuous mode [ 275.857234][ T5842] veth0_vlan: left promiscuous mode [ 275.922628][ T5842] team0 (unregistering): Port device team_slave_1 removed [ 275.929096][ T5842] team0 (unregistering): Port device team_slave_0 removed [ 275.963370][ T5442] 8021q: adding VLAN 0 to HW filter on device eth3 [ 275.970076][T14933] syzkaller0: entered promiscuous mode [ 275.973426][T14933] syzkaller0: entered allmulticast mode [ 275.982254][T14933] tipc: Started in network mode [ 275.983847][T14933] tipc: Node identity 86a69b311ad3, cluster identity 4711 [ 275.986368][T14933] tipc: Enabled bearer , priority 0 [ 275.993623][T14879] 8021q: adding VLAN 0 to HW filter on device bond0 [ 276.000749][T14932] tipc: Resetting bearer [ 276.004144][T14932] tipc: Disabling bearer [ 276.008012][T14879] 8021q: adding VLAN 0 to HW filter on device team0 [ 276.014915][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 276.017848][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 276.023859][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 276.026118][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 276.106412][ T5442] 8021q: adding VLAN 0 to HW filter on device eth4 [ 276.128852][T14954] 9p: Bad value for 'wfdno' [ 276.196054][ T5442] 8021q: adding VLAN 0 to HW filter on device eth5 [ 276.204033][T14879] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 276.263338][ T5842] IPVS: stop unused estimator thread 0... [ 276.286495][T14879] veth0_vlan: entered promiscuous mode [ 276.290180][T14879] veth1_vlan: entered promiscuous mode [ 276.298977][T14879] veth0_macvtap: entered promiscuous mode [ 276.302491][T14879] veth1_macvtap: entered promiscuous mode [ 276.308815][T14879] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 276.314322][T14879] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 276.319116][ T5779] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 276.322863][ T5779] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 276.326020][ T5779] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 276.328767][ T5779] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 276.356068][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 276.361868][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 276.362534][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 276.378293][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 276.381799][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 276.816823][T15000] syzkaller0: entered promiscuous mode [ 276.819080][T15000] syzkaller0: entered allmulticast mode [ 276.825150][T15000] tipc: Enabled bearer , priority 0 [ 276.828326][T14999] tipc: Resetting bearer [ 276.833157][T14999] tipc: Disabling bearer [ 276.912404][T15002] virt_wifi0 speed is unknown, defaulting to 1000 [ 276.920852][T15004] netlink: 'syz.4.2929': attribute type 13 has an invalid length. [ 276.945042][T15004] gretap0: refused to change device tx_queue_len [ 276.949746][T15004] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 277.162833][ T5808] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 277.236374][T15032] __nla_validate_parse: 10 callbacks suppressed [ 277.236393][T15032] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2937'. [ 277.250298][ T64] Bluetooth: hci1: command tx timeout [ 277.290204][ T10] usb 7-1: new high-speed USB device number 65 using dummy_hcd [ 277.403094][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 277.440403][ T10] usb 7-1: Using ep0 maxpacket: 8 [ 277.443428][ T10] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 277.446279][ T10] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 277.449765][ T10] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 277.453659][ T10] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 277.457478][ T10] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 277.462620][ T10] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 277.466162][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 277.674641][ T10] usb 7-1: usb_control_msg returned -32 [ 277.676844][ T10] usbtmc 7-1:16.0: can't read capabilities [ 278.160533][ T847] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 278.220004][T15048] Can't find a SQUASHFS superblock on nullb0 [ 278.254516][ C3] vcan0: j1939_tp_rxtimer: 0xffff888059317c00: rx timeout, send abort [ 278.310602][ T847] usb 10-1: Using ep0 maxpacket: 8 [ 278.313537][ T847] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 278.316912][ T847] usb 10-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 278.320866][ T847] usb 10-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 278.325574][ T847] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 278.328812][ T847] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.333548][ T847] usbtmc 10-1:16.0: bulk endpoints not found [ 278.377915][T15049] usbtmc 7-1:16.0: usb_control_msg returned -32 [ 278.450800][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 278.537496][T15034] usbtmc 7-1:16.0: usb_control_msg returned -32 [ 278.541144][ T5837] usb 7-1: USB disconnect, device number 65 [ 278.757842][ C3] vcan0: j1939_tp_rxtimer: 0xffff888059317c00: abort rx timeout. Force session deactivation [ 278.834698][T15052] loop5: detected capacity change from 0 to 2640 [ 278.837739][T15052] buffer_io_error: 15 callbacks suppressed [ 278.837750][T15052] Buffer I/O error on dev loop5, logical block 0, async page read [ 278.842942][T15052] Buffer I/O error on dev loop5, logical block 0, async page read [ 278.845967][T15052] Buffer I/O error on dev loop5, logical block 0, async page read [ 278.848643][T15052] Buffer I/O error on dev loop5, logical block 0, async page read [ 278.851667][T15052] Buffer I/O error on dev loop5, logical block 0, async page read [ 278.854097][T15052] Buffer I/O error on dev loop5, logical block 0, async page read [ 278.856649][T15052] Buffer I/O error on dev loop5, logical block 0, async page read [ 278.859030][T15052] Buffer I/O error on dev loop5, logical block 0, async page read [ 278.861760][T15052] ldm_validate_partition_table(): Disk read failed. [ 278.863944][T15052] Buffer I/O error on dev loop5, logical block 0, async page read [ 278.866498][T15052] Buffer I/O error on dev loop5, logical block 0, async page read [ 278.868971][T15052] Dev loop5: unable to read RDB block 0 [ 278.870931][T15052] loop5: unable to read partition table [ 278.872874][T15052] loop_reread_partitions: partition scan of loop5 (3 ) failed (rc=-5) [ 279.050326][T15056] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2946'. [ 279.152189][T15063] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2947'. [ 279.192111][T15065] syzkaller0: entered promiscuous mode [ 279.194516][T15065] syzkaller0: entered allmulticast mode [ 279.200382][T15065] tipc: Enabled bearer , priority 0 [ 279.203412][T15064] tipc: Resetting bearer [ 279.210377][T15064] tipc: Disabling bearer [ 279.320210][ T64] Bluetooth: hci1: command tx timeout [ 279.480545][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 279.616935][ T5140] ldm_validate_partition_table(): Disk read failed. [ 279.619246][ T5140] Dev loop5: unable to read RDB block 0 [ 279.621476][ T5140] loop5: unable to read partition table [ 280.210595][ T5808] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 