last executing test programs: 8m3.318226822s ago: executing program 32 (id=631): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0500000004000000040000000b"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 6m57.226861007s ago: executing program 33 (id=1414): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r2 = accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x80000) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000600)={r0, r2, 0x8, 0x0, 0x0, 0x6, 0xfc, 0x10cf, 0x5, 0x5, 0x2, 0x1, 'syz0\x00'}) 3m48.408394913s ago: executing program 34 (id=3313): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x3}, 0x50) write(r1, &(0x7f00000002c0)="04", 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x4}, 0x8) 2m11.418456307s ago: executing program 35 (id=4292): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r0, 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f0000000340)='3\n\x00', 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd/threads\x00', 0x1, 0x0) write(r2, 0x0, 0x0) 2m1.115123742s ago: executing program 8 (id=4587): r0 = socket$inet(0x2, 0x1, 0x6) bind$inet(r0, &(0x7f0000000100)={0x2, 0x801, @loopback}, 0x10) listen(r0, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f0000000440)='127.0.0.1:/\x00', &(0x7f0000000480)='./mnt\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049,proto=tcp,clientaddr=127.0.0.1,soft,timeo=1,retry=0\x00']) (async) r1 = accept(r0, 0x0, 0x0) read(r1, &(0x7f0000000600)=""/100, 0x64) write(r1, &(0x7f0000000700)="8000001c000000010000000100"/32, 0x20) 2m0.66181432s ago: executing program 8 (id=4596): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x4}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) 2m0.575307319s ago: executing program 8 (id=4597): r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='task\x00') fchdir(r0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000100)='proc\x00', 0x18006, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000640)='net/protocols\x00') exit(0x2616) fchdir(r1) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) 1m59.721158289s ago: executing program 8 (id=4608): mkdir(&(0x7f00000001c0)='./file0\x00', 0x124) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x103090, 0x0) mount$bind(&(0x7f0000001900)='.\x00', &(0x7f0000000380)='./file0/file0\x00', 0x0, 0x2a05004, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) 1m59.645168827s ago: executing program 8 (id=4610): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) epoll_pwait(r0, &(0x7f00000000c0)=[{}], 0x1, 0xfe, 0x0, 0x0) 1m59.30895187s ago: executing program 8 (id=4613): sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x92fda000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32) ftruncate(r1, 0x6000000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) fallocate(r0, 0x0, 0xa20, 0x8000c64) 1m58.990605541s ago: executing program 36 (id=4613): sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x92fda000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32) ftruncate(r1, 0x6000000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) fallocate(r0, 0x0, 0xa20, 0x8000c64) 1m26.341600282s ago: executing program 3 (id=4868): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0}, 0x94) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x1145, &(0x7f0000004fc0)=ANY=[], 0x0) 1m25.739841669s ago: executing program 3 (id=4871): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) umount2(&(0x7f0000000380)='./file1/file0\x00', 0x0) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 1m25.620257045s ago: executing program 3 (id=4873): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x6, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000000)={0x20, 0x11, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xa, 0x0, 0x0, 0x0, @binary="56ccabd869c2"}]}]}, 0x20}], 0x1, 0x0, 0x0, 0xc010}, 0x40080) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m25.536039254s ago: executing program 3 (id=4876): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x1c3902, 0x0) sendfile(r0, r0, 0x0, 0x200000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1m25.436496711s ago: executing program 3 (id=4877): mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) syz_clone(0xca700, 0x0, 0x0, 0x0, 0x0, 0x0) 1m25.187874616s ago: executing program 3 (id=4879): socket$vsock_stream(0x28, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc4}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) 1m10.14533285s ago: executing program 37 (id=4879): socket$vsock_stream(0x28, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc4}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) 1m1.748222995s ago: executing program 0 (id=5022): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x800, 0x5, 0xd000, 0xe, "0062ba7d8200000016001b000200f705096604"}) r1 = syz_open_pts(r0, 0xa0200) r2 = dup3(r1, r0, 0x0) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000040)={0x7, 0x4, 0x2, 0x3, 0x16, "e533991cd00ee11a"}) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_setup(0x7, &(0x7f00000000c0)=0x0) io_submit(r4, 0x1, &(0x7f0000000100)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x2}]) 1m1.356419897s ago: executing program 0 (id=5025): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000240)="98"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)="ef"}) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f00000034c0)={0x2020}, 0x2020) 1m0.400261885s ago: executing program 0 (id=5033): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) syz_clone3(0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x40000, 0x0) fcntl$notify(r1, 0x402, 0x1a) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000000)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000080)={r2, 0x1, r0, 0x4}) openat$hwrng(0xffffffffffffff9c, 0x0, 0x101000, 0x0) 59.443547589s ago: executing program 0 (id=5042): sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) r0 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="020e00001800000000000000ffdbdf25030005000000000002000000ac1e00010000000000000000030006000000000002000000000000000000000000000000040004000000000000000000000000000000000000000000000000000000000008001200000002000000000000000000060000000000000000000000000000c32f67630000000000000000000000000100000000000000000000000000000000040003"], 0xc0}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c00)=ANY=[@ANYBLOB="3801000010003306000096708b047129c02500001644000000000000000800aaac1e0001000000000000000000001f0000004000000080040000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac14143f0000000000000000000000000000000032000000fc0200000000000000000000000000002703000000000000090000000000000000000000000000000400000000000000000000000000200000000000000000000100000000000000070000000000000000000000000000000000000000000000020000000000000000000000000000008f000000000000000800000029bd70000235000002000100000000000000000048000200656362286369706865725f6e756c6c29"], 0x138}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[], 0x10}}, 0x0) sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020a000002"], 0x10}}, 0x0) 58.823633532s ago: executing program 0 (id=5045): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mnt\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./rpc_pipe\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000400)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000500)='nfs4\x00', 0x0, &(0x7f0000000540)='addr=127.0.0.1,port=2049,proto=tcp,clientaddr=127.0.0.1\x00') 57.733107049s ago: executing program 0 (id=5052): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000016001000071b48013d030100000000000402000000b00000bc26100000000000bf6720000000000016020000000000016702000007000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00'}, 0x48) 42.646252062s ago: executing program 38 (id=5052): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000016001000071b48013d030100000000000402000000b00000bc26100000000000bf6720000000000016020000000000016702000007000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00'}, 0x48) 38.665547341s ago: executing program 4 (id=5221): mkdir(&(0x7f0000000080)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f0000000340)={0x8000000000000000, 0x8, 0x2000008, 0xff, 0x2, 0x10006, 0x6, 0xfffffffffffffffc, 0x100ff7}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) 38.638107724s ago: executing program 4 (id=5222): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) accept4(r0, 0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0xc, &(0x7f0000000040)={0x0, 0xc92e, 0xdb00, 0x8, 0x29}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x1f, 0x0, 0x0) 38.525591547s ago: executing program 4 (id=5224): fsopen(&(0x7f0000000180)='hfs\x00', 0x1) r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(r0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in={{0x2, 0x4e21, @remote}}}, &(0x7f0000000000)=0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={0x0}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000900)=@sack_info={r3, 0xfffffff8, 0xb}, &(0x7f0000000940)=0xc) 38.446402512s ago: executing program 4 (id=5225): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) r0 = open$dir(&(0x7f0000000100)='./file0/../file0\x00', 0x210200, 0x0) r1 = open_tree(r0, &(0x7f0000000040)='./file0/../file0\x00', 0x81901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 38.356563039s ago: executing program 4 (id=5226): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) bind$tipc(r1, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) bind$tipc(r1, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x100003}}, 0x10) bind$tipc(r0, 0x0, 0x0) 38.167709334s ago: executing program 4 (id=5227): pipe2$9p(&(0x7f00000001c0), 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000691000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0}, 0x68) sendmsg$RDMA_NLDEV_CMD_RES_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x20040810) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000100)={0xf, 0x1f, 0x2, 0x2}, 0x51) prlimit64(0x0, 0x1, &(0x7f0000000140)={0x5, 0x4}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x4, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02080000040000000100000009000100000000", @ANYRES32, @ANYBLOB='\x00\x00'], 0x48) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 37.997462475s ago: executing program 39 (id=5227): pipe2$9p(&(0x7f00000001c0), 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000691000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0}, 0x68) sendmsg$RDMA_NLDEV_CMD_RES_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x20040810) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000100)={0xf, 0x1f, 0x2, 0x2}, 0x51) prlimit64(0x0, 0x1, &(0x7f0000000140)={0x5, 0x4}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x4, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02080000040000000100000009000100000000", @ANYRES32, @ANYBLOB='\x00\x00'], 0x48) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 23.985616319s ago: executing program 9 (id=5295): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r0, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f680, 0x0, 0x39d}) syz_io_uring_setup(0x5103, &(0x7f0000000180)={0x0, 0x1370, 0x11000, 0x2, 0x2cf}, &(0x7f0000000140), &(0x7f0000000400), &(0x7f0000000000)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) io_uring_enter(r1, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) 23.869144552s ago: executing program 9 (id=5297): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000020000000000000014085000000050000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000ffffff0000000000000000851000000200000085000000070000009500000000000000"], 0x0, 0xfffffdff, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x3f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r2, r1, 0x25, 0x0, @void}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000000)=ANY=[], 0x0) 23.736473052s ago: executing program 9 (id=5299): getpid() openat(0xffffffffffffff9c, 0x0, 0x40042, 0x101) socket(0xa, 0x3, 0x87) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) connect$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) r1 = fcntl$dupfd(r0, 0x406, r0) write$binfmt_elf64(r1, &(0x7f0000000300)=ANY=[], 0xfffffdcf) connect$unix(r1, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) 23.611494196s ago: executing program 9 (id=5301): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x2, {{0x42, 0x20000003}, 0xfffffffc}}, 0x10) bind$tipc(r0, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x1002}}}, 0x10) bind$tipc(r1, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) bind$tipc(r0, 0x0, 0x0) 23.54582634s ago: executing program 9 (id=5302): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file1/file0\x00', 0x6a) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x40000, 0x73) getdents64(r0, 0x0, 0x0) 23.437999067s ago: executing program 9 (id=5303): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4000050) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x6}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) sync() sync() sync() write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000000)={0x2, 0x3}, 0x2) 13.095406953s ago: executing program 5 (id=5410): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r1, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x9}}]}}]}, 0x48}}, 0xc840) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000800)=@newtfilter={0x54, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x6}, {}, {0x7, 0xfff1}}, [@filter_kind_options=@f_u32={{0x8}, {0x28, 0x2, [@TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0xb709, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4084}, 0x24040084) recvmmsg$unix(r0, &(0x7f0000000580)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000002c0)=""/219, 0xdb}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x60, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[], 0xc3}, 0x1, 0x100000000000000, 0x0, 0x2000}, 0x40400c0) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) 12.964169949s ago: executing program 5 (id=5413): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000040)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) rmdir(&(0x7f0000000200)='./file0/file1\x00') 12.837470602s ago: executing program 5 (id=5415): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000b80)={0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000100)={'vlan0\x00', &(0x7f0000002fc0)=@ethtool_link_settings={0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, [0x0, 0xe, 0x0, 0x0, 0x400000]}}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x15) syz_clone3(&(0x7f0000000680)={0x80000000, 0x0, 0x0, 0x0, {0x1c}, 0x0, 0x0, 0x0, &(0x7f0000000600)=[0x0], 0x1}, 0x58) 10.218300882s ago: executing program 1 (id=5441): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000140)=0x7, 0x4) socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newtaction={0xcc, 0x30, 0xffff, 0x70bd27, 0x0, {}, [{0xb8, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x10000, 0x0, 0x0, 0x1000000, 0x0, {0x0, 0x2, 0x0, 0x0, 0xfffe}, {0x0, 0x0, 0x0, 0x0, 0xfffd}}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_gact={0x48, 0x2, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x0, 0x1}}]}, {0x4}, {0xc, 0x3}, {0xc}}}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x32, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) 10.157403982s ago: executing program 1 (id=5442): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x34, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}}, 0x0) write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x20) 9.993605207s ago: executing program 1 (id=5443): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000300)=0x8000, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r0, &(0x7f0000000100)={0x2c, 0x0, r2}, 0x10) ppoll(&(0x7f0000000240)=[{r0, 0x4000}], 0x1, &(0x7f0000000280)={0x0, 0x989680}, 0x0, 0x0) 9.967702701s ago: executing program 1 (id=5444): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x10040) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f00000002c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) creat(0x0, 0x20) mount(0x0, 0x0, 0x0, 0x1000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6d71b000) syz_emit_ethernet(0x42, &(0x7f00000003c0)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0xfffe, 0x0, 0x95, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0x10, 0x8, 0x0, 0x1000, {[@timestamp={0x8, 0xa, 0x8001, 0x400056}]}}}}}}}, 0x0) 9.700393894s ago: executing program 5 (id=5447): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff0000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x214c, 0xc000, 0x0, 0x70}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0xc000) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}, {0x0}], 0x2) io_uring_enter(r0, 0x2219, 0x1adf, 0x16, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @random="dccf0b3ab7ce"}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000780)={0x1, &(0x7f0000000000)=[{0x34, 0x0, 0x0, 0x2}]}) 9.469997083s ago: executing program 1 (id=5450): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x60d4, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0) read$FUSE(r0, &(0x7f0000004380)={0x2020}, 0x2020) 9.186388475s ago: executing program 1 (id=5453): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mnt\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./rpc_pipe\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000400)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp,nolock,rsize=1024,wsize=1024\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000500)='nfs4\x00', 0x0, &(0x7f0000000540)='addr=127.0.0.1,port=2049,proto=tcp,clientaddr=127.0.0.1\x00') 9.11926092s ago: executing program 5 (id=5454): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x80000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) 8.826699954s ago: executing program 5 (id=5457): socket$nl_generic(0x10, 0x3, 0x10) setns(0xc9, 0x0) socket(0x8, 0x5, 0x5) epoll_create1(0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x40000000000000, 0x2, 0x80000001}, 0x0, &(0x7f0000000040)={0x3ff, 0x1, 0x400000000, 0x5, 0x0, 0x0, 0x7ff}, 0x0, 0x0) vmsplice(r0, &(0x7f00000003c0)=[{&(0x7f00000002c0)='\"', 0x1}], 0x1, 0x3) 8.415618111s ago: executing program 40 (id=5303): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4000050) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x6}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) sync() sync() sync() write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000000)={0x2, 0x3}, 0x2) 2.954809462s ago: executing program 6 (id=5491): socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000691000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0}, 0x68) sendmsg$RDMA_NLDEV_CMD_RES_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x20040810) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000100)={0xf, 0x1f, 0x2, 0x2}, 0x51) prlimit64(0x0, 0x1, &(0x7f0000000140)={0x5, 0x4}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x4, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02080000040000000100000009000100000000", @ANYRES32, @ANYBLOB='\x00\x00'], 0x48) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2.728518066s ago: executing program 6 (id=5494): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0, 