last executing test programs: 2.178810484s ago: executing program 3 (id=2553): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e0470040000"], 0x7) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) sendfile(r1, r0, 0x0, 0x3fffff) setregid(0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e23, 0x4, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f00000003c0), 0x0, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x20, @loopback, 0x1}, 0x1c) getsockopt$inet_sctp6_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f00000005c0)={0x0, 0x7, 0x7f, 0x8, 0x2, 0x7, 0x4, 0x8000, {0x0, @in6={{0xa, 0x4c21, 0x6, @empty, 0x401}}, 0x5e, 0x1ed, 0x9, 0x8}}, &(0x7f0000000680)=0xb0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000002c0), 0x40080, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000840)={{{@in=@multicast1}}, {{@in6=@mcast2}, 0x0, @in=@local}}, &(0x7f0000000400)=0xe8) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000000206010800000000000000000000003f0500010006000000050005000200000005000400000000000900020073797a310020000013000300686173683a6e65742c6966616365"], 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000005700)=ANY=[@ANYBLOB="580000000906010200000000000000000200fdff300007800c00018008000140e8000001140017006261746164765f736c6176655f3000000c00028008000140640101010900020073797a31000000000500010007"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x40c0080) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_procfs(0x0, 0x0) sendmsg$IPSET_CMD_LIST(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c00000007060500000000000000000001000002050001000700000055b6382093ee6e800356e6203be5a50744f257689307d6aaeaec67556b971767669cd740bb5b3c2b4e645b9b25d8e1ded752b8badde6408fba2cde26a3c770a73c8b06bb997450e18a5e1989b0eb8c01fa7289e84346b7b27f2674f52db8214b1e117851d869304034d29b4c752b93a71412b313fcb8622ce32d4e011a3be8ff8ccb73da0bdff042ccd898903cecf0128df632e1f97b5c589e358596d86f9aaef05b239e1addbdbf2a2651226c931799fced"], 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) syz_usb_disconnect(0xffffffffffffffff) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0001}]}) close_range(r6, 0xffffffffffffffff, 0x0) creat(&(0x7f00000004c0)='./file0\x00', 0x60) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x2301}) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) 1.969749715s ago: executing program 2 (id=2557): r0 = gettid() mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0x20000000, 0x4000000000003, 0x2, @thr={0x0, 0x0}}) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x2002) readv(r1, &(0x7f0000001980)=[{&(0x7f0000000580)=""/221, 0xdd}], 0x1) 1.919728953s ago: executing program 2 (id=2558): r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000380)={0x1d, r1, 0x2, {0x2, 0x0, 0x2}}, 0x18) sendmmsg(r0, &(0x7f0000002700)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000400)="5afe90520e63b0433e652ba72e743a8d38050a4c13b0e1181025ec1ecedc90482c3f4ae930c4bb341dd8256b023360064ab0687a9a06731982b2ebef8e012038184e082def73894e5e3c0a5ee3504ab1c2414f357f97becba97ceb13645958038ff792e6c7ebc93b2d1aefb0783edce1ff815ecc910b5a90a1762ddac80870f66412012dbd5584424e9c89810481f765fabdbc1879ccd10948e77889c3001d20e82a9ea494e7c4853165c0c3b1415ef09ba751309c191225b0994cb56a5db12573967f0edd140428e926f022f3a486d675b4738eb4695604d5f7288668b84324738ae13433ea1bd21b94be041672e815171ee7695c9021df04d37c0d493de3fd9b393e00f1a116a00b899128f80f358e60bd54be2d445d37566829381dc9fa4d722f82d22551df897d6910eaee766afe4e182264835ced2b130a1a02730b5fde8478bfd8e58340efcfc090eed9bc930114d5b0fb524fbd855a00b89194c680300742f9546f62da6d223aea59ff777ccc59075d2cf6d8f45d4ab27ea6e0cf7542e05096c766a07976d20ce1088fd59ddf094d6145747a256d664c929751c55438dd79162e5a5ab5fdba9f2371d7f086d9498d64cbd042f419a7b5d61934fef80a61408ee193eae2ead3d60cd6fd4781b6bf52eff6207f36f58e59b20f15d64947219ebd2de1af40ad54a98bcd34f555e31aa1d819152135f4d4de86ee2e0810bc212bffe752c25e9ac1794998d2d4faab101d5d21d85e5ca67635c8d1791ee5b04d5597cfa7d3f78ea036c808c40ffa8ea7820dedd63a689539501df9ebc111b9c9f7f6f5e0c462414c485609f07c8ce986d97688cf8a6430d0f7348d3af69beeffa527be5e0293fbeb86a8e605cf54b935128f0d04507aea930f59b9368fbfa90ba3f18df1b10d1236701d81d941d5c0f249cb31cddab9fc29bdfc6f09af0eb62d127b51b8fec883a970aa76e79c7617792cae95c618255e7aa6b388ca2ff315d0dc732cb7997d223496654f5810dff78bc00c20ecee7b836100b0d4df6e3ee6c8c180ad4ba4c1859118dab6910c3b4305ddb736fab3b98994cc324fce51163d0eb8456d00daa6675a95a237308cf9ab64735c9b0164e80e330e2eb3f684fa6d418f2b3b36dd8745cd6757bc7600f55b65c0e34c39fdd8cc86c8bd31c008336e1889b740d8f10c832af854346bd3d628d7b160538602a36715c956a046d4792823c4d9682ae62b70ba61202c9d7085fcab53635503bc3ae96415bec5b0001cc7e8b7e5b45ee4d9f754a3f94730a08e0ec22e0774eadfdd201d5072918c38205938b221b0b40ec988bcbaabd52c9db0228bde0dcda17684238461013f3d68cc7e5a73811ef7a08648996500b2ff47fb4c1d2d096905acf7c8d4b33c461ecd52c048228773c066644d9042093fa97c4d47332a07f427711228d124af2c7be64419bc1b0c1190afb17328b83d093f542b60cb738416aff5f44e1c31aed63629965bebf254f086e34fbbe540e52cfb773ababf30854cba6dd2159f7f766c92bf4717f922eec5fc79aa2c761296f12716ec4d0ff1a2cc610ee5e162b0e7823d7b90f853d799b316e49c65e05e612875417f8a4580e6b2c7868ca1a58233994b8320d25142230b29fa4bda1f2d1d82d5aa8ec349f5a5bbefc7791347719ce50941595705b824e7384d202a697359620e1922a633af3bf13b183f9980f147e6ccc78bafc8b39c6bd034716fa92c48070e91220290e981856e728b1957f21e3642bef007f00ebbfa1b13bf2d38f2341687f48e450a1453554e7a628d0a8db213efb7337b59af7bbff3f0f5bb987b9a97c8f2fdbe456bb1d329b60e2b1adc400739336afb3d3ea03caf2d1728e4828007e71621211bf81241de0266b0bc9514c49a395e027c3fddd1f07bf2642e7a360879ce024cf5b058e878b5023ff8a86164433e54fb06555ea3a70875407605e8170e3727f56baf739a18fef3d0730e1258ac6faec01971bb1c8f4ecb5909fd3ea99a41de8693348e5c0801c7d1a3dd5fdd8b0819a74c00367eacfc4ba30c9ca608b9e0693108660caae9dcb435f3bf14a0368841456b0c1865d76689f9fba11ee55652c336032b099f270a1ed68467f2f8082a580aba769edf69486adfbd503a4ed6d0cdb235f882a5d9f933dc7daa84c14fa74dc6f82bc5076417021f47b662deb09fdabf59667c1d357714791c9abbd70095705732c689a973b0fea8901a8f3f4f3480872946a8a5e9a6f5ecdb21c89ed539d76a44a26cd3a8424ff7f2c6d5bd41e881922d8334054202a3c388dda6b2eebee8bf6801c1e99829292bf735b2a1b96e9e1f6e8a6b0d989b56927125db1f41a59213e7c09ffa7d67b9d810583a0ed0e62a6ef19ebd758a62646ad9806ad169e158d8a882f98ad6b32e3de33ace86f477562898efcd988c92ddae54f31ee38349d9bd08a21a228f8641949355e789e1b51286c651bedfeb64082f7c2f3b6969772414782636329a72e53d03a2eac7a396eea2005f328da7e35cb2515936438f3028d36b59e0bbf2f9239d50d70c92db714d8176331c0120a3b183118f9c2fa63c4ea273f6d24c51a7e6bda665a2c96922980141b34cf81cffc9559baf51d1fe3f3c7096e441c3b8a8d32dde10385092637ee17e97f8ba4d0bd05a84a4d9c5757464da41a94227f637be3c3f23756fa5eb7d2d2a1ad5eb9fa7544308373debd42469dc5d0fc71b3aafc33b15f12dc23562c6ad0bfa027dfce417766e241dd5472ee9a6aece70adf17cc692e41088e4a06b2e4d89016b723fd9f326e6449e11c548725c7ef69274a102d354b33d0b2d1aaa3e456d7b3c32208256b5a3a6ad94f990762bf8816e4e2db7be112cbbd9d5aa48fdb84907833f346144881a638075d0bc3e3ba237dedf8af387684ef861ef23f96131397704ca97a72f175c6478431a1cb6b98d8e99f468a99dad252f75f3816a7252ce7c96fa57707d6b25995daaf4c12d5278e093b64186df86a6d5fd27a2cbf2716819891bbdec8451d762d187f7e02a770c449f5dd2502a1710e7838a644f33be41bdc6789f0ab1dbd6fbfb75041543aff4b4c3489c9e4fe55e97778c2054ab932306b5b0c1309b9f5dde9002fc0dcc0b5078cdaac04bdb0a3c44e25ebec8c01729e3d4b2b095404f708bc376a2882a974f4bea049b6805ea5c98e658806368e1e7ea042a0ff894447a8f5c4cd2acbd26050d75ba99da5b660edeb47d7a23ff67cab5f7f9b091229791968d42b70321a63b43925af3629f27c2e9e974ed26e4d62a6fcf6a7167a1dc5c6ddbe539fdb769d3549a9350d93bc26c44ed5af82ca37c0a4c6d845870d919dc6098df6aa67feb7905ae306c3dad810e10600041e3632db2aa6e3a9a9d3830e0dc188d58ca9f5dcb49d47c15e08ad428e4f5acf84561a0aa2945bf0083d43ba7ac1629c6b3f2a7b4130a182085c7584079c464989c17846341addf4765f4ea94af6975cb5cc5427764c96e58955d7aaf952e23667bee4ba248321bb590a560ae160958d322a301c06c0bcaea6ed27f73e6fa686220b655b125378aabf0ac0d229984ba7cea40c5f0ae053fdad333aa36a75292af995ac921088b719eb150c98b2bb4fcab64c9ae363a63e975772407a81a7b2dade551aaa8a6b5d233e688856c61fbaebd608363cdbce4716c45bc5519679af68f774224e50f86ba15a68edf6819d8e7ea6f579bfe799a9b3c168205d4b5364327685fc8f3fc45e292b1c6c8e48e8531bc7f1e06659089f82d2105872942cc3c87b9fbd9d5cf136c2344f8e738a1270fc9aefeef2e431dad699e31f96a1ca098933905c0234b0d62889df1edf19e23b926c5ef8f64f6f7ee6626ec9ac092d70b41bdce2e5b0180865adce635dd811c250490f2fb8f42a5056be0a8b64731a16da807e0e4bf86e5aad49c49a97a6e5bfe7ea5cfab09746dd328fbd50aa49926a50f287d63cba55ec76f76739188c7aa4e9f7ba4aa41efb24bbd7abb8d0d6d8972c56b7bf3910aed147fb6c694926b901db6d77da1f593aa503a38d1e41e52ba7b1225416b4ed2e7f469018936e475b46da34d9e48315bc92095710d9cbd1d97530aead62251f6724b2c5eae139c61f8ed46480f9a0c8557384531d889b2ce027358a155487635fafb5fcffd61f50427053a3e23cf2d6f6363455f07642b26fb203b6d2b093c9cc8761e43b70d5a03fb0b3f13247ec6d27b7a9f361ffffd529e649c8af3a13ad231918b9e57cd77d9202fd6e01b9a772f7d9667e5b10f19d22e146b66319d25d501a6893f1b4f635e5b67219aae95f8c99f05309cf58a223fd2f49b952a32ecb754b5391ce66ab90d0ff201d56af4c89513b65dcdf02227b6eb10ca8ec647f2740a68dc63db6aa416c55c94686c3c609cd5d8825136397a8dd3f33d6c2c2ec62d1d5641e746f37ea20d366553eb32195411c2c89dabc0de36076307fd16bf50bccc68d1e53a98c8711942b8d4980c5db4e0e8c25165572d178fa5d398f3b741c2578a1fcdb644eaad7dc0d3db0523055aa667401c2416c98ffbb77d7c6309deb32a790ad43e707e040ee68f93092a83d737048da0488cc3904622749fdb177b0bb50d2b65ff038e83845be3ba905831c4cb5fb39026800f4316a7e9d2b9f16a8a9ba1db5fcceab041e2f8c36a555fe143836b44ba39866b03f7efa0275bd1e0052c27a32289e72845f9f9b98a258f29e4a5badc25b7a6fc901951b0d003c5f5491c6e934303cea443dcefa1bc8a5689987976488419229c45846d64754d2cc24547aa75ccfab1a8d68b51990d1836a33400455116f1ea8ca4471d5fe2b6b7d8781c81383b2e33888885a7dfaba757af03088ae28d73470551e4deae34c829174ac85f9e88e6f7c2be35457d5039e94aec1392c3f0b2d596a4288fe5154753f5ed4f0f68ca52088c7dfd9e041bc59564a8d4bfea1771fb8d155819d066b65a21f52264623bb4e5edbb7d8d6b8339e89cd343fa3f03eeb1d291f6dcfd3903068d2cc02a2eb1f21b85364950e60ca1e760cdeee100e2c4f711ac611e65ef7392fcaab9a1aefcc79389670e3702c5a621a35c80cc5dc221873ac7aa9683ad2b60625a76305934f22f7f1cc0ef31cb6b7bf572df845344531ca1d2584755d25aaf2b8b3f02b564d37c81f7ada608120a45f6614a77466a571cf17aca27e7c34004edf7e939623781abf89c9749f2c9d67e4dec2f794f285e55ea73994f36a5f29accb96be4edbdf8175ecbae78461b7028c6ed224bb1d4c2608496b173b2aa7e0016684254790ae33177a4db8de2d04760a807af17ac148b303f94e1049b1adb15523010a5a524b0396da65810ee6872130f02dee5b5c892e2fd7d6151265e3b7baaf45e62c8f548d95e4f51cab8025d09613394004752c7bbab80edc6cc4a16809a8b46f9b53e5342fc1f92f1b16e1af66934ae4642f7888b23d08a82d6dedd222c5869ab325cc6af0bbe228d5114055d242db929c180b5027395c4a9c2ebbcd5069113bae4202e045e83ca1cb1ab323cf2aef784bcefea3f7f79e74dcd63e3ea4b2289ee99d0517f62ea7484b10d5369e993b2c65f19de7e3c11ed471af68fcbc86a5bc2bc52f70299c6623a0cc0fb7c33452fb46806e0945de33912ee9447336e0e979718ac866a3710e84b80cae1223416ae946b6bf470d6bfc13b70998820d9c489e752da4813b9c43bc0b042728a195abbf333186cb68b51840645b6928a5ed7627d6e9bc055a132c2dea15f478667bd8621537bcadf7e87df36dfff5652f6b042fdcb995b5438a81ef2e292df7a", 0x1000}], 0x1}}], 0x1, 0x4040040) 1.628773861s ago: executing program 0 (id=2559): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f0000000080)="b805000000090200e1490000320f01d9660ff7e31bf7ecec05000000b90000c0fe0fae41dcb50400000000b9800000c00f320908660fc7b20a0000000f300f0826f30fc7b205000000660fc775022e0ffa600c980f320f3566b85700", 0x5c}], 0x1, 0x17, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, 0x0}], 0x1, 0x6bb6c4a5b2d35090, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 2) 1.499861807s ago: executing program 1 (id=2562): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000940)=0x9, 0x4) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) sendmmsg$alg(r4, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c1da69fa672c4f5eb15788aa929e9f5c94e443cf68a1759ee805958a7c76c8c7f11a39ea32c019c2f2c8cce48d92d659f623081974c0135dc1fe2a057f725", 0x74}], 0x1, 0x0, 0x0, 0x40800}], 0x1, 0x48040) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x4, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0x7, &(0x7f0000000300)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r6}, @generic={0xbf, 0x4, 0xa}, @generic={0x7, 0x4, 0x0, 0x0, 0xfffffff8}, @generic={0xb7, 0x5, 0x0, 0x0, 0x8}, @generic={0x85, 0x0, 0x0, 0x0, 0x19}, @generic={0x95}], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r7, 0x0, 0xe, 0x0, &(0x7f0000000500)="11223344556677889900aabbccdd", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r8 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{0x0}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) 1.399379s ago: executing program 3 (id=2563): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$sg(&(0x7f0000005980), 0x0, 0x80201) write(r1, &(0x7f00000002c0)="19718f3d24000000a50c0000ed4a46b1ca9534b61f6aff497b583a578124db953db7a8c61275b693e0ed", 0x2a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x4200, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2500, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000c00000/0x400000)=nil) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000040)={[0xfffffffffffffffb, 0x0, 0x34a30b42, 0x7, 0x1000, 0x8000, 0x8000000001002, 0xfffffffffffffffc, 0x4, 0x6, 0x2, 0x2372, 0x8bda, 0xfffffffffffffefe, 0x7f, 0x20], 0x25000, 0x216156}) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r6, 0x4068aea3, &(0x7f0000000240)={0x8f, 0x0, 0x2}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x0, 0x43, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000000640)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)="82", 0x1}, {&(0x7f0000000140)='\x00', 0x1}], 0x2}}, {{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000500)="f6ae", 0x2}], 0x20}}], 0x2, 0x4404c880) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$sock_ifreq(r9, 0x8971, &(0x7f0000000080)={'virt_wifi0\x00', @ifru_hwaddr=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r8, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="cf042bbd7000fedbdf251200000008000300", @ANYRES32=r11, @ANYBLOB="0a000600ffffffffffff00000600b5003207000034065c622532adfed383c278cd7275225444794e2fae0602f2a62a451b880e56d2e83c1f24b5d9151e63b0b470a9a795c2613e9350f23ca5d4d47181ac1e84306b56659f44b0d25e609275b90ae1bc8387e2cc5d44f812e6f6a544ac2ed5b0a11de90b8170a5be882773d206f66e0005d2f0651b4de6c6dcd77b104c500b5e6baee8cc3ff9e6cb484e1c1b9cdc66c9a8411bf8f9d025fef3499c4f7e2e"], 0x30}, 0x1, 0x0, 0x0, 0x8c4}, 0x0) 1.320127756s ago: executing program 1 (id=2564): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x8, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0x3}, {}, {0xfff3, 0x10}}}, 0x24}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20004015) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f00000000c0)=@in={0x2, 0x270f, @rand_addr=0x64010101}, 0x10) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0xe0) 1.319877284s ago: executing program 3 (id=2565): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f0000000080)="b805000000090200e1490000320f01d9660ff7e31bf7ecec05000000b90000c0fe0fae41dcb50400000000b9800000c00f320908660fc7b20a0000000f300f0826f30fc7b205000000660fc775022e0ffa600c980f320f3566b85700", 0x5c}], 0x1, 0x17, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, 0x0}], 0x1, 0x6bb6c4a5b2d35090, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.248904526s ago: executing program 1 (id=2566): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x8) ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(0xffffffffffffffff, 0x4068aea3, &(0x7f00000001c0)={0xed, 0x0, 0x4}) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="04"], 0x8) socket(0x2, 0x80805, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@mcast1, 0xffffffff, 0x0, 0x2, 0x2, 0x9, 0xf}, 0x20) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0x90}) ioctl(r1, 0x8b32, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0) openat$pmem0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/nd/drivers/nd_pmem/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='namespace0.0\x00', 0xc) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/nd/drivers/nd_pmem/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000340)='namespace0.0\x00', 0xc) 1.007424514s ago: executing program 1 (id=2567): r0 = socket(0x10, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e23, 0xd, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x5d}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000480)=@gcm_256={{0x303}, "000200", "e123c5876ff425b1ebe250a8486be34705f4f827ae60ecb65e528248d5552bff", "7e25837b", "15d0db2c77179e1a"}, 0x38) r2 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_DISEQC_SEND_BURST(r2, 0x6f41, 0x0) write$binfmt_script(r1, &(0x7f0000000500)={'#! ', './file0'}, 0xb) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000280)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd87}, &(0x7f0000000240)=0x40) write$P9_RWSTAT(r1, &(0x7f0000000080)={0x7, 0x7f, 0x2}, 0x7) close_range(r0, r1, 0x0) 938.855415ms ago: executing program 1 (id=2568): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000340)="0a000300011400", 0x7) 938.657947ms ago: executing program 1 (id=2569): r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000380)={0x1d, r1, 0x2, {0x2, 0x0, 0x2}}, 0x18) sendmmsg(r0, &(0x7f0000002700)=[{{0x0, 