280.251170][T15086] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 280.420219][ T60] usb 7-1: new full-speed USB device number 66 using dummy_hcd [ 280.520358][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 280.572049][ T60] usb 7-1: config 0 interface 0 altsetting 255 endpoint 0x7 has an invalid bInterval 0, changing to 4 [ 280.581502][ T60] usb 7-1: config 0 interface 0 has no altsetting 0 [ 280.586052][ T60] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 280.589921][ T60] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 280.593911][ T60] usb 7-1: Product: syz [ 280.595642][ T60] usb 7-1: Manufacturer: syz [ 280.597515][ T60] usb 7-1: SerialNumber: syz [ 280.601286][ T60] usb 7-1: config 0 descriptor?? [ 280.606438][ T60] usb 7-1: selecting invalid altsetting 0 [ 280.805710][T15084] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.808178][T15085] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.810912][T15084] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.813229][T15085] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.815775][T15084] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.818114][T15085] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.820827][T15084] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.823189][T15085] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.825654][T15084] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.827969][T15085] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.831041][T15084] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.833468][T15085] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.835986][T15084] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.838330][T15085] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.840852][T15084] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.843144][T15085] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.845562][T15084] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.848020][T15085] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.850624][T15084] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.852894][T15085] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.855854][T15084] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.858996][T15085] usb 7-1: cannot submit urb 0, error -2: endpoint not enabled [ 280.867205][ T5808] usb 7-1: USB disconnect, device number 66 [ 280.936887][ T6019] usb 10-1: USB disconnect, device number 2 [ 281.210222][ T5808] usb 7-1: new low-speed USB device number 67 using dummy_hcd [ 281.361875][ T5808] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 281.365041][ T5808] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 281.369501][ T5808] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 281.374037][ T5808] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 281.378776][ T5808] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 281.383721][ T5808] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 281.388046][ T5808] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 281.393417][ T5808] usb 7-1: config 168 interface 0 has no altsetting 0 [ 281.396966][ T5808] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 281.400039][ T5808] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 281.404668][ T64] Bluetooth: hci1: command tx timeout [ 281.406981][ T5808] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 281.411446][ T5808] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 281.416226][ T5808] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 281.420844][ T5808] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 281.425292][ T5808] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 281.430677][ T5808] usb 7-1: config 168 interface 0 has no altsetting 0 [ 281.434227][ T5808] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 281.436690][ T5808] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 281.440413][ T5808] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 281.444141][ T5808] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 281.447770][ T5808] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 281.451486][ T5808] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 281.454881][ T5808] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 281.458916][ T5808] usb 7-1: config 168 interface 0 has no altsetting 0 [ 281.463249][ T5808] usb 7-1: string descriptor 0 read error: -22 [ 281.465163][ T5808] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 281.467882][ T5808] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 281.473338][ T5808] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 281.520788][ T60] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 281.560402][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 281.670455][ T60] usb 10-1: Using ep0 maxpacket: 8 [ 281.673666][ T60] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 281.676434][ T60] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 281.679772][ T60] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 281.683433][ T60] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 281.687362][ T60] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 281.690374][ T6019] usb 7-1: USB disconnect, device number 67 [ 281.691976][ T60] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 281.696958][ T60] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 281.906878][T15115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 281.910672][T15115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 281.913909][ T60] usb 10-1: usb_control_msg returned -32 [ 281.915695][ T60] usbtmc 10-1:16.0: can't read capabilities [ 282.600864][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 282.617878][T15133] usbtmc 10-1:16.0: CHECK_CLEAR_STATUS returned 40 [ 282.640191][ T5808] usb 7-1: new high-speed USB device number 68 using dummy_hcd [ 282.800237][ T5808] usb 7-1: Using ep0 maxpacket: 8 [ 282.803562][ T5808] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 282.806885][ T5808] usb 7-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 282.811177][ T5808] usb 7-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 282.816505][ T5808] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 282.818901][ T6019] usb 10-1: USB disconnect, device number 3 [ 282.820208][ T5808] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 282.831425][ T5808] usbtmc 7-1:16.0: bulk endpoints not found [ 283.240896][ T5808] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 283.305726][T15138] netlink: 'syz.4.2970': attribute type 21 has an invalid length. [ 283.309059][T15138] netlink: 'syz.4.2970': attribute type 6 has an invalid length. [ 283.312395][T15138] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2970'. [ 283.397655][ T41] kauditd_printk_skb: 11 callbacks suppressed [ 283.397670][ T41] audit: type=1400 audit(283.165:937): avc: denied { setattr } for pid=15147 comm="syz.5.2973" path="pipe:[84232]" dev="pipefs" ino=84232 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 283.443691][T15154] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2975'. [ 283.490249][ T64] Bluetooth: hci1: command tx timeout [ 283.612745][T15161] syzkaller0: entered