0x164) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) syz_emit_vhci(&(0x7f0000000280)=ANY=[@ANYBLOB="040302"], 0x4) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0xa8002, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000280)="c021", 0x1700}], 0x1) 2.616819443s ago: executing program 6 (id=5495): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6, 0xfffffffd, 0xfff}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000013c0), r2) sendmsg$NL80211_CMD_GET_WIPHY(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x30, r3, 0x65aebf9dafbebb59, 0x70bd28, 0x1, {{}, {@val={0x8, 0x12b, 0xffffffff}, @val={0x8}, @val={0xc, 0x99, {0x6, 0x13}}}}}, 0x30}, 0x1, 0x0, 0x0, 0x400c080}, 0x24048840) sendmsg$NL80211_CMD_GET_WIPHY(r1, 0x0, 0x20000000) recvmmsg(r2, &(0x7f0000008900)=[{{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000002980), 0x0, &(0x7f0000002a40)=""/67, 0x43}, 0x1}, {{0x0, 0x0, 0x0}, 0xefd}], 0x3, 0x2, 0x0) 2.541379588s ago: executing program 6 (id=5496): rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7, 0x40000400004, &(0x7f0000000040)) signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000d88000/0x1000)=nil, &(0x7f00007f2000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000b1f000/0xf000)=nil, &(0x7f0000f4a000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fbc000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f00008f7000/0x1000)=nil, &(0x7f00004d9000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x2405a045) r0 = io_uring_setup(0x2b24, &(0x7f0000000040)={0x0, 0xcaa1, 0xc000, 0x6, 0x2f8}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) rt_sigsuspend(&(0x7f0000000040)={[0x4]}, 0x8) 2.47704682s ago: executing program 6 (id=5497): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000100)="660f388173ab0fc76fb4360fc9bb25cc00007666ba6bb74189000003c70fae6e2fc0c00f0f2367260f01ca660f38817700c4c2459d78ad", 0x37}], 0x1, 0x55, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001f80)=[{{&(0x7f00000000c0)={0x2, 0x4e22, @remote}, 0x10, 0x0}}], 0x1, 0x4) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fdd000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080}) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x84, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e21, 0x101, @empty, 0x5ff}}, 0x7, 0x7ffd}, &(0x7f0000000000)=0x90) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.8099358s ago: executing program 2 (id=5501): socket$netlink(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000280)) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b70300001a000000850000003300000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r1}, &(0x7f0000000400), &(0x7f0000000500)=r2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="b9ff036bd9a3d0392eb005ead97f", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 1.643719736s ago: executing program 2 (id=5502): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) write(r1, &(0x7f0000000000)="ea", 0x1) write(r1, &(0x7f00000002c0)="04", 0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000100)={0x1, 0x0, 0x2, 0xfbffffff}, 0x10) sendto$inet6(r1, &(0x7f0000000200)='x', 0x1, 0x800, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x1}, 0x8) close(r1) 1.555590137s ago: executing program 2 (id=5503): bpf$PROG_LOAD(0x5, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) futex_waitv(&(0x7f0000000180)=[{0x0, &(0x7f0000000000), 0x2}], 0x1, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_clone3(0x0, 0x0) 1.493540462s ago: executing program 6 (id=5504): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2b, 0x25dfdbff, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x200009d1}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000300), r1) sendmsg$SMC_PNETID_ADD(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)={0x30, r2, 0x1, 0x0, 0x0, {0x1}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'lo\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}]}, 0x30}}, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) bind(r3, &(0x7f0000000200)=@in={0x2, 0x4e21, @dev={0x7f, 0x0, 0x0, 0x1}}, 0x10) listen(r3, 0x5) r4 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r4, &(0x7f0000000100)={0x2, 0x4e21, @dev={0x7f, 0x0, 0x0, 0x1}}, 0x10) 704.597547ms ago: executing program 7 (id=5507): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000c, 0x28011, r2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) ftruncate(r2, 0x80796c) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) 576.324226ms ago: executing program 7 (id=5508): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7c, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x200, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0xc}}}, 0x24}}, 0x4004004) r1 = socket$inet(0x2, 0x80001, 0x84) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)="1632800e", 0x4}], 0x1) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 570.361459ms ago: executing program 2 (id=5509): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f00000000c0)='ip6gretap0\x00') r1 = socket(0x10, 0x80002, 0x0) r2 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380000005400e50100000000fdffffff07000000", @ANYRES32=r3, @ANYBLOB="20000100", @ANYRES32=r5, @ANYBLOB="01010100ffffffff001dbcbb8c9e1e11000000000000000000000086dd00008b5b350ea3237dffcd58c9d660"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmmsg$alg(r1, &(0x7f00000000c0), 0x492492492492627, 0x0) 467.468105ms ago: executing program 2 (id=5510): r0 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r0, &(0x7f0000000000)=@in={0x2, 0x1388, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_sctp(0x2, 0x1, 0x84) connect(r1, &(0x7f0000000100)=@in={0x2, 0x1388, @loopback}, 0x10) accept(r0, 0x0, 0x0) sendmsg$inet_sctp(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)='a', 0x1}], 0x1, &(0x7f0000000300)=[@sndrcv={0x30, 0x84, 0x1, {0x0, 0x0, 0x2}}], 0x30}, 0x0) sendmsg$inet_sctp(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)='b', 0x1}], 0x1, &(0x7f0000000300)=[@sndinfo={0x20, 0x84, 0x2, {0x0, 0x1}}], 0x20}, 0x0) shutdown(r1, 0x1) sendmsg$inet_sctp(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)='c', 0x1}], 0x1}, 0x0) 465.719313ms ago: executing program 7 (id=5511): prlimit64(0x0, 0xe, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) prlimit64(0x0, 0x8, 0x0, &(0x7f0000000100)) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x2340, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x1, 0x484, 0x0, 0x1}, 0x10) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000000000000000000000800040001000000", 0x24) 357.939371ms ago: executing program 7 (id=5512): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b702000004000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff1d6405000000000065040400210000000404000001e37c60b7040000000000006a0a00fe000000008500000032000000b70000000000000095000000000000000ce0de7621e5e832249c04112cf7af2b75d0d1f034b1b3fb6bd3ce8fa62c7941272ff49142d860010ab162aa2264ab67e55a00000000000000edfe0969a9ddc125b686a1e83c8790c893d713b3295dad0ea697181d1e85b64126b5d72f204754d1d4a93f24215dee354e93cfc3f50ff23f8432c72012f021c84c59a9d4c142f439d3040cfee621589fb3a2f1407c7cbed48e7026f8d52d4bca2608c79aa4a73732028f88ce07ed1075da4a2ef44e3d8b88873f0b1de87dfb6d15936ec0a27cb554def9e27396df6b7851ffa26237ea6730880f06371beb3b290b7d8629a6f0373fefa0acb60888fc14ad2b83ca03ac2aee792482ced58af4140cc4ce3efef26e00c5b2200a91cb80c6065a697d6fc8aa8b65aee0783b04cff0218ce82c9687b4474da89c474c23727555fc5e5f8ad0f2f7a261140440fce1f12cc6df312accd011d888384283092d987c40bbb46f68c2431b97906f00000000349834fa147bd5923bbd4e606708034931a8f1a89bdf77093a0000427aab8e21e1a33d3fe093547532fce6549dd648ad233e05a7b3ea178007c1c32e871ac81f287c4aabbd153390b16d1d41ee433e3aee000000000009e106d6b5289f0000000000000000000000f7bc9f46cb71f6b889d37807865e3b4e9916dd0f72c9d58ea333b90f8886dcbf5ddda0e42ca08e3303632401f2f5212b40c0e88c957fd767dbfc80b07ad668b4f6f92fb209d7c2dbac597843c8eb7bf92fe6d0bb0b72549795c2ed19e441eb69869844152ba9da0588e42cdbc5fcd245ce5e3ef0dca64931276702a312db7956f0a75eb9caa17d47a6331c7c963cbf86a845ce27c26b7136d3e7207318b1df7a6320c64f18ccd926eaeddcde8d5006d6c38db117fb1115221a66169172720ccca770bff37e59511b2606138377eda44b2f288b491ab8aae0e11a98303b0e407e0f9d21f4a3ebbd3fabf6da9a1a1f869a339fab465d8322b7280b0734fd115a19b33c8644fff71b3c62f2e1b827e2663e06a751182e968c8ab05fb1d0115d4b11d944f2c06acc023a02b7416a9a10218d21503cda13bb5df6c992e52e1c01793b728eac000058ab3b3900d279297dadc127e2f38fc60c23af2e1fefa5a83456647191ba1953d320f59aa261fe79613df6bf43884e9649691e32680d75a541c27ffe74f9d13340f2cf1c7dc2b7db01213216cd4ecfd30efe137641471987289b7e23482e026b26eacd1b97443e2ea2d1d6e31a01ee0ae7fa195a2152b2338b086423a3883f2ce3e2f84e04f4d52c985eac4b46336908599564b47db0e6aa97ee51a360f4382fd99745725d44c77d097f69d19fe86f71c38a0226d44ebe0ecbd959f14b540745cd03b8c9f02b825ba45ca85706c73115f70871db9d2a1bc2a517b39f9648123917a5db07ba4e27f961373767e1ea8f7cc558e483abef1a9923c5cfa2081e430680950b7d7c377726b557ad31fdee17ba7057741f39d29d8ab295222f96297a777bb235416e72c84afef2bdb08fb375147b028b89f15af45bc8976b91158c13c9876daa71e7db0f5a17376be39ea79ce1246c547c740e31c64e5d293e0e5a544dd166010061d6ccae46c173b8e11721e4bce22c16af00000021f80ac6c3971006db853e3c40a5417d6eac09eb0e01ac6bd4c6dacdcb1d6d2ef9c8bdea91c984022821e961236d08f8b9072ec6cb5d5a68833fd5b4e80a5ac2bc6ff323f5ce612b59ce8177956c1affcc8baf4c8b59ab959aff9a7bd81f7c7c1f1bb92ddbeed6bce8041c7f0c1c584e6ae027678ce3cfbfea938aecc3c5119c5875b7fb35dc20f5c7aaae1e276104f607a73fe501c1045873a2b1eb80e95c87f099d98028dc82bdc7ef08c871fb3061c3c5ebd613e6e5e8cf099bb6e8c0441a133c85138b36a02c47fbedf7ed1d3ce74c9ec2c676c0b2d4b5eca61dbf5769b483c2a9f6bec666dae4e81960e9bad7f17cfc3d5bcc7b7f437110ca8ffa908c12086b2227eb202a8d56e0925ba994b05c98c39de44d25932449ddf08e5377814a40877eab4440ca01b3f50d2014a61a7d32105254b424238122386424efa3a7041254f686a5faac120942287f75e8e3db569ce47b120059d774a37e11d013be50cd2cbb00f6d2a23af61ec7d30bb7dc33a92f900b6ff1d29dc61cc40b846040dbafd00c6bcfbcf700"/1664], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffffe}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x702, 0xe80, 0x0, &(0x7f0000000380)="e460334470b8d480eb00c1520813", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, 0x0, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) dup(r2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) mknodat(0xffffffffffffff9c, 0x0, 0x81c0, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000) 346.794344ms ago: executing program 2 (id=5513): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0xca200) ioctl$DVB_DEMUX_DMX_SET_FILTER(r0, 0x403c6f2b, &(0x7f0000001e40)={0xe9c, {"0d06d96fff2900", "3dfa7700", "0000ff4a70f300"}, 0x4000c, 0x4}) preadv(r0, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xd) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000100)=0xe256) 219.638293ms ago: executing program 7 (id=5514): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x9, 0x1, 0x56d, 0x4, 0x42, 0xffffffffffffffff, 0x1000}, 0x50) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600), &(0x7f0000001f80), 0xfffffffb, r0}, 0x38) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000200), &(0x7f00000004c0), 0x1000, r0}, 0x38) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000180)={r0}, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@bloom_filter={0x1e, 0x9, 0x100, 0x8, 0x48, 0xffffffffffffffff, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x3, 0x3, 0x6}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000f00)={&(0x7f0000000d80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x2, [@struct={0x2, 0x2, 0x0, 0x4, 0x0, 0x9, [{0x3, 0x5, 0x9}, {0x5, 0x2, 0xaa0}]}, @fwd={0xa}]}}, &(0x7f0000000e00)=""/231, 0x4a, 0xe7, 0x0, 0x1}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000fc0)=@base={0x0, 0x1, 0x1, 0x101, 0x18204, r0, 0x5f4e, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000010c0)={0x6, 0x0, 0x0, &(0x7f0000000a40)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, 0x25, r1, 0x8, &(0x7f0000000f40)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000f80)={0x1, 0x7, 0x101}, 0x10, 0x0, 0x0, 0x2, 0x0, &(0x7f0000001080)=[{0x5, 0x1, 0xc, 0x3}, {0x0, 0x5, 0x2, 0x5}], 0x10, 0x1}, 0x94) 0s ago: executing program 7 (id=5515): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000380)={0xa, 0x4e21, 0x3, @loopback, 0x400014}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x10000008ebc, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) kernel console output (not intermixed with test programs): ntered promiscuous mode [ 478.232173][T17620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 478.251896][T17620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 478.316803][T17620] team0: Port device team_slave_0 added [ 478.325923][T17620] team0: Port device team_slave_1 added [ 478.349350][T17620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 478.358032][T17620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 478.386529][T17620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 478.400612][T17620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 478.408121][T17620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 478.434491][T17620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 478.482512][T17620] hsr_slave_0: entered promiscuous mode [ 478.489280][T17620] hsr_slave_1: entered promiscuous mode [ 478.495843][T17620] debugfs: 'hsr0' already exists in 'hsr' [ 478.501655][T17620] Cannot create hsr debugfs directory [ 478.748597][T17620] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 478.767816][T17620] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 478.775909][T17620] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 478.790161][T17620] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 478.800844][T17620] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 478.810851][T17620] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 478.819217][T17620] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 478.836446][T17620] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 478.969540][T17620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 478.990839][T17620] 8021q: adding VLAN 0 to HW filter on device team0 [ 479.004386][T10522] bridge0: port 1(bridge_slave_0) entered blocking state [ 479.011495][T10522] bridge0: port 1(bridge_slave_0) entered forwarding state [ 479.027344][ T1004] bridge0: port 2(bridge_slave_1) entered blocking state [ 479.034567][ T1004] bridge0: port 2(bridge_slave_1) entered forwarding state [ 479.433918][ T4928] Bluetooth: hci4: command tx timeout [ 479.482528][T17620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 479.725606][T17620] veth0_vlan: entered promiscuous mode [ 479.741837][T17620] veth1_vlan: entered promiscuous mode [ 479.781082][T17620] veth0_macvtap: entered promiscuous mode [ 479.795049][T17620] veth1_macvtap: entered promiscuous mode [ 479.842434][T17620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 479.861162][T17620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 479.874324][ T30] audit: type=1400 audit(1785221778.855:1158): avc: denied { getopt } for pid=17705 comm="syz.3.4479" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 479.895621][T10326] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.931854][ T57] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.948797][ T57] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.986638][ T57] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.084598][ T1004] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 480.106921][ T1004] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 480.183501][ T1004] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 480.192450][ T1004] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 480.309954][T17716] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4456'. [ 480.417844][T17722] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4484'. [ 481.513425][ T4928] Bluetooth: hci4: command tx timeout [ 481.715308][T17769] 9p: Bad value for 'wfdno' [ 481.846471][T17775] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4505'. [ 482.085882][T17788] netlink: 'syz.0.4508': attribute type 1 has an invalid length. [ 482.177130][T17788] bond5: entered promiscuous mode [ 482.202517][T17788] 8021q: adding VLAN 0 to HW filter on device bond5 [ 482.237457][T17797] bond5: (slave bridge3): making interface the new active one [ 482.246442][T17797] bridge3: entered promiscuous mode [ 482.254560][T17797] bond5: (slave bridge3): Enslaving as an active interface with an up link [ 482.678189][T17814] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4518'. [ 482.711433][T17814] bond6: peer notification delay (2365) is not a multiple of miimon (20), value rounded to 2360 ms [ 482.737463][T17814] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4518'. [ 482.747351][T17814] bond6: peer notification delay (2365) is not a multiple of miimon (20), value rounded to 2360 ms [ 483.019710][T17824] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 483.043470][T17824] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 483.343628][T17838] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4527'. [ 483.371344][T17838] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4527'. [ 483.457873][T17842] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 483.562022][T17850] netlink: 24 bytes leftover after parsing attributes in process `syz.8.4533'. [ 483.593266][ T4928] Bluetooth: hci4: command tx timeout [ 483.666063][T17855] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4536'. [ 484.278769][T17873] gretap1: entered promiscuous mode [ 484.309249][T17875] netlink: 2028 bytes leftover after parsing attributes in process `syz.5.4542'. [ 484.320695][T17873] netlink: 'syz.8.4543': attribute type 10 has an invalid length. [ 484.333511][T17873] bond0: option actor_port_prio: mode dependency failed, not supported in mode balance-rr(0) [ 484.698724][T17887] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 484.708870][T17887] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 484.742622][ T30] audit: type=1400 audit(1785221783.715:1159): avc: denied { mount } for pid=17888 comm="syz.6.4548" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 484.794386][ T30] audit: type=1400 audit(1785221783.775:1160): avc: denied { unmount } for pid=9487 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 484.909880][ T30] audit: type=1400 audit(1785221783.885:1161): avc: denied { mounton } for pid=17890 comm="syz.6.4550" path="/665/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 484.940210][ T30] audit: type=1400 audit(1785221783.915:1162): avc: denied { module_load } for pid=17892 comm="syz.8.4551" path="/sys/kernel/address_bits" dev="sysfs" ino=11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=system permissive=1 [ 485.296223][T17911] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 485.334571][T17911] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 485.443890][T17916] type: 32657 invalid [ 485.672844][ T4928] Bluetooth: hci4: command tx timeout [ 486.759210][T17943] tipc: Failed to remove unknown binding: 66,1,1/2099199:4035981542/4035981544 [ 486.897538][T17950] syzkaller1: entered promiscuous mode [ 486.910994][T17950] syzkaller1: entered allmulticast mode [ 487.118793][ T30] audit: type=1400 audit(1785221786.095:1163): avc: denied { ioctl } for pid=17966 comm="syz.0.4582" path="socket:[76277]" dev="sockfs" ino=76277 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 