last executing test programs: 10m54.986944069s ago: executing program 1 (id=287): socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket(0x2, 0x80805, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) msgctl$MSG_STAT(0x0, 0xb, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$dri(0x0, 0xd21, 0x4000) r1 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x41, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0xc1}, 0x0) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000040)={0x80}) socket$nl_generic(0x10, 0x3, 0x10) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x1, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, {0x0, 0x4, 0x9, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}]}) r5 = msgget$private(0x0, 0x4a0) msgsnd(r5, 0x0, 0xe3, 0x0) set_mempolicy(0x3, &(0x7f0000000000)=0x4000000ffb, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x0, 0x0, &(0x7f0000000040)='GPL\x00'}, 0x94) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0xf, 0x3, 0xffffffffffffffff, 0x1000000000000002, 0x102000000000002, 0x8000000d, 0x2004c8, 0xffff, 0x3, 0xffffffffffff0000, 0x10003, 0x7fffffffffffffff, 0xd0b, 0xfffffffffffffff9, 0x2000000000000002, 0x5], 0x80a0000, 0x80284}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 10m54.004678192s ago: executing program 1 (id=289): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) r1 = dup(r0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 10m52.650213341s ago: executing program 1 (id=293): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f00000036c0)=[{{&(0x7f0000000180)={0xa, 0x4e22, 0x2, @private1, 0xfffffff8}, 0x1c, 0x0}}], 0x1, 0x4040044) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, 0x0, &(0x7f0000000180)) 10m52.649920665s ago: executing program 1 (id=294): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x20341, 0x0) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) (rerun: 64) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/kvm/kvm_hv_stimer_cleanup/enable\x00', 0x8200, 0x0) write(r1, &(0x7f0000000400), 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/events/kvm/kvm_hv_stimer_cleanup/trigger\x00', 0x1, 0x0) write(r2, &(0x7f0000000600)='stacktrace', 0xa) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000140)={'dvmrp1\x00', 0x1}) (async) ioctl$TUNSETOFFLOAD(r3, 0x400454d0, 0xa930bb9f3fd061f5) (async) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000240)) (async) ioctl$TCSETSF2(r0, 0x402c542d, 0x0) (async) r4 = dup(0xffffffffffffffff) read$FUSE(r4, 0x0, 0x0) (async) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0xc100) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x4010640d, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x4000000145802, 0x0) syz_open_dev$usbfs(0x0, 0x76, 0x103381) (async, rerun: 64) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$cont(0x21, r7, 0x8, 0xffff) (async) r8 = dup(r6) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r8, 0xc1105517, &(0x7f0000000480)={{0x6, 0x6, 0x4a7, 0x6, 'syz0\x00', 0x6}, 0x5, 0x3, 0xb4, r7, 0x6, 0x3, 'syz1\x00', &(0x7f0000000340)=['\x00z\x05c\xeap\xeb\x029\xf4\xfd\tocQ;\xfa\xf4\x19\xe2\xdd@NTg\xe8\xd1\xa4\xcf<*\xd8\x98Q>\x97Q*7\xaa\xb9\xee\x95\x96\xbf\f\"\xbdE%\xed\xe6\xb8\x05\x80\x9d\xb2\x87n\xd5\xd8\x10\xcc<\xb1\x19\xce\xe0;\x85\x06\xa9(\xa1\a\xd1\xe3\r\xaa\f\xca#\x93+\xd7~\x9fI\x82h\xcb\xd6\x9a\xd3\x12\xfd\xfb/@\xd3\b\xdf\xc0\xe4ry\x81\xfdX\xa2\xa4\xa3})\x7f\xf3\'\xd3PeY\xd8Zp', '^\x00', '-\x00', ':]))', '\x00\x00\x01\x00\x00\x00\x00\x00\x00', ':]))'], 0x91}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r8, 0x2000) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) write$binfmt_aout(r8, 0x0, 0xffffffdb) (async) setpriority(0x2, 0x0, 0x7) (async) socket$pppoe(0x18, 0x1, 0x0) 10m52.113469254s ago: executing program 1 (id=295): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x4c}}, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPSET_CMD_LIST(r0, 0x0, 0x48810) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100001ddf8208c00712152230000000010902"], 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000e306000000000000000000000085000000200000009500000000000000"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) 10m51.460233006s ago: executing program 1 (id=300): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount$9p_xen(&(0x7f0000000000), &(0x7f00000002c0)='./sys/bus/pci/devices/0000:00:03.0/driver\x00', &(0x7f0000000300), 0x202001c, &(0x7f0000000340)={'trans=xen,', {[{@access_any}], [{@dont_hash}]}}) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0), 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000500)={'syztnl2\x00', &(0x7f00000003c0)={'ip_vti0\x00', 0x0, 0x8, 0x80, 0x8, 0x7fff, {{0x3b, 0x4, 0x1, 0x0, 0xec, 0x68, 0x0, 0x3, 0x4, 0x0, @loopback, @remote, {[@noop, @cipso={0x86, 0x2f, 0x3, [{0x7, 0xb, "42c017ebaced9d9308"}, {0x7, 0x2}, {0xd36e2d0f713f458a, 0x8, "ef7bf8fa82c5"}, {0x0, 0x4, "f86e"}, {0x1, 0x10, "cef6bc0ae4884c880c449241fa66"}]}, @timestamp={0x44, 0xc, 0xc9, 0x0, 0x6, [0x7, 0x6]}, @cipso={0x86, 0x9, 0x1, [{0x5, 0x3, 'B'}]}, @ssrr={0x89, 0xf, 0x38, [@broadcast, @local, @local]}, @cipso={0x86, 0x42, 0x3, [{0x6, 0x8, "ed0766da6ea2"}, {0x1, 0xb, "eee9aaa34ac456b1ac"}, {0x7, 0x3, '='}, {0x7, 0x5, "97e18d"}, {0x7, 0x11, "c6e4ede0e9ce98e033641b6aa514b7"}, {0xf85fdd6416cb5eff, 0x7, "d70396b117"}, {0x6, 0x9, "b93ff542c381e8"}]}, @timestamp_addr={0x44, 0x2c, 0xd3, 0x1, 0x7, [{@broadcast, 0x6}, {@loopback, 0x5}, {@private=0xa010100, 0x2}, {@private=0xa010100, 0x3}, {@empty, 0x7}]}, @lsrr={0x83, 0x13, 0xd7, [@multicast2, @rand_addr=0x64010102, @loopback, @empty]}]}}}}}) sendmsg$nl_route_sched_retired(r1, &(0x7f00000012c0)={&(0x7f0000000380), 0xc, &(0x7f0000001280)={&(0x7f0000000540)=@delchain={0xc2c, 0x65, 0x200, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0xd, 0xffe0}, {0x8, 0xd}, {0xe, 0x3}}, [@f_rsvp={{0x9}, {0xb58, 0x2, [@TCA_RSVP_ACT={0x658, 0x6, [@m_skbmod={0x128, 0xa, 0x0, 0x0, {{0xb}, {0x4}, {0xf9, 0x6, "f20805b342a4ccb317d3e033d46c99bccaf71dd2487a6092508ba9138c0c14370cf05c26e3af4d5fd53e243ab0883327de6e9444c5c6976d4d2514856723a90f252771b67966b298fd737f0aa22ae3201b63ae23cc3accb9b7f84316d6b542e3334ce58b04d566a9ce5daee75c7c68c7ef99aea2265a580650cbc6f87263681b9b66212262ba9edcae8170e0848c1c62d54c1cd41061d60b5cfbfc7d02543449d05c73674ae7c8fa1757781e4cc2e592a0074a005ac0e79d1ea27627404dfb24a0b31ff7b3b98609246fa0820a5d0ad26a73e34396a3e96f076176282f80554daed02358e3a94e3a29e459c45083f6218ed4f81b52"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}, @m_connmark={0x1c4, 0x8, 0x0, 0x0, {{0xd}, {0x100, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x8, 0x7, 0x4, 0xc2}, 0xf67}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6d1a394b, 0x52, 0x7, 0x90c5, 0xa3}, 0x400}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0xfffffffd, 0x6, 0x6, 0x4}, 0x8}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x7, 0x9, 0x3, 0x8, 0x8169}, 0x9}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xffffffff, 0x3, 0x4, 0x7fffffff, 0x9}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x3, 0x20000000, 0x3ff, 0x3}, 0x5}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0x5, 0x3, 0x200}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xffffffff, 0x2, 0x10000000, 0x101, 0xe}, 0x9}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4, 0x223, 0x3, 0x4, 0x8}, 0xd33}}]}, {0x97, 0x6, "f09dbdc6d7fa1ef3cfb6d182c789bb87be7e0ef0319a4bf5f9fa16d0cdbde2916b60f499a000cf715bef95caca274b05b5ab51bc2f9e8a0e73088bc1b2c9d6aa059a93bab861c41c9446cb4de63efe850e970e0801f7f5d3da1e783effcb90fae4fec0c3ad86cf6178a4d3686afcf4407c320f20cbbdb60059abdc8e851846c5566f0704ad28970a8f4a9adea30944feba67c7"}, {0xc}, {0xc, 0x8, {0x2}}}}, @m_sample={0x60, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0xfffffff7}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x4, 0x8e52, 0x2, 0x4, 0x7}}]}, {0x14, 0x6, "d34c40526c32ce5d5af2a67cba9a4916"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x138, 0x17, 0x0, 0x0, {{0x8}, {0x58, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @random="cfe2b4bd5022"}, @TCA_IFE_TYPE={0x6, 0x5, 0x3}, @TCA_IFE_TYPE={0x6, 0x5, 0xfe1b}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x3ff, 0x65b, 0x3, 0x2, 0x1000}, 0x1}}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x80000001, 0x401, 0x7, 0x3, 0xa}}}]}, {0xbb, 0x6, "0a6825afb12973c5f53f2be03c418fac60df7d1a225df1ad3e0d4dcb13e56ea3e3bd174ad56b6408e2597eaca1a7132fc31d567a519665729cda0b1da699404f5519286a857c1e7624d10c903687b7093a9d15f9bfe3e3bc79a189272757e2c0b0d548861ceba304e41aa30bc0999dcb6f55949a7acdc20fb0116ff1432735f375fcda8ef80d08f979b80a08771b6d5d9ba5763efa760077a650e81f91463cd00a4ea9a992c748f1c5bcbdeb8b2c4c353d017963a3310c"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_csum={0x1d0, 0xe, 0x0, 0x0, {{0x9}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x8, 0x6, 0x6, 0x3a, 0x7ff}, 0x1}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x8, 0x7, 0x2, 0xfffff794, 0x800}, 0x43}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x81, 0x401, 0xffffffffffffffff, 0x4, 0xc}, 0xd}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x9, 0x0, 0x4, 0xfffff800, 0x2}, 0x25}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0x9, 0x20000001, 0xffff, 0x8}, 0x6a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x3ff, 0x5, 0xfffffffffffffff6, 0x1, 0x7}, 0x24}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x10, 0x7, 0x4, 0xffff}, 0x22}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x7, 0x1, 0x4, 0xac1, 0x8}, 0x5d}}]}, {0xc4, 0x6, "12374303dfb38de52a6a08c1baac9bd7efedee4353a9d497dc04da25e2b59a54586bac589641379dd40eabba9d8605f2133901458608d953e8dc4147329980af1d81356ed3c5fda964ab2415875331c1f39e957f22af060bdf53298eebe82972184eee4b30b5e38a463b23ef847985068633f62c2864b7d69f03dd31f22b70fd051136ece069f9400d73af2cef7a2d265c1edd08995bc57f63b57aad365012967e7132cdca94e07c3224193921c1e74716578fc4b096267f2d883ecfea7294cc"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3}}}}]}, @TCA_RSVP_PINFO={0x20, 0x4, {{0x2, 0xb, 0x83}, {0x3, 0x2, 0xee74}, 0x0, 0x5b, 0x3}}, @TCA_RSVP_ACT={0x4dc, 0x6, [@m_skbedit={0x78, 0x12, 0x0, 0x0, {{0xc}, {0x3c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x4, 0xffff}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xe, 0xfff2}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x1ff}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x9, 0x1}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x4, 0x7fff, 0x8, 0x5, 0x2}}]}, {0x13, 0x6, "a3b53010e88a358db7ca10fa35c16e"}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}, @m_skbmod={0x128, 0x1b, 0x0, 0x0, {{0xb}, {0x64, 0x2, 0x0, 0x1, [@TCA_SKBMOD_SMAC={0xa, 0x4, @remote}, @TCA_SKBMOD_SMAC={0xa, 0x4, @local}, @TCA_SKBMOD_SMAC={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3e}}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0xc}, @TCA_SKBMOD_SMAC={0xa, 0x4, @random="34c19d7b89ea"}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x695}, @TCA_SKBMOD_PARMS={0x20, 0x2, {{0x1, 0x8, 0x6, 0x6, 0x8}, 0xe}}]}, {0x99, 0x6, "0632a31bd3654dfbea4af53c0eabbeeb167c4ca90b8090b66c42c8726a4f6f15b7849f558435de2abbf052e0b35b9ec61d2858b246111f3133553010b892de1bb4026b5593121f377627f54acaeaedb3885309546beafe57980e6d52a3ad2965e784325525552abd0964d16777d4e96390a95242a4c46347959ecddeed5d7738e9d9211bfb423bd29033fcf6adaf81bbca94c8a53a"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ife={0x64, 0xf, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2b}}, @TCA_IFE_SMAC={0xa, 0x4, @local}, @TCA_IFE_TYPE={0x6}]}, {0x1b, 0x6, "686df6be25e80552bdb75f8c90882b48ae25ba21b63c7f"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}, @m_csum={0x110, 0x15, 0x0, 0x0, {{0x9}, {0xac, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x3ff, 0x8000, 0x7, 0xa, 0x7}, 0x50}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xeff1978, 0x8001, 0x5, 0x7, 0x7f}, 0x57}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x5, 0x9, 0xffffffffffffffff, 0x5, 0x8000}, 0x5a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x6, 0x5, 0x5, 0x1}, 0x67}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0x2, 0x8, 0x400, 0x1}, 0x14}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0x80000000, 0x3, 0xffff, 0x3ff}, 0x79}}]}, {0x3a, 0x6, "4430de76af88ab085b23c591d07c37b44ae6894b56abbb0383458ce67cf2bfb135f857d981ca0ffedb436a1f27e52d5a9cc639008ee7"}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}, @m_bpf={0x1c4, 0x3, 0x0, 0x0, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_NAME={0xa, 0x6, './sys\x00'}, @TCA_ACT_BPF_FD={0x8, 0x5, r1}, @TCA_ACT_BPF_NAME={0x27, 0x6, './sys/bus/pci/drivers/pch_udc/bind\x00'}, @TCA_ACT_BPF_NAME={0x37, 0x6, './sys/bus/pci/devices/0000:00:03.0/driver_override\x00'}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0xa}, @TCA_ACT_BPF_NAME={0x2e, 0x6, './sys/bus/pci/devices/0000:00:03.0/driver\x00'}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{0x1ff, 0x6, 0x4}]}]}, {0xe4, 0x6, "7d5edbe0b23833af5646459f3ed3dc36a6b2bbbe2897a61948082abb7585c71c2f221973748163b1dfabf3fea62fa746057482c27d48635a6337d8912364f5214cc7c41af14c8eded168c34d38d6149cf611063336401619481991af031fbd08ef8e31e403f7e262b48b76a3a94fef7596020d92fd61d30418b7f12512e3fb12f0949bc0bbff75ad1edf8378a63b16ce10af84432f14e9facd9df68575f3d282b520e0952ad8301eba9e59fc54ca6fc526f9a1bdda610bd5ac9eb6140d9799df9ceb5c0d4b0c9e57a67c736442e79864387bb8377f1a0c837ec05d277ea7c323"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}, @f_tcindex={{0xc}, {0x98, 0x2, [@TCA_TCINDEX_MASK={0x6, 0x2, 0x1be2}, @TCA_TCINDEX_POLICE={0x54, 0x6, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xfff}, @TCA_POLICE_RESULT={0x8, 0x5, 0xe}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x10000002, 0x1, 0x20f7897b, 0x8, {0x4, 0x0, 0x3, 0x2, 0xce9d, 0x2}, {0x6b, 0x1, 0x7f, 0x6623, 0x101}, 0xbc2, 0x5, 0x3}}]}, @TCA_TCINDEX_POLICE={0x38, 0x6, [@TCA_POLICE_RESULT={0x8, 0x5, 0x6}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x2}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x8}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x500}, @TCA_POLICE_RESULT={0x8, 0x5, 0x8}]}]}}]}, 0xc2c}, 0x1, 0x0, 0x0, 0x400c085}, 0x80) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/pch_udc/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='0000:00:03.0\x00', 0xd) 10m51.363592447s ago: executing program 32 (id=300): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount$9p_xen(&(0x7f0000000000), &(0x7f00000002c0)='./sys/bus/pci/devices/0000:00:03.0/driver\x00', &(0x7f0000000300), 0x202001c, &(0x7f0000000340)={'trans=xen,', {[{@access_any}], [{@dont_hash}]}}) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0), 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000500)={'syztnl2\x00', &(0x7f00000003c0)={'ip_vti0\x00', 0x0, 0x8, 0x80, 0x8, 0x7fff, {{0x3b, 0x4, 0x1, 0x0, 0xec, 0x68, 0x0, 0x3, 0x4, 0x0, @loopback, @remote, {[@noop, @cipso={0x86, 0x2f, 0x3, [{0x7, 0xb, "42c017ebaced9d9308"}, {0x7, 0x2}, {0xd36e2d0f713f458a, 0x8, "ef7bf8fa82c5"}, {0x0, 0x4, "f86e"}, {0x1, 0x10, "cef6bc0ae4884c880c449241fa66"}]}, @timestamp={0x44, 0xc, 0xc9, 0x0, 0x6, [0x7, 0x6]}, @cipso={0x86, 0x9, 0x1, [{0x5, 0x3, 'B'}]}, @ssrr={0x89, 0xf, 0x38, [@broadcast, @local, @local]}, @cipso={0x86, 0x42, 0x3, [{0x6, 0x8, "ed0766da6ea2"}, {0x1, 0xb, "eee9aaa34ac456b1ac"}, {0x7, 0x3, '='}, {0x7, 0x5, "97e18d"}, {0x7, 0x11, "c6e4ede0e9ce98e033641b6aa514b7"}, {0xf85fdd6416cb5eff, 0x7, "d70396b117"}, {0x6, 0x9, "b93ff542c381e8"}]}, @timestamp_addr={0x44, 0x2c, 0xd3, 0x1, 0x7, [{@broadcast, 0x6}, {@loopback, 0x5}, {@private=0xa010100, 0x2}, {@private=0xa010100, 0x3}, {@empty, 0x7}]}, @lsrr={0x83, 0x13, 0xd7, [@multicast2, @rand_addr=0x64010102, @loopback, @empty]}]}}}}}) sendmsg$nl_route_sched_retired(r1, &(0x7f00000012c0)={&(0x7f0000000380), 0xc, &(0x7f0000001280)={&(0x7f0000000540)=@delchain={0xc2c, 0x65, 0x200, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0xd, 0xffe0}, {0x8, 0xd}, {0xe, 0x3}}, [@f_rsvp={{0x9}, {0xb58, 0x2, [@TCA_RSVP_ACT={0x658, 0x6, [@m_skbmod={0x128, 0xa, 0x0, 0x0, {{0xb}, {0x4}, {0xf9, 0x6, "f20805b342a4ccb317d3e033d46c99bccaf71dd2487a6092508ba9138c0c14370cf05c26e3af4d5fd53e243ab0883327de6e9444c5c6976d4d2514856723a90f252771b67966b298fd737f0aa22ae3201b63ae23cc3accb9b7f84316d6b542e3334ce58b04d566a9ce5daee75c7c68c7ef99aea2265a580650cbc6f87263681b9b66212262ba9edcae8170e0848c1c62d54c1cd41061d60b5cfbfc7d02543449d05c73674ae7c8fa1757781e4cc2e592a0074a005ac0e79d1ea27627404dfb24a0b31ff7b3b98609246fa0820a5d0ad26a73e34396a3e96f076176282f80554daed02358e3a94e3a29e459c45083f6218ed4f81b52"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}, @m_connmark={0x1c4, 0x8, 0x0, 0x0, {{0xd}, {0x100, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x8, 0x7, 0x4, 0xc2}, 0xf67}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6d1a394b, 0x52, 0x7, 0x90c5, 0xa3}, 0x400}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0xfffffffd, 0x6, 0x6, 0x4}, 0x8}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x7, 0x9, 0x3, 0x8, 0x8169}, 0x9}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xffffffff, 0x3, 0x4, 0x7fffffff, 0x9}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x3, 0x20000000, 0x3ff, 0x3}, 0x5}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0x5, 0x3, 0x200}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xffffffff, 0x2, 0x10000000, 0x101, 0xe}, 0x9}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4, 0x223, 0x3, 0x4, 0x8}, 0xd33}}]}, {0x97, 0x6, "f09dbdc6d7fa1ef3cfb6d182c789bb87be7e0ef0319a4bf5f9fa16d0cdbde2916b60f499a000cf715bef95caca274b05b5ab51bc2f9e8a0e73088bc1b2c9d6aa059a93bab861c41c9446cb4de63efe850e970e0801f7f5d3da1e783effcb90fae4fec0c3ad86cf6178a4d3686afcf4407c320f20cbbdb60059abdc8e851846c5566f0704ad28970a8f4a9adea30944feba67c7"}, {0xc}, {0xc, 0x8, {0x2}}}}, @m_sample={0x60, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0xfffffff7}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x4, 0x8e52, 0x2, 0x4, 0x7}}]}, {0x14, 0x6, "d34c40526c32ce5d5af2a67cba9a4916"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x138, 0x17, 0x0, 0x0, {{0x8}, {0x58, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @random="cfe2b4bd5022"}, @TCA_IFE_TYPE={0x6, 0x5, 0x3}, @TCA_IFE_TYPE={0x6, 0x5, 0xfe1b}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x3ff, 0x65b, 0x3, 0x2, 0x1000}, 0x1}}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x80000001, 0x401, 0x7, 0x3, 0xa}}}]}, {0xbb, 0x6, "0a6825afb12973c5f53f2be03c418fac60df7d1a225df1ad3e0d4dcb13e56ea3e3bd174ad56b6408e2597eaca1a7132fc31d567a519665729cda0b1da699404f5519286a857c1e7624d10c903687b7093a9d15f9bfe3e3bc79a189272757e2c0b0d548861ceba304e41aa30bc0999dcb6f55949a7acdc20fb0116ff1432735f375fcda8ef80d08f979b80a08771b6d5d9ba5763efa760077a650e81f91463cd00a4ea9a992c748f1c5bcbdeb8b2c4c353d017963a3310c"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_csum={0x1d0, 0xe, 0x0, 0x0, {{0x9}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x8, 0x6, 0x6, 0x3a, 0x7ff}, 0x1}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x8, 0x7, 0x2, 0xfffff794, 0x800}, 0x43}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x81, 0x401, 0xffffffffffffffff, 0x4, 0xc}, 0xd}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x9, 0x0, 0x4, 0xfffff800, 0x2}, 0x25}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0x9, 0x20000001, 0xffff, 0x8}, 0x6a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x3ff, 0x5, 0xfffffffffffffff6, 0x1, 0x7}, 0x24}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x10, 0x7, 0x4, 0xffff}, 0x22}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x7, 0x1, 0x4, 0xac1, 0x8}, 0x5d}}]}, {0xc4, 0x6, "12374303dfb38de52a6a08c1baac9bd7efedee4353a9d497dc04da25e2b59a54586bac589641379dd40eabba9d8605f2133901458608d953e8dc4147329980af1d81356ed3c5fda964ab2415875331c1f39e957f22af060bdf53298eebe82972184eee4b30b5e38a463b23ef847985068633f62c2864b7d69f03dd31f22b70fd051136ece069f9400d73af2cef7a2d265c1edd08995bc57f63b57aad365012967e7132cdca94e07c3224193921c1e74716578fc4b096267f2d883ecfea7294cc"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3}}}}]}, @TCA_RSVP_PINFO={0x20, 0x4, {{0x2, 0xb, 0x83}, {0x3, 0x2, 0xee74}, 0x0, 0x5b, 0x3}}, @TCA_RSVP_ACT={0x4dc, 0x6, [@m_skbedit={0x78, 0x12, 0x0, 0x0, {{0xc}, {0x3c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x4, 0xffff}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xe, 0xfff2}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x1ff}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x9, 0x1}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x4, 0x7fff, 0x8, 0x5, 0x2}}]}, {0x13, 0x6, "a3b53010e88a358db7ca10fa35c16e"}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}, @m_skbmod={0x128, 0x1b, 0x0, 0x0, {{0xb}, {0x64, 0x2, 0x0, 0x1, [@TCA_SKBMOD_SMAC={0xa, 0x4, @remote}, @TCA_SKBMOD_SMAC={0xa, 0x4, @local}, @TCA_SKBMOD_SMAC={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3e}}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0xc}, @TCA_SKBMOD_SMAC={0xa, 0x4, @random="34c19d7b89ea"}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x695}, @TCA_SKBMOD_PARMS={0x20, 0x2, {{0x1, 0x8, 0x6, 0x6, 0x8}, 0xe}}]}, {0x99, 0x6, "0632a31bd3654dfbea4af53c0eabbeeb167c4ca90b8090b66c42c8726a4f6f15b7849f558435de2abbf052e0b35b9ec61d2858b246111f3133553010b892de1bb4026b5593121f377627f54acaeaedb3885309546beafe57980e6d52a3ad2965e784325525552abd0964d16777d4e96390a95242a4c46347959ecddeed5d7738e9d9211bfb423bd29033fcf6adaf81bbca94c8a53a"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ife={0x64, 0xf, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2b}}, @TCA_IFE_SMAC={0xa, 0x4, @local}, @TCA_IFE_TYPE={0x6}]}, {0x1b, 0x6, "686df6be25e80552bdb75f8c90882b48ae25ba21b63c7f"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}, @m_csum={0x110, 0x15, 0x0, 0x0, {{0x9}, {0xac, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x3ff, 0x8000, 0x7, 0xa, 0x7}, 0x50}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xeff1978, 0x8001, 0x5, 0x7, 0x7f}, 0x57}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x5, 0x9, 0xffffffffffffffff, 0x5, 0x8000}, 0x5a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x6, 0x5, 0x5, 0x1}, 0x67}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0x2, 0x8, 0x400, 0x1}, 0x14}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0x80000000, 0x3, 0xffff, 0x3ff}, 0x79}}]}, {0x3a, 0x6, "4430de76af88ab085b23c591d07c37b44ae6894b56abbb0383458ce67cf2bfb135f857d981ca0ffedb436a1f27e52d5a9cc639008ee7"}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}, @m_bpf={0x1c4, 0x3, 0x0, 0x0, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_NAME={0xa, 0x6, './sys\x00'}, @TCA_ACT_BPF_FD={0x8, 0x5, r1}, @TCA_ACT_BPF_NAME={0x27, 0x6, './sys/bus/pci/drivers/pch_udc/bind\x00'}, @TCA_ACT_BPF_NAME={0x37, 0x6, './sys/bus/pci/devices/0000:00:03.0/driver_override\x00'}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0xa}, @TCA_ACT_BPF_NAME={0x2e, 0x6, './sys/bus/pci/devices/0000:00:03.0/driver\x00'}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{0x1ff, 0x6, 0x4}]}]}, {0xe4, 0x6, "7d5edbe0b23833af5646459f3ed3dc36a6b2bbbe2897a61948082abb7585c71c2f221973748163b1dfabf3fea62fa746057482c27d48635a6337d8912364f5214cc7c41af14c8eded168c34d38d6149cf611063336401619481991af031fbd08ef8e31e403f7e262b48b76a3a94fef7596020d92fd61d30418b7f12512e3fb12f0949bc0bbff75ad1edf8378a63b16ce10af84432f14e9facd9df68575f3d282b520e0952ad8301eba9e59fc54ca6fc526f9a1bdda610bd5ac9eb6140d9799df9ceb5c0d4b0c9e57a67c736442e79864387bb8377f1a0c837ec05d277ea7c323"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}, @f_tcindex={{0xc}, {0x98, 0x2, [@TCA_TCINDEX_MASK={0x6, 0x2, 0x1be2}, @TCA_TCINDEX_POLICE={0x54, 0x6, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xfff}, @TCA_POLICE_RESULT={0x8, 0x5, 0xe}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x10000002, 0x1, 0x20f7897b, 0x8, {0x4, 0x0, 0x3, 0x2, 0xce9d, 0x2}, {0x6b, 0x1, 0x7f, 0x6623, 0x101}, 0xbc2, 0x5, 0x3}}]}, @TCA_TCINDEX_POLICE={0x38, 0x6, [@TCA_POLICE_RESULT={0x8, 0x5, 0x6}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x2}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x8}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x500}, @TCA_POLICE_RESULT={0x8, 0x5, 0x8}]}]}}]}, 0xc2c}, 0x1, 0x0, 0x0, 0x400c085}, 0x80) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/pch_udc/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='0000:00:03.0\x00', 0xd) 6.333572114s ago: executing program 2 (id=3378): r0 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newtfilter={0x4c, 0x2c, 0x1, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb}, {0x0, 0xfff3}, {0xd, 