promiscuous mode [ 283.620397][T15161] syzkaller0: entered allmulticast mode [ 283.640356][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 283.759169][T15174] binder: 15173:15174 ioctl c0306201 0 returned -14 [ 283.764205][T15174] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2983'. [ 283.922992][T15179] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 284.648933][T15191] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2987'. [ 284.682176][T15194] binder: 15193:15194 ioctl c0306201 2000000001c0 returned -22 [ 284.690721][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 284.779997][T15199] FAULT_INJECTION: forcing a failure. [ 284.779997][T15199] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 284.784647][T15199] CPU: 2 UID: 0 PID: 15199 Comm: syz.4.2990 Tainted: G L syzkaller #0 PREEMPT(full) [ 284.784665][T15199] Tainted: [L]=SOFTLOCKUP [ 284.784669][T15199] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 284.784676][T15199] Call Trace: [ 284.784680][T15199] [ 284.784684][T15199] dump_stack_lvl+0x100/0x190 [ 284.784714][T15199] should_fail_ex.cold+0x5/0xa [ 284.784728][T15199] _copy_to_user+0x32/0xd0 [ 284.784748][T15199] simple_read_from_buffer+0xcb/0x170 [ 284.784764][T15199] proc_fail_nth_read+0x1af/0x230 [ 284.784778][T15199] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 284.784791][T15199] ? security_file_permission+0x76/0x210 [ 284.784802][T15199] ? rw_verify_area+0xce/0x6d0 [ 284.784813][T15199] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 284.784826][T15199] vfs_read+0x1e4/0xb40 [ 284.784840][T15199] ? __pfx_vfs_read+0x10/0x10 [ 284.784853][T15199] ? rcu_is_watching+0x12/0xc0 [ 284.784873][T15199] ? __fget_files+0x21f/0x3d0 [ 284.784890][T15199] ksys_read+0x12a/0x250 [ 284.784903][T15199] ? __pfx_ksys_read+0x10/0x10 [ 284.784917][T15199] ? rcu_is_watching+0x12/0xc0 [ 284.784932][T15199] do_syscall_64+0x115/0x870 [ 284.784947][T15199] ? clear_bhb_loop+0x40/0x90 [ 284.784958][T15199] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.784969][T15199] RIP: 0033:0x7f15da35d68e [ 284.784977][T15199] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 284.784988][T15199] RSP: 002b:00007f15db2f6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 284.784999][T15199] RAX: ffffffffffffffda RBX: 00007f15db2f76c0 RCX: 00007f15da35d68e [ 284.785006][T15199] RDX: 000000000000000f RSI: 00007f15db2f70a0 RDI: 0000000000000007 [ 284.785013][T15199] RBP: 00007f15db2f7090 R08: 0000000000000000 R09: 0000000000000000 [ 284.785019][T15199] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 284.785025][T15199] R13: 00007f15da616038 R14: 00007f15da615fa0 R15: 00007ffc9f756c28 [ 284.785035][T15199] [ 285.158107][T15208] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 285.413992][ T55] usb 7-1: USB disconnect, device number 68 [ 285.556024][T15213] netlink: 44 bytes leftover after parsing attributes in process `syz.5.2994'. [ 285.720412][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 286.280605][ T5808] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 286.376230][T15234] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3003'. [ 286.558258][ T41] audit: type=1400 audit(286.325:938): avc: denied { write } for pid=15242 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 286.589904][ T41] audit: type=1400 audit(286.355:939): avc: denied { write } for pid=15245 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 286.636859][ T41] audit: type=1400 audit(286.405:940): avc: denied { write } for pid=15253 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 286.674734][T15261] syzkaller1: entered promiscuous mode [ 286.677098][ T41] audit: type=1400 audit(286.445:941): avc: denied { write } for pid=15259 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 286.687646][T15261] syzkaller1: entered allmulticast mode [ 286.692543][T15261] ntfs3: Unknown parameter 'aclkaller1' [ 286.763833][ T41] audit: type=1400 audit(286.535:942): avc: denied { write } for pid=15268 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 286.773724][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 286.804400][ T41] audit: type=1400 audit(286.575:943): avc: denied { write } for pid=15271 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 286.872733][ T41] audit: type=1400 audit(286.645:944): avc: denied { connect } for pid=15274 comm="syz.5.3011" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 287.063108][T15287] netlink: 'syz.2.3014': attribute type 10 has an invalid length. [ 287.070744][T15287] team0 (unregistering): Port device team_slave_0 removed [ 287.076001][T15287] team0 (unregistering): Port device team_slave_1 removed [ 287.470253][ T5837] usb 7-1: new high-speed USB device number 69 using dummy_hcd [ 287.630244][ T5837] usb 7-1: Using ep0 maxpacket: 8 [ 287.634303][ T5837] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 287.637858][ T5837] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 287.642034][ T5837] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 287.645988][ T5837] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 287.649994][ T5837] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 287.655415][ T5837] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 287.659078][ T5837] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 287.667256][ T41] audit: type=1400 audit(287.435:945): avc: denied { write } for pid=15293 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 287.703919][ T41] audit: type=1400 audit(287.475:946): avc: denied { write } for pid=15296 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 287.801241][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 287.868549][ T5837] usb 7-1: usb_control_msg returned -32 [ 287.871081][ T5837] usbtmc 7-1:16.0: can't read capabilities [ 287.882862][T15301] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 287.887328][T15301] iommufd_mock iommufd_mock1: Adding to iommu group 10 [ 287.891013][T15301] iommufd_mock iommufd_mock2: Adding to iommu group 11 [ 287.893745][T15301] iommufd_mock iommufd_mock3: Adding to iommu group 12 [ 287.896846][T15301] iommufd_mock iommufd_mock4: Adding to iommu group 13 [ 287.901174][T15301] iommufd_mock iommufd_mock5: Adding to iommu group 14 [ 287.905629][T15301] iommufd_mock iommufd_mock6: Adding to iommu group 15 [ 287.910051][T15301] iommufd_mock iommufd_mock7: Adding to iommu group 16 [ 287.914119][T15301] iommufd_mock iommufd_mock8: Adding to iommu group 17 [ 287.917941][T15301] iommufd_mock iommufd_mock9: Adding to iommu group 18 [ 287.921086][T15301] iommufd_mock iommufd_mock10: Adding to iommu group 19 [ 287.925567][T15301] iommufd_mock iommufd_mock11: Adding to iommu group 20 [ 287.929340][T15301] iommufd_mock iommufd_mock12: Adding to iommu group 21 [ 287.933591][T15301] iommufd_mock iommufd_mock13: Adding to iommu group 22 [ 287.937429][T15301] iommufd_mock iommufd_mock14: Adding to iommu group 23 [ 287.939987][T15301] iommufd_mock iommufd_mock15: Adding to iommu group 24 [ 287.942615][T15301] iommufd_mock iommufd_mock16: Adding to iommu group 25 [ 287.946212][T15301] iommufd_mock iommufd_mock17: Adding to iommu group 26 [ 287.949791][T15301] iommufd_mock iommufd_mock18: Adding to iommu group 27 [ 