487.151407][T17967] __nla_validate_parse: 2 callbacks suppressed [ 487.151442][T17967] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4582'. [ 487.181810][T17967] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 487.556997][ T30] audit: type=1400 audit(1785221786.535:1164): avc: denied { create } for pid=17992 comm="syz.3.4592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 487.941873][T18007] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4598'. [ 487.967201][T18010] netlink: 156 bytes leftover after parsing attributes in process `syz.6.4594'. [ 488.039441][T18014] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4594'. [ 488.083914][ T30] audit: type=1400 audit(1785221787.065:1165): avc: denied { create } for pid=18015 comm="syz.0.4600" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 488.117887][ T30] audit: type=1400 audit(1785221787.095:1166): avc: denied { write } for pid=18015 comm="syz.0.4600" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 488.158156][ T30] audit: type=1400 audit(1785221787.095:1167): avc: denied { nlmsg_write } for pid=18015 comm="syz.0.4600" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 489.519205][T10337] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.715051][ T5622] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 489.737224][ T5622] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 489.747531][ T5622] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 489.768506][ T5622] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 489.782124][ T5622] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 489.789916][T18053] bond4: entered allmulticast mode [ 489.889347][T18051] bond4: left allmulticast mode [ 490.028477][T10337] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 490.118978][ T30] audit: type=1400 audit(1785221789.095:1168): avc: denied { read } for pid=18067 comm="syz.5.4619" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 490.185666][ T30] audit: type=1400 audit(1785221789.095:1169): avc: denied { open } for pid=18067 comm="syz.5.4619" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 490.224763][ T30] audit: type=1400 audit(1785221789.135:1170): avc: denied { ioctl } for pid=18067 comm="syz.5.4619" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 490.405106][T10337] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 490.565501][T10337] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 490.594035][T18082] syz_tun: entered allmulticast mode [ 490.628821][T18080] syz_tun: left allmulticast mode [ 490.988207][T18101] fuse: Bad value for 'fd' [ 491.059506][T10337] bridge_slave_1: left allmulticast mode [ 491.068953][T10337] bridge_slave_1: left promiscuous mode [ 491.077774][T10337] bridge0: port 2(bridge_slave_1) entered disabled state [ 491.116544][T10337] bridge_slave_0: left allmulticast mode [ 491.129492][T10337] bridge_slave_0: left promiscuous mode [ 491.138742][T10337] bridge0: port 1(bridge_slave_0) entered disabled state [ 491.398514][ T30] audit: type=1400 audit(1785221790.365:1171): avc: denied { write } for pid=18103 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 491.498996][ T30] audit: type=1400 audit(1785221790.475:1172): avc: denied { write } for pid=18124 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 491.610306][T10337] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 491.686869][T10337] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 491.697510][T10337] bond0 (unregistering): Released all slaves [ 491.711832][T18050] bridge0: port 1(bridge_slave_0) entered blocking state [ 491.725161][T18050] bridge0: port 1(bridge_slave_0) entered disabled state [ 491.736821][T18133] netlink: 14 bytes leftover after parsing attributes in process `syz.0.4635'. [ 491.743635][T18050] bridge_slave_0: entered allmulticast mode [ 491.774369][T18050] bridge_slave_0: entered promiscuous mode [ 491.781957][T18050] bridge0: port 2(bridge_slave_1) entered blocking state [ 491.794142][T18050] bridge0: port 2(bridge_slave_1) entered disabled state [ 491.812932][T18050] bridge_slave_1: entered allmulticast mode [ 491.825049][T18050] bridge_slave_1: entered promiscuous mode [ 491.847981][ T5273] 8021q: adding VLAN 0 to HW filter on device eth5 [ 491.865127][T18130] vlan2: entered allmulticast mode [ 491.870341][T18130] bond0: entered allmulticast mode [ 491.875619][T18130] bond_slave_0: entered allmulticast mode [ 491.882894][T18130] bond_slave_1: entered allmulticast mode [ 491.890133][T18130] bridge0: entered allmulticast mode [ 491.912810][ T4928] Bluetooth: hci4: command tx timeout [ 492.029843][T18137] xt_hashlimit: size too large, truncated to 1048576 [ 492.049737][T18133] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 492.148639][T18133] bond_slave_0: left allmulticast mode [ 492.159523][T18133] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 492.184396][T18133] bond_slave_1: left allmulticast mode [ 492.209734][T18133] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 492.219793][T18133] bridge0: left allmulticast mode [ 492.226210][T18133] bond0 (unregistering): Released all slaves [ 492.420761][T18050] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 492.471192][T18050] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 492.637866][T18050] team0: Port device team_slave_0 added [ 492.654140][T18050] team0: Port device team_slave_1 added [ 492.735644][T18050] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 492.756329][T18050] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 492.802776][T18050] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 492.935943][ T30] audit: type=1400 audit(1785221791.915:1173): avc: denied { write } for pid=18150 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 493.071092][ T30] audit: type=1400 audit(1785221792.035:1174): avc: denied { write } for pid=18168 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 493.174538][T10337] hsr_slave_0: left promiscuous mode [ 493.341642][T10337] hsr_slave_1: left promiscuous mode [ 493.354494][T10337] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 493.377911][T10337] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 493.400491][T10337] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 493.417896][T10337] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 493.511052][T10337] veth1_macvtap: left promiscuous mode [ 493.518508][T10337] veth0_macvtap: left promiscuous mode [ 493.525638][T10337] veth1_vlan: left promiscuous mode [ 493.531041][T10337] veth0_vlan: left promiscuous mode [ 493.962340][T10337] team0 (unregistering): Port device team_slave_1 removed [ 493.984720][T10337] team0 (unregistering): Port device team_slave_0 removed [ 493.994032][ T4928] Bluetooth: hci4: command tx timeout [ 494.220973][T18050] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 494.241003][T18050] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 494.267737][T18050] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 494.308455][ T5273] 8021q: adding VLAN 0 to HW filter on device eth6 [ 494.397708][T18050] hsr_slave_0: entered promiscuous mode [ 494.404966][T18050] hsr_slave_1: entered promiscuous mode [ 494.411271][T18050] debugfs: 'hsr0' already exists in 'hsr' [ 494.418596][T18050] Cannot create hsr debugfs directory [ 494.947375][ T30] audit: type=1400 audit(1785221793.925:1175): avc: denied { write } for pid=18187 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 495.054378][T18050] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 495.094727][ T30] audit: type=1400 audit(1785221794.075:1176): avc: denied { write } for pid=18198 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 495.099227][T18050] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 495.128020][T18050] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 495.138220][T18050] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 495.148962][T18050] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 495.165015][T18050] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 495.173867][T18050] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 495.184076][T18050] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 495.202585][ T5273] 8021q: adding VLAN 0 to HW filter on device eth7 [ 495.301991][T18050] 8021q: adding VLAN 0 to HW filter on device bond0 [ 495.331488][T18050] 8021q: adding VLAN 0 to HW filter on device team0 [ 495.349545][ T6451] bridge0: port 1(bridge_slave_0) entered blocking state [ 495.356777][ T6451] bridge0: port 1(bridge_slave_0) entered forwarding state [ 495.393554][ T6447] bridge0: port 2(bridge_slave_1) entered blocking state [ 495.400752][ T6447] bridge0: port 2(bridge_slave_1) entered forwarding state [ 495.738634][ T30] audit: type=1400 audit(1785221794.715:1177): avc: denied { write } for pid=18207 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 495.846734][ T30] audit: type=1400 audit(1785221794.825:1178): avc: denied { write } for pid=18224 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 495.914233][ T6447] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 495.926746][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 495.941733][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 495.998311][ T5273] 8021q: adding VLAN 0 to HW filter on device eth8 [ 496.030861][T18050] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 496.072962][ T4928] Bluetooth: hci4: command tx timeout [ 496.359283][T18050] veth0_vlan: entered promiscuous mode [ 496.387588][T18050] veth1_vlan: entered promiscuous mode [ 496.445569][T18249] netlink: 14 bytes leftover after parsing attributes in process `syz.5.4648'. [ 496.463402][T18245] vlan2: entered allmulticast mode [ 496.492752][T18245] bond0: entered allmulticast mode [ 496.527846][T18245] bond_slave_0: entered allmulticast mode [ 496.536987][T18245] bond_slave_1: entered allmulticast mode [ 496.543563][T18245] bridge0: entered allmulticast mode [ 496.671141][T18251] netlink: 'syz.0.4650': attribute type 1 has an invalid length. [ 496.738899][T18249] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 496.749464][T18249] bond_slave_0: left allmulticast mode [ 496.767579][T18249] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 496.779718][T18249] bond_slave_1: left allmulticast mode [ 496.797575][T18249] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 496.813169][T18249] bridge0: left allmulticast mode [ 496.835489][T18249] bond0 (unregistering): Released all slaves [ 496.914258][T18259] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4653'. [ 496.936871][T18251] 8021q: adding VLAN 0 to HW filter on device bond0 [ 496.970953][T18255] bond0: (slave syz_tun): Enslaving as a backup interface with an up link [ 497.122195][T18050] veth0_macvtap: entered promiscuous mode [ 497.134804][T18050] veth1_macvtap: entered promiscuous mode [ 497.164479][T18266] fuse: Bad value for 'fd' [ 497.170092][T18050] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 497.201458][T18050] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 497.211252][T18267] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 497.224665][T18267] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 497.238224][ T6447] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.262796][ T6447] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.286769][ T6447] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.300824][ T6447] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.318610][T18271] fuse: Bad value for 'fd' [ 497.475611][T18274] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4660'. [ 497.491011][T10337] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 497.501039][T10337] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 497.550552][ T6451] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 497.572177][ T6451] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 497.574427][ T30] audit: type=1400 audit(1785221796.555:1179): avc: denied { ioctl } for pid=18276 comm="syz.6.4662" path="socket:[78278]" dev="sockfs" ino=78278 ioctlcmd=0x890c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 497.625941][T18279] netlink: 9 bytes leftover after parsing attributes in process `syz.5.4661'. [ 497.637249][T18279] netlink: 9 bytes leftover after parsing attributes in process `syz.5.4661'. [ 497.958796][T18296] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 497.969524][T18296] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 498.162901][ T4928] Bluetooth: hci4: command tx timeout [ 499.476258][ T5721] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 499.695451][ T5721] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 499.727115][ T5721] usb 6-1: config 0 has no interfaces? [ 499.749383][ T5721] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 499.769685][ T5721] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 499.779269][ T5721] usb 6-1: Product: syz [ 499.785480][ T5721] usb 6-1: Manufacturer: syz [ 499.796038][ T5721] usb 6-1: config 0 descriptor?? [ 499.971665][T18335] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 500.005750][T18335] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 500.135056][ T30] audit: type=1400 audit(1785221799.115:1180): avc: denied { write } for pid=18342 comm="syz.9.4686" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 500.296388][ T5721] usb 6-1: USB disconnect, device number 43 [ 502.483135][ T5721] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 502.511224][T18386] fuse: Bad value for 'fd' [ 502.647064][ T5721] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 502.678792][ T5721] usb 10-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 502.716855][ T5721] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 502.758080][ T5721] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 502.812887][ T5721] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 502.841290][ T5721] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 502.861155][ T5721] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 502.892725][ T5721] usb 10-1: Product: syz [ 502.897072][ T5721] usb 10-1: Manufacturer: syz [ 502.921740][ T5721] cdc_wdm 10-1:1.0: skipping garbage [ 502.948561][ T5721] cdc_wdm 10-1:1.0: skipping garbage [ 502.982533][ T5721] cdc_wdm 10-1:1.0: cdc-wdm0: USB WDM device [ 502.994647][ T5721] cdc_wdm 10-1:1.0: Unknown control protocol [ 503.041679][T18397] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4702'. [ 503.106925][T18397] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4702'. [ 503.215446][T17118] usb 10-1: USB disconnect, device number 2 [ 503.588177][T18410] vlan0: entered allmulticast mode [ 503.595344][T18410] bond0: entered allmulticast mode [ 503.600626][T18410] bond_slave_0: entered allmulticast mode [ 503.669331][T18411] netlink: 14 bytes leftover after parsing attributes in process `syz.6.4709'. [ 503.712219][T18410] bond_slave_1: entered allmulticast mode [ 504.592436][T18411] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 504.644532][T18411] bond_slave_0: left allmulticast mode [ 504.687735][T18411] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 504.980364][T18411] bond_slave_1: left allmulticast mode [ 505.038281][T18411] bond0 (unregistering): Released all slaves [ 505.063850][ T30] audit: type=1400 audit(1785221804.045:1181): avc: denied { node_bind } for pid=18430 comm="syz.9.4716" saddr=127.0.0.1 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 505.218425][T18440] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 505.527920][T18452] hub 1-0:1.0: USB hub found [ 505.551674][T18452] hub 1-0:1.0: 1 port detected [ 505.913831][ T30] audit: type=1400 audit(1785221804.895:1182): avc: denied { ioctl } for pid=18468 comm="syz.9.4731" path="/22/file0/file0" dev="fuse" ino=288230376151711744 ioctlcmd=0x70ce scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 505.940356][T18469] sd 0:0:1:0: PR command failed: 1026 [ 505.958573][T18469] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 505.979157][T18469] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 507.037081][ T30] audit: type=1400 audit(1785221806.015:1183): avc: denied { write } for pid=18481 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 507.050411][T18495] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4737'. [ 507.210654][ T30] audit: type=1400 audit(1785221806.185:1184): avc: denied { write } for pid=18508 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 507.315484][T18495] bond0: entered promiscuous mode [ 507.320995][T18495] 8021q: adding VLAN 0 to HW filter on device bond0 [ 507.604592][T18530] overlayfs: failed to clone upperpath [ 507.890796][ T30] audit: type=1400 audit(1785221806.865:1185): avc: denied { write } for pid=18521 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 508.148941][ T30] audit: type=1400 audit(1785221807.125:1186): avc: denied { write } for pid=18544 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 508.319039][ T30] audit: type=1400 audit(1785221807.295:1187): avc: denied { sys_admin } for pid=18549 comm="syz.3.4751" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 508.442823][T17118] usb 6-1: new low-speed USB device number 44 using dummy_hcd [ 508.625662][T17118] usb 6-1: config 0 has no interfaces? [ 508.668648][T17118] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 508.700960][T17118] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.733638][ T30] audit: type=1400 audit(1785221807.705:1188): avc: denied { write } for pid=18555 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 508.779684][T17118] usb 6-1: config 0 descriptor?? [ 508.969995][ T30] audit: type=1400 audit(1785221808.952:1189): avc: denied { write } for pid=18582 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 509.171007][T17118] usb 6-1: USB disconnect, device number 44 [ 509.230895][T18600] tunl0: left promiscuous mode [ 509.255612][T18600] gre0: left promiscuous mode [ 509.313229][T18600] gretap0: left promiscuous mode [ 509.339751][T18600] erspan0: left promiscuous mode [ 509.356592][ T30] audit: type=1326 audit(1785221809.342:1190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18604 comm="syz.9.4765" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0203b9de99 code=0x0 [ 509.359291][T18600] ip6_vti0: left promiscuous mode [ 509.439291][T18600] sit0: left promiscuous mode [ 509.469616][T18600] ip6tnl0: left promiscuous mode [ 509.484960][T18600] ip6gre0: left promiscuous mode [ 509.498401][T18600] tipc: Resetting bearer [ 509.516177][T18600] syz_tun: left promiscuous mode [ 509.552808][T18600] ip6gretap0: left promiscuous mode [ 509.580864][T18600] bridge0: left promiscuous mode [ 509.599982][T18600] team0: left promiscuous mode [ 509.619859][T18600] batman_adv: batadv0: Interface deactivated: dummy0 [ 509.697766][T18600] nlmon0: left promiscuous mode [ 509.709244][T18600] batadv0: left promiscuous mode [ 509.719720][T18617] ceph: No mds server is up or the cluster is laggy [ 509.725903][T18600] vxcan0: left promiscuous mode [ 509.739755][T18600] vxcan1: left promiscuous mode [ 509.759042][T17146] libceph: connect (1)[c::]:6789 error -101 [ 509.766567][T18600] veth0: left promiscuous mode [ 509.771645][T17146] libceph: mon0 (1)[c::]:6789 connect error [ 509.793135][T18600] veth1: left promiscuous mode [ 509.821624][T18600] wg0: left promiscuous mode [ 509.838716][T18600] wg1: left promiscuous