0x300}}, [@filter_kind_options=@f_flow={{0x9}, {0x1c, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0xc1f5}, @TCA_FLOW_MODE={0x8}, @TCA_FLOW_DIVISOR={0x8, 0x8, 0x4}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi4\x00', 0x1, 0x0) syz_open_dev$video4linux(&(0x7f0000000000), 0x2, 0x200) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfd}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000240)={0x0, 0x2c58, 0x100, 0x20002, 0x16c}, &(0x7f00000000c0)=0x0, 0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r4, 0x0, r5, &(0x7f0000000980)=@IORING_OP_UNLINKAT={0x24, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200, 0x1}) syz_ublk_add_dev(r3, r4, 0x0, r5, &(0x7f00000031c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000003180)=@any_dev={0x3, 0xe9f, 0x0, 0x0, 0x1000, 0x9, 0x0, 0x0, 0x167a4c006c2ec9ca}}}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0xc8) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f000010"], 0x0) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) r7 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000280)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x0, 0x0, 0x0, 0x10002, 0x0, 0x0, 0x41100, 0x60, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r7, 0x2000012, 0x13b, 0x0, &(0x7f0000000500)="b6b4e9760e2cd0ddaf33815ee6c1d52d586dd859b6d4b0503a0bb9ce41455811c621c4b445b84fdbd5f5585db4dc4e79010099c3148a5a95f9f0f34252d8afb3e0c4fad5ed0731d266207ed54ed814203c1b0bb020211b7b867d37eca050e7c798c2c60eee4f4ee2d54ad1ea17346f005758897dd4c68e78a2a3bf3688181bfadc767ff370454353942ed4d23b3abac3d15c00f870d00cb922837843d7dbe58487575a5d96cbc7b32859ad17b86dcb263546a6551944c9b8eec8764942ebbd9b913bfe9b95b3ceb6d73d2480bff7b035709267fb98552a79481f60f75ef8bb0ce5e890b5a77beff21ec0451e757ba9ca799f328fccf0a6391e160a322bfa29e68dd64e4626c5defe61a1012d5e6bccb76450a9a45f2410b96c676e4cad4da6363367f941308789f098baec776696e52d9bfa70cf15ff86c1be06b2", 0x0, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xd}, 0x4c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r8 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) socket$nl_generic(0x10, 0x3, 0x10) writev(r8, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) close(r6) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'ip6gre0\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x2f, 0x2, 0xe, 0x2, 0x6, @mcast2, @mcast1, 0x20, 0x20, 0x2, 0x9}}) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000090a010400000000000000000a0000040900010073797a430ddfc56e8d4b009672cdc626310000000008000540000000020900020073797a310000000008000a40fffffffc0c000980080001400000000114000000340001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 6.027128885s ago: executing program 3 (id=3383): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ftruncate(r0, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x13, r0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) setns(0xffffffffffffffff, 0xc5053f3e1d278a60) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) remap_file_pages(&(0x7f0000636000/0x1000)=nil, 0x1000, 0x8, 0x6, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40000) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x5, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000100000000000000008000000850000003000000085000000500000009500000000010000"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x9, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xe, 0x0, &(0x7f0000000340)="e02753e868a10000000000000000", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) mkdirat(r0, &(0x7f0000000000)='./merge\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./upper\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./work\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x1ff) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a01040000000000000000070000000900000000797a300000000040000000030a01040000000000000000070000000900010073797a30000000ffffffff00000000300000000014000480080001400000000408000240ffffff3854000000e809010400000000000000000073797a30000000000900020073797a30000000002800048024000180090001006d6574610000000014000280080001400000000108000200000000000000"], 0xdc}}, 0x0) mount(0x0, &(0x7f00000000c0)='./merge\x00', &(0x7f0000000100)='zonefs\x00', 0x1, &(0x7f0000000240)='lowerdir=./lower,upperdir=./upper,workdir=./work,index=on,nfs_export=on\x00') r5 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x0, 0x0) open_by_handle_at(r5, &(0x7f0000000200)=ANY=[@ANYBLOB="1c000000f800000000000000fb19020100000200"/36], 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) mount(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000500)='binfmt_misc\x00', 0x3, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r2, &(0x7f0000000400)=[{&(0x7f0000000080)="8f9b5b0007e03dd651934dbfca91799a58f060", 0x13}, {&(0x7f00000001c0)="0100"/11, 0xb}, {&(0x7f00000003c0)="37a0a6c482b23cba92ffffff3f7b42590e180c07f3c193b532f3080000008c49ce65df4d", 0x24}], 0x58) 5.532807069s ago: executing program 3 (id=3387): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022d000100000000090400001503000000092140000001220f00090581", @ANYRES8], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000b00)={0x18, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) pwritev2(0xffffffffffffffff, &(0x7f00000015c0), 0x0, 0xfffff, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x40, [0x7ffd, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x10007f, 0x20000006, 0x4c, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x400, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x8000, 0x0, 0x2, 0x9a, 0x4, 0x7, 0xdf, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x200, 0x1, 0x7, 0x200, 0x3e, 0x2, 0x6, 0x6, 0xc, 0x5, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000009, 0x9, 0x8000012f, 0x8004, 0x1, 0xfffffff3, 0x129432e6, 0x88, 0xf9, 0xe, 0x8, 0x6c7, 0x9, 0xfffffffc, 0x8, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x30e, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x6, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f34, 0xd, 0x100004e0, 0x2, 0x4, 0xb, 0x8001, 0xb, 0x8, 0x9, 0x3b, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x5, 0x3, 0x9, 0x1, 0x3, 0xffffffff, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0x7f, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0x9, 0x4, 0x6, 0x5, 0x0, 0x6, 0x8, 0x1, 0x86, 0x3, 0x303c, 0xbe7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x0, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x6, 0x5, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x8b, 0xfffffff9, 0x1, 0x1000000a, 0x0, 0x5, 0x1f, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x80009, 0xbb33, 0x80000000, 0xb, 0xfffffff3, 0x93a, 0x6, 0x1000006, 0xfffffffe, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x10000, 0x7ff, 0x2, 0x5, 0x1, 0x2, 0x14d, 0x60a7, 0x16, 0x96, 0xfffffffe, 0x80000000, 0x5, 0x4, 0xc8, 0x1, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0xf, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x8000005, 0xb1e, 0xd7, 0x200, 0xffff3441, 0x1]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 3.523129465s ago: executing program 2 (id=3391): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000200c0000000c8615e2c7ef25bbca0f000000000010080000000000005f305f0061303000"], 0x0, 0x2f, 0xff30}, 0x28) epoll_create1(0x0) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000080)={0x5, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r2 = syz_open_dev$vim2m(0x0, 0x2000142, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000100)={0xf0f003, 0x2}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) connect$llc(0xffffffffffffffff, &(0x7f0000000240)={0x1a, 0x20, 0x0, 0x9, 0x2, 0x0, @random='\x00\x00\x00\x00\x00\a'}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000140)={{0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8}, 0x0, 0x0, 0x3, 0x9002, 0x9, 0x1, 0x8, 0x8, 0x9, 0xba3, 0x0, 0xffffffffffffffff}) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x48f, &(0x7f00000000c0)={0x1, @private, 0x0, 0x0, 'sed\x00', 0xa, 0xfffffffb, 0x14}, 0x2c) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000f40)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab58baeda525e1a8deffafde25"}) socket$tipc(0x1e, 0x5, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x8, 0x0, 0x5, 0xfffffffffffffffd, 0x0, 0x0, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x20000000009, 0x5, 0x0, 0x1, 0x9}, 0x0, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r6, 0xffffffffffffffff, 0x100000000000000) r7 = openat$uinput(0xffffff9c, &(0x7f0000000040), 0x802, 0x0) sendfile(r0, r7, &(0x7f0000000080)=0xffffffff, 0x4) 3.388699714s ago: executing program 4 (id=3393): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./rpc_pipefs\x00', 0x1ff) r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000001f00)=[{{&(0x7f0000000140)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000001b80)=[{&(0x7f0000000340)="3f2e8493eabd29c0c16dc88b90ba852413c4fcfd418f9b2c8c17c2f1e43673457b8a9e27212d7afa1e7cfb82d24bac6b8e5200ab577fe92c1caa3813b02d2502ba2f1751099454fc2e09fb9e5460ce8d481e166916474e8089eb48136f1c7de76837853490968a5d2b0ebc3ff335549fbf47807c6e4cc42807f6300c1eab713e9bd7c88d0a65a8c0f21ab16fb4f3862a7f649d829c4666bb9e36b3daecc6ab8933171e6f61ce634c86a1e660f8184ce775c8008cb0cbd27664d28eb21fc81467f2de7a47c7baa3686c26bb39e8cadd5f477a16a3f1ec3bab54a389adb925", 0xde}, {&(0x7f0000000440)="9b3c5dcf4c6bdd6b08b8032f66f874f33d01a83e42b321cf088269744f02e7df8c36309f0654c6334221452d639daaccb85c7ee2e6002be83189fc149f95d2a4d61a1b15b962300c693a04e2370fca5e2a5833975bf97707dca8571616cccd4eac9cff669847c06a6136d72cf180f2f857fe02dd435170e7b77de8b78e8d60876e65e32407c744045209fb42ae9fafd4fbb9106ccfdbeb782fe7fd4fe298a213efb2574ed7238ce51fcd929692a0", 0xae}, {&(0x7f0000000500)="7dc588277856a51ab6ddc1b19c299eea369d311cd4337ec31161bf2106382f4fd424f636b4a53cc726335250a08ac4756b0235ffb14b299c5c587bf1716c598d4177e69149d3dae51735cdeae6d5f6011b2f016b48c42bacb24e228aaa67ca15a242a3a16ee7c45909e04915bc90905f38a0217bbd924766fb8695d856f549dc606aabbb9b405a1555a4db5136499d724850712ada2087a006e619bf860a", 0x9e}, {&(0x7f00000005c0)="c73024d4d2abd179d46aa4131139f5a323cc00a714ae1c32ecf4ab62c6bd92cc014b1fb296fc0e", 0x27}, {&(0x7f0000000600)="22cfc0217deae8", 0x7}, {&(0x7f0000000b40)="12ddb0420da33cb2a124846ca673c034535cc643ee32b5f41b397323db3ee6c9f96873b1b949fc4d26f4139a0ad637033f361e337dbfbc955ac4daf08759dc23a75fa1b80a3d903ee547b5534ce5809d5e1fc6d6807d3c086f70b48464ba8093e0b4f8071968a6f05fd245f1d94ff928b9415aa87b04ed2f0c43211b4bdd8f523bed8b55cc285415663a9384b8766826e7fbde879f14ce13de7fe984031007edf588aab901f995fc315991ebe86bf3f12264d6181b4eaa3f48d3c32428244f240766164e3e6fb8b07ec4b315393cadd52ec4114dc00cce6a35a6772bf6149b0240db64d4a93b6218064e3a9de1667f22771d3085a73cf7934152f3c36b079fe5e6d91e54b6a3a4cc9c787dfbcdcfc032eb4367ac57ad380f57783fa08260d5f041bd96cb2526417f524591a6bb37375dd1d611cac8d016c99cd2911201a21ef86ea06df65f6e40af8eb1c3ddcdcaaa4d0b5edc896f99caf0c554ad997854acc4a1b029c2192e1debdd6a2ac5f033966c0b0f9cf556fc0149034f849c3fb172850ed80eec3f0da482f2abc0e6a37356e5f856a368167dc57eb4507031b5d54a9ca4aa0c3f47c01a07422e530d7a39c5ad2abdafde0b529a1fc0a6c49420e81d3e1bbec12e940cbf1699d6153b0bba6e22feed7e4b1c29558ea680dfe317a4857101da765f704ab636344a48b9cf988283c699e4451ebef7f3a96687dbbe5d231169dd19b61b7f93eddc1eb35e6f26a2e03ffc2ec22f08daee690ec0cd6cf7a9e1b98c4a4dc61633434a259f07d0a635a89b12376b35ca3952b848e8b472bbdf4c0ced09fdbf7433dc872f9e925e2154b5f57c2aacfd823e00d00b9cab9dd4cdbd2abba1ea2dac4b6c154ac0530c3888002068f318f4ce233825508d0504d7fc8fd57fc0563f5249273e16e98e7377b4b1bc2c0b8bacfca2fe47cd9b48408096fd45990faea6a7bbaac56aa4bc163572a8bb6b818cbd83c98977f7b2b8c8fbcca56122c4c947b242faf205989de31a11d68075673c33813ccc5abaf161199b0ca90f8a424a74713fbcc83a0497597fcb6c6ddf6215743f5d94b61dcf4bcad685780c7153e63eb4ba284c3b527046b24e46763ff63405c5bfdcc1a043dc83be4baa46554b6d32e8b858b21d24fa0a19cdd7a5cbd90a5a948069e9c251961b6ba97583ffe7e1a698e340a1f3e6ca1bf2dd56693d73b03ab707752e7bf30a9afd063b8e13d0e150a24eda794e06697b5d06b9019268f89766bca2e454ea42b4e228c9beb733193e364d767eb6f6483c3b35cd66e64a8927551ce6f9cf29eb309170225229236bfaedab30b00aaa6812eacda25b21237f47709881fe72031c11c3fa1458e52d9abbda6fa6f4a1bca2eb5e68d8b4fe181ac548fc454976a2d84e56a01faf8e62a749d7042f781aa194d46f800400b3f258c839eff40c396cb96ca41b70167a1fa9d68e46a0c30a2b4a858f84af35bb4f5f38d8d47bcf10cf735964f06a04376e8a41c5dc58b2d6dc4e96f1e14997c5a1679688775fd892013b9f8f8bceb21c2b4a5410cbb5b3317b202e9eef6f0f6744069f9d8b8ca628cea4273e04463382f38f30cea4e494e2d963313dde4637bdd600e92a91b8e93a1c7361243ec0454be02e0ecba906c8835bbae9e98ac4dcf52269e3788806be676b69031b8841bb70e409fd5a31a3169862870c8547659f7cd620ee38ee7b3c4cb6483de0a8f85dfc0c502c93ddadcbbfc6105499c31b7c4cfd2268df1394f682a6c07ae8ee3d587554576d0f6f3a5c3205164f03085d4cbb1a0fa3ecd64bfc1362e1156a6cc69e0f6198ff84e4b55eb0f583efdf4cd7db9707dd2d9f18bd9775c2f4455234e5d2f98497117ad2c68167aeb38e6a3a70e06c73a20b7d913612a337f5eaa39bf1d3d91015d9d5443f9add2a5bba6afbf9ae15329f89b2a581d3827d46f7b416fbe1624d83ba5ac6d7c8f998155676857a8629b7f955efaa6584d7be5d227ce7259c822a09e8a18343d50d34268d2efbe48b1f553ac38f3492c8191a7726925f0dc4c4d6c801c6b82af9a431865ce171f17e2f211ec005cf5f1f0aa2fd8513c0d579705d26c33c1367ca42b531a5449aa98bc5f5a4b6e836c102b6027bf27d6282d2b0653c58b655914bedcbe3fcafb65424a2fe7bad8af6690a851e35a8c0265a866f2614fc4f1d8656a77c75cce30dc8e7c18ea8099706e22862cc0746e9f4a5bd0932c3b79d450d5f5418ae52ae2be9e4eb144adf0ec01b3c243ffd092e89eaff4213bd790fad0a51b3380b656aa89ba4c632d84fc9ca5078069797ffd6db1273cdbf082dcf52688bfecc03d67b644bb731c1865c8fd595e8976cf17947e089b2f5b3f8be31485d3b6126544f03c67eea3deac1915f015bd6d649d3b618fcae00b669aa4b8e44e8c4443a491515026e7509ca76668c535f52c84959c56127a57372be51ec65e96341f86dd33a6359f8925070465154f4fda2e6b61656e404e0f46bf4036f5feefe455e70ec647d423f77f51948b4e1bd13f8b757cfff84f071c508acfbd5de2e0c026c0c2bbbef26c5d65d90144deacb59d20defb95574db6ac5f411ba3ce645d1a1ee7221a00a0470f1bb2b9ba2ca313c8f0615929640ec835e384382594e481d4e423a8f01118cd6a51a51b7a94f5ba91db4944e76d23046ab055f325d337e28016e8986764badb7a97aaaeca7468deade4df212550a6137443cc8d3012e5557fd974bfb5cb4b8c0f62597bf7550675b00735610f8eaf49a58fa53c397d59f9b390031033eb112aac33255f25cf010176a428b31fd2b11e4d0c38c85d02d641b58ebdda0cf4bdbaecf2b6b134197ca6e3b00568f502188f67abd5959e8d498ca0bd60c434552c890ff4aa5b892a4f2b7185fd5977fc48a06034ebe1b0f6d0bb7b82a3eb4b071766fa0e6266d01a43e4d16a469923e7cc59f36338454516152959c883f95fef01d6630bb98c7a272a74788a36a659f038cd72156f78452f75c7d2a5ae912414c9510255cb3f00c4fb852a26d78e34f276b1346cc2f4e06c7d6b25199296131839a18073aae69ca6315a78ace75d06f6af06bc0dc3e6289ed53ed3ef7fb45c180f345225986a7e1c24a927b3d95542ae69eb80309e211ce235ab90f397fbb7ba08699608ad3a28d612618a1d09731d919c38678823b83c2af599b15374561ad6176c8159149e815a6c34db3c5dd57e7b0d48da482232a4489f406cf6154a59216a07233647eeab9e9306ea154aac25c4100c94769f4f146d68cb6fb52a8eaac8132000fcec525a862cc5e7f01830415d816eae25f3813d2ea0880468378a4f5987458f0a77ad5a8465ef47b529f957a02d012d224be07279171eda5f890cfe2e14204cc3b9fac650f0a55348229e99732be5b18d15889ce3a5bbabfaf9833d276ed4270d7e17d39d120a8bf41537fd50dee600d18f5ea500f35b796fdf016da74dbe226ec77e02dbb2ae3f354899285ad03527e65dbdff629df99d4b6cd9666b6bc44d355c08c602acc776da487f58dace6329fc0bc30d60c8927872b560e7c87d06d01236fe3ca509938e9084a9a6c0e99bb04dd644b176afec0e5fec0390ca071cab33b42997aace4f57a26724c9087b0f96d872816c05984696fd357e8746eecc4fb9d5c51e157eef7f88683a615be6503c39c5395520c7d254a5ca1534ff086e5154d7279aa9d5843809c12c9c67e8eee15490062a9411169cb8896e4e74393cf5c78dc51ac1948894c7a8f0f936de845538a56ae1a70c6c3807336d95a0da25f413f3f592e0c87725f2841d7b097152476f42b32de8c66bd31ffd7516ff3731f1ba5e0985df757bd5b00628f19674bfd381d70c9d78a38543ddd66cbde1bbd29af3156e82eae7b81064c991dbed2c9031002a3c75337dc1e119605b97928c5ee6c4e298794ebb314f5fcfbc6796df291493f86f9d01e3dd72fe54d0b1b5f54bb158a84460d62fd7afe7a52ea20ab5874d4964d10bcd465f32ff9e1eeed17211183402ab577e67126390704310237f4654737211e003bf2032f3ee730088c877b940d84693c155a30ea28b48904247e2a683877b7039fa428a5d542a5e066f1c2539434ba4cd9b0b2bd754bf226e80cdb385169232838d044dbf5653c91c56df81418affe10e6cf45c404774bb170f784be79521144368dcef6d8cd376f25ef06cbf0cad4793c80e110d194515440054643daad082acee5fdb6ebcf45715b6b1738d7cad5d8e2df6dd667c6fdfe9d76d6fb07bb25238a693a319f806c93ac1439daf17fdd9874df9c5f6516dac66889d20762387996c9a34911e512d63a554f187dc01fb3b4fb01302cb977d3b81fb2d221f06a7b6fecfbd230cc11b9a0ddef2bc99522ad3b894cd297b7ef6f9ad349c0d2407100c1010ef852901681b9d3a5f588b61aeb6e9a74db0c79d8533fa1488b58f9589cd33ad63f2faa62c02a75ee3266aad1f264e8941e4e1721d22d905f5e497babf513d0432086155ebf6013ac087895a34b7a1630c9cb5f9b7bfbf6c8319468ae020b8e0c19a26657c63b38560cd230f3fdaf9d7a0d6a09a193b5fd14054fcc5373168ba64c6aa6b67c95e80f62be202b59217257317846fa62b25aa1bea28f86e4469fa560e00c41200aa0fcb8153a61e931abfdc86373763103a9d08a2e06245e69fe31119b36b786cd3987a577e8fa9671ee86ff4974752c3d85528836ee8af73ded4f3f0e928456ee7648610478d99929eb6e021ecae9d08b6ae0ff2e6d5c75e418a75e699c70699860c2b60efbc705eb751604f54d568fefac64ee340eafea0aab72a3c15985f4b3935c5d16dd3f66fed1b4d4b98195826b82e9c3c8b3bb8ec7c9dcc41830050fe94ea2e39f733022db84f77d278a4760f75578f33f9ab3a3876d195f07b390a30782725d3e19d1ea1765bff64157ef5beaba63be454ae8f69d53c51fe2acaf81faa6bf679a84869f4dc63d64c1b598dc64a1c348b428445492f2b73227dd838b281f52b5d7528e96cb16e56a645757f3910224ba31674ca620bf79f3a130abe556f3af9b7bf8db9e9be9e042e330880cc6d380cb8025f0246456eb3dea19b9e788a89c8b6000c463d91d5a26a6d48f82f3654c4469bf9dfc249326a0a19f367d7c9fa3bbf1ae4af4eac4b407c4807736d12232c91847755ecf8fbe27ea082490e53fc5e1af54c264e60bdc9e5c382c3d1366657e4e8058af52f9a3e5a0cb3a365f5baeb358ea61f617139c737b079fa0e3330f74241173f224ea7d490d3d0c01339c4a00a95986223dfb4926d8e007cf44500eca5797b5a525eda4eea1a31819d0d9ecca69163c4cde31721337047fdc125a0508e24579997090e6c47a1f75f9f010aa3cde5773bf6ac2bb8392c2587e82f150e61e85549925d73088d0bb1d932be70ef7eb2465fb439acce3fc42c460e26af8ff67ce6cf12941364ae899ac1df4d6363fecac7e1197bb886483e57b6c412a673f1be6e50b027f7d3b33e7f59a22ef1e617fcaa8cfa7215b8a1318d03a274d2ad2c1160cb3f31bd6503e7b07457058c7aab113dde74c558e089c5f34611538c7fbd03a4bff51354aea30e08e1bb45cc76af6271a829bc1fcc2af8a9bc6a03f5bdd21b560460ebf720610eb703800a5e91d70eb165f673aee739764cdfbad988b7f0f594490ceaf9e0a7f5dd4bb63a1ad24a797fdb376d9c25e703626849cba9cb47e25a40316baf68b433c13682bb53da47c1367551e670d0e4ec1806c4e6803e9d691fbfb2d8421c23622666000f44e8fffef6f6cffe5cd72dfc017084e8fa653", 0x1000}, {&(0x7f0000001b40)="024f08b9af90abc4be07a2d29383ee6db9b767a6f700817610bfb7", 0x1b}], 0x7, &(0x7f0000000640)=ANY=[@ANYBLOB="2c0000000100000001000000", @ANYRES32=r2, @ANYRES32=0x0, @ANYRES8=r1, @ANYRES8=r0, @ANYRES32=r2, @ANYRES32=r0, @ANYRES32=r2, @ANYRESDEC=r2, @ANYBLOB="18000000010000000200000062efadd3e6e2c69b2343c948555dc67a554939d14d7b8f0b30f1f2743cc0f33ac1afdbf80ceb9951", @ANYRES64=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="180000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRESHEX=r1, @ANYBLOB="180000000100000001000000", @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="180000000100000002000000", @ANYRES16=r2, @ANYRES32=0xee00, @ANYRES32=r2], 0x8c, 0x4000000}}], 0x1, 0xc0081) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0x4296}, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000200), 0xa2642, 0x0) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, &(0x7f00000000c0)=0x40) socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0xed}, 0x1, 0x0, 0x0, 0x4008004}, 0x4008880) getsockname$packet(r4, 0x0, &(0x7f0000000200)) recvmmsg(0xffffffffffffffff, &(0x7f0000003f40), 0x0, 0x0, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r4, r1, 0x0, 0x201000) cachestat(r5, &(0x7f0000000240)={0xa}, &(0x7f0000000040), 0x0) r6 = socket$can_raw(0x1d, 0x3, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'syzkaller0\x00', 0x0}) sendmsg$can_raw(r6, &(0x7f0000000000)={&(0x7f00000000c0)={0x1d, r7}, 0x10, &(0x7f0000000100)={0x0, 0x56}, 0x2, 0x0, 0x0, 0x1}, 0x4040005) r8 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r8, 0xc0184800, &(0x7f0000000100)={0x5, 0xffffffffffffffff, 0x80001}) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='numa_maps\x00') socket$kcm(0x11, 0x3, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./rpc_pipefs\x00', 0x127142, 0x22) creat(&(0x7f00000001c0)='./rpc_pipefs/gssd/clntXX/gssd\x00', 0x182) 3.224003335s ago: executing program 2 (id=3395): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1, 0xf, &(0x7f0000000400)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000002c0)=r2, 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000700)="d80000001a0081044e81f782db4cb904021d08004f1e81f8d8150019001105142603600e12080005007a010401a80016002000034004000000035c0461c9d67f6f940071342e875fab7cb6cec6cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4", 0x6c}], 0x1}, 0x0) 3.221429559s ago: executing program 2 (id=3397): r0 = socket$nl_rdma(0x10, 0x3, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)=@newtaction={0x204, 0x30, 0x1, 0x0, 0x0, {}, [{0x1f0, 0x1, [@m_mpls={0xb0, 0x12, 0x0, 0x0, {{0x9}, {0x64, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x9, 0x104, 0x1, 0x4, 0x800}, 0x1}}, @TCA_MPLS_LABEL={0x8, 0x5, 0x40ac3}, @TCA_MPLS_TTL={0x5, 0x7, 0x1}, @TCA_MPLS_PROTO={0x6, 0x4, 0x1b}, @TCA_MPLS_LABEL={0x8, 0x5, 0x8d6fe}, @TCA_MPLS_PROTO={0x6, 0x4, 0x88ca}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0x4190, 0x4, 0x0, 0x5, 0x9}, 0x1}}]}, {0x21, 0x6, "b7be011f6fa20bd828b0ce94cd3b348d959afe54cec3b7e312b7308338"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_mirred={0x13c, 0x15, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x7, 0x200, 0x1, 0x3, 0x40}, 0x2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x6, 0xfffffe00, 0x7, 0x9ea0, 0xaa}, 0x2}}]}, {0xd0, 0x6, "6095349c4967caf792a9e99d4af275ab47f3edb166597d3e04246d543240ee62e682e0a24940d5823dbf99fbafb8d4e7f21a3d9db706066dcb797917b907cc0445ce3a1ac7ed54dba2b4b266a6726a137b57d10971a73cfc4e38ba2b9dabc7fa29dc15e70f2b73195a217a1178ea52d0c17a786127a987f99c18edd1c8f4f26481b65648529de782253d32c98b42271c9dd23abf48e06586a6bd69b07480c5a1d4342d24b68ad54a3fbfa6775ee94d7e431388e2f65b8787de7b9dcbaa5446d250090f12e64b30eb9df252e2"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x204}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r5, 0xc138fd06, &(0x7f0000000540)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f6f6c") ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f0000000040)={0x0, 0x8, 0x0, 0x4}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d00)={0x11, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="4544f0fffcff30c000"], &(0x7f0000000280)='syzkaller\x00', 0x6, 0x1e, &(0x7f0000000300)=""/30, 0x41000, 0x10, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000c00)={0x4, 0xb, 0x902c}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000cc0)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x7}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x58) r6 = dup(0xffffffffffffffff) socket$nl_sock_diag(0x10, 0x3, 0x4) r7 = syz_open_dev$I2C(&(0x7f00000001c0), 0x78b5, 0x80) ioctl$I2C_RDWR(r7, 0x707, 0x0) setsockopt$PNPIPE_ENCAP(r6, 0x113, 0x1, &(0x7f0000000180)=0x1, 0x4) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000000914230c2dbd7000ffdbdf250900020073797a32000f00000800410072786500140033007767320000000000000000000000000066129cbdaaf92ea305126427a766b1c085924cd6ad57b03cfe9655f622d77d2aeea86454e08d702ca2d6392ca31ef21b722d78da5d90886bb0db32b0e33c89a5e901bb4e0379f25665d395238e6730ad37288567b268fe7f1586d588e526e7d727ec73b81279a75e879dd960e5107507609756ec582a8032a0ae41beb16ed972c66cc59029b79ace6666660cde28316ee23ff7ea64e39ae6d39b5f45f5ccf2adaffee80cc44776710ba5c2a2e806dcb0a1fd133d11902dea4f"], 0x38}, 0x1, 0x0, 0x0, 0x400c080}, 0x0) 2.961050281s ago: executing program 3 (id=3398): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff00", @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) socket(0x2b, 0x1, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfffd, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_DYING(r5, &(0x7f0000000000)={0x0, 0xffffffffffffffab, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) r6 = fsopen(&(0x7f0000000140)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000000)='test_dummy_encryption', &(0x7f0000000080)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2) close(0x5) 2.405773936s ago: executing program 4 (id=3399): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c00010062"], 0x3c}}, 0x0) socket(0x2b, 