287.953554][T15301] iommufd_mock iommufd_mock19: Adding to iommu group 28 [ 287.957796][T15301] iommufd_mock iommufd_mock20: Adding to iommu group 29 [ 287.961673][T15301] iommufd_mock iommufd_mock21: Adding to iommu group 30 [ 287.965578][T15301] iommufd_mock iommufd_mock22: Adding to iommu group 31 [ 287.968091][T15301] iommufd_mock iommufd_mock23: Adding to iommu group 32 [ 287.973013][T15301] iommufd_mock iommufd_mock24: Adding to iommu group 33 [ 287.976833][T15301] iommufd_mock iommufd_mock25: Adding to iommu group 34 [ 287.979641][T15301] iommufd_mock iommufd_mock26: Adding to iommu group 35 [ 287.983486][T15301] iommufd_mock iommufd_mock27: Adding to iommu group 36 [ 287.986961][T15301] iommufd_mock iommufd_mock28: Adding to iommu group 37 [ 287.990394][T15301] iommufd_mock iommufd_mock29: Adding to iommu group 38 [ 287.993902][T15301] iommufd_mock iommufd_mock30: Adding to iommu group 39 [ 287.994866][T15303] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=15303 comm=syz.5.3020 [ 287.998116][T15301] iommufd_mock iommufd_mock31: Adding to iommu group 40 [ 288.000902][ T1309] blk_print_req_error: 11 callbacks suppressed [ 288.000912][ T1309] I/O error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 2 [ 288.003837][T15301] iommufd_mock iommufd_mock32: Adding to iommu group 41 [ 288.005948][T15303] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3020'. [ 288.009056][T15301] iommufd_mock iommufd_mock33: Adding to iommu group 42 [ 288.019662][T15301] iommufd_mock iommufd_mock34: Adding to iommu group 43 [ 288.024382][T15301] iommufd_mock iommufd_mock35: Adding to iommu group 44 [ 288.028290][T15301] iommufd_mock iommufd_mock36: Adding to iommu group 45 [ 288.032587][T15301] iommufd_mock iommufd_mock37: Adding to iommu group 46 [ 288.038105][T15301] iommufd_mock iommufd_mock38: Adding to iommu group 47 [ 288.043803][T15301] iommufd_mock iommufd_mock39: Adding to iommu group 48 [ 288.048198][T15301] iommufd_mock iommufd_mock40: Adding to iommu group 49 [ 288.051018][T15301] iommufd_mock iommufd_mock41: Adding to iommu group 50 [ 288.053606][T15301] iommufd_mock iommufd_mock42: Adding to iommu group 51 [ 288.056160][T15301] iommufd_mock iommufd_mock43: Adding to iommu group 52 [ 288.060976][T15301] iommufd_mock iommufd_mock44: Adding to iommu group 53 [ 288.064164][T15301] iommufd_mock iommufd_mock45: Adding to iommu group 54 [ 288.067914][T15301] iommufd_mock iommufd_mock46: Adding to iommu group 55 [ 288.071331][T15301] iommufd_mock iommufd_mock47: Adding to iommu group 56 [ 288.075656][T15301] iommufd_mock iommufd_mock48: Adding to iommu group 57 [ 288.078387][T15301] iommufd_mock iommufd_mock49: Adding to iommu group 58 [ 288.082001][T15301] iommufd_mock iommufd_mock50: Adding to iommu group 59 [ 288.085590][T15301] iommufd_mock iommufd_mock51: Adding to iommu group 60 [ 288.090749][T15301] iommufd_mock iommufd_mock52: Adding to iommu group 61 [ 288.095302][T15301] iommufd_mock iommufd_mock53: Adding to iommu group 62 [ 288.097897][T15301] iommufd_mock iommufd_mock54: Adding to iommu group 63 [ 288.100716][T15301] iommufd_mock iommufd_mock55: Adding to iommu group 64 [ 288.105588][T15301] iommufd_mock iommufd_mock56: Adding to iommu group 65 [ 288.108682][T15301] iommufd_mock iommufd_mock57: Adding to iommu group 66 [ 288.111516][T15301] iommufd_mock iommufd_mock58: Adding to iommu group 67 [ 288.115083][T15301] iommufd_mock iommufd_mock59: Adding to iommu group 68 [ 288.118508][T15301] iommufd_mock iommufd_mock60: Adding to iommu group 69 [ 288.121841][T15301] iommufd_mock iommufd_mock61: Adding to iommu group 70 [ 288.124995][T15301] iommufd_mock iommufd_mock62: Adding to iommu group 71 [ 288.129343][T15301] iommufd_mock iommufd_mock63: Adding to iommu group 72 [ 288.133752][T15301] iommufd_mock iommufd_mock64: Adding to iommu group 73 [ 288.316970][ T5837] kernel write not supported for file /snd/midiC2D0 (pid: 5837 comm: kworker/1:4) [ 288.384651][T15328] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3029'. [ 288.387525][T15328] openvswitch: netlink: Missing key (keys=40, expected=100) [ 288.574116][T15335] usbtmc 7-1:16.0: usb_control_msg returned -32 [ 288.737305][T15339] netlink: 44 bytes leftover after parsing attributes in process `syz.5.3032'. [ 288.840556][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 288.901500][T15343] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3034'. [ 289.020996][T15342] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 289.115555][T15359] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3039'. [ 289.119179][T15359] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3039'. [ 289.219554][ T64] Bluetooth: hci2: unexpected event for opcode 0x2035 [ 289.227159][T15368] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 289.230261][T15368] SELinux: failed to load policy [ 289.320403][ T5808] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 289.385469][T15377] binder: 15376:15377 ioctl 4018620d 0 returned -22 [ 289.432305][T15381] tipc: Cannot configure node identity twice [ 289.567822][T15388] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 289.620721][T15392] bridge_slave_1: entered allmulticast mode [ 289.760331][T15400] netlink: 'syz.3.3054': attribute type 1 has an invalid length. [ 289.763729][T15400] netlink: 244 bytes leftover after parsing attributes in process `syz.3.3054'. [ 289.880683][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 289.968078][T15407] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3056'. [ 289.988447][ T41] audit: type=1400 audit(289.755:947): avc: denied { watch } for pid=15408 comm="syz.4.3057" path="/265/file0" dev="tmpfs" ino=1384 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 290.088299][T15415] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3059'. [ 290.222097][T15418] netlink: 190972 bytes leftover after parsing attributes in process `syz.5.3060'. [ 290.225299][T15418] openvswitch: netlink: ufid size 21390 bytes exceeds the range (1, 16) [ 290.228045][T15418] openvswitch: netlink: Message has 4 unknown bytes. [ 290.238052][ T6019] usb 7-1: USB disconnect, device number 69 [ 290.252502][T15421] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3062'. [ 290.352100][T15430] overlayfs: upper fs does not support file handles, falling back to index=off. [ 290.873211][T15449] SELinux: ebitmap: map size 0 does not match my size 64 (high bit was 0) [ 290.876585][T15449] SELinux: failed to load policy [ 290.920355][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 290.960325][ T5808] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 291.110229][ T5808] usb 10-1: Using ep0 maxpacket: 8 [ 291.113815][ T5808] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 291.117228][ T5808] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 291.121552][ T5808] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 291.125649][ T5808] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 291.129816][ T5808] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 291.135464][ T5808] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 291.139237][ T5808] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.348536][ T5808] usb 10-1: usb_control_msg returned -32 [ 291.351300][ T5808] usbtmc 