last executing test programs: 5m20.238161582s ago: executing program 1 (id=1566): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x4, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0x2, &(0x7f0000000300)=@raw=[@generic={0x7, 0x4, 0x0, 0x0, 0xfffffff8}, @generic={0x95}], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 5m20.168475908s ago: executing program 1 (id=1568): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3c, 0x3c, 0x6, [@var={0x4, 0x0, 0x0, 0xe, 0x4}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x3, [{0xa}]}, @ptr, @volatile={0x0, 0x0, 0x0, 0x9, 0x3}]}, {0x0, [0x0, 0x0, 0x0, 0x61]}}, 0x0, 0x5a}, 0x28) 5m20.08212184s ago: executing program 1 (id=1571): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000380)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf670000000000001507"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f00000003c0)}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) 5m18.840822143s ago: executing program 1 (id=1587): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x141) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='p:s/_ ./file0:0', 0xf) 5m18.78150781s ago: executing program 1 (id=1588): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x82) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000b00), 0x100) 5m18.292546008s ago: executing program 1 (id=1592): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1700000007"], 0x50) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)='O', 0x1, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) 5m18.205468829s ago: executing program 32 (id=1592): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1700000007"], 0x50) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)='O', 0x1, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) 990.831265ms ago: executing program 2 (id=6520): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newtfilter={0xbc, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x4}, {}, {0x6, 0x8}}, [@filter_kind_options=@f_u32={{0x8}, {0x88, 0x2, [@TCA_U32_SEL={0x84, 0x5, {0x0, 0x6, 0x8, 0x101, 0x4, 0xe, 0x7, 0x7, [{0x8e5, 0x8b39, 0x3a, 0x40}, {0x8, 0x3, 0x9, 0x2d}, {0xffffff8a, 0x9d2, 0x2, 0x10000}, {0x0, 0x1, 0x3b7, 0x5}, {0x553e3387, 0x3, 0x8000, 0x2}, {0x8001, 0x4, 0x1}, {0x1000, 0xa8c, 0xfffffff8, 0xd}]}}]}}, @TCA_CHAIN={0x8, 0xb, 0x6b}]}, 0xbc}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r3, {0xc, 0x10}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xf, 0xf}, {}, {0xffff, 0x6}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r1) 925.968177ms ago: executing program 2 (id=6523): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x10001, 0x1, 0x3, 0x8, 0xffffffc0}, 0x4, 0x1, 0x8, 0x0, 0x3, 0x0, 0x16, 0x13, 0x3, 0xca, {0x0, 0x8, 0x3, 0x5, 0x84, 0x8}}}}]}, 0x78}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x40004) 751.122778ms ago: executing program 2 (id=6525): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r0) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x14, r2, 0x1, 0x70bd26, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x48080}, 0x4000080) 750.549447ms ago: executing program 2 (id=6526): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014000000110001"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140002"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) 671.722021ms ago: executing program 2 (id=6529): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x40, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0x10, 0x2, [@TCA_FLOWER_KEY_ETH_SRC={0xa, 0x6, @link_local}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x24004800}, 0x0) write$tun(r0, &(0x7f0000000200)={@val={0xa, 0x7}, @void, @eth={@empty, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @val={@void, {0x8100, 0x5, 0x1, 0x6}}, {@ipv6={0x86dd, @tcp={0x7, 0x6, '\x00', 0x14, 0x6, 0xff, @private2, @mcast1, {[], {{0x4e1e, 0x4e64, 0x41424344, 0x41424344, 0x0, 0x0, 0x4000000000000068, 0x80, 0x100, 0x0, 0x9}}}}}}}}, 0x52) 500.968511ms ago: executing program 2 (id=6534): r0 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e24, 0xb, @mcast2, 0x9}, 0x1c) sendto$inet6(r0, &(0x7f0000000040)="800037bbfa9ba1", 0x7, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000003780)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000740)=""/212, 0xd4}], 0x1}, 0xe76}], 0x1, 0x0, 0x0) 294.527254ms ago: executing program 4 (id=6540): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="28000000040601090000000000000000000000090500010007"], 0x28}, 0x1, 0x0, 0x0, 0x14}, 0x10) 293.938679ms ago: executing program 3 (id=6541): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1ff) mount$afs(&(0x7f0000000340)=ANY=[@ANYBLOB='%s'], &(0x7f0000000000)='./file0\x00', &(0x7f00000000e0), 0x0, &(0x7f0000000300)={[{@dyn}]}) 261.624301ms ago: executing program 3 (id=6543): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000000c0), 0x12) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f00000000c0)=ANY=[], 0x6a) 210.879806ms ago: executing program 4 (id=6545): creat(&(0x7f0000000100)='./file0\x00', 0x4) mount$9p_unix(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x1000000, &(0x7f0000004000)=ANY=[@ANYBLOB='trans=u']) 210.39907ms ago: executing program 0 (id=6546): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1ff) mount$afs(&(0x7f0000000340)=ANY=[@ANYBLOB="2573795ce67bf4a3cd1c8e1b69302ef3"], &(0x7f0000000000)='./file0\x00', &(0x7f00000000e0), 0x0, &(0x7f0000000300)={[{@dyn}]}) 210.27395ms ago: executing program 3 (id=6547): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x80) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140002"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) 148.703573ms ago: executing program 0 (id=6548): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0x8b, 0x0, &(0x7f0000000040)="3d25c826ab0815acd86628f886ddf6ede78b6ea61301000000bcb9fb8f083f3a81657a32532b5100"/53, 0x0, 0xda, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x34) 148.505198ms ago: executing program 4 (id=6549): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002b40), r0) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000002c00)={&(0x7f0000000100)={0x3c, r1, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast1}, @NLBL_MGMT_A_DOMAIN={0xe, 0x1, 'net/l2cap\x00'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @dev={0xac, 0x14, 0x14, 0x35}}]}, 0x3c}, 0x1, 0x2000000, 0x0, 0x20000000}, 0x4000080) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 148.298516ms ago: executing program 0 (id=6550): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000200000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000000c0)=@setlink={0x2c, 0x13, 0x5, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r1, 0x312, 0x800}, [@IFLA_ADDRESS={0xa, 0x1, @remote}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x42) 136.728016ms ago: executing program 3 (id=6551): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25cfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000002c0), 0x4) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000900)=@newtfilter={0x87c, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r8, {0xffff, 0xfff3}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x84c, 0x2, [@TCA_BASIC_POLICE={0x848, 0x4, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x3, 0x3, 0x0, 0x0, 0x0, 0x3, 0x3ff, 0x2, 0x7, 0xfffffff7, 0x7, 0x2a3c14c8, 0x2, 0x140, 0x9cd0, 0x78e, 0x8, 0x9, 0x2, 0x80000000, 0x5, 0x80000000, 0x9, 0x6, 0xfff, 0x27, 0x52a67a94, 0xf, 0x1, 0x4, 0xfffffffe, 0x6, 0x0, 0xfffffffe, 0x800, 0x7, 0xffffffff, 0xffffffad, 0x8, 0x68, 0x0, 0x10000, 0x7ff, 0x7, 0xffffff64, 0x4, 0x9, 0x7, 0x5, 0x14000003, 0xffff, 0x2, 0x1ff, 0x4, 0xffff5edc, 0x8, 0x4, 0x81, 0x5, 0x94c, 0x1cf, 0x10000000, 0x3, 0x6, 0xfffffffb, 0x1, 0x2, 0x7, 0x1, 0x6, 0x0, 0xa, 0xf43, 0xa, 0x4, 0x5, 0x1, 0x8000, 0x3ff, 0x100, 0x2, 0x2, 0x8, 0x0, 0x24000000, 0x4, 0x80000000, 0x6, 0xac5, 0x9, 0xffb, 0x2, 0x67, 0xa, 0x9, 0x5, 0x7fffffff, 0xfffffff8, 0x86, 0x0, 0x0, 0x8ac7, 0x5, 0x78, 0x8000, 0xc, 0x6, 0x400, 0x20, 0x5, 0xffffffdf, 0x389, 0x3, 0x1e800000, 0x80000001, 0x4a, 0xff, 0x2, 0x3, 0x1ff, 0x9, 0x4, 0x6, 0x2, 0x7, 0x8001, 0x2, 0x263, 0xb, 0x8, 0x6, 0x6, 0x9, 0x6, 0xa, 0x13d, 0x209, 0x3fed, 0x2, 0x1, 0x2, 0x101, 0xffffffff, 0x7, 0x240, 0x4, 0x5, 0x2, 0xfffffffb, 0x1, 0x800, 0x7ffffffb, 0x8fc, 0x2, 0x68a4, 0x600000, 0x6, 0x4, 0x8, 0x4, 0x37, 0xa, 0x9, 0x3, 0x5, 0x8, 0x100, 0x7, 0xfe, 0x6, 0x7, 0x7, 0x22c, 0x6, 0x3, 0x8, 0x9, 0xfffffffc, 0xd6, 0x4ad, 0x7, 0x9, 0x2, 0x0, 0x7e6, 0x54d6, 0x2, 0x5, 0x8, 0x1, 0xf32, 0xffff, 0xb2, 0x0, 0x6, 0x7, 0x8, 0x400001, 0x4, 0x7, 0x9, 0x9, 0x0, 0x7, 0x2, 0x4000004, 0x20000, 0x2, 0x80000000, 0x10000, 0xe, 0x6, 0x2, 0x4, 0x1000, 0x8, 0x9, 0x0, 0xe6, 0x2, 0x9, 0x4, 0x1, 0x4, 0x9, 0xff, 0x9, 0x9, 0xb, 0x3, 0x7fff, 0x200, 0x5, 0xca1, 0x7f, 0xe, 0x1, 0x1000, 0xfff, 0x5, 0x7, 0x0, 0x7, 0x40, 0x80000001, 0x1, 0x7, 0x6, 0x8, 0xe9375e5, 0x8cf5, 0x7, 0xdf0d, 0x2, 0xfffffffb]}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x10, 0xd, 0xd36, 0x4, 0x6bc, 0x80002, 0x7, 0xf, 0x800, 0x7, 0x7, 0xe7f, 0xffff, 0x7, 0x5, 0x1, 0xffffffff, 0x4, 0x909e, 0x89cd, 0xffffffff, 0x8, 0x9, 0x4, 0x5, 0x2, 0x8, 0x4, 0xf23, 0x3ff, 0x9, 0xa, 0x5, 0x0, 0xff, 0x7f, 0x4, 0x0, 0x3, 0x382, 0x40, 0x80, 0x8, 0x2, 0x4000005, 0x20002, 0x9, 0x4f, 0x4, 0x0, 0x7, 0x80000000, 0x80000001, 0x8000, 0x9e, 0xe4, 0x200000, 0x7fffffff, 0x5a, 0x9, 0xfffffff4, 0x4, 0x6, 0x6, 0x459, 0x2, 0xff, 0x14000000, 0x5f72, 0x3, 0x8, 0x7, 0x5, 0x0, 0x6, 0x0, 0x6, 0x1000, 0xffffffff, 0x101, 0x2, 0x5, 0x7, 0x9, 0x1000, 0xb, 0x3, 0xfbb4, 0x4a, 0x0, 0x7, 0x8, 0x9, 0x0, 0x7, 0x101, 0x0, 0x3ff, 0x5, 0x800, 0x7fffffff, 0x2, 0x1, 0x3, 0x4, 0x101, 0x5, 0x19, 0x6c, 0x4000009, 0x4, 0xceb6, 0x5, 0x7, 0x53c0, 0x6, 0x5, 0x9, 0x1, 0x9, 0x2, 0x7, 0x8, 0x3, 0x3ff, 0x18, 0x6, 0xffffff7b, 0x15ef7157, 0xfffffffc, 0x5, 0x2, 0x7, 0x7fffffff, 0xdb5, 0x1000, 0x800, 0x8, 0x80000000, 0x100, 0x7, 0x1, 0x40, 0x1000, 0x3, 0xfffffffb, 0x5270e9b, 0x5, 0x7f, 0xb, 0x40, 0x9, 0x3, 0x0, 0x9, 0xb, 0x7, 0x1, 0x7, 0x3, 0x9, 0x0, 0xfe23, 0x6, 0x5, 0x8, 0xffffff7f, 0x3, 0xd, 0x80, 0x4, 0x9, 0x4, 0xff, 0x8001, 0x79, 0x40, 0x72e, 0x5c, 0x1, 0xb0, 0x6, 0x8, 0x9, 0x0, 0x80000001, 0x8, 0x4, 0x4, 0x200, 0x1, 0x1, 0x59ac, 0xebd7, 0x7, 0x10008, 0x4, 0x100, 0x0, 0x7, 0x138, 0x1, 0x8, 0xcb18, 0x0, 0xb, 0x5, 0xe489, 0x8, 0x5, 0x6, 0x56, 0x1800000, 0x80000000, 0xc4800000, 0x4251, 0x7fff, 0x8001, 0x6, 0x7, 0x5, 0x3, 0x4, 0x371, 0xaa67, 0x2, 0x0, 0x10, 0x8, 0x5a5, 0x400, 0x0, 0xfffeffff, 0xf, 0x8, 0x9, 0xc2b3, 0x0, 0x7fffffff, 0xfffffffa, 0x9, 0x3ff, 0x6, 0x7, 0x5, 0x7, 0x4, 0xc, 0x9, 0x1, 0x0, 0x10000, 0x4, 0x4, 0x8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x4, 0x2, 0x6, 0x4d2, 0x0, {0x8, 0x2, 0xa, 0x8, 0x8, 0x9}, {0x4, 0x0, 0xa380, 0x7ff, 0x5, 0x7d487c2b}, 0x9, 0x15f}}]}]}}]}, 0x87c}, 0x1, 0x0, 0x0, 0x10}, 0x8080) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000300)=@xdp={0x2c, 0x0, r6, 0x3d}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0x26}], 0x1}, 0x0) 80.340435ms ago: executing program 0 (id=6552): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x180) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r0) close(r0) openat(0xffffffffffffff9c, &(0x7f0000000680)='./file0\x00', 0x59b801, 0x1ce) 79.783633ms ago: executing program 4 (id=6553): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x20040000}, 0x48010) 74.357391ms ago: executing program 0 (id=6554): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x20) 49.542939ms ago: executing program 4 (id=6555): linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) openat$dir(0xffffffffffffff9c, &(0x7f00000006c0)='./file7\x00', 0x20000, 0x1c0) 522.27µs ago: executing program 3 (id=6556): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f00000000c0)="9d", 0x1, 0x20008005, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001e80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000480)=""/91, 0x5b}], 0x1}, 0x40}], 0x1, 0x1, 0x0) 199.049µs ago: executing program 0 (id=6557): mkdirat(0xffffffffffffff9c, &(0x7f0000000050)='./sys\x00', 0x1ed) mount(0x0, 0x0, &(0x7f0000000070)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed) mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) symlinkat(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ed) symlinkat(&(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000001900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ed) symlinkat(&(0x7f0000001e00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001f00)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000002100)='usbip-vudc.0', 0xc) 147.054µs ago: executing program 4 (id=6558): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc_dir\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc_dir\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_dir/acpi/wakeup\x00', 0x2, 0x0) write$yama_ptrace_scope(r0, 0x0, 0x0) 0s ago: executing program 3 (id=6559): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0x8b, 0x0, &(0x7f0000000040)="3d25c826ab0815acd86628f886ddf6ede78b6ea61301000000bcb9fb8f083f3a81657a32532b5100"/53, 0x0, 0xda, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x34) kernel console output (not intermixed with test programs): 881.491197][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 881.659075][ T10] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 57 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 882.088277][T18942] usb 8-1: reset high-speed USB device number 57 using dummy_hcd [ 882.458272][T18994] Config c/1 of g1 needs at least one function. [ 882.460746][T18994] udc dummy_udc.0: failed to start g1: -22 [ 882.462888][T18994] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 882.471316][T18994] UDC core: g1: couldn't find an available UDC or it's busy [ 882.514219][ T5852] usb 8-1: USB disconnect, device number 57 [ 882.521639][ T5852] usblp0: removed [ 882.555345][T18997] kvm: kvm [18996]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010003) = 0x2ff [ 882.838841][T19008] tipc: Started in network mode [ 882.840522][T19008] tipc: Node identity 2007ff, cluster identity 4711 [ 882.842571][T19008] tipc: Node number set to 2099199 [ 882.903305][T13554] tipc: Subscription rejected, illegal request [ 883.155443][T19033] Invalid logical block size (200) [ 883.174470][T19035] overlayfs: failed to resolve './cgroup': -2 [ 883.239405][ T9137] usb 9-1: new high-speed USB device number 47 using dummy_hcd [ 883.390347][ T9137] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 883.394438][ T9137] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 883.401622][ T9137] usb 9-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 883.405278][ T9137] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 883.409768][ T9137] usb 9-1: Product: syz [ 883.411545][ T9137] usb 9-1: Manufacturer: syz [ 883.413693][ T9137] usb 9-1: SerialNumber: syz [ 883.454215][T19046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3729'. [ 883.457990][T19046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3729'. [ 883.516682][T19059] futex_wake_op: syz.2.3729 tries to shift op by -1; fix this program [ 883.631370][ T9137] usblp 9-1:1.0: usblp0: USB Bidirectional printer dev 47 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 883.673074][T19070] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3739'. [ 884.040231][ T9137] usb 9-1: USB disconnect, device number 47 [ 884.051216][ T9137] usblp0: removed [ 884.397191][ T6024] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 884.487236][ T35] usb 8-1: new high-speed USB device number 58 using dummy_hcd [ 884.547158][ T6024] usb 5-1: Using ep0 maxpacket: 16 [ 884.551850][ T6024] usb 5-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 884.557874][ T6024] usb 5-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 884.562046][ T6024] usb 5-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 884.567445][ T6024] usb 5-1: config 0 interface 0 has no altsetting 0 [ 884.570233][ T6024] usb 5-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 884.574019][ T6024] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 884.586192][ T6024] usb 5-1: config 0 descriptor?? [ 884.642616][ T35] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 884.647332][ T35] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 884.651685][ T35] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 884.661102][ T35] usb 8-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00 [ 884.665421][ T35] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 884.669552][ T35] usb 8-1: Product: syz [ 884.671518][ T35] usb 8-1: Manufacturer: syz [ 884.673722][ T35] usb 8-1: SerialNumber: syz [ 884.680795][T19102] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 884.686533][ T35] usbserial_generic 8-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 884.692056][ T35] usbserial_generic 8-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 884.696517][ T35] usbserial_generic 8-1:1.0: generic converter detected [ 884.704074][ T35] usb 8-1: generic converter now attached to ttyUSB0 [ 884.926476][ T5624] usb 8-1: USB disconnect, device number 58 [ 884.935570][ T5624] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 884.939590][ T5624] usbserial_generic 8-1:1.0: device disconnected [ 885.201840][ T35] usb 5-1: USB disconnect, device number 54 [ 885.814624][T19160] tipc: Enabling of bearer rejected, failed to enable media [ 886.190617][T19183] fuse: fd is not a fuse device [ 887.051726][T19248] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 887.057164][ T5624] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 887.217892][ T5624] usb 5-1: Using ep0 maxpacket: 16 [ 887.222204][ T5624] usb 5-1: config 0 has an invalid interface number: 34 but max is 0 [ 887.225717][ T5624] usb 5-1: config 0 