0x1, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfffd, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_DYING(r5, &(0x7f0000000000)={0x0, 0xffffffffffffffab, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) r6 = fsopen(&(0x7f0000000140)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000000)='test_dummy_encryption', &(0x7f0000000080)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2) close(0x5) 2.111783071s ago: executing program 0 (id=3401): r0 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, 0x0, 0x1, {0x176e19c8f85d2a1e, 0xf0, 0x6}, 0x2}, 0x18) r1 = epoll_create1(0x80000) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs_dir\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs_dir/buffer_size_kb\x00', 0x1, 0x0) write(r3, &(0x7f0000000180), 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./tracefs_dir/free_buffer\x00', 0x1, 0x0) close(r4) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@file={0x0, './bus\x00'}, 0x6e) dup3(r1, r1, 0x80000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000003b80), r5) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000200)={0x1000201c}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r1, &(0x7f0000000440)={0xa0000001}) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) 2.013703078s ago: executing program 0 (id=3402): bind$can_j1939(0xffffffffffffffff, &(0x7f0000000340)={0x1d, 0x0, 0x1, {0x176e19c8f85d2a1e, 0xf0, 0x6}, 0x2}, 0x18) r0 = epoll_create1(0x80000) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs_dir\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', 0x0, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs_dir/buffer_size_kb\x00', 0x1, 0x0) write(r2, &(0x7f0000000180)='10', 0x2) close(0xffffffffffffffff) dup3(r0, r0, 0x80000) epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000200)={0x1000201c}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket$can_j1939(0x1d, 0x2, 0x7) 1.919723571s ago: executing program 0 (id=3403): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount$9p_xen(&(0x7f0000000000), &(0x7f00000002c0)='./sys/bus/pci/devices/0000:00:03.0/driver\x00', &(0x7f0000000300), 0x202001c, &(0x7f0000000340)={'trans=xen,', {[{@access_any}], [{@dont_hash}]}}) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='0000:00:03.0\x00', 0xd) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='pch_udc\x00', 0x8) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000500)={'syztnl2\x00', &(0x7f00000003c0)={'ip_vti0\x00', 0x0, 0x8, 0x80, 0x8, 0x7fff, {{0x3b, 0x4, 0x1, 0x0, 0xec, 0x68, 0x0, 0x3, 0x4, 0x0, @loopback, @remote, {[@noop, @cipso={0x86, 0x2f, 0x3, [{0x7, 0xb, "42c017ebaced9d9308"}, {0x7, 0x2}, {0xd36e2d0f713f458a, 0x8, "ef7bf8fa82c5"}, {0x0, 0x4, "f86e"}, {0x1, 0x10, "cef6bc0ae4884c880c449241fa66"}]}, @timestamp={0x44, 0xc, 0xc9, 0x0, 0x6, [0x7, 0x6]}, @cipso={0x86, 0x9, 0x1, [{0x5, 0x3, 'B'}]}, @ssrr={0x89, 0xf, 0x38, [@broadcast, @local, @local]}, @cipso={0x86, 0x42, 0x3, [{0x6, 0x8, "ed0766da6ea2"}, {0x1, 0xb, "eee9aaa34ac456b1ac"}, {0x7, 0x3, '='}, {0x7, 0x5, "97e18d"}, {0x7, 0x11, "c6e4ede0e9ce98e033641b6aa514b7"}, {0xf85fdd6416cb5eff, 0x7, "d70396b117"}, {0x6, 0x9, "b93ff542c381e8"}]}, @timestamp_addr={0x44, 0x2c, 0xd3, 0x1, 0x7, [{@broadcast, 0x6}, {@loopback, 0x5}, {@private=0xa010100, 0x2}, {@private=0xa010100, 0x3}, {@empty, 0x7}]}, @lsrr={0x83, 0x13, 0xd7, [@multicast2, @rand_addr=0x64010102, @loopback, @empty]}]}}}}}) sendmsg$nl_route_sched_retired(r1, &(0x7f00000012c0)={&(0x7f0000000380), 0xc, &(0x7f0000001280)={&(0x7f0000000540)=@delchain={0xc24, 0x65, 0x200, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0xd, 0xffe0}, {0x8, 0xd}, {0xe, 0x3}}, [@f_rsvp={{0x9}, {0xb58, 0x2, [@TCA_RSVP_ACT={0x658, 0x6, [@m_skbmod={0x128, 0xa, 0x0, 0x0, {{0xb}, {0x4}, {0xf9, 0x6, "f20805b342a4ccb317d3e033d46c99bccaf71dd2487a6092508ba9138c0c14370cf05c26e3af4d5fd53e243ab0883327de6e9444c5c6976d4d2514856723a90f252771b67966b298fd737f0aa22ae3201b63ae23cc3accb9b7f84316d6b542e3334ce58b04d566a9ce5daee75c7c68c7ef99aea2265a580650cbc6f87263681b9b66212262ba9edcae8170e0848c1c62d54c1cd41061d60b5cfbfc7d02543449d05c73674ae7c8fa1757781e4cc2e592a0074a005ac0e79d1ea27627404dfb24a0b31ff7b3b98609246fa0820a5d0ad26a73e34396a3e96f076176282f80554daed02358e3a94e3a29e459c45083f6218ed4f81b52"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}, @m_connmark={0x1c4, 0x8, 0x0, 0x0, {{0xd}, {0x100, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x8, 0x7, 0x4, 0xc2}, 0xf67}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6d1a394b, 0x52, 0x7, 0x90c5, 0xa3}, 0x400}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0xfffffffd, 0x6, 0x6, 0x4}, 0x8}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x7, 0x9, 0x3, 0x8, 0x8169}, 0x9}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xffffffff, 0x3, 0x4, 0x7fffffff, 0x9}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x3, 0x20000000, 0x3ff, 0x3}, 0x5}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0x5, 0x3, 0x200}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xffffffff, 0x2, 0x10000000, 0x101, 0xe}, 0x9}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4, 0x223, 0x3, 0x4, 0x8}, 0xd33}}]}, {0x97, 0x6, "f09dbdc6d7fa1ef3cfb6d182c789bb87be7e0ef0319a4bf5f9fa16d0cdbde2916b60f499a000cf715bef95caca274b05b5ab51bc2f9e8a0e73088bc1b2c9d6aa059a93bab861c41c9446cb4de63efe850e970e0801f7f5d3da1e783effcb90fae4fec0c3ad86cf6178a4d3686afcf4407c320f20cbbdb60059abdc8e851846c5566f0704ad28970a8f4a9adea30944feba67c7"}, {0xc}, {0xc, 0x8, {0x2}}}}, @m_sample={0x60, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0xfffffff7}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x4, 0x8e52, 0x2, 0x4, 0x7}}]}, {0x14, 0x6, "d34c40526c32ce5d5af2a67cba9a4916"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x138, 0x17, 0x0, 0x0, {{0x8}, {0x58, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @random="cfe2b4bd5022"}, @TCA_IFE_TYPE={0x6, 0x5, 0x3}, @TCA_IFE_TYPE={0x6, 0x5, 0xfe1b}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x3ff, 0x65b, 0x3, 0x2, 0x1000}, 0x1}}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x80000001, 0x401, 0x7, 0x3, 0xa}}}]}, {0xbb, 0x6, "0a6825afb12973c5f53f2be03c418fac60df7d1a225df1ad3e0d4dcb13e56ea3e3bd174ad56b6408e2597eaca1a7132fc31d567a519665729cda0b1da699404f5519286a857c1e7624d10c903687b7093a9d15f9bfe3e3bc79a189272757e2c0b0d548861ceba304e41aa30bc0999dcb6f55949a7acdc20fb0116ff1432735f375fcda8ef80d08f979b80a08771b6d5d9ba5763efa760077a650e81f91463cd00a4ea9a992c748f1c5bcbdeb8b2c4c353d017963a3310c"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_csum={0x1d0, 0xe, 0x0, 0x0, {{0x9}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x8, 0x6, 0x6, 0x3a, 0x7ff}, 0x1}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x8, 0x7, 0x2, 0xfffff794, 0x800}, 0x43}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x81, 0x401, 0xffffffffffffffff, 0x4, 0xc}, 0xd}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x9, 0x0, 0x4, 0xfffff800, 0x2}, 0x25}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0x9, 0x20000001, 0xffff, 0x8}, 0x6a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x3ff, 0x5, 0xfffffffffffffff6, 0x1, 0x7}, 0x24}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x10, 0x7, 0x4, 0xffff}, 0x22}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x7, 0x1, 0x4, 0xac1, 0x8}, 0x5d}}]}, {0xc4, 0x6, "12374303dfb38de52a6a08c1baac9bd7efedee4353a9d497dc04da25e2b59a54586bac589641379dd40eabba9d8605f2133901458608d953e8dc4147329980af1d81356ed3c5fda964ab2415875331c1f39e957f22af060bdf53298eebe82972184eee4b30b5e38a463b23ef847985068633f62c2864b7d69f03dd31f22b70fd051136ece069f9400d73af2cef7a2d265c1edd08995bc57f63b57aad365012967e7132cdca94e07c3224193921c1e74716578fc4b096267f2d883ecfea7294cc"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3}}}}]}, @TCA_RSVP_PINFO={0x20, 0x4, {{0x2, 0xb, 0x83}, {0x3, 0x2, 0xee74}, 0x0, 0x5b, 0x3}}, @TCA_RSVP_ACT={0x4dc, 0x6, [@m_skbedit={0x78, 0x12, 0x0, 0x0, {{0xc}, {0x3c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x4, 0xffff}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xe, 0xfff2}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x1ff}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x9, 0x1}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x4, 0x7fff, 0x8, 0x5, 0x2}}]}, {0x13, 0x6, "a3b53010e88a358db7ca10fa35c16e"}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}, @m_skbmod={0x128, 0x1b, 0x0, 0x0, {{0xb}, {0x64, 0x2, 0x0, 0x1, [@TCA_SKBMOD_SMAC={0xa, 0x4, @remote}, @TCA_SKBMOD_SMAC={0xa, 0x4, @local}, @TCA_SKBMOD_SMAC={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3e}}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0xc}, @TCA_SKBMOD_SMAC={0xa, 0x4, @random="34c19d7b89ea"}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x695}, @TCA_SKBMOD_PARMS={0x20, 0x2, {{0x1, 0x8, 0x6, 0x6, 0x8}, 0xe}}]}, {0x99, 0x6, "0632a31bd3654dfbea4af53c0eabbeeb167c4ca90b8090b66c42c8726a4f6f15b7849f558435de2abbf052e0b35b9ec61d2858b246111f3133553010b892de1bb4026b5593121f377627f54acaeaedb3885309546beafe57980e6d52a3ad2965e784325525552abd0964d16777d4e96390a95242a4c46347959ecddeed5d7738e9d9211bfb423bd29033fcf6adaf81bbca94c8a53a"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ife={0x64, 0xf, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2b}}, @TCA_IFE_SMAC={0xa, 0x4, @local}, @TCA_IFE_TYPE={0x6}]}, {0x1b, 0x6, "686df6be25e80552bdb75f8c90882b48ae25ba21b63c7f"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}, @m_csum={0x110, 0x15, 0x0, 0x0, {{0x9}, {0xac, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x3ff, 0x8000, 0x7, 0xa, 0x7}, 0x50}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xeff1978, 0x8001, 0x5, 0x7, 0x7f}, 0x57}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x5, 0x9, 0xffffffffffffffff, 0x5, 0x8000}, 0x5a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x6, 0x5, 0x5, 0x1}, 0x67}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0x2, 0x8, 0x400, 0x1}, 0x14}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0x80000000, 0x3, 0xffff, 0x3ff}, 0x79}}]}, {0x3a, 0x6, "4430de76af88ab085b23c591d07c37b44ae6894b56abbb0383458ce67cf2bfb135f857d981ca0ffedb436a1f27e52d5a9cc639008ee7"}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}, @m_bpf={0x1c4, 0x3, 0x0, 0x0, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_NAME={0xa, 0x6, './sys\x00'}, @TCA_ACT_BPF_FD={0x8, 0x5, r1}, @TCA_ACT_BPF_NAME={0x27, 0x6, './sys/bus/pci/drivers/pch_udc/bind\x00'}, @TCA_ACT_BPF_NAME={0x37, 0x6, './sys/bus/pci/devices/0000:00:03.0/driver_override\x00'}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0xa}, @TCA_ACT_BPF_NAME={0x2e, 0x6, './sys/bus/pci/devices/0000:00:03.0/driver\x00'}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{0x1ff, 0x6, 0x4}]}]}, {0xe4, 0x6, "7d5edbe0b23833af5646459f3ed3dc36a6b2bbbe2897a61948082abb7585c71c2f221973748163b1dfabf3fea62fa746057482c27d48635a6337d8912364f5214cc7c41af14c8eded168c34d38d6149cf611063336401619481991af031fbd08ef8e31e403f7e262b48b76a3a94fef7596020d92fd61d30418b7f12512e3fb12f0949bc0bbff75ad1edf8378a63b16ce10af84432f14e9facd9df68575f3d282b520e0952ad8301eba9e59fc54ca6fc526f9a1bdda610bd5ac9eb6140d9799df9ceb5c0d4b0c9e57a67c736442e79864387bb8377f1a0c837ec05d277ea7c323"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}, @f_tcindex={{0xc}, {0x90, 0x2, [@TCA_TCINDEX_POLICE={0x54, 0x6, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xfff}, @TCA_POLICE_RESULT={0x8, 0x5, 0xe}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x10000002, 0x1, 0x20f7897b, 0x8, {0x4, 0x0, 0x3, 0x2, 0xce9d, 0x2}, {0x6b, 0x1, 0x7f, 0x6623, 0x101}, 0xbc2, 0x5, 0x3}}]}, @TCA_TCINDEX_POLICE={0x38, 0x6, [@TCA_POLICE_RESULT={0x8, 0x5, 0x6}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x2}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x8}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x500}, @TCA_POLICE_RESULT={0x8, 0x5, 0x8}]}]}}]}, 0xc24}, 0x1, 0x0, 0x0, 0x400c085}, 0x80) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/pch_udc/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='0000:00:03.0\x00', 0xd) 1.70397492s ago: executing program 0 (id=3404): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff0000", @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) socket(0x2b, 0x1, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfffd, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_DYING(r5, &(0x7f0000000000)={0x0, 0xffffffffffffffab, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) r6 = fsopen(&(0x7f0000000140)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000000)='test_dummy_encryption', &(0x7f0000000080)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2) close(0x5) 1.647131126s ago: executing program 3 (id=3405): r0 = openat$autofs(0xffffff9c, &(0x7f0000000000), 0x80001, 0x0) r1 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000001080), 0x0, 0x0) io_setup(0x200, &(0x7f00000010c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000800)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x5, 0xfffe, r2, 0x0, 0x0, 0x0, 0x0, 0x2, r2}]) mkdir(&(0x7f0000000000)='proc\x00', 0x1ff) r4 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0x100577, 0x2, 0x1, 0x42}, &(0x7f0000000400), &(0x7f0000011000), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_FILES2(r4, 0xd, 0x0, 0x0) mount(0x0, &(0x7f0000000200)='proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) sendmsg$AUDIT_ADD_RULE(r2, &(0x7f0000000d40)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000880)={0x450, 0x3f3, 0x1, 0x70bd2b, 0x25dfdbff, {0x3, 0x1, 0x2, [0x9, 0x6, 0x80000001, 0x1, 0xec9, 0x7fffffff, 0x7, 0xf566, 0x0, 0x6, 0x10000, 0xffffffc0, 0x984, 0x10, 0x29f, 0x2000, 0x9, 0x4, 0x640, 0x1, 0x6, 0x9, 0x1ab, 0x4, 0x5, 0x362a, 0x9, 0x7, 0x2, 0x2, 0x5, 0x3, 0x40, 0x1, 0x2, 0x5, 0x0, 0x7, 0x4, 0x1, 0x7, 0x10001, 0xd4, 0x8, 0x9, 0x3, 0x2, 0x0, 0xfc55, 0xfffffffb, 0x343, 0x7, 0x7ff, 0x5, 0x81, 0x4, 0x6, 0x5, 0x1, 0xb, 0x7, 0x8, 0x1], [0xf73d, 0xfffffff7, 0x536d19bb, 0x80, 0x80000001, 0x26d0, 0xc355, 0xfffffffc, 0x8d05, 0x9, 0x9, 0x0, 0x8, 0xfffffffa, 0x8, 0x28000000, 0x7fffffff, 0x3, 0x7, 0xffff, 0x8, 0xf4, 0x1, 0xa, 0x3, 0x5, 0x3aafb681, 0xfffffffb, 0x8001, 0x1, 0x7, 0xffffff80, 0x5, 0x1, 0x7, 0xd3, 0x80000, 0x4, 0x9, 0xeec, 0x5, 0xf17, 0x4, 0x6, 0x3, 0x12000000, 0x401, 0xd3, 0x8, 0x80000001, 0x5, 0x0, 0x8, 0x8, 0x1a2, 0x4ae90fcc, 0x6, 0x4, 0x5, 0x83f, 0x4, 0x4, 0x1, 0x2], [0x4, 0x5, 0x7, 0x0, 0x40000000, 0xba69, 0x0, 0x6, 0x8, 0x6f9, 0x3afef446, 0x9, 0x10, 0x3, 0x4, 0x6644, 0x124b, 0xd, 0x9, 0x2, 0x980, 0x54d2, 0x6, 0x2, 0x4d, 0x8, 0x9b, 0x9, 0x1, 0x3536, 0x5, 0x1ff, 0x0, 0xa3, 0x8, 0x43, 0x7, 0x5, 0x41, 0x653a, 0x8, 0xf3, 0x7, 0x4, 0x0, 0x13, 0xfffffffc, 0x5, 0x0, 0x6, 0x3, 0xa0, 0x1, 0x10000, 0x1, 0x9, 0x7, 0x7, 0x927, 0x4, 0x7ff, 0xa, 0xffffffff], [0x2, 0x7280, 0xb, 0x1, 0x5, 0x7, 0x3, 0x8000, 0x4, 0x81, 0x3, 0x10001, 0x4, 0x0, 0x6, 0x9, 0x80000000, 0xfff, 0x2cf6, 0xd, 0x8665, 0x0, 0x4, 0x92a, 0x800, 0xd9b3, 0xffffff0c, 0x10, 0x9, 0xa, 0x3, 0x9, 0x1, 0x7, 0x2, 0x4, 0x10000, 0x4, 0xb69, 0x9, 0x2e, 0x2, 0x4, 0x0, 0x8, 0xe, 0x8, 0x3, 0x3, 0xffff, 0x7, 0xffffffbe, 0x3, 0x2, 0x1, 0x10001, 0x7, 0x0, 0x7, 0x0, 0x9f, 0x6, 0x4, 0xde9], 0x2d, ['\x00', '/dev/autofs\x00', '%%&\x00', ' \xbc\x1b', '\x00', ')})*\x00', '/dev/sequencer\x00', 'u#\x00', '\x00']}, ["", "", "", "", "", "", "", "", ""]}, 0x450}, 0x1, 0x0, 0x0, 0x4}, 0x48000) socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x2, &(0x7f0000000180)=[{0x7e8, 0x1, 0x5}, {0x8cf, 0x6, 0x6, 0x2}]}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='proc/kallsyms\x00', 0x0, 0x0) lseek(r5, 0x186a0, 0x0) lseek(r5, 0x249f0, 0x0) 1.642917374s ago: executing program 2 (id=3406): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022d000100000000090400001503000000092140000001220f00090581", @ANYRES8], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000b00)={0x18, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) pwritev2(0xffffffffffffffff, &(0x7f00000015c0), 0x0, 0xfffff, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x40, [0x7ffd, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x10007f, 0x20000006, 0x4c, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x400, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x8000, 0x0, 0x2, 0x9a, 0x4, 0x7, 0xdf, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x200, 0x1, 0x7, 0x200, 0x3e, 0x2, 0x6, 0x6, 0xc, 0x5, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000009, 0x9, 0x8000012f, 0x8004, 0x1, 0xfffffff3, 0x129432e6, 0x88, 0xf9, 0xe, 0x8, 0x6c7, 0x9, 0xfffffffc, 0x8, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x30e, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x6, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f34, 0xd, 0x100004e0, 0x2, 0x4, 0xb, 0x8001, 0xb, 0x8, 0x9, 0x3b, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x5, 0x3, 0x9, 0x1, 0x3, 0xffffffff, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0x7f, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0x9, 0x4, 0x6, 0x5, 0x0, 0x6, 0x8, 0x1, 0x86, 0x3, 0x303c, 0xbe7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x0, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x6, 0x5, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x8b, 0xfffffff9, 0x1, 0x1000000a, 0x0, 0x5, 0x1f, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x80009, 0xbb33, 0x80000000, 0xb, 0xfffffff3, 0x93a, 0x6, 0x1000006, 0xfffffffe, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x10000, 0x7ff, 0x2, 0x5, 0x1, 0x2, 0x14d, 0x60a7, 0x16, 0x96, 0xfffffffe, 0x80000000, 0x5, 0x4, 0xc8, 0x1, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0xf, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x8000005, 0xb1e, 0xd7, 0x200, 0xffff3441, 0x1]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 1.329260452s ago: executing program 3 (id=3407): io_uring_setup(0x178e, &(0x7f0000000300)={0x0, 0xcd80, 0x40, 0xfffffffe, 0xf0}) r0 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000100)='asymmetric\x00', &(0x7f00000003c0)=@secondary) keyctl$get_persistent(0x16, 0x0, r0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_print_times', 0x101a02, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x87) connect$inet6(r1, &(0x7f0000000500)={0xa, 0xfffd, 0x0, @loopback, 0x5}, 0x1c) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x1000, @initdev={0xfe, 0x88, '\x00', 0x40, 0x0}, 0x4}, 0x1c) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r2, 0x0, 0x119) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42) socket$xdp(0x2c, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket(0x400000000010, 0x3, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x8000000000000001, 0x80, 0x0, 0x800, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xfffffffffffffeff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) 1.296665508s ago: executing program 4 (id=3408): r0 = openat$snapshot(0xffffff9c, &(0x7f00000001c0), 0x62901, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0xc, &(0x7f0000000000), 0x4) r2 = syz_open_dev$swradio(&(0x7f00000046c0), 0x1, 0x2) ioctl$VIDIOC_S_FREQUENCY(r2, 0x402c5639, &(0x7f00000000c0)={0x0, 0x4, 0xfffffffe}) mount(0x0, 0x0, 0x0, 0x0, 0x0) epoll_create1(0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0xc03, 0x0) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000140)={{0x0, 0x4, 0x0, 0x9}, 'syz0\x00', 0x13}) ioctl$UI_DEV_CREATE(r4, 0x5501) r5 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0) ioctl$EVIOCSFF(r5, 0x40304580, 0x0) socket$inet(0x2b, 0x801, 0x2) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x8, 0x0, 0x5, 0xfffffffffffffffd, 0x0, 0x0, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x20000000009, 0x5, 0x0, 0x1, 0x9}, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x100000000000000) ioctl$SNAPSHOT_GET_IMAGE_SIZE(r0, 0x8008330e, 0x0) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r6, 0xc05c5340, &(0x7f0000000000)={0x7ff, 0x8, 0x4000000, {0x1, 0x10}, 0x100005, 0x5c6}) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) 561.474017ms ago: executing program 3 (id=3409): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff00", @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) socket(0x2b, 0x1, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfffd, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_DYING(r5, &(0x7f0000000000)={0x0, 0xffffffffffffffab, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) r6 = fsopen(&(0x7f0000000140)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000000)='test_dummy_encryption', &(0x7f0000000080)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2) close(0x5) 355.212945ms ago: executing program 4 (id=3410): r0 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, 0x0, 0x1, {0x176e19c8f85d2a1e, 0xf0, 0x6}, 0x2}, 0x18) r1 = epoll_create1(0x80000) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs_dir\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs_dir/buffer_size_kb\x00', 0x1, 0x0) write(r3, &(0x7f0000000180)='1', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./tracefs_dir/free_buffer\x00', 0x1, 0x0) close(r4) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@file={0x0, './bus\x00'}, 0x6e) dup3(r1, r1, 0x80000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000003b80), r5) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000200)={0x1000201c}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r1, &(0x7f0000000440)={0xa0000001}) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) 289.358773ms ago: executing program 0 (id=3411): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@enum={0x2, 0x0, 0x0, 0xf}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x28}, 0x20) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x4, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0, 0x0, 0x1}, 0x48) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0xa280, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'pimreg\x00', 0x1}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000100007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r1, @ANYBLOB="0000000002000000b705000008000000850000005d00000095"], &(0x7f0000000300)='GPL\x00', 0x2, 0x100a, &(0x7f0000002500)=""/4106, 0x0, 0x2b}, 0x94) 172.331472ms ago: executing program 4 (id=3412): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) 73.698182ms ago: executing program 0 (id=3413): setns(0xc9, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x30fa00, 0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x109002, 0x0) read$dsp(r1, &(0x7f00000000c0)=""/108, 0x6c) write$dsp(r0, &(0x7f0000002000)='`', 0x88020) r2 = openat$ndctl0(0xffffffffffffff9c, &(0x7f0000000000), 0x169101, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(r2, 0xc008640a, &(0x7f0000000180)) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000140)={0x28, 0x6, r4, 0x0, &(0x7f00004fa000/0x3000)=nil, 0x3000, 0x800}) ioctl$IOMMU_IOAS_COPY(r3, 0x3b83, &(0x7f0000000000)={0x28, 0x4, r4, r4, 0x3, 0x10}) r5 = signalfd(r3, &(0x7f0000000280)={[0x200, 0x1]}, 0x8) ioctl$IOMMU_IOAS_COPY(r3, 0x3b83, &(0x7f0000000040)={0x28, 0x5, r4, r4, 0x3, 0x2000, 0x3fff}) ioctl$IOMMU_IOAS_UNMAP(r2, 0x3b86, &(0x7f00000000c0)={0x18, r4, 0x71, 0x10001}) read$usbfs(r2, &(0x7f00000001c0)=""/138, 0x8a) ioctl$IOMMU_IOAS_UNMAP(0xffffffffffffffff, 0x3b86, &(0x7f0000000000)={0x18, r4, 0x6, 0x1}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0) close(r6) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r7, r7) setpgid(0x0, r7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/remove\x00', 0x1, 0x0) write(r8, &(0x7f0000000140)='1', 0x1) sched_setscheduler(r7, 0x3, &(0x7f0000000080)=0x6) socket$netlink(0x10, 0x3, 0x0) fstat(r5, &(0x7f0000000380)) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) 3.397181ms ago: executing program 4 (id=3414): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0xc0042, 0x1) r1 = socket(0x1d, 0x2, 0x6) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000000040)={0x1, 'netdevsim0\x00', {}, 0x40}) (async) mount$9p_fd(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000000), 0x3000084, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_readahead}]}}) 0s ago: executing program 2 (id=3415): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ftruncate(r0, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x13, r0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) setns(0xffffffffffffffff, 0xc5053f3e1d278a60) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r0, @ANYRES64=r1, @ANYRES32, @ANYBLOB="1c005a8018000080140005"], 0x38}, 0x1, 0x0, 0x0, 0x50811}, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) remap_file_pages(&(0x7f0000636000/0x1000)=nil, 