0x0, &(0x7f0000002a80)=[{&(0x7f00000003c0)="9d", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000400)="5afe90520e63b0433e652ba72e743a8d38050a4c13b0e1181025ec1ecedc90482c3f4ae930c4bb341dd8256b023360064ab0687a9a06731982b2ebef8e012038184e082def73894e5e3c0a5ee3504ab1c2414f357f97becba97ceb13645958038ff792e6c7ebc93b2d1aefb0783edce1ff815ecc910b5a90a1762ddac80870f66412012dbd5584424e9c89810481f765fabdbc1879ccd10948e77889c3001d20e82a9ea494e7c4853165c0c3b1415ef09ba751309c191225b0994cb56a5db12573967f0edd140428e926f022f3a486d675b4738eb4695604d5f7288668b84324738ae13433ea1bd21b94be041672e815171ee7695c9021df04d37c0d493de3fd9b393e00f1a116a00b899128f80f358e60bd54be2d445d37566829381dc9fa4d722f82d22551df897d6910eaee766afe4e182264835ced2b130a1a02730b5fde8478bfd8e58340efcfc090eed9bc930114d5b0fb524fbd855a00b89194c680300742f9546f62da6d223aea59ff777ccc59075d2cf6d8f45d4ab27ea6e0cf7542e05096c766a07976d20ce1088fd59ddf094d6145747a256d664c929751c55438dd79162e5a5ab5fdba9f2371d7f086d9498d64cbd042f419a7b5d61934fef80a61408ee193eae2ead3d60cd6fd4781b6bf52eff6207f36f58e59b20f15d64947219ebd2de1af40ad54a98bcd34f555e31aa1d819152135f4d4de86ee2e0810bc212bffe752c25e9ac1794998d2d4faab101d5d21d85e5ca67635c8d1791ee5b04d5597cfa7d3f78ea036c808c40ffa8ea7820dedd63a689539501df9ebc111b9c9f7f6f5e0c462414c485609f07c8ce986d97688cf8a6430d0f7348d3af69beeffa527be5e0293fbeb86a8e605cf54b935128f0d04507aea930f59b9368fbfa90ba3f18df1b10d1236701d81d941d5c0f249cb31cddab9fc29bdfc6f09af0eb62d127b51b8fec883a970aa76e79c7617792cae95c618255e7aa6b388ca2ff315d0dc732cb7997d223496654f5810dff78bc00c20ecee7b836100b0d4df6e3ee6c8c180ad4ba4c1859118dab6910c3b4305ddb736fab3b98994cc324fce51163d0eb8456d00daa6675a95a237308cf9ab64735c9b0164e80e330e2eb3f684fa6d418f2b3b36dd8745cd6757bc7600f55b65c0e34c39fdd8cc86c8bd31c008336e1889b740d8f10c832af854346bd3d628d7b160538602a36715c956a046d4792823c4d9682ae62b70ba61202c9d7085fcab53635503bc3ae96415bec5b0001cc7e8b7e5b45ee4d9f754a3f94730a08e0ec22e0774eadfdd201d5072918c38205938b221b0b40ec988bcbaabd52c9db0228bde0dcda17684238461013f3d68cc7e5a73811ef7a08648996500b2ff47fb4c1d2d096905acf7c8d4b33c461ecd52c048228773c066644d9042093fa97c4d47332a07f427711228d124af2c7be64419bc1b0c1190afb17328b83d093f542b60cb738416aff5f44e1c31aed63629965bebf254f086e34fbbe540e52cfb773ababf30854cba6dd2159f7f766c92bf4717f922eec5fc79aa2c761296f12716ec4d0ff1a2cc610ee5e162b0e7823d7b90f853d799b316e49c65e05e612875417f8a4580e6b2c7868ca1a58233994b8320d25142230b29fa4bda1f2d1d82d5aa8ec349f5a5bbefc7791347719ce50941595705b824e7384d202a697359620e1922a633af3bf13b183f9980f147e6ccc78bafc8b39c6bd034716fa92c48070e91220290e981856e728b1957f21e3642bef007f00ebbfa1b13bf2d38f2341687f48e450a1453554e7a628d0a8db213efb7337b59af7bbff3f0f5bb987b9a97c8f2fdbe456bb1d329b60e2b1adc400739336afb3d3ea03caf2d1728e4828007e71621211bf81241de0266b0bc9514c49a395e027c3fddd1f07bf2642e7a360879ce024cf5b058e878b5023ff8a86164433e54fb06555ea3a70875407605e8170e3727f56baf739a18fef3d0730e1258ac6faec01971bb1c8f4ecb5909fd3ea99a41de8693348e5c0801c7d1a3dd5fdd8b0819a74c00367eacfc4ba30c9ca608b9e0693108660caae9dcb435f3bf14a0368841456b0c1865d76689f9fba11ee55652c336032b099f270a1ed68467f2f8082a580aba769edf69486adfbd503a4ed6d0cdb235f882a5d9f933dc7daa84c14fa74dc6f82bc5076417021f47b662deb09fdabf59667c1d357714791c9abbd70095705732c689a973b0fea8901a8f3f4f3480872946a8a5e9a6f5ecdb21c89ed539d76a44a26cd3a8424ff7f2c6d5bd41e881922d8334054202a3c388dda6b2eebee8bf6801c1e99829292bf735b2a1b96e9e1f6e8a6b0d989b56927125db1f41a59213e7c09ffa7d67b9d810583a0ed0e62a6ef19ebd758a62646ad9806ad169e158d8a882f98ad6b32e3de33ace86f477562898efcd988c92ddae54f31ee38349d9bd08a21a228f8641949355e789e1b51286c651bedfeb64082f7c2f3b6969772414782636329a72e53d03a2eac7a396eea2005f328da7e35cb2515936438f3028d36b59e0bbf2f9239d50d70c92db714d8176331c0120a3b183118f9c2fa63c4ea273f6d24c51a7e6bda665a2c96922980141b34cf81cffc9559baf51d1fe3f3c7096e441c3b8a8d32dde10385092637ee17e97f8ba4d0bd05a84a4d9c5757464da41a94227f637be3c3f23756fa5eb7d2d2a1ad5eb9fa7544308373debd42469dc5d0fc71b3aafc33b15f12dc23562c6ad0bfa027dfce417766e241dd5472ee9a6aece70adf17cc692e41088e4a06b2e4d89016b723fd9f326e6449e11c548725c7ef69274a102d354b33d0b2d1aaa3e456d7b3c32208256b5a3a6ad94f990762bf8816e4e2db7be112cbbd9d5aa48fdb84907833f346144881a638075d0bc3e3ba237dedf8af387684ef861ef23f96131397704ca97a72f175c6478431a1cb6b98d8e99f468a99dad252f75f3816a7252ce7c96fa57707d6b25995daaf4c12d5278e093b64186df86a6d5fd27a2cbf2716819891bbdec8451d762d187f7e02a770c449f5dd2502a1710e7838a644f33be41bdc6789f0ab1dbd6fbfb75041543aff4b4c3489c9e4fe55e97778c2054ab932306b5b0c1309b9f5dde9002fc0dcc0b5078cdaac04bdb0a3c44e25ebec8c01729e3d4b2b095404f708bc376a2882a974f4bea049b6805ea5c98e658806368e1e7ea042a0ff894447a8f5c4cd2acbd26050d75ba99da5b660edeb47d7a23ff67cab5f7f9b091229791968d42b70321a63b43925af3629f27c2e9e974ed26e4d62a6fcf6a7167a1dc5c6ddbe539fdb769d3549a9350d93bc26c44ed5af82ca37c0a4c6d845870d919dc6098df6aa67feb7905ae306c3dad810e10600041e3632db2aa6e3a9a9d3830e0dc188d58ca9f5dcb49d47c15e08ad428e4f5acf84561a0aa2945bf0083d43ba7ac1629c6b3f2a7b4130a182085c7584079c464989c17846341addf4765f4ea94af6975cb5cc5427764c96e58955d7aaf952e23667bee4ba248321bb590a560ae160958d322a301c06c0bcaea6ed27f73e6fa686220b655b125378aabf0ac0d229984ba7cea40c5f0ae053fdad333aa36a75292af995ac921088b719eb150c98b2bb4fcab64c9ae363a63e975772407a81a7b2dade551aaa8a6b5d233e688856c61fbaebd608363cdbce4716c45bc5519679af68f774224e50f86ba15a68edf6819d8e7ea6f579bfe799a9b3c168205d4b5364327685fc8f3fc45e292b1c6c8e48e8531bc7f1e06659089f82d2105872942cc3c87b9fbd9d5cf136c2344f8e738a1270fc9aefeef2e431dad699e31f96a1ca098933905c0234b0d62889df1edf19e23b926c5ef8f64f6f7ee6626ec9ac092d70b41bdce2e5b0180865adce635dd811c250490f2fb8f42a5056be0a8b64731a16da807e0e4bf86e5aad49c49a97a6e5bfe7ea5cfab09746dd328fbd50aa49926a50f287d63cba55ec76f76739188c7aa4e9f7ba4aa41efb24bbd7abb8d0d6d8972c56b7bf3910aed147fb6c694926b901db6d77da1f593aa503a38d1e41e52ba7b1225416b4ed2e7f469018936e475b46da34d9e48315bc92095710d9cbd1d97530aead62251f6724b2c5eae139c61f8ed46480f9a0c8557384531d889b2ce027358a155487635fafb5fcffd61f50427053a3e23cf2d6f6363455f07642b26fb203b6d2b093c9cc8761e43b70d5a03fb0b3f13247ec6d27b7a9f361ffffd529e649c8af3a13ad231918b9e57cd77d9202fd6e01b9a772f7d9667e5b10f19d22e146b66319d25d501a6893f1b4f635e5b67219aae95f8c99f05309cf58a223fd2f49b952a32ecb754b5391ce66ab90d0ff201d56af4c89513b65dcdf02227b6eb10ca8ec647f2740a68dc63db6aa416c55c94686c3c609cd5d8825136397a8dd3f33d6c2c2ec62d1d5641e746f37ea20d366553eb32195411c2c89dabc0de36076307fd16bf50bccc68d1e53a98c8711942b8d4980c5db4e0e8c25165572d178fa5d398f3b741c2578a1fcdb644eaad7dc0d3db0523055aa667401c2416c98ffbb77d7c6309deb32a790ad43e707e040ee68f93092a83d737048da0488cc3904622749fdb177b0bb50d2b65ff038e83845be3ba905831c4cb5fb39026800f4316a7e9d2b9f16a8a9ba1db5fcceab041e2f8c36a555fe143836b44ba39866b03f7efa0275bd1e0052c27a32289e72845f9f9b98a258f29e4a5badc25b7a6fc901951b0d003c5f5491c6e934303cea443dcefa1bc8a5689987976488419229c45846d64754d2cc24547aa75ccfab1a8d68b51990d1836a33400455116f1ea8ca4471d5fe2b6b7d8781c81383b2e33888885a7dfaba757af03088ae28d73470551e4deae34c829174ac85f9e88e6f7c2be35457d5039e94aec1392c3f0b2d596a4288fe5154753f5ed4f0f68ca52088c7dfd9e041bc59564a8d4bfea1771fb8d155819d066b65a21f52264623bb4e5edbb7d8d6b8339e89cd343fa3f03eeb1d291f6dcfd3903068d2cc02a2eb1f21b85364950e60ca1e760cdeee100e2c4f711ac611e65ef7392fcaab9a1aefcc79389670e3702c5a621a35c80cc5dc221873ac7aa9683ad2b60625a76305934f22f7f1cc0ef31cb6b7bf572df845344531ca1d2584755d25aaf2b8b3f02b564d37c81f7ada608120a45f6614a77466a571cf17aca27e7c34004edf7e939623781abf89c9749f2c9d67e4dec2f794f285e55ea73994f36a5f29accb96be4edbdf8175ecbae78461b7028c6ed224bb1d4c2608496b173b2aa7e0016684254790ae33177a4db8de2d04760a807af17ac148b303f94e1049b1adb15523010a5a524b0396da65810ee6872130f02dee5b5c892e2fd7d6151265e3b7baaf45e62c8f548d95e4f51cab8025d09613394004752c7bbab80edc6cc4a16809a8b46f9b53e5342fc1f92f1b16e1af66934ae4642f7888b23d08a82d6dedd222c5869ab325cc6af0bbe228d5114055d242db929c180b5027395c4a9c2ebbcd5069113bae4202e045e83ca1cb1ab323cf2aef784bcefea3f7f79e74dcd63e3ea4b2289ee99d0517f62ea7484b10d5369e993b2c65f19de7e3c11ed471af68fcbc86a5bc2bc52f70299c6623a0cc0fb7c33452fb46806e0945de33912ee9447336e0e979718ac866a3710e84b80cae1223416ae946b6bf470d6bfc13b70998820d9c489e752da4813b9c43bc0b042728a195abbf333186cb68b51840645b6928a5ed7627d6e9bc055a132c2dea15f478667bd8621537bcadf7e87df36dfff5652", 0xff0}], 0x1, &(0x7f0000001540)=[{0x50, 0x118, 0x1fc, "44853fa8b12b30cb8139cacb21b5df59778123135230fc44ec52a6758820605eefaa11ff2c36ac42835a14c2072760ff5aa5c7ef1156ca9be81aadba0cbd"}, {0xb8, 0x1, 0x8, "87b06526cbca7bd73eca714ed915d9daf3a8f28454428b716d53d31b9ef7fa6ce892cb5323245d7cc61fe59f3aa26e47bb2782b2f5cce46da8e8ee2752f0eb145f42b1539e261ca76295f2929d0910a645301086c8f095b2e0b0762043776b634a699ad20b373b92e37d89858bb055bcf25fa5c40acf5b78155262d3cf3614cd1b9f0ebf633ea262d5fef704d5037b02db735856a509e324601da71faf54ee2b625987eadd622a"}, {0x78, 0x2d, 0x7, "cbfa2a07b2c9f8e98d2032611f0f847439a8ae92c08daebb4cb85f69e84d670f193bbfd89b3455d49e26406a4294749d3e7d6b20a783024495845b8f4739c3e38d1aca596a845f24da5dfc7f48c18c662d4808c177ebf80bb7abdd5e55d9afa047dfea996a7a0d"}], 0x180}}, {{0x0, 0x0, 0x0}}], 0x3, 0x4040040) 868.653823ms ago: executing program 2 (id=2570): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @multicast1}, 0x2}}, 0x2e) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f00000000c0), r4) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000880)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d0019feffe69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb46c4c0a285057e3061b9781e", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000140)=""/62, 0x3e}, {&(0x7f00000004c0)=""/172, 0xe8}, {&(0x7f0000000d00)=""/4142, 0x102e}, {&(0x7f0000000c00)=""/205, 0xcd}, {&(0x7f0000000900)=""/160, 0xa0}, {&(0x7f00000007c0)=""/176, 0xb0}, {&(0x7f00000003c0)=""/186, 0xba}, {&(0x7f0000000700)=""/187, 0xbb}, {&(0x7f0000000180)=""/22, 0x13}], 0x9}, 0x10040) recvmsg$kcm(r3, &(0x7f0000000bc0)={0x0, 0x0, 0x0}, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r6 = getpgid(0x0) syz_open_procfs(r6, &(0x7f0000000240)='syscall\x00') r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x14, r5, 0x1, 0x1070bd2c, 0x4, {0x5}}, 0x14}}, 0x20) sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)={0x14, r5, 0x325, 0x0, 0x0, {0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 778.403428ms ago: executing program 2 (id=2571): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0xf00000000000000) 778.05148ms ago: executing program 0 (id=2572): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000940)=0x9, 0x4) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) sendmmsg$alg(r4, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c1da69fa672c4f5eb15788aa929e9f5c94e443cf68a1759ee805958a7c76c8c7f11a39ea32c019c2f2c8cce48d92d659f623081974c0135dc1fe2a057f725", 0x74}], 0x1, 0x0, 0x0, 0x40800}], 0x1, 0x48040) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x4, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0x7, &(0x7f0000000300)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r6}, @generic={0xbf, 0x4, 0xa}, @generic={0x7, 0x4, 0x0, 0x0, 0xfffffff8}, @generic={0xb7, 0x5, 0x0, 0x0, 0x8}, @generic={0x85, 0x0, 0x0, 0x0, 0x19}, @generic={0x95}], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r7, 0x0, 0xe, 0x0, &(0x7f0000000500)="11223344556677889900aabbccdd", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r8 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{0x0}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) 609.580451ms ago: executing program 2 (id=2573): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mnt/module/block2mtd/parameters/block2mtd\x00', &(0x7f00000002c0)='hugetlbfs\x00', 0x140009, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/midi2.usb0/iface_name\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='my_midi_interface\x00', 0x12) ioprio_get$pid(0x2, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xe) mlock(&(0x7f000001a000/0x2000)=nil, 0x2000) mkdir(&(0x7f0000000040)='./mnt\x00', 0x15f) mount(0x0, &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./mnt/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r2, &(0x7f0000000200)="b82ca87fbf4ddfc9253795f9139cb364f7ab4483630f1b7e37d7d2dcb8e65f3c5003654435b055e458ebf622badce086c6fed3f09ef56fa6df8d8c745acb91d5f1966285012cc805480eb6db1dcbdcdc702ec4b32c", 0x55) mprotect(&(0x7f00007d2000/0x4000)=nil, 0x4000, 0x6) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'hsr0\x00'}) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xf544398c67135bf7, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000005, 0x38011, r4, 0x3811a000) fcntl$setown(r1, 0x8, r0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2) r5 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fsmount(r5, 0x0, 0x2) r6 = landlock_create_ruleset(&(0x7f0000000040)={0x2b, 0x1}, 0x18, 0x0) landlock_restrict_self(r6, 0xa) syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000140)={'gretap0\x00'}) getpid() 517.628834ms ago: executing program 0 (id=2574): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x8, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0x3}, {}, {0xfff3, 0x10}}}, 0x24}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20004015) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f00000000c0)=@in={0x2, 0x270f, @rand_addr=0x64010101}, 0x10) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0xe0) 516.6986ms ago: executing program 0 (id=2575): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x8) ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(0xffffffffffffffff, 0x4068aea3, &(0x7f00000001c0)={0xed, 0x0, 0x4}) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="04"], 0x8) socket(0x2, 0x80805, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@mcast1, 0xffffffff, 0x0, 0x2, 0x2, 0x9, 0xf}, 0x20) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0x90}) ioctl(r1, 0x8b32, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/nd/drivers/nd_pmem/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='namespace0.0\x00', 0xc) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/nd/drivers/nd_pmem/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000340)='namespace0.0\x00', 0xc) 369.085813ms ago: executing program 2 (id=2576): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r0, &(0x7f0000000040)="1ce0", 0x2, 0x0, &(0x7f0000001100)={0x2, 0xfffd, @private}, 0x10) r1 = fcntl$dupfd(r0, 0x0, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)='0000:00:02.0\x00', 0xd) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0) write(r3, &(0x7f00000001c0)='ohci-pci\x00', 0x9) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/ohci-pci/bind\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='0000:00:02.0\x00', 0xd) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000000)=0x6474, 0x4) read$msr(r1, &(0x7f0000001140)=""/4096, 0x1000) 93.578806ms ago: executing program 3 (id=2577): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000080)={0x7ff, 0x6, 0x9, 0x2}, 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x14003, 0x0) mount$overlay(0x0, &(0x7f0000000340)='./file0\x00', 0x0, 0xf6ff, 0x0) sendto$inet6(r0, &(0x7f0000000140)="96", 0x1, 0x44005, &(0x7f0000000040)={0xa, 0x4e24, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x25}}, 0xc5b}, 0x1c) 92.127289ms ago: executing program 0 (id=2578): r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000380)={0x1d, r1, 0x2, {0x2, 0x0, 0x2}}, 0x18) sendmmsg(r0, &(0x7f0000002700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4040040) 91.989683ms ago: executing program 3 (id=2579): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @multicast1}, 0x2}}, 0x2e) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f00000000c0), r4) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000880)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d0019feffe69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb46c4c0a285057e3061b9781e", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000140)=""/62, 0x3e}, {&(0x7f00000004c0)=""/172, 0xe8}, {&(0x7f0000000d00)=""/4142, 0x102e}, {&(0x7f0000000c00)=""/205, 0xcd}, {&(0x7f0000000900)=""/160, 0xa0}, {&(0x7f00000007c0)=""/176, 0xb0}, {&(0x7f00000003c0)=""/186, 0xba}, {&(0x7f0000000700)=""/187, 0xbb}, {&(0x7f0000000180)=""/22, 0x13}], 0x9}, 0x10040) recvmsg$kcm(r3, &(0x7f0000000bc0)={0x0, 0x0, 0x0}, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r6 = getpgid(0x0) syz_open_procfs(r6, &(0x7f0000000240)='syscall\x00') r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x14, r5, 0x1, 0x1070bd2c, 0x4, {0x5}}, 0x14}}, 0x20) sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)={0x14, r5, 0x325, 0x0, 0x0, {0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 59.507882ms ago: executing program 3 (id=2580): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl(r1, 0x4048aec9, &(0x7f0000000040)="0100"/72) (async) ioctl(r1, 0x400caed0, &(0x7f0000000100)="0100000000000000ffffffff") (async) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/net/dummy0/carrier\x00', 0x1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) (async) r4 = syz_open_dev$evdev(&(0x7f0000002000), 0x1, 0x80) ioctl$EVIOCGKEYCODE(r4, 0x80084504, &(0x7f0000002040)=""/113) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x9, &(0x7f0000002100)=0xfff00000, 0x4) (async) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='net/tcp\x00') lseek(r5, 0x2000, 0x0) (async) r6 = open(&(0x7f0000000280)='.\x00', 0x163480, 0x0) (async) setreuid(0xee01, 0xee01) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r8, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}}, 0x0) fsetxattr$security_selinux(r6, &(0x7f0000000000), &(0x7f00000000c0)='system_u:object_r:dlm_control_device_t:s0\x00', 0x2a, 0x0) pread64(r6, 0x0, 0x0, 0x1) (async) write(r2, &(0x7f0000000800)='0', 0x1) 0s ago: executing program 0 (id=2581): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @multicast1}, 0x2}}, 0x2e) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)={0x14, r3, 0x325, 0x0, 0x0, {0x8}}, 0x14}, 0x1, 0xf0, 0x0, 0x40801}, 0x0) kernel console output (not intermixed with test programs): 10 [ 178.781234][T11625] vhost_task_create+0x1db/0x370 [ 178.781246][T11625] ? __pfx_vhost_task_create+0x10/0x10 [ 178.781262][T11625] ? __pfx_vhost_task_fn+0x10/0x10 [ 178.781276][T11625] ? __pfx___mutex_lock+0x10/0x10 [ 178.781289][T11625] ? kasan_quarantine_put+0x104/0x240 [ 178.781305][T11625] kvm_mmu_post_init_vm+0x1b3/0x360 [ 178.781321][T11625] kvm_arch_vcpu_ioctl_run+0x66/0x1960 [ 178.781337][T11625] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 178.781358][T11625] kvm_vcpu_ioctl+0x730/0x1700 [ 178.781371][T11625] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 178.781384][T11625] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 178.781403][T11625] ? do_vfs_ioctl+0x226/0x13e0 [ 178.781419][T11625] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 178.781435][T11625] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 178.781457][T11625] ? __fget_files+0x215/0x3d0 [ 178.781467][T11625] ? hook_file_ioctl_common+0x140/0x440 [ 178.781483][T11625] ? selinux_file_ioctl+0x13b/0x290 [ 178.781499][T11625] ? selinux_file_ioctl+0xb6/0x290 [ 178.781516][T11625] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 178.781529][T11625] __x64_sys_ioctl+0x18e/0x210 [ 178.781546][T11625] do_syscall_64+0x115/0x870 [ 178.781558][T11625] ? clear_bhb_loop+0x40/0x90 [ 178.781572][T11625] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 178.781583][T11625] RIP: 0033:0x7f0d41b9e019 [ 178.781593][T11625] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 178.781604][T11625] RSP: 002b:00007f0d42b29028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 178.781615][T11625] RAX: ffffffffffffffda RBX: 00007f0d41e25fa0 RCX: 00007f0d41b9e019 [ 178.781622][T11625] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000d [ 178.781628][T11625] RBP: 00007f0d42b29090 R08: 0000000000000000 R09: 0000000000000000 [ 178.781634][T11625] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 178.781640][T11625] R13: 00007f0d41e26038 R14: 00007f0d41e25fa0 R15: 00007ffe136b8268 [ 178.781654][T11625] [ 178.908604][ T42] audit: type=1400 audit(1785755045.202:628): avc: denied { egress } for pid=10 comm="kworker/0:1" saddr=fe80::1c daddr=ff02::2 netif=wpan1 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:netif_t tclass=netif permissive=1 [ 178.918286][ T42] audit: type=1400 audit(1785755045.202:629): avc: denied { sendto } for pid=10 comm="kworker/0:1" saddr=fe80::1c daddr=ff02::2 netif=wpan1 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:node_t tclass=node permissive=1 [ 179.111200][ T5750] Bluetooth: hci0: unexpected event for opcode 0x0004 [ 179.435559][T11644] netlink: 'syz.0.2276': attribute type 29 has an invalid length. [ 179.438895][T11644] netlink: 'syz.0.2276': attribute type 29 has an invalid length. [ 179.441557][T11644] netlink: 'syz.0.2276': attribute type 29 has an invalid length. [ 179.619606][T11652] __nla_validate_parse: 2 callbacks suppressed [ 179.619625][T11652] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2280'. [ 179.624812][T11652] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2280'. [ 179.644072][T11654] syz.2.2281: vmalloc error: size 4294959104, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 179.652183][T11654] CPU: 0 UID: 0 PID: 11654 Comm: syz.2.2281 Tainted: G L syzkaller #0 PREEMPT(full) [ 179.652203][T11654] Tainted: [L]=SOFTLOCKUP [ 179.652208][T11654] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 179.652215][T11654] Call Trace: [ 179.652220][T11654] [ 179.652225][T11654] dump_stack_lvl+0x100/0x190 [ 179.652245][T11654] warn_alloc.cold+0x94/0xa8 [ 179.652269][T11654] ? __pfx_warn_alloc+0x10/0x10 [ 179.652284][T11654] ? kasan_save_stack+0x3f/0x50 [ 179.652299][T11654] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 179.652317][T11654] ? vb2_vmalloc_alloc+0xf9/0x410 [ 179.652329][T11654] ? __vb2_queue_alloc+0x8d5/0x1160 [ 179.652347][T11654] ? vb2_core_create_bufs+0x5fa/0xa30 [ 179.652364][T11654] ? vb2_create_bufs+0x40c/0x830 [ 179.652378][T11654] ? v4l_create_bufs+0x17d/0x270 [ 179.652389][T11654] ? __video_do_ioctl+0xb2a/0xdf0 [ 179.652402][T11654] ? video_usercopy+0x47a/0x1730 [ 179.652416][T11654] ? __x64_sys_ioctl+0x18e/0x210 [ 179.652432][T11654] ? do_syscall_64+0x115/0x870 [ 179.652445][T11654] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 179.652457][T11654] ? vb2_vmalloc_alloc+0x135/0x410 [ 179.652469][T11654] __vmalloc_node_range_noprof+0x136c/0x1630 [ 179.652490][T11654] ? vb2_vmalloc_alloc+0x135/0x410 [ 179.652504][T11654] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 179.652522][T11654] ? kasan_save_track+0x14/0x30 [ 179.652550][T11654] ? __kasan_kmalloc+0xaa/0xb0 [ 179.652562][T11654] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 179.652580][T11654] ? vb2_vmalloc_alloc+0x135/0x410 [ 179.652591][T11654] vmalloc_user_noprof+0x9e/0xe0 [ 179.652606][T11654] ? vb2_vmalloc_alloc+0x135/0x410 [ 179.652618][T11654] vb2_vmalloc_alloc+0x135/0x410 [ 179.652629][T11654] ? __pfx_vb2_vmalloc_alloc+0x10/0x10 [ 179.652642][T11654] __vb2_queue_alloc+0x8d5/0x1160 [ 179.652668][T11654] vb2_core_create_bufs+0x5fa/0xa30 [ 179.652688][T11654] ? __pfx_vb2_core_create_bufs+0x10/0x10 [ 179.652708][T11654] ? trace_contention_end+0x126/0x160 [ 179.652723][T11654] ? __mutex_lock+0x26d/0x1bd0 [ 179.652738][T11654] vb2_create_bufs+0x40c/0x830 [ 179.652755][T11654] ? __pfx_vb2_create_bufs+0x10/0x10 [ 179.652771][T11654] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 179.652785][T11654] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 179.652800][T11654] v4l_create_bufs+0x17d/0x270 [ 179.652813][T11654] __video_do_ioctl+0xb2a/0xdf0 [ 179.652829][T11654] ? __might_fault+0xc5/0x140 [ 179.652840][T11654] ? __pfx___video_do_ioctl+0x10/0x10 [ 179.652859][T11654] video_usercopy+0x47a/0x1730 [ 179.652874][T11654] ? __pfx___video_do_ioctl+0x10/0x10 [ 179.652889][T11654] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 179.652908][T11654] ? __pfx_video_usercopy+0x10/0x10 [ 179.652931][T11654] v4l2_ioctl+0x1bd/0x250 [ 179.652946][T11654] ? __pfx_v4l2_ioctl+0x10/0x10 [ 179.652961][T11654] __x64_sys_ioctl+0x18e/0x210 [ 179.652978][T11654] do_syscall_64+0x115/0x870 [ 179.652991][T11654] ? clear_bhb_loop+0x40/0x90 [ 179.653005][T11654] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 179.653016][T11654] RIP: 0033:0x7f74e739e019 [ 179.653026][T11654] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 179.653037][T11654] RSP: 002b:00007f74e8205028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 179.653049][T11654] RAX: ffffffffffffffda RBX: 00007f74e7625fa0 RCX: 00007f74e739e019 [ 179.653056][T11654] RDX: 0000200000000480 RSI: 00000000c100565c RDI: 0000000000000004 [ 179.653063][T11654] RBP: 00007f74e743500c R08: 0000000000000000 R09: 0000000000000000 [ 179.653069][T11654] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 179.653075][T11654] R13: 00007f74e7626038 R14: 00007f74e7625fa0 R15: 00007ffed640bb08 [ 179.653089][T11654] [ 179.653702][T11654] Mem-Info: [ 179.698241][T11655] bridge_slave_1: default FDB implementation only supports local addresses [ 179.698580][T11654] active_anon:12375 inactive_anon:9 isolated_anon:0 [ 179.698580][T11654] active_file:743 inactive_file:70464 isolated_file:0 [ 179.698580][T11654] unevictable:1768 dirty:92 writeback:0 [ 179.698580][T11654] slab_reclaimable:12417 slab_unreclaimable:78180 [ 179.698580][T11654] mapped:26075 shmem:2319 pagetables:1374 [ 179.698580][T11654] sec_pagetables:299 bounce:0 [ 179.698580][T11654] kernel_misc_reclaimable:0 [ 179.698580][T11654] free:415775 free_pcp:15357 free_cma:0 [ 179.795712][T11654] Node 0 active_anon:49560kB inactive_anon:36kB active_file:2972kB inactive_file:279472kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:104344kB dirty:384kB writeback:0kB shmem:5736kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14264kB pagetables:5220kB sec_pagetables:1188kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 179.806527][T11654] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:2384kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:200kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 179.816515][T11654] Node 0 DMA free:6780kB boost:0kB min:340kB low:424kB high:508kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:8332kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:84kB local_pcp:84kB free_cma:0kB [ 179.817646][T11652] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2280'. [ 179.825931][T11654] lowmem_reserve[]: 0 1225 1225 1225 1225 [ 179.825964][T11654] Node 0 DMA32 free:46000kB boost:0kB min:27396kB low:34244kB high:41092kB reserved_highatomic:0KB free_highatomic:0KB active_anon:49560kB inactive_anon:36kB active_file:2972kB inactive_file:271140kB unevictable:3536kB writepending:384kB zspages:544kB present:2080628kB managed:1255220kB mlocked:0kB bounce:0kB free_pcp:27268kB local_pcp:17404kB free_cma:0kB [ 179.832220][T11652] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2280'. [ 179.842626][T11654] lowmem_reserve[]: 0 0 0 0 0 [ 179.846668][T11654] Node 1 Normal free:1612840kB boost:0kB min:39840kB low:49800kB high:59760kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:2384kB unevictable:3536kB writepending:0kB zspages:0kB present:2097152kB managed:1781884kB mlocked:0kB bounce:0kB free_pcp:31476kB local_pcp:22696kB free_cma:0kB [ 179.856566][T11654] lowmem_reserve[]: 0 0 0 0 0 [ 179.866082][T11654] Node 0 DMA: 3*4kB (UM) 2*8kB (U) 4*16kB (UM) 7*32kB (UM) 5*64kB (UM) 6*128kB (UM) 3*256kB (UM) 5*512kB (UM) 2*1024kB (UM) 0*2048kB 0*4096kB = 6780kB [ 179.880995][T11654] Node 0 DMA32: 512*4kB (UM) 686*8kB (UM) 287*16kB (UME) 143*32kB (UME) 42*64kB (M) 36*128kB (ME) 17*256kB (ME) 11*512kB (M) 8*1024kB (UME) 2*2048kB (UE) 0*4096kB = 46272kB [ 179.887158][T11654] Node 1 Normal: 100*4kB (UM) 83*8kB (UM) 34*16kB (UME) 27*32kB (UME) 14*64kB (UME) 26*128kB (UME) 20*256kB (UME) 17*512kB (UM) 13*1024kB (UME) 7*2048kB (UE) 382*4096kB (UM) = 1612840kB [ 179.893422][T11654] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 179.898317][T11654] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 179.901239][T11654] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 179.920453][T11654] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 179.926832][T11654] 73524 total pagecache pages [ 179.929544][T11654] 3 pages in swap cache [ 179.931170][T11654] Free swap = 124788kB [ 179.932496][T11654] Total swap = 124996kB [ 179.933957][T11654] 1048443 pages RAM [ 179.935323][T11654] 0 pages HighMem/MovableOnly [ 179.937040][T11654] 285327 pages reserved [ 179.938493][T11654] 0 pages cma reserved [ 179.985000][T11665] netlink: 'syz.3.2286': attribute type 29 has an invalid length. [ 179.989513][ T42] audit: type=1400 audit(1785755046.292:630): avc: denied { mmap_zero } for pid=11663 comm="syz.2.2285" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 180.020736][T11666] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2285'. [ 180.039090][T11670] FAULT_INJECTION: forcing a failure. [ 180.039090][T11670] name failslab, interval 1, probability 0, space 0, times 0 [ 180.051246][T11670] CPU: 0 UID: 0 PID: 11670 Comm: syz.3.2287 Tainted: G L syzkaller #0 PREEMPT(full) [ 180.051266][T11670] Tainted: [L]=SOFTLOCKUP [ 180.051270][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 180.051277][T11670] Call Trace: [ 180.051280][T11670] [ 180.051285][T11670] dump_stack_lvl+0x100/0x190 [ 180.051304][T11670] should_fail_ex.cold+0x5/0xa [ 180.051316][T11670] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 180.051335][T11670] should_failslab+0xc2/0x120 [ 180.051349][T11670] kmem_cache_alloc_noprof+0x91/0x6a0 [ 180.051363][T11670] ? skb_clone+0x190/0x400 [ 180.051379][T11670] skb_clone+0x190/0x400 [ 180.051393][T11670] netlink_deliver_tap+0xaed/0xcc0 [ 180.051408][T11670] netlink_unicast+0x62b/0x850 [ 180.051421][T11670] ? __pfx_netlink_unicast+0x10/0x10 [ 180.051436][T11670] netlink_sendmsg+0x8b0/0xda0 [ 180.051449][T11670] ? __pfx_netlink_sendmsg+0x10/0x10 [ 180.051462][T11670] ? selinux_socket_sendmsg+0x198/0x2f0 [ 180.051480][T11670] ____sys_sendmsg+0xa4d/0xbe0 [ 180.051496][T11670] ? __pfx_netlink_sendmsg+0x10/0x10 [ 180.051509][T11670] ? __pfx_____sys_sendmsg+0x10/0x10 [ 180.051532][T11670] ___sys_sendmsg+0x190/0x1e0 [ 180.051543][T11670] ? __pfx____sys_sendmsg+0x10/0x10 [ 180.051553][T11670] ? __lock_acquire+0x49f/0x1a40 [ 180.051567][T11670] ? get_pid_task+0x106/0x250 [ 180.051591][T11670] __sys_sendmsg+0x160/0x210 [ 180.051606][T11670] ? __pfx___sys_sendmsg+0x10/0x10 [ 180.051627][T11670] do_syscall_64+0x115/0x870 [ 180.051640][T11670] ? clear_bhb_loop+0x40/0x90 [ 180.051653][T11670] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.051664][T11670] RIP: 0033:0x7f0d41b9e019 [ 180.051673][T11670] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 180.051684][T11670] RSP: 002b:00007f0d42b29028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 180.051695][T11670] RAX: ffffffffffffffda RBX: 00007f0d41e25fa0 RCX: 00007f0d41b9e019 [ 180.051702][T11670] RDX: 000000000004c880 RSI: 0000200000000180 RDI: 0000000000000003 [ 180.051708][T11670] RBP: 00007f0d42b29090 R08: 0000000000000000 R09: 0000000000000000 [ 180.051715][T11670] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 180.051721][T11670] R13: 00007f0d41e26038 R14: 00007f0d41e25fa0 R15: 00007ffe136b8268 [ 180.051734][T11670] [ 180.138582][T11672] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2288'. [ 180.174128][T11672] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2288'. [ 180.178303][ T5589] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 180.181322][ T5589] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 180.184351][ T5589] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 180.188081][ T5589] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 180.240973][ T5750] Bluetooth: hci3: unexpected event for opcode 0x0004 [ 180.278275][T11681] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2292'. [ 180.281322][T11681] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2292'. [ 180.318003][T11681] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2292'. [ 180.400266][ T42] audit: type=1400 audit(1785755046.702:631): avc: denied { read } for pid=11685 comm="syz.2.2294" path="socket:[69413]" dev="sockfs" ino=69413 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 180.525968][T11691] FAULT_INJECTION: forcing a failure. [ 180.525968][T11691] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 180.544850][T11691] CPU: 2 UID: 0 PID: 11691 Comm: syz.1.2296 Tainted: G L syzkaller #0 PREEMPT(full) [ 180.544878][T11691] Tainted: [L]=SOFTLOCKUP [ 180.544884][T11691] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 180.544893][T11691] Call Trace: [ 180.544899][T11691] [ 180.544905][T11691] dump_stack_lvl+0x100/0x190 [ 180.544946][T11691] should_fail_ex.cold+0x5/0xa [ 180.544969][T11691] _copy_from_user+0x2e/0xd0 [ 180.544993][T11691] copy_mount_options+0x76/0x190 [ 180.545018][T11691] __x64_sys_mount+0x1ab/0x310 [ 180.545040][T11691] ? __pfx___x64_sys_mount+0x10/0x10 [ 180.545066][T11691] do_syscall_64+0x115/0x870 [ 180.545090][T11691] ? clear_bhb_loop+0x40/0x90 [ 180.545110][T11691] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.545126][T11691] RIP: 0033:0x7f6cf3f9e019 [ 180.545141][T11691] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 180.545157][T11691] RSP: 002b:00007f6cf4f35028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 180.545174][T11691] RAX: ffffffffffffffda RBX: 00007f6cf4225fa0 RCX: 00007f6cf3f9e019 [ 180.545185][T11691] RDX: 0000200000000080 RSI: 00002000000000c0 RDI: 0000000000000000 [ 180.545195][T11691] RBP: 00007f6cf4f35090 R08: 0000200000000040 R09: 0000000000000000 [ 180.545204][T11691] R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000001 [ 180.545213][T11691] R13: 00007f6cf4226038 R14: 00007f6cf4225fa0 R15: 00007fffc0d76488 [ 180.545234][T11691] [ 180.600232][T11695] 9pnet_virtio: no channels available for device syz [ 180.612278][T11691] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 180.724920][T11698] FAULT_INJECTION: forcing a failure. [ 180.724920][T11698] name failslab, interval 1, probability 0, space 0, times 0 [ 180.730165][T11698] CPU: 0 UID: 0 PID: 11698 Comm: syz.1.2299 Tainted: G L syzkaller #0 PREEMPT(full) [ 180.730189][T11698] Tainted: [L]=SOFTLOCKUP [ 180.730193][T11698] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 180.730199][T11698] Call Trace: [ 180.730203][T11698] [ 180.730208][T11698] dump_stack_lvl+0x100/0x190 [ 180.730225][T11698] should_fail_ex.cold+0x5/0xa [ 180.730239][T11698] should_failslab+0xc2/0x120 [ 180.730254][T11698] __kmalloc_noprof+0xfc/0x820 [ 180.730267][T11698] ? kobject_put+0xb9/0x640 [ 180.730282][T11698] ? nfc_llcp_build_tlv+0x105/0x250 [ 180.730298][T11698] nfc_llcp_build_tlv+0x105/0x250 [ 180.730312][T11698] nfc_llcp_build_gb.isra.0+0x15e/0x3f0 [ 180.730325][T11698] ? __pfx_nfc_llcp_build_gb.isra.0+0x10/0x10 [ 180.730338][T11698] ? print_kernel_ident+0x13/0x40 [ 180.730355][T11698] ? nfc_llcp_find_local+0xd3/0x180 [ 180.730366][T11698] ? nfc_llcp_find_local+0xd4/0x180 [ 180.730379][T11698] ? do_raw_spin_unlock+0x145/0x1e0 [ 180.730396][T11698] nfc_llcp_general_bytes+0x30/0xf0 [ 180.730409][T11698] nfc_dep_link_up+0x277/0x540 [ 180.730425][T11698] ? __pfx_nfc_dep_link_up+0x10/0x10 [ 180.730438][T11698] ? nfc_get_device+0x8d/0xd0 [ 180.730451][T11698] ? __pfx_nfc_get_device+0x10/0x10 [ 180.730468][T11698] nfc_genl_dep_link_up+0x1b4/0x270 [ 180.730484][T11698] genl_family_rcv_msg_doit+0x214/0x300 [ 180.730500][T11698] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 180.730518][T11698] ? bpf_lsm_capable+0x9/0x10 [ 180.730543][T11698] ? security_capable+0x80/0x260 [ 180.730559][T11698] genl_rcv_msg+0x560/0x800 [ 180.730574][T11698] ? __pfx_genl_rcv_msg+0x10/0x10 [ 180.730587][T11698] ? __pfx_nfc_genl_dep_link_up+0x10/0x10 [ 180.730604][T11698] ? __lock_acquire+0x49f/0x1a40 [ 180.730619][T11698] netlink_rcv_skb+0x159/0x420 [ 180.730630][T11698] ? __pfx_genl_rcv_msg+0x10/0x10 [ 180.730643][T11698] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 180.730660][T11698] ? netlink_deliver_tap+0x1ae/0xcc0 [ 180.730675][T11698] genl_rcv+0x28/0x40 [ 180.730687][T11698] netlink_unicast+0x585/0x850 [ 180.730700][T11698] ? __pfx_netlink_unicast+0x10/0x10 [ 180.730711][T11698] ? __pfx_sock_has_perm+0x10/0x10 [ 180.730729][T11698] netlink_sendmsg+0x8b0/0xda0 [ 180.730743][T11698] ? __pfx_netlink_sendmsg+0x10/0x10 [ 180.730755][T11698] ? selinux_socket_sendmsg+0x198/0x2f0 [ 180.730773][T11698] ____sys_sendmsg+0xa4d/0xbe0 [ 180.730790][T11698] ? __pfx_netlink_sendmsg+0x10/0x10 [ 180.730802][T11698] ? __pfx_____sys_sendmsg+0x10/0x10 [ 180.730825][T11698] ___sys_sendmsg+0x190/0x1e0 [ 180.730836][T11698] ? __pfx____sys_sendmsg+0x10/0x10 [ 180.730846][T11698] ? __lock_acquire+0x49f/0x1a40 [ 180.730859][T11698] ? get_pid_task+0x106/0x250 [ 180.730884][T11698] __sys_sendmsg+0x160/0x210 [ 180.730899][T11698] ? __pfx___sys_sendmsg+0x10/0x10 [ 180.730920][T11698] do_syscall_64+0x115/0x870 [ 180.730933][T11698] ? clear_bhb_loop+0x40/0x90 [ 180.730946][T11698] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.730957][T11698] RIP: 0033:0x7f6cf3f9e019 [ 180.730967][T11698] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 180.730977][T11698] RSP: 002b:00007f6cf4f35028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 180.730989][T11698] RAX: ffffffffffffffda RBX: 00007f6cf4225fa0 RCX: 00007f6cf3f9e019 [ 180.730996][T11698] RDX: 0000000000008000 RSI: 0000200000000f80 RDI: 0000000000000004 [ 180.731002][T11698] RBP: 00007f6cf4f35090 R08: 0000000000000000 R09: 0000000000000000 [ 180.731008][T11698] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 180.731014][T11698] R13: 00007f6cf4226038 R14: 00007f6cf4225fa0 R15: 00007fffc0d76488 [ 180.731028][T11698] [ 180.880499][ T8517] usb 8-1: new low-speed USB device number 11 using dummy_hcd [ 181.037740][ T8517] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 181.041589][ T8517] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 181.045044][ T8517] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 181.049320][ T8517] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 181.052631][ T8517] usb 8-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 181.055730][ T8517] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.062080][ T8517] hub 8-1:1.0: bad descriptor, ignoring hub [ 181.064673][ T8517] hub 8-1:1.0: probe with driver hub failed with error -5 [ 181.069319][ T8517] cdc_wdm 8-1:1.0: skipping garbage [ 181.071247][ T8517] cdc_wdm 8-1:1.0: skipping garbage [ 181.077701][ T8517] cdc_wdm 8-1:1.0: cdc-wdm0: USB WDM device [ 181.080132][ T8517] cdc_wdm 8-1:1.0: Unknown control protocol [ 181.284799][ T42] audit: type=1400 audit(1785755047.582:632): avc: denied { mount } for pid=11719 comm="syz.1.2307" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 181.361028][T11693] cdc_wdm 8-1:1.0: Error submitting int urb - -90 [ 181.379318][ T10] usb 8-1: USB disconnect, device number 11 [ 181.696311][ T8517] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 181.846273][ T8517] usb 7-1: Using ep0 maxpacket: 32 [ 181.850661][ T8517] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 181.858301][ T8517] usb 7-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 181.861945][ T8517] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 181.865396][ T8517] usb 7-1: Product: syz [ 181.867519][ T8517] usb 7-1: Manufacturer: syz [ 181.869535][ T8517] usb 7-1: SerialNumber: syz [ 181.875160][ T8517] usb 7-1: config 0 descriptor?? [ 181.878896][T11725] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 181.980414][ T5750] Bluetooth: hci0: unexpected event for opcode 0x0004 [ 182.260209][ T42] audit: type=1400 audit(1785755048.562:633): avc: denied { write } for pid=11724 comm="syz.2.2309" name="ndctl0" dev="devtmpfs" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 182.455424][T11740] openvswitch: netlink: Actions may not be safe on all matching packets [ 182.464588][T11740] FAULT_INJECTION: forcing a failure. [ 182.464588][T11740] name failslab, interval 1, probability 0, space 0, times 0 [ 182.470142][T11740] CPU: 2 UID: 0 PID: 11740 Comm: syz.0.2316 Tainted: G L syzkaller #0 PREEMPT(full) [ 182.470161][T11740] Tainted: [L]=SOFTLOCKUP [ 182.470165][T11740] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 182.470171][T11740] Call Trace: [ 182.470175][T11740] [ 182.470179][T11740] dump_stack_lvl+0x100/0x190 [ 182.470210][T11740] should_fail_ex.cold+0x5/0xa [ 182.470226][T11740] should_failslab+0xc2/0x120 [ 182.470241][T11740] __kmalloc_cache_noprof+0x91/0x6c0 [ 182.470260][T11740] ? lockdep_init_map_type+0x5c/0x250 [ 182.470274][T11740] ? tcf_block_get_ext+0x3c8/0x1950 [ 182.470299][T11740] tcf_block_get_ext+0x3c8/0x1950 [ 182.470313][T11740] tcf_block_get+0xa8/0x100 [ 182.470324][T11740] ? __pfx_tcf_block_get+0x10/0x10 [ 182.470334][T11740] ? __pfx_tcf_chain_head_change_dflt+0x10/0x10 [ 182.470349][T11740] ? lockdep_init_map_type+0x5c/0x250 [ 182.470362][T11740] ? timer_init_key+0x150/0x310 [ 182.470385][T11740] sfq_init+0xed/0x2500 [ 182.470398][T11740] ? rtnetlink_rcv_msg+0x3c9/0xe90 [ 182.470413][T11740] ? netlink_rcv_skb+0x159/0x420 [ 182.470423][T11740] ? netlink_unicast+0x585/0x850 [ 182.470434][T11740] ? ____sys_sendmsg+0xa4d/0xbe0 [ 182.470450][T11740] ? ___sys_sendmsg+0x190/0x1e0 [ 182.470459][T11740] ? __sys_sendmsg+0x160/0x210 [ 182.470472][T11740] ? do_syscall_64+0x115/0x870 [ 182.470488][T11740] ? lockdep_init_map_type+0x5c/0x250 [ 182.470502][T11740] ? __pfx_sfq_init+0x10/0x10 [ 182.470516][T11740] ? qdisc_alloc+0x81b/0xb30 [ 182.470532][T11740] ? __pfx_sfq_init+0x10/0x10 [ 182.470546][T11740] qdisc_create+0x47b/0x1060 [ 182.470561][T11740] tc_modify_qdisc+0xdcf/0x2120 [ 182.470577][T11740] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 182.470601][T11740] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 182.470614][T11740] rtnetlink_rcv_msg+0x3c9/0xe90 [ 182.470630][T11740] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 182.470649][T11740] ? ref_tracker_free+0x37e/0x6c0 [ 182.470667][T11740] netlink_rcv_skb+0x159/0x420 [ 182.470678][T11740] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 182.470694][T11740] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 182.470710][T11740] ? netlink_deliver_tap+0x1ae/0xcc0 [ 182.470723][T11740] netlink_unicast+0x585/0x850 [ 182.470736][T11740] ? __pfx_netlink_unicast+0x10/0x10 [ 182.470751][T11740] netlink_sendmsg+0x8b0/0xda0 [ 182.470765][T11740] ? __pfx_netlink_sendmsg+0x10/0x10 [ 182.470778][T11740] ? selinux_socket_sendmsg+0x198/0x2f0 [ 182.470796][T11740] ____sys_sendmsg+0xa4d/0xbe0 [ 182.470812][T11740] ? __pfx_netlink_sendmsg+0x10/0x10 [ 182.470824][T11740] ? __pfx_____sys_sendmsg+0x10/0x10 [ 182.470840][T11740] ? rcu_is_watching+0x12/0xc0 [ 182.470862][T11740] ___sys_sendmsg+0x190/0x1e0 [ 182.470873][T11740] ? __pfx____sys_sendmsg+0x10/0x10 [ 182.470890][T11740] ? lockdep_hardirqs_on+0x78/0x100 [ 182.470902][T11740] ? irqentry_exit+0x24d/0xa00 [ 182.470924][T11740] __sys_sendmsg+0x160/0x210 [ 182.470938][T11740] ? __pfx___sys_sendmsg+0x10/0x10 [ 182.470959][T11740] do_syscall_64+0x115/0x870 [ 182.470972][T11740] ? clear_bhb_loop+0x40/0x90 [ 182.470985][T11740] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 182.470996][T11740] RIP: 0033:0x7f55d879e019 [ 182.471005][T11740] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 182.471016][T11740] RSP: 002b:00007f55d9646028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 182.471027][T11740] RAX: ffffffffffffffda RBX: 00007f55d8a25fa0 RCX: 00007f55d879e019 [ 182.471033][T11740] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 000000000000000b [ 182.471039][T11740] RBP: 00007f55d9646090 R08: 0000000000000000 R09: 0000000000000000 [ 182.471046][T11740] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 182.471052][T11740] R13: 00007f55d8a26038 R14: 00007f55d8a25fa0 R15: 00007ffd20131af8 [ 182.471065][T11740] [ 183.146288][T10364] usb 8-1: new full-speed USB device number 12 using dummy_hcd [ 183.299758][T10364] usb 8-1: unable to get BOS descriptor or descriptor too short [ 183.308477][T10364] usb 8-1: not running at top speed; connect to a high speed hub [ 183.314925][T10364] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 183.319374][T10364] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 183.325698][T10364] usb 8-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 183.333589][T10364] usb 8-1: config 14 has no interface number 0 [ 183.336818][T10364] usb 8-1: config 14 has no interface number 1 [ 183.339673][T10364] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 183.344335][T10364] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 183.354339][T10364] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 183.363582][T10364] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 183.368104][T10364] usb 8-1: config 14 interface 57 has no altsetting 0 [ 183.371072][T10364] usb 8-1: config 14 interface 228 has no altsetting 0 [ 183.380293][T10364] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 183.383743][T10364] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 183.387494][T10364] usb 8-1: Product: syz [ 183.389393][T10364] usb 8-1: Manufacturer: syz [ 183.391448][T10364] usb 8-1: SerialNumber: syz [ 183.716569][ T10] usb 6-1: new full-speed USB device number 18 using dummy_hcd [ 183.824833][T10364] legousbtower 8-1:14.57: interrupt endpoints not found [ 183.868948][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 183.872338][ T10] usb 6-1: not running at top speed; connect to a high speed hub [ 183.875559][ T10] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 183.879499][ T10] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 183.882434][ T10] usb 6-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 183.885857][ T10] usb 6-1: config 14 has no interface number 0 [ 183.888713][ T10] usb 6-1: config 14 has no interface number 1 [ 183.890857][ T10] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 183.894429][ T10] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 183.899164][ T10] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 183.902812][ T10] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 183.910802][ T10] usb 6-1: config 14 interface 57 has no altsetting 0 [ 183.913322][ T10] usb 6-1: config 14 interface 228 has no altsetting 0 [ 183.917746][ T10] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 183.921365][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 183.924756][ T10] usb 6-1: Product: syz [ 183.927575][ T10] usb 6-1: Manufacturer: syz [ 183.930443][ T10] usb 6-1: SerialNumber: syz [ 184.225717][T10364] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 184.233061][T10364] legousbtower 8-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 184.343401][ T10] legousbtower 6-1:14.57: interrupt endpoints not found [ 184.439148][ T9] usb 8-1: USB disconnect, device number 12 [ 184.453600][T10364] usb 7-1: USB disconnect, device number 12 [ 184.469793][ T9] legousbtower 8-1:14.228: LEGO USB Tower #-159 now disconnected [ 184.748777][ T10] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 184.754635][ T10] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 184.951643][T11758] FAULT_INJECTION: forcing a failure. [ 184.951643][T11758] name failslab, interval 1, probability 0, space 0, times 0 [ 184.967650][T11758] CPU: 2 UID: 0 PID: 11758 Comm: syz.1.2322 Tainted: G L syzkaller #0 PREEMPT(full) [ 184.967679][T11758] Tainted: [L]=SOFTLOCKUP [ 184.967686][T11758] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 184.967697][T11758] Call Trace: [ 184.967703][T11758] [ 184.967709][T11758] dump_stack_lvl+0x100/0x190 [ 184.967737][T11758] should_fail_ex.cold+0x5/0xa [ 184.967759][T11758] should_failslab+0xc2/0x120 [ 184.967799][T11758] kmem_cache_alloc_noprof+0x91/0x6a0 [ 184.967821][T11758] ? do_getname+0x35/0x390 [ 184.967870][T11758] do_getname+0x35/0x390 [ 184.967895][T11758] do_sys_openat2+0xc7/0x1e0 [ 184.967932][T11758] ? __pfx_do_sys_openat2+0x10/0x10 [ 184.967955][T11758] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 184.967981][T11758] ? __fget_files+0x21f/0x3d0 [ 184.968005][T11758] __x64_sys_openat+0x12d/0x210 [ 184.968029][T11758] ? __pfx___x64_sys_openat+0x10/0x10 [ 184.968056][T11758] ? ksys_write+0x1ac/0x250 [ 184.968091][T11758] do_syscall_64+0x115/0x870 [ 184.968113][T11758] ? clear_bhb_loop+0x40/0x90 [ 184.968136][T11758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.968156][T11758] RIP: 0033:0x7f6cf3f5e84e [ 184.968171][T11758] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 184.968190][T11758] RSP: 002b:00007f6cf4f34b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 184.968207][T11758] RAX: ffffffffffffffda RBX: 00007f6cf4f356c0 RCX: 00007f6cf3f5e84e [ 184.968221][T11758] RDX: 0000000000000002 RSI: 00007f6cf4f34c00 RDI: ffffffffffffff9c [ 184.968233][T11758] RBP: 00007f6cf4f35090 R08: 0000000000000000 R09: 0000000000000000 [ 184.968244][T11758] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 184.968256][T11758] R13: 00007f6cf4226038 R14: 00007f6cf4225fa0 R15: 00007fffc0d76488 [ 184.968280][T11758] [ 185.061481][T10364] usb 6-1: USB disconnect, device number 18 [ 185.071626][T10364] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 185.140396][ T5750] Bluetooth: hci3: unexpected event for opcode 0x0004 [ 185.436668][ T10] usb 8-1: new full-speed USB device number 13 using dummy_hcd [ 185.560901][ T42] kauditd_printk_skb: 2 callbacks suppressed [ 185.560918][ T42] audit: type=1400 audit(1785755051.862:636): avc: denied { execute } for pid=11773 comm="syz-executor" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 185.587816][ T42] audit: type=1400 audit(1785755051.882:637): avc: denied { execute_no_trans } for pid=11773 comm="syz-executor" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 185.610391][ T10] usb 8-1: unable to get BOS descriptor or descriptor too short [ 185.614258][ T10] usb 8-1: not running at top speed; connect to a high speed hub [ 185.622267][ T10] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 185.625784][ T10] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 185.629800][ T10] usb 8-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 185.639145][ T10] usb 8-1: config 14 has no interface number 0 [ 185.650867][ T5747] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 185.661325][ T5747] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 185.664641][ T10] usb 8-1: config 14 has no interface number 1 [ 185.667996][ T10] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 185.672574][ T5747] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 185.677832][ T10] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 185.682861][ T10] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 185.688018][ T10] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 185.692221][ T10] usb 8-1: config 14 interface 57 has no altsetting 0 [ 185.695162][ T10] usb 8-1: config 14 interface 228 has no altsetting 0 [ 185.698969][ T5747] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 185.702932][ T5747] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 185.708966][ T10] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 185.712955][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.716724][ T10] usb 8-1: Product: syz [ 185.718439][ T10] usb 8-1: Manufacturer: syz [ 185.720481][ T10] usb 8-1: SerialNumber: syz [ 186.025940][ T42] audit: type=1400 audit(1785755052.322:638): avc: denied { write } for pid=11786 comm="syz.2.2330" name="/" dev="9p" ino=78394615 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 186.144714][ T10] legousbtower 8-1:14.57: interrupt endpoints not found [ 186.223282][T11774] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.225760][T11774] bridge0: port 1(bridge_slave_0) entered disabled state [ 186.234525][T11774] bridge_slave_0: entered allmulticast mode [ 186.238473][T11774] bridge_slave_0: entered promiscuous mode [ 186.244704][T11774] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.247192][T11774] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.249516][T11774] bridge_slave_1: entered allmulticast mode [ 186.252501][T11774] bridge_slave_1: entered promiscuous mode [ 186.274678][T11774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 186.281318][T11774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 186.305104][T11774] team0: Port device team_slave_0 added [ 186.311407][T11774] team0: Port device team_slave_1 added [ 186.332634][T11774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 186.334944][T11774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 186.343245][T11774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 186.350366][T11774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 186.352646][T11774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 186.360776][T11774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 186.395489][T11774] hsr_slave_0: entered promiscuous mode [ 186.399170][T11774] hsr_slave_1: entered promiscuous mode [ 186.401664][T11774] debugfs: 'hsr0' already exists in 'hsr' [ 186.403552][T11774] Cannot create hsr debugfs directory [ 186.535204][T11774] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 186.538677][T11774] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.548984][ T10] legousbtower 8-1:14.228: get version request failed: -121 [ 186.556956][ T10] legousbtower 8-1:14.228: probe with driver legousbtower failed with error -121 [ 186.617367][T11774] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 186.622511][T11774] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.707998][T11774] netdevsim netdevsim1 netdevsim1 (unregistering): left allmulticast mode [ 186.712216][T11774] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 186.715459][T11774] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.751632][T10364] usb 8-1: USB disconnect, device number 13 [ 186.777001][T11774] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 186.780222][T11774] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.888468][T11774] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 186.898754][T11774] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 186.901927][T11774] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 186.908851][T11774] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 186.911608][T11774] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 186.916485][T11774] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 186.919292][T11774] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 186.923159][T11774] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 186.940747][T11774] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.944142][T11774] bridge0: port 2(bridge_slave_1) entered forwarding state [ 186.947558][T11774] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.949898][T11774] bridge0: port 1(bridge_slave_0) entered forwarding state [ 186.999968][T11774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 187.014604][ T6685] bridge0: port 1(bridge_slave_0) entered disabled state [ 187.017805][ T6685] bridge0: port 2(bridge_slave_1) entered disabled state [ 187.031768][T11774] 8021q: adding VLAN 0 to HW filter on device team0 [ 187.032017][ T42] audit: type=1400 audit(1785755053.332:639): avc: denied { read } for pid=11804 comm="syz.2.2333" name="ndctl0" dev="devtmpfs" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 187.070685][ T6685] bridge0: port 1(bridge_slave_0) entered blocking state [ 187.073582][ T6685] bridge0: port 1(bridge_slave_0) entered forwarding state [ 187.087830][ T6685] bridge0: port 2(bridge_slave_1) entered blocking state [ 187.090385][ T6685] bridge0: port 2(bridge_slave_1) entered forwarding state [ 187.179996][T11808] validate_nla: 10 callbacks suppressed [ 187.180008][T11808] netlink: 'syz.0.2334': attribute type 29 has an invalid length. [ 187.203287][T11808] netlink: 'syz.0.2334': attribute type 29 has an invalid length. [ 187.211976][T11808] netlink: 'syz.0.2334': attribute type 29 has an invalid length. [ 187.357656][ T5747] Bluetooth: hci3: unexpected event for opcode 0x0004 [ 187.384437][T11823] Bluetooth: MGMT ver 1.23 [ 187.450924][T11823] block nbd1: server does not support multiple connections per device. [ 187.456862][T11823] block nbd1: shutting down sockets [ 187.512711][T11774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 187.566053][T11774] veth0_vlan: entered promiscuous mode [ 187.581498][T11774] veth1_vlan: entered promiscuous mode [ 187.610579][T11774] veth0_macvtap: entered promiscuous mode [ 187.623348][T11774] veth1_macvtap: entered promiscuous mode [ 187.640063][T11774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 187.650264][T11774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 187.747957][ T5589] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.748040][ T5750] Bluetooth: hci4: command tx timeout [ 187.765744][ T6677] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 187.770081][ T6677] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 187.795220][ T1166] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 187.798715][ T1166] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 187.816913][ T42] audit: type=1400 audit(1785755054.112:640): avc: denied { mounton } for pid=11774 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2838 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 187.828847][ T5589] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.836966][ T5589] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.844131][ T42] audit: type=1400 audit(1785755054.122:641): avc: denied { mounton } for pid=11774 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 187.885731][ T5750] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 187.887261][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.916095][T11842] netlink: 'syz.3.2342': attribute type 29 has an invalid length. [ 187.920363][T11842] netlink: 'syz.3.2342': attribute type 29 has an invalid length. [ 187.923793][T11842] netlink: 'syz.3.2342': attribute type 29 has an invalid length. [ 188.124054][ T5749] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 188.129194][ T5749] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 188.138629][ T5749] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 188.142118][ T5749] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 188.145803][ T5749] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 188.208876][ T42] audit: type=1400 audit(1785755054.512:642): avc: denied { module_request } for pid=11845 comm="syz-executor" kmod="nr3" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 188.234467][ T42] audit: type=1400 audit(1785755054.522:643): avc: denied { bpf } for pid=11851 comm="syz.1.2345" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 188.264379][ T42] audit: type=1400 audit(1785755054.522:644): avc: denied { perfmon } for pid=11851 comm="syz.1.2345" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 188.502715][T11869] mac80211_hwsim hwsim2 syzkaller0: entered promiscuous mode [ 188.505210][T11869] mac80211_hwsim hwsim2 syzkaller0: entered allmulticast mode [ 188.516372][T11867] block nbd1: server does not support multiple connections per device. [ 188.522902][T11867] block nbd1: shutting down sockets [ 188.621589][T11876] netlink: 'syz.2.2351': attribute type 29 has an invalid length. [ 188.629690][T11876] netlink: 'syz.2.2351': attribute type 29 has an invalid length. [ 188.637020][T11876] netlink: 'syz.2.2351': attribute type 29 has an invalid length. [ 188.829216][T11845] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.831657][T11845] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.834122][T11845] bridge_slave_0: entered allmulticast mode [ 188.837184][T11845] bridge_slave_0: entered promiscuous mode [ 188.842495][T11845] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.844725][T11845] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.847335][T11845] bridge_slave_1: entered allmulticast mode [ 188.850446][T11845] bridge_slave_1: entered promiscuous mode [ 188.876808][T11845] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 188.885644][T11845] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 188.908979][T11845] team0: Port device team_slave_0 added [ 188.912625][T11845] team0: Port device team_slave_1 added [ 188.935822][T11845] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 188.938247][T11845] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 188.946387][T11845] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 188.950953][T11845] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 188.953483][T11845] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 188.961423][T11845] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 189.022705][T11845] hsr_slave_0: entered promiscuous mode [ 189.033154][T11845] hsr_slave_1: entered promiscuous mode [ 189.042578][T11845] debugfs: 'hsr0' already exists in 'hsr' [ 189.044425][T11845] Cannot create hsr debugfs directory [ 189.132060][T11904] FAULT_INJECTION: forcing a failure. [ 189.132060][T11904] name failslab, interval 1, probability 0, space 0, times 0 [ 189.137456][T11904] CPU: 0 UID: 0 PID: 11904 Comm: syz.2.2357 Tainted: G L syzkaller #0 PREEMPT(full) [ 189.137482][T11904] Tainted: [L]=SOFTLOCKUP [ 189.137489][T11904] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 189.137499][T11904] Call Trace: [ 189.137517][T11904] [ 189.137525][T11904] dump_stack_lvl+0x100/0x190 [ 189.137571][T11904] should_fail_ex.cold+0x5/0xa [ 189.137624][T11904] should_failslab+0xc2/0x120 [ 189.137659][T11904] __kmalloc_noprof+0xfc/0x820 [ 189.137686][T11904] ? rcu_is_watching+0x12/0xc0 [ 189.137722][T11904] ? tomoyo_encode2+0xfb/0x3c0 [ 189.137749][T11904] tomoyo_encode2+0xfb/0x3c0 [ 189.137770][T11904] tomoyo_encode+0x29/0x50 [ 189.137786][T11904] tomoyo_realpath_from_path+0x18c/0x690 [ 189.137811][T11904] tomoyo_path_number_perm+0x23c/0x580 [ 189.137835][T11904] ? tomoyo_path_number_perm+0x22e/0x580 [ 189.137862][T11904] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 189.137913][T11904] ? find_held_lock+0x2b/0x80 [ 189.137936][T11904] ? __fget_files+0x215/0x3d0 [ 189.137953][T11904] ? hook_file_ioctl_common+0x140/0x440 [ 189.137973][T11904] ? __fget_files+0x215/0x3d0 [ 189.137996][T11904] ? __fget_files+0x21f/0x3d0 [ 189.138017][T11904] security_file_ioctl+0xd3/0x230 [ 189.138046][T11904] __x64_sys_ioctl+0xb7/0x210 [ 189.138073][T11904] do_syscall_64+0x115/0x870 [ 189.138098][T11904] ? clear_bhb_loop+0x40/0x90 [ 189.138126][T11904] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 189.138144][T11904] RIP: 0033:0x7f74e739e019 [ 189.138159][T11904] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 189.138176][T11904] RSP: 002b:00007f74e81e4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 