mode [ 509.875636][T18600] wg2: left promiscuous mode [ 509.916093][T18600] veth0_to_bridge: left promiscuous mode [ 509.951250][T18600] veth1_to_bridge: left promiscuous mode [ 510.004190][T18600] bond_slave_0: left promiscuous mode [ 510.024600][T18600] veth1_to_bond: left promiscuous mode [ 510.044162][T18600] bond_slave_1: left promiscuous mode [ 510.068233][T18600] veth0_to_team: left promiscuous mode [ 510.093224][T18600] team_slave_0: left promiscuous mode [ 510.122193][T18600] veth1_to_team: left promiscuous mode [ 510.143909][T18600] team_slave_1: left promiscuous mode [ 510.150708][T18600] veth0_to_batadv: left promiscuous mode [ 510.174865][T18600] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 510.193622][T18600] batadv_slave_0: left promiscuous mode [ 510.204906][T18600] veth1_to_batadv: left promiscuous mode [ 510.224672][T18600] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 510.232156][T18600] batadv_slave_1: left promiscuous mode [ 510.255001][T18600] xfrm0: left promiscuous mode [ 510.261663][T18600] veth0_to_hsr: left promiscuous mode [ 510.282601][T18600] veth1_to_hsr: left promiscuous mode [ 510.321809][T18600] veth1_virt_wifi: left promiscuous mode [ 510.330508][T18600] veth0_virt_wifi: left promiscuous mode [ 510.339655][T18600] virt_wifi0: left promiscuous mode [ 510.355574][T18600] macvtap0: left promiscuous mode [ 510.363787][T18600] macsec0: left promiscuous mode [ 510.371077][T18600] geneve0: left promiscuous mode [ 510.412497][T18600] geneve1: left promiscuous mode [ 510.446404][T18600] mac80211_hwsim hwsim6 wlan0: left promiscuous mode [ 510.473218][T18600] hsr0.1: left promiscuous mode [ 510.478309][T18600] hsr0: left promiscuous mode [ 510.504572][T18600] netdevsim netdevsim3 eth0: left promiscuous mode [ 510.528747][T18600] netdevsim netdevsim3 eth1: left promiscuous mode [ 510.580138][T18600] netdevsim netdevsim3 eth2: left promiscuous mode [ 510.621175][T18600] netdevsim netdevsim3 eth3: left promiscuous mode [ 510.650295][T18600] sit1: left promiscuous mode [ 510.686019][T18600] ip6gre1: left promiscuous mode [ 510.788177][T18600] ip6erspan0: left promiscuous mode [ 510.796634][T18600] bond0: left promiscuous mode [ 510.803317][T18600] lo: left promiscuous mode [ 510.815860][T18600] gtp0: left promiscuous mode [ 510.845686][T18600] bond1: left promiscuous mode [ 510.856600][T18600] ip6tnl1: left promiscuous mode [ 510.865168][T18600] bridge1: left promiscuous mode [ 510.874727][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 510.874744][ T30] audit: type=1400 audit(1785221810.862:1193): avc: denied { listen } for pid=18628 comm="syz.0.4769" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 510.894984][T18584] uprobe: syz.6.4760:18584 failed to unregister, leaking uprobe [ 510.917164][T18629] netlink: 'syz.0.4769': attribute type 2 has an invalid length. [ 510.917528][T18600] bond2: left promiscuous mode [ 510.927198][ T30] audit: type=1400 audit(1785221810.912:1194): avc: denied { connect } for pid=18628 comm="syz.0.4769" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 510.933869][T18600] ipip0: left promiscuous mode [ 510.966390][ T30] audit: type=1400 audit(1785221810.952:1195): avc: denied { accept } for pid=18628 comm="syz.0.4769" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 510.991886][T18600] bond3: left promiscuous mode [ 510.998988][T18600] erspan1: left promiscuous mode [ 511.023659][T18600] bridge2: left promiscuous mode [ 511.041266][T17941] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 511.058808][T17941] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.067713][T17941] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 511.077511][T17941] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.091668][T17941] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 511.146694][T17941] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.166377][T17941] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 511.178261][T17941] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.226945][T18655] xt_hashlimit: size too large, truncated to 1048576 [ 512.318959][T18663] fuse: Bad value for 'fd' [ 512.890084][T18675] overlayfs: failed to clone lowerpath [ 512.918626][T18675] overlayfs: failed to clone lowerpath [ 513.222145][ T30] audit: type=1400 audit(1785221813.202:1196): avc: denied { append } for pid=18686 comm="syz.0.4791" name="mice" dev="devtmpfs" ino=917 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 513.294091][T18693] fuse: Bad value for 'fd' [ 513.386910][ T30] audit: type=1400 audit(1785221813.372:1197): avc: denied { write } for pid=18696 comm="syz.6.4795" name="usb_gadget" dev="configfs" ino=139 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 513.419727][ T30] audit: type=1400 audit(1785221813.392:1198): avc: denied { write } for pid=18696 comm="syz.6.4795" name="functions" dev="configfs" ino=79692 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 513.451730][ T30] audit: type=1400 audit(1785221813.432:1199): avc: denied { write } for pid=18696 comm="syz.6.4795" name="configs" dev="configfs" ino=79693 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 513.478060][ T30] audit: type=1400 audit(1785221813.442:1200): avc: denied { write } for pid=18696 comm="syz.6.4795" name="c.1" dev="configfs" ino=80471 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 513.516474][ T30] audit: type=1400 audit(1785221813.442:1201): avc: denied { write } for pid=18696 comm="syz.6.4795" name="c.1" dev="configfs" ino=80471 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 513.765295][ T30] audit: type=1400 audit(1785221813.752:1202): avc: denied { mount } for pid=18711 comm="syz.6.4801" name="/" dev="ramfs" ino=80505 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 514.577003][T17121] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 514.723312][T18744] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4814'. [ 514.734327][T17121] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 514.757799][T17121] usb 10-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 514.781083][T17121] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 514.807411][T17121] usb 10-1: config 0 descriptor?? [ 514.895959][T18748] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4816'. [ 514.940735][T18748] netlink: 'syz.3.4816': attribute type 1 has an invalid length. [ 515.032071][T17121] usbhid 10-1:0.0: can't add hid device: -71 [ 515.047914][T17121] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 515.081446][T17121] usb 10-1: USB disconnect, device number 3 [ 515.390498][T18757] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 515.402213][T18757] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 515.421838][T18757] overlayfs: inode number too big (/, ino=4611686018427387905, xinobits=3) [ 515.431130][T18757] ovl_remap_lower_ino: 8 callbacks suppressed [ 515.431148][T18757] overlayfs: d_ino too big (., ino=4611686018427387926, xinobits=3) [ 515.446885][T18757] overlayfs: d_ino too big (gadget, ino=4611686018427391557, xinobits=3) [ 515.458992][T18757] overlayfs: d_ino too big (snd_seq, ino=4611686018427391748, xinobits=3) [ 515.468744][T18757] overlayfs: d_ino too big (netdevsim, ino=4611686018427412845, xinobits=3) [ 515.479992][T18757] overlayfs: d_ino too big (serio, ino=4611686018427391574, xinobits=3) [ 515.489317][T18757] overlayfs: d_ino too big (ulpi, ino=4611686018427391511, xinobits=3) [ 515.499217][T18757] overlayfs: d_ino too big (coreboot, ino=4611686018427391660, xinobits=3) [ 515.508111][T18757] overlayfs: d_ino too big (hdaudio, ino=4611686018427391754, xinobits=3) [ 515.517857][T18757] overlayfs: d_ino too big (iio, ino=4611686018427391690, xinobits=3) [ 515.528862][T18757] overlayfs: d_ino too big (firewire, ino=4611686018427412859, xinobits=3) [ 515.537691][T17145] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 515.695184][T17145] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 515.706544][T17145] usb 10-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 515.722752][T17145] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 515.744968][T17145] usb 10-1: config 0 descriptor?? [ 515.790719][T18765] fuse: Bad value for 'fd' [ 516.149257][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 516.149274][ T30] audit: type=1400 audit(1785221816.132:1205): avc: denied { recv } for pid=5611 comm="syz-executor" saddr=10.128.0.169 src=30006 daddr=10.128.0.90 dest=59102 netif=eth0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 516.161391][T18734] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 516.203849][T18734] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 516.361039][T18776] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4828'. [ 516.653986][T17145] aiptek 10-1:0.0: Aiptek using 400 ms programming speed [ 516.678718][T17145] input: Aiptek as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/input/input64 [ 517.098853][T18622] usb 10-1: USB disconnect, device number 4 [ 517.098935][ C0] aiptek 10-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 517.358859][ T4928] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 517.371174][ T4928] Bluetooth: hci4: Injecting HCI hardware error event [ 517.382251][ T4928] Bluetooth: hci4: hardware error 0x00 [ 519.077052][ T30] audit: type=1400 audit(1785221819.052:1206): avc: denied { egress } for pid=18622 comm="kworker/1:15" saddr=fe80::1c daddr=ff02::16 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:netif_t tclass=netif permissive=1 [ 519.145303][ T30] audit: type=1400 audit(1785221819.052:1207): avc: denied { sendto } for pid=18622 comm="kworker/1:15" saddr=fe80::1c daddr=ff02::16 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:node_t tclass=node permissive=1 [ 519.342350][T18824] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4845'. [ 519.517121][ T4928] Bluetooth: hci4: Opcode 0x0c03 failed: -110 ~r&Λ[ 520.421348][ T30] audit: type=1400 audit(1785221820.402:1208): avc: denied { ioctl } for pid=18852 comm="syz.5.4850" path="/705/file0/file0" dev="fuse" ino=67 ioctlcmd=0x5415 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 520.915244][ T30] audit: type=1400 audit(1785221820.902:1209): avc: denied { create } for pid=18863 comm="syz.3.4859" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 520.945487][ T30] audit: type=1400 audit(1785221820.922:1210): avc: denied { connect } for pid=18863 comm="syz.3.4859" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 520.981527][ T30] audit: type=1400 audit(1785221820.922:1211): avc: denied { setopt } for pid=18863 comm="syz.3.4859" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 521.064222][T18868] fuse: Bad value for 'fd' [ 522.788729][T18890] overlayfs: failed to clone upperpath [ 522.969218][T18905] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=18905 comm=syz.9.4875 [ 523.003137][T18905] netlink: 'syz.9.4875': attribute type 1 has an invalid length. [ 523.080731][T18909] bond1: (slave gretap1): making interface the new active one [ 523.104384][T18909] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 523.172764][T17121] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 524.226747][T17121] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 524.238441][T17121] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 524.249747][T17121] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 524.264378][T17121] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 524.282559][T17121] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 524.310633][T17121] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 524.335306][T17121] usb 6-1: config 0 descriptor?? [ 524.417545][ T30] audit: type=1400 audit(1785221824.402:1212): avc: denied { append } for pid=18921 comm="syz.0.4892" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 524.898007][T17121] plantronics 0003:047F:FFFF.0037: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 525.180333][T18935] netlink: 24 bytes leftover after parsing attributes in process `syz.9.4887'. [ 525.923310][T18622] usb 6-1: USB disconnect, device number 45 [ 526.347013][T18956] netlink: 'syz.9.4896': attribute type 4 has an invalid length. [ 526.385528][T18956] netlink: 'syz.9.4896': attribute type 4 has an invalid length. [ 526.430808][T18956] lo: entered promiscuous mode [ 526.444257][T18956] tunl0: entered promiscuous mode [ 526.451480][T18956] gre0: entered promiscuous mode [ 526.481964][T18956] gretap0: entered promiscuous mode [ 526.497928][T18956] erspan0: entered promiscuous mode [ 526.513722][T18956] ip_vti0: entered promiscuous mode [ 526.524875][T18956] ip6_vti0: entered promiscuous mode [ 526.542558][T18956] sit0: entered promiscuous mode [ 526.554049][T18956] ip6tnl0: entered promiscuous mode [ 526.564656][T18956] ip6gre0: entered promiscuous mode [ 526.582448][T18956] syz_tun: entered promiscuous mode [ 526.654327][T18956] ip6gretap0: entered promiscuous mode [ 526.670265][T18956] bridge0: port 2(bridge_slave_1) entered disabled state [ 526.677924][T18956] bridge0: port 1(bridge_slave_0) entered disabled state [ 526.694557][T18956] bridge0: entered promiscuous mode [ 526.708178][T18956] vcan0: entered promiscuous mode [ 526.731498][T18956] bond0: entered promiscuous mode [ 526.741174][T18956] bond_slave_0: entered promiscuous mode [ 526.750434][T18956] bond_slave_1: entered promiscuous mode [ 526.763635][T18956] team0: entered promiscuous mode [ 526.772143][T18956] team_slave_0: entered promiscuous mode [ 526.781420][T18956] team_slave_1: entered promiscuous mode [ 526.794314][T18956] dummy0: entered promiscuous mode [ 526.813799][T18956] nlmon0: entered promiscuous mode [ 526.820766][T18956] batadv0: entered promiscuous mode [ 526.829021][T18956] vxcan0: entered promiscuous mode [ 526.835211][T18956] vxcan1: entered promiscuous mode [ 526.842197][T18956] veth0: entered promiscuous mode [ 526.851483][T18956] veth1: entered promiscuous mode [ 526.860207][T18956] wg0: entered promiscuous mode [ 526.877833][T18956] wg1: entered promiscuous mode [ 526.886477][T18956] wg2: entered promiscuous mode [ 526.895578][T18956] veth0_to_bridge: entered promiscuous mode [ 526.906941][T18956] veth1_to_bridge: entered promiscuous mode [ 526.918381][T18956] veth0_to_bond: entered promiscuous mode [ 526.929685][T18956] veth1_to_bond: entered promiscuous mode [ 526.941441][T18956] veth0_to_team: entered promiscuous mode [ 526.956566][T18956] veth1_to_team: entered promiscuous mode [ 526.967827][T18956] veth0_to_batadv: entered promiscuous mode [ 526.978675][T18956] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 526.987892][T18956] batadv_slave_0: entered promiscuous mode [ 526.996660][T18956] veth1_to_batadv: entered promiscuous mode [ 527.005984][T18956] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 527.014873][T18956] batadv_slave_1: entered promiscuous mode [ 527.023787][T18956] xfrm0: entered promiscuous mode [ 527.030957][T18956] veth0_to_hsr: entered promiscuous mode [ 527.041374][T18956] veth1_to_hsr: entered promiscuous mode [ 527.057136][T18956] hsr0: entered promiscuous mode [ 527.066251][T18956] veth1_virt_wifi: entered promiscuous mode [ 527.074782][T18956] veth0_virt_wifi: entered promiscuous mode [ 527.088625][T18956] virt_wifi0: entered promiscuous mode [ 527.101361][T18956] vlan0: entered promiscuous mode [ 527.110959][T18956] vlan1: entered promiscuous mode [ 527.123394][T18956] macvlan0: entered promiscuous mode [ 527.140430][T18956] macvlan1: entered promiscuous mode [ 527.149096][T18956] ipvlan0: entered promiscuous mode [ 527.156577][T18956] ipvlan1: entered promiscuous mode [ 527.188520][T18956] macvtap0: entered promiscuous mode [ 527.205522][T18956] macsec0: entered promiscuous mode [ 527.216801][T18956] geneve0: entered promiscuous mode [ 527.224737][T18956] geneve1: entered promiscuous mode [ 527.236047][T18956] netdevsim netdevsim9 netdevsim0: entered promiscuous mode [ 527.249863][T18956] netdevsim netdevsim9 netdevsim1: entered promiscuous mode [ 527.264648][T18956] netdevsim netdevsim9 netdevsim2: entered promiscuous mode [ 527.276962][T18956] netdevsim netdevsim9 netdevsim3: entered promiscuous mode [ 527.301549][T18956] mac80211_hwsim hwsim23 wlan0: entered promiscuous mode [ 527.321592][T18956] mac80211_hwsim hwsim24 wlan1: entered promiscuous mode [ 527.330842][T18956] bond1: entered promiscuous mode [ 527.336718][T18956] gretap1: entered promiscuous mode [ 527.351880][T18956] veth2: entered promiscuous mode [ 527.360176][T18956] veth3: entered promiscuous mode [ 527.373807][T17941] netdevsim netdevsim9 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.400256][T17941] netdevsim netdevsim9 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.428713][T17941] netdevsim netdevsim9 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.452764][T17941] netdevsim netdevsim9 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.467780][T18966] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 527.520094][T18966] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 527.577613][T18966] overlayfs: inode number too big (/, ino=4611686018427387905, xinobits=3) [ 527.599063][T18972] netlink: 44 bytes leftover after parsing attributes in process `syz.6.4901'. [ 527.606549][T18966] ovl_remap_lower_ino: 63 callbacks suppressed [ 527.606564][T18966] overlayfs: d_ino too big (., ino=4611686018427387926, xinobits=3) [ 527.615339][T18972] netlink: 'syz.6.4901': attribute type 8 has an invalid length. [ 527.672972][T18966] overlayfs: d_ino too big (gadget, ino=4611686018427391557, xinobits=3) [ 527.697530][T18966] overlayfs: d_ino too big (snd_seq, ino=4611686018427391748, xinobits=3) [ 527.713868][T18966] overlayfs: d_ino too big (netdevsim, ino=4611686018427412845, xinobits=3) [ 527.725704][T18966] overlayfs: d_ino too big (serio, ino=4611686018427391574, xinobits=3) [ 527.739057][T18966] overlayfs: d_ino too big (ulpi, ino=4611686018427391511, xinobits=3) [ 527.748097][T18966] overlayfs: d_ino too big (coreboot, ino=4611686018427391660, xinobits=3) [ 527.759381][T18966] overlayfs: d_ino too big (hdaudio, ino=4611686018427391754, xinobits=3) [ 527.768210][T18966] overlayfs: d_ino too big (iio, ino=4611686018427391690, xinobits=3) [ 527.777427][T18966] overlayfs: d_ino too big (firewire, ino=4611686018427412859, xinobits=3) [ 527.808872][T18976] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4903'. [ 527.837875][T18976] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4903'. [ 527.913897][T17941] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 528.001129][T18986] tipc: Cannot configure node identity twice [ 528.776977][T19016] loop5: detected capacity change from 0 to 7 [ 528.786928][T19016] Dev loop5: unable to read RDB block 7 [ 528.792559][T19016] loop5: AHDI p2 [ 528.796944][T19016] loop5: partition table partially beyond EOD, truncated [ 529.649274][T19030] binder: 19029:19030 ioctl c0306201 200000000640 returned -22 [ 529.747058][T19032] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3765145859 (60242333744 ns) > initial count (29576955120 ns). Using initial count to start timer. [ 529.965829][ T30] audit: type=1400 audit(1785221829.942:1213): avc: denied { write } for pid=19037 comm="syz.5.4927" name="uncompressed" dev="configfs" ino=54742 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 530.012730][ T30] audit: type=1400 audit(1785221829.952:1214): avc: denied { write } for pid=19037 comm="syz.5.4927" name="u" dev="configfs" ino=82306 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 531.070905][T18989] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 531.267092][T19055] io-wq is not configured for unbound workers [ 532.991712][T19079] netlink: 'syz.0.4944': attribute type 12 has an invalid length. [ 533.506189][T19085] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 533.529496][T19085] batman_adv: batadv0: Adding interface: gretap2 [ 533.544285][T19085] batman_adv: batadv0: The MTU of interface gretap2 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 533.578584][T19085] batman_adv: batadv0: Interface activated: gretap2 [ 533.638496][T19088] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 533.836268][T19093] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4950'. [ 535.336276][ T30] audit: type=1800 audit(1785221835.322:1215): pid=19114 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.9.4958" name="file1" dev="overlay" ino=485 res=0 errno=0 [ 538.115140][T19154] random: crng reseeded on system resumption [ 538.140223][T19152] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4966'. [ 538.174357][T19157] tunl0: left promiscuous mode [ 538.208157][T19157] gre0: left promiscuous mode [ 538.214073][T19157] gretap0: left promiscuous mode [ 538.220994][T19157] erspan0: left promiscuous mode [ 538.221604][ T30] audit: type=1326 audit(1785221838.202:1216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19150 comm="syz.6.4966" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f188bd9de99 code=0x7ffc0000 [ 538.235725][T19157] ip_vti0: left promiscuous mode [ 538.301496][ T30] audit: type=1326 audit(1785221838.202:1217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19150 comm="syz.6.4966" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f188bd9de99 code=0x7ffc0000 [ 538.367125][ T30] audit: type=1326 audit(1785221838.222:1218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19150 comm="syz.6.4966" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f188bd9de99 code=0x7ffc0000 [ 538.425733][ T30] audit: type=1326 audit(1785221838.272:1219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19150 comm="syz.6.4966" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f188bd9de99 code=0x7ffc0000 [ 538.434072][T19157] ip6_vti0: left promiscuous mode [ 538.477188][ T5622] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 538.479979][T19157] sit0: left promiscuous mode [ 538.496707][ T5622] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 538.510086][ T5622] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 538.517367][ T30] audit: type=1326 audit(1785221838.272:1220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19150 comm="syz.6.4966" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f188bd9de99 code=0x7ffc0000 [ 538.545704][ T30] audit: type=1326 audit(1785221838.412:1221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19150 comm="syz.6.4966" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f188bd9de99 code=0x7ffc0000 [ 538.574737][ T30] audit: type=1326 audit(1785221838.552:1222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19150 comm="syz.6.4966" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f188bd5e6ce code=0x7ffc0000 [ 538.575178][T19157] ip6tnl0: left promiscuous mode [ 538.601592][ T30] audit: type=1326 audit(1785221838.552:1223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19150 comm="syz.6.4966" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f188bd5e6ce code=0x7ffc0000 [ 538.608047][T19157] ip6gre0: left promiscuous mode [ 538.633184][ T5622] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 538.634864][ T30] audit: type=1326 audit(1785221838.562:1224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19150 comm="syz.6.4966" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f188bd5e6ce code=0x7ffc0000 [ 538.652977][T19157] syz_tun: left promiscuous mode [ 538.700236][ T5622] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 538.726219][T19157] ip6gretap0: left promiscuous mode [ 538.828934][T19157] bridge0: left promiscuous mode [ 538.843945][T19157] vcan0: left promiscuous mode [ 538.849947][T19157] team0: left promiscuous mode [ 538.856390][T19157] dummy0: left promiscuous mode [ 538.862278][T19157] nlmon0: left promiscuous mode [ 538.868584][T19157] batadv0: left promiscuous mode [ 538.874454][T19157] vxcan0: left promiscuous mode [ 538.881056][T19157] vxcan1: left promiscuous mode [ 538.890492][T19157] veth0: left promiscuous mode [ 538.896621][T19157] veth1: left promiscuous mode [ 538.902150][T19157] wg0: left promiscuous mode [ 538.907575][T19157] wg1: left promiscuous mode [ 538.913026][T19157] wg2: left promiscuous mode [ 538.918371][T19157] veth1_to_bridge: left promiscuous mode [ 538.925705][T19157] veth0_to_bond: left promiscuous mode [ 538.932135][T19157] bond_slave_0: left promiscuous mode [ 538.938903][T19157] veth1_to_bond: left promiscuous mode [ 538.945580][T19157] bond_slave_1: left promiscuous mode [ 538.952614][T19157] team_slave_0: left promiscuous mode [ 538.961376][T19157] veth1_to_team: left promiscuous mode [ 538.968210][T19157] team_slave_1: left promiscuous mode [ 538.977554][T19157] veth0_to_batadv: left promiscuous mode [ 539.026791][T19157] batadv_slave_0: left promiscuous mode [ 539.088175][T19157] veth1_to_batadv: left promiscuous mode [ 539.095019][T19157] batadv_slave_1: left promiscuous mode [ 539.101349][T19157] xfrm0: left promiscuous mode [ 539.108626][T19157] veth0_to_hsr: left promiscuous mode [ 539.123440][T19157] veth1_to_hsr: left promiscuous mode [ 539.130503][T19157] hsr0: left promiscuous mode [ 539.140184][T19157] veth1_virt_wifi: left promiscuous mode [ 539.147770][T19157] veth0_virt_wifi: left promiscuous mode [ 539.156174][T19157] virt_wifi0: left promiscuous mode [ 539.164608][T19157] vlan0: left promiscuous mode [ 539.171172][T19157] vlan1: left promiscuous mode [ 539.178250][T19157] macvlan0: left promiscuous mode [ 539.184480][T19157] macvlan1: left promiscuous mode [ 539.192014][T19157] ipvlan0: left promiscuous mode [ 539.199389][T19157] ipvlan1: left promiscuous mode [ 539.208605][T19157] macvtap0: left promiscuous mode [ 539.215933][T19157] macsec0: left promiscuous mode [ 539.221709][T19157] geneve0: left promiscuous mode [ 539.229006][T19157] geneve1: left promiscuous mode [ 539.236116][T19157] netdevsim netdevsim5 netdevsim0: left promiscuous mode [ 539.245209][T19157] netdevsim netdevsim5 netdevsim1: left promiscuous mode [ 539.254326][T19157] netdevsim netdevsim5 netdevsim2: left promiscuous mode [ 539.263851][T19157] netdevsim netdevsim5 netdevsim3: left promiscuous mode [ 539.274738][T19157] mac80211_hwsim hwsim14 wlan0: left promiscuous mode [ 539.284161][T19157] vxlan0: left promiscuous mode [ 539.301533][T19157] sit1: left promiscuous mode [ 539.363802][T19157] bridge1: left promiscuous mode [ 539.369637][T19157] ip6tnl1: left promiscuous mode [ 539.380078][T19157] gre1: left promiscuous mode [ 539.385757][T19157] bond1: left promiscuous mode [ 539.390694][T19157] lo: left promiscuous mode [ 539.398744][T19157] geneve2: left promiscuous mode [ 539.421307][T19157] sit2: left promiscuous mode [ 539.426999][T19157] ip6gretap1: left promiscuous mode [ 539.441448][T19157] macvlan2: left promiscuous mode [ 539.450965][T19157] bond0: left promiscuous mode [ 539.528939][ T8077] tipc: Disabling bearer [ 539.579794][T19178] netlink: 8 bytes leftover after parsing attributes in process `syz.9.4980'. [ 540.375473][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 540.375490][ T30] audit: type=1400 audit(1785221840.362:1232): avc: denied { mount } for pid=19206 comm="syz.9.4988" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 540.417033][T19207] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 540.450825][ T30] audit: type=1400 audit(1785221840.432:1233): avc: denied { unmount } for pid=18050 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 540.534110][T19165] bridge0: port 1(bridge_slave_0) entered blocking state [ 540.549764][T19165] bridge0: port 1(bridge_slave_0) entered disabled state [ 540.571495][T19165] bridge_slave_0: entered allmulticast mode [ 540.579799][T19165] bridge_slave_0: entered promiscuous mode [ 540.605977][T19165] bridge0: port 2(bridge_slave_1) entered blocking state [ 540.617785][T19165] bridge0: port 2(bridge_slave_1) entered disabled state [ 540.638027][T19165] bridge_slave_1: entered allmulticast mode [ 540.655376][T19165] bridge_slave_1: entered promiscuous mode [ 540.739259][T19165] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 540.757038][T19165] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 540.822422][T19165] team0: Port device team_slave_0 added [ 540.844079][T19165] team0: Port device team_slave_1 added [ 540.876073][ T4928] Bluetooth: hci6: command tx timeout [ 540.906758][T19165] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 540.914322][T19165] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 540.940706][T19165] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 540.953521][T19165] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 540.960540][T19165] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 540.986846][T19165] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 541.045023][T19165] hsr_slave_0: entered promiscuous mode [ 541.053856][T19165] hsr_slave_1: entered promiscuous mode [ 541.061798][T19165] debugfs: 'hsr0' already exists in 'hsr' [ 541.071275][T19165] Cannot create hsr debugfs directory [ 541.970496][ T30] audit: type=1400 audit(1785221841.952:1234): avc: denied { write } for pid=19218 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 542.248239][ T30] audit: type=1400 audit(1785221842.232:1235): avc: denied { write } for pid=19238 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 542.911298][ T30] audit: type=1400 audit(1785221842.892:1236): avc: denied { write } for pid=19248 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 542.967584][ T4928] Bluetooth: hci6: command tx timeout [ 543.203556][ T30] audit: type=1400 audit(1785221843.192:1237): avc: denied { write } for pid=19272 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 543.212183][T19275] netlink: 'syz.6.4997': attribute type 1 has an invalid length. [ 543.333926][T19165] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 543.364782][T19165] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 543.379643][T19165] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 543.392580][T19165] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 543.430288][T19275] bond0: entered promiscuous mode [ 543.436865][T19275] 8021q: adding VLAN 0 to HW filter on device bond0 [ 543.451310][T19165] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 543.468925][T19165] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 543.480707][T19165] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 543.492853][T19165] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 543.518014][T19278] bond0: (slave gretap4): making interface the new active one [ 543.528804][T19278] gretap4: entered promiscuous mode [ 543.535270][T19278] bond0: (slave gretap4): Enslaving as an active interface with an up link [ 543.704205][ T30] audit: type=1400 audit(1785221843.692:1238): avc: denied { write } for pid=19280 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 543.770492][T19165] 8021q: adding VLAN 0 to HW filter on device bond0 [ 543.817469][T19165] 8021q: adding VLAN 0 to HW filter on device team0 [ 543.836573][T14917] bridge0: port 1(bridge_slave_0) entered blocking state [ 543.843737][T14917] bridge0: port 1(bridge_slave_0) entered forwarding state [ 543.903819][ T30] audit: type=1400 audit(1785221843.882:1239): avc: denied { write } for pid=19307 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 543.904502][T10336] bridge0: port 2(bridge_slave_1) entered blocking state [ 543.933045][T10336] bridge0: port 2(bridge_slave_1) entered forwarding state [ 544.032535][T19314] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5008'. [ 544.100507][T19317] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5011'. [ 544.830256][ T30] audit: type=1400 audit(1785221844.812:1240): avc: denied { write } for pid=19319 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 544.939079][T19165] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 544.990368][ T30] audit: type=1400 audit(1785221844.972:1241): avc: denied { write } for pid=19348 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 545.034246][ T4928] Bluetooth: hci6: command tx timeout [ 545.575874][T19165] veth0_vlan: entered promiscuous mode [ 545.607179][ T30] audit: type=1400 audit(1785221845.582:1242): avc: denied { write } for pid=19354 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 545.647329][T19165] veth1_vlan: entered promiscuous mode [ 545.738705][T19165] veth0_macvtap: entered promiscuous mode [ 545.751252][T19165] veth1_macvtap: entered promiscuous mode [ 545.760554][ T30] audit: type=1400 audit(1785221845.732:1243): avc: denied { write } for pid=19374 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 545.814079][T19165] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 545.830579][T19165] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 545.870791][T10775] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.896852][T10775] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.913015][T17145] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 545.923406][T10775] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.933561][T10775] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 546.074926][T17145] usb 10-1: Using ep0 maxpacket: 16 [ 546.117943][T17145] usb 10-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 546.148518][T17145] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.176409][T17145] usb 10-1: Product: syz [ 546.187688][T17145] usb 10-1: Manufacturer: syz [ 546.194387][T17145] usb 10-1: SerialNumber: syz [ 546.210522][T17145] usb 10-1: config 0 descriptor?? [ 546.230098][T17941] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 546.259310][T17941] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 546.325112][T14917] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 546.349441][T14917] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 546.442317][T19391] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 546.471482][ T30] audit: type=1400 audit(1785221846.452:1244): avc: denied { write } for pid=19379 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 546.616457][ T30] audit: type=1400 audit(1785221846.602:1245): avc: denied { write } for pid=19396 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 546.656125][T19372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 546.692876][T19372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 546.719542][T17145] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 546.739305][T17145] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 546.790902][T17145] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 546.827308][T17145] usb 10-1: media controller created [ 546.869335][T17145] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 547.114444][ T4928] Bluetooth: hci6: command tx timeout [ 547.207101][T19423] binder: 19422:19423 ioctl c0306201 0 returned -14 [ 547.279618][T19427] binder: 19422:19427 ioctl c0306201 0 returned -14 [ 547.286624][ T30] audit: type=1400 audit(1785221847.272:1246): avc: denied { write } for pid=19403 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 547.416793][ T30] audit: type=1400 audit(1785221847.402:1247): avc: denied { write } for pid=19433 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 547.449347][T17145] zl10353_read_register: readreg error (reg=127, ret==0) [ 547.468884][T19372] dtv5100: wlen = 0, aborting. [ 547.475917][T17145] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 547.485276][T17145] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 547.501760][T17145] usb 10-1: USB disconnect, device number 5 [ 547.594222][T17145] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 547.651080][T19445] netlink: 'syz.6.5030': attribute type 1 has an invalid length. [ 547.690976][T19445] 8021q: adding VLAN 0 to HW filter on device bond4 [ 547.800325][ T30] audit: type=1400 audit(1785221847.782:1248): avc: denied { name_bind } for pid=19450 comm="syz.5.5031" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 547.821491][T19445] bond4: (slave geneve2): making interface the new active one [ 547.839171][T19445] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 547.897697][ T30] audit: type=1400 audit(1785221847.882:1249): avc: denied { write } for pid=19441 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 548.014735][ T30] audit: type=1400 audit(1785221848.002:1250): avc: denied { write } for pid=19459 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 548.676267][ T30] audit: type=1400 audit(1785221848.652:1251): avc: denied { write } for pid=19466 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 550.282134][T19559] vivid-003: ================= START STATUS ================= [ 550.303437][T19559] vivid-003: Radio HW Seek Mode: Bounded [ 550.314193][T19559] vivid-003: Radio Programmable HW Seek: false [ 550.320513][T19559] vivid-003: RDS Rx I/O Mode: Block I/O [ 550.327153][T19559] vivid-003: Generate RBDS Instead of RDS: false [ 550.334394][T19559] vivid-003: RDS Reception: true [ 550.340113][T19559] vivid-003: RDS Program Type: 0 inactive [ 550.351366][T19559] vivid-003: RDS PS Name: inactive [ 550.423105][T19559] vivid-003: RDS Radio Text: inactive [ 550.468954][T19559] vivid-003: RDS Traffic Announcement: false inactive [ 550.502018][T19559] vivid-003: RDS Traffic Program: false inactive [ 550.530816][T19563] Process accounting resumed [ 550.564476][T19559] vivid-003: RDS Music: false inactive [ 550.634950][T19559] vivid-003: ================== END STATUS ================== [ 550.672242][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 550.672258][ T30] audit: type=1400 audit(1785221850.652:1257): avc: denied { unmount } for pid=5611 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 550.822199][ T30] audit: type=1400 audit(1785221850.802:1258): avc: denied { write } for pid=19561 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 550.931215][ T30] audit: type=1400 audit(1785221850.912:1259): avc: denied { unmount } for pid=5611 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 551.007657][ T30] audit: type=1400 audit(1785221850.992:1260): avc: denied { write } for pid=19580 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 551.442754][T17145] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 551.612915][T17145] usb 5-1: Using ep0 maxpacket: 8 [ 551.620101][T17145] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 551.627746][ T30] audit: type=1400 audit(1785221851.602:1261): avc: denied { write } for pid=19589 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 551.632159][T17145] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 551.717100][T17145] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 551.740473][ T30] audit: type=1400 audit(1785221851.722:1262): avc: denied { write } for pid=19602 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 551.743656][T17145] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 