0x1000, 0x8, 0x6, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40000) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x5, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000100000000000000008000000850000003000000085000000500000009500000000010000"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x9, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xe, 0x0, &(0x7f0000000340)="e02753e868a10000000000000000", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) mkdirat(r0, &(0x7f0000000000)='./merge\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./upper\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./work\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x1ff) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a01040000000000000000070000000900000000797a300000000040000000030a01040000000000000000070000000900010073797a30000000ffffffff00000000300000000014000480080001400000000408000240ffffff3854000000e809010400000000000000000073797a30000000000900020073797a30000000002800048024000180090001006d6574610000000014000280080001400000000108000200000000000000"], 0xdc}}, 0x0) mount(0x0, &(0x7f00000000c0)='./merge\x00', &(0x7f0000000100)='zonefs\x00', 0x1, &(0x7f0000000240)='lowerdir=./lower,upperdir=./upper,workdir=./work,index=on,nfs_export=on\x00') r5 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x0, 0x0) open_by_handle_at(r5, &(0x7f0000000200)=ANY=[@ANYBLOB="1c000000f800000000000000fb19020100000200"/36], 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) mount(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000500)='binfmt_misc\x00', 0x3, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r2, &(0x7f0000000400)=[{&(0x7f0000000080)="8f9b5b0007e03dd651934dbfca91799a58f060", 0x13}, {&(0x7f00000001c0)="0100"/11, 0xb}, {&(0x7f00000003c0)="37a0a6c482b23cba92ffffff3f7b42590e180c07f3c193b532f3080000008c49ce65df4d", 0x24}], 0x58) kernel console output (not intermixed with test programs): 27][T17432] ? __ia32_compat_sys_io_submit+0x1a7/0x3b0 [ 682.976940][T17432] __ia32_compat_sys_io_submit+0x1a7/0x3b0 [ 682.976955][T17432] ? __pfx___ia32_compat_sys_io_submit+0x10/0x10 [ 682.976971][T17432] ? trace_syscall_enter+0xd9/0x110 [ 682.976985][T17432] ? rcu_is_watching+0x12/0xc0 [ 682.977000][T17432] __do_fast_syscall_32+0xe7/0x970 [ 682.977017][T17432] ? lockdep_hardirqs_on+0x78/0x100 [ 682.977033][T17432] do_fast_syscall_32+0x32/0x70 [ 682.977049][T17432] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 682.977064][T17432] RIP: 0023:0xf70befec [ 682.977079][T17432] Code: Unable to access opcode bytes at 0xf70befc2. [ 682.977084][T17432] RSP: 002b:00000000f547c50c EFLAGS: 00000292 ORIG_RAX: 00000000000000f8 [ 682.977096][T17432] RAX: ffffffffffffffda RBX: 00000000f547d000 RCX: 0000000000000001 [ 682.977102][T17432] RDX: 0000000080000300 RSI: 0000000000000000 RDI: 0000000000000000 [ 682.977109][T17432] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 682.977115][T17432] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 682.977121][T17432] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 682.977136][T17432] [ 683.138942][T17246] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 683.152231][ T5445] 8021q: adding VLAN 0 to HW filter on device eth7 [ 683.177910][T17246] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 683.186687][T17464] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2588'. [ 683.237335][ T5808] hsr_slave_0: left promiscuous mode [ 683.239690][ T5808] hsr_slave_1: left promiscuous mode [ 683.242182][ T5808] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 683.244941][ T5808] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 683.324915][ T5740] Bluetooth: hci1: command 0x041b tx timeout [ 683.390644][ T5808] team0 (unregistering): Port device team_slave_1 removed [ 683.409940][ T5808] team0 (unregistering): Port device team_slave_0 removed [ 683.448236][ T61] smc: removing ib device syz0 [ 683.469513][ T5733] usb 9-1: new high-speed USB device number 40 using dummy_hcd [ 683.541361][ T61] smbdirect: ib_dev[syz0] removed [ 683.641843][ T5733] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 683.648813][ T5733] usb 9-1: config index 0 descriptor too short (expected 45, got 36) [ 683.653683][ T5733] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 683.671438][ T5733] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 683.686304][T17246] team0: Port device team_slave_0 added [ 683.698616][ T5733] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 683.708646][T17246] team0: Port device team_slave_1 added [ 683.714085][ T5733] usb 9-1: config 0 descriptor?? [ 683.740080][ T5733] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 683.801205][T17246] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 683.807534][T17246] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 683.839447][T17246] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 683.859237][T17246] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 683.861484][T17246] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 683.889442][T17246] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 684.085302][T17246] hsr_slave_0: entered promiscuous mode [ 684.089586][T17246] hsr_slave_1: entered promiscuous mode [ 684.125093][ T5740] Bluetooth: hci0: command tx timeout [ 684.273540][ T5445] 8021q: adding VLAN 0 to HW filter on device eth8 [ 684.323629][T17566] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 684.328522][T17566] cramfs: wrong magic [ 685.292024][T17630] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2593'. [ 685.482633][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.594889][T17646] Invalid ELF header magic: != ELF [ 686.058482][ T5808] IPVS: stop unused estimator thread 0... [ 686.209664][ T5740] Bluetooth: hci0: command tx timeout [ 686.292610][ T5880] usb 9-1: USB disconnect, device number 40 [ 686.644138][T17246] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 686.662539][T17246] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 686.671671][T17246] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 686.675553][T17701] Invalid ELF header magic: != ELF [ 686.696588][T17246] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 686.705225][T17246] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 686.726264][T17246] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 686.732798][T17246] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 686.750208][T17246] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 686.978402][T17717] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2599'. [ 686.987961][T17246] 8021q: adding VLAN 0 to HW filter on device bond0 [ 687.036676][T17246] 8021q: adding VLAN 0 to HW filter on device team0 [ 687.076101][T17246] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 687.079466][T17246] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 687.090285][ T111] bridge0: port 1(bridge_slave_0) entered blocking state [ 687.092535][ T111] bridge0: port 1(bridge_slave_0) entered forwarding state [ 687.096201][ T111] bridge0: port 2(bridge_slave_1) entered blocking state [ 687.098533][ T111] bridge0: port 2(bridge_slave_1) entered forwarding state [ 687.761366][T17750] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 687.764048][T17750] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 687.789164][T17750] vhci_hcd vhci_hcd.0: Device attached [ 688.274909][ T5740] Bluetooth: hci0: command tx timeout [ 688.313451][T17246] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 688.500295][T17751] vhci_hcd: connection closed [ 688.511783][T17070] vhci_hcd vhci_hcd.0: stop threads [ 688.535367][T17070] vhci_hcd vhci_hcd.0: release socket [ 688.541985][T17070] vhci_hcd vhci_hcd.0: disconnect device [ 688.750663][T17246] veth0_vlan: entered promiscuous mode [ 688.784352][T17246] veth1_vlan: entered promiscuous mode [ 688.816768][T17246] veth0_macvtap: entered promiscuous mode [ 688.823740][T17246] veth1_macvtap: entered promiscuous mode [ 688.841386][T17246] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 688.867342][T17246] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 688.972192][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.987499][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.998466][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 689.014519][ T5808] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 689.113597][ T1163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 689.130179][ T1163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 689.148080][T17788] overlayfs: failed to verify origin (604/file1, ino=3470, err=-116) [ 689.151838][T17788] overlayfs: failed to verify origin (604/file1, ino=3470, err=-116) [ 689.183259][T17794] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2608'. [ 689.188978][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 689.197089][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 689.235991][ T5816] usb usb38-port1: attempt power cycle [ 689.460751][T17809] overlayfs: failed to verify origin (0/file1, ino=27, err=-116) [ 689.468953][T17809] overlayfs: failed to verify origin (0/file1, ino=27, err=-116) [ 689.755734][T16594] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 689.768687][T16594] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 689.783084][T16594] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 689.789424][T16594] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 689.799685][T16594] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 690.564442][T17814] wg2 speed is unknown, defaulting to 1000 [ 690.616520][ T5816] usb usb38-port1: unable to enumerate USB device [ 690.857111][T12068] bond0: (slave syz_tun): Releasing backup interface [ 691.007460][T17850] FAULT_INJECTION: forcing a failure. [ 691.007460][T17850] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 691.012906][T17850] CPU: 3 UID: 0 PID: 17850 Comm: syz.4.2615 Tainted: G L syzkaller #0 PREEMPT(full) [ 691.012936][T17850] Tainted: [L]=SOFTLOCKUP [ 691.012943][T17850] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 691.012955][T17850] Call Trace: [ 691.012962][T17850] [ 691.012970][T17850] dump_stack_lvl+0x100/0x190 [ 691.012998][T17850] should_fail_ex.cold+0x5/0xa [ 691.013032][T17850] ? prepare_alloc_pages+0x16d/0x5f0 [ 691.013062][T17850] should_fail_alloc_page+0xeb/0x140 [ 691.013091][T17850] prepare_alloc_pages+0x1f0/0x5f0 [ 691.013121][T17850] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 691.013149][T17850] ? rcu_is_watching+0x12/0xc0 [ 691.013172][T17850] ? trace_mm_page_alloc+0x164/0x1c0 [ 691.013199][T17850] ? __alloc_frozen_pages_noprof+0x2d1/0x2dc0 [ 691.013223][T17850] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 691.013246][T17850] ? pick_task_fair+0xe6/0x1bf0 [ 691.013271][T17850] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 691.013300][T17850] ? kvm_sched_clock_read+0x11/0x20 [ 691.013324][T17850] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 691.013343][T17850] ? sched_clock_cpu+0x6c/0x570 [ 691.013369][T17850] ? __pfx_sched_clock_cpu+0x10/0x10 [ 691.013394][T17850] ? find_held_lock+0x2b/0x80 [ 691.013412][T17850] ? __schedule+0x31d8/0x6730 [ 691.013428][T17850] ? __schedule+0x31d8/0x6730 [ 691.013450][T17850] alloc_pages_bulk_noprof+0x5de/0x13c0 [ 691.013476][T17850] ? policy_nodemask+0xed/0x4f0 [ 691.013504][T17850] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 691.013537][T17850] __kasan_populate_vmalloc+0xf0/0x210 [ 691.013563][T17850] alloc_vmap_area+0x95d/0x2bb0 [ 691.013601][T17850] ? kasan_save_track+0x14/0x30 [ 691.013625][T17850] ? __kasan_kmalloc+0xaa/0xb0 [ 691.013646][T17850] ? __pfx_alloc_vmap_area+0x10/0x10 [ 691.013672][T17850] ? __get_vm_area_node+0x101/0x330 [ 691.013701][T17850] __get_vm_area_node+0x1ca/0x330 [ 691.013732][T17850] __vmalloc_node_range_noprof+0x228/0x1630 [ 691.013761][T17850] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 691.013810][T17850] ? __bfs+0x150/0x2a0 [ 691.013835][T17850] ? __pfx_check_buffer+0x10/0x10 [ 691.013859][T17850] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 691.013896][T17850] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 691.013926][T17850] ? __bfs+0x150/0x2a0 [ 691.013958][T17850] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 691.013983][T17850] __vmalloc_node_noprof+0xad/0xf0 [ 691.014011][T17850] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 691.014040][T17850] __vmalloc_noprof+0xa3/0x120 [ 691.014067][T17850] ? __pfx___vmalloc_noprof+0x10/0x10 [ 691.014097][T17850] ? rcu_is_watching+0x12/0xc0 [ 691.014120][T17850] ? apparmor_capable+0x1d7/0x4d0 [ 691.014146][T17850] bpf_prog_alloc_no_stats+0x58/0x640 [ 691.014171][T17850] ? security_capable+0x80/0x260 [ 691.014194][T17850] bpf_prog_alloc+0x3b/0x200 [ 691.014218][T17850] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 691.014247][T17850] bpf_prog_load+0x1149/0x2fa0 [ 691.014275][T17850] ? __pfx_bpf_prog_load+0x10/0x10 [ 691.014320][T17850] __sys_bpf+0x18dc/0x4e80 [ 691.014348][T17850] ? __pfx___sys_bpf+0x10/0x10 [ 691.014371][T17850] ? find_held_lock+0x2b/0x80 [ 691.014391][T17850] ? __schedule+0x31d8/0x6730 [ 691.014412][T17850] ? __schedule+0x31d8/0x6730 [ 691.014439][T17850] ? __schedule+0x126e/0x6730 [ 691.014486][T17850] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 691.014519][T17850] ? trace_event_buffer_commit+0x1fc/0xa80 [ 691.014539][T17850] ? find_held_lock+0x2b/0x80 [ 691.014565][T17850] ? __ia32_sys_bpf+0xcc/0x170 [ 691.014584][T17850] __ia32_sys_bpf+0xcc/0x170 [ 691.014604][T17850] ? rcu_is_watching+0x12/0xc0 [ 691.014628][T17850] __do_fast_syscall_32+0xe7/0x970 [ 691.014655][T17850] ? lockdep_hardirqs_on+0x78/0x100 [ 691.014682][T17850] do_fast_syscall_32+0x32/0x70 [ 691.014710][T17850] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 691.014734][T17850] RIP: 0023:0xf709efec [ 691.014757][T17850] Code: Unable to access opcode bytes at 0xf709efc2. [ 691.014766][T17850] RSP: 002b:00000000f546c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 691.014785][T17850] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800003c0 [ 691.014794][T17850] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 691.014803][T17850] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 691.014815][T17850] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 691.014825][T17850] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 691.014845][T17850] [ 691.214569][T17850] syz.4.2615: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 691.222575][T17850] CPU: 3 UID: 0 PID: 17850 Comm: syz.4.2615 Tainted: G L syzkaller #0 PREEMPT(full) [ 691.222607][T17850] Tainted: [L]=SOFTLOCKUP [ 691.222614][T17850] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 691.222626][T17850] Call Trace: [ 691.222633][T17850] [ 691.222641][T17850] dump_stack_lvl+0x100/0x190 [ 691.222670][T17850] warn_alloc.cold+0x94/0xa8 [ 691.222690][T17850] ? __pfx_warn_alloc+0x10/0x10 [ 691.222711][T17850] ? lockdep_hardirqs_on+0x78/0x100 [ 691.222739][T17850] ? __get_vm_area_node+0x2cd/0x330 [ 691.222770][T17850] ? __get_vm_area_node+0x208/0x330 [ 691.222799][T17850] __vmalloc_node_range_noprof+0xccd/0x1630 [ 691.222831][T17850] ? __bfs+0x150/0x2a0 [ 691.222856][T17850] ? __pfx_check_buffer+0x10/0x10 [ 691.222885][T17850] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 691.222918][T17850] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 691.222946][T17850] ? __bfs+0x150/0x2a0 [ 691.222976][T17850] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 691.223000][T17850] __vmalloc_node_noprof+0xad/0xf0 [ 691.223027][T17850] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 691.223077][T17850] __vmalloc_noprof+0xa3/0x120 [ 691.223104][T17850] ? __pfx___vmalloc_noprof+0x10/0x10 [ 691.223134][T17850] ? rcu_is_watching+0x12/0xc0 [ 691.223157][T17850] ? apparmor_capable+0x1d7/0x4d0 [ 691.223181][T17850] bpf_prog_alloc_no_stats+0x58/0x640 [ 691.223204][T17850] ? security_capable+0x80/0x260 [ 691.223225][T17850] bpf_prog_alloc+0x3b/0x200 [ 691.223248][T17850] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 691.223276][T17850] bpf_prog_load+0x1149/0x2fa0 [ 691.223301][T17850] ? __pfx_bpf_prog_load+0x10/0x10 [ 691.223344][T17850] __sys_bpf+0x18dc/0x4e80 [ 691.223376][T17850] ? __pfx___sys_bpf+0x10/0x10 [ 691.223398][T17850] ? find_held_lock+0x2b/0x80 [ 691.223419][T17850] ? __schedule+0x31d8/0x6730 [ 691.223441][T17850] ? __schedule+0x31d8/0x6730 [ 691.223467][T17850] ? __schedule+0x126e/0x6730 [ 691.223512][T17850] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 691.223542][T17850] ? trace_event_buffer_commit+0x1fc/0xa80 [ 691.223562][T17850] ? find_held_lock+0x2b/0x80 [ 691.223584][T17850] ? __ia32_sys_bpf+0xcc/0x170 [ 691.223601][T17850] __ia32_sys_bpf+0xcc/0x170 [ 691.223619][T17850] ? rcu_is_watching+0x12/0xc0 [ 691.223641][T17850] __do_fast_syscall_32+0xe7/0x970 [ 691.223666][T17850] ? lockdep_hardirqs_on+0x78/0x100 [ 691.223691][T17850] do_fast_syscall_32+0x32/0x70 [ 691.223717][T17850] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 691.223740][T17850] RIP: 0023:0xf709efec [ 691.223762][T17850] Code: Unable to access opcode bytes at 0xf709efc2. [ 691.223770][T17850] RSP: 002b:00000000f546c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 691.223788][T17850] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800003c0 [ 691.223800][T17850] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 691.223810][T17850] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 691.223820][T17850] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 691.223831][T17850] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 691.223855][T17850] [ 691.223909][T17850] Mem-Info: [ 691.353021][T17850] active_anon:5720 inactive_anon:873 isolated_anon:0 [ 691.353021][T17850] active_file:3763 inactive_file:24001 isolated_file:0 [ 691.353021][T17850] unevictable:2734 dirty:759 writeback:0 [ 691.353021][T17850] slab_reclaimable:7905 slab_unreclaimable:60686 [ 691.353021][T17850] mapped:26610 shmem:1385 pagetables:1303 [ 691.353021][T17850] sec_pagetables:306 bounce:0 [ 691.353021][T17850] kernel_misc_reclaimable:0 [ 691.353021][T17850] free:46302 free_pcp:11122 free_cma:0 [ 691.371698][T17850] Node 0 active_anon:80kB inactive_anon:76kB active_file:8kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:2076kB dirty:8kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8032kB pagetables:1472kB sec_pagetables:1112kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 691.384888][T17850] Node 1 active_anon:22800kB inactive_anon:3416kB active_file:15044kB inactive_file:96004kB unevictable:10936kB isolated(anon):0kB isolated(file):0kB mapped:104364kB dirty:3028kB writeback:0kB shmem:5540kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:6144kB kernel_stack:6292kB pagetables:3740kB sec_pagetables:112kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 691.401343][T17850] Node 0 DMA free:2052kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:656kB local_pcp:268kB free_cma:0kB [ 691.420859][T17850] lowmem_reserve[]: 0 280 280 280 280 [ 691.423913][T17850] Node 0 DMA32 free:15784kB boost:0kB min:12776kB low:15968kB high:19160kB reserved_highatomic:0KB free_highatomic:0KB active_anon:80kB inactive_anon:76kB active_file:8kB inactive_file:0kB unevictable:0kB writepending:8kB zspages:0kB present:1032196kB managed:287068kB mlocked:0kB bounce:0kB free_pcp:10756kB local_pcp:1504kB free_cma:0kB [ 691.438532][T17850] lowmem_reserve[]: 0 0 0 0 0 [ 691.442609][T17850] Node 1 DMA32 free:167372kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:22800kB inactive_anon:3416kB active_file:15044kB inactive_file:96004kB unevictable:10936kB writepending:3028kB zspages:2392kB present:1048432kB managed:948212kB mlocked:6936kB bounce:0kB free_pcp:33060kB local_pcp:8328kB free_cma:0kB [ 691.457632][T17850] lowmem_reserve[]: 0 0 0 0 0 [ 691.460097][T17850] Node 0 DMA: 55*4kB (UM) 5*8kB (U) 2*16kB (UM) 7*32kB (U) 2*64kB (UM) 1*128kB (M) 1*256kB (M) 0*512kB 1*1024kB (M) 0*2048kB 0*4096kB = 2052kB [ 691.467461][T17850] Node 0 DMA32: 38*4kB (UME) 30*8kB (UE) 42*16kB (UME) 86*32kB (UE) 39*64kB (UME) 26*128kB (UME) 4*256kB (U) 6*512kB (UM) 2*1024kB (U) 0*2048kB 0*4096kB = 15784kB [ 691.478363][T17850] Node 1 DMA32: 719*4kB (UME) 812*8kB (UME) 396*16kB (UME) 182*32kB (UME) 205*64kB (UME) 155*128kB (UME) 93*256kB (UME) 56*512kB (UME) 7*1024kB (M) 2*2048kB (M) 12*4096kB (UM) = 167388kB [ 691.490425][T17850] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 691.494413][T17850] Node 0 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 691.498660][T17850] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 691.503847][T17850] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 691.507957][T17850] 29567 total pagecache pages [ 691.510068][T17850] 421 pages in swap cache [ 691.511978][T17850] Free swap = 120348kB [ 691.513735][T17850] Total swap = 124996kB [ 691.515712][T17850] 524155 pages RAM [ 691.517389][T17850] 0 pages HighMem/MovableOnly [ 691.519500][T17850] 211495 pages reserved [ 691.521321][T17850] 0 pages cma reserved [ 691.885343][T16594] Bluetooth: hci2: command tx timeout [ 692.043206][T17070] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.154654][T17814] bridge0: port 1(bridge_slave_0) entered blocking state [ 692.166285][T17814] bridge0: port 1(bridge_slave_0) entered disabled state [ 692.172136][T17814] bridge_slave_0: entered allmulticast mode [ 692.173537][T17814] bridge_slave_0: entered promiscuous mode [ 692.187384][T17814] bridge0: port 2(bridge_slave_1) entered blocking state [ 692.187662][T17814] bridge0: port 2(bridge_slave_1) entered disabled state [ 692.187813][T17814] bridge_slave_1: entered allmulticast mode [ 692.189179][T17814] bridge_slave_1: entered promiscuous mode [ 692.227873][T17070] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.285987][T17981] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2617'. [ 692.308777][T17814] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 692.317196][T17814] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 692.382479][T17070] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.462400][T17814] team0: Port device team_slave_0 added [ 692.467366][T18002] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2621'. [ 692.469257][T17814] team0: Port device team_slave_1 added [ 692.512622][T17814] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 692.516625][T17814] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 692.528519][T17814] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 692.553505][T17070] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.567058][T17814] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 692.573216][T17814] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 692.593579][T17814] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 692.724915][T17814] hsr_slave_0: entered promiscuous mode [ 692.729852][T17814] hsr_slave_1: entered promiscuous mode [ 692.735420][T17814] debugfs: 'hsr0' already exists in 'hsr' [ 692.739064][T17814] Cannot create hsr debugfs directory [ 693.851562][T17070] bridge_slave_0: left allmulticast mode [ 693.862869][T17070] bridge_slave_0: left promiscuous mode [ 693.873312][T17070] bridge0: port 1(bridge_slave_0) entered disabled state [ 693.955158][T16594] Bluetooth: hci2: command tx timeout [ 693.964431][T17070] bond2: left allmulticast mode [ 693.990213][T17070] batman_adv: batadv0: Interface deactivated: gretap1 [ 694.432889][T17070] batman_adv: batadv0: Removing interface: gretap1 [ 694.774220][T17070] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 694.791879][T17070] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 694.802026][T17070] bond0 (unregistering): Released all slaves [ 694.812312][T17070] bond1 (unregistering): Released all slaves [ 694.828115][T17070] bond2 (unregistering): Released all slaves [ 694.928312][ T5445] 8021q: adding VLAN 0 to HW filter on device eth1 [ 694.936097][T14106] wg2 speed is unknown, defaulting to 1000 [ 694.938032][T14106] syz2: Port: 1 Link DOWN [ 694.950872][T14106] wg2 speed is unknown, defaulting to 1000 [ 694.955586][T17070] tipc: Left network mode [ 695.250205][T18169] overlayfs: failed to verify origin (122/file1, ino=798, err=-116) [ 695.295371][T18169] overlayfs: failed to verify origin (122/file1, ino=798, err=-116) [ 695.359225][ T5445] 8021q: adding VLAN 0 to HW filter on device eth6 [ 695.955167][T17772] usb 9-1: new high-speed USB device