last executing test programs: 7.803426938s ago: executing program 2 (id=1272): ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x10000, 0x1000000, &(0x7f0000000000/0x1000000)=nil, 0x0, r2}) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f0000000340)={0x10000, 0x1000000}) (async) r4 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0x29, &(0x7f0000000100)=0x9, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x1, 0x10, &(0x7f0000000000)=@framed={{}, [@snprintf={{}, {}, {0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb6}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x20}, 0x94) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) capset(&(0x7f00000000c0)={0x20071026}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) openat$ptmx(0xffffffffffffff9c, 0x0, 0x40980, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000003300), 0x40002, 0x0) r7 = syz_usb_connect(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x0, 0xb9, 0x56, 0xda, 0x2}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r7, &(0x7f0000000bc0)={0x24, 0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="00030c0000"], 0x0, 0x0}, 0x0) 4.441873607s ago: executing program 2 (id=1280): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3fff}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x52, '\x00', 0x0, @fallback=0x9af8dba271b76fd5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df12c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f00000005c0), 0x10) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) 3.484486229s ago: executing program 2 (id=1284): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3fff}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x52, '\x00', 0x0, @fallback=0x9af8dba271b76fd5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df12c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f00000005c0), 0x10) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) 3.437755781s ago: executing program 0 (id=1285): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3fff}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x52, '\x00', 0x0, @fallback=0x9af8dba271b76fd5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df12c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f00000005c0), 0x10) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) 3.188207834s ago: executing program 3 (id=1287): socket(0x2, 0x3, 0xff) close(0x3) syz_genetlink_get_family_id$gtp(0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffffff, &(0x7f0000000480)='./file0\x00', 0xae) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r1) r2 = socket$packet(0x11, 0x2, 0x300) getsockname$packet(r2, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket(0x200000000000011, 0x2, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=@ipv6_newrule={0x24, 0x18, 0x409, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x1e, 0x1}]}, 0x24}}, 0x80) sendmsg$nl_route(r5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xc8000, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x800}) 3.186842824s ago: executing program 3 (id=1288): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3fff}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x52, '\x00', 0x0, @fallback=0x9af8dba271b76fd5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df12c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f00000005c0), 0x10) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) 2.538726104s ago: executing program 2 (id=1290): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b00)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x4c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=ANY=[@ANYBLOB], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r1, 0x70, &(0x7f0000000100)}, 0x1c) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x80800) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_WAIT_VBLANK(r2, 0xc018643a, &(0x7f0000000040)={0x10000000, 0x1c6a8b68, 0x6}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r2, 0xc05064a7, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0)=[0x0], &(0x7f0000000340), 0x0, 0x1, 0x0, 0x0, r3}) r5 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x9) ioctl$TCSETAW(r5, 0x5407, &(0x7f0000000180)={0x2, 0x7, 0x2, 0xfb45, 0x3, "0d5f078393b87ad2"}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r2, 0xc01064ab, &(0x7f0000000380)={0x1, r4, r3}) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) r6 = creat(0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x100, 0x8, '\x00', 0x0, @fallback=0x30, r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffba, 0x0, 0x0, 0x0, 0x9}, 