551.814405][T17145] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 551.833407][T17145] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 551.950558][T19605] overlayfs: conflicting options: nfs_export=on,index=off [ 551.968021][T19605] netlink: 'syz.9.5056': attribute type 11 has an invalid length. [ 551.976462][T19605] netlink: 220 bytes leftover after parsing attributes in process `syz.9.5056'. [ 552.086442][T17145] usb 5-1: GET_CAPABILITIES returned 0 [ 552.099413][T17145] usbtmc 5-1:16.0: can't read capabilities [ 552.345700][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 552.378239][T17121] usb 5-1: USB disconnect, device number 9 [ 553.052315][T19616] netlink: 4 bytes leftover after parsing attributes in process `syz.9.5061'. [ 553.931716][T19638] syzkaller0: entered promiscuous mode [ 553.937395][T19638] syzkaller0: entered allmulticast mode [ 554.102923][ T5739] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 554.138868][T19648] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=19648 comm=syz.4.5072 [ 554.265078][ T5739] usb 10-1: Using ep0 maxpacket: 32 [ 554.279262][ T5739] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 554.306844][ T5739] usb 10-1: New USB device found, idVendor=0424, idProduct=c001, bcdDevice=aa.5f [ 554.324607][ T5739] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.342923][ T5739] usb 10-1: Product: syz [ 554.347643][ T5739] usb 10-1: Manufacturer: syz [ 554.363631][ T5739] usb 10-1: SerialNumber: syz [ 554.374449][ T5739] usb 10-1: config 0 descriptor?? [ 554.629679][T18622] usb 10-1: USB disconnect, device number 6 [ 554.921381][T19678] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 555.581969][T19697] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5091'. [ 555.671522][T19676] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 556.223984][T19719] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2 sclass=netlink_route_socket pid=19719 comm=syz.9.5098 [ 556.708876][T19734] netlink: 56 bytes leftover after parsing attributes in process `syz.4.5104'. [ 556.774904][ T30] audit: type=1400 audit(1785221856.752:1263): avc: denied { setattr } for pid=19737 comm="syz.6.5105" name="/" dev="configfs" ino=1072 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 557.360642][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 557.367479][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 559.055071][T19782] overlayfs: failed to clone upperpath [ 559.921658][T10324] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 560.346228][ T30] audit: type=1326 audit(1785221860.332:1264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19792 comm="syz.9.5129" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0203b9de99 code=0x0 [ 560.399062][T19797] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5130'. [ 560.598287][ T30] audit: type=1400 audit(1785221860.582:1265): avc: denied { bind } for pid=19799 comm="syz.6.5131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 561.208200][T19815] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5137'. [ 561.217907][T19815] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5137'. [ 561.232930][T19817] netlink: 16 bytes leftover after parsing attributes in process `syz.9.5138'. [ 561.301510][T19820] syz_tun: entered allmulticast mode [ 561.315202][T19820] SELinux: failure in sel_netif_sid_slow(), invalid network interface (0) [ 561.326455][T19820] mroute: pending queue full, dropping entries [ 561.335975][T19819] syz_tun: left allmulticast mode [ 562.362877][T19828] xt_hashlimit: size too large, truncated to 1048576 [ 562.739205][T19853] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5152'. [ 562.750912][T19853] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5152'. [ 562.968576][T19864] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5158'. [ 563.394680][ T30] audit: type=1400 audit(1785221863.382:1266): avc: denied { shutdown } for pid=19872 comm="syz.6.5160" lport=42074 faddr=::ffff:172.20.255.187 fport=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 563.457311][T19880] fuse: Bad value for 'fd' [ 563.498001][T19882] fuse: Bad value for 'fd' [ 563.748802][T19893] netlink: 'syz.9.5169': attribute type 1 has an invalid length. [ 563.778613][T19893] 8021q: adding VLAN 0 to HW filter on device bond2 [ 563.830410][T19893] bond2: (slave geneve2): making interface the new active one [ 563.848238][T19893] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 563.867021][T10336] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 563.893096][T10336] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 563.917222][T10336] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 563.944645][T10336] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 564.641551][T19911] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5170'. [ 564.658268][T19911] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5170'. [ 565.429126][T19944] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5187'. [ 565.906233][ T5622] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 565.919880][ T5622] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 565.939789][ T5622] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 565.949085][ T5622] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 565.960735][ T5622] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 567.709319][T19952] bridge0: port 1(bridge_slave_0) entered blocking state [ 567.722499][T19952] bridge0: port 1(bridge_slave_0) entered disabled state [ 567.738855][T19952] bridge_slave_0: entered allmulticast mode [ 567.754607][T19952] bridge_slave_0: entered promiscuous mode [ 567.778006][T19952] bridge0: port 2(bridge_slave_1) entered blocking state [ 567.797773][T19952] bridge0: port 2(bridge_slave_1) entered disabled state [ 567.810985][T19952] bridge_slave_1: entered allmulticast mode [ 567.829183][T19952] bridge_slave_1: entered promiscuous mode [ 567.917312][T19952] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 567.930289][T19952] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 567.981301][T19952] team0: Port device team_slave_0 added [ 567.992576][T19952] team0: Port device team_slave_1 added [ 568.073150][ T4928] Bluetooth: hci1: command tx timeout [ 568.163027][T19997] overlayfs: failed to clone upperpath [ 568.212448][T19952] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 568.228299][T19952] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 568.258314][T19952] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 568.277158][T19952] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 568.284270][T19952] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 568.340315][ T30] audit: type=1400 audit(1785221868.322:1267): avc: denied { setopt } for pid=19995 comm="syz.5.5202" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 568.365216][T19952] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 568.501184][T19952] hsr_slave_0: entered promiscuous mode [ 568.524452][T19952] hsr_slave_1: entered promiscuous mode [ 568.540861][T19952] debugfs: 'hsr0' already exists in 'hsr' [ 568.554282][T19952] Cannot create hsr debugfs directory [ 568.797828][T19952] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 568.910026][T19952] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.009569][T19952] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.174252][T19952] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.324931][ T30] audit: type=1400 audit(1785221869.302:1268): avc: denied { write } for pid=20018 comm="syz.9.5211" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 570.155124][ T4928] Bluetooth: hci1: command tx timeout [ 570.408422][T14917] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.550338][ T5622] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 570.569532][ T5622] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 570.580440][ T5622] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 570.588618][ T5622] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 570.596303][ T5622] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 570.761217][T14917] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 571.136275][T19999] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 571.196184][T19952] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 571.327745][T19952] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 571.341034][T19952] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 571.403842][T20067] x_tables: duplicate underflow at hook 4 [ 571.411009][T20067] sctp: [Deprecated]: syz.5.5231 (pid 20067) Use of int in maxseg socket option. [ 571.411009][T20067] Use struct sctp_assoc_value instead [ 571.530311][T19952] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 571.568843][T19952] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 571.580714][T20069] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5232'. [ 571.590900][T20069] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5232'. [ 571.680275][T19952] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 571.748638][T14917] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 571.756292][T20075] netlink: 16 bytes leftover after parsing attributes in process `syz.9.5234'. [ 571.777855][T19952] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 571.828820][T19952] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 571.865908][T20073] lo speed is unknown, defaulting to 1000 [ 571.892071][T20073] lo speed is unknown, defaulting to 1000 [ 571.927541][T20073] lo speed is unknown, defaulting to 1000 [ 571.940208][T20073] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 571.968205][T20073] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 572.005671][T20073] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 572.025876][T20073] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 572.127674][T19952] 8021q: adding VLAN 0 to HW filter on device bond0 [ 572.155247][T20073] lo speed is unknown, defaulting to 1000 [ 572.187737][T20073] lo speed is unknown, defaulting to 1000 [ 572.209492][T19952] 8021q: adding VLAN 0 to HW filter on device team0 [ 572.225575][T20073] lo speed is unknown, defaulting to 1000 [ 572.233373][ T5622] Bluetooth: hci1: command tx timeout [ 572.251059][T20073] lo speed is unknown, defaulting to 1000 [ 572.254892][T10775] bridge0: port 1(bridge_slave_0) entered blocking state [ 572.264071][T10775] bridge0: port 1(bridge_slave_0) entered forwarding state [ 572.300695][T20073] lo speed is unknown, defaulting to 1000 [ 572.340520][T14917] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.365209][T10775] bridge0: port 2(bridge_slave_1) entered blocking state [ 572.372729][T10775] bridge0: port 2(bridge_slave_1) entered forwarding state [ 572.384260][T20073] lo speed is unknown, defaulting to 1000 [ 572.397444][T20073] lo speed is unknown, defaulting to 1000 [ 572.405346][T20073] lo speed is unknown, defaulting to 1000 [ 572.428409][T20073] lo speed is unknown, defaulting to 1000 [ 572.438142][T20073] lo speed is unknown, defaulting to 1000 [ 572.495607][T20073] lo speed is unknown, defaulting to 1000 [ 572.729272][ T5622] Bluetooth: hci6: command tx timeout [ 572.957211][T20054] bridge0: port 1(bridge_slave_0) entered blocking state [ 572.983610][T20054] bridge0: port 1(bridge_slave_0) entered disabled state [ 573.001471][T20054] bridge_slave_0: entered allmulticast mode [ 573.013969][T20054] bridge_slave_0: entered promiscuous mode [ 573.025444][T20054] bridge0: port 2(bridge_slave_1) entered blocking state [ 573.033314][T20054] bridge0: port 2(bridge_slave_1) entered disabled state [ 573.045234][T20054] bridge_slave_1: entered allmulticast mode [ 573.057692][T20054] bridge_slave_1: entered promiscuous mode [ 573.141907][ T30] audit: type=1400 audit(1785221873.122:1269): avc: denied { write } for pid=20113 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 573.179209][T20127] lo: left promiscuous mode [ 573.204247][T20127] tunl0: left promiscuous mode [ 573.223552][T20127] gre0: left promiscuous mode [ 573.232006][T20127] gretap0: left promiscuous mode [ 573.240032][T20127] erspan0: left promiscuous mode [ 573.247625][T20127] ip_vti0: left promiscuous mode [ 573.255019][T20127] ip6_vti0: left promiscuous mode [ 573.261836][T20127] sit0: left promiscuous mode [ 573.266924][ T30] audit: type=1400 audit(1785221873.252:1270): avc: denied { write } for pid=20135 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 573.271090][T20127] ip6tnl0: left promiscuous mode [ 573.304751][T20127] ip6gre0: left promiscuous mode [ 573.311516][T20127] ip6gretap0: left promiscuous mode [ 573.319691][T20127] bridge0: left promiscuous mode [ 573.326874][T20127] vcan0: left promiscuous mode [ 573.333188][T20127] bond0: left promiscuous mode [ 573.339824][T20127] 8021q: adding VLAN 0 to HW filter on device bond0 [ 573.347133][T20127] team0: left promiscuous mode [ 573.352540][T20127] 8021q: adding VLAN 0 to HW filter on device team0 [ 573.361985][T20127] dummy0: left promiscuous mode [ 573.371328][T20127] nlmon0: left promiscuous mode [ 573.378058][T20127] batadv0: left promiscuous mode [ 573.384651][T20127] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 573.391976][T20127] vxcan0: left promiscuous mode [ 573.399861][T20127] vxcan1: left promiscuous mode [ 573.406591][T20127] veth0: left promiscuous mode [ 573.413225][T20127] veth1: left promiscuous mode [ 573.421567][T20127] wg0: left promiscuous mode [ 573.430210][T20127] wg1: left promiscuous mode [ 573.439435][T20127] wg2: left promiscuous mode [ 573.446580][T20127] veth0_to_bridge: left promiscuous mode [ 573.455632][T20127] veth1_to_bridge: left promiscuous mode [ 573.466059][T20127] veth0_to_bond: left promiscuous mode [ 573.474079][T20127] bond_slave_0: left promiscuous mode [ 573.480932][T20127] veth1_to_bond: left promiscuous mode [ 573.487934][T20127] bond_slave_1: left promiscuous mode [ 573.495553][T20127] veth0_to_team: left promiscuous mode [ 573.502518][T20127] team_slave_0: left promiscuous mode [ 573.514931][T20127] veth1_to_team: left promiscuous mode [ 573.522470][T20127] team_slave_1: left promiscuous mode [ 573.529904][T20127] veth0_to_batadv: left promiscuous mode [ 573.537714][T20127] batadv_slave_0: left promiscuous mode [ 573.544898][T20127] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 573.553352][T20127] veth1_to_batadv: left promiscuous mode [ 573.561011][T20127] batadv_slave_1: left promiscuous mode [ 573.568709][T20127] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 573.577178][T20127] xfrm0: left promiscuous mode [ 573.583464][T20127] veth0_to_hsr: left promiscuous mode [ 573.590249][T20127] veth1_to_hsr: left promiscuous mode [ 573.597946][T20127] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 573.608490][T20127] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 573.619165][T20127] hsr0: left promiscuous mode [ 573.625045][T20127] veth1_virt_wifi: left promiscuous mode [ 573.632522][T20127] veth0_virt_wifi: left promiscuous mode [ 573.639669][T20127] virt_wifi0: left promiscuous mode [ 573.650058][T20127] veth1_vlan: left promiscuous mode [ 573.657441][T20127] vlan0: left promiscuous mode [ 573.663594][T20127] vlan1: left promiscuous mode [ 573.669284][T20127] veth1_vlan: entered promiscuous mode [ 573.675159][T20127] macvlan0: left promiscuous mode [ 573.681510][T20127] macvlan1: left promiscuous mode [ 573.687942][T20127] ipvlan0: left promiscuous mode [ 573.694032][T20127] ipvlan1: left promiscuous mode [ 573.699858][T20127] veth1_macvtap: left promiscuous mode [ 573.706654][T20127] veth0_macvtap: left promiscuous mode [ 573.713412][T20127] veth0_macvtap: entered promiscuous mode [ 573.719409][T20127] macvtap0: left promiscuous mode [ 573.726009][T20127] veth1_macvtap: entered promiscuous mode [ 573.731971][T20127] macsec0: left promiscuous mode [ 573.738146][T20127] geneve0: left promiscuous mode [ 573.745882][T20127] geneve1: left promiscuous mode [ 573.752603][T20127] netdevsim netdevsim9 netdevsim0: left promiscuous mode [ 573.760360][T20127] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 573.768452][T20127] netdevsim netdevsim9 netdevsim1: left promiscuous mode [ 573.776038][T20127] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 573.784294][T20127] netdevsim netdevsim9 netdevsim2: left promiscuous mode [ 573.791657][T20127] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 573.799980][T20127] netdevsim netdevsim9 netdevsim3: left promiscuous mode [ 573.807635][T20127] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 573.817554][T20127] mac80211_hwsim hwsim23 wlan0: left promiscuous mode [ 573.825425][T20127] mac80211_hwsim hwsim24 wlan1: left promiscuous mode [ 573.833870][T20127] bond1: left promiscuous mode [ 573.839597][T20127] 8021q: adding VLAN 0 to HW filter on device bond1 [ 573.850484][T20127] gretap1: left promiscuous mode [ 573.856956][T20127] veth2: left promiscuous mode [ 573.862533][T20127] veth3: left promiscuous mode [ 573.878929][T14917] bridge_slave_1: left allmulticast mode [ 573.886118][T14917] bridge_slave_1: left promiscuous mode [ 573.897886][T14917] bridge0: port 2(bridge_slave_1) entered disabled state [ 573.916243][T14917] bridge_slave_0: left allmulticast mode [ 573.927358][T14917] bridge_slave_0: left promiscuous mode [ 573.950725][T14917] bridge0: port 1(bridge_slave_0) entered disabled state [ 574.107601][T14917] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 574.118587][T14917] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 574.129532][T14917] bond0 (unregistering): Released all slaves [ 574.143257][T20054] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 574.155349][T20054] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 574.168737][ T5273] 8021q: adding VLAN 0 to HW filter on device eth1 [ 574.168839][T17121] lo speed is unknown, defaulting to 1000 [ 574.190355][T10336] bridge0: port 1(bridge_slave_0) entered blocking state [ 574.191225][T17121] syz2: Port: 1 Link ACTIVE [ 574.197568][T10336] bridge0: port 1(bridge_slave_0) entered forwarding state [ 574.212214][T10336] bridge0: port 2(bridge_slave_1) entered blocking state [ 574.219472][T10336] bridge0: port 2(bridge_slave_1) entered forwarding state [ 574.309153][ T12] netdevsim netdevsim9 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 574.313188][ T5622] Bluetooth: hci1: command tx timeout [ 574.411384][T10336] netdevsim netdevsim9 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 574.456620][T10336] netdevsim netdevsim9 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 574.467856][T10336] netdevsim netdevsim9 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 574.506476][T20054] team0: Port device team_slave_0 added [ 574.596369][T20054] team0: Port device team_slave_1 added [ 574.699320][T20054] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 574.709285][T20054] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 574.759325][T20054] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 574.795239][ T5622] Bluetooth: hci6: command tx timeout [ 574.806699][T20054] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 574.816098][T20054] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 574.885702][T20054] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 575.074059][T19952] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 575.107949][T20054] hsr_slave_0: entered promiscuous mode [ 575.120916][T20054] hsr_slave_1: entered promiscuous mode [ 575.135240][T20054] debugfs: 'hsr0' already exists in 'hsr' [ 575.141143][ T30] audit: type=1400 audit(1785221875.122:1271): avc: denied { write } for pid=20154 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 575.164571][T20054] Cannot create hsr debugfs directory [ 575.245722][T14917] hsr_slave_0: left promiscuous mode [ 575.261766][ T30] audit: type=1400 audit(1785221875.242:1272): avc: denied { write } for pid=20171 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 575.288659][T14917] hsr_slave_1: left promiscuous mode [ 575.296181][T14917] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 575.306074][T14917] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 575.325684][T14917] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 575.333951][T14917] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 575.390442][T14917] veth1_macvtap: left promiscuous mode [ 575.400734][T14917] veth0_macvtap: left promiscuous mode [ 575.408311][T14917] veth1_vlan: left promiscuous mode [ 575.414015][T14917] veth0_vlan: left promiscuous mode [ 576.872819][ T5622] Bluetooth: hci6: command tx timeout [ 577.400782][T20190] netlink: 'syz.9.5256': attribute type 1 has an invalid length. [ 577.426319][T14917] team0 (unregistering): Port device team_slave_1 removed [ 577.447137][T14917] team0 (unregistering): Port device team_slave_0 removed [ 577.556787][ T5273] 8021q: adding VLAN 0 to HW filter on device eth2 [ 577.587751][T20190] 8021q: adding VLAN 0 to HW filter on device bond3 [ 577.629914][T20193] bond3: (slave geneve3): making interface the new active one [ 577.645666][T20193] bond3: (slave geneve3): Enslaving as an active interface with an up link [ 577.928227][T19952] veth0_vlan: entered promiscuous mode [ 577.979108][T19952] veth1_vlan: entered promiscuous mode [ 578.348034][ T30] audit: type=1400 audit(1785221878.332:1273): avc: denied { write } for pid=20198 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 578.431252][T20054] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 578.455524][T20054] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.482953][T20054] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 578.503845][ T30] audit: type=1400 audit(1785221878.492:1274): avc: denied { write } for pid=20211 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 578.610156][T19952] veth0_macvtap: entered promiscuous mode [ 578.636102][T19952] veth1_macvtap: entered promiscuous mode [ 578.666084][ T5273] 8021q: adding VLAN 0 to HW filter on device eth3 [ 578.691683][T19952] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 578.807396][T20054] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 578.818552][T20054] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.832345][T20054] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 578.868191][T19952] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 578.890351][ T57] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 578.910939][ T57] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 578.921252][ T57] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 578.935894][ T57] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 578.954237][ T5622] Bluetooth: hci6: command tx timeout [ 579.132107][T20054] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 579.153466][T20054] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.164728][T20054] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 579.304734][T20239] netlink: 2036 bytes leftover after parsing attributes in process `syz.5.5264'. [ 579.314069][ T30] audit: type=1400 audit(1785221879.302:1275): avc: denied { write } for pid=20228 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 579.317462][T20239] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5264'. [ 579.369814][T20054] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 579.380866][T20054] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.391768][T20054] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 579.431509][ T30] audit: type=1400 audit(1785221879.412:1276): avc: denied { write } for pid=20242 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 579.514792][T17941] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 579.528735][T17941] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 579.571107][T17941] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 579.580360][T17941] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 579.639661][ T5273] 8021q: adding VLAN 0 to HW filter on device eth4 [ 580.169806][T20253] tipc: Started in network mode [ 580.176169][T20253] tipc: Node identity 6eb5f7eb7269, cluster identity 4711 [ 580.213107][T20253] tipc: Enabled bearer , priority 0 [ 580.451908][T20259] syzkaller0: MTU too low for tipc bearer [ 580.473171][T20259] tipc: Disabling bearer [ 580.499506][T20054] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 580.529184][T20054] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 580.543787][T20054] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 580.557678][T20054] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 580.619261][T20054] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 580.652279][T20054] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 580.673719][T20054] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 580.725711][T20054] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 581.034513][T20054] 8021q: adding VLAN 0 to HW filter on device bond0 [ 581.085640][T20054] 8021q: adding VLAN 0 to HW filter on device team0 [ 581.119939][T14917] bridge0: port 1(bridge_slave_0) entered blocking state [ 581.127118][T14917] bridge0: port 1(bridge_slave_0) entered forwarding state [ 581.177978][T14917] bridge0: port 2(bridge_slave_1) entered blocking state [ 581.185126][T14917] bridge0: port 2(bridge_slave_1) entered forwarding state [ 581.695034][T20301] netlink: 68 bytes leftover after parsing attributes in process `syz.9.5288'. [ 581.723572][T20301] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5288'. [ 581.762953][T20305] tipc: Failed to obtain node identity [ 581.769699][T20305] tipc: Enabling of bearer rejected, failed to enable media [ 581.945784][T20054] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 582.058574][T20054] veth0_vlan: entered promiscuous mode [ 582.086020][T20054] veth1_vlan: entered promiscuous mode [ 582.154083][T20054] veth0_macvtap: entered promiscuous mode [ 582.186373][T20054] veth1_macvtap: entered promiscuous mode [ 582.230122][T20054] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 582.261327][T20054] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 582.282244][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.295699][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.309887][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.321843][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.570034][T14917] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 582.594566][T14917] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 582.649039][T17941] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 582.665710][T17941] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 582.790630][T20314] netlink: 4 bytes leftover after parsing attributes in process `syz.9.5282'. [ 584.103529][T17138] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 584.231073][T20339] syzkaller1: entered promiscuous mode [ 584.306115][T17138] usb 3-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 584.317561][T20339] syzkaller1: entered allmulticast mode [ 584.323290][T17138] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 584.340430][T17138] usb 3-1: config 0 descriptor?? [ 584.918447][ T30] audit: type=1800 audit(1785221884.882:1277): pid=20363 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.6.5300" name="file0" dev="overlay" ino=3987 res=0 errno=0 [ 584.961992][T20370] overlayfs: failed to clone upperpath [ 585.574334][T20392] tipc: Started in network mode [ 585.579387][T20392] tipc: Node identity 1001001, cluster identity 4711 [ 585.587388][T20392] tipc: Node number set to 16781313 [ 585.593445][T20392] tipc: Cannot configure node identity twice [ 585.610356][T20392] tipc: New replicast peer: 127.0.0.1 [ 585.618005][T20392] tipc: Enabled bearer , priority 10 [ 585.964699][T20407] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5318'. [ 586.151756][ T30] audit: type=1400 audit(1785221886.132:1278): avc: denied { accept } for pid=20410 comm="syz.1.5320" lport=20000 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 586.177939][T17138] usb 3-1: Cannot set autoneg [ 586.183579][T17138] MOSCHIP usb-ethernet driver 3-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 586.208829][T17138] usb 3-1: USB disconnect, device number 20 [ 587.047617][T20427] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5326'. [ 587.084699][T20432] overlayfs: failed to clone upperpath [ 587.891124][T20450] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 588.517888][T20461] kvm: vcpu 1: requested lapic timer restore with starting count register 0x390=2614914533 (2614914533 ns) > initial count (338492871 ns). Using initial count to start timer. [ 590.295282][T20513] fuse: fd is not a fuse device [ 590.990495][ T30] audit: type=1400 audit(1785221890.972:1279): avc: denied { write } for pid=20531 comm="syz.6.5368" name="header" dev="configfs" ino=54728 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 591.033893][ T30] audit: type=1400 audit(1785221890.972:1280): avc: denied { write } for pid=20531 comm="syz.6.5368" name="header" dev="configfs" ino=54741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 591.060804][ T30] audit: type=1400 audit(1785221890.982:1281): avc: denied { write } for pid=20531 comm="syz.6.5368" name="ss" dev="configfs" ino=54738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 591.089289][ T30] audit: type=1400 audit(1785221890.982:1282): avc: denied { write } for pid=20531 comm="syz.6.5368" name="ss" dev="configfs" ino=54738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 591.132990][ T30] audit: type=1400 audit(1785221890.982:1283): avc: denied { write } for pid=20531 comm="syz.6.5368" name="h" dev="configfs" ino=89641 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 591.165630][ T30] audit: type=1400 audit(1785221890.982:1284): avc: denied { read } for pid=20531 comm="syz.6.5368" name="h" dev="configfs" ino=89642 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1 [ 591.201609][ T30] audit: type=1400 audit(1785221890.982:1285): avc: denied { write } for pid=20531 comm="syz.6.5368" name="h" dev="configfs" ino=89641 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 591.391852][ T30] audit: type=1400 audit(1785221891.372:1286): avc: denied { write } for pid=20533 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 591.469735][T20551] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5371'. [ 591.530695][ T30] audit: type=1400 audit(1785221891.512:1287): avc: denied { write } for pid=20552 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 591.918604][ T57] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 592.099315][ T30] audit: type=1400 audit(1785221892.082:1288): avc: denied { write } for pid=20555 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 592.258930][T20574] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5374'. [ 593.450525][T20627] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5379'. [ 595.710978][T20714] netlink: 'syz.1.5417': attribute type 2 has an invalid length. [ 595.740642][T20714] : entered promiscuous mode [ 595.828448][T20720] fuse: fd is not a fuse device [ 595.934283][T17121] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 596.113649][T17121] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 596.122358][T17121] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 596.137680][T17121] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 596.148641][T17121] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 596.164164][T17121] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 596.179507][T20728] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5423'. [ 596.182363][T17121] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 596.198526][T17121] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 596.207141][T17121] usb 6-1: Product: syz [ 596.211814][T17121] usb 6-1: Manufacturer: syz [ 596.223207][T17121] cdc_wdm 6-1:1.0: skipping garbage [ 596.228679][T17121] cdc_wdm 6-1:1.0: skipping garbage [ 596.240539][T17121] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 596.248864][T17121] cdc_wdm 6-1:1.0: Unknown control protocol [ 596.299346][T20730] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5424'. [ 596.450884][T20732] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5425'. [ 596.454633][T20734] fuse: fd is not a fuse device [ 596.463262][T20732] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5425'. [ 596.607319][T20742] tipc: Enabling of bearer rejected, failed to enable media [ 596.625737][T20738] kvm: pic: non byte write [ 596.846400][T20753] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5435'. [ 596.858697][T20753] netlink: 'syz.2.5435': attribute type 11 has an invalid length. [ 596.875566][ T57] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 596.875679][T20753] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5435'. [ 596.885284][ T57] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 596.893702][T20753] netlink: 'syz.2.5435': attribute type 11 has an invalid length. [ 596.903641][ T57] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 596.927707][ T57] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 597.253097][T17121] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 597.412697][T17121] usb 3-1: Using ep0 maxpacket: 8 [ 597.421676][T17121] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 597.431936][T17121] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 597.444388][T17121] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 597.455393][T17121] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 59391, setting to 1024 [ 597.466638][T17121] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 597.477730][T17121] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 597.493943][T17121] usb 3-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 597.503160][T17121] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 597.511207][T17121] usb 3-1: Product: syz [ 597.517945][T17121] usb 3-1: Manufacturer: syz [ 597.522590][T17121] usb 3-1: SerialNumber: syz [ 597.532347][T17121] usb 3-1: config 0 descriptor?? [ 597.541316][T20756] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 598.248903][T20772] netlink: 'syz.1.5441': attribute type 3 has an invalid length. [ 598.260288][T20772] netlink: 'syz.1.5441': attribute type 3 has an invalid length. [ 598.732747][T17145] usb 6-1: USB disconnect, device number 46 [ 598.854241][T17121] rc_core: IR keymap rc-snapstream-firefly not found [ 598.861160][T17121] Registered IR keymap rc-empty [ 598.874243][T17121] rc rc0: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 598.890074][T17121] input: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input66 [ 598.969047][T17121] input: syz syz mouse as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input67 [ 599.004889][T17121] usb 3-1: USB disconnect, device number 21 [ 599.010874][ C1] ati_remote 3-1:0.0: ati_remote_irq_in: usb_submit_urb()=-19 [ 599.165015][ T4963] ati_remote 3-1:0.0: ati_remote_open: usb_submit_urb failed! [ 599.561432][ T30] kauditd_printk_skb: 465 callbacks suppressed [ 599.561452][ T30] audit: type=1400 audit(1785221899.542:1754): avc: denied { write } for pid=20814 comm="syz.2.5456" name="c.1" dev="configfs" ino=34902 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 600.170909][ T4928] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 600.190726][ T4928] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 600.205109][ T4928] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 600.218789][ T4928] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 600.226503][ T4928] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 600.253714][T17121] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 600.464553][T17121] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 600.475092][T17121] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 600.487586][T17121] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 600.497610][T17121] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 600.500592][T20833] lo speed is unknown, defaulting to 1000 [ 600.505906][T17121] usb 3-1: SerialNumber: syz [ 600.725125][T20833] bridge0: port 1(bridge_slave_0) entered blocking state [ 600.736043][T17121] usb 3-1: 0:2 : does not exist [ 600.740993][T17121] usb 3-1: unit 255 not found! [ 600.742803][T20833] bridge0: port 1(bridge_slave_0) entered disabled state [ 600.758025][T20833] bridge_slave_0: entered allmulticast mode [ 600.772080][T20833] bridge_slave_0: entered promiscuous mode [ 600.781353][T20833] bridge0: port 2(bridge_slave_1) entered blocking state [ 600.786569][T17121] usb 3-1: USB disconnect, device number 22 [ 600.789750][T20833] bridge0: port 2(bridge_slave_1) entered disabled state [ 600.805781][T20833] bridge_slave_1: entered allmulticast mode [ 600.833193][T20833] bridge_slave_1: entered promiscuous mode [ 600.840493][ T7853] udevd[7853]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 600.867133][T20833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 600.881025][T20833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 600.921721][T20833] team0: Port device team_slave_0 added [ 600.929585][T20833] team0: Port device team_slave_1 added [ 600.955438][T20833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 600.962431][T20833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 600.989305][T20833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 601.002081][T20833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 601.009203][T20833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 601.039432][T20833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 601.074510][T20833] hsr_slave_0: entered promiscuous mode [ 601.080833][T20833] hsr_slave_1: entered promiscuous mode [ 601.087091][T20833] debugfs: 'hsr0' already exists in 'hsr' [ 601.093299][T20833] Cannot create hsr debugfs directory [ 601.214022][T20833] netdevsim netdevsim7 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 601.225118][T20833] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 601.357207][T20833] netdevsim netdevsim7 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 601.367974][T20833] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 601.482486][T20861] 0: reclassify loop, rule prio 0, protocol 03 [ 601.507658][T20833] netdevsim netdevsim7 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 601.519327][T20833] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 601.606264][T20833] netdevsim netdevsim7 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 601.617294][T20833] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 601.708642][T20863] lo speed is unknown, defaulting to 1000 [ 601.927274][T20833] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 601.937835][T20833] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 