number 41 using dummy_hcd [ 696.048518][T16594] Bluetooth: hci2: command tx timeout [ 696.117334][T17772] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 696.122827][T17772] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 696.128402][T17772] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 696.131656][T17772] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 696.137863][T18206] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 696.140502][T17070] hsr_slave_0: left promiscuous mode [ 696.142844][T17772] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 696.144986][T17070] hsr_slave_1: left promiscuous mode [ 696.148783][T17070] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 696.151130][T17070] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 696.160608][T17070] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 696.163308][T17070] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 696.174412][T17070] batman_adv: batadv0: Interface deactivated: veth0 [ 696.183949][T17070] batman_adv: batadv0: Removing interface: veth0 [ 696.211257][T17070] veth1_macvtap: left promiscuous mode [ 696.216947][T17070] veth0_macvtap: left promiscuous mode [ 696.222597][T17070] veth1_vlan: left promiscuous mode [ 696.228010][T17070] veth0_vlan: left promiscuous mode [ 696.530772][T18287] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 696.532980][T18287] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 696.544965][T18287] vhci_hcd vhci_hcd.0: Device attached [ 696.844930][T14106] usb 38-1: SetAddress Request (32) to port 0 [ 696.847247][T14106] usb 38-1: new SuperSpeed USB device number 32 using vhci_hcd [ 696.905812][T17772] usb 9-1: USB disconnect, device number 41 [ 697.069725][T17070] team0 (unregistering): Port device team_slave_1 removed [ 697.081884][T17070] team0 (unregistering): Port device team_slave_0 removed [ 697.110617][T18288] vhci_hcd: connection reset by peer [ 697.112745][ T13] vhci_hcd vhci_hcd.0: stop threads [ 697.114489][ T13] vhci_hcd vhci_hcd.0: release socket [ 697.124966][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 697.131551][ T111] smc: removing ib device syz2 [ 697.280095][T17814] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 697.300252][ T111] smbdirect: ib_dev[syz2] removed [ 697.315766][T17814] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 697.324445][T17814] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 697.438612][T17814] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 697.463858][T17814] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 697.500810][T17814] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 697.517015][T17814] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 697.650595][T17814] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 697.653742][T18311] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 697.689530][T18311] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 698.126404][T16594] Bluetooth: hci2: command tx timeout [ 698.251399][T18325] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 698.330843][T18325] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 698.633586][T17814] 8021q: adding VLAN 0 to HW filter on device bond0 [ 698.671461][T17814] 8021q: adding VLAN 0 to HW filter on device team0 [ 698.689031][T10769] bridge0: port 1(bridge_slave_0) entered blocking state [ 698.691370][T10769] bridge0: port 1(bridge_slave_0) entered forwarding state [ 698.736870][T10769] bridge0: port 2(bridge_slave_1) entered blocking state [ 698.739301][T10769] bridge0: port 2(bridge_slave_1) entered forwarding state [ 698.743680][T18346] overlayfs: missing 'lowerdir' [ 698.788099][T17814] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 698.792034][T17814] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 698.851880][T16594] Bluetooth: hci0: Ignoring connect complete event for invalid link type [ 698.913479][T18363] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2646'. [ 699.055815][T18376] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 699.058238][T18376] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 699.137089][T17070] IPVS: stop unused estimator thread 0... [ 699.214686][T17814] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 699.241691][T17814] veth0_vlan: entered promiscuous mode [ 699.249274][T17814] veth1_vlan: entered promiscuous mode [ 699.271639][T17814] veth0_macvtap: entered promiscuous mode [ 699.277541][T17814] veth1_macvtap: entered promiscuous mode [ 699.290187][T17814] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 699.302668][T17814] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 699.375204][T17070] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.387038][T17070] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.452456][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.473493][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.611957][ T1163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 699.622114][ T1163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 699.671450][T10769] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 699.677292][T10769] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 699.818076][T18410] overlayfs: missing 'lowerdir' [ 699.848616][T18411] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 699.850766][T18411] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 699.857198][T18411] vhci_hcd vhci_hcd.0: Device attached [ 700.075853][T18428] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 700.085617][T18428] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 700.277594][T18412] vhci_hcd: connection closed [ 700.277898][ T13] vhci_hcd vhci_hcd.0: stop threads [ 700.285943][ T13] vhci_hcd vhci_hcd.0: release socket [ 700.289143][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 701.081730][T18457] FAULT_INJECTION: forcing a failure. [ 701.081730][T18457] name failslab, interval 1, probability 0, space 0, times 0 [ 701.090775][T18457] CPU: 0 UID: 0 PID: 18457 Comm: syz.4.2660 Tainted: G L syzkaller #0 PREEMPT(full) [ 701.090805][T18457] Tainted: [L]=SOFTLOCKUP [ 701.090812][T18457] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 701.090824][T18457] Call Trace: [ 701.090831][T18457] [ 701.090839][T18457] dump_stack_lvl+0x100/0x190 [ 701.090869][T18457] should_fail_ex.cold+0x5/0xa [ 701.090891][T18457] should_failslab+0xc2/0x120 [ 701.090919][T18457] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 701.090944][T18457] ? __alloc_skb+0x5b7/0x710 [ 701.090969][T18457] ? __alloc_skb+0x140/0x710 [ 701.090996][T18457] __alloc_skb+0x140/0x710 [ 701.091044][T18457] ? __alloc_skb+0x5b7/0x710 [ 701.091068][T18457] ? __pfx___alloc_skb+0x10/0x10 [ 701.091099][T18457] netlink_alloc_large_skb+0x69/0x150 [ 701.091123][T18457] netlink_sendmsg+0x680/0xda0 [ 701.091154][T18457] ? __pfx_netlink_sendmsg+0x10/0x10 [ 701.091179][T18457] ? apparmor_socket_sendmsg+0x15b/0x270 [ 701.091205][T18457] ____sys_sendmsg+0xa4d/0xbe0 [ 701.091224][T18457] ? __pfx_netlink_sendmsg+0x10/0x10 [ 701.091247][T18457] ? __pfx_____sys_sendmsg+0x10/0x10 [ 701.091273][T18457] ? __pfx_trace_clock_local+0x10/0x10 [ 701.091305][T18457] ___sys_sendmsg+0x190/0x1e0 [ 701.091328][T18457] ? __pfx____sys_sendmsg+0x10/0x10 [ 701.091360][T18457] ? find_held_lock+0x2b/0x80 [ 701.091400][T18457] __sys_sendmsg+0x160/0x210 [ 701.091427][T18457] ? __pfx___sys_sendmsg+0x10/0x10 [ 701.091465][T18457] __do_fast_syscall_32+0xe7/0x970 [ 701.091492][T18457] ? lockdep_hardirqs_on+0x78/0x100 [ 701.091520][T18457] do_fast_syscall_32+0x32/0x70 [ 701.091546][T18457] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 701.091570][T18457] RIP: 0023:0xf709efec [ 701.091592][T18457] Code: Unable to access opcode bytes at 0xf709efc2. [ 701.091600][T18457] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 701.091619][T18457] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000240 [ 701.091631][T18457] RDX: 0000000004008014 RSI: 0000000000000000 RDI: 0000000000000000 [ 701.091641][T18457] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 701.091652][T18457] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 701.091662][T18457] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 701.091686][T18457] [ 701.176982][T18459] FAULT_INJECTION: forcing a failure. [ 701.176982][T18459] name failslab, interval 1, probability 0, space 0, times 0 [ 701.180983][T18459] CPU: 0 UID: 0 PID: 18459 Comm: syz.2.2659 Tainted: G L syzkaller #0 PREEMPT(full) [ 701.181003][T18459] Tainted: [L]=SOFTLOCKUP [ 701.181007][T18459] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 701.181014][T18459] Call Trace: [ 701.181019][T18459] [ 701.181024][T18459] dump_stack_lvl+0x100/0x190 [ 701.181043][T18459] should_fail_ex.cold+0x5/0xa [ 701.181056][T18459] should_failslab+0xc2/0x120 [ 701.181073][T18459] __kmalloc_noprof+0xfc/0x820 [ 701.181087][T18459] ? __pfx_dynamic_dname+0x10/0x10 [ 701.181105][T18459] ? tomoyo_encode2+0xfb/0x3c0 [ 701.181124][T18459] tomoyo_encode2+0xfb/0x3c0 [ 701.181141][T18459] tomoyo_encode+0x29/0x50 [ 701.181156][T18459] tomoyo_realpath_from_path+0x18c/0x690 [ 701.181175][T18459] tomoyo_path_number_perm+0x23c/0x580 [ 701.181189][T18459] ? tomoyo_path_number_perm+0x22e/0x580 [ 701.181204][T18459] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 701.181231][T18459] ? find_held_lock+0x2b/0x80 [ 701.181246][T18459] ? __fget_files+0x215/0x3d0 [ 701.181256][T18459] ? hook_file_ioctl_common+0x140/0x440 [ 701.181270][T18459] ? __fget_files+0x215/0x3d0 [ 701.181282][T18459] ? __fget_files+0x21f/0x3d0 [ 701.181294][T18459] security_file_ioctl_compat+0xd3/0x230 [ 701.181309][T18459] __ia32_compat_sys_ioctl+0xc2/0x360 [ 701.181328][T18459] __do_fast_syscall_32+0xe7/0x970 [ 701.181345][T18459] ? lockdep_hardirqs_on+0x78/0x100 [ 701.181360][T18459] do_fast_syscall_32+0x32/0x70 [ 701.181376][T18459] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 701.181391][T18459] RIP: 0023:0xf7f43fec [ 701.181407][T18459] Code: Unable to access opcode bytes at 0xf7f43fc2. [ 701.181412][T18459] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 701.181423][T18459] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000400452c8 [ 701.181430][T18459] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 701.181436][T18459] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 701.181442][T18459] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 701.181448][T18459] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 701.181469][T18459] [ 701.181481][T18459] ERROR: Out of memory at tomoyo_realpath_from_path. [ 701.279881][T18461] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2661'. [ 701.603802][T18479] 9p: Bad value for 'rfdno' [ 701.895951][T18477] overlayfs: failed to verify origin (6/file1, ino=60, err=-116) [ 701.901997][T18477] overlayfs: failed to verify origin (6/file1, ino=60, err=-116) [ 701.903460][T18483] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 701.955963][T14106] usb 38-1: device descriptor read/8, error -110 [ 701.981013][T18483] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 702.342038][T18494] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 702.347745][T18494] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 702.356036][T14106] usb usb38-port1: attempt power cycle [ 702.936038][T14106] usb usb38-port1: unable to enumerate USB device [ 703.051702][T18526] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 703.053896][T18526] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 703.064252][T18526] vhci_hcd vhci_hcd.0: Device attached [ 703.178297][ T5881] usb 7-1: new high-speed USB device number 103 using dummy_hcd [ 703.334914][T11813] usb 46-1: SetAddress Request (7) to port 0 [ 703.337165][T11813] usb 46-1: new SuperSpeed USB device number 7 using vhci_hcd [ 703.340609][ T5881] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 703.346538][ T5881] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 703.352000][ T5881] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 703.358872][ T5881] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 703.371127][T18522] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 703.380824][ T5881] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 703.927346][T18545] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2671'. [ 703.987991][T18548] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2672'. [ 704.140669][T16594] Bluetooth: hci0: Ignoring connect complete event for invalid link type [ 704.156250][T14189] usb 7-1: USB disconnect, device number 103 [ 704.232956][T18527] vhci_hcd: connection reset by peer [ 704.235203][T17070] vhci_hcd vhci_hcd.4: stop threads [ 704.238957][T17070] vhci_hcd vhci_hcd.4: release socket [ 704.249213][T17070] vhci_hcd vhci_hcd.4: disconnect device [ 705.753244][T18587] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 705.755365][T18587] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 705.780598][T18587] vhci_hcd vhci_hcd.0: Device attached [ 706.055034][ T5733] usb 42-1: SetAddress Request (42) to port 0 [ 706.057035][ T5733] usb 42-1: new SuperSpeed USB device number 42 using vhci_hcd [ 706.079350][T18596] 9p: Bad value for 'rfdno' [ 706.190046][T18588] vhci_hcd: connection reset by peer [ 706.192165][ T12] vhci_hcd vhci_hcd.2: stop threads [ 706.193987][ T12] vhci_hcd vhci_hcd.2: release socket [ 706.196265][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 707.068957][T16594] Bluetooth: hci2: Ignoring connect complete event for invalid link type [ 707.354905][T14106] usb 7-1: new high-speed USB device number 104 using dummy_hcd [ 707.505581][T14106] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 707.510856][T14106] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 707.514355][T14106] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 707.519282][T14106] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 707.529099][T18613] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 707.537325][T14106] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 708.212831][T18637] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2684'. [ 708.435004][T11813] usb 46-1: device descriptor read/8, error -110 [ 708.782298][ T5837] usb 7-1: USB disconnect, device number 104 [ 709.066044][T11813] usb usb46-port1: attempt power cycle [ 709.066747][T18657] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 709.073535][T18657] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 709.455811][T18683] 9p: Bad value for 'rfdno' [ 710.135112][T11813] usb usb46-port1: unable to enumerate USB device [ 710.462914][T18682] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 710.475264][T18682] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 711.154897][ T5733] usb 42-1: device descriptor read/8, error -110 [ 711.821857][ T5733] usb usb42-port1: attempt power cycle [ 712.629017][ T5733] usb usb42-port1: unable to enumerate USB device [ 712.847173][T18761] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2706'. [ 712.853454][T18761] bridge0: port 2(bridge_slave_1) entered disabled state [ 712.860872][T18761] bridge_slave_1 (unregistering): left allmulticast mode [ 712.863132][T18761] bridge_slave_1 (unregistering): left promiscuous mode [ 712.865826][T18761] bridge0: port 2(bridge_slave_1) entered disabled state [ 712.943956][T18772] 9p: Bad value for 'rfdno' [ 713.105649][T18773] 9p: Bad value for 'rfdno' [ 713.676883][T18779] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2711'. [ 713.981618][T18801] mac80211_hwsim hwsim13 wlan0: entered promiscuous mode [ 714.137240][T18813] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 714.140704][T18813] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 715.051370][T18847] 9p: Bad value for 'rfdno' [ 715.951420][T18867] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 715.954603][T18867] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 716.168673][T18875] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2726'. [ 716.172605][T18875] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2726'. [ 716.176305][T18875] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2726'. [ 716.246309][T18875] binder: 18872:18875 ioctl c0306201 80000040 returned -22 [ 716.722242][T18892] binder: 18887:18892 ioctl c0306201 80000040 returned -22 [ 716.725996][T18892] ublk2: read batch cmd buffer failed [ 716.727875][T18892] ublk2: read batch cmd buffer failed [ 717.045077][T18905] 9p: Bad value for 'rfdno' [ 717.914034][T18925] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 717.922279][T18925] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 718.731972][T18962] 9p: Bad value for 'rfdno' [ 719.102880][T18975] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 719.109761][T18975] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 719.412436][T18987] overlayfs: failed to verify origin (38/file1, ino=258, err=-116) [ 719.419132][T18987] overlayfs: failed to verify origin (38/file1, ino=258, err=-116) [ 719.667252][T18998] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2750'. [ 720.127163][T19018] overlayfs: failed to verify origin (30/file1, ino=219, err=-116) [ 720.129858][T19018] overlayfs: failed to verify origin (30/file1, ino=219, err=-116) [ 720.207203][T16594] Bluetooth: hci0: Ignoring connect complete event for invalid link type [ 720.466391][T19045] Invalid ELF header magic: != ELF [ 721.000249][T19064] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 721.002374][T19064] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 721.012082][T19064] vhci_hcd vhci_hcd.0: Device attached [ 721.274931][T11813] usb 42-1: SetAddress Request (46) to port 0 [ 721.276983][T11813] usb 42-1: new SuperSpeed USB device number 46 using vhci_hcd [ 721.280502][T16594] Bluetooth: hci1: Ignoring connect complete event for invalid link type [ 721.354963][T19065] vhci_hcd: connection reset by peer [ 721.357582][ T5808] vhci_hcd vhci_hcd.2: stop threads [ 721.359375][ T5808] vhci_hcd vhci_hcd.2: release socket [ 721.380480][ T5808] vhci_hcd vhci_hcd.2: disconnect device [ 721.658299][T19055] orangefs_mount: mount request failed with -4 [ 722.123073][T19101] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2778'. [ 722.250720][T19106] 9p: Bad value for 'rfdno' [ 722.801073][T19122] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2779'. [ 723.407668][T19150] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2788'. [ 723.436972][T19150] bridge0: port 2(bridge_slave_1) entered disabled state [ 723.544575][T19150] bridge_slave_1 (unregistering): left allmulticast mode [ 723.551832][T19150] bridge_slave_1 (unregistering): left promiscuous mode [ 723.558655][T19150] bridge0: port 2(bridge_slave_1) entered disabled state [ 723.964916][ T5733] usb 9-1: new high-speed USB device number 42 using dummy_hcd [ 723.979878][T19176] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 723.982637][T19176] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 724.005052][T19176] vhci_hcd vhci_hcd.0: Device attached [ 724.017227][T19179] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2793'. [ 724.115451][ T5733] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 724.120190][ T5733] usb 9-1: config index 0 descriptor too short (expected 45, got 36) [ 724.123156][ T5733] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 724.129902][ T5733] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 724.137568][ T5733] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 724.150062][ T5733] usb 9-1: config 0 descriptor?? [ 724.296733][T19177] vhci_hcd: connection closed [ 724.307365][ T24] usb 38-1: SetAddress Request (36) to port 0 [ 724.319645][ T5808] vhci_hcd vhci_hcd.0: stop threads [ 724.327108][ T24] usb 38-1: new SuperSpeed USB device number 36 using vhci_hcd [ 724.338854][ T5808] vhci_hcd vhci_hcd.0: release socket [ 724.349814][ T5808] vhci_hcd vhci_hcd.0: disconnect device [ 724.365376][ T24] usb 38-1: enqueue for inactive port 0 [ 724.630569][ T5733] usb 9-1: string descriptor 0 read error: -71 [ 724.640450][ T5733] usb 9-1: USB disconnect, device number 42 [ 724.827682][ T24] usb usb38-port1: attempt power cycle [ 725.307599][T19214] overlayfs: failed to verify origin (40/file1, ino=285, err=-116) [ 725.312297][T19214] overlayfs: failed to verify origin (40/file1, ino=285, err=-116) [ 725.421995][ T24] usb usb38-port1: unable to enumerate USB device [ 726.355091][T11813] usb 42-1: device descriptor read/8, error -110 [ 726.502005][T19252] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 726.509176][T19252] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 726.699191][T19223] netlink: 188 bytes leftover after parsing attributes in process `syz.4.2809'. [ 726.747743][T11813] usb usb42-port1: attempt power cycle [ 726.883406][T19275] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2803'. [ 727.129276][T19289] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 727.136790][T19289] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 727.177789][T19280] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2805'. [ 727.340459][T11813] usb usb42-port1: unable to enumerate USB device [ 727.965236][T19303] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 727.972477][T19303] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 728.548423][T11813] usb 7-1: new high-speed USB device number 105 using dummy_hcd [ 728.705711][T11813] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 728.709872][T11813] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 728.713445][T11813] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 728.717163][T11813] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 728.722483][T19329] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 728.728830][T11813] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 730.600829][ T5816] usb 7-1: USB disconnect, device number 105 [ 731.530350][T19429] overlayfs: failed to verify origin (175/file1, ino=1116, err=-116) [ 731.533386][T19429] overlayfs: failed to verify origin (175/file1, ino=1116, err=-116) [ 731.992635][T19459] fuse: Unknown parameter '0000000000000000000300000000000000000003' [ 732.369162][T19476] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 732.378561][T19476] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 732.405360][ T5733] usb 7-1: new high-speed USB device number 106 using dummy_hcd [ 732.555712][ T5733] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 732.561809][ T5733] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 732.568693][ T5733] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 732.572712][ T5733] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 732.584609][T19462] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 732.592617][ T5733] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 732.618564][T19504] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2844'. [ 733.160894][ T24] usb 7-1: USB disconnect, device number 106 [ 733.166318][T19522] vlan2: entered promiscuous mode [ 733.171036][T19522] hsr0: entered promiscuous mode [ 733.172970][T19522] vlan2: entered allmulticast mode [ 733.175677][T19522] hsr0: entered allmulticast mode [ 733.196005][T19522] hsr_slave_0: entered allmulticast mode [ 733.198983][T19522] hsr_slave_1: entered allmulticast mode [ 733.240727][T19522] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2850'. [ 733.245416][T19522] hsr_slave_0: left promiscuous mode [ 733.248897][T19522] hsr_slave_1: left promiscuous mode [ 733.543314][T19559] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2854'. [ 733.734541][T19576] FAULT_INJECTION: forcing a failure. [ 733.734541][T19576] name failslab, interval 1, probability 0, space 0, times 0 [ 733.738921][T19576] CPU: 3 UID: 0 PID: 19576 Comm: syz.3.2858 Tainted: G L syzkaller #0 PREEMPT(full) [ 733.738941][T19576] Tainted: [L]=SOFTLOCKUP [ 733.738945][T19576] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 733.738952][T19576] Call Trace: [ 733.738957][T19576] [ 733.738962][T19576] dump_stack_lvl+0x100/0x190 [ 733.738982][T19576] should_fail_ex.cold+0x5/0xa [ 733.738994][T19576] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 733.739008][T19576] should_failslab+0xc2/0x120 [ 733.739027][T19576] kmem_cache_alloc_noprof+0x91/0x6a0 [ 733.739042][T19576] ? skb_clone+0x190/0x400 [ 733.739061][T19576] skb_clone+0x190/0x400 [ 733.739077][T19576] netlink_deliver_tap+0xaed/0xcc0 [ 733.739093][T19576] netlink_unicast+0x62b/0x850 [ 733.739107][T19576] ? __pfx_netlink_unicast+0x10/0x10 [ 733.739123][T19576] netlink_sendmsg+0x8b0/0xda0 [ 733.739137][T19576] ? __pfx_netlink_sendmsg+0x10/0x10 [ 733.739152][T19576] ? apparmor_socket_sendmsg+0x15b/0x270 [ 733.739168][T19576] ____sys_sendmsg+0xa4d/0xbe0 [ 733.739179][T19576] ? __pfx_netlink_sendmsg+0x10/0x10 [ 733.739193][T19576] ? __pfx_____sys_sendmsg+0x10/0x10 [ 733.739207][T19576] ? __pfx_trace_clock_local+0x10/0x10 [ 733.739230][T19576] ___sys_sendmsg+0x190/0x1e0 [ 733.739243][T19576] ? __pfx____sys_sendmsg+0x10/0x10 [ 733.739261][T19576] ? find_held_lock+0x2b/0x80 [ 733.739285][T19576] __sys_sendmsg+0x160/0x210 [ 733.739300][T19576] ? __pfx___sys_sendmsg+0x10/0x10 [ 733.739322][T19576] __do_fast_syscall_32+0xe7/0x970 [ 733.739341][T19576] ? lockdep_hardirqs_on+0x78/0x100 [ 733.739357][T19576] do_fast_syscall_32+0x32/0x70 [ 733.739373][T19576] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 733.739388][T19576] RIP: 0023:0xf7f02fec [ 733.739402][T19576] Code: Unable to access opcode bytes at 0xf7f02fc2. [ 733.739407][T19576] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 733.739419][T19576] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000080 [ 733.739425][T19576] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 733.739431][T19576] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 733.739438][T19576] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 733.739444][T19576] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 733.739457][T19576] [ 733.739483][T19576] netlink: 'syz.3.2858': attribute type 1 has an invalid length. [ 733.828278][T19576] 8021q: adding VLAN 0 to HW filter on device bond1 [ 733.856192][T19583] bond1: entered allmulticast mode [ 733.875224][T19622] bridge_slave_0: invalid flags given to default FDB implementation [ 733.878890][T19622] bridge_slave_0: invalid flags given to default FDB implementation [ 733.992667][T19630] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2863'. [ 734.096485][ T24] usb 8-1: new high-speed USB device number 96 using dummy_hcd [ 734.239670][T19635] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2864'. [ 734.246290][ T24] usb 8-1: New USB device found, idVendor=0e41, idProduct=4159, bcdDevice=65.d2 [ 734.260060][ T24] usb 8-1: config 6 has an invalid interface number: 123 but max is 1 [ 734.265113][ T24] usb 8-1: config 6 has no interface number 1 [ 734.269537][ T24] usb 8-1: config 6 interface 0 altsetting 1 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 734.284696][ T24] usb 8-1: config 6 interface 0 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 734.293492][ T24] usb 8-1: config 6 interface 0 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 734.304445][ T24] usb 8-1: config 6 interface 0 altsetting 1 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 734.312255][ T24] usb 8-1: config 6 interface 0 altsetting 1 has a duplicate endpoint with address 0x3, skipping [ 734.319690][ T24] usb 8-1: config 6 interface 0 altsetting 1 bulk endpoint 0x9 has invalid maxpacket 32 [ 734.323973][ T24] usb 8-1: config 6 interface 0 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 734.329215][ T24] usb 8-1: config 6 interface 0 altsetting 1 endpoint 0xB has invalid maxpacket 1088, setting to 64 [ 734.333819][ T24] usb 8-1: config 6 interface 123 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 734.340867][ T24] usb 8-1: config 6 interface 123 altsetting 0 has a duplicate endpoint with address 0x9, skipping [ 734.348361][ T24] usb 8-1: config 6 interface 123 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 734.362814][ T24] usb 8-1: config 6 interface 0 has no altsetting 0 [ 734.379389][ T24] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 734.385625][ T24] usb 8-1: Product: syz [ 734.387317][ T24] usb 8-1: Manufacturer: syz [ 734.391925][ T24] usb 8-1: SerialNumber: syz [ 734.399227][T19576] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 734.608067][ T24] snd_usb_podhd 8-1:6.0: Line 6 POD HD500X found [ 734.617772][ T24] snd_usb_podhd 8-1:6.0: set_interface failed [ 734.640492][ T24] snd_usb_podhd 8-1:6.0: Line 6 POD HD500X now disconnected [ 734.644424][ T24] snd_usb_podhd 8-1:6.0: probe with driver snd_usb_podhd failed with error -71 [ 734.660657][ T24] usb 8-1: USB disconnect, device number 96 [ 734.742704][T19688] 9p: Bad value for 'rfdno' [ 734.745166][ T5733] usb 9-1: new high-speed USB device number 43 using dummy_hcd [ 734.895577][ T5733] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 734.903441][ T5733] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 734.911398][ T5733] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 734.916155][ T5733] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.924335][T19663] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 734.933115][ T5733] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 735.346471][T19706] overlayfs: failed to verify origin (67/file1, ino=432, err=-116) [ 735.350238][T19706] overlayfs: failed to verify origin (67/file1, ino=432, err=-116) [ 735.765149][ T5733] usb 9-1: USB disconnect, device number 43 [ 736.001486][T19737] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2877'. [ 736.041959][T19753] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2881'. [ 736.059700][T19755] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 736.062156][T19755] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 736.385923][T19777] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2883'. [ 736.395908][T19777] bridge0: port 2(bridge_slave_1) entered disabled state [ 736.420086][T19777] bridge_slave_1 (unregistering): left allmulticast mode [ 736.423487][T19777] bridge_slave_1 (unregistering): left promiscuous mode [ 736.433839][T19777] bridge0: port 2(bridge_slave_1) entered disabled state [ 736.538084][T19787] 9p: Bad value for 'rfdno' [ 737.457434][T19827] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2890'. [ 737.517088][T19829] kAFS: unparsable volume name [ 737.527203][T11813] usb 7-1: new high-speed USB device number 107 using dummy_hcd [ 737.735846][T19839] syzkaller0: entered promiscuous mode [ 737.738045][T19839] syzkaller0: entered allmulticast mode [ 737.824879][T11813] usb 7-1: Using ep0 maxpacket: 8 [ 737.827379][T11813] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 737.831492][T11813] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 737.834603][T11813] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 737.838151][T11813] usb 7-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 737.841984][T11813] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 737.845453][T11813] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 737.848545][T11813] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 737.852422][T11813] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 738.063796][T11813] usb 7-1: GET_CAPABILITIES returned 0 [ 738.065832][T11813] usbtmc 7-1:16.0: can't read capabilities [ 738.265454][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.269423][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.273200][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.276867][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.283915][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.286876][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.289791][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.292673][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.295568][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.300385][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.303527][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.306365][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.309214][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.312100][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.315069][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.317885][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 738.588441][T19858] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2899'. [ 739.962423][T19892] overlayfs: failed to verify origin (76/file1, ino=491, err=-116) [ 739.965341][T19892] overlayfs: failed to verify origin (76/file1, ino=491, err=-116) [ 740.156475][T19921] netlink: 188 bytes leftover after parsing attributes in process `syz.3.2907'. [ 740.298588][T11813] usb 7-1: USB disconnect, device number 107 [ 740.347596][T19943] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2910'. [ 740.798408][T19945] overlayfs: failed to verify origin (82/file1, ino=530, err=-116) [ 740.803314][T19945] overlayfs: failed to verify origin (82/file1, ino=530, err=-116) [ 741.124695][T19957] overlayfs: failed to verify origin (80/file1, ino=522, err=-116) [ 741.130600][T19957] overlayfs: failed to verify origin (80/file1, ino=522, err=-116) [ 741.671387][T19988] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2917'. [ 742.398453][T19995] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2924'. [ 742.573457][T19999] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2922'. [ 742.775516][T20007] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2925'. [ 742.817137][T20010] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 742.820108][T20010] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 743.041986][T20023] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 743.047548][T20023] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 743.349527][T20054] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 743.353239][T20054] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 743.771995][T20087] overlayfs: failed to verify origin (74/file1, ino=492, err=-116) [ 743.774680][T20087] overlayfs: failed to verify origin (74/file1, ino=492, err=-116) [ 743.868817][T20096] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 743.870977][T20096] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 743.876720][T20096] vhci_hcd vhci_hcd.0: Device attached [ 743.932031][T20101] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2937'. [ 744.184955][T17170] usb 46-1: SetAddress Request (11) to port 0 [ 744.187989][T17170] usb 46-1: new SuperSpeed USB device number 11 using vhci_hcd [ 744.345680][T20118] 9p: Bad value for 'rfdno' [ 744.588454][T20098] vhci_hcd: connection reset by peer [ 744.590560][ T12] vhci_hcd vhci_hcd.4: stop threads [ 744.593002][ T12] vhci_hcd vhci_hcd.4: release socket [ 744.599323][ T12] vhci_hcd vhci_hcd.4: disconnect device [ 744.651575][T20120] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2943'. [ 744.783221][T20129] overlayfs: failed to verify origin (85/file1, ino=562, err=-116) [ 744.786497][T20129] overlayfs: failed to verify origin (85/file1, ino=562, err=-116) [ 745.716086][T20164] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 745.718214][T20164] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 745.727222][T20164] vhci_hcd vhci_hcd.0: Device attached [ 745.972954][T20172] 9p: Bad value for 'rfdno' [ 746.270540][T20165] vhci_hcd: connection closed [ 746.270821][T17070] vhci_hcd vhci_hcd.4: stop threads [ 746.277553][T17070] vhci_hcd vhci_hcd.4: release socket [ 746.280104][T17070] vhci_hcd vhci_hcd.4: disconnect device [ 746.358021][T20180] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 746.366074][T20180] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 746.500338][T20190] netlink: 'syz.3.2961': attribute type 1 has an invalid length. [ 746.523132][T20190] 8021q: adding VLAN 0 to HW filter on device bond2 [ 746.548725][T20190] bond2: entered allmulticast mode [ 746.844882][T17784] usb 8-1: new high-speed USB device number 97 using dummy_hcd [ 746.918899][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 746.996108][T17784] usb 8-1: New USB device found, idVendor=0e41, idProduct=4159, bcdDevice=65.d2 [ 747.017242][T17784] usb 8-1: config 6 has an invalid interface number: 123 but max is 1 [ 747.024508][T17784] usb 8-1: config 6 has no interface number 1 [ 747.032281][T17784] usb 8-1: config 6 interface 0 altsetting 1 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 747.042657][T17784] usb 8-1: config 6 interface 0 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 747.059862][T17784] usb 8-1: config 6 interface 0 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 747.075685][T17784] usb 8-1: config 6 interface 0 altsetting 1 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 747.090287][T17784] usb 8-1: config 6 interface 0 altsetting 1 has a duplicate endpoint with address 0x3, skipping [ 747.109205][T17784] usb 8-1: config 6 interface 0 altsetting 1 bulk endpoint 0x9 has invalid maxpacket 32 [ 747.121441][T17784] usb 8-1: config 6 interface 0 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 747.135072][T17784] usb 8-1: config 6 interface 0 altsetting 1 endpoint 0xB has invalid maxpacket 1088, setting to 64 [ 747.151424][T17784] usb 8-1: config 6 interface 123 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 747.164115][T17784] usb 8-1: config 6 interface 123 altsetting 0 has a duplicate endpoint with address 0x9, skipping [ 747.177562][T17784] usb 8-1: config 6 interface 123 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 747.189752][T17784] usb 8-1: config 6 interface 0 has no altsetting 0 [ 747.200602][T17784] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 747.206420][T17784] usb 8-1: Product: syz [ 747.207844][T17784] usb 8-1: Manufacturer: syz [ 747.216256][T17784] usb 8-1: SerialNumber: syz [ 747.228715][T20190] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 747.410967][T20239] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2963'. [ 747.463853][T17784] snd_usb_podhd 8-1:6.0: Line 6 POD HD500X found [ 747.477005][T17784] snd_usb_podhd 8-1:6.0: set_interface failed [ 747.481531][T17784] snd_usb_podhd 8-1:6.0: Line 6 POD HD500X now disconnected [ 747.487449][T17784] snd_usb_podhd 8-1:6.0: probe with driver snd_usb_podhd failed with error -71 [ 747.521003][T17784] usb 8-1: USB disconnect, device number 97 [ 747.871862][T20271] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 747.875464][T20271] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 748.690116][T20295] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 748.692237][T20295] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 748.701323][T20295] vhci_hcd vhci_hcd.0: Device attached [ 748.885463][T20296] vhci_hcd: connection closed [ 748.885700][ T12] vhci_hcd vhci_hcd.4: stop threads [ 748.888898][ T12] vhci_hcd vhci_hcd.4: release socket [ 748.892997][ T12] vhci_hcd vhci_hcd.4: disconnect device [ 749.924006][T17170] usb 46-1: device descriptor read/8, error -110 [ 750.050965][T20307] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2974'. [ 750.080790][T20310] syzkaller0: entered promiscuous mode [ 750.083434][T20310] syzkaller0: entered allmulticast mode [ 750.930590][T17170] usb usb46-port1: attempt power cycle [ 750.992209][T20341] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 750.995931][T20341] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 751.489736][T17170] usb usb46-port1: unable to enumerate USB device [ 752.387139][T20396] FAULT_INJECTION: forcing a failure. [ 752.387139][T20396] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 752.391344][T20396] CPU: 2 UID: 0 PID: 20396 Comm: syz.4.2993 Tainted: G L syzkaller #0 PREEMPT(full) [ 752.391375][T20396] Tainted: [L]=SOFTLOCKUP [ 752.391380][T20396] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 752.391387][T20396] Call Trace: [ 752.391392][T20396] [ 752.391397][T20396] dump_stack_lvl+0x100/0x190 [ 752.391418][T20396] should_fail_ex.cold+0x5/0xa [ 752.391436][T20396] _copy_to_user+0x32/0xd0 [ 752.391458][T20396] simple_read_from_buffer+0xcb/0x170 [ 752.391481][T20396] proc_fail_nth_read+0x1af/0x230 [ 752.391499][T20396] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 752.391516][T20396] ? rw_verify_area+0xce/0x6d0 [ 752.391533][T20396] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 752.391549][T20396] vfs_read+0x1e4/0xb40 [ 752.391561][T20396] ? __pfx_vfs_read+0x10/0x10 [ 752.391570][T20396] ? find_held_lock+0x2b/0x80 [ 752.391585][T20396] ? __fget_files+0x215/0x3d0 [ 752.391599][T20396] ? __fget_files+0x21f/0x3d0 [ 752.391613][T20396] ksys_read+0x12a/0x250 [ 752.391624][T20396] ? __pfx_ksys_read+0x10/0x10 [ 752.391633][T20396] ? trace_syscall_enter+0xd9/0x110 [ 752.391650][T20396] do_int80_emulation+0x14b/0x720 [ 752.391668][T20396] asm_int80_emulation+0x1a/0x20 [ 752.391680][T20396] RIP: 0023:0xf71d74eb [ 752.391690][T20396] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 752.391701][T20396] RSP: 002b:00000000f548d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 752.391713][T20396] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f548d5d0 [ 752.391720][T20396] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 752.391726][T20396] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 752.391732][T20396] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 752.391739][T20396] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 752.391753][T20396] [ 754.023926][T20418] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2994'. [ 754.028320][T20418] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2994'. [ 754.032337][T20418] netlink: 'syz.2.2994': attribute type 12 has an invalid length. [ 754.036222][T20418] netlink: 'syz.2.2994': attribute type 13 has an invalid length. [ 754.068333][T20445] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3002'. [ 754.095582][T14106] usb 8-1: new high-speed USB device number 98 using dummy_hcd [ 754.145434][T20450] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3003'. [ 754.255837][T14106] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 754.260490][T14106] usb 8-1: config index 0 descriptor too short (expected 45, got 36) [ 754.266701][T14106] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 754.272295][T14106] usb 8-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 754.277240][T14106] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 754.286347][T14106] usb 8-1: config 0 descriptor?? [ 754.296264][T14106] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 754.764232][T20482] overlayfs: failed to verify origin (98/file1, ino=635, err=-116) [ 754.768032][T20482] overlayfs: failed to verify origin (98/file1, ino=635, err=-116) [ 755.064879][T14106] usb 7-1: new high-speed USB device number 108 using dummy_hcd [ 755.227222][T14106] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 755.233435][T14106] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 755.250289][T14106] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 755.256849][T14106] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 755.271856][T20485] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 755.294602][T14106] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 756.690160][T14106] usb 7-1: USB disconnect, device number 108 [ 756.864477][T11813] usb 8-1: USB disconnect, device number 98 [ 757.081611][T20570] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3020'. [ 757.141478][T20574] 9p: Bad value for 'rfdno' [ 757.455557][T20584] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 757.458673][T20584] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 757.461522][T20589] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3026'. [ 758.344913][T11813] usb 9-1: new high-speed USB device number 44 using dummy_hcd [ 758.461921][T20619] syzkaller0: entered promiscuous mode [ 758.464716][T20619] syzkaller0: entered allmulticast mode [ 758.766051][ T1350] usb 8-1: new high-speed USB device number 99 using dummy_hcd [ 758.781162][T11813] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 758.787383][T11813] usb 9-1: config index 0 descriptor too short (expected 45, got 36) [ 758.791505][T11813] usb 9-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 758.794578][T11813] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 758.799152][T11813] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 758.803412][T11813] usb 9-1: config 0 descriptor?? [ 758.808184][T11813] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 758.825654][T20644] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3037'. [ 758.927313][ T1350] usb 8-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 758.934561][ T1350] usb 8-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 758.940414][ T1350] usb 8-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 758.953617][ T1350] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 758.958637][T20623] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 758.963101][ T1350] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 759.355923][T20672] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 759.359723][T20672] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 759.519951][T20683] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 759.523238][T20683] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 759.949837][T20697] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 759.963961][T20697] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 759.983918][ T5816] usb 8-1: USB disconnect, device number 99 [ 760.402965][T20749] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3050'. [ 760.870089][T20759] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 760.872934][T20759] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 760.900491][T20759] vhci_hcd vhci_hcd.0: Device attached [ 761.026486][T17784] usb 9-1: USB disconnect, device number 44 [ 761.222856][T17170] usb 38-1: SetAddress Request (40) to port 0 [ 761.230995][T17170] usb 38-1: new SuperSpeed USB device number 40 using vhci_hcd [ 761.270698][T20761] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 761.272211][T20760] vhci_hcd: connection closed [ 761.277700][T13921] vhci_hcd vhci_hcd.0: stop threads [ 761.282097][T13921] vhci_hcd vhci_hcd.0: release socket [ 761.290384][T13921] vhci_hcd vhci_hcd.0: disconnect device [ 761.690500][T20789] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3055'. [ 762.155203][ T1350] usb 8-1: new high-speed USB device number 100 using dummy_hcd [ 762.308271][ T1350] usb 8-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 762.316819][ T1350] usb 8-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 762.320955][ T1350] usb 8-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 762.328786][ T1350] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 762.368190][T20806] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 762.435119][ T1350] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 765.093717][ T1350] usb 8-1: USB disconnect, device number 100 [ 765.437272][T20896] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3071'. [ 765.453906][T20898] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3072'. [ 766.202037][T20913] random: crng reseeded on system resumption [ 766.274989][T17170] usb 38-1: device descriptor read/8, error -110 [ 766.613710][T20918] faux_driver vgem: [drm] Unknown color mode 55545; guessing buffer size. [ 766.676346][T17170] usb usb38-port1: attempt power cycle [ 766.703884][T20927] FAULT_INJECTION: forcing a failure. [ 766.703884][T20927] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 766.709294][T20927] CPU: 2 UID: 0 PID: 20927 Comm: syz.4.3079 Tainted: G L syzkaller #0 PREEMPT(full) [ 766.709313][T20927] Tainted: [L]=SOFTLOCKUP [ 766.709317][T20927] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 766.709324][T20927] Call Trace: [ 766.709329][T20927] [ 766.709335][T20927] dump_stack_lvl+0x100/0x190 [ 766.709354][T20927] should_fail_ex.cold+0x5/0xa [ 766.709367][T20927] _copy_to_user+0x32/0xd0 [ 766.709387][T20927] simple_read_from_buffer+0xcb/0x170 [ 766.709407][T20927] proc_fail_nth_read+0x1af/0x230 [ 766.709439][T20927] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 766.709457][T20927] ? rw_verify_area+0xce/0x6d0 [ 766.709476][T20927] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 766.709497][T20927] vfs_read+0x1e4/0xb40 [ 766.709515][T20927] ? __pfx_vfs_read+0x10/0x10 [ 766.709528][T20927] ? find_held_lock+0x2b/0x80 [ 766.709551][T20927] ? __fget_files+0x215/0x3d0 [ 766.709573][T20927] ? __fget_files+0x21f/0x3d0 [ 766.709595][T20927] ksys_read+0x12a/0x250 [ 766.709611][T20927] ? __pfx_ksys_read+0x10/0x10 [ 766.709627][T20927] ? trace_syscall_enter+0xd9/0x110 [ 766.709654][T20927] do_int80_emulation+0x14b/0x720 [ 766.709685][T20927] asm_int80_emulation+0x1a/0x20 [ 766.709705][T20927] RIP: 0023:0xf71d74eb [ 