0x94) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x265, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4}}}}}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r7, 0x89b0, &(0x7f0000000080)={'veth0_to_hsr\x00', &(0x7f0000000100)=@ethtool_channels={0x1, 0x1, 0x0, 0x1000, 0x0, 0xffffdffc, 0x3, 0xfffffffc}}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001800410100000000ffdbdf2502180000ff0000080000000208000100ac1414"], 0x3c}}, 0x40) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x68, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4, 0x2}}}}}}, 0x0) 2.538020369s ago: executing program 0 (id=1291): madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0400f9f407000904018002200000000000000000000800010000000000", 0x24) sendmsg$SEG6_CMD_GET_TUNSRC(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140), 0xc, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x20000040}, 0x4008811) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) userfaultfd(0x1) writev(0xffffffffffffffff, 0x0, 0x0) r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000480), 0xa6f81, 0x0) r1 = syz_open_dev$video4linux(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_S_FMT(r1, 0xc0585605, &(0x7f0000000100)={0x1, 0x0, {0x280, 0x1e0, 0x3014}}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50}, 0x24000085) add_key$user(&(0x7f0000000200), 0x0, 0x0, 0x0, 0xfffffffffffffffd) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000180)=0x6f) r2 = dup2(r0, r0) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f00000001c0)=0x2) read$FUSE(r2, &(0x7f00000063c0)={0x2020}, 0xfffffffffffffe46) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) 1.936980467s ago: executing program 3 (id=1294): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x2, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x104) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB], 0x0, 0x63, 0x0, 0x1}, 0x28) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x24, 0x23, 0x9, 0x70bd25, 0x25dfd3ff, {0x1}, [@typed={0x8, 0x1, 0x0, 0x0, @ipv4=@loopback}, @typed={0x8, 0xb, 0x0, 0x0, @uid}]}, 0x24}, 0x1, 0x0, 0x0, 0x24040811}, 0x8410) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) recvfrom(r0, &(0x7f0000000180)=""/233, 0xe9, 0x40000002, 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000004c0)=@gcm_128={{0x303}, "b7a41f23ed0500", "d21b0e8a0e000000000000000600", "1d000006", "0b18d1465e7cb56e"}, 0x28) openat$kvm(0xffffff9c, &(0x7f0000000000), 0x501b80, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(r0, &(0x7f0000000ac0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000500)=""/245, 0xf5}], 0x1, &(0x7f0000000640)=""/16, 0x10}, 0x3}], 0x1, 0x23, 0x0) sendto$inet6(r0, &(0x7f0000000140)="d0", 0x1, 0x0, 0x0, 0x0) 1.936442999s ago: executing program 1 (id=1295): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b00)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x4c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=ANY=[@ANYBLOB], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r1, 0x70, &(0x7f0000000100)}, 0x1c) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x80800) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_WAIT_VBLANK(r2, 0xc018643a, &(0x7f0000000040)={0x10000000, 0x1c6a8b68, 0x6}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r2, 0xc05064a7, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0)=[0x0], &(0x7f0000000340), 0x0, 0x1, 0x0, 0x0, r3}) r5 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x9) ioctl$TCSETAW(r5, 0x5407, &(0x7f0000000180)={0x2, 0x7, 0x2, 0xfb45, 0x3, "0d5f078393b87ad2"}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r2, 0xc01064ab, &(0x7f0000000380)={0x1, r4, r3}) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) creat(&(0x7f00000001c0)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x265, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4}}}}}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r6, 0x89b0, &(0x7f0000000080)={'veth0_to_hsr\x00', &(0x7f0000000100)=@ethtool_channels={0x1, 0x1, 0x0, 0x1000, 0x0, 0xffffdffc, 0x3, 0xfffffffc}}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001800410100000000ffdbdf2502180000ff0000080000000208000100ac1414"], 0x3c}}, 0x40) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x68, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4, 0x2}}}}}}, 0x0) 1.78909926s ago: executing program 2 (id=1296): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3fff}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x52, '\x00', 0x0, @fallback=0x9af8dba271b76fd5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df12c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f00000005c0), 