189.138203][T11904] RAX: ffffffffffffffda RBX: 00007f74e7626090 RCX: 00007f74e739e019 [ 189.138215][T11904] RDX: 0000200000000080 RSI: 00000000402c542c RDI: 0000000000000004 [ 189.138225][T11904] RBP: 00007f74e81e4090 R08: 0000000000000000 R09: 0000000000000000 [ 189.138235][T11904] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 189.138245][T11904] R13: 00007f74e7626128 R14: 00007f74e7626090 R15: 00007ffed640bb08 [ 189.138270][T11904] [ 189.138322][T11904] ERROR: Out of memory at tomoyo_realpath_from_path. [ 189.222994][ T42] audit: type=1400 audit(1785755055.522:645): avc: denied { set_context_mgr } for pid=11905 comm="syz.0.2360" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 189.232009][T11906] binder: 11905:11906 ioctl c0306201 0 returned -14 [ 189.255052][T11845] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 189.259930][T11845] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.291998][T11908] netlink: 'syz.0.2361': attribute type 29 has an invalid length. [ 189.396085][T11845] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 189.400709][T11845] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.426277][ T5747] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 189.482697][T11845] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 189.485893][T11845] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.711417][T11845] netdevsim netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 189.715264][T11845] netdevsim netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.816268][ T2327] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 189.827350][ T5747] Bluetooth: hci4: command tx timeout [ 189.904542][T11845] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 189.919917][T11845] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 189.924012][T11845] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 189.929704][T11845] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 189.935655][T11845] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 189.942144][T11845] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 189.946863][T11845] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 189.955469][T11845] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 189.968862][ T2327] usb 5-1: config 1 interface 2 altsetting 0 has a duplicate endpoint with address 0x82, skipping [ 189.973350][ T2327] usb 5-1: config 1 interface 2 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 189.980317][ T2327] usb 5-1: New USB device found, idVendor=1110, idProduct=900f, bcdDevice= 0.00 [ 189.984191][ T2327] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 189.988208][ T2327] usb 5-1: Product: syz [ 189.990020][ T2327] usb 5-1: Manufacturer: syz [ 189.991988][ T2327] usb 5-1: SerialNumber: syz [ 190.048763][T11845] 8021q: adding VLAN 0 to HW filter on device bond0 [ 190.068746][T11845] 8021q: adding VLAN 0 to HW filter on device team0 [ 190.082561][ T1166] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.085646][ T1166] bridge0: port 1(bridge_slave_0) entered forwarding state [ 190.096468][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.099545][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state [ 190.141032][ T2327] usb 5-1: reset high-speed USB device number 7 using dummy_hcd [ 190.226734][ T5747] Bluetooth: hci1: command tx timeout [ 190.254909][T11926] sctp: [Deprecated]: syz.0.2364 (pid 11926) Use of struct sctp_assoc_value in delayed_ack socket option. [ 190.254909][T11926] Use struct sctp_sack_info instead [ 190.262469][T11926] __nla_validate_parse: 4 callbacks suppressed [ 190.262479][T11926] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2364'. [ 190.372094][ T5747] Bluetooth: hci2: Received unexpected HCI Event 0x00 [ 190.440999][T11845] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 190.501586][T11845] veth0_vlan: entered promiscuous mode [ 190.514379][T11845] veth1_vlan: entered promiscuous mode [ 190.538973][T11845] veth0_macvtap: entered promiscuous mode [ 190.547233][T11845] veth1_macvtap: entered promiscuous mode [ 190.563984][T11845] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 190.572555][T11845] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 190.609936][ T5589] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.617010][ T5589] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.648162][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.657507][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.743318][ T6685] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 190.746085][ T6685] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 190.770051][ T6685] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 190.772646][ T6685] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 191.402995][ T42] kauditd_printk_skb: 1 callbacks suppressed [ 191.403007][ T42] audit: type=1400 audit(1785755057.702:647): avc: denied { watch watch_reads } for pid=11948 comm="syz.1.2368" path="/proc/17/net/dev_snmp6" dev="proc" ino=4026533901 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=dir permissive=1 [ 191.710628][T11961] tipc: Started in network mode [ 191.712749][T11961] tipc: Node identity 4004, cluster identity 4711 [ 191.717434][T11961] tipc: Node number set to 16388 [ 191.762393][T11961] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2374'. [ 191.871112][ T5750] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 191.880595][ T5750] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 191.885667][ T5750] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 191.889660][ T5750] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 191.892349][ T5750] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 191.986372][ T2327] usb 5-1: [UEAGLE-ATM] urb submission failed with error -19 [ 191.990486][ T2327] ueagle-atm 5-1:1.0: usbatm_usb_probe: bind failed: -19! [ 192.009185][ T2327] usb 5-1: USB disconnect, device number 7 [ 192.053357][ T42] audit: type=1400 audit(1785755058.352:648): avc: denied { write } for pid=11967 comm="syz.3.2376" name="/" dev="9p" ino=78394615 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 192.306365][ T5747] Bluetooth: hci1: command tx timeout [ 192.473255][ T5589] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 192.478814][ T5589] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 192.564848][T11988] validate_nla: 5 callbacks suppressed [ 192.564861][T11988] netlink: 'syz.2.2381': attribute type 29 has an invalid length. [ 192.583952][T11988] netlink: 'syz.2.2381': attribute type 29 has an invalid length. [ 192.612278][T11988] netlink: 'syz.2.2381': attribute type 29 has an invalid length. [ 192.688377][ T5589] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 192.691952][ T5589] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 192.858488][ T5589] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 192.910735][ T5589] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.010626][T11963] bridge0: port 1(bridge_slave_0) entered blocking state [ 193.013500][T11963] bridge0: port 1(bridge_slave_0) entered disabled state [ 193.015997][T11963] bridge_slave_0: entered allmulticast mode [ 193.019306][T11963] bridge_slave_0: entered promiscuous mode [ 193.022668][T11963] bridge0: port 2(bridge_slave_1) entered blocking state [ 193.025029][T11963] bridge0: port 2(bridge_slave_1) entered disabled state [ 193.027900][T11963] bridge_slave_1: entered allmulticast mode [ 193.031360][T11963] bridge_slave_1: entered promiscuous mode [ 193.056719][ T5589] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 193.066789][ T5589] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.131611][T11963] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 193.136465][T11963] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 193.152870][T11963] team0: Port device team_slave_0 added [ 193.155847][T11963] team0: Port device team_slave_1 added [ 193.191138][T11963] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 193.200109][T11963] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 193.208785][T11963] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 193.218605][T11963] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 193.222275][T11963] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 193.231000][T11963] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 193.394127][T11963] hsr_slave_0: entered promiscuous mode [ 193.397674][T11963] hsr_slave_1: entered promiscuous mode [ 193.400291][T11963] debugfs: 'hsr0' already exists in 'hsr' [ 193.402253][T11963] Cannot create hsr debugfs directory [ 193.506323][ T5747] Bluetooth: hci4: command tx timeout [ 193.514941][ T42] audit: type=1400 audit(1785755059.812:649): avc: denied { write } for pid=12009 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 193.546098][ T5589] bridge_slave_1: left allmulticast mode [ 193.548849][ T5589] bridge_slave_1: left promiscuous mode [ 193.553510][ T5589] bridge0: port 2(bridge_slave_1) entered disabled state [ 193.563894][ T5589] bridge_slave_0: left allmulticast mode [ 193.565777][ T5589] bridge_slave_0: left promiscuous mode [ 193.571235][ T5589] bridge0: port 1(bridge_slave_0) entered disabled state [ 193.613235][ T42] audit: type=1400 audit(1785755059.912:650): avc: denied { write } for pid=12012 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 193.626756][T11955] Set syz1 is full, maxelem 65536 reached [ 193.816783][ T5589] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 193.825663][ T5589] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 193.834417][ T5589] bond0 (unregistering): (slave veth0_to_bond): Releasing backup interface [ 193.842124][ T5589] bond0 (unregistering): Released all slaves [ 193.858684][ T5451] 8021q: adding VLAN 0 to HW filter on device eth2 [ 193.942848][ T5589] tipc: Disabling bearer [ 193.964228][ T5589] tipc: Left network mode [ 193.988025][ T5747] Bluetooth: hci0: command tx timeout [ 194.036318][T12025] netlink: 'syz.2.2389': attribute type 29 has an invalid length. [ 194.039115][T12025] netlink: 'syz.2.2389': attribute type 29 has an invalid length. [ 194.116381][ T5747] Bluetooth: hci2: unexpected event for opcode 0x0004 [ 194.130155][ T42] audit: type=1400 audit(1785755060.432:651): avc: denied { write } for pid=12027 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 194.160001][ T1443] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.162760][ T1443] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.205429][ T42] audit: type=1400 audit(1785755060.502:652): avc: denied { write } for pid=12038 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 194.320110][ T5451] 8021q: adding VLAN 0 to HW filter on device eth3 [ 194.325416][T12042] FAULT_INJECTION: forcing a failure. [ 194.325416][T12042] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 194.333446][T12042] CPU: 0 UID: 0 PID: 12042 Comm: syz.1.2394 Tainted: G L syzkaller #0 PREEMPT(full) [ 194.333465][T12042] Tainted: [L]=SOFTLOCKUP [ 194.333469][T12042] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 194.333477][T12042] Call Trace: [ 194.333481][T12042] [ 194.333485][T12042] dump_stack_lvl+0x100/0x190 [ 194.333503][T12042] should_fail_ex.cold+0x5/0xa [ 194.333518][T12042] _copy_from_user+0x2e/0xd0 [ 194.333533][T12042] copy_msghdr_from_user+0x9f/0x4c0 [ 194.333546][T12042] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 194.333559][T12042] ? __pfx__kstrtoull+0x10/0x10 [ 194.333573][T12042] ___sys_sendmsg+0x106/0x1e0 [ 194.333584][T12042] ? __pfx____sys_sendmsg+0x10/0x10 [ 194.333601][T12042] ? find_held_lock+0x2b/0x80 [ 194.333619][T12042] __sys_sendmmsg+0x20c/0x440 [ 194.333635][T12042] ? __pfx___sys_sendmmsg+0x10/0x10 [ 194.333648][T12042] ? ksys_write+0x190/0x250 [ 194.333685][T12042] ? fput+0x79/0x100 [ 194.333698][T12042] ? ksys_write+0x1ac/0x250 [ 194.333714][T12042] ? __pfx_ksys_write+0x10/0x10 [ 194.333732][T12042] __x64_sys_sendmmsg+0x9c/0x100 [ 194.333746][T12042] ? lockdep_hardirqs_on+0x78/0x100 [ 194.333759][T12042] do_syscall_64+0x115/0x870 [ 194.333772][T12042] ? clear_bhb_loop+0x40/0x90 [ 194.333785][T12042] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.333797][T12042] RIP: 0033:0x7f17d5d9e019 [ 194.333806][T12042] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 194.333817][T12042] RSP: 002b:00007f17d6cba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 194.333828][T12042] RAX: ffffffffffffffda RBX: 00007f17d6026090 RCX: 00007f17d5d9e019 [ 194.333835][T12042] RDX: 0000000000000002 RSI: 0000200000002700 RDI: 0000000000000003 [ 194.333841][T12042] RBP: 00007f17d6cba090 R08: 0000000000000000 R09: 0000000000000000 [ 194.333847][T12042] R10: 0000000004040040 R11: 0000000000000246 R12: 0000000000000001 [ 194.333853][T12042] R13: 00007f17d6026128 R14: 00007f17d6026090 R15: 00007ffe4839bfe8 [ 194.333866][T12042] [ 194.400957][ T5747] Bluetooth: hci1: command tx timeout [ 194.524459][ T42] audit: type=1400 audit(1785755060.822:653): avc: denied { write } for pid=12050 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 194.549163][T12056] netlink: 'syz.3.2395': attribute type 1 has an invalid length. [ 194.603838][T12056] team0: Port device geneve2 added [ 194.683451][ T42] audit: type=1400 audit(1785755060.982:654): avc: denied { write } for pid=12061 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 194.709323][ T5589] hsr_slave_0: left promiscuous mode [ 194.713544][ T5589] hsr_slave_1: left promiscuous mode [ 194.719043][ T5589] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 194.724932][ T5589] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 194.732133][ T5589] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 194.738087][ T5589] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 194.761207][ T5589] veth1_macvtap: left promiscuous mode [ 194.767532][ T5589] veth0_macvtap: left promiscuous mode [ 194.769989][ T5589] veth1_vlan: left promiscuous mode [ 194.772116][ T5589] veth0_vlan: left promiscuous mode [ 194.888638][T12067] netlink: 'syz.2.2399': attribute type 29 has an invalid length. [ 195.044594][ T5589] team0 (unregistering): Port device team_slave_1 removed [ 195.080782][ T5589] team0 (unregistering): Port device team_slave_0 removed [ 195.350749][ T42] audit: type=1400 audit(1785755061.652:655): avc: denied { write } for pid=12071 comm="syz.1.2401" name="/" dev="9p" ino=78394615 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 195.396431][T12076] FAULT_INJECTION: forcing a failure. [ 195.396431][T12076] name failslab, interval 1, probability 0, space 0, times 0 [ 195.401957][T12076] CPU: 0 UID: 0 PID: 12076 Comm: syz.2.2402 Tainted: G L syzkaller #0 PREEMPT(full) [ 195.401986][T12076] Tainted: [L]=SOFTLOCKUP [ 195.401993][T12076] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 195.402003][T12076] Call Trace: [ 195.402011][T12076] [ 195.402018][T12076] dump_stack_lvl+0x100/0x190 [ 195.402046][T12076] should_fail_ex.cold+0x5/0xa [ 195.402071][T12076] should_failslab+0xc2/0x120 [ 195.402096][T12076] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 195.402119][T12076] ? __alloc_skb+0x5b7/0x710 [ 195.402142][T12076] ? __alloc_skb+0x140/0x710 [ 195.402168][T12076] __alloc_skb+0x140/0x710 [ 195.402189][T12076] ? __alloc_skb+0x5b7/0x710 [ 195.402210][T12076] ? __pfx___alloc_skb+0x10/0x10 [ 195.402240][T12076] netlink_alloc_large_skb+0x69/0x150 [ 195.402262][T12076] netlink_sendmsg+0x680/0xda0 [ 195.402286][T12076] ? __pfx_netlink_sendmsg+0x10/0x10 [ 195.402309][T12076] ? selinux_socket_sendmsg+0x198/0x2f0 [ 195.402339][T12076] ____sys_sendmsg+0xa4d/0xbe0 [ 195.402364][T12076] ? __pfx_netlink_sendmsg+0x10/0x10 [ 195.402402][T12076] ? __pfx_____sys_sendmsg+0x10/0x10 [ 195.402442][T12076] ___sys_sendmsg+0x190/0x1e0 [ 195.402462][T12076] ? __pfx____sys_sendmsg+0x10/0x10 [ 195.402477][T12076] ? __lock_acquire+0x49f/0x1a40 [ 195.402501][T12076] ? get_pid_task+0x106/0x250 [ 195.402561][T12076] __sys_sendmsg+0x160/0x210 [ 195.402587][T12076] ? __pfx___sys_sendmsg+0x10/0x10 [ 195.402621][T12076] do_syscall_64+0x115/0x870 [ 195.402645][T12076] ? clear_bhb_loop+0x40/0x90 [ 195.402668][T12076] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.402686][T12076] RIP: 0033:0x7f74e739e019 [ 195.402704][T12076] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 195.402722][T12076] RSP: 002b:00007f74e81e4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 195.402743][T12076] RAX: ffffffffffffffda RBX: 00007f74e7626090 RCX: 00007f74e739e019 [ 195.402754][T12076] RDX: 0000000000008000 RSI: 0000200000000280 RDI: 0000000000000006 [ 195.402766][T12076] RBP: 00007f74e81e4090 R08: 0000000000000000 R09: 0000000000000000 [ 195.402775][T12076] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 195.402786][T12076] R13: 00007f74e7626128 R14: 00007f74e7626090 R15: 00007ffed640bb08 [ 195.402811][T12076] [ 195.642526][ T42] audit: type=1400 audit(1785755061.942:656): avc: denied { write } for pid=12081 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 195.720616][T11963] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 195.733526][T11963] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 195.750025][T11963] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 195.777487][T11963] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 195.782516][T12088] FAULT_INJECTION: forcing a failure. [ 195.782516][T12088] name failslab, interval 1, probability 0, space 0, times 0 [ 195.787379][T11963] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 195.798256][T12088] CPU: 0 UID: 0 PID: 12088 Comm: syz.2.2404 Tainted: G L syzkaller #0 PREEMPT(full) [ 195.798275][T12088] Tainted: [L]=SOFTLOCKUP [ 195.798279][T12088] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 195.798285][T12088] Call Trace: [ 195.798290][T12088] [ 195.798295][T12088] dump_stack_lvl+0x100/0x190 [ 195.798313][T12088] should_fail_ex.cold+0x5/0xa [ 195.798328][T12088] should_failslab+0xc2/0x120 [ 195.798343][T12088] __kmalloc_noprof+0xfc/0x820 [ 195.798356][T12088] ? __pfx_dynamic_dname+0x10/0x10 [ 195.798372][T12088] ? tomoyo_encode2+0xfb/0x3c0 [ 195.798385][T12088] tomoyo_encode2+0xfb/0x3c0 [ 195.798397][T12088] tomoyo_encode+0x29/0x50 [ 195.798407][T12088] tomoyo_realpath_from_path+0x18c/0x690 [ 195.798421][T12088] tomoyo_path_number_perm+0x23c/0x580 [ 195.798437][T12088] ? tomoyo_path_number_perm+0x22e/0x580 [ 195.798453][T12088] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 195.798482][T12088] ? find_held_lock+0x2b/0x80 [ 195.798492][T12088] ? __fget_files+0x215/0x3d0 [ 195.798502][T12088] ? hook_file_ioctl_common+0x140/0x440 [ 195.798514][T12088] ? __fget_files+0x215/0x3d0 [ 195.798527][T12088] ? __fget_files+0x21f/0x3d0 [ 195.798540][T12088] security_file_ioctl+0xd3/0x230 [ 195.798557][T12088] __x64_sys_ioctl+0xb7/0x210 [ 195.798574][T12088] do_syscall_64+0x115/0x870 [ 195.798587][T12088] ? clear_bhb_loop+0x40/0x90 [ 195.798600][T12088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.798611][T12088] RIP: 0033:0x7f74e739e019 [ 195.798621][T12088] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 195.798632][T12088] RSP: 002b:00007f74e8205028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 195.798644][T12088] RAX: ffffffffffffffda RBX: 00007f74e7625fa0 RCX: 00007f74e739e019 [ 195.798651][T12088] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 195.798657][T12088] RBP: 00007f74e8205090 R08: 0000000000000000 R09: 0000000000000000 [ 195.798664][T12088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 195.798669][T12088] R13: 00007f74e7626038 R14: 00007f74e7625fa0 R15: 00007ffed640bb08 [ 195.798683][T12088] [ 195.798694][T12088] ERROR: Out of memory at tomoyo_realpath_from_path. [ 195.849519][T12095] Invalid argument reading file caps for ./file0 [ 195.889571][T11963] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 195.893480][T11963] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 195.901820][T11963] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 196.066304][ T5747] Bluetooth: hci0: command tx timeout [ 196.090770][T11963] 8021q: adding VLAN 