10-1:16.0: can't read capabilities [ 291.970408][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 292.053097][T15465] usbtmc 10-1:16.0: usb_control_msg returned -32 [ 292.319799][T15471] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 292.361423][ T5808] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 292.449993][T15487] netlink: 'syz.2.3081': attribute type 12 has an invalid length. [ 292.654250][T15495] F2FS-fs (nullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 292.657571][T15495] F2FS-fs (nullb0): Can't find valid F2FS filesystem in 1th superblock [ 292.661444][T15495] F2FS-fs (nullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 292.664326][T15495] F2FS-fs (nullb0): Can't find valid F2FS filesystem in 2th superblock [ 293.010710][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 293.051124][T15507] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 293.066389][T15509] netlink: 'syz.3.3092': attribute type 7 has an invalid length. [ 293.069629][T15509] netlink: 'syz.3.3092': attribute type 8 has an invalid length. [ 293.209184][T15524] overlayfs: workdir and upperdir must be separate subtrees [ 293.212342][T15524] overlayfs: workdir and upperdir must be separate subtrees [ 293.215589][T15524] overlayfs: workdir and upperdir must be separate subtrees [ 293.215881][T15526] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 293.260859][ T7261] Bluetooth: hci4: Frame reassembly failed (-84) [ 293.263458][T15530] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 293.727600][ T5837] usb 10-1: USB disconnect, device number 4 [ 294.040522][ T1355] net_ratelimit: 1 callbacks suppressed [ 294.040541][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 294.622813][T15537] SELinux: security policydb version 18 (MLS) not backwards compatible [ 294.626300][T15537] SELinux: failed to load policy [ 294.666074][T15539] bond1: option downdelay: invalid value (18446744073709551615) [ 294.669253][T15539] bond1: option downdelay: allowed values 0 - 2147483647 [ 294.673843][T15539] bond1 (unregistering): Released all slaves [ 294.880019][T15549] loop6: detected capacity change from 0 to 2640 [ 294.884271][T14482] buffer_io_error: 356 callbacks suppressed [ 294.884281][T14482] Buffer I/O error on dev loop6, logical block 0, async page read [ 294.888840][T14482] Buffer I/O error on dev loop6, logical block 0, async page read [ 294.891898][T14482] Buffer I/O error on dev loop6, logical block 0, async page read [ 294.895067][T14482] Buffer I/O error on dev loop6, logical block 0, async page read [ 294.897715][T14482] Buffer I/O error on dev loop6, logical block 0, async page read [ 295.080557][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 295.320251][ T5738] Bluetooth: hci4: command 0x1003 tx timeout [ 295.320296][ T64] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 295.400630][ T5808] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 295.721265][ T1355] usb 7-1: new high-speed USB device number 70 using dummy_hcd [ 295.870276][ T1355] usb 7-1: Using ep0 maxpacket: 8 [ 295.873325][ T1355] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 295.876092][ T1355] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 295.878994][ T1355] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 295.882163][ T1355] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 295.885378][ T1355] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 295.890703][ T1355] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 295.894111][ T1355] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.982787][T15574] overlayfs: failed to resolve 'xino=on': -2 [ 296.130379][ T1355] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.156383][T15577] __nla_validate_parse: 8 callbacks suppressed [ 296.156395][T15577] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.3119'. [ 296.250671][T15592] bridge_slave_0: left allmulticast mode [ 296.252458][T15592] bridge_slave_0: left promiscuous mode [ 296.254342][T15592] bridge0: port 1(bridge_slave_0) entered disabled state [ 296.260695][T15592] bridge_slave_1: left allmulticast mode [ 296.262550][T15592] bridge_slave_1: left promiscuous mode [ 296.262643][T15592] bridge0: port 2(bridge_slave_1) entered disabled state [ 296.271312][T15592] bond0: (slave bond_slave_0): Releasing backup interface [ 296.275699][T15592] bond0: (slave bond_slave_1): Releasing backup interface [ 296.281964][T15592] team0: Port device team_slave_0 removed [ 296.287185][T15592] team0: Port device team_slave_1 removed [ 296.291840][T15592] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 296.295231][T15592] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 296.299239][T15592] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 296.302432][ T41] audit: type=1400 audit(296.075:948): avc: denied { mount } for pid=15566 comm="syz.2.3114" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 296.304232][ T60] usb 7-1: USB disconnect, device number 70 [ 296.305050][T15592] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 296.310920][ T41] audit: type=1400 audit(296.075:949): avc: denied { read } for pid=15566 comm="syz.2.3114" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 296.312502][T15567] usbtmc 7-1:16.0: simple usb_control_msg failed -19 [ 296.312778][T15567] btrfs: Unknown parameter 'barrier' [ 296.315713][T15592] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 296.316005][ T41] audit: type=1400 audit(296.075:950): avc: denied { read } for pid=15566 comm="syz.2.3114" name="/" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 296.340087][ T41] audit: type=1400 audit(296.075:951): avc: denied { open } for pid=15566 comm="syz.2.3114" path="/153/file0" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 296.347136][ T41] audit: type=1400 audit(296.075:952): avc: denied { read } for pid=15566 comm="syz.2.3114" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 296.353749][ T41] audit: type=1400 audit(296.075:953): avc: denied { read } for pid=15566 comm="syz.2.3114" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 296.360043][ T41] audit: type=1400 audit(296.075:954): avc: denied { read } for pid=15566 comm="syz.2.3114" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 296.367291][ T41] audit: type=1400 audit(296.075:955): avc: denied { read } for pid=15566 comm="syz.2.3114" name="/" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 296.368044][T15595] team0: Mode changed to "activebackup" [ 296.374903][ T41] audit: type=1400 audit(296.075:956): avc: denied { read } for pid=15566 comm="syz.2.3114" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 296.397914][T15594] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 296.430530][ T41] audit: type=1400 audit(296.205:957): avc: denied { unmount } for pid=11320 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 296.542856][T15615] libceph: resolve '0' (ret=-3): failed [ 296.631732][T15620] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3131'. [ 296.634641][T15620] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3131'. [ 296.639439][T15620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 296.643472][T15620] bond3: (slave bond0): making interface the new active one [ 296.646918][T15620] bond3: (slave bond0): Enslaving as an active interface with an up link [ 296.652109][T15620] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15620 comm=syz.3.3131 [ 296.656113][T15620] netlink: 'syz.3.3131': attribute type 4 has an invalid length. [ 296.658551][T15620] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3131'. [ 296.663306][T15620] .