766.709722][T20927] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 766.709738][T20927] RSP: 002b:00000000f548d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 766.709758][T20927] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f548d5d0 [ 766.709769][T20927] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 766.709779][T20927] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 766.709789][T20927] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 766.709799][T20927] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 766.709823][T20927] [ 767.060746][T20949] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3083'. [ 767.075801][T14106] usb 9-1: new high-speed USB device number 45 using dummy_hcd [ 767.103313][T20951] netlink: 188 bytes leftover after parsing attributes in process `syz.3.3084'. [ 767.247970][T14106] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 767.256771][T14106] usb 9-1: config index 0 descriptor too short (expected 45, got 36) [ 767.261785][T14106] usb 9-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 767.270559][T14106] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 767.274227][T17170] usb usb38-port1: unable to enumerate USB device [ 767.281459][T14106] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 767.287590][T20961] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3085'. [ 767.299986][T14106] usb 9-1: config 0 descriptor?? [ 767.315545][T14106] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 768.049536][T20969] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3087'. [ 768.058088][T20972] MTDSB: Device #1 doesn't appear to exist [ 768.058088][T20972] [ 768.467936][T20994] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 768.699420][T21008] netlink: 188 bytes leftover after parsing attributes in process `syz.2.3093'. [ 769.017008][T21024] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3095'. [ 769.536913][T21046] netlink: 188 bytes leftover after parsing attributes in process `syz.3.3102'. [ 769.747965][T21053] Bluetooth: MGMT ver 1.23 [ 769.749616][T21053] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 769.835080][ T5880] usb 9-1: USB disconnect, device number 45 [ 770.106021][T21082] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 770.108136][T21082] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 770.119638][T21082] vhci_hcd vhci_hcd.0: Device attached [ 770.212633][T21093] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 770.249740][T21097] netlink: 188 bytes leftover after parsing attributes in process `syz.3.3112'. [ 770.406472][ T5880] usb 38-1: SetAddress Request (44) to port 0 [ 770.408765][ T5880] usb 38-1: new SuperSpeed USB device number 44 using vhci_hcd [ 770.505827][T21085] vhci_hcd: connection reset by peer [ 770.510788][ T12] vhci_hcd vhci_hcd.0: stop threads [ 770.512475][ T12] vhci_hcd vhci_hcd.0: release socket [ 770.514500][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 770.650428][T14106] usb 9-1: new high-speed USB device number 46 using dummy_hcd [ 770.717376][T21111] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3114'. [ 770.805687][T14106] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 770.809734][T14106] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 770.813246][T14106] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 770.816361][T14106] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 770.821861][T21101] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 770.826283][T14106] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 770.934943][T17772] usb 7-1: new high-speed USB device number 109 using dummy_hcd [ 771.085924][T17772] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 771.092049][T17772] usb 7-1: config index 0 descriptor too short (expected 45, got 36) [ 771.094623][T17772] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 771.099547][T17772] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 771.103046][T17772] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 771.107973][T17772] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 771.112812][T17772] usb 7-1: config 0 descriptor?? [ 771.121140][T17772] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 771.129037][T21140] random: crng reseeded on system resumption [ 771.363548][T11813] usb 9-1: USB disconnect, device number 46 [ 772.184996][T21190] netlink: 188 bytes leftover after parsing attributes in process `syz.4.3125'. [ 772.223058][T21191] 9p: Bad value for 'rfdno' [ 772.521153][T21198] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3126'. [ 772.964999][T21207] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 772.968405][T21207] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 773.224859][T11813] usb 8-1: new high-speed USB device number 101 using dummy_hcd [ 773.307903][T21226] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3133'. [ 773.350025][T21229] netlink: 188 bytes leftover after parsing attributes in process `syz.4.3134'. [ 773.376045][T11813] usb 8-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 773.384680][T11813] usb 8-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 773.391250][T11813] usb 8-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 773.399430][T11813] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 773.408718][T21212] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 773.417075][T11813] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 773.784815][T17772] usb 7-1: USB disconnect, device number 109 [ 773.834530][T17170] usb 8-1: USB disconnect, device number 101 [ 773.873096][T21263] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3136'. [ 773.900910][T21263] netlink: 14 bytes leftover after parsing attributes in process `syz.2.3136'. [ 773.929082][T21263] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 773.989825][T21263] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 774.007121][T21263] bond0 (unregistering): Released all slaves [ 774.250414][T21298] geneve1: entered promiscuous mode [ 774.267205][T21298] veth1_to_hsr: entered promiscuous mode [ 774.328358][T21299] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3142'. [ 774.334368][T21303] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 774.431898][T21306] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 774.434020][T21306] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 774.438358][T21306] vhci_hcd vhci_hcd.0: Device attached [ 774.619008][T21310] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3143'. [ 774.705208][T17170] usb 42-1: SetAddress Request (50) to port 0 [ 774.710906][T17170] usb 42-1: new SuperSpeed USB device number 50 using vhci_hcd [ 775.057323][T21307] vhci_hcd: connection reset by peer [ 775.064643][ T5808] vhci_hcd vhci_hcd.2: stop threads [ 775.070300][ T5808] vhci_hcd vhci_hcd.2: release socket [ 775.073427][ T5808] vhci_hcd vhci_hcd.2: disconnect device [ 775.184996][ T56] usb 8-1: new high-speed USB device number 102 using dummy_hcd [ 775.336954][ T56] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 775.347178][ T56] usb 8-1: config index 0 descriptor too short (expected 45, got 36) [ 775.355162][ T56] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 775.366339][ T56] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 775.375024][ T56] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 775.380578][ T56] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 775.386255][ T56] usb 8-1: config 0 descriptor?? [ 775.405398][ T56] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 775.475027][ T5880] usb 38-1: device descriptor read/8, error -110 [ 775.865569][ T5880] usb usb38-port1: attempt power cycle [ 776.004910][T17784] usb 9-1: new high-speed USB device number 47 using dummy_hcd [ 776.117530][T21358] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3152'. [ 776.129869][T21365] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 776.132495][T21365] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 776.157184][T17784] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 776.161302][T17784] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 776.166517][T17784] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 776.169737][T17784] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 776.175405][T21352] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 776.181108][T17784] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 776.195264][ T5740] Bluetooth: hci2: command 0x0405 tx timeout [ 776.301655][T21397] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3157'. [ 776.307506][T21397] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3157'. [ 776.311448][T21397] comedi comedi1: dt2814: I/O base address or length out of range [ 776.448738][ T5880] usb usb38-port1: unable to enumerate USB device [ 776.459122][T21407] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3159'. [ 776.511957][T21409] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3160'. [ 776.687171][T17784] usb 9-1: USB disconnect, device number 47 [ 777.136249][T21432] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 777.138351][T21432] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 777.143940][T21432] vhci_hcd vhci_hcd.0: Device attached [ 777.682895][T21433] vhci_hcd: connection closed [ 777.684113][ T12] vhci_hcd vhci_hcd.2: stop threads [ 777.692617][ T12] vhci_hcd vhci_hcd.2: release socket [ 777.699965][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 777.817230][T21443] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3163'. [ 778.021142][ T41] usb 8-1: USB disconnect, device number 102 [ 778.288367][T21466] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 778.297455][T21466] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 778.791635][ T12] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 778.797008][ T12] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 778.801793][ T12] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 778.815443][ T12] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 779.329357][T21514] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 779.332195][T21514] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 779.343023][T21514] vhci_hcd vhci_hcd.0: Device attached [ 779.604904][T11813] usb 44-1: SetAddress Request (30) to port 0 [ 779.608428][T11813] usb 44-1: new SuperSpeed USB device number 30 using vhci_hcd [ 779.804946][T17170] usb 42-1: device descriptor read/8, error -110 [ 779.873595][T21543] 9p: Bad value for 'rfdno' [ 779.990070][T21515] vhci_hcd: connection reset by peer [ 779.993918][ T12] vhci_hcd vhci_hcd.3: stop threads [ 779.996964][ T12] vhci_hcd vhci_hcd.3: release socket [ 780.001259][ T12] vhci_hcd vhci_hcd.3: disconnect device [ 780.296242][T17170] usb usb42-port1: attempt power cycle [ 780.613989][T21550] fuse: fd is not a fuse device [ 780.732359][T21559] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3185'. [ 780.869028][T17170] usb usb42-port1: unable to enumerate USB device [ 780.901625][T21573] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 780.904722][T21573] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 781.223663][T21585] 9p: Bad value for 'rfdno' [ 781.764224][T21596] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 781.766369][T21596] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 781.769653][T21596] vhci_hcd vhci_hcd.0: Device attached [ 782.044955][T14189] usb 46-1: SetAddress Request (15) to port 0 [ 782.047202][T14189] usb 46-1: new SuperSpeed USB device number 15 using vhci_hcd [ 782.343622][T21597] vhci_hcd: connection reset by peer [ 782.346943][T13921] vhci_hcd vhci_hcd.4: stop threads [ 782.348658][T13921] vhci_hcd vhci_hcd.4: release socket [ 782.352361][T13921] vhci_hcd vhci_hcd.4: disconnect device [ 782.427957][T21621] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 782.433493][T21621] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 782.487938][T21627] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3200'. [ 782.755691][T21639] 9p: Bad value for 'rfdno' [ 782.929707][ T34] usb 8-1: new high-speed USB device number 103 using dummy_hcd [ 783.018154][T21643] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3203'. [ 783.085780][ T34] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 783.091117][ T34] usb 8-1: config index 0 descriptor too short (expected 45, got 36) [ 783.094728][ T34] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 783.099357][ T34] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 783.102499][ T34] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 783.106904][ T34] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 783.111782][T21651] XFS (mtdblock0): Invalid superblock magic number [ 783.113426][ T34] usb 8-1: config 0 descriptor?? [ 783.450459][T21672] netlink: 188 bytes leftover after parsing attributes in process `syz.4.3209'. [ 783.589655][ T34] usbhid 8-1:0.0: can't add hid device: -71 [ 783.591833][ T34] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 783.597440][ T34] usb 8-1: USB disconnect, device number 103 [ 783.768064][T21708] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 783.770100][T21708] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 783.780143][T21708] vhci_hcd vhci_hcd.0: Device attached [ 783.783820][T21712] random: crng reseeded on system resumption [ 783.831526][T21712] input: syz0 as /devices/virtual/input/input39 [ 784.064987][T14106] usb 38-1: SetAddress Request (48) to port 0 [ 784.068149][T14106] usb 38-1: new SuperSpeed USB device number 48 using vhci_hcd [ 784.117634][T21725] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3215'. [ 784.303260][T21738] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3218'. [ 784.555065][T21745] 9p: Bad value for 'rfdno' [ 784.585277][T21709] vhci_hcd: connection reset by peer [ 784.600956][ T12] vhci_hcd vhci_hcd.0: stop threads [ 784.602807][ T12] vhci_hcd vhci_hcd.0: release socket [ 784.604934][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 784.674992][T11813] usb 44-1: device descriptor read/8, error -110 [ 785.058269][T21758] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3222'. [ 785.077013][T11813] usb usb44-port1: attempt power cycle [ 785.114147][T21764] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3222'. [ 785.118128][T21764] netlink: 'syz.4.3222': attribute type 2 has an invalid length. [ 785.123942][T21764] netlink: 'syz.4.3222': attribute type 2 has an invalid length. [ 785.287079][T21780] random: crng reseeded on system resumption [ 785.308777][T21780] input: syz0 as /devices/virtual/input/input40 [ 785.421836][ T5816] usb 9-1: new high-speed USB device number 48 using dummy_hcd [ 785.601759][ T5816] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 785.619144][ T5816] usb 9-1: config index 0 descriptor too short (expected 45, got 36) [ 785.626757][ T5816] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 785.638907][ T5816] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 785.646226][ T5816] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 785.646364][T11813] usb usb44-port1: unable to enumerate USB device [ 785.658880][ T5816] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 785.737594][ T5816] usb 9-1: config 0 descriptor?? [ 786.264186][T21804] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 786.266909][T21804] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 786.281158][T21804] vhci_hcd vhci_hcd.0: Device attached [ 786.805338][ T5816] usbhid 9-1:0.0: can't add hid device: -71 [ 786.807296][ T5816] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 786.813424][ T5816] usb 9-1: USB disconnect, device number 48 [ 787.085994][T14189] usb 46-1: device descriptor read/8, error -110 [ 787.224607][T21805] vhci_hcd: connection closed [ 787.224739][ T13] vhci_hcd vhci_hcd.0: stop threads [ 787.228621][ T13] vhci_hcd vhci_hcd.0: release socket [ 787.231507][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 787.303977][T21836] 9p: Bad value for 'rfdno' [ 787.698695][T21848] random: crng reseeded on system resumption [ 787.746765][T21848] input: syz0 as /devices/virtual/input/input41 [ 787.766782][T14189] usb usb46-port1: attempt power cycle [ 787.886858][T21864] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3243'. [ 788.031415][T21872] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 788.035922][T21872] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 788.076410][ T5733] usb 9-1: new high-speed USB device number 49 using dummy_hcd [ 788.172673][T21884] random: crng reseeded on system resumption [ 788.199040][T21884] input: syz0 as /devices/virtual/input/input42 [ 788.225366][ T5733] usb 9-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 788.230151][ T5733] usb 9-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 788.235674][ T5733] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 788.246156][ T5733] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 788.249705][ T5733] usb 9-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 788.261416][ T5733] usb 9-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 788.264074][ T5733] usb 9-1: Product: syz [ 788.268506][ T5733] usb 9-1: Manufacturer: syz [ 788.275647][ T5733] cdc_wdm 9-1:1.0: probe with driver cdc_wdm failed with error -22 [ 788.346206][T14189] usb usb46-port1: unable to enumerate USB device [ 788.409756][T21898] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 788.411894][T21898] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 788.415350][T21898] vhci_hcd vhci_hcd.0: Device attached [ 788.673959][T21858] jffs2: notice: (21858) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 788.685577][ T1350] usb 42-1: SetAddress Request (54) to port 0 [ 788.687634][ T1350] usb 42-1: new SuperSpeed USB device number 54 using vhci_hcd [ 788.916109][T14189] usb 9-1: USB disconnect, device number 49 [ 789.104323][T21899] vhci_hcd: connection reset by peer [ 789.107690][ T5808] vhci_hcd vhci_hcd.2: stop threads [ 789.109543][ T5808] vhci_hcd vhci_hcd.2: release socket [ 789.111612][ T5808] vhci_hcd vhci_hcd.2: disconnect device [ 789.152169][T21917] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 789.154705][T21917] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 789.156904][T14106] usb 38-1: device descriptor read/8, error -110 [ 789.547230][T14106] usb usb38-port1: attempt power cycle [ 789.763947][T21937] 9p: Bad value for 'rfdno' [ 790.058874][T21943] random: crng reseeded on system resumption [ 790.138722][T14106] usb usb38-port1: unable to enumerate USB device [ 790.153479][T21944] input: syz0 as /devices/virtual/input/input43 [ 790.459933][T21964] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3256'. [ 790.715341][T14189] usb 9-1: new high-speed USB device number 50 using dummy_hcd [ 790.877681][T14189] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 790.895909][T14189] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 790.915232][T14189] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 790.941530][T14189] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 790.976236][T21968] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 791.046973][T14189] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 791.272087][T17170] usb 9-1: USB disconnect, device number 50 [ 792.772232][T22031] loop2: detected capacity change from 0 to 7 [ 792.810818][T22039] batman_adv: batadv0: Adding interface: veth0 [ 792.812961][T22039] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 792.820986][T22039] batman_adv: batadv0: Interface activated: veth0 [ 792.824873][T14106] usb 7-1: new high-speed USB device number 110 using dummy_hcd [ 792.828656][T22031] Dev loop2: unable to read RDB block 7 [ 792.831604][T22039] batman_adv: batadv0: Interface deactivated: veth0 [ 792.833587][T22031] loop2: unable to read partition table [ 792.840875][T22031] loop2: partition table beyond EOD, truncated [ 792.843526][T22031] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 792.848182][T22039] batman_adv: batadv0: Removing interface: veth0 [ 792.883009][T22052] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 792.885536][T22052] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 792.888620][T22052] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 792.891342][T22052] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 792.978639][T22062] 9p: Bad value for 'rfdno' [ 792.981500][T14106] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 792.987527][T14106] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 792.993191][T14106] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 793.086248][T14106] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 793.093072][T22025] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 793.110821][T14106] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 793.317870][T14189] usb 7-1: USB disconnect, device number 110 [ 793.380234][T22057] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3272'. [ 793.715016][ T1350] usb 42-1: device descriptor read/8, error -110 [ 793.906391][T22115] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 793.911298][T22115] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 794.102832][T22130] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 794.105019][T22130] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 794.105645][ T1350] usb usb42-port1: attempt power cycle [ 794.108945][T22130] vhci_hcd vhci_hcd.0: Device attached [ 794.272687][T22129] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3280'. [ 794.382537][T22145] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 794.384559][T22145] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 794.388694][T22145] vhci_hcd vhci_hcd.0: Device attached [ 794.395500][T14189] usb 46-1: SetAddress Request (19) to port 0 [ 794.399554][T14189] usb 46-1: new SuperSpeed USB device number 19 using vhci_hcd [ 794.612110][T22153] 9p: Bad value for 'rfdno' [ 794.674878][T17772] usb 44-1: SetAddress Request (34) to port 0 [ 794.773035][ T1350] usb usb42-port1: unable to enumerate USB device [ 794.783309][T17772] usb 44-1: new SuperSpeed USB device number 34 using vhci_hcd [ 794.812043][T22131] vhci_hcd: connection reset by peer [ 794.814263][ T5808] vhci_hcd vhci_hcd.4: stop threads [ 794.816313][ T5808] vhci_hcd vhci_hcd.4: release socket [ 794.818387][ T5808] vhci_hcd vhci_hcd.4: disconnect device [ 794.967663][T22146] vhci_hcd: connection reset by peer [ 794.970089][ T5808] vhci_hcd vhci_hcd.3: stop threads [ 794.971826][ T5808] vhci_hcd vhci_hcd.3: release socket [ 794.973799][ T5808] vhci_hcd vhci_hcd.3: disconnect device [ 795.332317][T22156] random: crng reseeded on system resumption [ 795.448192][T22156] input: syz0 as /devices/virtual/input/input44 [ 795.751214][T22194] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3290'. [ 795.848871][T22199] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3289'. [ 795.979905][T22204] 9p: Bad value for 'rfdno' [ 796.575927][T22212] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 796.578047][T22212] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 796.585414][T22212] vhci_hcd vhci_hcd.0: Device attached [ 796.838975][T22226] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 796.841195][T22226] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 797.133113][T22261] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3300'. [ 797.184863][ T34] usb 7-1: new high-speed USB device number 111 using dummy_hcd [ 797.210692][T22213] vhci_hcd: connection closed [ 797.211276][ T13] vhci_hcd vhci_hcd.3: stop threads [ 797.220512][ T13] vhci_hcd vhci_hcd.3: release socket [ 797.225317][ T13] vhci_hcd vhci_hcd.3: disconnect device [ 797.347518][ T34] usb 7-1: Using ep0 maxpacket: 32 [ 797.350659][ T34] usb 7-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 797.358553][ T34] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 797.361158][ T34] usb 7-1: config 0 has no interface number 0 [ 797.367794][ T34] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 797.372279][ T34] usb 7-1: Product: syz [ 797.373594][ T34] usb 7-1: Manufacturer: syz [ 797.375209][ T34] usb 7-1: SerialNumber: syz [ 797.380566][ T34] usb 7-1: config 0 descriptor?? [ 797.386252][ T34] usb 7-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 797.390891][ T34] usb 7-1: selecting invalid altsetting 1 [ 797.392860][ T34] usb 7-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 797.413766][ T34] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 