0 to HW filter on device bond0 [ 196.180418][T11963] 8021q: adding VLAN 0 to HW filter on device team0 [ 196.208133][ T6671] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.211243][ T6671] bridge0: port 1(bridge_slave_0) entered forwarding state [ 196.231725][ T6671] bridge0: port 2(bridge_slave_1) entered blocking state [ 196.234840][ T6671] bridge0: port 2(bridge_slave_1) entered forwarding state [ 196.434051][T12135] netlink: 'syz.2.2407': attribute type 29 has an invalid length. [ 196.466303][ T5747] Bluetooth: hci1: command tx timeout [ 196.476813][ T42] kauditd_printk_skb: 4 callbacks suppressed [ 196.476825][ T42] audit: type=1400 audit(1785755062.772:661): avc: denied { write } for pid=12119 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 196.492354][T12135] netlink: 'syz.2.2407': attribute type 29 has an invalid length. [ 196.672067][ T42] audit: type=1400 audit(1785755062.972:662): avc: denied { write } for pid=12149 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 196.799637][T11838] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 196.922974][ T42] audit: type=1400 audit(1785755063.222:663): avc: denied { write } for pid=12162 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 196.956465][T11838] usb 6-1: Using ep0 maxpacket: 32 [ 196.963963][T11838] usb 6-1: config 0 has no interfaces? [ 196.969849][T11838] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 196.979096][T11838] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.011760][T11838] usb 6-1: config 0 descriptor?? [ 197.090498][T11963] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 197.091610][ T42] audit: type=1400 audit(1785755063.392:664): avc: denied { write } for pid=12173 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 197.181322][T11963] veth0_vlan: entered promiscuous mode [ 197.189886][T11963] veth1_vlan: entered promiscuous mode [ 197.228777][T11963] veth0_macvtap: entered promiscuous mode [ 197.259193][T12185] netlink: 'syz.2.2416': attribute type 29 has an invalid length. [ 197.281173][T11963] veth1_macvtap: entered promiscuous mode [ 197.299372][ T42] audit: type=1400 audit(1785755063.602:665): avc: denied { write } for pid=12186 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 197.314874][ T24] usb 6-1: USB disconnect, device number 19 [ 197.327885][T11963] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 197.344070][T11963] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 197.388115][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 197.390664][ T42] audit: type=1400 audit(1785755063.692:666): avc: denied { write } for pid=12193 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 197.396851][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 197.449844][ T5589] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 197.458658][ T5589] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 197.477348][ T5747] Bluetooth: hci2: unexpected event for opcode 0x0004 [ 197.500135][ T6671] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 197.511160][ T6671] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 197.550576][ T6669] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 197.556456][ T6669] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 197.571235][ T42] audit: type=1400 audit(1785755063.872:667): avc: denied { write } for pid=12200 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 197.629688][ T42] audit: type=1400 audit(1785755063.932:668): avc: denied { write } for pid=12204 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 197.670350][ T5747] Bluetooth: hci0: Received unexpected HCI Event 0x00 [ 197.698762][T12211] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2422'. [ 197.711974][T12212] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2422'. [ 197.723625][ T42] audit: type=1400 audit(1785755064.022:669): avc: denied { write } for pid=12210 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 197.735967][T12211] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2422'. [ 197.746320][T12212] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2422'. [ 197.795440][ T42] audit: type=1400 audit(1785755064.092:670): avc: denied { write } for pid=12217 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 198.018441][T12231] validate_nla: 2 callbacks suppressed [ 198.018453][T12231] netlink: 'syz.1.2426': attribute type 29 has an invalid length. [ 198.037329][T12231] netlink: 'syz.1.2426': attribute type 29 has an invalid length. [ 198.048785][T12231] netlink: 'syz.1.2426': attribute type 29 has an invalid length. [ 198.146727][ T5747] Bluetooth: hci0: command tx timeout [ 198.498696][T12257] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2436'. [ 198.501709][T12257] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2436'. [ 198.511724][T12257] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2436'. [ 198.519139][T12257] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2436'. [ 198.531295][ T13] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 198.540511][ T13] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 198.552652][ T13] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 198.567376][ T5589] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 198.571348][T12265] netlink: 'syz.3.2438': attribute type 29 has an invalid length. [ 198.574624][T12265] netlink: 'syz.3.2438': attribute type 29 has an invalid length. [ 198.585347][T12265] netlink: 'syz.3.2438': attribute type 29 has an invalid length. [ 199.736114][T12285] FAULT_INJECTION: forcing a failure. [ 199.736114][T12285] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 199.743720][T12285] CPU: 0 UID: 0 PID: 12285 Comm: syz.1.2446 Tainted: G L syzkaller #0 PREEMPT(full) [ 199.743745][T12285] Tainted: [L]=SOFTLOCKUP [ 199.743750][T12285] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 199.743761][T12285] Call Trace: [ 199.743768][T12285] [ 199.743798][T12285] dump_stack_lvl+0x100/0x190 [ 199.743828][T12285] should_fail_ex.cold+0x5/0xa [ 199.743855][T12285] _copy_from_user+0x2e/0xd0 [ 199.743882][T12285] __sys_bpf+0x2f5/0x4e80 [ 199.743923][T12285] ? __pfx___sys_bpf+0x10/0x10 [ 199.743940][T12285] ? find_held_lock+0x2b/0x80 [ 199.743958][T12285] ? get_pid_task+0xfc/0x250 [ 199.743976][T12285] ? get_pid_task+0xfc/0x250 [ 199.743998][T12285] ? find_held_lock+0x2b/0x80 [ 199.744019][T12285] ? rcu_read_lock_any_held+0x6a/0xa0 [ 199.744038][T12285] ? find_held_lock+0x2b/0x80 [ 199.744053][T12285] ? ksys_write+0x190/0x250 [ 199.744080][T12285] ? ksys_write+0x190/0x250 [ 199.744121][T12285] ? fput+0x79/0x100 [ 199.744147][T12285] ? __x64_sys_bpf+0xce/0x140 [ 199.744165][T12285] __x64_sys_bpf+0xce/0x140 [ 199.744183][T12285] ? do_syscall_64+0x90/0x870 [ 199.744207][T12285] do_syscall_64+0x115/0x870 [ 199.744227][T12285] ? clear_bhb_loop+0x40/0x90 [ 199.744248][T12285] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.744264][T12285] RIP: 0033:0x7f17d5d9e019 [ 199.744280][T12285] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 199.744295][T12285] RSP: 002b:00007f17d6cdb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 199.744312][T12285] RAX: ffffffffffffffda RBX: 00007f17d6025fa0 RCX: 00007f17d5d9e019 [ 199.744324][T12285] RDX: 000000000000000c RSI: 00002000000004c0 RDI: 000000000000000a [ 199.744334][T12285] RBP: 00007f17d6cdb090 R08: 0000000000000000 R09: 0000000000000000 [ 199.744344][T12285] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 199.744352][T12285] R13: 00007f17d6026038 R14: 00007f17d6025fa0 R15: 00007ffe4839bfe8 [ 199.744373][T12285] [ 199.967933][ T60] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 199.995489][T12295] netlink: 'syz.2.2449': attribute type 29 has an invalid length. [ 199.999540][T12295] netlink: 'syz.2.2449': attribute type 29 has an invalid length. [ 200.002599][T12295] netlink: 'syz.2.2449': attribute type 29 has an invalid length. [ 200.249122][ T5832] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 200.384712][T12267] Set syz1 is full, maxelem 65536 reached [ 200.606092][T12314] FAULT_INJECTION: forcing a failure. [ 200.606092][T12314] name failslab, interval 1, probability 0, space 0, times 0 [ 200.610813][T12314] CPU: 2 UID: 0 PID: 12314 Comm: syz.0.2457 Tainted: G L syzkaller #0 PREEMPT(full) [ 200.610838][T12314] Tainted: [L]=SOFTLOCKUP [ 200.610843][T12314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 200.610852][T12314] Call Trace: [ 200.610858][T12314] [ 200.610865][T12314] dump_stack_lvl+0x100/0x190 [ 200.610890][T12314] should_fail_ex.cold+0x5/0xa [ 200.610911][T12314] should_failslab+0xc2/0x120 [ 200.610932][T12314] __kmalloc_noprof+0xfc/0x820 [ 200.610950][T12314] ? __pfx_dynamic_dname+0x10/0x10 [ 200.610973][T12314] ? tomoyo_encode2+0xfb/0x3c0 [ 200.610993][T12314] tomoyo_encode2+0xfb/0x3c0 [ 200.611009][T12314] tomoyo_encode+0x29/0x50 [ 200.611022][T12314] tomoyo_realpath_from_path+0x18c/0x690 [ 200.611043][T12314] tomoyo_path_number_perm+0x23c/0x580 [ 200.611064][T12314] ? tomoyo_path_number_perm+0x22e/0x580 [ 200.611087][T12314] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 200.611130][T12314] ? find_held_lock+0x2b/0x80 [ 200.611145][T12314] ? __fget_files+0x215/0x3d0 [ 200.611160][T12314] ? hook_file_ioctl_common+0x140/0x440 [ 200.611177][T12314] ? __fget_files+0x215/0x3d0 [ 200.611196][T12314] ? __fget_files+0x21f/0x3d0 [ 200.611216][T12314] security_file_ioctl+0xd3/0x230 [ 200.611240][T12314] __x64_sys_ioctl+0xb7/0x210 [ 200.611263][T12314] do_syscall_64+0x115/0x870 [ 200.611281][T12314] ? clear_bhb_loop+0x40/0x90 [ 200.611301][T12314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.611317][T12314] RIP: 0033:0x7f035399e019 [ 200.611332][T12314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 200.611347][T12314] RSP: 002b:00007f0354788028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 200.611363][T12314] RAX: ffffffffffffffda RBX: 00007f0353c25fa0 RCX: 00007f035399e019 [ 200.611374][T12314] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 200.611384][T12314] RBP: 00007f0354788090 R08: 0000000000000000 R09: 0000000000000000 [ 200.611394][T12314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 200.611403][T12314] R13: 00007f0353c26038 R14: 00007f0353c25fa0 R15: 00007fffd2f1e1b8 [ 200.611426][T12314] [ 200.611441][T12314] ERROR: Out of memory at tomoyo_realpath_from_path. [ 200.759710][ T60] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 200.963769][T12317] netlink: 'syz.0.2458': attribute type 29 has an invalid length. [ 201.017155][T12319] FAULT_INJECTION: forcing a failure. [ 201.017155][T12319] name failslab, interval 1, probability 0, space 0, times 0 [ 201.024599][T12319] CPU: 2 UID: 0 PID: 12319 Comm: syz.0.2459 Tainted: G L syzkaller #0 PREEMPT(full) [ 201.024624][T12319] Tainted: [L]=SOFTLOCKUP [ 201.024629][T12319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 201.024638][T12319] Call Trace: [ 201.024644][T12319] [ 201.024651][T12319] dump_stack_lvl+0x100/0x190 [ 201.024676][T12319] should_fail_ex.cold+0x5/0xa [ 201.024697][T12319] should_failslab+0xc2/0x120 [ 201.024718][T12319] __kmalloc_cache_noprof+0x91/0x6c0 [ 201.024745][T12319] ? io_uring_setup.cold+0x6c/0x1cae [ 201.024787][T12319] io_uring_setup.cold+0x6c/0x1cae [ 201.024813][T12319] ? __pfx_io_uring_setup+0x10/0x10 [ 201.024836][T12319] ? find_held_lock+0x2b/0x80 [ 201.024851][T12319] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 201.024866][T12319] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 201.024897][T12319] ? ksys_write+0x1ac/0x250 [ 201.024920][T12319] ? __pfx_ksys_write+0x10/0x10 [ 201.024947][T12319] __x64_sys_io_uring_setup+0xc2/0x170 [ 201.024979][T12319] do_syscall_64+0x115/0x870 [ 201.024998][T12319] ? clear_bhb_loop+0x40/0x90 [ 201.025018][T12319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.025033][T12319] RIP: 0033:0x7f035399e019 [ 201.025048][T12319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 201.025063][T12319] RSP: 002b:00007f0354787ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 201.025080][T12319] RAX: ffffffffffffffda RBX: 0000200000000b48 RCX: 00007f035399e019 [ 201.025090][T12319] RDX: 0000200000000bc8 RSI: 0000200000000b48 RDI: 0000000000000104 [ 201.025099][T12319] RBP: 0000200000000b40 R08: 0000200000001f40 R09: 0000000000000000 [ 201.025110][T12319] R10: 0000200000000bd0 R11: 0000000000000206 R12: 0000200000000bc8 [ 201.025119][T12319] R13: 0000200000000bd0 R14: 00007f0354787fd8 R15: 0000000000000000 [ 201.025140][T12319] [ 201.029654][T12290] ceph: No mds server is up or the cluster is laggy [ 201.238320][T12323] bond1: entered promiscuous mode [ 201.454206][ T5747] Bluetooth: hci2: Received unexpected HCI Event 0x00 [ 201.472566][T12276] Set syz1 is full, maxelem 65536 reached [ 201.788922][ T42] kauditd_printk_skb: 6 callbacks suppressed [ 201.788933][ T42] audit: type=1400 audit(1785755068.092:677): avc: denied { create } for pid=12345 comm="syz.1.2470" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 201.805896][ T5750] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 201.813869][ T5750] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 201.819701][ T5750] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 201.824909][ T5750] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 201.829939][ T5750] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 201.835460][ T42] audit: type=1400 audit(1785755068.132:678): avc: denied { read } for pid=12342 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 201.842147][ T42] audit: type=1400 audit(1785755068.132:679): avc: denied { open } for pid=12342 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 202.192009][T12356] binder: 12355:12356 ioctl 4018620d 0 returned -22 [ 202.280854][ T5589] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 202.285316][ T5589] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.364869][ T5589] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 202.370048][ T5589] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.494910][ T5747] Bluetooth: hci0: Received unexpected HCI Event 0x00 [ 202.514522][ T5589] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 202.518185][ T5589] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.669781][ T5589] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 202.676547][ T5589] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.693751][T12342] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.698776][T12342] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.704790][T12342] bridge_slave_0: entered allmulticast mode [ 202.713693][T12342] bridge_slave_0: entered promiscuous mode [ 202.722906][T12342] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.725931][T12342] bridge0: port 2(bridge_slave_1) entered disabled state [ 202.728751][T12342] bridge_slave_1: entered allmulticast mode [ 202.732322][T12342] bridge_slave_1: entered promiscuous mode [ 202.767957][T12342] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 202.781529][T12342] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 202.812667][T12342] team0: Port device team_slave_0 added [ 202.820319][T12342] team0: Port device team_slave_1 added [ 202.859299][T12342] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 202.862190][T12342] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 202.873769][T12342] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 202.885249][T12342] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 202.892327][T12342] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 202.919743][T12342] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 203.090414][ T5747] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 203.104666][T12342] hsr_slave_0: entered promiscuous mode [ 203.115262][T12342] hsr_slave_1: entered promiscuous mode [ 203.190147][ T5589] bridge_slave_1: left allmulticast mode [ 203.193537][ T5589] bridge_slave_1: left promiscuous mode [ 203.202719][ T5589] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.228557][ T5589] bridge_slave_0: left allmulticast mode [ 203.230394][ T5589] bridge_slave_0: left promiscuous mode [ 203.232422][ T5589] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.271093][ T42] audit: type=1400 audit(1785755069.572:680): avc: denied { write } for pid=12397 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 203.325450][ T42] audit: type=1400 audit(1785755069.622:681): avc: denied { write } for pid=12400 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 203.391819][T12403] validate_nla: 8 callbacks suppressed [ 203.391839][T12403] netlink: 'syz.3.2485': attribute type 29 has an invalid length. [ 203.438692][T12396] binder: 12395:12396 ioctl 4018620d 0 returned -22 [ 203.448391][ T5589] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 203.452564][ T5589] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 203.456629][ T5589] bond0 (unregistering): Released all slaves [ 203.461811][ T5589] bond1 (unregistering): Released all slaves [ 203.492423][ T5451] 8021q: adding VLAN 0 to HW filter on device eth2 [ 203.498739][T12404] netlink: 'syz.3.2485': attribute type 29 has an invalid length. [ 203.556587][ T5589] tipc: Left network mode [ 203.675819][ T42] audit: type=1400 audit(1785755069.972:682): avc: denied { write } for pid=12409 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 203.777680][ T42] audit: type=1400 audit(1785755070.082:683): avc: denied { write } for pid=12412 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 203.906273][ T5747] Bluetooth: hci3: command tx timeout [ 203.918205][ T42] audit: type=1400 audit(1785755070.222:684): avc: denied { write } for pid=12415 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 203.961345][ T42] audit: type=1400 audit(1785755070.262:685): avc: denied { write } for pid=12418 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 204.003318][ T5589] hsr_slave_0: left promiscuous mode [ 204.011704][ T5589] hsr_slave_1: left promiscuous mode [ 204.018539][ T5589] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 204.022747][ T5589] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 204.026930][ T5589] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 204.029448][ T5589] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 204.041748][ T5589] veth1_macvtap: left promiscuous mode [ 204.045859][ T5589] veth0_macvtap: left promiscuous mode [ 204.052634][ T5589] veth1_vlan: left promiscuous mode [ 204.055939][ T5589] veth0_vlan: left promiscuous mode [ 204.069569][ T42] audit: type=1400 audit(1785755070.372:686): avc: denied { listen } for pid=12422 comm="syz.0.2488" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 204.230565][ T5747] Bluetooth: hci0: Received unexpected HCI Event 0x00 [ 204.308657][ T5589] team0 (unregistering): Port device team_slave_1 removed [ 204.318712][ T5589] team0 (unregistering): Port device team_slave_0 removed [ 204.373859][T12437] netlink: 'syz.1.2493': attribute type 29 has an invalid length. [ 204.432005][T12438] netlink: 'syz.1.2493': attribute type 29 has an invalid length. [ 204.790507][T12342] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 204.802434][T12342] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 204.808123][T12342] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 204.814348][T12342] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 204.818711][T12444] binder: 12442:12444 ioctl 4018620d 0 returned -22 [ 204.822311][T12342] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 204.844195][T12342] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 204.849523][T12342] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 204.861314][T12342] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 204.941570][T12342] 8021q: adding VLAN 0 to HW filter on device bond0 [ 204.961263][T12342] 8021q: adding VLAN 0 to HW filter on device team0 [ 204.970649][ T6667] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.973682][ T6667] bridge0: port 1(bridge_slave_0) entered forwarding state [ 205.000530][ T6667] bridge0: port 2(bridge_slave_1) entered blocking