`: renamed from bond0 (while UP) [ 296.843951][T15632] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 297.080520][ T1355] usb 7-1: new high-speed USB device number 71 using dummy_hcd [ 297.161149][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 297.221379][T15654] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 297.230436][ T1355] usb 7-1: Using ep0 maxpacket: 8 [ 297.233548][ T1355] usb 7-1: unable to get BOS descriptor or descriptor too short [ 297.236765][ T1355] usb 7-1: config 8 has an invalid interface number: 198 but max is 0 [ 297.239208][ T1355] usb 7-1: config 8 has no interface number 0 [ 297.241207][ T1355] usb 7-1: config 8 interface 198 altsetting 0 endpoint 0xA has an invalid bInterval 28, changing to 8 [ 297.246467][ T1355] usb 7-1: string descriptor 0 read error: -22 [ 297.248361][ T1355] usb 7-1: New USB device found, idVendor=1430, idProduct=6cdc, bcdDevice=85.cc [ 297.251131][ T1355] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.363968][ T64] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 297.420325][ T60] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 297.461781][T15632] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3134'. [ 297.465609][T15632] overlayfs: statfs failed on './file0' [ 297.468491][ T1355] usb 7-1: USB disconnect, device number 71 [ 297.547895][T15667] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(13) [ 297.550063][T15667] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 297.553261][T15667] vhci_hcd vhci_hcd.0: Device attached [ 297.570318][ T60] usb 10-1: Using ep0 maxpacket: 8 [ 297.573752][ T60] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 297.577358][ T60] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 297.582021][ T60] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 297.586105][ T60] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 297.590607][ T60] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 297.595917][ T60] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 297.599587][ T60] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 297.730396][ T6603] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 297.790321][ T6603] usb 45-1: new full-speed USB device number 2 using vhci_hcd [ 298.058661][T15657] usbtmc 10-1:16.0: simple usb_control_msg failed -32 [ 298.063191][ T1355] usb 10-1: USB disconnect, device number 5 [ 298.200595][ T6019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 298.440635][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 298.591825][T15681] program syz.5.3150 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 298.899250][T15712] netlink: 'syz.5.3162': attribute type 1 has an invalid length. [ 298.901896][T15712] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3162'. [ 298.906046][T15712] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3162'. [ 298.906140][T15713] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3162'. [ 298.984104][T15722] gtp0: entered allmulticast mode [ 299.028100][T15724] netlink: 'syz.2.3166': attribute type 1 has an invalid length. [ 299.031181][T15724] netlink: 'syz.2.3166': attribute type 4 has an invalid length. [ 299.033650][T15724] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.3166'. [ 299.128736][T15739] IPVS: set_ctl: invalid protocol: 60 172.20.20.187:20000 [ 299.240817][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 299.742439][T15750] geneve2: entered promiscuous mode [ 299.744543][T15750] geneve2: entered allmulticast mode [ 299.971219][T15756] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 300.042868][T15763] overlayfs: maximum fs stacking depth exceeded [ 300.108111][T15767] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=19894 sclass=netlink_xfrm_socket pid=15767 comm=syz.5.3184 [ 300.280546][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 300.374612][T15775] virt_wifi0 speed is unknown, defaulting to 1000 [ 300.520244][T15670] vhci_hcd: connection reset by peer [ 300.522873][ T5807] vhci_hcd vhci_hcd.4: stop threads [ 300.524683][ T5807] vhci_hcd vhci_hcd.4: release socket [ 300.526645][ T5807] vhci_hcd vhci_hcd.4: disconnect device [ 300.544144][T15779] gtp1: entered allmulticast mode [ 300.656223][T15784] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3189'. [ 300.656828][T15782] xt_nat: multiple ranges no longer supported [ 300.662744][T15784] hugetlbfs: Bad value 'xOsize=' for mount option 'size' [ 300.662744][T15784] [ 300.693937][T15788] tmpfs: Unknown parameter 'grpquota_blockWh>rdlimit' [ 300.736441][T15793] bridge_slave_0: left promiscuous mode [ 300.757648][T15793] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 300.764564][T15793] 8021q: adding VLAN 0 to HW filter on device bond1 [ 300.768061][T15793] mac80211_hwsim hwsim12 wlan0: entered promiscuous mode [ 300.777753][T15793] xfrm1: left promiscuous mode [ 300.796038][ T5807] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 300.799202][ T5807] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 300.806244][ T5807] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 300.809204][ T5807] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 301.046072][T15813] ip6gretap0: entered promiscuous mode [ 301.222723][T15825] tmpfs: Unknown parameter 'iave' [ 301.320800][ T6576] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 301.480580][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 301.915323][ T41] kauditd_printk_skb: 6 callbacks suppressed [ 301.915334][ T41] audit: type=1400 audit(301.685:964): avc: denied { getopt } for pid=15845 comm="syz.3.3206" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 302.111347][T15850] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 302.360396][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 302.871008][ T847] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 302.910250][ T6603] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 303.020461][ T847] usb 10-1: Using ep0 maxpacket: 8 [ 303.024027][ T847] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 303.027450][ T847] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 303.031697][ T847] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 303.035847][ T847] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 303.040020][ T847] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 303.045581][ T847] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 303.049296][ T847] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 303.257154][ T847] usb 10-1: usb_control_msg returned -32 [ 303.258988][ T847] usbtmc 10-1:16.0: can't read capabilities [ 303.400995][T15874] __nla_validate_parse: 1 callbacks suppressed [ 303.401012][T15874] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3215'. [ 303.401600][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 303.612521][T15875] usbtmc 10-1:16.0: usb_control_msg returned -32 [ 303.616866][ T6577] usb 10-1: USB disconnect, device number 6 [ 303.686225][T15877] CIFS: VFS: UNC: missing delimiter between hostname and share name [ 303.688679][T15877] CIFS: VFS: Malformed UNC in devname [ 303.693830][T15877] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 303.722778][T15879] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 303.725642][T15879] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 303.729378][T15879] vhci_hcd vhci_hcd.0: Device attached [ 303.785258][ T41] audit: type=1400 audit(303.555:965): avc: denied { remount } for pid=15878 comm="syz.2.3217" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 303.785312][T15882] devtmpfs: Cannot change global quota limit on remount [ 303.912389][T15884] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3218'. [ 303.920423][ T55] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 303.980473][ T55] usb 41-1: new full-speed USB device number 2 using vhci_hcd [ 303.994045][ T41] audit: type=1326 audit(303.765:966): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15889 comm="syz.4.3220" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f15da39ce59 code=0x7ffc0000 [ 304.002757][ T41] audit: type=1326 audit(303.765:967): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15889 comm="syz.4.3220" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f15da39ce59 code=0x7ffc0000 [ 304.011921][ T41] audit: type=1326 audit(303.765:968): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15889 comm="syz.4.3220" exe="/syz-executor" sig=0 arch=c000003e syscall=270 compat=0 ip=0x7f15da39ce59 code=0x7ffc0000 [ 304.336127][T15911] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 304.403264][T15911] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 304.441079][ T6576] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 304.445494][T15911] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 304.460305][ T6577] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 304.512754][T15911] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 304.520922][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 304.553497][T15880] vhci_hcd: connection reset by peer [ 304.555937][ T8009] vhci_hcd vhci_hcd.2: stop threads [ 304.558103][ T8009] vhci_hcd vhci_hcd.2: release socket [ 304.560444][ T8009] vhci_hcd vhci_hcd.2: disconnect device [ 304.560740][ T12] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 304.567829][ T12] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 304.574337][ T8009] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 304.581370][ T12] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 304.621416][ T6577] usb 10-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 304.625222][ T6577] usb 10-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 304.628470][ T6577] usb 10-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 304.631508][ T6577] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 304.636401][T15899] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 304.641124][ T6577] usb 10-1: Quirk or no altset; falling back to MIDI 1.0 [ 304.844157][T15899] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 304.846869][T15899] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 304.978555][ T847] usb 10-1: USB disconnect, device number 7 [ 305.105985][T15923] macvtap1: entered promiscuous mode [ 305.183692][T15934] ip6t_srh: unknown srh match flags 4015 [ 305.251144][T15933] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 305.269358][ T41] audit: type=1400 audit(305.035:969): avc: denied { lock } for pid=15935 comm="syz.2.3236" path="/dev/nullb0" dev="devtmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 305.480519][ T6576] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 305.553383][T15941] netlink: 'syz.5.3237': attribute type 3 has an invalid length. [ 305.559329][T15941] dns_resolver: Unsupported server list version (0) [ 305.800471][ T10] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 305.961511][ T10] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 305.964771][ T10] usb 10-1: config 0 has no interfaces? [ 305.966696][ T10] usb 10-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 305.969511][ T10] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.973090][ T10] usb 10-1: config 0 descriptor?? [ 306.016183][T15945] netlink: 260 bytes leftover after parsing attributes in process `syz.4.3239'. [ 306.520417][ T6576] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 306.548870][ T41] audit: type=1400 audit(306.315:970): avc: denied { read append } for pid=15968 comm="syz.2.3250" name="file0" dev="tmpfs" ino=1018 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 306.556199][ T41] audit: type=1400 audit(306.315:971): avc: denied { open } for pid=15968 comm="syz.2.3250" path="/188/file0" dev="tmpfs" ino=1018 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 306.741476][T15976] netlink: 'syz.2.3253': attribute type 1 has an invalid length. [ 307.010253][ T6576] usb 7-1: new full-speed USB device number 72 using dummy_hcd [ 307.162124][ T6576] usb 7-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 307.165672][ T6576] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x93, changing to 0x83 [ 307.170239][ T6576] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 307.173996][ T6576] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 307.177068][ T6576] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 307.182633][ T6576] usb 7-1: New USB device found, idVendor=15c2, idProduct=003b, bcdDevice=66.3e [ 307.185492][ T6576] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.187955][ T6576] usb 7-1: Product: syz [ 307.189232][ T6576] usb 7-1: Manufacturer: syz [ 307.190828][ T6576] usb 7-1: SerialNumber: syz [ 307.195540][ T6576] usb 7-1: config 0 descriptor?? [ 307.198342][ T6576] imon:imon_init_intf0: usb_submit_urb failed for intf0 (-90) [ 307.200804][ T6576] imon 7-1:0.0: unable to initialize intf0, err -90 [ 307.203137][ T6576] imon:imon_probe: failed to initialize context! [ 307.205070][ T6576] imon 7-1:0.0: unable to register, err -19 [ 307.265036][T15995] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3261'. [ 307.269133][T15995] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 307.400199][ T6576] usb 7-1: USB disconnect, device number 72 [ 307.560408][ T6577] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 307.563839][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 307.662024][ T41] audit: type=1400 audit(307.435:972): avc: denied { listen } for pid=16012 comm="syz.4.3269" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 307.714053][T16017] ------------[ cut here ]------------ [ 307.716302][T16017] !