0x10) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) 1.738699329s ago: executing program 1 (id=1297): socket(0x2, 0x3, 0xff) close(0x3) syz_genetlink_get_family_id$gtp(0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffffff, &(0x7f0000000480)='./file0\x00', 0xae) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r1) r2 = socket$packet(0x11, 0x2, 0x300) getsockname$packet(r2, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket(0x200000000000011, 0x2, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=@ipv6_newrule={0x24, 0x18, 0x409, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x1e, 0x1}]}, 0x24}}, 0x80) sendmsg$nl_route(r5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xc8000, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x800}) 1.648824961s ago: executing program 1 (id=1298): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3fff}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x52, '\x00', 0x0, @fallback=0x9af8dba271b76fd5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df12c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f00000005c0), 0x10) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) 1.610973599s ago: executing program 0 (id=1299): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$DVB_DVR_DMX_DQBUF(0xffffffffffffffff, 0xc0186f40, &(0x7f0000000040)={0x1, 0x20000000, 0x9, 0xb, 0x8, 0x6}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x9}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0xc50}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xff, 0x0, 0x4, 0x6, 0x7f, 0x20c}, {0xf1c2, 0x3, 0x38, 0xf, 0x84, 0x7, 0x3, 0x50, 0x0, 0x5, 0x4, 0x5, 0x3a}], 0xffffffff}) openat$vimc2(0xffffffffffffff9c, &(0x7f0000003240), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002b40), r3) sendmsg$NLBL_MGMT_C_ADD(r3, &(0x7f0000002c40)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="b0010000", @ANYRES16=r4, @ANYBLOB="010023bd7000fedbdf25010000000800040003000000790101006e016cb1d76a742f6cdc827b5620b8326361700083f2a64c36eb3be6d9a71b736ab02496daf52f9c74db40822d972e4fd677cee5e1496b5eeea93d98dff053960f72329cdc0790cc1938f30d968f4d2a46a25937c3fd1b722e3c1bbd295e9faa72ae78705725f74cc91d3ab1c566e34b7ba3b1d54ef4596a9f7a0377d38f11ef438da9fe22543d3489e653364729ef8c0f6daba4150b8415df87c88224182e7edf5992f5d963d82ece795aedfbd23286c751d599f34d6273b46e8d2304997142460d0fa9213cbe6e0a80326c05491e0080fd1affaa3d5219c64cb32e2f39b8570ad173bac5f8da28fe9c7479b03a5045eed21736104cf99a1de8cb93c98d1ec53cc86da02e60788818e923f40eb5748235941ba011618dabbf4c880efbc3b1ab04264bcf2d19e40094a8c6e14cb8321e64a657ed7faf4d37abc952efcf6770943e5d666be915934bde5544556451b7c419d3dacd913b436090279b80f0b7c71e620ee2aab98b8d98ca96e1bf5d8bc7aabb36a266d8000000080002"], 0x1b0}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000080) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(0xffffffffffffffff, 0x29, 0x3b, &(0x7f00000002c0)={0x3c, 0x3, '\x00', [@jumbo={0xc2, 0x4, 0x2}, @enc_lim={0x4, 0x1, 0x4}, @pad1, @calipso={0x7, 0x10, {0x0, 0x2, 0x7f, 0x9, [0x100000000]}}]}, 0x28) ioctl$KVM_RUN(r2, 0xae80, 0x0) socket(0x2a, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f00000001c0)={0x9, r1, 'id1\x00'}) ioctl$HIDIOCGRAWNAME(r5, 0x80404804, &(0x7f0000000240)) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000080)={0x50, 0x0, 0x0, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001c00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x24, 0x20040011}}], 0x1, 0x80) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) 1.058380931s ago: executing program 3 (id=1300): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b00)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x4c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=ANY=[@ANYBLOB], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r1, 0x70, &(0x7f0000000100)}, 0x1c) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x80800) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_WAIT_VBLANK(r2, 0xc018643a, &(0x7f0000000040)={0x10000000, 0x1c6a8b68, 0x6}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r2, 0xc05064a7, 0x0) r4 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x9) ioctl$TCSETAW(r4, 0x5407, &(0x7f0000000180)={0x2, 0x7, 0x2, 0xfb45, 0x3, "0d5f078393b87ad2"}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r2, 0xc01064ab, &(0x7f0000000380)={0x1, 0x0, r3}) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) r5 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x100, 0x8, '\x00', 0x0, @fallback=0x30, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffba, 