last executing test programs: 2.647765633s ago: executing program 0 (id=1): syz_usb_connect$cdc_ecm(0x6, 0x0, 0x0, 0x0) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000040)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000080), 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/serio/devices/serio2/drvctl\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='psmouse', 0x7) 2.576275677s ago: executing program 3 (id=4): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000300)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000400)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x8) dup2(r1, r0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) io_uring_setup(0x1b78, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0xffff}}}, 0x24}}, 0x0) r3 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='8', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2.495094624s ago: executing program 3 (id=5): syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x8, 0x0, 0x2}}}}}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES32=r3], 0x20}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@ipv6_newrule={0x24, 0x18, 0x409, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x1e, 0x1}]}, 0x24}}, 0x0) syz_emit_ethernet(0xfdef, &(0x7f0000000880)={@link_local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "010448", 0x20, 0x3a, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @local, {[], @ndisc_na={0x88, 0x0, 0x0, 0x0, '\x00', @remote, [{0x2, 0x1, "36dad83aea8d"}]}}}}}}, 0x0) 1.822914694s ago: executing program 3 (id=6): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_RELEASE_PORT(r0, 0x80045519, &(0x7f0000000000)=0x6) 1.822710924s ago: executing program 3 (id=7): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) fdatasync(r0) 1.751780141s ago: executing program 3 (id=9): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="0000600001000000000014"], 0x4a) 1.661518799s ago: executing program 3 (id=11): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='+p', 0x2) socket$inet(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) bind$netlink(r2, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r1, &(0x7f0000024c80)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000024d40)=ANY=[@ANYBLOB="4400000010000d042abd7000077bf70000000000", @ANYRES32=r3, @ANYBLOB="01000000000000002400128009000100626f6e6400000000140002800500010006"], 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) bind$netlink(r5, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r5, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200e3}, [@IFLA_MASTER={0x8, 0xa, r6}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) openat$cdrom(0xffffffffffffff9c, 0x0, 0x101000, 0x0) 1.19082448s ago: executing program 0 (id=13): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000240)={'veth1_to_bridge\x00', 0x400}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$cgroup_subtree(r0, &(0x7f0000000040)=ANY=[], 0xe) 1.126307217s ago: executing program 1 (id=15): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000001c00)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000440)="9e", 0x1}], 0x2}, 0x20008b88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b1a, &(0x7f0000000000)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000014c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001500)={0x2c, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8}]}, 0x2c}}, 0x0) 1.054420362s ago: executing program 1 (id=16): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x11) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e04a1f29f656e642c6163638173733d616e792c63616368653d66736361636865"]) mkdir(&(0x7f0000000100)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x141) 767.15941ms ago: executing program 2 (id=21): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000300)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000400)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x8) r2 = dup2(r1, r0) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, 0x0, &(0x7f0000000240)) 765.479061ms ago: executing program 1 (id=29): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r1, 0x0) syz_emit_ethernet(0x9a, &(0x7f0000000040)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "101040", 0x64, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x19, 0xc2, 0x0, 0x0, 0x0, {[@mptcp=@synack={0x1e, 0x10, 0x2, 0x2, 0x81, 0x3, 0x4}, @window={0x3, 0x3}, @mss={0x1e, 0x4, 0x96f4}, @sack_perm={0x4, 0x2}, @generic={0x0, 0xa, "8bfbd54ae56dd076"}, @timestamp={0x8, 0xa}, @mptcp=@mp_fclose={0x1e, 0xc, 0x4c, 0x0, 0x7}, @md5sig={0x13, 0x12, "7232407c80067615774fdbb46eb86cc8"}, @generic={0x0, 0x2}]}}}}}}}}, 0x0) 699.129221ms ago: executing program 2 (id=22): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg(r0, &(0x7f0000000f00)=[{{&(0x7f0000000700)=@in6={0xa, 0x4e22, 0x7, @dev={0xfe, 0x80, '\x00', 0x29}, 0x37}, 0x80, &(0x7f0000000c80)=[{&(0x7f0000000800)="0dc2931b4c", 0x5}], 0x1}}, {{&(0x7f0000000d00)=@hci={0x1f, 0x4, 0x3}, 0x80, &(0x7f0000000ec0)=[{&(0x7f0000000d80)='C', 0x1}, {0x0}], 0x2}}], 0x2, 0x200008c4) 688.750854ms ago: executing program 1 (id=23): r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$CDROM_DEBUG(r0, 0x5330, 0x1) ioctl$DVD_AUTH(r0, 0x5392, &(0x7f0000000080)=@hrpcs) 635.491834ms ago: executing program 2 (id=24): syz_emit_ethernet(0x42, &(0x7f0000000340)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x64, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x1000, 0x4e22, 0x12345678, 0x0, 0x0, 0x0, 0x8, 0x2, 0x1000, 0x0, 0x0, {[@fastopen={0x22, 0xc, "03020304050607083efd"}]}}}}}}}, 0x0) 580.919815ms ago: executing program 2 (id=25): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000001c00)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000440)="9e", 0x1}], 0x2}, 0x20008b88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b1a, &(0x7f0000000000)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000014c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001500)={0x2c, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8}]}, 