state [ 205.005718][ T6667] bridge0: port 2(bridge_slave_1) entered forwarding state [ 205.171452][T12467] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2497'. [ 205.338616][T12342] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 205.370406][T12342] veth0_vlan: entered promiscuous mode [ 205.377457][T12342] veth1_vlan: entered promiscuous mode [ 205.380864][T12479] FAULT_INJECTION: forcing a failure. [ 205.380864][T12479] name failslab, interval 1, probability 0, space 0, times 0 [ 205.385590][T12479] CPU: 0 UID: 0 PID: 12479 Comm: syz.0.2499 Tainted: G L syzkaller #0 PREEMPT(full) [ 205.385607][T12479] Tainted: [L]=SOFTLOCKUP [ 205.385611][T12479] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 205.385617][T12479] Call Trace: [ 205.385630][T12479] [ 205.385635][T12479] dump_stack_lvl+0x100/0x190 [ 205.385652][T12479] should_fail_ex.cold+0x5/0xa [ 205.385667][T12479] should_failslab+0xc2/0x120 [ 205.385682][T12479] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 205.385695][T12479] ? __alloc_skb+0x5b7/0x710 [ 205.385708][T12479] ? __alloc_skb+0x140/0x710 [ 205.385722][T12479] __alloc_skb+0x140/0x710 [ 205.385734][T12479] ? __alloc_skb+0x5b7/0x710 [ 205.385746][T12479] ? __pfx___alloc_skb+0x10/0x10 [ 205.385762][T12479] netlink_alloc_large_skb+0x69/0x150 [ 205.385776][T12479] netlink_sendmsg+0x680/0xda0 [ 205.385789][T12479] ? __pfx_netlink_sendmsg+0x10/0x10 [ 205.385802][T12479] ? selinux_socket_sendmsg+0x198/0x2f0 [ 205.385820][T12479] ____sys_sendmsg+0xa4d/0xbe0 [ 205.385836][T12479] ? __pfx_netlink_sendmsg+0x10/0x10 [ 205.385867][T12479] ? __pfx_____sys_sendmsg+0x10/0x10 [ 205.385890][T12479] ___sys_sendmsg+0x190/0x1e0 [ 205.385901][T12479] ? __pfx____sys_sendmsg+0x10/0x10 [ 205.385911][T12479] ? __lock_acquire+0x49f/0x1a40 [ 205.385925][T12479] ? get_pid_task+0x106/0x250 [ 205.385957][T12479] __sys_sendmsg+0x160/0x210 [ 205.385972][T12479] ? __pfx___sys_sendmsg+0x10/0x10 [ 205.385993][T12479] do_syscall_64+0x115/0x870 [ 205.386006][T12479] ? clear_bhb_loop+0x40/0x90 [ 205.386019][T12479] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 205.386031][T12479] RIP: 0033:0x7f035399e019 [ 205.386040][T12479] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 205.386051][T12479] RSP: 002b:00007f0354788028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 205.386069][T12479] RAX: ffffffffffffffda RBX: 00007f0353c25fa0 RCX: 00007f035399e019 [ 205.386076][T12479] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 205.386082][T12479] RBP: 00007f0354788090 R08: 0000000000000000 R09: 0000000000000000 [ 205.386088][T12479] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 205.386095][T12479] R13: 00007f0353c26038 R14: 00007f0353c25fa0 R15: 00007fffd2f1e1b8 [ 205.386108][T12479] [ 205.391406][T12342] veth0_macvtap: entered promiscuous mode [ 205.487157][ T5747] Bluetooth: hci0: Received unexpected HCI Event 0x00 [ 205.505173][T12342] veth1_macvtap: entered promiscuous mode [ 205.532384][T12342] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 205.542574][T12342] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 205.551003][T12485] netlink: 'syz.1.2502': attribute type 29 has an invalid length. [ 205.558930][T12485] netlink: 'syz.1.2502': attribute type 29 has an invalid length. [ 205.564304][T12485] netlink: 'syz.1.2502': attribute type 29 has an invalid length. [ 205.587269][ T5589] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 205.598952][ T5589] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 205.653116][ T6669] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 205.660670][ T6669] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 205.688085][ T1168] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 205.690833][ T1168] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 205.697395][ T5818] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 205.700156][ T5818] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 205.799881][T12500] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2507'. [ 205.827887][T12503] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2508'. [ 205.830826][T12503] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2508'. [ 205.954036][T12496] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2505'. [ 205.958237][T12496] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2505'. [ 205.977668][T12496] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2505'. [ 205.981508][T12496] netlink: 'syz.1.2505': attribute type 30 has an invalid length. [ 205.996590][ T5747] Bluetooth: hci3: command tx timeout [ 205.997408][ T5818] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 206.009047][ T5818] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 206.017250][ T5818] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 206.025931][ T5818] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 206.085533][T12513] netlink: 'syz.1.2511': attribute type 29 has an invalid length. [ 206.088979][T12513] netlink: 'syz.1.2511': attribute type 29 has an invalid length. [ 206.121915][ T5747] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 206.224112][T12520] loop3: detected capacity change from 0 to 7 [ 206.228394][ C2] blk_print_req_error: 25 callbacks suppressed [ 206.228406][ C2] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 206.233927][ C2] buffer_io_error: 25 callbacks suppressed [ 206.233939][ C2] Buffer I/O error on dev loop3, logical block 0, async page read [ 206.241915][ C2] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 206.245001][ C2] Buffer I/O error on dev loop3, logical block 0, async page read [ 206.248387][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 206.251722][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 206.254824][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 206.257990][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 206.260601][ C2] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 206.263728][ C2] Buffer I/O error on dev loop3, logical block 0, async page read [ 206.267586][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 206.270700][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 206.273506][ C2] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 206.276604][ C2] Buffer I/O error on dev loop3, logical block 0, async page read [ 206.279104][T12520] ldm_validate_partition_table(): Disk read failed. [ 206.282449][ C2] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 206.285511][ C2] Buffer I/O error on dev loop3, logical block 0, async page read [ 206.288225][ C2] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 206.291302][ C2] Buffer I/O error on dev loop3, logical block 0, async page read [ 206.293895][ C2] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 206.296981][ C2] Buffer I/O error on dev loop3, logical block 0, async page read [ 206.299906][T12520] Dev loop3: unable to read RDB block 0 [ 206.306115][T12520] loop3: unable to read partition table [ 206.310036][T12520] loop3: partition table beyond EOD, truncated [ 206.313661][T12520] loop_reread_partitions: partition scan of loop3 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 206.643989][ T5747] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 206.828048][T12552] FAULT_INJECTION: forcing a failure. [ 206.828048][T12552] name failslab, interval 1, probability 0, space 0, times 0 [ 206.835513][T12552] CPU: 2 UID: 0 PID: 12552 Comm: syz.2.2525 Tainted: G L syzkaller #0 PREEMPT(full) [ 206.835532][T12552] Tainted: [L]=SOFTLOCKUP [ 206.835542][T12552] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 206.835549][T12552] Call Trace: [ 206.835553][T12552] [ 206.835558][T12552] dump_stack_lvl+0x100/0x190 [ 206.835578][T12552] should_fail_ex.cold+0x5/0xa [ 206.835593][T12552] should_failslab+0xc2/0x120 [ 206.835608][T12552] kmem_cache_alloc_noprof+0x91/0x6a0 [ 206.835622][T12552] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 206.835651][T12552] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 206.835667][T12552] mmu_topup_memory_caches+0x25/0x170 [ 206.835691][T12552] kvm_mmu_load+0xe2/0x2570 [ 206.835707][T12552] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 206.835718][T12552] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 206.835731][T12552] ? __pfx_kvm_mmu_load+0x10/0x10 [ 206.835768][T12552] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 206.835789][T12552] ? kvm_check_and_inject_events+0x873/0x12a0 [ 206.835806][T12552] ? record_steal_time+0x3a0/0xbb0 [ 206.835819][T12552] vcpu_run+0x3aaa/0x5de0 [ 206.835840][T12552] ? __pfx_vcpu_run+0x10/0x10 [ 206.835860][T12552] ? rcu_is_watching+0x12/0xc0 [ 206.835880][T12552] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 206.835895][T12552] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 206.835915][T12552] kvm_vcpu_ioctl+0x730/0x1700 [ 206.835928][T12552] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 206.835940][T12552] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 206.835960][T12552] ? do_vfs_ioctl+0x226/0x13e0 [ 206.835975][T12552] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 206.835991][T12552] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 206.836013][T12552] ? __fget_files+0x215/0x3d0 [ 206.836024][T12552] ? hook_file_ioctl_common+0x140/0x440 [ 206.836040][T12552] ? selinux_file_ioctl+0x13b/0x290 [ 206.836056][T12552] ? selinux_file_ioctl+0xb6/0x290 [ 206.836072][T12552] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 206.836085][T12552] __x64_sys_ioctl+0x18e/0x210 [ 206.836102][T12552] do_syscall_64+0x115/0x870 [ 206.836115][T12552] ? clear_bhb_loop+0x40/0x90 [ 206.836142][T12552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 206.836154][T12552] RIP: 0033:0x7fe05d39e019 [ 206.836163][T12552] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 206.836174][T12552] RSP: 002b:00007fe05e2f8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 206.836186][T12552] RAX: ffffffffffffffda RBX: 00007fe05d625fa0 RCX: 00007fe05d39e019 [ 206.836193][T12552] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 206.836199][T12552] RBP: 00007fe05e2f8090 R08: 0000000000000000 R09: 0000000000000000 [ 206.836205][T12552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 206.836211][T12552] R13: 00007fe05d626038 R14: 00007fe05d625fa0 R15: 00007ffd15a2a9a8 [ 206.836225][T12552] [ 207.055060][T12571] capability: warning: `syz.3.2533' uses 32-bit capabilities (legacy support in use) [ 207.087904][ T5747] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 207.181578][T12575] FAULT_INJECTION: forcing a failure. [ 207.181578][T12575] name failslab, interval 1, probability 0, space 0, times 0 [ 207.185628][T12575] CPU: 0 UID: 0 PID: 12575 Comm: syz.3.2535 Tainted: G L syzkaller #0 PREEMPT(full) [ 207.185645][T12575] Tainted: [L]=SOFTLOCKUP [ 207.185649][T12575] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 207.185656][T12575] Call Trace: [ 207.185660][T12575] [ 207.185665][T12575] dump_stack_lvl+0x100/0x190 [ 207.185682][T12575] should_fail_ex.cold+0x5/0xa [ 207.185697][T12575] should_failslab+0xc2/0x120 [ 207.185713][T12575] kmem_cache_alloc_noprof+0x91/0x6a0 [ 207.185727][T12575] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 207.185744][T12575] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 207.185761][T12575] mmu_topup_memory_caches+0x25/0x170 [ 207.185778][T12575] kvm_mmu_load+0xe2/0x2570 [ 207.185792][T12575] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 207.185804][T12575] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 207.185817][T12575] ? __pfx_kvm_mmu_load+0x10/0x10 [ 207.185830][T12575] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 207.185844][T12575] ? kvm_check_and_inject_events+0x873/0x12a0 [ 207.185860][T12575] ? record_steal_time+0x3a0/0xbb0 [ 207.185873][T12575] vcpu_run+0x3aaa/0x5de0 [ 207.185893][T12575] ? __pfx_vcpu_run+0x10/0x10 [ 207.185913][T12575] ? rcu_is_watching+0x12/0xc0 [ 207.185932][T12575] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 207.185948][T12575] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 207.185967][T12575] kvm_vcpu_ioctl+0x730/0x1700 [ 207.185980][T12575] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 207.185992][T12575] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 207.186006][T12575] ? do_vfs_ioctl+0x226/0x13e0 [ 207.186022][T12575] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 207.186038][T12575] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 207.186060][T12575] ? __fget_files+0x215/0x3d0 [ 207.186071][T12575] ? hook_file_ioctl_common+0x140/0x440 [ 207.186087][T12575] ? selinux_file_ioctl+0x13b/0x290 [ 207.186103][T12575] ? selinux_file_ioctl+0xb6/0x290 [ 207.186132][T12575] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 207.186147][T12575] __x64_sys_ioctl+0x18e/0x210 [ 207.186163][T12575] do_syscall_64+0x115/0x870 [ 207.186177][T12575] ? clear_bhb_loop+0x40/0x90 [ 207.186189][T12575] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.186201][T12575] RIP: 0033:0x7fd53c79e019 [ 207.186210][T12575] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 207.186220][T12575] RSP: 002b:00007fd53d685028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 207.186232][T12575] RAX: ffffffffffffffda RBX: 00007fd53ca25fa0 RCX: 00007fd53c79e019 [ 207.186238][T12575] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 207.186245][T12575] RBP: 00007fd53d685090 R08: 0000000000000000 R09: 0000000000000000 [ 207.186251][T12575] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 207.186257][T12575] R13: 00007fd53ca26038 R14: 00007fd53ca25fa0 R15: 00007fffa38c5248 [ 207.186271][T12575] [ 207.419327][T12578] FAULT_INJECTION: forcing a failure. [ 207.419327][T12578] name failslab, interval 1, probability 0, space 0, times 0 [ 207.425003][T12578] CPU: 2 UID: 0 PID: 12578 Comm: syz.3.2536 Tainted: G L syzkaller #0 PREEMPT(full) [ 207.425022][T12578] Tainted: [L]=SOFTLOCKUP [ 207.425027][T12578] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 207.425034][T12578] Call Trace: [ 207.425037][T12578] [ 207.425042][T12578] dump_stack_lvl+0x100/0x190 [ 207.425061][T12578] should_fail_ex.cold+0x5/0xa [ 207.425076][T12578] should_failslab+0xc2/0x120 [ 207.425091][T12578] kmem_cache_alloc_noprof+0x91/0x6a0 [ 207.425106][T12578] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 207.425124][T12578] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 207.425142][T12578] mmu_topup_memory_caches+0x25/0x170 [ 207.425160][T12578] kvm_mmu_load+0xe2/0x2570 [ 207.425176][T12578] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 207.425189][T12578] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 207.425202][T12578] ? __pfx_kvm_mmu_load+0x10/0x10 [ 207.425217][T12578] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 207.425231][T12578] ? kvm_check_and_inject_events+0x873/0x12a0 [ 207.425247][T12578] ? record_steal_time+0x3a0/0xbb0 [ 207.425262][T12578] vcpu_run+0x3aaa/0x5de0 [ 207.425284][T12578] ? __pfx_vcpu_run+0x10/0x10 [ 207.425305][T12578] ? rcu_is_watching+0x12/0xc0 [ 207.425325][T12578] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 207.425341][T12578] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 207.425362][T12578] kvm_vcpu_ioctl+0x730/0x1700 [ 207.425376][T12578] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 207.425389][T12578] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 207.425404][T12578] ? do_vfs_ioctl+0x226/0x13e0 [ 207.425422][T12578] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 207.425438][T12578] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 207.425462][T12578] ? __fget_files+0x215/0x3d0 [ 207.425473][T12578] ? hook_file_ioctl_common+0x140/0x440 [ 207.425490][T12578] ? selinux_file_ioctl+0x13b/0x290 [ 207.425507][T12578] ? selinux_file_ioctl+0xb6/0x290 [ 207.425526][T12578] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 207.425539][T12578] __x64_sys_ioctl+0x18e/0x210 [ 207.425556][T12578] do_syscall_64+0x115/0x870 [ 207.425570][T12578] ? clear_bhb_loop+0x40/0x90 [ 207.425584][T12578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.425596][T12578] RIP: 0033:0x7fd53c79e019 [ 207.425606][T12578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 207.425617][T12578] RSP: 002b:00007fd53d685028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 207.425648][T12578] RAX: ffffffffffffffda RBX: 00007fd53ca25fa0 RCX: 00007fd53c79e019 [ 207.425655][T12578] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 207.425661][T12578] RBP: 00007fd53d685090 R08: 0000000000000000 R09: 0000000000000000 [ 207.425668][T12578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 207.425674][T12578] R13: 00007fd53ca26038 R14: 00007fd53ca25fa0 R15: 00007fffa38c5248 [ 207.425689][T12578] [ 207.780041][ T42] kauditd_printk_skb: 12 callbacks suppressed [ 207.780053][ T42] audit: type=1400 audit(1785755074.082:699): avc: denied { write } for pid=12594 comm="syz.1.2544" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 207.789583][ T42] audit: type=1400 audit(1785755074.082:700): avc: denied { write } for pid=12594 comm="syz.1.2544" name="hpet" dev="devtmpfs" ino=630 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 207.803031][ T5747] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 207.808941][ T42] audit: type=1400 audit(1785755074.112:701): avc: denied { setopt } for pid=12594 comm="syz.1.2544" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 207.855560][T12599] FAULT_INJECTION: forcing a failure. [ 207.855560][T12599] name failslab, interval 1, probability 0, space 0, times 0 [ 207.861534][T12599] CPU: 2 UID: 0 PID: 12599 Comm: syz.0.2545 Tainted: G L syzkaller #0 PREEMPT(full) [ 207.861553][T12599] Tainted: [L]=SOFTLOCKUP [ 207.861557][T12599] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 207.861564][T12599] Call Trace: [ 207.861568][T12599] [ 207.861573][T12599] dump_stack_lvl+0x100/0x190 [ 207.861591][T12599] should_fail_ex.cold+0x5/0xa [ 207.861606][T12599] should_failslab+0xc2/0x120 [ 207.861621][T12599] kmem_cache_alloc_noprof+0x91/0x6a0 [ 207.861633][T12599] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 207.861649][T12599] ? __lock_acquire+0x49f/0x1a40 [ 207.861662][T12599] ? sctp_get_port_local+0x828/0x1630 [ 207.861680][T12599] sctp_get_port_local+0x828/0x1630 [ 207.861699][T12599] ? __pfx_sctp_get_port_local+0x10/0x10 [ 207.861717][T12599] ? sctp_bind_addr_match+0x19d/0x300 [ 207.861732][T12599] sctp_do_bind+0x2b9/0x760 [ 207.861745][T12599] sctp_connect_new_asoc+0x5e7/0x770 [ 207.861757][T12599] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 207.861773][T12599] sctp_sendmsg+0x1743/0x22e0 [ 207.861787][T12599] ? __pfx_sctp_sendmsg+0x10/0x10 [ 207.861797][T12599] ? sock_has_perm+0x25a/0x2f0 [ 207.861812][T12599] ? __pfx_sock_has_perm+0x10/0x10 [ 207.861830][T12599] ? __might_fault+0xc5/0x140 [ 207.861845][T12599] ? __pfx_sctp_sendmsg+0x10/0x10 [ 207.861856][T12599] inet_sendmsg+0x11c/0x140 [ 207.861872][T12599] __sys_sendto+0x453/0x4e0 [ 207.861885][T12599] ? __pfx_inet_sendmsg+0x10/0x10 [ 207.861899][T12599] ? __pfx___sys_sendto+0x10/0x10 [ 207.861915][T12599] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 207.861934][T12599] ? ksys_write+0x1ac/0x250 [ 207.861956][T12599] ? __pfx_ksys_write+0x10/0x10 [ 207.861974][T12599] __x64_sys_sendto+0xe0/0x1c0 [ 207.861986][T12599] ? do_syscall_64+0x90/0x870 [ 207.861998][T12599] ? lockdep_hardirqs_on+0x78/0x100 [ 207.862011][T12599] do_syscall_64+0x115/0x870 [ 207.862023][T12599] ? clear_bhb_loop+0x40/0x90 [ 207.862037][T12599] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.862048][T12599] RIP: 0033:0x7f035399e019 [ 207.862059][T12599] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 207.862069][T12599] RSP: 002b:00007f0354788028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 207.862080][T12599] RAX: ffffffffffffffda RBX: 00007f0353c25fa0 RCX: 00007f035399e019 [ 207.862087][T12599] RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000003 [ 207.862093][T12599] RBP: 00007f0354788090 R08: 0000200000000040 R09: 000000000000001c [ 207.862099][T12599] R10: 0000000000044005 