has no interface number 0 [ 887.229075][ T5624] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 887.236656][ T5624] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 887.242936][ T5624] usb 5-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 887.246780][ T5624] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 887.251253][ T5624] usb 5-1: Product: syz [ 887.253349][ T5624] usb 5-1: Manufacturer: syz [ 887.255395][ T5624] usb 5-1: SerialNumber: syz [ 887.262566][ T5624] usb 5-1: config 0 descriptor?? [ 887.265686][T19235] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 887.272263][T19235] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 887.481798][T19235] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 887.485025][T19235] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 887.692075][ T5624] asix 5-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 888.302191][ T5624] asix 5-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 888.307862][ T5624] asix 5-1:0.34 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x00b0: ffffffb9 [ 888.337680][ T5624] asix 5-1:0.34: probe with driver asix failed with error -71 [ 888.346896][ T5624] usb 5-1: USB disconnect, device number 55 [ 889.277165][ T5852] usb 9-1: new high-speed USB device number 48 using dummy_hcd [ 889.408317][ T5624] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 889.428869][ T5852] usb 9-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 889.432302][ T5852] usb 9-1: config 0 interface 0 has no altsetting 0 [ 889.434672][ T5852] usb 9-1: New USB device found, idVendor=046d, idProduct=c532, bcdDevice= 0.00 [ 889.438047][ T5852] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 889.441997][ T5852] usb 9-1: config 0 descriptor?? [ 889.578505][ T5624] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 889.581859][ T5624] usb 5-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 889.584841][ T5624] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 889.594278][ T5624] as10x_usb: device has been detected [ 889.596738][ T5624] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 889.604431][ T5624] usb 5-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 889.609278][ T5624] as10x_usb: error during firmware upload part1 [ 889.611581][ T5624] Registered device Abilis Systems DVB-Titan [ 889.868040][ T5852] logitech-djreceiver 0003:046D:C532.0017: unknown main item tag 0x0 [ 889.872733][ T5852] logitech-djreceiver 0003:046D:C532.0017: unknown main item tag 0x0 [ 889.875361][ T5852] logitech-djreceiver 0003:046D:C532.0017: unknown main item tag 0x0 [ 889.878699][ T5852] logitech-djreceiver 0003:046D:C532.0017: unknown main item tag 0x0 [ 889.881790][ T5852] logitech-djreceiver 0003:046D:C532.0017: unknown main item tag 0x0 [ 889.884408][ T5852] logitech-djreceiver 0003:046D:C532.0017: unknown main item tag 0x0 [ 889.887277][ T5852] logitech-djreceiver 0003:046D:C532.0017: unknown main item tag 0x0 [ 890.064416][ T35] usb 9-1: USB disconnect, device number 48 [ 890.786884][T19360] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3858'. [ 891.307140][ T5852] usb 9-1: new high-speed USB device number 49 using dummy_hcd [ 891.411045][ T35] usb 5-1: USB disconnect, device number 56 [ 891.429777][ T35] Unregistered device Abilis Systems DVB-Titan [ 891.432162][ T35] as10x_usb: device has been disconnected [ 891.467459][ T5852] usb 9-1: Using ep0 maxpacket: 32 [ 891.471636][ T5852] usb 9-1: unable to get BOS descriptor or descriptor too short [ 891.476019][ T5852] usb 9-1: config 128 has an invalid interface number: 127 but max is 3 [ 891.477144][ T5624] usb 8-1: new high-speed USB device number 59 using dummy_hcd [ 891.479527][ T5852] usb 9-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 891.486222][ T5852] usb 9-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 891.490126][ T5852] usb 9-1: config 128 has no interface number 0 [ 891.492804][ T5852] usb 9-1: config 128 interface 127 altsetting 14 has an endpoint descriptor with address 0xF5, changing to 0x85 [ 891.498141][ T5852] usb 9-1: config 128 interface 127 altsetting 14 endpoint 0x85 has invalid maxpacket 3410, setting to 64 [ 891.502715][ T5852] usb 9-1: config 128 interface 127 has no altsetting 0 [ 891.507976][ T5852] usb 9-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 891.512001][ T5852] usb 9-1: New USB device strings: Mfr=1, Product=210, SerialNumber=3 [ 891.515310][ T5852] usb 9-1: Product: syz [ 891.517203][ T5852] usb 9-1: Manufacturer: syz [ 891.519402][ T5852] usb 9-1: SerialNumber: syz [ 891.628645][ T5624] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 891.632712][ T5624] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 891.636499][ T5624] usb 8-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 891.640167][ T5624] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 891.645221][ T5624] usb 8-1: config 0 descriptor?? [ 891.769492][ T5852] usb 9-1: USB disconnect, device number 49 [ 891.786119][T13702] udevd[13702]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb9/9-1/9-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 892.266940][ T5624] usb 8-1: language id specifier not provided by device, defaulting to English [ 892.460813][T19441] lo: entered allmulticast mode [ 892.465712][T19441] tunl0: entered allmulticast mode [ 892.470163][T19441] gre0: entered allmulticast mode [ 892.476064][T19441] gretap0: entered allmulticast mode [ 892.482007][T19441] erspan0: entered allmulticast mode [ 892.485693][T19441] ip_vti0: entered allmulticast mode [ 892.489375][T19441] ip6_vti0: entered allmulticast mode [ 892.492877][T19441] sit0: entered allmulticast mode [ 892.496697][T19441] ip6tnl0: entered allmulticast mode [ 892.500191][T19441] ip6gre0: entered allmulticast mode [ 892.504033][T19441] syz_tun: entered allmulticast mode [ 892.508083][T19441] ip6gretap0: entered allmulticast mode [ 892.511750][T19441] bridge0: port 2(bridge_slave_1) entered disabled state [ 892.514905][T19441] bridge0: port 1(bridge_slave_0) entered disabled state [ 892.518755][T19441] bridge0: entered allmulticast mode [ 892.522293][T19441] vcan0: entered allmulticast mode [ 892.525495][T19441] bond0: entered allmulticast mode [ 892.527905][T19441] bond_slave_0: entered allmulticast mode [ 892.530164][T19441] bond_slave_1: entered allmulticast mode [ 892.533962][T19441] team0: entered allmulticast mode [ 892.536088][T19441] team_slave_1: entered allmulticast mode [ 892.540600][T19441] dummy0: entered allmulticast mode [ 892.546696][T19441] nlmon0: entered allmulticast mode [ 892.550788][T19441] batadv0: entered allmulticast mode [ 892.554322][T19441] vxcan0: entered allmulticast mode [ 892.556956][T19441] vxcan1: entered allmulticast mode [ 892.559780][T19441] veth0: entered allmulticast mode [ 892.563170][T19441] veth1: entered allmulticast mode [ 892.566833][T19441] wg0: entered allmulticast mode [ 892.570351][T19441] wg1: entered allmulticast mode [ 892.574624][T19441] wg2: entered allmulticast mode [ 892.578410][T19441] veth0_to_bridge: entered allmulticast mode [ 892.584936][T19441] veth1_to_bridge: entered allmulticast mode [ 892.591210][T19441] veth0_to_bond: entered allmulticast mode [ 892.595516][T19441] veth1_to_bond: entered allmulticast mode [ 892.599831][T19441] veth1_to_team: entered allmulticast mode [ 892.606080][T19441] veth0_to_batadv: entered allmulticast mode [ 892.610865][T19441] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 892.613367][T19441] batadv_slave_0: entered allmulticast mode [ 892.616753][T19441] veth1_to_batadv: entered allmulticast mode [ 892.620197][T19441] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 892.623011][T19441] batadv_slave_1: entered allmulticast mode [ 892.626155][T19441] xfrm0: entered allmulticast mode [ 892.629035][T19441] veth0_to_hsr: entered allmulticast mode [ 892.632033][T19441] hsr_slave_0: entered allmulticast mode [ 892.634587][T19441] veth1_to_hsr: entered allmulticast mode [ 892.637691][T19441] hsr_slave_1: entered allmulticast mode [ 892.640506][T19441] hsr0: entered allmulticast mode [ 892.643284][T19441] veth1_virt_wifi: entered allmulticast mode [ 892.646407][T19441] veth0_virt_wifi: entered allmulticast mode [ 892.649522][T19441] virt_wifi0: entered allmulticast mode [ 892.651455][T19441] veth1_vlan: entered allmulticast mode [ 892.654444][T19441] veth0_vlan: entered allmulticast mode [ 892.657382][T19441] vlan0: entered allmulticast mode [ 892.660166][T19441] vlan1: entered allmulticast mode [ 892.663118][T19441] macvlan0: entered allmulticast mode [ 892.666037][T19441] macvlan1: entered allmulticast mode [ 892.668905][T19441] ipvlan0: entered allmulticast mode [ 892.670685][T19441] ipvlan1: entered allmulticast mode [ 892.672955][T19441] veth1_macvtap: entered allmulticast mode [ 892.676041][T19441] veth0_macvtap: entered allmulticast mode [ 892.677838][ T5624] input: HID 256c:006d Pen as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/0003:256C:006D.0018/input/input32 [ 892.684223][T19441] macvtap0: entered allmulticast mode [ 892.690225][T19441] macsec0: entered allmulticast mode [ 892.695184][T19441] geneve0: entered allmulticast mode [ 892.703026][T19441] geneve1: entered allmulticast mode [ 892.709767][T19441] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 892.714895][T19441] netdevsim netdevsim4 netdevsim1: entered allmulticast mode [ 892.721845][T19441] netdevsim netdevsim4 netdevsim2: entered allmulticast mode [ 892.730382][T19441] netdevsim netdevsim4 netdevsim3: entered allmulticast mode [ 892.735470][T19441] mac80211_hwsim hwsim10 wlan0: entered allmulticast mode [ 892.740159][T19441] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 892.745843][T19441] geneve2: entered allmulticast mode [ 892.751450][ T5624] input: HID 256c:006d Pad as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/0003:256C:006D.0018/input/input33 [ 892.777413][T13554] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.781398][T13554] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.783703][ T5624] input: HID 256c:006d Touch Strip as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/0003:256C:006D.0018/input/input34 [ 892.785218][T13554] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.794597][T13554] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.830207][ T5624] input: HID 256c:006d Dial as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/0003:256C:006D.0018/input/input35 [ 892.914456][ T5624] uclogic 0003:256C:006D.0018: input,hidraw1: USB HID v0.00 Keypad [HID 256c:006d] on usb-dummy_hcd.3-1/input0 [ 892.957860][ T5624] usb 8-1: USB disconnect, device number 59 [ 892.980808][T19452] fido_id[19452]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb8/8-1/report_descriptor': No such file or directory [ 893.162210][T19469] macvlan0: entered promiscuous mode [ 893.166861][T19469] macvlan0: left allmulticast mode [ 893.180300][T19469] netlink: Unknown conntrack attr (type=32, max=9) [ 893.242190][T19476] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3910'. [ 894.387657][T19538] af_packet: tpacket_rcv: packet too big, clamped from 2902 to 4294967272. macoff=96 [ 894.473915][T19545] netlink: 'syz.3.3938': attribute type 39 has an invalid length. [ 894.539480][T19547] netlink: 'syz.2.3940': attribute type 1 has an invalid length. [ 894.554218][T19547] 8021q: adding VLAN 0 to HW filter on device bond1 [ 894.566556][T19547] bond1: (slave veth0_to_bond): making interface the new active one [ 894.570585][T19547] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 894.608219][T19552] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3941'. [ 894.614400][T19547] 8021q: adding VLAN 0 to HW filter on device bond2 [ 894.618650][T19547] bond1: (slave bond2): Enslaving as an active interface with a down link [ 894.662310][T19555] netlink: 116 bytes leftover after parsing attributes in process `syz.4.3942'. [ 894.942320][T19564] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3947'. [ 894.962859][T19564] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3947'. [ 895.018354][T19568] futex_wake_op: syz.3.3947 tries to shift op by -1; fix this program [ 895.416388][T19588] infiniband syz2: set down [ 895.418358][T19588] infiniband syz2: added bridge_slave_0 [ 895.436902][T19588] smbdirect: ib_dev[syz2]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 895.442196][T19588] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 895.448826][T19588] smbdirect: ib_dev[syz2]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 895.492748][T19588] RDS/IB: syz2: added [ 895.494409][T19588] smc: adding ib device syz2 with port count 1 [ 895.496680][T19588] smc: ib device syz2 port 1 has no pnetid [ 895.677213][ T10] usb 8-1: new high-speed USB device number 60 using dummy_hcd [ 895.828767][ T10] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 895.832930][ T10] usb 8-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 895.836403][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 895.848097][ T10] as10x_usb: device has been detected [ 895.850239][ T10] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 895.859652][ T10] usb 8-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 895.885456][ T10] as10x_usb: error during firmware upload part1 [ 895.889318][ T10] Registered device Abilis Systems DVB-Titan [ 896.333068][T19627] ÿÿÿÿÿÿ: renamed from vlan1 [ 897.366703][T19660] netlink: 156 bytes leftover after parsing attributes in process `syz.4.3984'. [ 897.668575][ T43] usb 8-1: USB disconnect, device number 60 [ 897.686665][ T43] Unregistered device Abilis Systems DVB-Titan [ 897.689670][ T43] as10x_usb: device has been disconnected [ 898.184924][T19718] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4010'. [ 898.189240][T19718] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4010'. [ 898.245713][T19727] futex_wake_op: syz.2.4010 tries to shift op by -1; fix this program [ 898.711765][T19775] netlink: zone id is out of range [ 898.713346][T19775] netlink: zone id is out of range [ 898.714909][T19775] netlink: set zone limit has 4 unknown bytes [ 899.140924][T19803] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4046'. [ 899.226077][T19809] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 899.233065][T19809] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 899.442387][T19822] nbd0: detected capacity change from 0 to 63 [ 899.452452][T19830] block nbd0: NBD_DISCONNECT [ 899.459422][T19830] block nbd0: Disconnected due to user request. [ 899.463771][T19830] block nbd0: shutting down sockets [ 899.471329][ C3] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 899.474995][ C3] Buffer I/O error on dev nbd0, logical block 0, async page read [ 899.479037][ C3] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 899.482191][ C3] Buffer I/O error on dev nbd0, logical block 1, async page read [ 899.484697][ C3] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 899.485292][ C1] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 899.488111][ C3] Buffer I/O error on dev nbd0, logical block 2, async page read [ 899.491829][ C1] Buffer I/O error on dev nbd0, logical block 3, async page read [ 899.500599][ T5902] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 899.504537][ T5902] Buffer I/O error on dev nbd0, logical block 0, async page read [ 899.509030][ T5902] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 899.513264][ T5902] Buffer I/O error on dev nbd0, logical block 1, async page read [ 899.516604][ T5902] Buffer I/O error on dev nbd0, logical block 2, async page read [ 899.520262][ T5902] Buffer I/O error on dev nbd0, logical block 3, async page read [ 899.526628][ T1637] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 899.531030][ T1637] Buffer I/O error on dev nbd0, logical block 0, async page read [ 899.534408][ T1637] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 899.538975][ T1637] Buffer I/O error on dev nbd0, logical block 1, async page read [ 899.542338][ T1637] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 899.546140][ T1637] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 899.554468][T13702] ldm_validate_partition_table(): Disk read failed. [ 899.558868][T13702] Dev nbd0: unable to read RDB block 0 [ 899.561990][T13702] nbd0: unable to read partition table [ 899.576081][T13702] ldm_validate_partition_table(): Disk read failed. [ 899.579743][T13702] Dev nbd0: unable to read RDB block 0 [ 899.582271][T13702] nbd0: unable to read partition table [ 899.596044][T19847] syzkaller0: entered promiscuous mode [ 899.598607][T19847] syzkaller0: entered allmulticast mode [ 899.612236][T19849] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4065'. [ 900.353190][T19883] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 900.570078][ T10] IPVS: starting estimator thread 0... [ 900.667243][T19919] IPVS: using max 43 ests per chain, 103200 per kthread [ 900.701465][T19937] openvswitch: netlink: Unexpected mask (mask=200240, allowed=10048) [ 901.073099][T19972] syzkaller0: entered promiscuous mode [ 901.075378][T19972] syzkaller0: entered allmulticast mode [ 901.759904][T20001] syzkaller0: entered promiscuous mode [ 901.762053][T20001] syzkaller0: entered allmulticast mode [ 902.796967][T20107] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4177'. [ 903.427262][T20159] syzkaller0: entered promiscuous mode [ 903.429583][T20159] syzkaller0: entered allmulticast mode [ 904.129937][T20189] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4214'. [ 905.328779][T20209] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4223'. [ 906.559151][ T5089] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 906.569208][ T5089] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 906.573742][ T5089] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 906.582023][ T5089] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 906.585650][ T5089] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 906.607429][ T5751] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 906.612897][ T5751] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 906.616893][ T5751] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 906.622747][ T5751] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 906.625442][ T5751] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 906.826103][ C3] vcan0: j1939_tp_rxtimer: 0xffff888013f1a400: rx timeout, send abort [ 906.833684][ C3] vcan0: j1939_xtp_rx_abort_one: 0xffff888013f1a400: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 906.858444][T20288] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4250'. [ 906.863242][T20288] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4250'. [ 907.072217][T20312] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4261'. [ 907.075823][T20312] openvswitch: netlink: Flow actions attr not present in new flow. [ 907.296893][T20254] bridge0: port 1(bridge_slave_0) entered blocking state [ 907.299162][T20254] bridge0: port 1(bridge_slave_0) entered disabled state [ 907.301499][T20254] bridge_slave_0: entered allmulticast mode [ 907.304144][T20254] bridge_slave_0: entered promiscuous mode [ 907.307899][T20254] bridge0: port 2(bridge_slave_1) entered blocking state [ 907.310227][T20254] bridge0: port 2(bridge_slave_1) entered disabled state [ 907.312592][T20254] bridge_slave_1: entered allmulticast mode [ 907.316645][T20254] bridge_slave_1: entered promiscuous mode [ 907.333055][T20254] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 907.337960][T20254] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 907.368256][T20254] team0: Port device team_slave_0 added [ 907.373431][T20254] team0: Port device team_slave_1 added [ 907.388875][T20254] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 907.391115][T20254] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 907.399466][T20254] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 907.404125][T20254] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 907.406473][T20254] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 907.414526][T20254] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 907.440520][T20254] hsr_slave_0: entered promiscuous mode [ 907.443674][T20254] hsr_slave_1: entered promiscuous mode [ 907.446667][T20254] debugfs: 'hsr0' already exists in 'hsr' [ 907.449393][T20254] Cannot create hsr debugfs directory [ 907.515703][T20337] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4269'. [ 907.521756][T20337] openvswitch: netlink: Flow actions attr not present in new flow. [ 907.524620][T20338] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4267'. [ 907.971885][T20254] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 907.978338][T20254] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 907.982191][T20254] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 907.988226][T20254] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 907.992155][T20254] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 907.998678][T20254] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 908.002698][T20254] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 908.011956][T20254] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 908.041942][T20254] bridge0: port 2(bridge_slave_1) entered blocking state [ 908.045050][T20254] bridge0: port 2(bridge_slave_1) entered forwarding state [ 908.048365][T20254] bridge0: port 1(bridge_slave_0) entered blocking state [ 908.051370][T20254] bridge0: port 1(bridge_slave_0) entered forwarding state [ 908.090954][T20254] 8021q: adding VLAN 0 to HW filter on device bond0 [ 908.102540][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 908.108093][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 908.122727][T20362] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4277'. [ 908.126382][T20254] 8021q: adding VLAN 0 to HW filter on device team0 [ 908.136526][T20362] openvswitch: netlink: Flow actions attr not present in new flow. [ 908.136653][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 908.142228][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 908.151854][ T1169] bridge0: port 2(bridge_slave_1) entered blocking state [ 908.154145][ T1169] bridge0: port 2(bridge_slave_1) entered forwarding state [ 908.472591][T20254] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 908.692673][T20254] veth0_vlan: entered promiscuous mode [ 908.697472][ T5751] Bluetooth: hci0: command tx timeout [ 908.709008][T20254] veth1_vlan: entered promiscuous mode [ 908.738849][T20254] veth0_macvtap: entered promiscuous mode [ 908.745765][T20254] veth1_macvtap: entered promiscuous mode [ 908.764098][T20254] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 908.786409][T20254] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 908.858379][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 908.867490][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 908.896972][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 908.897501][ T14] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 908.900807][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 908.904231][ T14] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 908.939450][ T1169] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 908.942926][ T1169] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 909.221296][ T5089] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 909.228600][ T5089] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 909.231919][ T5089] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 909.240242][ T5089] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 909.243194][ T5089] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 909.635991][T13554] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 909.758501][T13554] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 909.887674][T13554] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 909.910520][T20444] bridge0: port 1(bridge_slave_0) entered blocking state [ 909.914016][T20444] bridge0: port 1(bridge_slave_0) entered disabled state [ 909.916917][T20444] bridge_slave_0: entered allmulticast mode [ 909.920105][T20444] bridge_slave_0: entered promiscuous mode [ 909.923717][T20444] bridge0: port 2(bridge_slave_1) entered blocking state [ 909.925970][T20444] bridge0: port 2(bridge_slave_1) entered disabled state [ 909.928736][T20444] bridge_slave_1: entered allmulticast mode [ 909.931534][T20444] bridge_slave_1: entered promiscuous mode [ 909.948494][T20444] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 909.953068][T20444] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 909.972531][T20444] team0: Port device team_slave_0 added [ 909.976496][T20444] team0: Port device team_slave_1 added [ 909.997849][T20444] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 910.000575][T20444] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 910.009389][T20444] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 910.014226][T20444] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 910.017872][T20444] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 910.028176][T20444] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 910.054546][T13554] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 910.098573][T20444] hsr_slave_0: entered promiscuous mode [ 910.099390][T20478] netlink: 'syz.0.4308': attribute type 1 has an invalid length. [ 910.101010][T20444] hsr_slave_1: entered promiscuous mode [ 910.106134][T20444] debugfs: 'hsr0' already exists in 'hsr' [ 910.108883][T20444] Cannot create hsr debugfs directory [ 910.123954][T20478] bond1: entered promiscuous mode [ 910.125967][T20478] 8021q: adding VLAN 0 to HW filter on device bond1 [ 910.178018][T20478] 8021q: adding VLAN 0 to HW filter on device bond1 [ 910.180468][T20478] bond1: (slave ipip0): The slave device specified does not support setting the MAC address [ 910.183595][T20478] bond1: (slave ipip0): Setting fail_over_mac to active for active-backup mode [ 910.190781][T20478] bond1: (slave ipip0): making interface the new active one [ 910.193095][T20478] ipip0: entered promiscuous mode [ 910.195714][T20478] bond1: (slave ipip0): Enslaving as an active interface with an up link [ 910.310283][ T14] netdevsim netdevsim2 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.450031][T13554] bridge_slave_1: left allmulticast mode [ 910.457284][T13554] bridge_slave_1: left promiscuous mode [ 910.460733][T13554] bridge0: port 2(bridge_slave_1) entered disabled state [ 910.471706][T13554] bridge_slave_0: left allmulticast mode [ 910.474065][T13554] bridge_slave_0: left promiscuous mode [ 910.476872][T13554] bridge0: port 1(bridge_slave_0) entered disabled state [ 910.704307][T13554] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 910.708587][T13554] bond0 (unregistering): Released all slaves [ 910.714861][T13554] bond1 (unregistering): (slave veth0_to_bond): Releasing active interface [ 910.722650][T13554] bond1 (unregistering): (slave bond2): Releasing active interface [ 910.725879][T13554] bond1 (unregistering): Released all slaves [ 910.741943][T13554] bond2 (unregistering): Released all slaves [ 910.757224][ T13] netdevsim netdevsim2 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.760574][ T13] netdevsim netdevsim2 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.768856][ T5089] Bluetooth: hci0: command tx timeout [ 910.769177][ T13] netdevsim netdevsim2 eth9: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.807082][T20503] netlink: 'syz.4.4317': attribute type 1 has an invalid length. [ 910.811114][T20504] netlink: 'syz.4.4317': attribute type 1 has an invalid length. [ 910.943149][T20444] netdevsim netdevsim2 eth9 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 911.016242][T13554] tipc: Left network mode [ 911.019834][ T5442] 8021q: adding VLAN 0 to HW filter on device eth6 [ 911.031798][T20514] netlink: 'syz.4.4319': attribute type 12 has an invalid length. [ 911.035301][T20514] netlink: 'syz.4.4319': attribute type 29 has an invalid length. [ 911.039181][T20514] netlink: 148 bytes leftover after parsing attributes in process `syz.4.4319'. [ 911.043072][T20514] netlink: 'syz.4.4319': attribute type 3 has an invalid length. [ 911.046505][T20514] netlink: 'syz.4.4319': attribute type 2 has an invalid length. [ 911.051626][T20514] netlink: 35 bytes leftover after parsing attributes in process `syz.4.4319'. [ 911.136371][T20529] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4325'. [ 911.150383][T20529] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4325'. [ 911.206314][T20444] netdevsim netdevsim2 eth8 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 911.278763][T20539] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4328'. [ 911.337420][ T5089] Bluetooth: hci1: command tx timeout [ 911.363523][T20444] netdevsim netdevsim2 eth7 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 911.480169][T20444] netdevsim netdevsim2 eth6 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 911.490976][T20558] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4335'. [ 911.494032][T20558] openvswitch: netlink: Flow actions attr not present in new flow. [ 911.713498][T20569] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4338'. [ 911.726067][T13554] hsr_slave_0: left promiscuous mode [ 911.729562][T13554] hsr_slave_1: left promiscuous mode [ 911.732463][T13554] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 911.735461][T13554] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 911.739657][T13554] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 911.742141][T13554] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 911.757669][T13554] veth1_vlan: left promiscuous mode [ 911.759822][T13554] veth0_vlan: left promiscuous mode [ 911.916298][T13554] team0 (unregistering): Port device team_slave_1 removed [ 911.924130][T13554] team0 (unregistering): Port device team_slave_0 removed [ 912.101683][T20444] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 912.124421][T20444] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 912.130312][T20444] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 912.145806][T20444] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 912.151004][T20444] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 912.164413][T20444] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 912.169880][T20444] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 912.177775][T20444] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 912.298605][T20444] 8021q: adding VLAN 0 to HW filter on device bond0 [ 912.363179][T20444] 8021q: adding VLAN 0 to HW filter on device team0 [ 912.371153][T11236] bridge0: port 1(bridge_slave_0) entered blocking state [ 912.374233][T11236] bridge0: port 1(bridge_slave_0) entered forwarding state [ 912.399669][T11236] bridge0: port 2(bridge_slave_1) entered blocking state [ 912.402745][T11236] bridge0: port 2(bridge_slave_1) entered forwarding state [ 912.659748][T20640] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4358'. [ 912.804057][T20444] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 912.878503][T20667] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4365'. [ 912.907111][T20667] bond1: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 912.925774][T20667] bond1 (unregistering): Released all slaves [ 912.984519][T20444] veth0_vlan: entered promiscuous mode [ 912.991297][T20444] veth1_vlan: entered promiscuous mode [ 913.016878][T20444] veth0_macvtap: entered promiscuous mode [ 913.029435][T20444] veth1_macvtap: entered promiscuous mode [ 913.046845][T20677] Driver unsupported XDP return value 0 on prog (id 834) dev N/A, expect packet loss! [ 913.049070][T20444] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 913.057408][T20444] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 913.118856][ T14] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 913.127391][ T14] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 913.240925][T11236] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 913.246562][T11236] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 913.286089][ T1169] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 913.287614][T10201] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 913.292994][T10201] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 913.293639][ T1169] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 913.311077][T20698] netlink: 'syz.4.4373': attribute type 12 has an invalid length. [ 913.319569][T20698] netlink: 'syz.4.4373': attribute type 29 has an invalid length. [ 913.325100][T20698] __nla_validate_parse: 1 callbacks suppressed [ 913.325115][T20698] netlink: 148 bytes leftover after parsing attributes in process `syz.4.4373'. [ 913.336332][T20698] netlink: 59 bytes leftover after parsing attributes in process `syz.4.4373'. [ 913.400326][T20708] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4378'. [ 913.408030][ T5751] Bluetooth: hci1: command tx timeout [ 913.412119][ T5089] Bluetooth: hci0: command tx timeout [ 914.489243][T20756] netlink: 116 bytes leftover after parsing attributes in process `syz.0.4399'. [ 914.534666][T20758] netlink: 'syz.0.4400': attribute type 1 has an invalid length. [ 914.537689][T20758] netlink: 756 bytes leftover after parsing attributes in process `syz.0.4400'. [ 914.897269][T20780] nbd4: detected capacity change from 0 to 63 [ 914.905230][T20783] block nbd4: NBD_DISCONNECT [ 914.909054][T20783] block nbd4: Disconnected due to user request. [ 914.915278][T20783] block nbd4: shutting down sockets [ 914.963706][ C1] blk_print_req_error: 136 callbacks suppressed [ 914.963727][ C1] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 914.970689][ C1] buffer_io_error: 138 callbacks suppressed [ 914.970708][ C1] Buffer I/O error on dev nbd4, logical block 0, async page read [ 914.976384][ C1] Buffer I/O error on dev nbd4, logical block 1, async page read [ 914.979754][ C1] Buffer I/O error on dev nbd4, logical block 2, async page read [ 914.983055][ C1] Buffer I/O error on dev nbd4, logical block 3, async page read [ 914.987406][ T1482] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 914.990538][ T1482] Buffer I/O error on dev nbd4, logical block 0, async page read [ 914.992995][ T1482] Buffer I/O error on dev nbd4, logical block 1, async page read [ 914.996085][ T1482] Buffer I/O error on dev nbd4, logical block 2, async page read [ 914.998708][ T1482] Buffer I/O error on dev nbd4, logical block 3, async page read [ 915.003791][ T1637] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 915.008438][ T1637] Buffer I/O error on dev nbd4, logical block 0, async page read [ 915.012025][ T1637] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 915.015859][ T1637] Buffer I/O error on dev nbd4, logical block 1, async page read [ 915.020095][ T1637] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 915.023406][ T1637] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 915.029849][ T1482] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 915.033251][ T1482] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 915.039493][ T1482] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 2 prio class 2 [ 915.043697][ T1637] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 915.048073][T13702] ldm_validate_partition_table(): Disk read failed. [ 915.051011][T13702] Dev nbd4: unable to read RDB block 0 [ 915.053511][T13702] nbd4: unable to read partition table [ 915.060671][T13702] ldm_validate_partition_table(): Disk