0x2c}}, 0x0) 577.845451ms ago: executing program 1 (id=26): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='external:', 0x9) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x932, 0x0) 105.843823ms ago: executing program 2 (id=27): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x11) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e04a1f29f656e642c6163638173733d616e792c63616368653d66736361636865"]) mkdir(&(0x7f0000000100)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x141) 71.41121ms ago: executing program 0 (id=28): sendmmsg$unix(0xffffffffffffffff, &(0x7f0000007780)=[{{0x0, 0x0, &(0x7f00000000c0)=[{}], 0x1, 0x0, 0x0, 0x20008000}}], 0x1, 0x8020) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xe}, 0xe) sendmmsg$sock(r0, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) 6.244237ms ago: executing program 0 (id=30): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) 1.275654ms ago: executing program 1 (id=31): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000600), &(0x7f0000000640)={'syz', 0x2}, 0x0, 0x0, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @auto=[0x30, 0x30, 0x36, 0x30, 0x39, 0x30, 0x38, 0x30, 0x30, 0x30, 0x36, 0x31, 0x30, 0x37, 0x30, 0x31]}, &(0x7f0000000100)={0x0, "00112233444566778899aabbccddeeff00112233445566778899aabbccddeeff0011fb2fa087e1a5a490aabbccddeeff001122334455667788d9aabbccddeeff", 0x41}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x62, 0x36, 0x30, 0x30, 0x30, 0x33, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x65, 0x38, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000840)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x38}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x61, 0x30, 0x30, 0x30, 0x39, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x3d}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61, 0x30, 0x66, 0x64, 0x30, 0x63, 0x66]}, &(0x7f0000000740)={0x0, "001122334b0c66778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbddddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @desc1}, &(0x7f0000000580)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccdd2233445566778899aabbccddeeff000000000000000000000000009700", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @desc3}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$keyring(&(0x7f0000000300), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r0) add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x34, 0x62, 0x30, 0x30, 0x30, 0x30, 0x64, 0x30, 0x30, 0x31, 0x30, 0x37, 0x63, 0x66, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff0011223344556677878d486ca0bac53400112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x62, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35, 0x33, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @auto=[0x65, 0x36, 0x30, 0x63, 0x36, 0x30, 0x30, 0x64, 0x30, 0x30, 0x39, 0x30, 0x30, 0x30, 0x36, 0x63]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000480)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x38, 0x32, 0x30, 0x6e, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35, 0x30, 0x30, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x32, 0x30, 0x32, 0x30, 0x30, 0x30, 0x66, 0x30, 0x30, 0x62, 0xf]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x44}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x64, 0x30, 0x30, 0x64, 0x30, 0x30, 0x63, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x36]}, &(0x7f00000006c0)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @desc2}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aa00000000ff00112233445566778899aabbccddeeff", 0x140}, 0x48, r0) request_key(&(0x7f0000001000)='dns_resolver\x00', &(0x7f0000001040)={'syz', 0x2}, &(0x7f0000001080)='\x00', r0) 0s ago: executing program 2 (id=38): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000240)={'veth1_to_bridge\x00', 0x400}) write$cgroup_subtree(r0, &(0x7f0000000040)=ANY=[], 0xe) kernel console output (not intermixed with test programs): [ 29.006650][ T43] audit: type=1400 audit(1790753741.223:115): avc: denied { siginh } for pid=5632 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '[localhost]:7495' (ED25519) to the list of known hosts. [ 30.735705][ T43] audit: type=1400 audit(1790753742.953:116): avc: denied { name_bind } for pid=5639 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 30.765207][ T43] audit: type=1400 audit(1790753742.973:117): avc: denied { execute } for pid=5640 comm="sh" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 30.765935][ T43] audit: type=1400 audit(1790753742.983:118): avc: denied { execute_no_trans } for pid=5640 comm="sh" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 30.999958][ T43] audit: type=1400 audit(1790753743.213:119): avc: denied { write } for pid=5641 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.059421][ T43] audit: type=1400 audit(1790753743.273:120): avc: denied { write } for pid=5644 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.955567][ T43] audit: type=1400 audit(1790753744.163:121): avc: denied { write } for pid=5647 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.994764][ T43] audit: type=1400 audit(1790753744.203:122): avc: denied { write } for pid=5650 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.085448][ T43] audit: type=1400 audit(1790753744.293:123): avc: denied { write } for pid=5653 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.127614][ T43] audit: type=1400 audit(1790753744.343:124): avc: denied { write } for pid=5656 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.263850][ T43] audit: type=1400 audit(1790753744.473:125): avc: denied { write } for pid=5659 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.952372][ T5640] cgroup: Unknown subsys name 'net' [ 33.059287][ T5640] cgroup: Unknown subsys name 'cpuset' [ 33.063274][ T5640] cgroup: Unknown subsys name 'rlimit' [ 33.240194][ T5697] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 33.924178][ T5640] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 37.135897][ T43] kauditd_printk_skb: 35 callbacks suppressed [ 37.135910][ T43] audit: type=1400 audit(1790753749.343:161): avc: denied { execmem } for pid=5717 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 37.299283][ T43] audit: type=1400 audit(1790753749.513:162): avc: denied { create } for pid=5722 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.299314][ T43] audit: type=1400 audit(1790753749.513:163): avc: denied { create } for pid=5723 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.299646][ T43] audit: type=1400 audit(1790753749.513:164): avc: denied { read write } for pid=5723 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.299673][ T43] audit: type=1400 audit(1790753749.513:165): avc: denied { read write } for pid=5722 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.299963][ T43] audit: type=1400 audit(1790753749.513:166): avc: denied { open } for pid=5722 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.309021][ T43] audit: type=1400 audit(1790753749.523:167): avc: denied { ioctl } for pid=5723 comm="syz-executor" path="socket:[7313]" dev="sockfs" ino=7313 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.326777][ T5735] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 37.327720][ T5735] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 37.328941][ T5737] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 37.329763][ T5737] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 37.330302][ T5735] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 37.330629][ T5735] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 37.331588][ T5735] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 37.332044][ T5737] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 37.332049][ T5735] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 37.332927][ T5735] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 37.333087][ T5735] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 37.334743][ T5737] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 37.334840][ T5735] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 37.335049][ T5737] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 37.335055][ T5735] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 37.335264][ T5737] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 37.336048][ T5736] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 37.337444][ T5738] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 37.341507][ T43] audit: type=1400 audit(1790753749.553:168): avc: denied { read } for pid=5722 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 37.341532][ T43] audit: type=1400 audit(1790753749.553:169): avc: denied { open } for pid=5722 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 37.341552][ T43] audit: type=1400 audit(1790753749.553:170): avc: denied { mounton } for pid=5722 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 37.343214][ T5737] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 37.345835][ T5087] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 37.984702][ T5722] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.984749][ T5722] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.984806][ T5722] bridge_slave_0: entered allmulticast mode [ 37.986361][ T5722] bridge_slave_0: entered promiscuous mode [ 38.014769][ T5730] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.014821][ T5730] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.014887][ T5730] bridge_slave_0: entered allmulticast mode [ 38.015712][ T5730] bridge_slave_0: entered promiscuous mode [ 38.016922][ T5730] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.016961][ T5730] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.017017][ T5730] bridge_slave_1: entered allmulticast mode [ 38.018192][ T5730] bridge_slave_1: entered promiscuous mode [ 38.020771][ T5722] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.020839][ T5722] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.020897][ T5722] bridge_slave_1: entered allmulticast mode [ 38.021608][ T5722] bridge_slave_1: entered promiscuous mode [ 38.065560][ T5724] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.065652][ T5724] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.065740][ T5724] bridge_slave_0: entered allmulticast mode [ 38.066990][ T5724] bridge_slave_0: entered promiscuous mode [ 38.068728][ T5724] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.068769][ T5724] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.068847][ T5724] bridge_slave_1: entered allmulticast mode [ 38.069596][ T5724] bridge_slave_1: entered promiscuous mode [ 38.081863][ T5730] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.084414][ T5730] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.086428][ T5722] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.087945][ T5722] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.131954][ T5723] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.132029][ T5723] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.132295][ T5723] bridge_slave_0: entered allmulticast mode [ 38.133545][ T5723] bridge_slave_0: entered promiscuous mode [ 38.150040][ T5724] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.151806][ T5722] team0: Port device team_slave_0 added [ 38.151928][ T5723] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.151975][ T5723] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.152127][ T5723] bridge_slave_1: entered allmulticast mode [ 38.153865][ T5723] bridge_slave_1: entered promiscuous mode [ 38.156378][ T5730] team0: Port device team_slave_0 added [ 38.167605][ T5724] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.179746][ T5722] team0: Port device team_slave_1 added [ 38.189949][ T5730] team0: Port device team_slave_1 added [ 38.198873][ T5723] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.205924][ T5724] team0: Port device team_slave_0 added [ 38.222893][ T5723] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.229654][ T5724] team0: Port device team_slave_1 added [ 