797.424222][ T34] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 797.434893][ T34] usb 7-1: media controller created [ 797.453392][ T34] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 797.794393][T22285] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3303'. [ 797.957229][T22293] 9p: Could not find request transport: fd8rOdno=0x0000000000000006 [ 798.122843][T22301] FAULT_INJECTION: forcing a failure. [ 798.122843][T22301] name failslab, interval 1, probability 0, space 0, times 0 [ 798.150073][T22301] CPU: 2 UID: 0 PID: 22301 Comm: syz.3.3306 Tainted: G L syzkaller #0 PREEMPT(full) [ 798.150093][T22301] Tainted: [L]=SOFTLOCKUP [ 798.150098][T22301] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 798.150105][T22301] Call Trace: [ 798.150111][T22301] [ 798.150116][T22301] dump_stack_lvl+0x100/0x190 [ 798.150137][T22301] should_fail_ex.cold+0x5/0xa [ 798.150150][T22301] should_failslab+0xc2/0x120 [ 798.150167][T22301] __kmalloc_noprof+0xfc/0x820 [ 798.150182][T22301] ? sock_kmalloc+0x111/0x170 [ 798.150196][T22301] sock_kmalloc+0x111/0x170 [ 798.150208][T22301] skcipher_recvmsg+0x1d0/0xec0 [ 798.150243][T22301] ? __lock_acquire+0x450/0x1a40 [ 798.150256][T22301] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 798.150271][T22301] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 798.150284][T22301] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 798.150299][T22301] sock_recvmsg+0x1d5/0x220 [ 798.150312][T22301] ____sys_recvmsg+0x21e/0x670 [ 798.150325][T22301] ? __pfx_____sys_recvmsg+0x10/0x10 [ 798.150342][T22301] ? __lock_acquire+0x49f/0x1a40 [ 798.150353][T22301] ___sys_recvmsg+0x16a/0x1a0 [ 798.150366][T22301] ? __pfx____sys_recvmsg+0x10/0x10 [ 798.150389][T22301] do_recvmmsg+0x54d/0x740 [ 798.150402][T22301] ? __pfx_do_recvmmsg+0x10/0x10 [ 798.150445][T22301] ? trace_buffer_unlock_commit_regs+0x375/0x540 [ 798.150461][T22301] __sys_recvmmsg+0x21f/0x270 [ 798.150477][T22301] ? __pfx___sys_recvmmsg+0x10/0x10 [ 798.150494][T22301] ? trace_syscall_enter+0xd9/0x110 [ 798.150506][T22301] ? trace_syscall_enter+0xd9/0x110 [ 798.150519][T22301] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 798.150541][T22301] ? trace_syscall_enter+0xe3/0x110 [ 798.150553][T22301] __do_fast_syscall_32+0xe7/0x970 [ 798.150589][T22301] ? lockdep_hardirqs_on+0x78/0x100 [ 798.150605][T22301] do_fast_syscall_32+0x32/0x70 [ 798.150621][T22301] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 798.150636][T22301] RIP: 0023:0xf7f02fec [ 798.150652][T22301] Code: Unable to access opcode bytes at 0xf7f02fc2. [ 798.150657][T22301] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 798.150669][T22301] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800075c0 [ 798.150676][T22301] RDX: 0000000000000001 RSI: 0000000000000140 RDI: 0000000000000000 [ 798.150682][T22301] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 798.150688][T22301] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 798.150694][T22301] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 798.150715][T22301] [ 798.312626][T22304] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 798.315235][T22304] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 798.547583][T22325] random: crng reseeded on system resumption [ 798.600208][ T34] usb 7-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 798.604323][ T34] zl10353_read_register: readreg error (reg=127, ret==-110) [ 798.631168][T22327] input: syz0 as /devices/virtual/input/input45 [ 798.715148][T17170] usb 9-1: new high-speed USB device number 51 using dummy_hcd [ 798.724458][ T34] usb 7-1: USB disconnect, device number 111 [ 798.865742][T17170] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 798.875946][T17170] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 798.884988][T17170] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 559 [ 798.895017][T17170] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 798.901447][T22319] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 798.908775][T17170] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 799.038713][T22360] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 799.040760][T22360] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 799.043540][T22360] vhci_hcd vhci_hcd.0: Device attached [ 799.133540][T17170] usb 9-1: USB disconnect, device number 51 [ 799.376281][T22384] oom_control is deprecated and will be removed. Please report your usecase to linux-mm-@kvack.org if you depend on this functionality. [ 799.475273][T14189] usb 46-1: device descriptor read/8, error -110 [ 799.622357][T22361] vhci_hcd: connection closed [ 799.623013][T13921] vhci_hcd vhci_hcd.3: stop threads [ 799.627853][T13921] vhci_hcd vhci_hcd.3: release socket [ 799.629909][T13921] vhci_hcd vhci_hcd.3: disconnect device [ 799.726107][T22403] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 799.728968][T22403] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 799.865837][T14189] usb usb46-port1: attempt power cycle [ 799.875189][T17772] usb 44-1: device descriptor read/8, error -110 [ 799.882641][T22418] random: crng reseeded on system resumption [ 799.949344][T22419] input: syz0 as /devices/virtual/input/input46 [ 800.286534][T17772] usb usb44-port1: attempt power cycle [ 800.364737][T22427] 9p: Bad value for 'rfdno' [ 800.534970][T14189] usb usb46-port1: unable to enumerate USB device [ 800.802609][T22442] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3322'. [ 800.815008][T22444] xt_cgroup: path and classid specified [ 801.025789][T17772] usb usb44-port1: unable to enumerate USB device [ 801.199690][T22473] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3330'. [ 801.257307][T22477] random: crng reseeded on system resumption [ 801.336963][T22479] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 801.339154][T22479] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 801.342315][T22479] vhci_hcd vhci_hcd.0: Device attached [ 801.615232][T17772] usb 44-1: SetAddress Request (38) to port 0 [ 801.618977][T17772] usb 44-1: new SuperSpeed USB device number 38 using vhci_hcd [ 801.844742][T22485] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3333'. [ 801.882911][T22480] vhci_hcd: connection reset by peer [ 801.885849][ T5808] vhci_hcd vhci_hcd.3: stop threads [ 801.888738][ T5808] vhci_hcd vhci_hcd.3: release socket [ 801.890774][ T5808] vhci_hcd vhci_hcd.3: disconnect device [ 802.323609][T22511] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 802.327443][T22511] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 802.639591][T22536] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3342'. [ 802.704642][T22538] random: crng reseeded on system resumption [ 802.788754][T22538] input: syz0 as /devices/virtual/input/input48 [ 802.948588][T22554] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3346'. [ 803.555349][T22581] netlink: 'syz.2.3354': attribute type 3 has an invalid length. [ 803.596775][T22586] random: crng reseeded on system resumption [ 803.671572][T22588] input: syz0 as /devices/virtual/input/input49 [ 803.751094][T22595] FAULT_INJECTION: forcing a failure. [ 803.751094][T22595] name failslab, interval 1, probability 0, space 0, times 0 [ 803.751128][T22595] CPU: 0 UID: 0 PID: 22595 Comm: syz.2.3356 Tainted: G L syzkaller #0 PREEMPT(full) [ 803.751144][T22595] Tainted: [L]=SOFTLOCKUP [ 803.751148][T22595] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 803.751156][T22595] Call Trace: [ 803.751161][T22595] [ 803.751166][T22595] dump_stack_lvl+0x100/0x190 [ 803.751184][T22595] should_fail_ex.cold+0x5/0xa [ 803.751198][T22595] should_failslab+0xc2/0x120 [ 803.751216][T22595] __kmalloc_noprof+0xfc/0x820 [ 803.751231][T22595] ? bit_cursor+0x938/0x14e0 [ 803.751247][T22595] bit_cursor+0x938/0x14e0 [ 803.751263][T22595] ? __pfx_bit_cursor+0x10/0x10 [ 803.751275][T22595] ? enable_work+0x295/0x320 [ 803.751290][T22595] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 803.751315][T22595] ? get_color+0x1da/0x450 [ 803.751332][T22595] ? __pfx_bit_cursor+0x10/0x10 [ 803.751343][T22595] fbcon_cursor+0x43c/0x5e0 [ 803.751353][T22595] ? add_softcursor+0x220/0x290 [ 803.751369][T22595] set_cursor+0x1db/0x250 [ 803.751382][T22595] con_write+0x89/0xb0 [ 803.751398][T22595] n_tty_write+0x431/0x1160 [ 803.751415][T22595] ? __pfx_n_tty_write+0x10/0x10 [ 803.751425][T22595] ? __kasan_kmalloc+0xaa/0xb0 [ 803.751440][T22595] ? __pfx_woken_wake_function+0x10/0x10 [ 803.751454][T22595] ? rcu_is_watching+0x12/0xc0 [ 803.751468][T22595] ? file_tty_write.isra.0+0x694/0x890 [ 803.751483][T22595] ? kfree+0x1e5/0x6c0 [ 803.751493][T22595] ? __pfx_n_tty_write+0x10/0x10 [ 803.751504][T22595] file_tty_write.isra.0+0x4d2/0x890 [ 803.751522][T22595] vfs_write+0x6ac/0x1050 [ 803.751534][T22595] ? __pfx_tty_write+0x10/0x10 [ 803.751550][T22595] ? __pfx_vfs_write+0x10/0x10 [ 803.751559][T22595] ? find_held_lock+0x2b/0x80 [ 803.751582][T22595] ksys_write+0x12a/0x250 [ 803.751593][T22595] ? __pfx_ksys_write+0x10/0x10 [ 803.751602][T22595] ? trace_syscall_enter+0xd9/0x110 [ 803.751618][T22595] __do_fast_syscall_32+0xe7/0x970 [ 803.751635][T22595] ? lockdep_hardirqs_on+0x78/0x100 [ 803.751651][T22595] do_fast_syscall_32+0x32/0x70 [ 803.751667][T22595] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 803.751682][T22595] RIP: 0023:0xf7f43fec [ 803.751696][T22595] Code: Unable to access opcode bytes at 0xf7f43fc2. [ 803.751701][T22595] RSP: 002b:00000000f53e550c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 803.751712][T22595] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080002080 [ 803.751718][T22595] RDX: 0000000000001006 RSI: 0000000000000000 RDI: 0000000000000000 [ 803.751724][T22595] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 803.751731][T22595] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 803.751736][T22595] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 803.751750][T22595] [ 804.133545][T22615] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3358'. [ 804.176141][T22620] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3360'. [ 805.055182][T22649] random: crng reseeded on system resumption [ 805.159114][T22666] input: syz0 as /devices/virtual/input/input50 [ 805.326987][ T5740] Bluetooth: hci0: command 0x0406 tx timeout [ 805.498159][T22704] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 805.500763][T22704] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 805.704894][T17784] usb 8-1: new high-speed USB device number 104 using dummy_hcd [ 805.774994][T22713] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3370'. [ 805.855565][T17784] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 805.866405][T22721] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 805.868537][T22721] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 805.875304][T22721] vhci_hcd vhci_hcd.0: Device attached [ 806.155152][T17784] usb 8-1: config index 0 descriptor too short (expected 45, got 36) [ 806.157910][T17784] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 806.161283][T17784] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 806.164328][T17784] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 806.168441][T17784] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 806.172331][T17784] usb 8-1: config 0 descriptor?? [ 806.178355][T17170] usb 46-1: SetAddress Request (23) to port 0 [ 806.180365][T17170] usb 46-1: new SuperSpeed USB device number 23 using vhci_hcd [ 806.368565][T22728] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3374'. [ 806.371870][T22722] vhci_hcd: connection reset by peer [ 806.373785][T13921] vhci_hcd vhci_hcd.4: stop threads [ 806.376015][T13921] vhci_hcd vhci_hcd.4: release socket [ 806.380613][T13921] vhci_hcd vhci_hcd.4: disconnect device [ 806.675515][T17772] usb 44-1: device descriptor read/8, error -110 [ 806.731158][T22738] random: crng reseeded on system resumption [ 806.942882][T17784] usbhid 8-1:0.0: can't add hid device: -71 [ 806.944850][T17784] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 807.065892][T17772] usb usb44-port1: attempt power cycle [ 807.207758][T22750] input: syz1 as /devices/virtual/input/input52 [ 807.241587][T22740] input: syz0 as /devices/virtual/input/input51 [ 807.403016][T17784] usb 8-1: USB disconnect, device number 104 [ 807.708688][T17772] usb usb44-port1: unable to enumerate USB device [ 807.936339][ T1350] usb 7-1: new high-speed USB device number 112 using dummy_hcd [ 808.028317][T22798] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3383'. [ 808.056762][T22802] random: crng reseeded on system resumption [ 808.105784][ T1350] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 808.157168][ T1350] usb 7-1: config 27 has an invalid descriptor of length 113, skipping remainder of the config [ 808.164112][ T1350] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 808.175101][ T1350] usb 7-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 808.182864][ T1350] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 808.209676][T22803] input: syz0 as /devices/virtual/input/input53 [ 808.327712][ T1350] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 808.364902][ T1350] usb 7-1: invalid MIDI out EP 0 [ 808.369010][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.425572][T22815] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 808.425594][T22815] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 808.425721][T22815] vhci_hcd vhci_hcd.0: Device attached [ 808.579424][T17784] usb 8-1: new high-speed USB device number 105 using dummy_hcd [ 809.125976][T22828] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3378'. [ 809.294894][T17784] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 809.372330][T17784] usb 8-1: config index 0 descriptor too short (expected 45, got 36) [ 809.375204][T17784] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 809.378605][T17784] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 809.381623][T17784] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 809.385154][T22818] vhci_hcd: connection closed [ 809.385868][T17784] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 809.393099][T17784] usb 8-1: config 0 descriptor?? [ 809.397026][ T12] vhci_hcd vhci_hcd.4: stop threads [ 809.398900][ T12] vhci_hcd vhci_hcd.4: release socket [ 809.400865][ T12] vhci_hcd vhci_hcd.4: disconnect device [ 809.513883][ T1350] snd-usb-audio 7-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 809.529955][ T1350] usb 7-1: USB disconnect, device number 112 [ 809.576638][T22852] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 809.613781][ T42] kauditd_printk_skb: 11 callbacks suppressed [ 809.613797][ T42] audit: type=1326 audit(1786386450.144:10556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22851 comm="syz.0.3388" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 809.624653][ T42] audit: type=1326 audit(1786386450.144:10557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22851 comm="syz.0.3388" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 809.633691][ T42] audit: type=1326 audit(1786386450.144:10558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22851 comm="syz.0.3388" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 809.640739][ T42] audit: type=1326 audit(1786386450.144:10559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22851 comm="syz.0.3388" exe="/syz-executor" sig=0 arch=40000003 syscall=313 compat=1 ip=0xf70befec code=0x7ffc0000 [ 809.649074][ T42] audit: type=1326 audit(1786386450.144:10560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22851 comm="syz.0.3388" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 809.659741][ T42] audit: type=1326 audit(1786386450.154:10561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22851 comm="syz.0.3388" exe="/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf70befec code=0x7ffc0000 [ 809.671486][ T42] audit: type=1326 audit(1786386450.154:10562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22851 comm="syz.0.3388" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 809.678162][T16594] Bluetooth: hci1: SCO packet for unknown connection handle 0 [ 809.682267][ T42] audit: type=1326 audit(1786386450.154:10563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22851 comm="syz.0.3388" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf70befec code=0x7ffc0000 [ 809.697565][ T42] audit: type=1326 audit(1786386450.154:10564): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22851 comm="syz.0.3388" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 809.704478][ T42] audit: type=1326 audit(1786386450.154:10565): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22851 comm="syz.0.3388" exe="/syz-executor" sig=0 arch=40000003 syscall=150 compat=1 ip=0xf70befec code=0x7ffc0000 [ 810.319610][T17784] usbhid 8-1:0.0: can't add hid device: -71 [ 810.326807][T17784] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 810.339225][T17784] usb 8-1: USB disconnect, device number 105 [ 810.679637][T22895] random: crng reseeded on system resumption [ 810.777376][T22898] input: syz0 as /devices/virtual/input/input54 [ 810.918184][T22904] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3398'. [ 810.922039][T22903] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 810.924110][T22903] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 810.937307][T22903] vhci_hcd vhci_hcd.0: Device attached [ 811.205031][T17784] usb 42-1: SetAddress Request (58) to port 0 [ 811.214669][T17784] usb 42-1: new SuperSpeed USB device number 58 using vhci_hcd [ 811.235759][T17170] usb 46-1: device descriptor read/8, error -110 [ 811.540365][T22905] vhci_hcd: connection reset by peer [ 811.542852][ T12] vhci_hcd vhci_hcd.2: stop threads [ 811.544526][ T12] vhci_hcd vhci_hcd.2: release socket [ 811.550591][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 811.634572][T22915] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3399'. [ 811.641207][T17170] usb usb46-port1: attempt power cycle [ 811.970075][T22932] pch_udc 0000:00:03.0: dma_pool_destroy data_requests busy [ 811.972854][T22932] pch_udc 0000:00:03.0: dma_pool_destroy setup requests busy [ 812.207173][T22941] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3404'. [ 812.217475][T17170] usb usb46-port1: unable to enumerate USB device [ 812.434842][ T5733] usb 7-1: new high-speed USB device number 113 using dummy_hcd [ 812.585706][ T5733] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 812.593758][ T5733] usb 7-1: config index 0 descriptor too short (expected 45, got 36) [ 812.598050][T22957] random: crng reseeded on system resumption [ 812.599668][ T5733] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 812.607790][ T5733] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 812.612082][ T5733] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 812.618898][ T5733] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 812.625443][ T5733] usb 7-1: config 0 descriptor?? [ 812.694048][T22961] input: syz0 as /devices/virtual/input/input55 [ 813.261718][T22968] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3409'. [ 813.324343][ T5733] usbhid 7-1:0.0: can't add hid device: -71 [ 813.337604][ T5733] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 813.352232][ T5733] usb 7-1: USB disconnect, device number 113 [ 813.703450][T22999] syzkaller0: entered promiscuous mode [ 813.705928][T22999] syzkaller0: entered allmulticast mode [ 813.949126][T23014] Oops: general protection fault, probably for non-canonical address 0xdffffc0020001469: 0000 [#1] SMP KASAN NOPTI [ 813.952883][T23014] KASAN: maybe wild-memory-access in range [0x000000010000a348-0x000000010000a34f] [ 813.955852][T23014] CPU: 2 UID: 0 PID: 23014 Comm: syz.0.3413 Tainted: G L syzkaller #0 PREEMPT(full) [ 813.959161][T23014] Tainted: [L]=SOFTLOCKUP [ 813.960507][T23014] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 813.963629][T23014] RIP: 0010:__release_resource+0x89/0x2c0 [ 813.965447][T23014] Code: 00 48 8b 5b 38 48 85 db 0f 84 46 01 00 00 49 bd 00 00 00 00 00 fc ff df eb 28 e8 62 03 41 00 48 8d 6b 30 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 97 01 00 00 48 8b 5b 30 48 85 db 0f 84 12 01 [ 813.971188][T23014] RSP: 0000:ffffc900064b7b10 EFLAGS: 00010206 [ 813.973086][T23014] RAX: 0000000020001469 RBX: 000000010000a31b RCX: ffffc90030de6000 [ 813.975517][T23014] RDX: 0000000000080000 RSI: ffffffff81c8cc3e RDI: ffff88802132a5c8 [ 813.977999][T23014] RBP: 000000010000a34b R08: 0000000000000001 R09: fffff52000c96f5d [ 813.980445][T23014] R10: 0000000000000003 R11: 0000000000000000 R12: ffff88802132a5a0 [ 813.982909][T23014] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000001 [ 813.985413][T23014] FS: 0000000000000000(0000) GS:ffff888096df3000(0063) knlGS:00000000f548cb40 [ 813.988200][T23014] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 813.990288][T23014] CR2: 00000000f7278b50 CR3: 000000004b6d7000 CR4: 0000000000352ef0 [ 813.992751][T23014] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 813.995128][T23014] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 813.997581][T23014] Call Trace: [ 813.998548][T23014] [ 813.999505][T23014] release_resource+0x26/0x40 [ 814.001007][T23014] pci_remove_bus_device+0x2d3/0x3b0 [ 814.002666][T23014] pci_stop_and_remove_bus_device_locked+0x1a/0x20 [ 814.004579][T23014] remove_store+0x123/0x140 [ 814.005956][T23014] ? __pfx_remove_store+0x10/0x10 [ 814.007496][T23014] ? find_held_lock+0x2b/0x80 [ 814.008935][T23014] ? sysfs_file_kobj+0xe4/0x290 [ 814.010398][T23014] ? sysfs_file_kobj+0xe4/0x290 [ 814.011907][T23014] ? __pfx_remove_store+0x10/0x10 [ 814.013451][T23014] dev_attr_store+0x58/0x80 [ 814.014900][T23014] ? __pfx_dev_attr_store+0x10/0x10 [ 814.016532][T23014] sysfs_kf_write+0xf2/0x150 [ 814.017963][T23014] kernfs_fop_write_iter+0x3e0/0x5f0 [ 814.019609][T23014] ? __pfx_sysfs_kf_write+0x10/0x10 [ 814.021286][T23014] vfs_write+0x6ac/0x1050 [ 814.022680][T23014] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 814.024521][T23014] ? __pfx_vfs_write+0x10/0x10 [ 814.026060][T23014] ? find_held_lock+0x2b/0x80 [ 814.027568][T23014] ksys_write+0x12a/0x250 [ 814.028938][T23014] ? __pfx_ksys_write+0x10/0x10 [ 814.030517][T23014] ? trace_syscall_enter+0xd9/0x110 [ 814.032162][T23014] __do_fast_syscall_32+0xe7/0x970 [ 814.033793][T23014] do_fast_syscall_32+0x32/0x70 [ 814.035384][T23014] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 814.037375][T23014] RIP: 0023:0xf70befec [ 814.038696][T23014] Code: Unable to access opcode bytes at 0xf70befc2. [ 814.040808][T23014] RSP: 002b:00000000f548c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 814.043445][T23014] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000140 [ 814.045931][T23014] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 814.048443][T23014] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 814.050922][T23014] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 814.053399][T23014] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 814.055876][T23014] [ 814.056861][T23014] Modules linked in: [ 814.058682][T23014] ---[ end trace 0000000000000000 ]--- [ 814.061000][T23014] RIP: 0010:__release_resource+0x89/0x2c0 [ 814.062983][T23014] Code: 00 48 8b 5b 38 48 85 db 0f 84 46 01 00 00 49 bd 00 00 00 00 00 fc ff df eb 28 e8 62 03 41 00 48 8d 6b 30 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 97 01 00 00 48 8b 5b 30 48 85 db 0f 84 12 01 [ 814.069113][T23014] RSP: 0000:ffffc900064b7b10 EFLAGS: 00010206 [ 814.071038][T23014] RAX: 0000000020001469 RBX: 000000010000a31b RCX: ffffc90030de6000 [ 814.073620][T23014] RDX: 0000000000080000 RSI: ffffffff81c8cc3e RDI: ffff88802132a5c8 [ 814.076220][T23014] RBP: 000000010000a34b R08: 0000000000000001 R09: fffff52000c96f5d [ 814.078599][T23014] R10: 0000000000000003 R11: 0000000000000000 R12: ffff88802132a5a0 [ 814.081029][T23014] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000001 [ 814.083525][T23014] FS: 0000000000000000(0000) GS:ffff888096df3000(0063) knlGS:00000000f548cb40 [ 814.086365][T23014] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 814.088452][T23014] CR2: 00000000f70bf000 CR3: 000000004b6d7000 CR4: 0000000000352ef0 [ 814.090972][T23014] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 814.093469][T23014] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 814.096011][T23014] Kernel panic - not syncing: Fatal exception [ 814.098525][T23014] Kernel Offset: disabled [ 814.099901][T23014] Rebooting in 86400 seconds..