(flags & __GFP_NOWARN) [ 307.716314][T16017] WARNING: mm/slub.c:6841 at __kvmalloc_node_noprof+0x6f7/0xa60, CPU#2: syz.4.3271/16017 [ 307.722097][T16017] Modules linked in: [ 307.723356][T16017] CPU: 2 UID: 0 PID: 16017 Comm: syz.4.3271 Tainted: G L syzkaller #0 PREEMPT(full) [ 307.726780][T16017] Tainted: [L]=SOFTLOCKUP [ 307.728121][T16017] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 307.731874][T16017] RIP: 0010:__kvmalloc_node_noprof+0x6f7/0xa60 [ 307.733752][T16017] Code: c1 e8 5d 0f ff ff 4d 85 f6 0f 85 21 fd ff ff 48 81 fb ff ff ff 7f 0f 86 b8 fc ff ff 41 81 e4 00 20 00 00 0f 85 07 fd ff ff 90 <0f> 0b 90 e9 fe fc ff ff be 43 01 00 00 48 c7 c7 5e 81 f2 8d e8 10 [ 307.740706][T16017] RSP: 0018:ffffc9000706fa88 EFLAGS: 00010246 [ 307.743172][T16017] RAX: 0000000000000001 RBX: 0000000080000008 RCX: 0000000100000000 [ 307.746286][T16017] RDX: 0000000000000000 RSI: ffffffff8c1e6100 RDI: ffffffff8e1f3930 [ 307.749090][T16017] RBP: 0000000000000021 R08: 00000000004028c0 R09: 00000000ffffffff [ 307.752560][T16017] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 [ 307.755652][T16017] R13: 00000000ffffffff R14: 0000000000000000 R15: 00000000004028c0 [ 307.758711][T16017] FS: 00007f15db2f76c0(0000) GS:ffff8880d6516000(0000) knlGS:0000000000000000 [ 307.762401][T16017] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 307.765071][T16017] CR2: 0000200000002300 CR3: 0000000033600000 CR4: 0000000000352ef0 [ 307.767456][T16017] Call Trace: [ 307.768479][T16017] [ 307.769359][T16017] ? io_pin_pages+0xc3/0x1e0 [ 307.770858][T16017] io_pin_pages+0xc3/0x1e0 [ 307.772172][T16017] io_sqe_buffer_register+0x1d9/0x1500 [ 307.774257][T16017] ? rcu_is_cpu_rrupt_from_idle+0x250/0x270 [ 307.776460][T16017] ? trace_kmalloc+0xeb/0x110 [ 307.778506][T16017] ? __pfx_io_sqe_buffer_register+0x10/0x10 [ 307.781252][T16017] ? io_rsrc_data_alloc+0x2c/0xa0 [ 307.783265][T16017] ? copy_iovec_from_user+0x102/0x140 [ 307.785385][T16017] ? iovec_from_user+0xda/0x140 [ 307.787243][T16017] io_sqe_buffers_register.cold+0x346/0x4c3 [ 307.789613][T16017] ? __pfx_io_sqe_buffers_register+0x10/0x10 [ 307.792104][T16017] ? __fget_files+0x21f/0x3d0 [ 307.794038][T16017] __do_sys_io_uring_register+0x13ce/0x1bc0 [ 307.796399][T16017] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 307.798940][T16017] ? __pfx___do_sys_io_uring_register+0x10/0x10 [ 307.801609][T16017] ? __x64_sys_futex+0x34f/0x4d0 [ 307.803669][T16017] ? __x64_sys_futex+0x358/0x4d0 [ 307.805723][T16017] ? rcu_is_watching+0x12/0xc0 [ 307.807688][T16017] ? xfd_validate_state+0x129/0x190 [ 307.809763][T16017] ? rcu_is_watching+0x12/0xc0 [ 307.812022][T16017] do_syscall_64+0x115/0x870 [ 307.813871][T16017] ? clear_bhb_loop+0x40/0x90 [ 307.815809][T16017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.818232][T16017] RIP: 0033:0x7f15da39ce59 [ 307.820029][T16017] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 307.827589][T16017] RSP: 002b:00007f15db2f7028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 307.830951][T16017] RAX: ffffffffffffffda RBX: 00007f15da615fa0 RCX: 00007f15da39ce59 [ 307.834062][T16017] RDX: 0000200000002300 RSI: 0000000000000000 RDI: 0000000000000003 [ 307.837166][T16017] RBP: 00007f15da432e6f R08: 0000000000000000 R09: 0000000000000000 [ 307.840616][T16017] R10: 0000000000003100 R11: 0000000000000246 R12: 0000000000000000 [ 307.843718][T16017] R13: 00007f15da616038 R14: 00007f15da615fa0 R15: 00007ffc9f756c28 [ 307.846782][T16017] [ 307.848048][T16017] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 307.850871][T16017] CPU: 2 UID: 0 PID: 16017 Comm: syz.4.3271 Tainted: G L syzkaller #0 PREEMPT(full) [ 307.855057][T16017] Tainted: [L]=SOFTLOCKUP [ 307.856781][T16017] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 307.860679][T16017] Call Trace: [ 307.862001][T16017] [ 307.863195][T16017] dump_stack_lvl+0x100/0x190 [ 307.865066][T16017] vpanic+0x552/0x970 [ 307.866694][T16017] ? __pfx_vpanic+0x10/0x10 [ 307.868521][T16017] ? lock_release+0x24d/0x310 [ 307.870423][T16017] panic+0xd1/0xe0 [ 307.871938][T16017] ? __pfx_panic+0x10/0x10 [ 307.873739][T16017] check_panic_on_warn.cold+0x19/0x34 [ 307.875870][T16017] ? __kvmalloc_node_noprof+0x6f7/0xa60 [ 307.878062][T16017] __warn.cold+0x191/0x318 [ 307.879844][T16017] __report_bug+0x30f/0x440 [ 307.881656][T16017] ? __kvmalloc_node_noprof+0x6f7/0xa60 [ 307.883896][T16017] ? __pfx___report_bug+0x10/0x10 [ 307.885908][T16017] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 307.888266][T16017] ? policy_nodemask+0xed/0x4f0 [ 307.890208][T16017] ? __kvmalloc_node_noprof+0x6f7/0xa60 [ 307.892360][T16017] report_bug+0xb2/0x220 [ 307.894056][T16017] ? __kvmalloc_node_noprof+0x6f7/0xa60 [ 307.896273][T16017] handle_bug+0x16a/0x2a0 [ 307.897790][T16017] exc_invalid_op+0x17/0x50 [ 307.899165][T16017] asm_exc_invalid_op+0x1a/0x20 [ 307.900605][T16017] RIP: 0010:__kvmalloc_node_noprof+0x6f7/0xa60 [ 307.902488][T16017] Code: c1 e8 5d 0f ff ff 4d 85 f6 0f 85 21 fd ff ff 48 81 fb ff ff ff 7f 0f 86 b8 fc ff ff 41 81 e4 00 20 00 00 0f 85 07 fd ff ff 90 <0f> 0b 90 e9 fe fc ff ff be 43 01 00 00 48 c7 c7 5e 81 f2 8d e8 10 [ 307.909183][T16017] RSP: 0018:ffffc9000706fa88 EFLAGS: 00010246 [ 307.911045][T16017] RAX: 0000000000000001 RBX: 0000000080000008 RCX: 0000000100000000 [ 307.913663][T16017] RDX: 0000000000000000 RSI: ffffffff8c1e6100 RDI: ffffffff8e1f3930 [ 307.916873][T16017] RBP: 0000000000000021 R08: 00000000004028c0 R09: 00000000ffffffff [ 307.920100][T16017] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 [ 307.923303][T16017] R13: 00000000ffffffff R14: 0000000000000000 R15: 00000000004028c0 [ 307.926491][T16017] ? __kvmalloc_node_noprof+0x6d3/0xa60 [ 307.928711][T16017] ? io_pin_pages+0xc3/0x1e0 [ 307.930576][T16017] io_pin_pages+0xc3/0x1e0 [ 307.932408][T16017] io_sqe_buffer_register+0x1d9/0x1500 [ 307.934607][T16017] ? rcu_is_cpu_rrupt_from_idle+0x250/0x270 [ 307.936985][T16017] ? trace_kmalloc+0xeb/0x110 [ 307.938903][T16017] ? __pfx_io_sqe_buffer_register+0x10/0x10 [ 307.941273][T16017] ? io_rsrc_data_alloc+0x2c/0xa0 [ 307.943319][T16017] ? copy_iovec_from_user+0x102/0x140 [ 307.945479][T16017] ? iovec_from_user+0xda/0x140 [ 307.947498][T16017] io_sqe_buffers_register.cold+0x346/0x4c3 [ 307.949917][T16017] ? __pfx_io_sqe_buffers_register+0x10/0x10 [ 307.952356][T16017] ? __fget_files+0x21f/0x3d0 [ 307.954264][T16017] __do_sys_io_uring_register+0x13ce/0x1bc0 [ 307.956648][T16017] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 307.959266][T16017] ? __pfx___do_sys_io_uring_register+0x10/0x10 [ 307.961808][T16017] ? __x64_sys_futex+0x34f/0x4d0 [ 307.963900][T16017] ? __x64_sys_futex+0x358/0x4d0 [ 307.965918][T16017] ? rcu_is_watching+0x12/0xc0 [ 307.967920][T16017] ? xfd_validate_state+0x129/0x190 [ 307.970025][T16017] ? rcu_is_watching+0x12/0xc0 [ 307.971998][T16017] do_syscall_64+0x115/0x870 [ 307.973892][T16017] ? clear_bhb_loop+0x40/0x90 [ 307.975807][T16017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.978182][T16017] RIP: 0033:0x7f15da39ce59 [ 307.980019][T16017] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 307.987722][T16017] RSP: 002b:00007f15db2f7028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 307.991063][T16017] RAX: ffffffffffffffda RBX: 00007f15da615fa0 RCX: 00007f15da39ce59 [ 307.994144][T16017] RDX: 0000200000002300 RSI: 0000000000000000 RDI: 0000000000000003 [ 307.996492][T16017] RBP: 00007f15da432e6f R08: 0000000000000000 R09: 0000000000000000 [ 307.999206][T16017] R10: 0000000000003100 R11: 0000000000000246 R12: 0000000000000000 [ 308.002261][T16017] R13: 00007f15da616038 R14: 00007f15da615fa0 R15: 00007ffc9f756c28 [ 308.005400][T16017] [ 308.007356][T16017] Kernel Offset: disabled [ 308.009048][T16017] Rebooting in 86400 seconds..