38.238069][ T5722] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.238079][ T5722] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.238091][ T5722] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.241663][ T5723] team0: Port device team_slave_0 added [ 38.261088][ T5722] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.261111][ T5722] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.261124][ T5722] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.263531][ T5723] team0: Port device team_slave_1 added [ 38.274676][ T5730] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.274690][ T5730] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.274710][ T5730] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.286536][ T5724] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.286546][ T5724] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.286559][ T5724] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.287210][ T5723] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.287221][ T5723] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.287241][ T5723] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.288485][ T5724] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.288493][ T5724] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.288505][ T5724] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.293503][ T5730] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.293516][ T5730] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.293536][ T5730] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.294452][ T5723] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.294464][ T5723] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.294483][ T5723] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.359144][ T5724] hsr_slave_0: entered promiscuous mode [ 38.359647][ T5724] hsr_slave_1: entered promiscuous mode [ 38.365191][ T5722] hsr_slave_0: entered promiscuous mode [ 38.366782][ T5722] hsr_slave_1: entered promiscuous mode [ 38.367375][ T5722] debugfs: 'hsr0' already exists in 'hsr' [ 38.367443][ T5722] Cannot create hsr debugfs directory [ 38.380742][ T5730] hsr_slave_0: entered promiscuous mode [ 38.381261][ T5730] hsr_slave_1: entered promiscuous mode [ 38.381556][ T5730] debugfs: 'hsr0' already exists in 'hsr' [ 38.381583][ T5730] Cannot create hsr debugfs directory [ 38.407242][ T5723] hsr_slave_0: entered promiscuous mode [ 38.407968][ T5723] hsr_slave_1: entered promiscuous mode [ 38.408455][ T5723] debugfs: 'hsr0' already exists in 'hsr' [ 38.408470][ T5723] Cannot create hsr debugfs directory [ 38.704552][ T5724] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 38.709825][ T5724] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.710350][ T5724] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 38.712088][ T5724] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.712724][ T5724] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 38.716795][ T5724] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.717367][ T5724] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 38.719385][ T5724] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.768622][ T5724] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.768684][ T5724] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.768898][ T5724] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.769110][ T5724] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.774073][ T5722] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.778262][ T5722] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.778931][ T5722] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.783406][ T5722] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.793411][ T5722] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.797099][ T5722] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.805736][ T5722] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.809445][ T5722] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.822239][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.823319][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.844587][ T5730] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 38.848035][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.848771][ T5730] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 38.852100][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.861934][ T5730] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 38.864430][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.877235][ T5730] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 38.879866][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.922439][ T5723] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 38.925940][ T5723] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.926528][ T5723] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 38.929752][ T5723] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.930352][ T5723] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 38.934795][ T5723] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.939447][ T5723] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 38.941363][ T5723] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.978938][ T5724] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.004402][ T5724] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.014158][ T1164] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.014206][ T1164] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.019617][ T1164] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.019665][ T1164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.034222][ T5722] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.049487][ T5722] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.054680][ T5730] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.064797][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.064841][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.066411][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.066453][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.078083][ T5723] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.097281][ T5730] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.107784][ T5723] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.113524][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.113590][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.114561][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.114601][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.117289][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.117330][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.134699][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.134743][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.318156][ T5724] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.357704][ T5722] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.360035][ T5724] veth0_vlan: entered promiscuous mode [ 39.367897][ T5087] Bluetooth: hci2: command tx timeout [ 39.367996][ T5087] Bluetooth: hci3: command tx timeout [ 39.368042][ T5087] Bluetooth: hci1: command tx timeout [ 39.369584][ T5724] veth1_vlan: entered promiscuous mode [ 39.376173][ T5727] Bluetooth: hci0: command tx timeout [ 39.386961][ T5724] veth0_macvtap: entered promiscuous mode [ 39.391083][ T5730] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.393100][ T5724] veth1_macvtap: entered promiscuous mode [ 39.415687][ T5722] veth0_vlan: entered promiscuous mode [ 39.421107][ T5724] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.429196][ T5723] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.430711][ T5724] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.446816][ T5722] veth1_vlan: entered promiscuous mode [ 39.460769][ T5730] veth0_vlan: entered promiscuous mode [ 39.477373][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.487646][ T5802] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.500444][ T5730] veth1_vlan: entered promiscuous mode [ 39.505539][ T5722] veth0_macvtap: entered promiscuous mode [ 39.515735][ T5722] veth1_macvtap: entered promiscuous mode [ 39.519501][ T70] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.519514][ T70] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.534904][ T5723] veth0_vlan: entered promiscuous mode [ 39.550509][ T5730] veth0_macvtap: entered promiscuous mode [ 39.552658][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.552670][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.552838][ T5730] veth1_macvtap: entered promiscuous mode [ 39.555650][ T5722] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.559670][ T5723] veth1_vlan: entered promiscuous mode [ 39.562110][ T5722] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.571054][ T5730] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.583637][ T5730] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.600648][ T5724] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 39.618486][ T5723] veth0_macvtap: entered promiscuous mode [ 39.621166][ T5723] veth1_macvtap: entered promiscuous mode [ 39.648713][ T5723] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.659600][ T5723] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.661860][ T46] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.661872][ T46] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.693233][ T70] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.693246][ T70] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.693469][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.693478][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.731701][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.731713][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.746202][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.747093][ T676] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.747104][ T676] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.768543][ T676] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.768555][ T676] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.778711][ T5802] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.778821][ T5802] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.778917][ T5802] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.779064][ T5802] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.779196][ T5802] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.779366][ T5802] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.779551][ T5802] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.779690][ T5802] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.779833][ T5802] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.779975][ T5802] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.780086][ T5802] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.780187][ T5802] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.780306][ T5802] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.871899][ T5883] Bluetooth: ISO socket layer initialized [ 39.881006][ T5882] syzkaller0: entered promiscuous mode [ 39.881020][ T5882] syzkaller0: entered allmulticast mode [ 40.753392][ T5899] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11'. [ 40.770617][ T5899] 8021q: adding VLAN 0 to HW filter on device bond1 [ 40.773399][ T5902] FAULT_INJECTION: forcing a failure. [ 40.773399][ T5902] name failslab, interval 1, probability 0, space 0, times 1 [ 40.773429][ T5902] CPU: 2 UID: 0 PID: 5902 Comm: syz.1.12 Not tainted syzkaller #0 PREEMPT(full) [ 40.773453][ T5902] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 40.773460][ T5902] Call Trace: [ 40.773464][ T5902] [ 40.773469][ T5902] dump_stack_lvl+0x100/0x190 [ 40.773489][ T5902] should_fail_ex.cold+0x5/0xa [ 40.773505][ T5902] should_failslab+0xc2/0x120 [ 40.773521][ T5902] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 40.773536][ T5902] ? __d_alloc+0x35/0xa50 [ 40.773576][ T5902] __d_alloc+0x35/0xa50 [ 40.773601][ T5902] d_alloc+0x4a/0x1e0 [ 40.773619][ T5902] lookup_one_qstr_excl+0x171/0x250 [ 40.773632][ T5902] start_dirop+0x59/0xb0 [ 40.773647][ T5902] simple_start_creating+0xf9/0x110 [ 40.773664][ T5902] ? __pfx_simple_start_creating+0x10/0x10 [ 40.773680][ T5902] ? mntput+0x70/0xa0 [ 40.773695][ T5902] ? simple_pin_fs+0xa3/0x190 [ 40.773710][ T5902] debugfs_start_creating.part.0+0x7b/0x150 [ 40.773722][ T5902] __debugfs_create_file+0xa9/0x500 [ 40.773735][ T5902] debugfs_create_file_full+0x41/0x60 [ 40.773748][ T5902] ref_tracker_dir_debugfs+0x19e/0x2e0 [ 40.773765][ T5902] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 40.773781][ T5902] ? stack_depot_init+0x17/0x80 [ 40.773805][ T5902] ? kasan_save_track+0x14/0x30 [ 40.773820][ T5902] ? __kasan_kmalloc+0xaa/0xb0 [ 40.773834][ T5902] ? lockdep_init_map_type+0x5c/0x250 [ 40.773849][ T5902] preinit_net+0x43b/0x920 [ 40.773867][ T5902] copy_net_ns+0x1dd/0x7a0 [ 40.773879][ T5902] create_new_namespaces+0x3ea/0xac0 [ 40.773895][ T5902] unshare_nsproxy_namespaces+0xf2/0x220 [ 40.773909][ T5902] ksys_unshare+0x4a2/0xa70 [ 40.773923][ T5902] ? __pfx_ksys_unshare+0x10/0x10 [ 40.773941][ T5902] __x64_sys_unshare+0x31/0x40 [ 40.773954][ T5902] do_syscall_64+0x123/0x790 [ 40.773967][ T5902] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 40.773978][ T5902] RIP: 0033:0x7f750739e159 [ 40.773988][ T5902] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.773998][ T5902] RSP: 002b:00007f75082ef028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 40.774010][ T5902] RAX: ffffffffffffffda RBX: 00007f7507625fa0 RCX: 00007f750739e159 [ 40.774016][ T5902] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 40.774023][ T5902] RBP: 00007f750743506b R08: 0000000000000000 R09: 0000000000000000 [ 40.774029][ T5902] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 40.774036][ T5902] R13: 00007f7507626038 R14: 00007f7507625fa0 R15: 00007ffdb5cfa008 [ 40.774050][ T5902] [ 40.776554][ T5899] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 40.782987][ T5899] 8021q: adding VLAN 0 to HW filter on device bond1 [ 40.800049][ T5899] bond1: (slave lo): making interface the new active one [ 40.816906][ T5899] bond1: (slave lo): Enslaving as an active interface with an up link [ 40.820667][ T5899] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 41.293426][ T5909] warning: `syz.1.15' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 41.411687][ T5911] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 41.455693][ T5087] Bluetooth: hci1: command tx timeout [ 41.455715][ T5087] Bluetooth: hci2: command tx timeout [ 41.455716][ T5734] Bluetooth: hci3: command tx timeout [ 41.455768][ T5727] Bluetooth: hci0: command tx timeout [ 41.925901][ T5934] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 42.317162][ T5938] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 42.442966][ T5944] ================================================================== [ 42.442990][ T5944] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x4f3/0x5d0 [ 42.443016][ T5944] Read of size 4 at addr ffff88802bc68e3c by task syz.0.30/5944 [ 42.443029][ T5944] [ 42.443038][ T5944] CPU: 2 UID: 0 PID: 5944 Comm: syz.0.30 Not tainted syzkaller #0 PREEMPT(full) [ 42.443052][ T5944] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 42.443059][ T5944] Call Trace: [ 42.443063][ T5944] [ 42.443067][ T5944] dump_stack_lvl+0x100/0x190 [ 42.443083][ T5944] print_report+0x13d/0x4b0 [ 42.443099][ T5944] ? __virt_addr_valid+0x239/0x430 [ 42.443110][ T5944] ? dvb_frontend_release+0x4f3/0x5d0 [ 42.443120][ T5944] kasan_report+0xdf/0x1c0 [ 42.443135][ T5944] ? dvb_frontend_release+0x4f3/0x5d0 [ 42.443146][ T5944] dvb_frontend_release+0x4f3/0x5d0 [ 42.443155][ T5944] ? __pfx_dvb_frontend_release+0x10/0x10 [ 42.443166][ T5944] __fput+0x3ff/0xb50 [ 42.443186][ T5944] task_work_run+0x150/0x240 [ 42.443203][ T5944] ? __pfx_task_work_run+0x10/0x10 [ 42.443219][ T5944] ? __pfx_task_work_add+0x10/0x10 [ 42.443236][ T5944] get_signal+0x1bd/0x21e0 [ 42.443248][ T5944] ? __pfx___fput_deferred+0x10/0x10 [ 42.443264][ T5944] ? __pfx_get_signal+0x10/0x10 [ 42.443276][ T5944] ? do_raw_spin_lock+0x128/0x260 [ 42.443290][ T5944] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 42.443305][ T5944] arch_do_signal_or_restart+0x91/0x7e0 [ 42.443321][ T5944] ? find_held_lock+0x2b/0x80 [ 42.443336][ T5944] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 42.443352][ T5944] ? __x64_sys_close_range+0x3ce/0x5d0 [ 42.443369][ T5944] ? __x64_sys_close_range+0x30f/0x5d0 [ 42.443386][ T5944] exit_to_user_mode_loop+0x139/0x700 [ 42.443400][ T5944] ? rcu_is_watching+0x13/0xc0 [ 42.443416][ T5944] do_syscall_64+0x661/0x790 [ 42.443427][ T5944] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 42.443438][ T5944] RIP: 0033:0x7f721019e159 [ 42.443446][ T5944] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.443456][ T5944] RSP: 002b:00007fffb3096d88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 42.443467][ T5944] RAX: 0000000000000000 RBX: 00007fffb3096e70 RCX: 00007f721019e159 [ 42.443474][ T5944] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 42.443480][ T5944] RBP: 000000000000a541 R08: 0000000000000001 R09: 0000000000000000 [ 42.443487][ T5944] R10: 0000001b31520000 R11: 0000000000000246 R12: 00007fffb3096eb0 [ 42.443493][ T5944] R13: 00007f7210425fac R14: 000000000000a586 R15: 00007f7210425fa0 [ 42.443503][ T5944] [ 42.443506][ T5944] [ 42.443509][ T5944] Allocated by task 1: [ 42.443514][ T5944] kasan_save_stack+0x30/0x50 [ 42.443526][ T5944] kasan_save_track+0x14/0x30 [ 42.443538][ T5944] __kasan_kmalloc+0xaa/0xb0 [ 42.443550][ T5944] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 42.443560][ T5944] dvb_register_device+0x1d6/0x1e20 [ 42.443569][ T5944] dvb_register_frontend+0x552/0x820 [ 42.443578][ T5944] vidtv_bridge_probe+0x44b/0xa30 [ 42.443591][ T5944] platform_probe+0x106/0x1d0 [ 42.443601][ T5944] really_probe+0x241/0xa60 [ 42.443614][ T5944] __driver_probe_device+0x210/0x460 [ 42.443626][ T5944] driver_probe_device+0x4a/0x140 [ 42.443639][ T5944] __driver_attach+0x21f/0x5b0 [ 42.443652][ T5944] bus_for_each_dev+0x13e/0x1d0 [ 42.443661][ T5944] bus_add_driver+0x305/0x5b0 [ 42.443672][ T5944] driver_register+0x1e2/0x360 [ 42.443686][ T5944] vidtv_bridge_init+0x52/0x80 [ 42.443701][ T5944] do_one_initcall+0x11c/0x6f0 [ 42.443711][ T5944] kernel_init_freeable+0x6ea/0x7b0 [ 42.443722][ T5944] kernel_init+0x21/0x1e0 [ 42.443734][ T5944] ret_from_fork+0x730/0xd60 [ 42.443744][ T5944] ret_from_fork_asm+0x1a/0x30 [ 42.443754][ T5944] [ 42.443757][ T5944] Freed by task 5944: [ 42.443761][ T5944] kasan_save_stack+0x30/0x50 [ 42.443773][ T5944] kasan_save_track+0x14/0x30 [ 42.443785][ T5944] kasan_save_free_info+0x3b/0x70 [ 42.443794][ T5944] __kasan_slab_free+0x5f/0x80 [ 42.443807][ T5944] kfree+0x22b/0x6d0 [ 42.443814][ T5944] dvb_device_put.part.0+0x57/0x90 [ 42.443823][ T5944] dvb_generic_release+0xe2/0x160 [ 42.443832][ T5944] dvb_frontend_release+0x13d/0x5d0 [ 42.443840][ T5944] __fput+0x3ff/0xb50 [ 42.443854][ T5944] task_work_run+0x150/0x240 [ 42.443869][ T5944] get_signal+0x1bd/0x21e0 [ 42.443879][ T5944] arch_do_signal_or_restart+0x91/0x7e0 [ 42.443894][ T5944] exit_to_user_mode_loop+0x139/0x700 [ 42.443906][ T5944] do_syscall_64+0x661/0x790 [ 42.443915][ T5944] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 42.443925][ T5944] [ 42.443927][ T5944] The buggy address belongs to the object at ffff88802bc68e00 [ 42.443927][ T5944] which belongs to the cache kmalloc-256 of size 256 [ 42.443934][ T5944] The buggy address is located 60 bytes inside of [ 42.443934][ T5944] freed 256-byte region [ffff88802bc68e00, ffff88802bc68f00) [ 42.443944][ T5944] [ 42.443946][ T5944] The buggy address belongs to the physical page: [ 42.443951][ T5944] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2bc68 [ 42.443960][ T5944] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 42.443968][ T5944] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 42.443978][ T5944] page_type: f5(slab) [ 42.443986][ T5944] raw: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 [ 42.443995][ T5944] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 42.444004][ T5944] head: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 [ 42.444013][ T5944] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 42.444021][ T5944] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 42.444030][ T5944] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 42.444035][ T5944] page dumped because: kasan: bad access detected [ 42.444040][ T5944] page_owner tracks the page as allocated [ 42.444043][ T5944] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 7585803262 [ 42.444060][ T5944] post_alloc_hook+0xfd/0x120 [ 42.444068][ T5944] get_page_from_freelist+0x110d/0x35d0 [ 42.444078][ T5944] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 42.444089][ T5944] new_slab+0xa9/0x6e0 [ 42.444098][ T5944] refill_objects+0xe3/0x410 [ 42.444107][ T5944] __pcs_replace_empty_main+0x35e/0x650 [ 42.444116][ T5944] __kmalloc_cache_noprof+0x4f4/0x6d0 [ 42.444125][ T5944] bus_add_driver+0x92/0x5b0 [ 42.444136][ T5944] driver_register+0x1e2/0x360 [ 42.444150][ T5944] i2c_register_driver+0xd9/0x1f0 [ 42.444160][ T5944] do_one_initcall+0x11c/0x6f0 [ 42.444170][ T5944] kernel_init_freeable+0x6ea/0x7b0 [ 42.444197][ T5944] kernel_init+0x21/0x1e0 [ 42.444209][ T5944] ret_from_fork+0x730/0xd60 [ 42.444219][ T5944] ret_from_fork_asm+0x1a/0x30 [ 42.444229][ T5944] page_owner free stack trace missing [ 42.444233][ T5944] [ 42.444235][ T5944] Memory state around the buggy address: [ 42.444240][ T5944] ffff88802bc68d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.444246][ T5944] ffff88802bc68d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.444253][ T5944] >ffff88802bc68e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.444258][ T5944] ^ [ 42.444264][ T5944] ffff88802bc68e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.444270][ T5944] ffff88802bc68f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.444276][ T5944] ================================================================== [ 42.444294][ T5944] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 42.668653][ T5944] CPU: 2 UID: 0 PID: 5944 Comm: syz.0.30 Not tainted syzkaller #0 PREEMPT(full) [ 42.671382][ T5944] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 42.674367][ T5944] Call Trace: [ 42.675337][ T5944] [ 42.676252][ T5944] dump_stack_lvl+0x100/0x190 [ 42.677715][ T5944] vpanic+0x553/0x970 [ 42.678945][ T5944] ? __pfx_vpanic+0x10/0x10 [ 42.680322][ T5944] ? rcu_is_watching+0x13/0xc0 [ 42.681810][ T5944] ? irqentry_exit+0x24d/0xa10 [ 42.683268][ T5944] ? dvb_frontend_release+0x4f3/0x5d0 [ 42.684884][ T5944] panic+0xd1/0xe0 [ 42.686029][ T5944] ? __pfx_panic+0x10/0x10 [ 42.687371][ T5944] check_panic_on_warn.cold+0x19/0x34 [ 42.688985][ T5944] end_report.part.0+0x3a/0x90 [ 42.690452][ T5944] kasan_report.cold+0xe/0x18 [ 42.691886][ T5944] ? dvb_frontend_release+0x4f3/0x5d0 [ 42.693482][ T5944] dvb_frontend_release+0x4f3/0x5d0 [ 42.695055][ T5944] ? __pfx_dvb_frontend_release+0x10/0x10 [ 42.696770][ T5944] __fput+0x3ff/0xb50 [ 42.697996][ T5944] task_work_run+0x150/0x240 [ 42.699400][ T5944] ? __pfx_task_work_run+0x10/0x10 [ 42.700952][ T5944] ? __pfx_task_work_add+0x10/0x10 [ 42.702525][ T5944] get_signal+0x1bd/0x21e0 [ 42.704168][ T5944] ? __pfx___fput_deferred+0x10/0x10 [ 42.705905][ T5944] ? __pfx_get_signal+0x10/0x10 [ 42.707476][ T5944] ? do_raw_spin_lock+0x128/0x260 [ 42.709010][ T5944] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 42.710630][ T5944] arch_do_signal_or_restart+0x91/0x7e0 [ 42.712307][ T5944] ? find_held_lock+0x2b/0x80 [ 42.713799][ T5944] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 42.715677][ T5944] ? __x64_sys_close_range+0x3ce/0x5d0 [ 42.717326][ T5944] ? __x64_sys_close_range+0x30f/0x5d0 [ 42.718996][ T5944] exit_to_user_mode_loop+0x139/0x700 [ 42.720605][ T5944] ? rcu_is_watching+0x13/0xc0 [ 42.722082][ T5944] do_syscall_64+0x661/0x790 [ 42.723517][ T5944] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 42.725284][ T5944] RIP: 0033:0x7f721019e159 [ 42.726662][ T5944] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.732321][ T5944] RSP: 002b:00007fffb3096d88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 42.734898][ T5944] RAX: 0000000000000000 RBX: 00007fffb3096e70 RCX: 00007f721019e159 [ 42.737303][ T5944] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 42.739668][ T5944] RBP: 000000000000a541 R08: 0000000000000001 R09: 0000000000000000 [ 42.742169][ T5944] R10: 0000001b31520000 R11: 0000000000000246 R12: 00007fffb3096eb0 [ 42.744573][ T5944] R13: 00007f7210425fac R14: 000000000000a586 R15: 00007f7210425fa0 [ 42.746996][ T5944] [ 42.748542][ T5944] Kernel Offset: disabled [ 42.749828][ T5944] Rebooting in 86400 seconds.. VM DIAGNOSIS: 07:35:54 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000000 RBX=0000000000000002 RCX=ffffc9000c001000 RDX=0000000000080000 RSI=ffffffff81ff833e RDI=ffff88802a5e0000 RBP=ffff88806a641900 RSP=ffffc90004ff77a8 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000000 R12=ffffed10054bc2b3 R13=0000000000000003 R14=ffffed100d4c8321 R15=0000000000000001 RIP=ffffffff81ff8349 RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f1c9ee2f6c0 ffffffff 00c00000 GS =0000 ffff8880d5b4f000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fffb3097020 CR3=000000005a3a0000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000001000000 Opmask01=0000000001000001 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 307a79732f74656e 2f70756f7267637a ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fffb3097116 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fffb3097116 00007fffb309711c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f721023564e ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f721023568e ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f72102357f2 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7210235680 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000050 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000000000000050 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000068687 RBX=ffff88801f6bcb00 RCX=ffffffff8bd28215 RDX=0000000000000001 RSI=ffffffff8e38e957 RDI=ffffffff8c623980 RBP=ffffed1003ed7960 RSP=ffffc90000187e00 R8 =0000000000000001 R9 =ffffed100d4a67bd R10=ffff88806a533deb R11=0000000000000001 R12=0000000000000000 R13=0000000000000000 R14=1ffff92000030fc4 R15=dffffc0000000000 RIP=ffffffff8bd2674f RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d5c4f000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f75075ef2f8 CR3=000000004f034000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000008000100 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 307a79732f74656e 2f70756f7267637a ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fffb3097116 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fffb3097116 00007fffb309711c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f721023564e ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f721023568e ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f72102357f2 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f7210235680 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=000000000000002f RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85b1a0b5 RDI=ffffffff9bc75f60 RBP=ffffffff9bc75f20 RSP=ffffc900045df300 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=20666f2064616552 R12=0000000000000000 R13=000000000000002f R14=000000000000000f R15=ffffc900045df618 RIP=ffffffff85b1a0df RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000555591433500 ffffffff 00c00000 GS =0000 ffff8880d5d4f000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000001b32706ff8 CR3=000000002e06b000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000fff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffff81769cc3 ffffffff81769cc3 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0023646e65746e6f ffffffff81769cc3 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffff81ac0ffc ffffffff81ac0f85 ffffffff81ac0e13 ffffffff81ac0dd1 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000040008 0000000f0010000c ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000048437 RBX=ffff88801f6b8000 RCX=ffffffff8bd28215 RDX=0000000000000001 RSI=ffffffff8e38e957 RDI=ffffffff8c623980 RBP=ffffed1003ed7000 RSP=ffffc900001a7e00 R8 =0000000000000001 R9 =ffffed100d4e67bd R10=ffff88806a733deb R11=0000000000000001 R12=0000000000000000 R13=0000000000000000 R14=1ffff92000034fc4 R15=dffffc0000000000 RIP=ffffffff8bd2674f RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880d5e4f000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000200000c64000 CR3=000000002e878000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000fefffc00 Opmask01=0000000000000054 Opmask02=00000000000000ff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055558de98874 000055558de98870 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fcb459f2e80 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fcb459f2e80 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000003bf12 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055558de96ad8 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 797301ffffffffff ffffffdf08038003 00040001e0cd8208 000f800401c71000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00080007000c0008 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 80040008000a1000 021000080175bc03 80040880a2d39408 0001000000080606 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 011c100001800401 0000000806060101 80d60980040880a2 d3b2080001000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 080606012ae41080 040009a003006567 646972625f6f745f 316874657601ffff ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffdf08 0980030580040008 000a100002100008 0175bc0380040880 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 a2d3940800010000 00080606012ad601 f6d1a090d3cbb2a0 9b040003a0030000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 080b80031dc7bb80 8010000108000282 80e2100030808096 1000028080800800 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000