601.946782][T20833] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 601.959087][T20833] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 601.967955][T20833] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 601.979942][T20833] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 601.988648][T20833] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 602.004033][T20833] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 602.075960][T20833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 602.098251][T20833] 8021q: adding VLAN 0 to HW filter on device team0 [ 602.112117][T10775] bridge0: port 1(bridge_slave_0) entered blocking state [ 602.119287][T10775] bridge0: port 1(bridge_slave_0) entered forwarding state [ 602.140832][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 602.148027][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 602.183298][ T5739] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 602.279798][T20878] binder: 20876:20878 ioctl c0306201 200000000080 returned -14 [ 602.289843][T20878] binder: 20876:20878 ioctl c0306201 2000000003c0 returned -14 [ 602.298858][ T30] audit: type=1400 audit(1785221902.282:1755): avc: denied { call } for pid=20876 comm="syz.6.5473" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 602.318731][ T5622] Bluetooth: hci7: command tx timeout [ 602.343035][ T5739] usb 3-1: Using ep0 maxpacket: 16 [ 602.360594][ T5739] usb 3-1: config index 0 descriptor too short (expected 1068, got 27) [ 602.379098][ T5739] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 602.407102][ T5739] usb 3-1: New USB device found, idVendor=06f8, idProduct=b000, bcdDevice=7d.f9 [ 602.417823][ T5739] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 602.442836][ T5739] usb 3-1: Product: syz [ 602.447079][ T5739] usb 3-1: Manufacturer: syz [ 602.451733][ T5739] usb 3-1: SerialNumber: syz [ 602.462127][ T5739] usb 3-1: config 0 descriptor?? [ 602.624289][T20833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 602.863361][T20833] veth0_vlan: entered promiscuous mode [ 602.881640][T20833] veth1_vlan: entered promiscuous mode [ 602.920583][T20833] veth0_macvtap: entered promiscuous mode [ 602.931158][T20833] veth1_macvtap: entered promiscuous mode [ 602.959108][T20833] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 602.973177][T20833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 602.987360][T14923] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 602.997689][T14923] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 603.017165][T14923] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 603.026347][T14923] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 603.166982][ T6447] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 603.190217][ T6447] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 603.212589][ T6447] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 603.223560][ T6447] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 603.298208][T20901] netlink: 12 bytes leftover after parsing attributes in process `syz.7.5464'. [ 603.310388][ T30] audit: type=1400 audit(1785221903.292:1756): avc: denied { getopt } for pid=20900 comm="syz.7.5464" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 603.335718][ T5739] usb 3-1: USB disconnect, device number 23 [ 604.270654][T20916] orangefs_devreq_write_iter: failed to copy head. [ 604.393090][ T5622] Bluetooth: hci7: command tx timeout [ 605.179589][T20937] bond0: (slave ip6tnl0): refused to change device type [ 605.803550][ T5622] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 605.932786][T17145] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 606.044241][ T30] audit: type=1400 audit(1785221906.032:1757): avc: denied { name_connect } for pid=20958 comm="syz.7.5498" dest=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 606.082876][T17145] usb 3-1: Using ep0 maxpacket: 32 [ 606.110678][T17145] usb 3-1: unable to get BOS descriptor or descriptor too short [ 606.135108][T17145] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 606.144981][T17145] usb 3-1: can't read configurations, error -71 [ 606.473114][ T5622] Bluetooth: hci7: command tx timeout [ 607.644356][T20980] lo speed is unknown, defaulting to 1000 [ 607.681057][T20982] loop5: detected capacity change from 0 to 7 [ 607.694574][T20982] loop5: [POWERTEC] p1 p2 p3 [ 607.699552][T20982] loop5: p1 size 1919942656 extends beyond EOD, truncated [ 607.708693][T20982] loop5: p2 start 876163636 is beyond EOD, truncated [ 607.715492][T20982] loop5: p3 start 29360128 is beyond EOD, truncated [ 607.765682][T20983] netlink: 16 bytes leftover after parsing attributes in process `syz.6.5504'. [ 607.791275][ T7853] udevd[7853]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 607.845924][T20980] lo speed is unknown, defaulting to 1000 [ 607.852595][T20980] lo speed is unknown, defaulting to 1000 [ 608.555672][ T31] INFO: task syz.7.4292:17180 blocked for more than 143 seconds. [ 608.556178][ T5622] Bluetooth: hci7: command tx timeout [ 608.567846][ T31] Tainted: G L syzkaller #0 [ 608.576488][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 608.589469][ T31] task:syz.7.4292 state:D stack:28776 pid:17180 tgid:17175 ppid:14583 task_flags:0x400140 flags:0x00080002 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 608.607819][ T31] Call Trace: [ 608.616471][ T31] [ 608.620652][ T31] __schedule+0x125c/0x6730 [ 608.622666][ T30] audit: type=1400 audit(1785221908.602:1758): avc: denied { write } for pid=5595 comm="syz-executor" path="pipe:[5236]" dev="pipefs" ino=5236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 608.626960][ T31] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 608.712152][ T30] audit: type=1400 audit(1785221908.602:1759): avc: denied { recv } for pid=10336 comm="kworker/u8:34" saddr=10.128.0.169 src=35484 daddr=10.128.0.90 dest=22 netif=eth0 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 608.757912][ T31] ? __pfx___schedule+0x10/0x10 [ 608.764342][ T31] ? find_held_lock+0x2b/0x80 [ 608.769114][ T31] ? schedule+0x225/0x2c0 [ 608.777540][ T31] schedule+0xdd/0x2c0 [ 608.782224][ T31] schedule_preempt_disabled+0x13/0x30 [ 608.791131][ T31] __mutex_lock+0xccc/0x1bd0 [ 608.800070][ T31] ? nfsd_nrthreads+0x63/0x1d0 [ 608.808264][ T31] ? __lock_acquire+0x49f/0x1a40 [ 608.815345][ T31] ? vfs_write+0x2aa/0x1050 [ 608.819952][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 608.825757][T17135] lo speed is unknown, defaulting to 1000 [ 608.830326][ T31] ? net_generic+0xea/0x2a0 [ 608.838568][T20980] infiniband syz1: set down [ 608.838687][ T31] ? net_generic+0xea/0x2a0 [ 608.852969][ T31] ? nfsd_nrthreads+0x63/0x1d0 [ 608.859323][ T31] nfsd_nrthreads+0x63/0x1d0 [ 608.865956][T20980] infiniband syz1: added lo [ 608.867722][ T31] write_threads+0x2e4/0x570 [ 608.877467][ T31] ? __pfx_write_threads+0x10/0x10 [ 608.883732][ T31] ? __might_fault+0xc5/0x140 [ 608.890008][ T31] ? __might_fault+0xc5/0x140 [ 608.897133][ T31] ? __pfx_write_threads+0x10/0x10 [ 608.904952][ T31] ? __pfx_write_threads+0x10/0x10 [ 608.909754][T20980] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 608.926732][ T31] ? _copy_from_user+0x59/0xd0 [ 608.931599][ T31] ? __pfx_write_threads+0x10/0x10 [ 608.940712][ T31] nfsctl_transaction_write+0x106/0x1a0 [ 608.950776][T20980] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 608.953503][ T31] vfs_write+0x2aa/0x1050 [ 608.968206][T20980] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 608.993997][ T31] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 609.000188][ T31] ? __pfx_vfs_write+0x10/0x10 [ 609.007739][ T31] ? __fget_files+0x215/0x3d0 [ 609.012505][ T31] ? __fget_files+0x21f/0x3d0 [ 609.017929][ T31] ksys_write+0x12a/0x250 [ 609.018919][T20980] RDS/IB: syz1: added [ 609.022327][ T31] ? __pfx_ksys_write+0x10/0x10 [ 609.026953][T20980] smc: adding ib device syz1 with port count 1 [ 609.032093][ T31] do_syscall_64+0x115/0x870 [ 609.038046][T20980] smc: ib device syz1 port 1 has no pnetid [ 609.049358][ T31] ? clear_bhb_loop+0x40/0x90 [ 609.054569][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.054632][T17135] lo speed is unknown, defaulting to 1000 [ 609.062021][ T31] RIP: 0033:0x7ff80959de99 [ 609.072305][T20980] lo speed is unknown, defaulting to 1000 [ 609.073365][ T31] RSP: 002b:00007ff80a417028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 609.091146][ T31] RAX: ffffffffffffffda RBX: 00007ff809826090 RCX: 00007ff80959de99 [ 609.099536][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 609.109040][ T31] RBP: 00007ff809633eaf R08: 0000000000000000 R09: 0000000000000000 [ 609.119236][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 609.127668][ T31] R13: 00007ff809826128 R14: 00007ff809826090 R15: 00007ffe763d02f8 [ 609.135956][ T31] [ 609.139453][ T31] [ 609.139453][ T31] Showing all locks held in the system: [ 609.148077][ T31] 1 lock held by khungtaskd/31: [ 609.157716][ T31] #0: ffffffff8ebe8180 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 609.168004][ T31] 2 locks held by getty/5361: [ 609.172945][ T31] #0: ffff8880380500a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 609.183353][ T31] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 [ 609.198953][ T31] 2 locks held by syz-executor/5611: [ 609.205543][ T31] #0: ffff88803656a0d8 (&type->s_umount_key#85){++++}-{4:4}, at: deactivate_super+0xdf/0x110 [ 609.217321][ T31] #1: ffffffff8f0727a0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 [ 609.229276][ T31] 2 locks held by kworker/0:5/5739: [ 609.235253][ T31] #0: ffff88801bc0f140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 [ 609.246334][ T31] #1: ffffc90005007d08 ((work_completion)(&m->mpeg_thread)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 [ 609.258548][ T31] 3 locks held by kworker/1:11/17121: [ 609.268429][ T31] 3 locks held by kworker/1:14/17135: [ 609.276042][ T31] #0: ffff88801bc0f140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 [ 609.287124][ T31] #1: ffffc9000395fd08 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 [ 609.297061][ T31] #2: ffffffff8ebf3c28 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 609.308535][ T31] 3 locks held by syz.7.4292/17176: [ 609.314730][ T31] #0: ffff88807e2a15f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 609.334735][ T31] #1: ffff88805344c450 (sb_writers#16){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 609.345986][ T31] #2: ffffffff8f0727a0 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xa5/0xcc0 [ 609.362051][ T31] 3 locks held by syz.7.4292/17180: [ 609.377069][ T31] #0: ffff88807f1d9eb0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 609.390294][ T31] #1: ffff88805344c450 (sb_writers#16){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 609.402137][ T31] #2: ffffffff8f0727a0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nrthreads+0x63/0x1d0 [ 609.412787][ T31] 1 lock held by syz.5.4586/17978: [ 609.422926][ T31] 1 lock held by syz.9.5303/20372: [ 609.428459][ T31] #0: ffff88803656a0d8 (&type->s_umount_key#85){++++}-{4:4}, at: super_lock+0x320/0x3f0 [ 609.440423][ T31] 1 lock held by syz.9.5303/20373: [ 609.448657][ T31] #0: ffff88803656a0d8 (&type->s_umount_key#85){++++}-{4:4}, at: super_lock+0x320/0x3f0 [ 609.460461][ T31] 1 lock held by syz.9.5303/20374: [ 609.465890][ T31] #0: ffff88803656a0d8 (&type->s_umount_key#85){++++}-{4:4}, at: super_lock+0x320/0x3f0 [ 609.486292][ T31] 2 locks held by syz.1.5453/20806: [ 609.491608][ T31] #0: ffff888073bec0d8 (&type->s_umount_key#85){++++}-{4:4}, at: deactivate_super+0xdf/0x110 [ 609.502726][ T31] #1: ffffffff8f0727a0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 [ 609.512402][ T31] 5 locks held by syz.6.5504/20980: [ 609.521667][ T31] 2 locks held by syz.2.5513/20995: [ 609.528909][ T31] #0: ffff888087dbcea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 609.541386][ T31] #1: ffffffff8ebf3c28 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 609.552965][ T31] 1 lock held by syz.7.5515/21002: [ 609.558110][ T31] #0: ffff888087cf4ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 609.568062][ T31] [ 609.591339][ T31] ============================================= [ 609.591339][ T31] [ 609.605631][ T31] NMI backtrace for cpu 1 [ 609.605649][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 609.605672][ T31] Tainted: [L]=SOFTLOCKUP [ 609.605678][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 609.605687][ T31] Call Trace: [ 609.605693][ T31] [ 609.605700][ T31] dump_stack_lvl+0x100/0x190 [ 609.605727][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 609.605749][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 609.605774][ T31] nmi_trigger_cpumask_backtrace+0x21c/0x2a0 [ 609.605803][ T31] sys_info+0x141/0x190 [ 609.605824][ T31] watchdog+0xcb1/0x1030 [ 609.605849][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 609.605867][ T31] ? __pfx_watchdog+0x10/0x10 [ 609.605890][ T31] ? __kthread_parkme+0x18c/0x230 [ 609.605916][ T31] ? kthread+0x13a/0x450 [ 609.605932][ T31] ? __pfx_watchdog+0x10/0x10 [ 609.605949][ T31] kthread+0x370/0x450 [ 609.605970][ T31] ? __pfx_kthread+0x10/0x10 [ 609.605988][ T31] ret_from_fork+0x72b/0xd50 [ 609.606010][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 609.606034][ T31] ? __switch_to+0x800/0x10f0 [ 609.606050][ T31] ? __pfx_kthread+0x10/0x10 [ 609.606066][ T31] ret_from_fork_asm+0x1a/0x30 [ 609.606098][ T31] [ 609.606117][ T31] Sending NMI from CPU 1 to CPUs 0: [ 609.739196][ C0] NMI backtrace for cpu 0 [ 609.739216][ C0] CPU: 0 UID: 0 PID: 17978 Comm: syz.5.4586 Tainted: G L syzkaller #0 PREEMPT(full) [ 609.739236][ C0] Tainted: [L]=SOFTLOCKUP [ 609.739241][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 609.739249][ C0] RIP: 0010:__rcu_read_lock+0x49/0x70 [ 609.739275][ C0] Code: 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 2c 8b 83 c4 04 00 00 83 c0 01 89 83 c4 04 00 00 <8b> 83 c4 04 00 00 3d ff ff ff 3f 7f 06 5b e9 94 f1 cf 09 90 0f 0b [ 609.739288][ C0] RSP: 0018:ffffc90004107528 EFLAGS: 00000202 [ 609.739301][ C0] RAX: 0000000000000001 RBX: ffff888032bf2540 RCX: ffffc90004107690 [ 609.739310][ C0] RDX: 0000000000000000 RSI: ffffffff8e17fc5f RDI: ffff888032bf2a04 [ 609.739319][ C0] RBP: ffffc90004107640 R08: 0000000000000001 R09: 0000000000000007 [ 609.739328][ C0] R10: 0000000000000200 R11: 000000000000b886 R12: fffff52000820ec1 [ 609.739337][ C0] R13: ffffc900041075f8 R14: ffffc900041075f8 R15: ffffc90004107600 [ 609.739346][ C0] FS: 0000000000000000(0000) GS:ffff888123ddc000(0000) knlGS:0000000000000000 [ 609.739360][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 609.739371][ C0] CR2: 0000001b2d909ff8 CR3: 000000000e994000 CR4: 00000000003526f0 [ 609.739380][ C0] Call Trace: [ 609.739385][ C0] [ 609.739391][ C0] unwind_next_frame+0xae/0x2090 [ 609.739405][ C0] ? arch_stack_walk+0x73/0xf0 [ 609.739427][ C0] __unwind_start+0x3cd/0x7e0 [ 609.739441][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 609.739462][ C0] arch_stack_walk+0x73/0xf0 [ 609.739482][ C0] ? arch_stack_walk+0x73/0xf0 [ 609.739503][ C0] stack_trace_save+0x8e/0xc0 [ 609.739516][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 609.739530][ C0] ? __lock_acquire+0x49f/0x1a40 [ 609.739546][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 609.739560][ C0] ? lockdep_hardirqs_on+0x78/0x100 [ 609.739575][ C0] save_stack+0x162/0x1e0 [ 609.739591][ C0] ? __pfx_save_stack+0x10/0x10 [ 609.739610][ C0] ? page_ext_put+0x3e/0xd0 [ 609.739627][ C0] __reset_page_owner+0x84/0x190 [ 609.739644][ C0] free_pages_prepare+0x586/0xd80 [ 609.739666][ C0] __free_contig_range_common+0x14f/0x250 [ 609.739688][ C0] free_pages_bulk+0x12a/0x200 [ 609.739704][ C0] vm_area_free_pages+0xad/0x2b0 [ 609.739720][ C0] vfree+0x107/0x750 [ 609.739736][ C0] ? kcov_close+0x2b/0x60 [ 609.739751][ C0] ? __pfx_kcov_close+0x10/0x10 [ 609.739765][ C0] ? rcu_is_watching+0x12/0xc0 [ 609.739783][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 609.739796][ C0] ? __pfx_kcov_close+0x10/0x10 [ 609.739810][ C0] ? __pfx_kcov_close+0x10/0x10 [ 609.739825][ C0] kcov_close+0x34/0x60 [ 609.739839][ C0] __fput+0x3ff/0xb50 [ 609.739857][ C0] task_work_run+0x150/0x240 [ 609.739872][ C0] ? __pfx_task_work_run+0x10/0x10 [ 609.739889][ C0] do_exit+0x951/0x2ae0 [ 609.739911][ C0] ? __pfx_do_exit+0x10/0x10 [ 609.739929][ C0] ? cgroup_update_frozen_flag+0x125/0x240 [ 609.739949][ C0] ? find_held_lock+0x2b/0x80 [ 609.739969][ C0] ? get_signal+0x184f/0x21e0 [ 609.739987][ C0] do_group_exit+0xd5/0x2a0 [ 609.740000][ C0] get_signal+0x1ec7/0x21e0 [ 609.740020][ C0] ? __pfx_get_signal+0x10/0x10 [ 609.740036][ C0] ? __pfx_hrtimer_nanosleep+0x10/0x10 [ 609.740052][ C0] arch_do_signal_or_restart+0x91/0x7e0 [ 609.740067][ C0] ? get_timespec64+0x147/0x240 [ 609.740081][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 609.740099][ C0] ? __x64_sys_clock_nanosleep+0x347/0x480 [ 609.740117][ C0] exit_to_user_mode_loop+0x139/0x6f0 [ 609.740134][ C0] ? rcu_is_watching+0x12/0xc0 [ 609.740153][ C0] do_syscall_64+0x666/0x870 [ 609.740168][ C0] ? clear_bhb_loop+0x40/0x90 [ 609.740183][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.740197][ C0] RIP: 0033:0x7f913895e6ce [ 609.740209][ C0] Code: Unable to access opcode bytes at 0x7f913895e6a4. [ 609.740215][ C0] RSP: 002b:00007f9139814f58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 609.740227][ C0] RAX: fffffffffffffdfc RBX: 00007f91398156c0 RCX: 00007f913895e6ce [ 609.740237][ C0] RDX: 00007f9139814fb0 RSI: 0000000000000000 RDI: 0000000000000000 [ 609.740245][ C0] RBP: 00007f9138a33eaf R08: 0000000000000000 R09: 0000000000000000 [ 609.740254][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 609.740262][ C0] R13: 00007f9138c26038 R14: 00007f9138c25fa0 R15: 00007fffdebd1218 [ 609.740276][ C0] [ 609.800931][T20980] lo speed is unknown, defaulting to 1000 [ 609.802566][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 609.802585][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 609.802613][ T31] Tainted: [L]=SOFTLOCKUP [ 609.802620][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 609.802630][ T31] Call Trace: [ 609.802637][ T31] [ 609.802643][ T31] dump_stack_lvl+0x100/0x190 [ 609.802669][ T31] vpanic+0x552/0x970 [ 609.802686][ T31] ? __pfx_vpanic+0x10/0x10 [ 609.802705][ T31] ? nmi_trigger_cpumask_backtrace+0x1c7/0x2a0 [ 609.802733][ T31] panic+0xd1/0xe0 [ 609.802749][ T31] ? __pfx_panic+0x10/0x10 [ 609.802767][ T31] ? nmi_trigger_cpumask_backtrace+0x1fa/0x2a0 [ 609.802792][ T31] ? nmi_trigger_cpumask_backtrace+0x260/0x2a0 [ 609.802817][ T31] ? nmi_trigger_cpumask_backtrace+0x26a/0x2a0 [ 609.802841][ T31] ? watchdog.cold+0x1ec/0x234 [ 609.802859][ T31] ? watchdog+0xcc1/0x1030 [ 609.802879][ T31] watchdog.cold+0x1fd/0x234 [ 609.802901][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 609.802919][ T31] ? __pfx_watchdog+0x10/0x10 [ 609.802939][ T31] ? __kthread_parkme+0x18c/0x230 [ 609.802971][ T31] ? kthread+0x13a/0x450 [ 609.802986][ T31] ? __pfx_watchdog+0x10/0x10 [ 609.803003][ T31] kthread+0x370/0x450 [ 609.803018][ T31] ? __pfx_kthread+0x10/0x10 [ 609.803036][ T31] ret_from_fork+0x72b/0xd50 [ 609.803060][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 609.803083][ T31] ? __switch_to+0x800/0x10f0 [ 609.803101][ T31] ? __pfx_kthread+0x10/0x10 [ 609.803118][ T31] ret_from_fork_asm+0x1a/0x30 [ 609.803152][ T31] [ 609.810053][ T31] Kernel Offset: disabled