read failed. [ 915.064687][T13702] Dev nbd4: unable to read RDB block 0 [ 915.068296][T13702] nbd4: unable to read partition table [ 915.128044][T20798] tipc: Started in network mode [ 915.129677][T20798] tipc: Node identity 76cc80757bb9, cluster identity 4711 [ 915.132364][T20798] tipc: Enabled bearer , priority 10 [ 915.223441][T20807] netlink: 'syz.3.4422': attribute type 1 has an invalid length. [ 915.297851][T20812] syzkaller0: entered promiscuous mode [ 915.300140][T20812] syzkaller0: entered allmulticast mode [ 915.466838][T20823] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4428'. [ 915.487138][ T5751] Bluetooth: hci1: command tx timeout [ 915.541480][T20828] netlink: 'syz.3.4431': attribute type 12 has an invalid length. [ 915.544931][T20828] netlink: 'syz.3.4431': attribute type 29 has an invalid length. [ 915.548779][T20828] netlink: 148 bytes leftover after parsing attributes in process `syz.3.4431'. [ 915.552474][T20828] netlink: 59 bytes leftover after parsing attributes in process `syz.3.4431'. [ 915.622478][T20835] netlink: 'syz.4.4434': attribute type 1 has an invalid length. [ 915.744428][T20847] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4440'. [ 915.748571][T20847] openvswitch: netlink: Flow actions attr not present in new flow. [ 915.959717][T20857] nbd3: detected capacity change from 0 to 63 [ 915.962626][T20862] block nbd3: NBD_DISCONNECT [ 915.970286][T20862] block nbd3: Disconnected due to user request. [ 915.977830][T20862] block nbd3: shutting down sockets [ 915.982207][T13702] ldm_validate_partition_table(): Disk read failed. [ 915.988593][T13702] Dev nbd3: unable to read RDB block 0 [ 915.994487][T13702] nbd3: unable to read partition table [ 916.021359][T13702] ldm_validate_partition_table(): Disk read failed. [ 916.027767][T13702] Dev nbd3: unable to read RDB block 0 [ 916.033031][T13702] nbd3: unable to read partition table [ 916.204846][T20870] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4450'. [ 916.221319][T20870] openvswitch: netlink: Flow actions attr not present in new flow. [ 916.260448][ T43] tipc: Node number set to 225804405 [ 916.270351][T20874] netlink: 'syz.4.4452': attribute type 1 has an invalid length. [ 916.430161][T20887] netlink: 'syz.2.4458': attribute type 12 has an invalid length. [ 916.433495][T20887] netlink: 'syz.2.4458': attribute type 29 has an invalid length. [ 916.968104][T20939] netlink: 'syz.3.4480': attribute type 12 has an invalid length. [ 916.971061][T20939] netlink: 'syz.3.4480': attribute type 29 has an invalid length. [ 917.235548][T20965] netlink: 'syz.4.4493': attribute type 4 has an invalid length. [ 917.445458][T20983] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 917.449349][T20983] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 917.514168][T20991] openvswitch: netlink: Flow actions attr not present in new flow. [ 917.567207][ T5751] Bluetooth: hci1: command tx timeout [ 917.641101][T20995] futex_wake_op: syz.2.4502 tries to shift op by -1; fix this program [ 917.698891][T21006] syzkaller0: entered promiscuous mode [ 917.701266][T21006] syzkaller0: entered allmulticast mode [ 918.014560][T21033] syzkaller0: entered promiscuous mode [ 918.017524][T21033] syzkaller0: entered allmulticast mode [ 918.163136][T21029] futex_wake_op: syz.2.4522 tries to shift op by -1; fix this program [ 918.407462][T21057] bond1: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 918.411932][T21057] bond1 (unregistering): Released all slaves [ 918.788358][T21069] syzkaller0: entered promiscuous mode [ 918.790372][T21069] syzkaller0: entered allmulticast mode [ 919.080111][T21082] syzkaller0: entered promiscuous mode [ 919.084951][T21082] syzkaller0: entered allmulticast mode [ 919.113658][T21088] __nla_validate_parse: 12 callbacks suppressed [ 919.113672][T21088] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4548'. [ 919.121221][T21088] openvswitch: netlink: Flow actions attr not present in new flow. [ 919.221739][T21096] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4552'. [ 919.238148][T21094] syzkaller0: entered promiscuous mode [ 919.242770][T21094] syzkaller0: entered allmulticast mode [ 919.383691][T21110] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4558'. [ 919.508771][T21118] bond1: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 919.520688][T21118] bond1 (unregistering): Released all slaves [ 919.631663][T21133] syzkaller0: entered promiscuous mode [ 919.637358][T21133] syzkaller0: entered allmulticast mode [ 920.074547][T21170] syzkaller0: entered promiscuous mode [ 920.077634][T21170] syzkaller0: entered allmulticast mode [ 920.203277][T21179] syzkaller0: entered promiscuous mode [ 920.205482][T21179] syzkaller0: entered allmulticast mode [ 920.696922][ T5089] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 920.713698][ T5089] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 920.717210][ T43] usb 9-1: new high-speed USB device number 50 using dummy_hcd [ 920.723214][ T5089] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 920.729648][ T5089] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 920.734407][ T5089] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 920.880563][ T43] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 920.888095][ T43] usb 9-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 920.890972][ T43] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 920.911964][ T43] as10x_usb: device has been detected [ 920.914017][ T43] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 920.941046][ T43] usb 9-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 920.960944][ T43] as10x_usb: error during firmware upload part1 [ 920.963410][ T43] Registered device Abilis Systems DVB-Titan [ 921.159219][T21249] block nbd0: NBD_DISCONNECT [ 921.185159][T21251] syzkaller0: entered promiscuous mode [ 921.189833][T21251] syzkaller0: entered allmulticast mode [ 921.481754][T21214] bridge0: port 1(bridge_slave_0) entered blocking state [ 921.484860][T21214] bridge0: port 1(bridge_slave_0) entered disabled state [ 921.488172][T21214] bridge_slave_0: entered allmulticast mode [ 921.492327][T21214] bridge_slave_0: entered promiscuous mode [ 921.497315][T21214] bridge0: port 2(bridge_slave_1) entered blocking state [ 921.500469][T21214] bridge0: port 2(bridge_slave_1) entered disabled state [ 921.503633][T21214] bridge_slave_1: entered allmulticast mode [ 921.508156][T21214] bridge_slave_1: entered promiscuous mode [ 921.540207][T21214] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 921.552750][T21214] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 921.583356][T21214] team0: Port device team_slave_0 added [ 921.588935][T21214] team0: Port device team_slave_1 added [ 921.615002][T21214] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 921.617984][T21214] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 921.628148][T21214] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 921.635637][T21214] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 921.638764][T21214] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 921.649536][T21214] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 921.701902][T21278] validate_nla: 2 callbacks suppressed [ 921.701917][T21278] netlink: 'syz.2.4626': attribute type 1 has an invalid length. [ 921.709835][T21214] hsr_slave_0: entered promiscuous mode [ 921.713722][T21214] hsr_slave_1: entered promiscuous mode [ 921.716762][T21214] debugfs: 'hsr0' already exists in 'hsr' [ 921.719264][T21214] Cannot create hsr debugfs directory [ 921.739296][T21278] bond1: entered promiscuous mode [ 921.742092][T21278] 8021q: adding VLAN 0 to HW filter on device bond1 [ 921.857741][T21284] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4628'. [ 921.870700][T21214] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 921.982454][T21214] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 922.082603][T21214] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 922.169106][T21214] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 922.358549][T21214] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 922.365099][T21214] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 922.371926][T21214] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 922.379607][T21214] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 922.383773][T21214] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 922.391216][T21214] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 922.395470][T21214] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 922.402982][T21214] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 922.470931][T21214] 8021q: adding VLAN 0 to HW filter on device bond0 [ 922.488776][T21214] 8021q: adding VLAN 0 to HW filter on device team0 [ 922.497979][ T1169] bridge0: port 1(bridge_slave_0) entered blocking state [ 922.500978][ T1169] bridge0: port 1(bridge_slave_0) entered forwarding state [ 922.508886][ T1169] bridge0: port 2(bridge_slave_1) entered blocking state [ 922.511818][ T1169] bridge0: port 2(bridge_slave_1) entered forwarding state [ 922.724075][T20428] usb 9-1: USB disconnect, device number 50 [ 922.749746][T20428] Unregistered device Abilis Systems DVB-Titan [ 922.752130][T20428] as10x_usb: device has been disconnected [ 922.807867][T21333] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4642'. [ 922.811183][T21333] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4642'. [ 922.847199][ T5089] Bluetooth: hci3: command tx timeout [ 922.864736][T21214] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 922.905530][T21214] veth0_vlan: entered promiscuous mode [ 922.915579][T21214] veth1_vlan: entered promiscuous mode [ 922.950386][T21214] veth0_macvtap: entered promiscuous mode [ 922.957282][T21214] veth1_macvtap: entered promiscuous mode [ 922.972069][T21214] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 922.983035][T21214] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 923.012629][ T14] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 923.019238][ T14] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 923.039328][ T14] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 923.049605][ T14] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 923.067282][T21348] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4647'. [ 923.126553][ T9966] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 923.130032][ T9966] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 923.161652][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 923.167340][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 923.327188][T21361] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4648'. [ 923.466134][T21373] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4655'. [ 923.494713][T21374] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4656'. [ 923.560384][T21378] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input36 [ 923.767162][ T10] usb 8-1: new high-speed USB device number 61 using dummy_hcd [ 923.918713][ T10] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 923.925337][ T10] usb 8-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 923.933180][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 923.953926][ T10] as10x_usb: device has been detected [ 923.956794][ T10] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 923.973884][ T10] usb 8-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 923.995699][ T10] as10x_usb: error during firmware upload part1 [ 923.998953][ T10] Registered device Abilis Systems DVB-Titan [ 924.752220][T21421] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4674'. [ 924.928299][ T5089] Bluetooth: hci3: command tx timeout [ 925.268384][T21452] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4687'. [ 925.410470][ T5089] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 925.417966][ T5089] Bluetooth: hci1: Injecting HCI hardware error event [ 925.421367][ T5089] Bluetooth: hci1: hardware error 0x00 [ 925.567868][T21467] syzkaller0: entered promiscuous mode [ 925.570435][T21467] syzkaller0: entered allmulticast mode [ 925.773478][ T43] usb 8-1: USB disconnect, device number 61 [ 925.780918][T21480] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4699'. [ 925.805284][ T43] Unregistered device Abilis Systems DVB-Titan [ 925.807608][ T43] as10x_usb: device has been disconnected [ 926.050418][T21493] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4704'. [ 926.068377][T21495] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4705'. [ 926.318790][T21519] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4715'. [ 926.528299][T21544] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4724'. [ 926.698984][T21556] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4730'. [ 927.034162][ T5751] Bluetooth: hci3: command tx timeout [ 927.277672][T21590] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4744'. [ 927.327756][T21593] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4745'. [ 927.448147][T21596] futex_wake_op: syz.0.4742 tries to shift op by -1; fix this program [ 927.487206][ T5089] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 927.906169][T21625] syzkaller0: entered promiscuous mode [ 927.908372][T21625] syzkaller0: entered allmulticast mode [ 927.912423][T21625] tipc: Started in network mode [ 927.914109][T21625] tipc: Node identity 76d4f5b856ce, cluster identity 4711 [ 927.919539][T21625] tipc: Enabled bearer , priority 0 [ 927.930845][T21625] tipc: Resetting bearer [ 927.944704][T21624] tipc: Resetting bearer [ 927.972849][T21624] tipc: Disabling bearer [ 928.164112][T21623] futex_wake_op: syz.2.4758 tries to shift op by -1; fix this program [ 928.735019][T21566] Set syz0 is full, maxelem 65536 reached [ 929.098186][ T5089] Bluetooth: hci3: command tx timeout [ 929.122904][T21685] syzkaller0: entered promiscuous mode [ 929.125323][T21685] syzkaller0: entered allmulticast mode [ 929.282656][T21700] block nbd0: not configured, cannot reconfigure [ 929.616723][T21721] netlink: 'syz.3.4797': attribute type 7 has an invalid length. [ 929.620408][T21721] netlink: 'syz.3.4797': attribute type 8 has an invalid length. [ 929.638892][T21710] futex_wake_op: syz.2.4793 tries to shift op by -1; fix this program [ 929.674322][T21724] tipc: Enabling of bearer rejected, failed to enable media [ 929.723415][T21726] syzkaller1: entered promiscuous mode [ 929.725479][T21726] syzkaller1: entered allmulticast mode [ 929.873406][T21732] syzkaller0: entered promiscuous mode [ 929.875960][T21732] syzkaller0: entered allmulticast mode [ 930.019745][T21742] syzkaller0: entered promiscuous mode [ 930.021969][T21742] syzkaller0: entered allmulticast mode [ 930.117783][T21751] __nla_validate_parse: 16 callbacks suppressed [ 930.117802][T21751] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4811'. [ 930.239649][T21759] syzkaller0: entered promiscuous mode [ 930.241494][T21759] syzkaller0: entered allmulticast mode [ 930.362938][T21772] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4821'. [ 930.629522][T21802] netlink: 64 bytes leftover after parsing attributes in process `syz.3.4834'. [ 930.965589][T21825] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4843'. [ 931.205649][T21840] syzkaller0: entered promiscuous mode [ 931.208104][T21840] syzkaller0: entered allmulticast mode [ 931.325208][T21844] netlink: 64 bytes leftover after parsing attributes in process `syz.3.4852'. [ 931.405611][T21842] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4851'. [ 931.451309][T21842] futex_wake_op: syz.4.4851 tries to shift op by -1; fix this program [ 931.500808][T21855] syzkaller0: entered promiscuous mode [ 931.504390][T21855] syzkaller0: entered allmulticast mode [ 932.133995][T21907] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4876'. [ 932.456416][T21935] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4891'. [ 932.473099][T21935] 8021q: adding VLAN 0 to HW filter on device bond1 [ 932.484328][T21935] 8021q: adding VLAN 0 to HW filter on device team0 [ 932.492620][T21935] bond1: (slave team0): Enslaving as an active interface with an up link [ 932.546270][T21939] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4892'. [ 932.687862][T21947] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4896'. [ 932.739479][T21953] nbd: must specify at least one socket [ 933.457146][ T10] usb 7-1: new high-speed USB device number 45 using dummy_hcd [ 933.611597][ T10] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 933.616083][ T10] usb 7-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 933.620237][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 933.635062][ T10] as10x_usb: device has been detected [ 933.639927][ T10] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 933.653006][ T10] usb 7-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 933.669504][ T10] as10x_usb: error during firmware upload part1 [ 933.672388][ T10] Registered device Abilis Systems DVB-Titan [ 934.046699][T21980] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 934.327619][T22018] syzkaller0: entered promiscuous mode [ 934.330199][T22018] syzkaller0: entered allmulticast mode [ 935.097441][T22042] nbd0: detected capacity change from 0 to 63 [ 935.100867][T22045] block nbd0: NBD_DISCONNECT [ 935.102925][T22045] block nbd0: Disconnected due to user request. [ 935.106485][T22045] block nbd0: shutting down sockets [ 935.120495][ C2] blk_print_req_error: 178 callbacks suppressed [ 935.120516][ C2] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 935.126936][ C2] buffer_io_error: 286 callbacks suppressed [ 935.126952][ C2] Buffer I/O error on dev nbd0, logical block 2, async page read [ 935.129529][ C0] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 935.136062][ C0] Buffer I/O error on dev nbd0, logical block 3, async page read [ 935.138950][ C0] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 935.141963][ C2] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 935.142178][ C0] Buffer I/O error on dev nbd0, logical block 0, async page read [ 935.146143][ C2] Buffer I/O error on dev nbd0, logical block 1, async page read [ 935.152228][ T1637] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 935.156189][ T1637] Buffer I/O error on dev nbd0, logical block 0, async page read [ 935.159587][ T1637] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 935.163835][ T1637] Buffer I/O error on dev nbd0, logical block 1, async page read [ 935.167437][ T1637] Buffer I/O error on dev nbd0, logical block 2, async page read [ 935.170755][ T1637] Buffer I/O error on dev nbd0, logical block 3, async page read [ 935.176097][ T9672] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 935.180155][ T9672] Buffer I/O error on dev nbd0, logical block 0, async page read [ 935.183099][ T9672] Buffer I/O error on dev nbd0, logical block 1, async page read [ 935.186532][ T9672] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 935.190684][ T9672] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 935.194852][ T9672] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 935.199285][T13702] ldm_validate_partition_table(): Disk read failed. [ 935.206598][T13702] Dev nbd0: unable to read RDB block 0 [ 935.210740][T13702] nbd0: unable to read partition table [ 935.222086][T13702] ldm_validate_partition_table(): Disk read failed. [ 935.228646][T13702] Dev nbd0: unable to read RDB block 0 [ 935.231606][T13702] nbd0: unable to read partition table [ 935.456721][ T5624] usb 7-1: USB disconnect, device number 45 [ 935.471157][ T5624] Unregistered device Abilis Systems DVB-Titan [ 935.472686][ T5624] as10x_usb: device has been disconnected [ 936.046470][T22085] syzkaller0: entered promiscuous mode [ 936.049490][T22085] syzkaller0: entered allmulticast mode [ 936.118420][T22083] nbd0: detected capacity change from 0 to 63 [ 936.123587][ T67] block nbd0: Receive control failed (result -104) [ 936.282959][T22093] __nla_validate_parse: 1 callbacks suppressed [ 936.282972][T22093] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4953'. [ 936.657204][ T9137] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 936.820003][ T9137] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 936.826977][ T9137] usb 5-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 936.833882][ T9137] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 936.843259][ T9137] as10x_usb: device has been detected [ 936.845900][ T9137] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 936.857644][ T9137] usb 5-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 936.863699][ T9137] as10x_usb: error during firmware upload part1 [ 936.867665][ T9137] Registered device Abilis Systems DVB-Titan [ 936.878899][T22124] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4966'. [ 936.884893][T22124] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4966'. [ 936.965672][T22128] bond2: entered promiscuous mode [ 936.970986][T22128] 8021q: adding VLAN 0 to HW filter on device bond2 [ 936.989640][T22128] 8021q: adding VLAN 0 to HW filter on device bond2 [ 936.992501][T22128] bond2: (slave ipip0): The slave device specified does not support setting the MAC address [ 936.997805][T22128] bond2: (slave ipip0): Error -95 calling set_mac_address [ 937.193810][T22137] netlink: 'syz.4.4972': attribute type 12 has an invalid length. [ 937.200424][T22137] netlink: 'syz.4.4972': attribute type 29 has an invalid length. [ 937.205082][T22137] netlink: 148 bytes leftover after parsing attributes in process `syz.4.4972'. [ 937.208265][T22137] netlink: 59 bytes leftover after parsing attributes in process `syz.4.4972'. [ 937.284585][T22145] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4976'. [ 937.345760][T22149] syzkaller0: entered promiscuous mode [ 937.348430][T22149] syzkaller0: entered allmulticast mode [ 937.587580][T22172] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4989'. [ 937.590733][T22172] netlink: 'syz.2.4989': attribute type 7 has an invalid length. [ 937.593757][T22172] netlink: 'syz.2.4989': attribute type 8 has an invalid length. [ 937.597751][T22172] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4989'. [ 937.708210][T22170] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4988'. [ 937.711146][T22170] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4988'. [ 937.767818][T22170] futex_wake_op: syz.3.4988 tries to shift op by -1; fix this program [ 938.059362][T22201] netlink: 'syz.4.5000': attribute type 7 has an invalid length. [ 938.064987][T22201] netlink: 'syz.4.5000': attribute type 8 has an invalid length. [ 938.121549][T22207] netlink: 'syz.3.5002': attribute type 12 has an invalid length. [ 938.125070][T22207] netlink: 'syz.3.5002': attribute type 29 has an invalid length. [ 938.389199][T22213] futex_wake_op: syz.3.5004 tries to shift op by -1; fix this program [ 938.663447][T20688] usb 5-1: USB disconnect, device number 57 [ 938.684445][T20688] Unregistered device Abilis Systems DVB-Titan [ 938.686485][T20688] as10x_usb: device has been disconnected [ 938.989711][T22228] netlink: 'syz.2.5011': attribute type 7 has an invalid length. [ 938.993093][T22228] netlink: 'syz.2.5011': attribute type 8 has an invalid length. [ 939.757144][ T6024] usb 9-1: new high-speed USB device number 51 using dummy_hcd [ 939.908582][ T6024] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 939.911937][ T6024] usb 9-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 939.914904][ T6024] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 939.923242][ T6024] as10x_usb: device has been detected [ 939.925496][ T6024] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 939.936865][ T6024] usb 9-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 939.947456][ T6024] as10x_usb: error during firmware upload part1 [ 939.950489][ T6024] Registered device Abilis Systems DVB-Titan [ 940.151597][T22274] dvmrp0: entered allmulticast mode [ 940.940278][T22318] bond2: entered promiscuous mode [ 940.942900][T22318] 8021q: adding VLAN 0 to HW filter on device bond2 [ 940.960519][T22318] 8021q: adding VLAN 0 to HW filter on device bond2 [ 940.963781][T22318] bond2: (slave ipip0): The slave device specified does not support setting the MAC address [ 940.969578][T22318] bond2: (slave ipip0): Error -95 calling set_mac_address [ 941.434449][T22346] __nla_validate_parse: 19 callbacks suppressed [ 941.434464][T22346] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5054'. [ 941.592225][T22356] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5056'. [ 941.757395][T10892] usb 9-1: USB disconnect, device number 51 [ 941.782852][T10892] Unregistered device Abilis Systems DVB-Titan [ 941.785194][T10892] as10x_usb: device has been disconnected [ 942.372235][T22378] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5063'. [ 942.373411][T22379] validate_nla: 5 callbacks suppressed [ 942.373430][T22379] netlink: 'syz.0.5064': attribute type 1 has an invalid length. [ 942.376229][T22378] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5063'. [ 942.396836][T22379] bond2: entered promiscuous mode [ 942.399822][T22379] 8021q: adding VLAN 0 to HW filter on device bond2 [ 942.431888][T22379] 8021q: adding VLAN 0 to HW filter on device bond2 [ 942.434784][T22379] bond2: (slave ipip1): The slave device specified does not support setting the MAC address [ 942.441401][T22379] bond2: (slave ipip1): Error -95 calling set_mac_address [ 942.757150][T22390] nbd3: detected capacity change from 0 to 63 [ 942.763358][ T67] block nbd3: Receive control failed (result -104) [ 942.931891][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 942.938856][T22400] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5071'. [ 943.057234][T20688] usb 8-1: new high-speed USB device number 62 using dummy_hcd [ 943.241439][T20688] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 943.250695][T20688] usb 8-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 943.254860][T20688] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 943.277311][T20688] as10x_usb: device has been detected [ 943.280337][T20688] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 943.292309][T20688] usb 8-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 943.301173][T20688] as10x_usb: error during firmware upload part1 [ 943.304235][T20688] Registered device Abilis Systems DVB-Titan [ 943.347375][T22415] nbd4: detected capacity change from 0 to 63 [ 943.354493][ T5902] block nbd4: Send control failed (result -32) [ 943.357977][ T67] block nbd4: Receive control failed (result -32) [ 943.363242][ T5902] block nbd4: Request send failed, requeueing [ 943.381107][T19843] block nbd4: Dead connection, failed to find a fallback [ 943.384272][T19843] block nbd4: shutting down sockets [ 943.388442][T19843] blk_print_req_error: 118 callbacks suppressed [ 943.388461][T19843] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 943.401458][T19843] buffer_io_error: 138 callbacks suppressed [ 943.401476][T19843] Buffer I/O error on dev nbd4, logical block 0, async page read [ 943.407455][T19843] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 943.411325][T19843] Buffer I/O error on dev nbd4, logical block 1, async page read [ 943.414523][T19843] Buffer I/O error on dev nbd4, logical block 2, async page read [ 943.418823][T19843] Buffer I/O error on dev nbd4, logical block 3, async page read [ 943.425116][ T9672] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 943.429194][ T9672] Buffer I/O error on dev nbd4, logical block 0, async page read [ 943.435910][ T9672] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 943.441341][ T9672] Buffer I/O error on dev nbd4, logical block 1, async page read [ 943.446103][ T9672] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 943.450379][ T9672] Buffer I/O error on dev nbd4, logical block 2, async page read [ 943.453861][ T9672] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 943.457893][ T9672] Buffer I/O error on dev nbd4, logical block 3, async page read [ 943.461223][T19843] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 943.465333][T19843] Buffer I/O error on dev nbd4, logical block 0, async page read [ 943.468620][T19843] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 943.472481][T19843] Buffer I/O error on dev nbd4, logical block 1, async page read [ 943.476030][ T9672] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 943.480244][ T9672] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 943.489020][T16319] ldm_validate_partition_table(): Disk read failed. [ 943.492877][T16319] Dev nbd4: unable to read RDB block 0 [ 943.496378][T16319] nbd4: unable to read partition table [ 943.511352][T16319] ldm_validate_partition_table(): Disk read failed. [ 943.514722][T22427] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5082'. [ 943.518114][T16319] Dev nbd4: unable to read RDB block 0 [ 943.519258][T16319] nbd4: unable to read partition table [ 943.591088][T22429] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5084'. [ 943.595010][T22429] netlink: 'syz.2.5084': attribute type 7 has an invalid length. [ 943.598555][T22429] netlink: 'syz.2.5084': attribute type 8 has an invalid length. [ 943.609431][T22429] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5084'. [ 943.727290][T22437] netlink: 'syz.0.5088': attribute type 12 has an invalid length. [ 943.901929][T22451] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5093'. [ 943.919491][T22451] netlink: 'syz.0.5093': attribute type 7 has an invalid length. [ 943.922202][T22451] netlink: 'syz.0.5093': attribute type 8 has an invalid length. [ 943.924525][T22451] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5093'. [ 944.325711][T22463] futex_wake_op: syz.0.5094 tries to shift op by -1; fix this program [ 944.773545][T22477] syz.4.5100: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 944.779072][T22477] CPU: 2 UID: 0 PID: 22477 Comm: syz.4.5100 Not tainted syzkaller #0 PREEMPT(full) [ 944.779113][T22477] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 944.779142][T22477] Call Trace: [ 944.779160][T22477] [ 944.779168][T22477] dump_stack_lvl+0x100/0x190 [ 944.779278][T22477] warn_alloc.cold+0x94/0xa8 [ 944.779319][T22477] ? __pfx_warn_alloc+0x10/0x10 [ 944.779370][T22477] ? kasan_save_stack+0x3f/0x50 [ 944.779405][T22477] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 944.779425][T22477] ? xskq_create+0x52/0x1d0 [ 944.779547][T22477] ? xsk_setsockopt+0x743/0xab0 [ 944.779567][T22477] ? do_sock_setsockopt+0xf3/0x1d0 [ 944.779637][T22477] ? __sys_setsockopt+0x119/0x190 [ 944.779662][T22477] ? __ia32_sys_setsockopt+0xbc/0x160 [ 944.779686][T22477] ? __do_fast_syscall_32+0xe7/0x970 [ 944.779722][T22477] ? do_fast_syscall_32+0x32/0x70 [ 944.779754][T22477] ? xskq_create+0xfb/0x1d0 [ 944.779775][T22477] __vmalloc_node_range_noprof+0x136c/0x1630 [ 944.779812][T22477] ? xskq_create+0xfb/0x1d0 [ 944.779839][T22477] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 944.779861][T22477] ? kasan_save_track+0x14/0x30 [ 944.779877][T22477] ? __kasan_kmalloc+0xaa/0xb0 [ 944.779892][T22477] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 944.779905][T22477] ? xskq_create+0xfb/0x1d0 [ 944.779923][T22477] vmalloc_user_noprof+0x9e/0xe0 [ 944.779947][T22477] ? xskq_create+0xfb/0x1d0 [ 944.779966][T22477] xskq_create+0xfb/0x1d0 [ 944.779990][T22477] xsk_setsockopt+0x743/0xab0 [ 944.780009][T22477] ? __pfx_aa_sk_perm+0x10/0x10 [ 944.780086][T22477] ? __pfx_xsk_setsockopt+0x10/0x10 [ 944.780108][T22477] ? find_held_lock+0x2b/0x80 [ 944.780156][T22477] ? aa_sock_opt_perm+0xfe/0x1b0 [ 944.780177][T22477] ? __pfx_xsk_setsockopt+0x10/0x10 [ 944.780198][T22477] do_sock_setsockopt+0xf3/0x1d0 [ 944.780230][T22477] __sys_setsockopt+0x119/0x190 [ 944.780259][T22477] __ia32_sys_setsockopt+0xbc/0x160 [ 944.780284][T22477] ? __do_fast_syscall_32+0x98/0x970 [ 944.780310][T22477] ? lockdep_hardirqs_on+0x78/0x100 [ 944.780334][T22477] __do_fast_syscall_32+0xe7/0x970 [ 944.780360][T22477] ? lockdep_hardirqs_on+0x78/0x100 [ 944.780384][T22477] do_fast_syscall_32+0x32/0x70 [ 944.780411][T22477] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 944.780434][T22477] RIP: 0023:0xf706efec [ 944.780462][T22477] Code: Unable to access opcode bytes at 0xf706efc2. [ 944.780470][T22477] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 944.780489][T22477] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000000000011b [ 944.780501][T22477] RDX: 0000000000000006 RSI: 0000000080000000 RDI: 0000000000000004 [ 944.780512][T22477] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 944.780522][T22477] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 944.780532][T22477] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 944.780554][T22477] [ 944.780676][T22477] Mem-Info: [ 944.901163][T22477] active_anon:995 inactive_anon:6707 isolated_anon:0 [ 944.901163][T22477] active_file:3430 inactive_file:9961 isolated_file:0 [ 944.901163][T22477] unevictable:1000 dirty:29 writeback:25 [ 944.901163][T22477] slab_reclaimable:6653 slab_unreclaimable:74357 [ 944.901163][T22477] mapped:25750 shmem:1503 pagetables:1599 [ 944.901163][T22477] sec_pagetables:308 bounce:0 [ 944.901163][T22477] kernel_misc_reclaimable:0 [ 944.901163][T22477] free:56215 free_pcp:9504 free_cma:0 [ 944.915355][T22477] Node 0 active_anon:116kB inactive_anon:16kB active_file:264kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:3100kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8544kB pagetables:1404kB sec_pagetables:1104kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 944.929056][T22477] Node 1 active_anon:3912kB inactive_anon:26792kB active_file:13472kB inactive_file:39876kB unevictable:4000kB isolated(anon):0kB isolated(file):0kB mapped:99972kB dirty:128kB writeback:36kB shmem:5956kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:6596kB pagetables:4944kB sec_pagetables:128kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 944.941844][T22477] Node 0 DMA free:2972kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:68kB local_pcp:0kB free_cma:0kB [ 944.951713][T22477] lowmem_reserve[]: 0 280 280 280 280 [ 944.953468][T22477] Node 0 DMA32 free:17648kB boost:2048kB min:14824kB low:18016kB high:21208kB reserved_highatomic:0KB free_highatomic:0KB active_anon:144kB inactive_anon:16kB active_file:312kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:260kB present:1032196kB managed:287072kB mlocked:0kB bounce:0kB free_pcp:8432kB local_pcp:976kB free_cma:0kB [ 944.963847][T22477] lowmem_reserve[]: 0 0 0 0 0 [ 944.965743][T22477] Node 1 DMA32 free:204112kB boost:12288kB min:59428kB low:71212kB high:82996kB reserved_highatomic:0KB free_highatomic:0KB active_anon:3928kB inactive_anon:26744kB active_file:13556kB inactive_file:39952kB unevictable:4000kB writepending:200kB zspages:1616kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:29516kB local_pcp:2572kB free_cma:0kB [ 944.976006][T22477] lowmem_reserve[]: 0 0 0 0 0 [ 944.977714][T22477] Node 0 DMA: 169*4kB (U) 61*8kB (U) 29*16kB (U) 12*32kB (U) 3*64kB (U) 0*128kB 1*256kB (U) 1*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 2972kB [ 944.982411][T22477] Node 0 DMA32: 454*4kB (U) 66*8kB (UME) 7*16kB (UE) 142*32kB (UE) 36*64kB (UME) 23*128kB (UME) 5*256kB (UME) 6*512kB (UM) 1*1024kB (U) 0*2048kB 0*4096kB = 17624kB [ 944.989184][T22477] Node 1 DMA32: 1002*4kB (UME) 1305*8kB (UME) 858*16kB (UME) 1083*32kB (UME) 690*64kB (UME) 373*128kB (UME) 91*256kB (UME) 35*512kB (UM) 