R11: 0000000000000246 R12: 0000000000000001 [ 207.862105][T12599] R13: 00007f0353c26038 R14: 00007f0353c25fa0 R15: 00007fffd2f1e1b8 [ 207.862118][T12599] [ 208.070561][ T5747] Bluetooth: hci3: command tx timeout [ 208.108608][T12607] FAULT_INJECTION: forcing a failure. [ 208.108608][T12607] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 208.112869][T12607] CPU: 0 UID: 0 PID: 12607 Comm: syz.3.2549 Tainted: G L syzkaller #0 PREEMPT(full) [ 208.112886][T12607] Tainted: [L]=SOFTLOCKUP [ 208.112890][T12607] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 208.112897][T12607] Call Trace: [ 208.112901][T12607] [ 208.112905][T12607] dump_stack_lvl+0x100/0x190 [ 208.112924][T12607] should_fail_ex.cold+0x5/0xa [ 208.112936][T12607] ? prepare_alloc_pages+0x16d/0x5f0 [ 208.112953][T12607] should_fail_alloc_page+0xeb/0x140 [ 208.112969][T12607] prepare_alloc_pages+0x1f0/0x5f0 [ 208.112986][T12607] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 208.112999][T12607] ? __pfx_stack_trace_save+0x10/0x10 [ 208.113012][T12607] ? stack_depot_save_flags+0x27/0x9d0 [ 208.113035][T12607] ? stack_depot_save_flags+0x27/0x9d0 [ 208.113052][T12607] ? kasan_save_stack+0x3f/0x50 [ 208.113065][T12607] ? kasan_save_stack+0x30/0x50 [ 208.113076][T12607] ? kasan_save_track+0x14/0x30 [ 208.113088][T12607] ? __kasan_kmalloc+0xaa/0xb0 [ 208.113100][T12607] ? __kvmalloc_node_noprof+0x34f/0x970 [ 208.113112][T12607] ? __kvm_mmu_topup_memory_cache+0x455/0x5f0 [ 208.113125][T12607] ? mmu_topup_memory_caches+0xbc/0x170 [ 208.113141][T12607] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 208.113153][T12607] ? kvm_vcpu_ioctl+0x730/0x1700 [ 208.113164][T12607] ? do_syscall_64+0x115/0x870 [ 208.113189][T12607] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 208.113203][T12607] ? policy_nodemask+0xed/0x4f0 [ 208.113219][T12607] alloc_pages_mpol+0x1fb/0x540 [ 208.113234][T12607] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 208.113249][T12607] ? __kvmalloc_node_noprof+0x36d/0x970 [ 208.113264][T12607] alloc_pages_noprof+0x1a/0x160 [ 208.113281][T12607] get_free_pages_noprof+0x10/0xb0 [ 208.113308][T12607] __kvm_mmu_topup_memory_cache+0x278/0x5f0 [ 208.113326][T12607] mmu_topup_memory_caches+0xbc/0x170 [ 208.113342][T12607] kvm_mmu_load+0xe2/0x2570 [ 208.113357][T12607] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 208.113369][T12607] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 208.113382][T12607] ? __pfx_kvm_mmu_load+0x10/0x10 [ 208.113395][T12607] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 208.113409][T12607] ? kvm_check_and_inject_events+0x873/0x12a0 [ 208.113425][T12607] ? record_steal_time+0x3a0/0xbb0 [ 208.113438][T12607] vcpu_run+0x3aaa/0x5de0 [ 208.113459][T12607] ? __pfx_vcpu_run+0x10/0x10 [ 208.113479][T12607] ? rcu_is_watching+0x12/0xc0 [ 208.113498][T12607] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 208.113514][T12607] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 208.113533][T12607] kvm_vcpu_ioctl+0x730/0x1700 [ 208.113546][T12607] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 208.113559][T12607] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 208.113572][T12607] ? do_vfs_ioctl+0x226/0x13e0 [ 208.113588][T12607] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 208.113604][T12607] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 208.113626][T12607] ? __fget_files+0x215/0x3d0 [ 208.113636][T12607] ? hook_file_ioctl_common+0x140/0x440 [ 208.113652][T12607] ? selinux_file_ioctl+0x13b/0x290 [ 208.113668][T12607] ? selinux_file_ioctl+0xb6/0x290 [ 208.113686][T12607] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 208.113698][T12607] __x64_sys_ioctl+0x18e/0x210 [ 208.113726][T12607] do_syscall_64+0x115/0x870 [ 208.113740][T12607] ? clear_bhb_loop+0x40/0x90 [ 208.113753][T12607] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 208.113765][T12607] RIP: 0033:0x7fd53c79e019 [ 208.113774][T12607] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 208.113784][T12607] RSP: 002b:00007fd53d685028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 208.113796][T12607] RAX: ffffffffffffffda RBX: 00007fd53ca25fa0 RCX: 00007fd53c79e019 [ 208.113802][T12607] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 208.113809][T12607] RBP: 00007fd53d685090 R08: 0000000000000000 R09: 0000000000000000 [ 208.113815][T12607] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 208.113821][T12607] R13: 00007fd53ca26038 R14: 00007fd53ca25fa0 R15: 00007fffa38c5248 [ 208.113834][T12607] [ 208.445978][T12623] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 208.450935][ T42] audit: type=1400 audit(1785755074.762:702): avc: denied { search } for pid=12622 comm="syz.2.2555" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 208.465138][ T42] audit: type=1400 audit(1785755074.762:703): avc: denied { read } for pid=12622 comm="syz.2.2555" name="trace_pipe" dev="tracefs" ino=1355 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 208.481722][ T42] audit: type=1400 audit(1785755074.762:704): avc: denied { open } for pid=12622 comm="syz.2.2555" path="/18/debug/tracing/trace_pipe" dev="tracefs" ino=1355 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 208.505360][ T5747] Bluetooth: hci3: Received unexpected HCI Event 0x00 [ 208.890511][ T42] audit: type=1400 audit(1785755075.192:705): avc: denied { setopt } for pid=12633 comm="syz.1.2560" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 208.934662][T12637] validate_nla: 14 callbacks suppressed [ 208.934681][T12637] netlink: 'syz.1.2561': attribute type 29 has an invalid length. [ 208.944470][T12637] netlink: 'syz.1.2561': attribute type 29 has an invalid length. [ 208.948486][T12637] netlink: 'syz.1.2561': attribute type 29 has an invalid length. [ 209.088515][ T42] audit: type=1400 audit(1785755075.392:706): avc: denied { write } for pid=12641 comm="syz.3.2563" name="sg0" dev="devtmpfs" ino=722 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 209.127787][ T42] audit: type=1400 audit(1785755075.432:707): avc: denied { ioctl } for pid=12641 comm="syz.3.2563" path="socket:[79442]" dev="sockfs" ino=79442 ioctlcmd=0x8971 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 209.173358][T12645] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2564'. [ 209.182089][T12645] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2564'. [ 209.190168][T12645] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2564'. [ 209.258759][ T5747] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 209.632325][T12660] netlink: 'syz.2.2570': attribute type 29 has an invalid length. [ 209.641451][T12660] netlink: 'syz.2.2570': attribute type 29 has an invalid length. [ 209.651410][T12660] netlink: 'syz.2.2570': attribute type 29 has an invalid length. [ 209.893019][T12667] block2mtd: too many arguments [ 209.906971][ T9] libceph: connect (1)[c::]:6789 error -101 [ 209.909730][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 210.008359][T12667] ceph: No mds server is up or the cluster is laggy [ 210.049504][ T5747] Bluetooth: hci0: Received unexpected HCI Event 0x00 [ 210.147032][ T5747] Bluetooth: hci3: command tx timeout [ 210.222397][T12680] e1000e 0000:00:02.0 eth1: removed PHC [ 210.248004][ T42] audit: type=1400 audit(1785755076.542:708): avc: denied { remount } for pid=12682 comm="syz.3.2577" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 210.371719][T12688] netlink: 'syz.3.2579': attribute type 29 has an invalid length. [ 210.422243][T12688] netlink: 'syz.3.2579': attribute type 29 has an invalid length. [ 210.434175][T12688] netlink: 'syz.3.2579': attribute type 29 has an invalid length. [ 210.544331][T12697] ------------[ cut here ]------------ [ 210.546912][T12697] kvm_is_error_gpa(gpa) == kvm_is_error_hva(uhva) [ 210.546921][T12697] WARNING: arch/x86/kvm/../../../virt/kvm/pfncache.c:267 at __kvm_gpc_refresh+0x1a98/0x22d0, CPU#2: syz.3.2580/12697 [ 210.552965][T12697] Modules linked in: [ 210.556560][T12697] CPU: 2 UID: 0 PID: 12697 Comm: syz.3.2580 Tainted: G L syzkaller #0 PREEMPT(full) [ 210.560306][T12697] Tainted: [L]=SOFTLOCKUP [ 210.561708][T12697] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 210.564857][T12697] RIP: 0010:__kvm_gpc_refresh+0x1a98/0x22d0 [ 210.567047][T12697] Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 31 07 00 00 48 8b 04 24 31 db 48 8b a8 08 01 00 00 e9 2b f6 ff ff e8 69 2f 87 00 90 <0f> 0b 90 e9 55 f8 ff ff e8 5b 2f 87 00 48 c7 c6 a0 b9 c2 8b 48 89 [ 210.573277][T12697] RSP: 0018:ffffc9000361f228 EFLAGS: 00010293 [ 210.575457][T12697] RAX: 0000000000000000 RBX: ffffffffffffffff RCX: ffffffff81831900 [ 210.578005][T12697] RDX: ffff88802ba54a80 RSI: ffffffff818332b7 RDI: ffff88802ba54a80 [ 210.580492][T12697] RBP: ffff888000000000 R08: 0000000000000000 R09: 0000000000000001 [ 210.582998][T12697] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000001001 [ 210.585459][T12697] R13: ffff888000000001 R14: ffff888000000000 R15: ffffc9000361f448 [ 210.588014][T12697] FS: 00007fd53d6646c0(0000) GS:ffff8880d5fd8000(0000) knlGS:0000000000000000 [ 210.590805][T12697] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 210.592920][T12697] CR2: 00007fd53d642ff8 CR3: 000000002ab82000 CR4: 0000000000352ef0 [ 210.597371][T12697] DR0: 0000000000000008 DR1: 0000000000000002 DR2: 0000000000000404 [ 210.599923][T12697] DR3: ffffffffefffff14 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 210.602445][T12697] Call Trace: [ 210.603531][T12697] [ 210.604513][T12697] ? find_held_lock+0x2b/0x80 [ 210.606065][T12697] ? kvm_xen_set_evtchn_fast+0x874/0xe80 [ 210.607912][T12697] ? __pfx___mutex_lock+0x10/0x10 [ 210.609511][T12697] ? __lock_acquire+0x49f/0x1a40 [ 210.611093][T12697] ? __pfx___kvm_gpc_refresh+0x10/0x10 [ 210.612831][T12697] kvm_gpc_refresh+0xc9/0x160 [ 210.614333][T12697] kvm_xen_set_evtchn.part.0+0x168/0x230 [ 210.616114][T12697] ? kvm_xen_set_evtchn.part.0+0x153/0x230 [ 210.618101][T12697] kvm_xen_hvm_evtchn_send+0x22f/0x290 [ 210.619850][T12697] ? __pfx_kvm_xen_hvm_evtchn_send+0x10/0x10 [ 210.621767][T12697] kvm_arch_vm_ioctl+0x13ac/0x18d0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 210.624631][T12697] ? __pfx_kvm_arch_vm_ioctl+0x10/0x10 [ 210.626673][T12697] ? vfs_open+0x82/0x3f0 [ 210.628062][T12697] ? path_openat+0x2873/0x4280 [ 210.629760][T12697] ? __lock_acquire+0x49f/0x1a40 [ 210.631402][T12697] ? __lock_acquire+0x49f/0x1a40 [ 210.632991][T12697] ? __lock_acquire+0x49f/0x1a40 [ 210.634568][T12697] ? __lock_acquire+0x49f/0x1a40 [ 210.636845][T12697] ? find_held_lock+0x2b/0x80 [ 210.638396][T12697] ? is_bpf_text_address+0x8a/0x1a0 [ 210.640054][T12697] ? is_bpf_text_address+0x8a/0x1a0 [ 210.641713][T12697] ? bpf_ksym_find+0x128/0x1c0 [ 210.643268][T12697] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 210.645264][T12697] ? is_bpf_text_address+0x94/0x1a0 [ 210.646958][T12697] ? kernel_text_address+0x8d/0x100 [ 210.648596][T12697] ? __pfx_widen_string+0x10/0x10 [ 210.650196][T12697] ? __kernel_text_address+0xd/0x30 [ 210.651864][T12697] ? unwind_get_return_address+0x59/0xa0 [ 210.653686][T12697] ? arch_stack_walk+0xa6/0xf0 [ 210.655220][T12697] ? tomoyo_path_number_perm+0x46d/0x580 [ 210.657039][T12697] ? stack_trace_save+0x8e/0xc0 [ 210.658541][T12697] ? __pfx_stack_trace_save+0x10/0x10 [ 210.660052][T12697] ? stack_depot_save_flags+0x27/0x9d0 [ 210.662111][T12697] ? __lock_acquire+0x49f/0x1a40 [ 210.663675][T12697] ? tomoyo_path_number_perm+0x46d/0x580 [ 210.665459][T12697] kvm_vm_ioctl+0x1560/0x4180 [ 210.668488][T12697] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.670446][T12697] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 210.672080][T12697] ? kasan_quarantine_put+0x104/0x240 [ 210.673782][T12697] ? lockdep_hardirqs_on+0x78/0x100 [ 210.675444][T12697] ? find_held_lock+0x2b/0x80 [ 210.677099][T12697] ? tomoyo_path_number_perm+0x28f/0x580 [ 210.678879][T12697] ? tomoyo_path_number_perm+0x28f/0x580 [ 210.680668][T12697] ? tomoyo_path_number_perm+0x188/0x580 [ 210.682466][T12697] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 210.684377][T12697] ? __pfx_futex_wait+0x10/0x10 [ 210.685933][T12697] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 210.687854][T12697] ? do_vfs_ioctl+0x226/0x13e0 [ 210.689385][T12697] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 210.690999][T12697] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 210.693165][T12697] ? __fget_files+0x215/0x3d0 [ 210.694660][T12697] ? hook_file_ioctl_common+0x140/0x440 [ 210.696508][T12697] ? selinux_file_ioctl+0x13b/0x290 [ 210.698167][T12697] ? selinux_file_ioctl+0xb6/0x290 [ 210.699804][T12697] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 210.701424][T12697] __x64_sys_ioctl+0x18e/0x210 [ 210.702955][T12697] do_syscall_64+0x115/0x870 [ 210.704444][T12697] ? clear_bhb_loop+0x40/0x90 [ 210.707159][T12697] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.709078][T12697] RIP: 0033:0x7fd53c79e019 [ 210.710507][T12697] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 210.717404][T12697] RSP: 002b:00007fd53d664028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 210.720024][T12697] RAX: ffffffffffffffda RBX: 00007fd53ca26090 RCX: 00007fd53c79e019 [ 210.722508][T12697] RDX: 0000200000000100 RSI: 00000000400caed0 RDI: 0000000000000004 [ 210.724990][T12697] RBP: 00007fd53c83500c R08: 0000000000000000 R09: 0000000000000000 [ 210.727550][T12697] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 210.730040][T12697] R13: 00007fd53ca26128 R14: 00007fd53ca26090 R15: 00007fffa38c5248 [ 210.732555][T12697] [ 210.733550][T12697] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 210.735839][T12697] CPU: 2 UID: 0 PID: 12697 Comm: syz.3.2580 Tainted: G L syzkaller #0 PREEMPT(full) [ 210.739209][T12697] Tainted: [L]=SOFTLOCKUP [ 210.740584][T12697] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 210.743773][T12697] Call Trace: [ 210.744849][T12697] [ 210.745802][T12697] dump_stack_lvl+0x100/0x190 [ 210.747306][T12697] vpanic+0x552/0x970 [ 210.748600][T12697] ? __pfx_vpanic+0x10/0x10 [ 210.750057][T12697] panic+0xd1/0xe0 [ 210.751259][T12697] ? __pfx_panic+0x10/0x10 [ 210.752694][T12697] ? check_panic_on_warn+0x1f/0x90 [ 210.754325][T12697] check_panic_on_warn.cold+0x19/0x34 [ 210.756039][T12697] ? __kvm_gpc_refresh+0x1a98/0x22d0 [ 210.757712][T12697] __warn.cold+0x191/0x318 [ 210.759133][T12697] __report_bug+0x30f/0x440 [ 210.760592][T12697] ? __kvm_gpc_refresh+0x1a98/0x22d0 [ 210.762285][T12697] ? __pfx___report_bug+0x10/0x10 [ 210.763895][T12697] ? check_prev_add+0xfe/0xe60 [ 210.765415][T12697] ? check_prev_add+0xfe/0xe60 [ 210.766938][T12697] ? lockdep_unlock+0x5a/0xc0 [ 210.768445][T12697] ? __lock_acquire+0xd5b/0x1a40 [ 210.770034][T12697] ? __kvm_gpc_refresh+0x1a98/0x22d0 [ 210.771775][T12697] report_bug+0xb2/0x220 [ 210.773137][T12697] ? __kvm_gpc_refresh+0x1a98/0x22d0 [ 210.774804][T12697] handle_bug+0x16a/0x2a0 [ 210.776192][T12697] exc_invalid_op+0x17/0x50 [ 210.777640][T12697] asm_exc_invalid_op+0x1a/0x20 [ 210.779182][T12697] RIP: 0010:__kvm_gpc_refresh+0x1a98/0x22d0 [ 210.781070][T12697] Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 31 07 00 00 48 8b 04 24 31 db 48 8b a8 08 01 00 00 e9 2b f6 ff ff e8 69 2f 87 00 90 <0f> 0b 90 e9 55 f8 ff ff e8 5b 2f 87 00 48 c7 c6 a0 b9 c2 8b 48 89 [ 210.787044][T12697] RSP: 0018:ffffc9000361f228 EFLAGS: 00010293 [ 210.788968][T12697] RAX: 0000000000000000 RBX: ffffffffffffffff RCX: ffffffff81831900 [ 210.791456][T12697] RDX: ffff88802ba54a80 RSI: ffffffff818332b7 RDI: ffff88802ba54a80 [ 210.793941][T12697] RBP: ffff888000000000 R08: 0000000000000000 R09: 0000000000000001 [ 210.796427][T12697] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000001001 [ 210.798895][T12697] R13: ffff888000000001 R14: ffff888000000000 R15: ffffc9000361f448 [ 210.801377][T12697] ? __kvm_gpc_refresh+0xe0/0x22d0 [ 210.803006][T12697] ? __kvm_gpc_refresh+0x1a97/0x22d0 [ 210.804679][T12697] ? __kvm_gpc_refresh+0x1a97/0x22d0 [ 210.806348][T12697] ? find_held_lock+0x2b/0x80 [ 210.807853][T12697] ? kvm_xen_set_evtchn_fast+0x874/0xe80 [ 210.809626][T12697] ? __pfx___mutex_lock+0x10/0x10 [ 210.811230][T12697] ? __lock_acquire+0x49f/0x1a40 [ 210.812813][T12697] ? __pfx___kvm_gpc_refresh+0x10/0x10 [ 210.814541][T12697] kvm_gpc_refresh+0xc9/0x160 [ 210.816053][T12697] kvm_xen_set_evtchn.part.0+0x168/0x230 [ 210.817837][T12697] ? kvm_xen_set_evtchn.part.0+0x153/0x230 [ 210.819677][T12697] kvm_xen_hvm_evtchn_send+0x22f/0x290 [ 210.821414][T12697] ? __pfx_kvm_xen_hvm_evtchn_send+0x10/0x10 [ 210.823303][T12697] kvm_arch_vm_ioctl+0x13ac/0x18d0 [ 210.824927][T12697] ? __pfx_kvm_arch_vm_ioctl+0x10/0x10 [ 210.826646][T12697] ? vfs_open+0x82/0x3f0 [ 210.828006][T12697] ? path_openat+0x2873/0x4280 [ 210.829526][T12697] ? __lock_acquire+0x49f/0x1a40 [ 210.831109][T12697] ? __lock_acquire+0x49f/0x1a40 [ 210.832690][T12697] ? __lock_acquire+0x49f/0x1a40 [ 210.834276][T12697] ? __lock_acquire+0x49f/0x1a40 [ 210.835850][T12697] ? find_held_lock+0x2b/0x80 [ 210.837345][T12697] ? is_bpf_text_address+0x8a/0x1a0 [ 210.838999][T12697] ? is_bpf_text_address+0x8a/0x1a0 [ 210.840654][T12697] ? bpf_ksym_find+0x128/0x1c0 [ 210.842197][T12697] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 210.844153][T12697] ? is_bpf_text_address+0x94/0x1a0 [ 210.845800][T12697] ? kernel_text_address+0x8d/0x100 [ 210.847442][T12697] ? __pfx_widen_string+0x10/0x10 [ 210.848873][T12697] ? __kernel_text_address+0xd/0x30 [ 210.850518][T12697] ? unwind_get_return_address+0x59/0xa0 [ 210.852295][T12697] ? arch_stack_walk+0xa6/0xf0 [ 210.853821][T12697] ? tomoyo_path_number_perm+0x46d/0x580 [ 210.855590][T12697] ? stack_trace_save+0x8e/0xc0 [ 210.857140][T12697] ? __pfx_stack_trace_save+0x10/0x10 [ 210.858825][T12697] ? stack_depot_save_flags+0x27/0x9d0 [ 210.860553][T12697] ? __lock_acquire+0x49f/0x1a40 [ 210.862136][T12697] ? tomoyo_path_number_perm+0x46d/0x580 [ 210.863907][T12697] kvm_vm_ioctl+0x1560/0x4180 [ 210.865402][T12697] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.867317][T12697] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 210.868929][T12697] ? kasan_quarantine_put+0x104/0x240 [ 210.870633][T12697] ? lockdep_hardirqs_on+0x78/0x100 [ 210.872297][T12697] ? find_held_lock+0x2b/0x80 [ 210.873787][T12697] ? tomoyo_path_number_perm+0x28f/0x580 [ 210.875555][T12697] ? tomoyo_path_number_perm+0x28f/0x580 [ 210.877333][T12697] ? tomoyo_path_number_perm+0x188/0x580 [ 210.879104][T12697] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 210.880998][T12697] ? __pfx_futex_wait+0x10/0x10 [ 210.882541][T12697] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 210.884413][T12697] ? do_vfs_ioctl+0x226/0x13e0 [ 210.885929][T12697] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 210.887527][T12697] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 210.889679][T12697] ? __fget_files+0x215/0x3d0 [ 210.891171][T12697] ? hook_file_ioctl_common+0x140/0x440 [ 210.892953][T12697] ? selinux_file_ioctl+0x13b/0x290 [ 210.894594][T12697] ? selinux_file_ioctl+0xb6/0x290 [ 210.896220][T12697] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 210.897816][T12697] __x64_sys_ioctl+0x18e/0x210 [ 210.899338][T12697] do_syscall_64+0x115/0x870 [ 210.900810][T12697] ? clear_bhb_loop+0x40/0x90 [ 210.902314][T12697] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.904183][T12697] RIP: 0033:0x7fd53c79e019 [ 210.905601][T12697] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 210.911580][T12697] RSP: 002b:00007fd53d664028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 210.914193][T12697] RAX: ffffffffffffffda RBX: 00007fd53ca26090 RCX: 00007fd53c79e019 [ 210.916669][T12697] RDX: 0000200000000100 RSI: 00000000400caed0 RDI: 0000000000000004 [ 210.919142][T12697] RBP: 00007fd53c83500c R08: 0000000000000000 R09: 0000000000000000 [ 210.921618][T12697] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 210.924097][T12697] R13: 00007fd53ca26128 R14: 00007fd53ca26090 R15: 00007fffa38c5248 [ 210.926567][T12697] [ 210.928104][T12697] Kernel Offset: disabled [ 210.929476][T12697] Rebooting in 86400 seconds..