6*1024kB (M) 1*2048kB (M) 0*4096kB = 204144kB [ 944.996441][T22477] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 944.999594][T22477] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 945.002445][T22477] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 945.005391][T22477] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 945.008445][T22477] 15275 total pagecache pages [ 945.009911][T22477] 311 pages in swap cache [ 945.011274][T22477] Free swap = 120288kB [ 945.012580][T22477] Total swap = 124996kB [ 945.013886][T22477] 524155 pages RAM [ 945.015084][T22477] 0 pages HighMem/MovableOnly [ 945.016580][T22477] 211494 pages reserved [ 945.018116][T22477] 0 pages cma reserved [ 945.350705][T22494] futex_wake_op: syz.4.5106 tries to shift op by -1; fix this program [ 945.525228][T22505] syzkaller0: entered promiscuous mode [ 945.527749][T22505] syzkaller0: entered allmulticast mode [ 945.706907][T22510] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input37 [ 945.943894][T20688] usb 8-1: USB disconnect, device number 62 [ 945.968327][T20688] Unregistered device Abilis Systems DVB-Titan [ 945.969278][T20688] as10x_usb: device has been disconnected [ 946.712504][T22581] nbd: nbd4 already in use [ 946.714513][T22581] block nbd4: NBD_DISCONNECT [ 946.716819][T22581] block nbd4: Send disconnect failed -32 [ 946.771549][T22583] __nla_validate_parse: 4 callbacks suppressed [ 946.771567][T22583] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5137'. [ 946.779006][T22583] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5137'. [ 946.953293][T22599] sctp: [Deprecated]: syz.0.5140 (pid 22599) Use of int in maxseg socket option. [ 946.953293][T22599] Use struct sctp_assoc_value instead [ 947.076418][T22606] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5147'. [ 947.082936][T22606] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5147'. [ 947.118040][T22601] nbd4: detected capacity change from 0 to 63 [ 947.123474][T22604] block nbd4: NBD_DISCONNECT [ 947.125610][T22604] block nbd4: Disconnected due to user request. [ 947.130245][T22604] block nbd4: shutting down sockets [ 947.137597][T16319] ldm_validate_partition_table(): Disk read failed. [ 947.141641][T16319] Dev nbd4: unable to read RDB block 0 [ 947.145437][T16319] nbd4: unable to read partition table [ 947.157489][T16319] ldm_validate_partition_table(): Disk read failed. [ 947.161410][T16319] Dev nbd4: unable to read RDB block 0 [ 947.165210][T16319] nbd4: unable to read partition table [ 947.177234][T22611] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5150'. [ 947.193095][T22613] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5149'. [ 947.196436][T22613] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5149'. [ 947.402939][T22629] netlink: 'syz.4.5158': attribute type 1 has an invalid length. [ 947.420944][T22629] 8021q: adding VLAN 0 to HW filter on device bond1 [ 947.432857][T22629] bond1: (slave dummy0): making interface the new active one [ 947.436256][T22629] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 947.450036][T22629] bond1: entered promiscuous mode [ 947.451808][T22629] dummy0: entered promiscuous mode [ 947.453643][T22629] bond1: entered allmulticast mode [ 947.455394][T22629] dummy0: entered allmulticast mode [ 947.495711][T22635] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5160'. [ 947.746338][T22648] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5168'. [ 947.750641][T22648] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5168'. [ 947.946341][ T5751] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 947.956644][ T5751] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 947.960579][ T5751] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 947.975465][ T5751] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 947.984092][ T5751] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 948.424303][T22698] Bluetooth: MGMT ver 1.23 [ 948.559210][ T14] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 948.595472][T22710] dvmrp0: entered allmulticast mode [ 948.605079][T22710] netlink: 'syz.4.5189': attribute type 12 has an invalid length. [ 948.682674][ T14] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 948.695702][T22662] bridge0: port 1(bridge_slave_0) entered blocking state [ 948.699125][T22662] bridge0: port 1(bridge_slave_0) entered disabled state [ 948.702189][T22662] bridge_slave_0: entered allmulticast mode [ 948.706283][T22662] bridge_slave_0: entered promiscuous mode [ 948.711423][T22662] bridge0: port 2(bridge_slave_1) entered blocking state [ 948.714532][T22662] bridge0: port 2(bridge_slave_1) entered disabled state [ 948.717699][T22662] bridge_slave_1: entered allmulticast mode [ 948.730896][T22662] bridge_slave_1: entered promiscuous mode [ 948.765642][T22662] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 948.792636][ T14] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 948.802738][T22662] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 948.840158][T22662] team0: Port device team_slave_0 added [ 948.845735][T22662] team0: Port device team_slave_1 added [ 948.868290][T22662] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 948.871384][T22662] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 948.882176][T22662] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 948.890483][T22662] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 948.893542][T22662] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 948.903808][T22662] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 948.947680][ T14] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 948.992063][T22662] hsr_slave_0: entered promiscuous mode [ 948.995602][T22662] hsr_slave_1: entered promiscuous mode [ 948.998979][T22662] debugfs: 'hsr0' already exists in 'hsr' [ 949.001707][T22662] Cannot create hsr debugfs directory [ 949.371673][ T14] bond1 (unregistering): (slave ipip0): Releasing backup interface [ 949.374895][ T14] ipip0 (unregistering): left promiscuous mode [ 949.395919][ T14] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 949.402167][ T14] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 949.406132][ T14] bond0 (unregistering): Released all slaves [ 949.412576][ T14] bond1 (unregistering): Released all slaves [ 949.421024][ T14] bond2 (unregistering): Released all slaves [ 949.438924][T22738] netlink: 'syz.4.5202': attribute type 12 has an invalid length. [ 949.446017][T22738] netlink: 'syz.4.5202': attribute type 29 has an invalid length. [ 949.570783][T22739] syzkaller0: entered promiscuous mode [ 949.573495][T22739] syzkaller0: entered allmulticast mode [ 949.577524][ T14] tipc: Left network mode [ 949.877246][T13554] netdevsim netdevsim0 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 949.880683][T13554] netdevsim netdevsim0 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 949.916451][T22765] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 0, id = 0 [ 949.971270][T22662] netdevsim netdevsim0 eth7 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.047264][ T5751] Bluetooth: hci4: command tx timeout [ 950.068881][ T5442] 8021q: adding VLAN 0 to HW filter on device eth6 [ 950.071669][T22760] futex_wake_op: syz.2.5206 tries to shift op by -1; fix this program [ 950.133021][T22662] netdevsim netdevsim0 eth6 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.146323][T22780] netlink: 'syz.3.5211': attribute type 12 has an invalid length. [ 950.148934][T22780] netlink: 'syz.3.5211': attribute type 29 has an invalid length. [ 950.460662][ T5089] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 950.487181][T22662] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 950.494626][T22662] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 950.498263][T22662] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 950.519990][T22806] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input38 [ 950.531801][T22662] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 950.536585][T22662] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 950.546964][T22662] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 950.551185][T22662] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 950.586341][T22662] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 950.604417][T22810] netlink: 'syz.4.5222': attribute type 12 has an invalid length. [ 950.611639][T22810] netlink: 'syz.4.5222': attribute type 29 has an invalid length. [ 950.675724][T22662] 8021q: adding VLAN 0 to HW filter on device bond0 [ 950.686089][T22815] futex_wake_op: syz.2.5221 tries to shift op by -1; fix this program [ 950.715576][ T14] hsr_slave_0: left promiscuous mode [ 950.718962][ T14] hsr_slave_1: left promiscuous mode [ 950.721786][ T14] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 950.725246][ T14] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 950.752256][ T14] veth1_macvtap: left promiscuous mode [ 950.755566][ T14] veth0_macvtap: left promiscuous mode [ 950.758631][ T14] veth1_vlan: left promiscuous mode [ 950.760494][ T14] veth0_vlan: left promiscuous mode [ 951.040341][ T14] team0 (unregistering): Port device team_slave_1 removed [ 951.052499][ T14] team0 (unregistering): Port device team_slave_0 removed [ 951.142882][T22835] syzkaller0: entered promiscuous mode [ 951.144793][T22835] syzkaller0: entered allmulticast mode [ 951.188434][T22662] 8021q: adding VLAN 0 to HW filter on device team0 [ 951.198940][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 951.201273][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 951.212688][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 951.215051][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 951.331781][T22852] netlink: 'syz.4.5231': attribute type 12 has an invalid length. [ 951.335306][T22852] netlink: 'syz.4.5231': attribute type 29 has an invalid length. [ 951.538132][T22662] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 951.571507][T22662] veth0_vlan: entered promiscuous mode [ 951.583809][T22662] veth1_vlan: entered promiscuous mode [ 951.613603][T22662] veth0_macvtap: entered promiscuous mode [ 951.618908][T22662] veth1_macvtap: entered promiscuous mode [ 951.628556][T22662] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 951.639739][T22662] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 951.690674][ T14] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 951.709471][ T14] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 951.792213][ T1169] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 951.795833][ T1169] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 951.819346][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 951.821994][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 951.827622][T10201] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 951.831149][T10201] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 951.840957][T22869] __nla_validate_parse: 12 callbacks suppressed [ 951.840970][T22869] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5234'. [ 951.913921][T22869] futex_wake_op: syz.2.5234 tries to shift op by -1; fix this program [ 952.014863][T22881] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5236'. [ 952.018840][T22881] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5236'. [ 952.127446][ T5089] Bluetooth: hci4: command tx timeout [ 952.303533][T22905] netlink: 148 bytes leftover after parsing attributes in process `syz.0.5249'. [ 952.309635][T22906] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5248'. [ 952.312360][T22906] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5248'. [ 952.344905][T22896] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5244'. [ 952.399147][T22907] futex_wake_op: syz.3.5244 tries to shift op by -1; fix this program [ 952.511980][T22923] syzkaller0: entered promiscuous mode [ 952.514674][T22923] syzkaller0: entered allmulticast mode [ 952.571269][T22929] validate_nla: 2 callbacks suppressed [ 952.571287][T22929] netlink: 'syz.0.5258': attribute type 12 has an invalid length. [ 952.576228][T22929] netlink: 'syz.0.5258': attribute type 29 has an invalid length. [ 952.580204][T22929] netlink: 148 bytes leftover after parsing attributes in process `syz.0.5258'. [ 952.681811][T22939] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5263'. [ 952.685028][T22939] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5263'. [ 952.869442][T22952] netlink: 'syz.3.5268': attribute type 12 has an invalid length. [ 952.872859][T22952] netlink: 'syz.3.5268': attribute type 29 has an invalid length. [ 952.891992][T22954] syzkaller0: entered promiscuous mode [ 952.893221][T22946] futex_wake_op: syz.0.5264 tries to shift op by -1; fix this program [ 952.893973][T22954] syzkaller0: entered allmulticast mode [ 952.965803][T22956] syzkaller0: entered promiscuous mode [ 952.968225][T22956] syzkaller0: entered allmulticast mode [ 953.197543][T22972] netlink: 'syz.0.5278': attribute type 12 has an invalid length. [ 953.200710][T22972] netlink: 'syz.0.5278': attribute type 29 has an invalid length. [ 953.353741][T22983] syzkaller0: entered promiscuous mode [ 953.357102][T22983] syzkaller0: entered allmulticast mode [ 953.452251][T22984] futex_wake_op: syz.3.5279 tries to shift op by -1; fix this program [ 954.109547][T23026] futex_wake_op: syz.3.5296 tries to shift op by -1; fix this program [ 954.208238][ T5089] Bluetooth: hci4: command tx timeout [ 954.256647][T23044] syzkaller0: entered promiscuous mode [ 954.258725][T23044] syzkaller0: entered allmulticast mode [ 954.545042][T23069] syzkaller0: entered promiscuous mode [ 954.547575][T23069] syzkaller0: entered allmulticast mode [ 954.912790][T23091] netlink: 'syz.4.5332': attribute type 12 has an invalid length. [ 954.916019][T23091] netlink: 'syz.4.5332': attribute type 29 has an invalid length. [ 954.948146][T23095] syzkaller0: entered promiscuous mode [ 954.950313][T23095] syzkaller0: entered allmulticast mode [ 955.035012][T23097] syzkaller0: entered promiscuous mode [ 955.037659][T23097] syzkaller0: entered allmulticast mode [ 956.290145][ T5089] Bluetooth: hci4: command tx timeout [ 956.868197][T23126] __nla_validate_parse: 13 callbacks suppressed [ 956.868216][T23126] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5341'. [ 957.717673][T23130] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 957.723203][T23130] syzkaller0: entered promiscuous mode [ 957.725660][T23130] syzkaller0: entered allmulticast mode [ 957.986838][T23151] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5351'. [ 958.125777][T23160] syzkaller0: entered promiscuous mode [ 958.128396][T23160] syzkaller0: entered allmulticast mode [ 958.271498][T23178] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5363'. [ 960.725256][T23177] syzkaller0: entered promiscuous mode [ 960.727794][T23177] syzkaller0: entered allmulticast mode [ 960.863576][T23189] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 960.870005][T23189] syzkaller0: entered promiscuous mode [ 960.872448][T23189] syzkaller0: entered allmulticast mode [ 961.082455][T23209] syzkaller0: entered promiscuous mode [ 961.084323][T23209] syzkaller0: entered allmulticast mode [ 961.238833][T23222] syzkaller0: entered promiscuous mode [ 961.240593][T23222] syzkaller0: entered allmulticast mode [ 961.540373][T23253] syzkaller0: entered promiscuous mode [ 961.542847][T23253] syzkaller0: entered allmulticast mode [ 961.609599][T23258] syzkaller0: entered promiscuous mode [ 961.611536][T23258] syzkaller0: entered allmulticast mode [ 961.986129][T23295] syzkaller0: entered promiscuous mode [ 961.988550][T23295] syzkaller0: entered allmulticast mode [ 962.019705][T23294] syzkaller0: entered promiscuous mode [ 962.021671][T23294] syzkaller0: entered allmulticast mode [ 962.026160][T23297] syzkaller0: entered promiscuous mode [ 962.028448][T23297] syzkaller0: entered allmulticast mode [ 962.386207][T23323] syzkaller0: entered promiscuous mode [ 962.388998][T23323] syzkaller0: entered allmulticast mode [ 962.559506][T23335] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5425'. [ 962.562428][T23335] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5425'. [ 962.625876][T23341] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5427'. [ 962.629315][T23341] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5427'. [ 962.773320][T23351] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input39 [ 963.209429][T23404] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5453'. [ 963.212154][T23404] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5453'. [ 963.356793][T23421] syzkaller0: entered promiscuous mode [ 963.360667][T23421] syzkaller0: entered allmulticast mode [ 963.425740][T23426] dvmrp0: entered allmulticast mode [ 963.955021][T23468] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5471'. [ 964.000374][T23472] syzkaller0: entered promiscuous mode [ 964.002538][T23472] syzkaller0: entered allmulticast mode [ 964.282758][T23495] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5482'. [ 964.284679][T23496] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5481'. [ 964.366395][T23502] netlink: 260 bytes leftover after parsing attributes in process `syz.2.5485'. [ 965.314950][T23578] syzkaller0: entered promiscuous mode [ 965.316897][T23578] syzkaller0: entered allmulticast mode [ 966.255735][T23648] syzkaller0: entered promiscuous mode [ 966.258388][T23648] syzkaller0: entered allmulticast mode [ 966.490362][T23665] syzkaller0: entered promiscuous mode [ 966.492200][T23665] syzkaller0: entered allmulticast mode [ 966.613458][ T1637] block nbd0: Possible stuck request ffff888027ee4440: control (read@0,1024B). Runtime 30 seconds [ 966.625990][ T1637] block nbd0: Possible stuck request ffff888027ee4600: control (read@1024,3072B). Runtime 30 seconds [ 966.810253][T23695] syzkaller0: entered promiscuous mode [ 966.812080][T23695] syzkaller0: entered allmulticast mode [ 966.944357][T23701] syzkaller0: entered promiscuous mode [ 966.946570][T23701] syzkaller0: entered allmulticast mode [ 967.268321][T23721] syzkaller0: entered promiscuous mode [ 967.270208][T23721] syzkaller0: entered allmulticast mode [ 967.738654][T23744] __nla_validate_parse: 11 callbacks suppressed [ 967.738668][T23744] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5586'. [ 967.744559][T23744] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5586'. [ 967.898008][T23763] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5594'. [ 968.308642][T23784] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5604'. [ 968.312350][T23784] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5604'. [ 968.454977][T23793] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5606'. [ 968.553046][T10201] bridge_slave_1: left allmulticast mode [ 968.554961][T10201] bridge_slave_1: left promiscuous mode [ 968.557936][T10201] bridge0: port 2(bridge_slave_1) entered disabled state [ 968.566422][T10201] bridge_slave_0: left allmulticast mode [ 968.571480][T10201] bridge_slave_0: left promiscuous mode [ 968.574101][T10201] bridge0: port 1(bridge_slave_0) entered disabled state [ 968.684384][T10201] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 968.691635][T10201] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 968.695271][T10201] bond0 (unregistering): Released all slaves [ 968.915395][T23819] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5617'. [ 969.055940][T23816] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5616'. [ 969.060187][T23816] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5616'. [ 969.221409][T23845] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5627'. [ 969.229164][T10201] hsr_slave_0: left promiscuous mode [ 969.231565][T10201] hsr_slave_1: left promiscuous mode [ 969.233621][T10201] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 969.236431][T10201] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 969.404703][T10201] team0 (unregistering): Port device team_slave_1 removed [ 969.415555][T10201] team0 (unregistering): Port device team_slave_0 removed [ 969.603215][T23845] ip6gre1: entered promiscuous mode [ 969.607128][T23845] ip6gre1: entered allmulticast mode [ 970.341200][T23914] netlink: 'syz.3.5650': attribute type 7 has an invalid length. [ 970.343806][T23914] netlink: 'syz.3.5650': attribute type 8 has an invalid length. [ 972.036516][T24033] syzkaller0: entered promiscuous mode [ 972.038512][T24033] syzkaller0: entered allmulticast mode [ 972.347974][T24051] bridge0: port 1(bridge_slave_0) entered disabled state [ 973.012743][ T1482] block nbd3: Possible stuck request ffff888027fd8dc0: control (read@0,4096B). Runtime 30 seconds [ 973.326625][T24101] syzkaller0: entered promiscuous mode [ 973.328558][T24101] syzkaller0: entered allmulticast mode [ 973.520366][T24113] syzkaller0: entered promiscuous mode [ 973.522873][T24113] syzkaller0: entered allmulticast mode [ 976.117995][T24153] __nla_validate_parse: 58 callbacks suppressed [ 976.118007][T24153] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5753'. [ 976.128207][T24148] virt_wifi0 speed is unknown, defaulting to 1000 [ 976.132377][T24148] virt_wifi0 speed is unknown, defaulting to 1000 [ 976.136223][T24148] virt_wifi0 speed is unknown, defaulting to 1000 [ 976.140893][T24148] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 976.146778][T24148] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 976.154067][T24148] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 976.165291][T24148] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 976.185144][T24148] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 976.219954][T24148] virt_wifi0 speed is unknown, defaulting to 1000 [ 976.224046][T24148] virt_wifi0 speed is unknown, defaulting to 1000 [ 976.228391][T24148] virt_wifi0 speed is unknown, defaulting to 1000 [ 976.231362][T24148] virt_wifi0 speed is unknown, defaulting to 1000 [ 976.235000][T24148] virt_wifi0 speed is unknown, defaulting to 1000 [ 976.238753][T24148] virt_wifi0 speed is unknown, defaulting to 1000 [ 976.765400][T24192] netlink: 'syz.3.5770': attribute type 1 has an invalid length. [ 976.778420][T24192] bond3: entered promiscuous mode [ 976.780616][T24192] 8021q: adding VLAN 0 to HW filter on device bond3 [ 976.794028][T24192] 8021q: adding VLAN 0 to HW filter on device bond3 [ 976.796489][T24192] bond3: (slave ipip0): The slave device specified does not support setting the MAC address [ 976.800825][T24192] bond3: (slave ipip0): Setting fail_over_mac to active for active-backup mode [ 976.807698][T24192] bond3: (slave ipip0): making interface the new active one [ 976.810037][T24192] ipip0: entered promiscuous mode [ 976.812562][T24192] bond3: (slave ipip0): Enslaving as an active interface with an up link [ 977.281803][T24242] netlink: 592 bytes leftover after parsing attributes in process `syz.0.5791'. [ 977.392471][T24252] netlink: 5408 bytes leftover after parsing attributes in process `syz.0.5797'. [ 977.395604][T24252] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 977.456536][T24258] netlink: 592 bytes leftover after parsing attributes in process `syz.3.5802'. [ 977.512700][T24269] netlink: 'syz.4.5803': attribute type 1 has an invalid length. [ 977.533209][T24269] bond3: entered promiscuous mode [ 977.535384][T24269] 8021q: adding VLAN 0 to HW filter on device bond3 [ 977.560832][T24269] 8021q: adding VLAN 0 to HW filter on device bond3 [ 977.563277][T24269] bond3: (slave ipip0): The slave device specified does not support setting the MAC address [ 977.566632][T24269] bond3: (slave ipip0): Setting fail_over_mac to active for active-backup mode [ 977.575213][T24269] bond3: (slave ipip0): making interface the new active one [ 977.577851][T24269] ipip0: entered promiscuous mode [ 977.580612][T24269] bond3: (slave ipip0): Enslaving as an active interface with an up link [ 977.671143][T24286] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5810'. [ 977.780260][T24292] netlink: 592 bytes leftover after parsing attributes in process `syz.3.5813'. [ 977.958189][T24306] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5820'. [ 977.981135][T24306] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5820'. [ 978.009611][T24306] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5820'. [ 978.056550][T24313] netlink: 592 bytes leftover after parsing attributes in process `syz.4.5824'. [ 978.124517][T24322] netlink: 'syz.4.5827': attribute type 1 has an invalid length. [ 978.151742][T24322] bond4: entered promiscuous mode [ 978.153784][T24322] 8021q: adding VLAN 0 to HW filter on device bond4 [ 978.174384][T24322] 8021q: adding VLAN 0 to HW filter on device bond4 [ 978.179089][T24322] bond4: (slave ipip1): The slave device specified does not support setting the MAC address [ 978.184316][T24322] bond4: (slave ipip1): Setting fail_over_mac to active for active-backup mode [ 978.204847][T24322] bond4: (slave ipip1): making interface the new active one [ 978.208505][T24322] ipip1: entered promiscuous mode [ 978.212023][T24322] bond4: (slave ipip1): Enslaving as an active interface with an up link [ 978.410176][T24353] syzkaller0: entered promiscuous mode [ 978.412553][T24353] syzkaller0: entered allmulticast mode [ 978.413726][T24355] netlink: 'syz.4.5841': attribute type 1 has an invalid length. [ 978.431401][T24355] bond5: entered promiscuous mode [ 978.433456][T24355] 8021q: adding VLAN 0 to HW filter on device bond5 [ 978.467599][T24355] 8021q: adding VLAN 0 to HW filter on device bond5 [ 978.470118][T24355] bond5: (slave ipip2): The slave device specified does not support setting the MAC address [ 978.473419][T24355] bond5: (slave ipip2): Setting fail_over_mac to active for active-backup mode [ 978.480582][T24355] bond5: (slave ipip2): making interface the new active one [ 978.483040][T24355] ipip2: entered promiscuous mode [ 978.485717][T24355] bond5: (slave ipip2): Enslaving as an active interface with an up link [ 978.703090][T24379] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 978.730851][T24381] netlink: 'syz.0.5853': attribute type 7 has an invalid length. [ 978.733360][T24381] netlink: 'syz.0.5853': attribute type 8 has an invalid length. [ 978.976674][T24402] netlink: 'syz.4.5863': attribute type 7 has an invalid length. [ 978.980770][T24402] netlink: 'syz.4.5863': attribute type 8 has an invalid length. [ 979.066468][T24408] syzkaller0: entered promiscuous mode [ 979.069044][T24408] syzkaller0: entered allmulticast mode [ 979.170714][ T5089] Bluetooth: hci4: command tx timeout [ 979.271012][T24431] netlink: 'syz.2.5873': attribute type 7 has an invalid length. [ 979.274368][T24431] netlink: 'syz.2.5873': attribute type 8 has an invalid length. [ 979.654080][T24478] 8021q: adding VLAN 0 to HW filter on device bond1 [ 979.688108][T24481] bond4: entered promiscuous mode [ 979.690374][T24481] 8021q: adding VLAN 0 to HW filter on device bond4 [ 979.703432][T24478] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 979.710149][T24478] dummy0: entered promiscuous mode [ 979.713986][T24478] bond1: (slave dummy0): Releasing backup interface [ 979.844656][T24498] syzkaller0: entered promiscuous mode [ 979.849085][T24498] syzkaller0: entered allmulticast mode [ 980.203506][T24536] syzkaller0: entered promiscuous mode [ 980.205401][T24536] syzkaller0: entered allmulticast mode [ 981.219261][T24622] __nla_validate_parse: 15 callbacks suppressed [ 981.219282][T24622] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5949'. [ 981.225725][T24622] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5949'. [ 981.445631][T24643] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5959'. [ 981.449406][T24643] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5959'. [ 981.624302][T24662] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5968'. [ 981.628343][T24662] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5968'. [ 981.631000][T24660] bond3: entered promiscuous mode [ 981.634106][T24660] 8021q: adding VLAN 0 to HW filter on device bond3 [ 981.762267][T24680] netlink: 140 bytes leftover after parsing attributes in process `syz.0.5976'. [ 981.846907][T24687] validate_nla: 3 callbacks suppressed [ 981.846926][T24687] netlink: 'syz.0.5978': attribute type 1 has an invalid length. [ 981.891941][T24687] bond2: entered promiscuous mode [ 981.894180][T24687] 8021q: adding VLAN 0 to HW filter on device bond2 [ 982.302347][T24718] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5992'. [ 982.320700][T24718] macsec1: entered promiscuous mode [ 982.322972][T24718] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 982.326503][T24718] macsec1: entered allmulticast mode [ 982.330671][T24718] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 982.337760][T24718] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 983.352479][T24797] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6022'. [ 983.448001][T24805] netlink: 'syz.4.6026': attribute type 1 has an invalid length. [ 983.463532][T24805] bond6: entered promiscuous mode [ 983.465572][T24805] 8021q: adding VLAN 0 to HW filter on device bond6 [ 983.609492][T24818] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6032'. [ 983.725315][T24828] syzkaller0: entered promiscuous mode [ 983.727160][T24828] syzkaller0: entered allmulticast mode [ 983.844984][T24842] syzkaller0: entered promiscuous mode [ 983.846694][T24842] syzkaller0: entered allmulticast mode [ 983.991544][T24858] netlink: 'syz.2.6048': attribute type 1 has an invalid length. [ 984.004093][T24858] bond4: entered promiscuous mode [ 984.006115][T24858] 8021q: adding VLAN 0 to HW filter on device bond4 [ 986.710944][T24894] syzkaller0: entered promiscuous mode [ 986.713233][T24894] syzkaller0: entered allmulticast mode [ 986.782924][T24905] __nla_validate_parse: 1 callbacks suppressed [ 986.782937][T24905] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6061'. [ 986.828160][T24909] openvswitch: netlink: Message has 1 unknown bytes. [ 986.831050][T24909] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 987.010671][T24930] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6071'. [ 989.927849][T24969] netlink: 112 bytes leftover after parsing attributes in process `syz.0.6080'. [ 989.986682][T24959] virt_wifi0 speed is unknown, defaulting to 1000 [ 990.076520][T24975] syzkaller0: entered promiscuous mode [ 990.078459][T24975] syzkaller0: entered allmulticast mode [ 990.803798][T24992] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6088'. [ 990.874099][T24996] netlink: 112 bytes leftover after parsing attributes in process `syz.4.6089'. [ 992.838997][T25022] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6094'. [ 992.982851][T25034] netlink: 112 bytes leftover after parsing attributes in process `syz.3.6100'. [ 993.087509][T25046] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6105'. [ 993.313934][T25076] syzkaller0: entered promiscuous mode [ 993.315883][T25076] syzkaller0: entered allmulticast mode [ 993.336970][T25080] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6119'. [ 993.497139][T25092] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6125'. [ 993.655306][T25107] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 993.660260][T25107] syzkaller0: entered promiscuous mode [ 993.662707][T25107] syzkaller0: entered allmulticast mode [ 993.689565][T25114] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6136'. [ 993.800481][ T5089] Bluetooth: hci4: link tx timeout [ 993.802832][ T5089] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 994.038466][T25142] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 994.042924][T25142] syzkaller0: entered promiscuous mode [ 994.045296][T25142] syzkaller0: entered allmulticast mode [ 994.160156][ T5751] Bluetooth: hci4: link tx timeout [ 994.162303][ T5751] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 994.409090][T25166] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6154'. [ 994.554615][ T5751] Bluetooth: hci4: link tx timeout [ 994.556353][ T5751] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 994.560869][T25179] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 994.564377][T25179] syzkaller0: entered promiscuous mode [ 994.571604][T25179] syzkaller0: entered allmulticast mode [ 994.870288][ T5751] Bluetooth: hci4: link tx timeout [ 994.872546][ T5751] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 994.964154][T25202] netlink: 'syz.0.6173': attribute type 12 has an invalid length. [ 994.967758][T25202] netlink: 'syz.0.6173': attribute type 29 has an invalid length. [ 994.971035][T25202] netlink: 148 bytes leftover after parsing attributes in process `syz.0.6173'. [ 995.156389][T25210] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input40 [ 995.241656][ T5751] Bluetooth: hci4: link tx timeout [ 995.249759][ T5751] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 995.475131][T25241] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6185'. [ 995.888213][ T5751] Bluetooth: hci4: command 0x0406 tx timeout [ 996.699868][ T1637] block nbd0: Possible stuck request ffff888027ee4440: control (read@0,1024B). Runtime 60 seconds [ 996.704592][ T1637] block nbd0: Possible stuck request ffff888027ee4600: control (read@1024,3072B). Runtime 60 seconds [ 997.293466][T25308] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6214'. [ 997.834296][T25324] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 997.962420][T25328] __nla_validate_parse: 1 callbacks suppressed [ 997.962443][T25328] netlink: 112 bytes leftover after parsing attributes in process `syz.2.6223'. [ 998.340520][T25349] netlink: 112 bytes leftover after parsing attributes in process `syz.3.6232'. [ 999.103672][T25358] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6233'. [ 1000.826931][T25369] netlink: 96 bytes leftover after parsing attributes in process `syz.2.6235'. [ 1001.495472][T25390] netlink: 112 bytes leftover after parsing attributes in process `syz.2.6245'. [ 1001.533213][T25395] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6247'. [ 1001.783268][ T9137] IPVS: starting estimator thread 0... [ 1001.838792][T25413] netlink: 112 bytes leftover after parsing attributes in process `syz.2.6255'. [ 1001.877213][T25411] IPVS: using max 24 ests per chain, 57600 per kthread [ 1002.202508][T25441] netlink: 'syz.4.6266': attribute type 1 has an invalid length. [ 1002.218300][T25441] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1002.240862][T25441] bond7: (slave gretap1): making interface the new active one [ 1002.245801][T25441] bond7: (slave gretap1): Enslaving as an active interface with an up link [ 1002.271831][T25441] bond1: (slave dummy0): Releasing active interface [ 1002.274574][T25441] dummy0: left promiscuous mode [ 1002.276286][T25441] dummy0: left allmulticast mode [ 1002.284928][T25441] bond7: (slave dummy0): Enslaving as an active interface with an up link [ 1002.289528][T25441] netlink: 'syz.4.6266': attribute type 10 has an invalid length. [ 1002.291947][T25441] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6266'. [ 1002.294729][T25441] dummy0: entered promiscuous mode [ 1002.299275][T25441] bond7: (slave dummy0): Releasing active interface [ 1002.520741][T25450] bridge0: port 2(bridge_slave_1) entered disabled state [ 1002.524154][T25450] bridge0: port 1(bridge_slave_0) entered disabled state [ 1002.583254][T25450] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1002.591616][T25450] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1002.616545][T25450] tipc: Resetting bearer [ 1002.620858][T25450] tipc: Resetting bearer [ 1002.715710][T25450] bond1: left allmulticast mode [ 1002.719819][T25450] ip6gre1: left allmulticast mode [ 1002.767419][ T14] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1002.772209][ T14] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1002.776890][ T14] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1002.780012][ T14] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1002.829903][T25481] syzkaller0: entered promiscuous mode [ 1002.832175][T25481] syzkaller0: entered allmulticast mode [ 1002.872503][T25487] netlink: 112 bytes leftover after parsing attributes in process `syz.2.6281'. [ 1003.099121][ T1482] block nbd3: Possible stuck request ffff888027fd8dc0: control (read@0,4096B). Runtime 60 seconds [ 1004.375840][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 1005.837772][ T5140] udevd[5140]: worker [13702] /devices/virtual/block/nbd0 is taking a long time [ 1005.847385][ T5140] udevd[5140]: worker [13704] /devices/virtual/block/nbd3 is taking a long time [ 1005.946975][T25518] netlink: 112 bytes leftover after parsing attributes in process `syz.0.6292'. [ 1006.096803][T25535] syzkaller0: entered promiscuous mode [ 1006.099628][T25535] syzkaller0: entered allmulticast mode [ 1007.806690][T25562] netlink: 112 bytes leftover after parsing attributes in process `syz.3.6301'. [ 1009.233755][T25581] netlink: 'syz.4.6310': attribute type 1 has an invalid length. [ 1009.295047][T25581] veth3: entered allmulticast mode [ 1009.301865][T25581] bond8: (slave veth3): Enslaving as an active interface with a down link [ 1009.331845][T25581] bond8: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 1009.344498][T25581] macvlan2: entered promiscuous mode [ 1009.346396][T25581] macvlan2: entered allmulticast mode [ 1009.349023][T25581] bond8: entered promiscuous mode [ 1009.355755][T25581] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1009.359564][T25581] bond8: left promiscuous mode [ 1010.729283][T25636] netlink: 112 bytes leftover after parsing attributes in process `syz.0.6335'. [ 1010.975703][T25653] syzkaller0: entered promiscuous mode [ 1010.978183][T25653] syzkaller0: entered allmulticast mode [ 1011.116375][T25663] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6348'. [ 1011.371193][T25680] syzkaller0: entered promiscuous mode [ 1011.379357][T25680] syzkaller0: entered allmulticast mode [ 1012.404286][T25726] netlink: 'syz.3.6375': attribute type 1 has an invalid length. [ 1012.501148][T25737] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6379'. [ 1012.530621][T25740] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 1012.979837][T25767] netlink: 'syz.3.6388': attribute type 1 has an invalid length. [ 1013.633271][T25813] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1013.944133][T25829] syzkaller0: entered promiscuous mode [ 1013.946677][T25829] syzkaller0: entered allmulticast mode [ 1013.958463][T25829] tipc: Started in network mode [ 1013.961025][T25829] tipc: Node identity a6317c02efd6, cluster identity 4711 [ 1013.964937][T25829] tipc: Enabled bearer , priority 0 [ 1013.973503][T25829] tipc: Resetting bearer [ 1013.980955][T25828] tipc: Resetting bearer [ 1014.003069][T25828] tipc: Disabling bearer [ 1014.020320][T25833] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6415'. [ 1014.302970][T25849] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6423'. [ 1014.458559][T25863] syzkaller0: entered promiscuous mode [ 1014.460656][T25863] syzkaller0: entered allmulticast mode [ 1014.660879][T25879] netlink: 'syz.2.6436': attribute type 2 has an invalid length. [ 1014.663489][T25879] netlink: 'syz.2.6436': attribute type 2 has an invalid length. [ 1018.374280][T25939] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6454'. [ 1018.665896][T25948] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6459'. [ 1018.669881][T25948] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6459'. [ 1019.083865][T25988] jffs2: notice: (25988) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1019.166153][T25995] jffs2: notice: (25995) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1019.390619][T26014] jffs2: notice: (26014) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1020.158939][T26035] netlink: 'syz.3.6496': attribute type 1 has an invalid length. [ 1020.260958][T26042] jffs2: notice: (26042) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1020.486180][T26057] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6503'. [ 1020.584666][ T44] audit: type=1800 audit(1786156667.541:53): pid=26067 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.6507" name="serialnumber" dev="configfs" ino=99062 res=0 errno=0 [ 1020.815632][T26093] netlink: 'syz.0.6516': attribute type 1 has an invalid length. [ 1020.923191][T26107] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6519'. [ 1021.118512][T26115] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6522'. [ 1021.124137][T26115] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6522'. [ 1021.729241][T26169] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6540'. [ 1021.815359][T26177] 9p: Could not find request transport: u [ 1022.048999][T26204] ================================================================== [ 1022.052293][T26204] BUG: KASAN: global-out-of-bounds in usb_copy_descriptors+0x18d/0x320 [ 1022.055709][T26204] Read of size 32 at addr ffffffff9ba2eb60 by task syz.0.6557/26204 [ 1022.060091][T26204] [ 1022.061833][T26204] CPU: 1 UID: 0 PID: 26204 Comm: syz.0.6557 Not tainted syzkaller #0 PREEMPT(full) [ 1022.061863][T26204] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1022.061876][T26204] Call Trace: [ 1022.061885][T26204] [ 1022.061894][T26204] dump_stack_lvl+0x100/0x190 [ 1022.061924][T26204] print_report+0x13d/0x4b0 [ 1022.061954][T26204] ? __virt_addr_valid+0x239/0x430 [ 1022.061995][T26204] ? usb_copy_descriptors+0x18d/0x320 [ 1022.062024][T26204] kasan_report+0xdf/0x1c0 [ 1022.062052][T26204] ? usb_copy_descriptors+0x18d/0x320 [ 1022.062081][T26204] kasan_check_range+0x10f/0x1e0 [ 1022.062097][T26204] __asan_memcpy+0x23/0x60 [ 1022.062115][T26204] usb_copy_descriptors+0x18d/0x320 [ 1022.062139][T26204] usb_assign_descriptors+0xd2/0x470 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1022.062164][T26204] f_audio_bind+0x243a/0x3950 [ 1022.062200][T26204] ? __pfx_f_audio_bind+0x10/0x10 [ 1022.062218][T26204] usb_add_function+0x219/0x890 [ 1022.062245][T26204] configfs_composite_bind+0xd83/0x1960 [ 1022.062282][T26204] gadget_bind_driver+0x28c/0xbf0 [ 1022.062304][T26204] ? __pfx_gadget_bind_driver+0x10/0x10 [ 1022.062327][T26204] really_probe+0x241/0xa60 [ 1022.062409][T26204] __driver_probe_device+0x20e/0x450 [ 1022.062437][T26204] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1022.062477][T26204] driver_probe_device+0x4a/0x140 [ 1022.062500][T26204] __driver_attach+0x21f/0x5b0 [ 1022.062522][T26204] ? __pfx___driver_attach+0x10/0x10 [ 1022.062543][T26204] bus_for_each_dev+0x13e/0x1d0 [ 1022.062562][T26204] ? __pfx_bus_for_each_dev+0x10/0x10 [ 1022.062579][T26204] ? bus_add_driver+0x2b5/0x5b0 [ 1022.062601][T26204] bus_add_driver+0x305/0x5b0 [ 1022.062621][T26204] driver_register+0x1e2/0x360 [ 1022.062646][T26204] usb_gadget_register_driver_owner+0x132/0x210 [ 1022.062669][T26204] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 1022.062697][T26204] configfs_write_iter+0x302/0x4e0 [ 1022.062732][T26204] vfs_write+0x6ac/0x1050 [ 1022.062761][T26204] ? __pfx_configfs_write_iter+0x10/0x10 [ 1022.062784][T26204] ? __pfx_vfs_write+0x10/0x10 [ 1022.062802][T26204] ? find_held_lock+0x2b/0x80 [ 1022.062833][T26204] ksys_write+0x12a/0x250 [ 1022.062852][T26204] ? __pfx_ksys_write+0x10/0x10 [ 1022.062871][T26204] __do_fast_syscall_32+0xe7/0x970 [ 1022.062903][T26204] do_fast_syscall_32+0x32/0x70 [ 1022.062926][T26204] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1022.062951][T26204] RIP: 0023:0xf7f37fec [ 1022.062972][T26204] Code: Unable to access opcode bytes at 0xf7f37fc2. [ 1022.062983][T26204] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 1022.063005][T26204] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080002100 [ 1022.063020][T26204] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 1022.063033][T26204] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1022.063045][T26204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1022.063055][T26204] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1022.063072][T26204] [ 1022.063078][T26204] [ 1022.086327][T26210] jffs2: notice: (26210) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1022.087337][T26204] The buggy address belongs to the variable: [ 1022.087349][T26204] ac_header_desc+0x0/0x40 [ 1022.190464][T26204] [ 1022.191451][T26204] The buggy address belongs to the physical page: [ 1022.193996][T26204] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ba2e [ 1022.197517][T26204] flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff) [ 1022.200697][T26204] raw: 00fff00000002000 ffffea00006e8b88 ffffea00006e8b88 0000000000000000 [ 1022.204084][T26204] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1022.207545][T26204] page dumped because: kasan: bad access detected [ 1022.210099][T26204] page_owner info is not present (never set?) [ 1022.212541][T26204] [ 1022.213535][T26204] Memory state around the buggy address: [ 1022.215849][T26204] ffffffff9ba2ea00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1022.219009][T26204] ffffffff9ba2ea80: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9 [ 1022.222206][T26204] >ffffffff9ba2eb00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 [ 1022.225423][T26204] ^ [ 1022.228413][T26204] ffffffff9ba2eb80: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 [ 1022.231546][T26204] ffffffff9ba2ec00: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 [ 1022.234708][T26204] ================================================================== [ 1022.247177][T26204] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1022.249515][T26204] CPU: 0 UID: 0 PID: 26204 Comm: syz.0.6557 Not tainted syzkaller #0 PREEMPT(full) [ 1022.252457][T26204] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1022.256100][T26204] Call Trace: [ 1022.257228][T26204] [ 1022.258246][T26204] dump_stack_lvl+0x100/0x190 [ 1022.259742][T26204] vpanic+0x552/0x970 [ 1022.261046][T26204] ? __pfx_vpanic+0x10/0x10 [ 1022.262493][T26204] ? mark_held_locks+0x40/0x70 [ 1022.264059][T26204] ? usb_copy_descriptors+0x18d/0x320 [ 1022.265813][T26204] panic+0xd1/0xe0 [ 1022.267300][T26204] ? __pfx_panic+0x10/0x10 [ 1022.268778][T26204] ? usb_copy_descriptors+0x18d/0x320 [ 1022.270523][T26204] ? preempt_schedule_common+0x42/0xc0 [ 1022.272250][T26204] check_panic_on_warn.cold+0x19/0x34 [ 1022.273981][T26204] end_report.part.0+0x3a/0x90 [ 1022.275543][T26204] kasan_report.cold+0xe/0x18 [ 1022.277037][T26204] ? usb_copy_descriptors+0x18d/0x320 [ 1022.278771][T26204] kasan_check_range+0x10f/0x1e0 [ 1022.280366][T26204] __asan_memcpy+0x23/0x60 [ 1022.281956][T26204] usb_copy_descriptors+0x18d/0x320 [ 1022.283867][T26204] usb_assign_descriptors+0xd2/0x470 [ 1022.285580][T26204] f_audio_bind+0x243a/0x3950 [ 1022.287592][T26204] ? __pfx_f_audio_bind+0x10/0x10 [ 1022.289366][T26204] usb_add_function+0x219/0x890 [ 1022.291008][T26204] configfs_composite_bind+0xd83/0x1960 [ 1022.292855][T26204] gadget_bind_driver+0x28c/0xbf0 [ 1022.294503][T26204] ? __pfx_gadget_bind_driver+0x10/0x10 [ 1022.296372][T26204] really_probe+0x241/0xa60 [ 1022.298018][T26204] __driver_probe_device+0x20e/0x450 [ 1022.299780][T26204] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1022.301767][T26204] driver_probe_device+0x4a/0x140 [ 1022.303387][T26204] __driver_attach+0x21f/0x5b0 [ 1022.304974][T26204] ? __pfx___driver_attach+0x10/0x10 [ 1022.306734][T26204] bus_for_each_dev+0x13e/0x1d0 [ 1022.308139][T26204] ? __pfx_bus_for_each_dev+0x10/0x10 [ 1022.309877][T26204] ? bus_add_driver+0x2b5/0x5b0 [ 1022.311516][T26204] bus_add_driver+0x305/0x5b0 [ 1022.313083][T26204] driver_register+0x1e2/0x360 [ 1022.314575][T26204] usb_gadget_register_driver_owner+0x132/0x210 [ 1022.316603][T26204] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 1022.318484][T26204] configfs_write_iter+0x302/0x4e0 [ 1022.320156][T26204] vfs_write+0x6ac/0x1050 [ 1022.321578][T26204] ? __pfx_configfs_write_iter+0x10/0x10 [ 1022.323486][T26204] ? __pfx_vfs_write+0x10/0x10 [ 1022.325061][T26204] ? find_held_lock+0x2b/0x80 [ 1022.326725][T26204] ksys_write+0x12a/0x250 [ 1022.328145][T26204] ? __pfx_ksys_write+0x10/0x10 [ 1022.329725][T26204] __do_fast_syscall_32+0xe7/0x970 [ 1022.331455][T26204] do_fast_syscall_32+0x32/0x70 [ 1022.333112][T26204] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1022.335259][T26204] RIP: 0023:0xf7f37fec [ 1022.336831][T26204] Code: Unable to access opcode bytes at 0xf7f37fc2. [ 1022.339199][T26204] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 1022.342177][T26204] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080002100 [ 1022.344866][T26204] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 1022.347375][T26204] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1022.350095][T26204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1022.352804][T26204] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1022.355400][T26204] [ 1022.357117][T26204] Kernel Offset: disabled [ 1022.358559][T26204] Rebooting in 86400 seconds.. VM DIAGNOSIS: 02:37:49 Registers: info registers vcpu 0 CPU#0 RAX=dffffc0000000000 RBX=ffffc9000042f830 RCX=ffffffff91c582c4 RDX=1ffff92000085f08 RSI=ffffc9000042fe30 RDI=ffffc9000042f840 RBP=ffffc9000042fe30 RSP=ffffc9000042f790 R8 =0000000000000001 R9 =0000000000000007 R10=0000000000000200 R11=000000000000d347 R12=0000000000000008 R13=ffffc90000428000 R14=ffffc9000042fe60 R15=ffffc9000042f864 RIP=ffffffff81b81196 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096bf3000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000000000000 CR3=0000000050c3e000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=dffffc0000000060 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd RSI=ffffffff85a0deb0 RDI=ffffffff9b9e3520 RBP=ffffffff9b9e34e0 RSP=ffffc9000c9bf140 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=3966666666666652 R12=0000000000000000 R13=0000000000000020 R14=fffffbfff373c6f6 R15=dffffc0000000000 RIP=ffffffff85a0ded7 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096cf3000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000080002000 CR3=0000000078b46000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000002 RBX=ffffea0001e4d6c0 RCX=1ffffffff2243d70 RDX=0000000000000000 RSI=0000000000000003 RDI=ffff88807ffd69b8 RBP=ffffffff9464e6c3 RSP=ffffc90004cbf388 R8 =0000000000000001 R9 =fffffbfff22436fa R10=ffffffff9121b7d7 R11=0000000000000000 R12=0000000000000001 R13=0000000000000003 R14=ffff88807ffd6940 R15=ffffffff9464e6c0 RIP=ffffffff82553f1f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007fc689b44300 ffffffff 00c00000 GS =0000 ffff888096df3000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000556ec52c1000 CR3=000000004dce3000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000fcffc200 Opmask01=000000000000ffff Opmask02=00000000ffffffff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000001 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000003bf12 0000002c00000012 0004000000080024 0000000000280030 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000019a4 0000001400000000 0000000000000000 0000000000000015 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2f7665642f01ffff ffffffffffffe508 0980032200001280 0000001000000001 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 8003000800060800 200800060474ce01 0000020806020103 e80004000008000f ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffff0201c708 0008024eaa018002 0880a2d394080001 000000080606012a ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 9203c482040001a0 0300000000000030 72656c6c616b7a79 7301ffffffffffff ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffdf0801800300 0400000800098002 01c7080008004eaa 006e75742f74656e ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2e01ffffffffffff fffff30808800300 306b636f6c626474 6d2f7665642f2e01 ZMM25=b16130f8b16130f8 b16130f8b16130f8 b16130f8b16130f8 b16130f8b16130f8 b16130f8b16130f8 b16130f8b16130f8 b16130f8b16130f8 b16130f8b16130f8 ZMM26=19bb489319bb4893 19bb489319bb4893 19bb489319bb4893 19bb489319bb4893 19bb489319bb4893 19bb489319bb4893 19bb489319bb4893 19bb489319bb4893 ZMM27=1b0d69281b0d6928 1b0d69281b0d6928 1b0d69281b0d6928 1b0d69281b0d6928 1b0d69281b0d6928 1b0d69281b0d6928 1b0d69281b0d6928 1b0d69281b0d6928 ZMM28=000000500000004f 0000004e0000004d 0000004c0000004b 0000004a00000049 0000004800000047 0000004600000045 0000004400000043 0000004200000041 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=ed290000ed290000 ed290000ed290000 ed290000ed290000 ed290000ed290000 ed290000ed290000 ed290000ed290000 ed290000ed290000 ed290000ed290000 info registers vcpu 3 CPU#3 RAX=0000000000c26c69 RBX=ffff88801c7f8000 RCX=ffffffff8bb81335 RDX=0000000000000000 RSI=ffffffff8e1a2693 RDI=ffffffff8c3fe580 RBP=ffffed10038ff000 RSP=ffffc9000049fe00 R8 =0000000000000001 R9 =ffffed10056a678d R10=ffff88802b533c6b R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffff92000093fc4 R15=dffffc0000000000 RIP=ffffffff8bb7f8ff RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096ef3000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000000c3e0cb3 CR3=0000000074e4d000 CR4=00352ef0 DR0=ffffffffffffffff DR1=00000000000001f8 DR2=0000000000000083 DR3=ffffffffefffff15 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000