0x0, 0x0, 0x0, 0x9}, 0x94) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x265, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4}}}}}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r6, 0x89b0, &(0x7f0000000080)={'veth0_to_hsr\x00', &(0x7f0000000100)=@ethtool_channels={0x1, 0x1, 0x0, 0x1000, 0x0, 0xffffdffc, 0x3, 0xfffffffc}}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001800410100000000ffdbdf2502180000ff0000080000000208000100ac1414"], 0x3c}}, 0x40) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x68, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4, 0x2}}}}}}, 0x0) 766.246981ms ago: executing program 0 (id=1301): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b00)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x4c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=ANY=[@ANYBLOB], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r1, 0x70, &(0x7f0000000100)}, 0x1c) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc018643a, &(0x7f0000000040)={0x10000000, 0x1c6a8b68, 0x6}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0)=[0x0], &(0x7f0000000340), 0x0, 0x1, 0x0, 0x0, r2}) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x9) ioctl$DRM_IOCTL_MODE_SETPROPERTY(0xffffffffffffffff, 0xc01064ab, &(0x7f0000000380)={0x1, r3, r2}) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) creat(&(0x7f00000001c0)='./file0\x00', 0x0) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x265, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4}}}}}}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89b0, &(0x7f0000000080)={'veth0_to_hsr\x00', 0x0}) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x68, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4, 0x2}}}}}}, 0x0) 765.720117ms ago: executing program 0 (id=1302): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b00)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x4c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=ANY=[@ANYBLOB], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r1, 0x70, &(0x7f0000000100)}, 0x1c) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x80800) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_WAIT_VBLANK(r2, 0xc018643a, &(0x7f0000000040)={0x10000000, 0x1c6a8b68, 0x6}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r2, 0xc05064a7, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0)=[0x0], &(0x7f0000000340), 0x0, 0x1, 0x0, 0x0, r3}) r5 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x9) ioctl$TCSETAW(r5, 0x5407, &(0x7f0000000180)={0x2, 0x7, 0x2, 0xfb45, 0x3, "0d5f078393b87ad2"}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r2, 0xc01064ab, &(0x7f0000000380)={0x1, r4, r3}) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) creat(&(0x7f00000001c0)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x265, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4}}}}}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r6, 0x89b0, &(0x7f0000000080)={'veth0_to_hsr\x00', &(0x7f0000000100)=@ethtool_channels={0x1, 0x1, 0x0, 0x1000, 0x0, 0xffffdffc, 0x3, 0xfffffffc}}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001800410100000000ffdbdf2502180000ff0000080000000208000100ac1414"], 0x3c}}, 0x40) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x68, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4, 0x2}}}}}}, 0x0) 765.35244ms ago: executing program 2 (id=1303): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x2, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x104) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="9febfa001800000000000000440500004400000007000007000006040000000500000028040000000200000001000000ffffffff01000000020000db07b3a10010000000050000000e000000070000000d0000000d00000000000000006100000000"], 0x0, 0x63, 0x0, 0x1}, 0x28) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x24, 0x23, 0x9, 0x70bd25, 0x25dfd3ff, {0x1}, [@typed={0x8, 0x1, 0x0, 0x0, @ipv4=@loopback}, @typed={0x8, 0xb, 0x0, 0x0, @uid}]}, 0x24}, 0x1, 0x0, 0x0, 0x24040811}, 0x8410) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) recvfrom(r0, &(0x7f0000000180)=""/233, 0xe9, 0x40000002, 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000004c0)=@gcm_128={{0x303}, "b7a41f23ed0500", "d21b0e8a0e000000000000000600", "1d000006", "0b18d1465e7cb56e"}, 0x28) openat$kvm(0xffffff9c, &(0x7f0000000000), 0x501b80, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(r0, &(0x7f0000000ac0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000500)=""/245, 0xf5}], 0x1, &(0x7f0000000640)=""/16, 0x10}, 0x3}], 0x1, 0x23, 0x0) sendto$inet6(r0, &(0x7f0000000140)="d0", 0x1, 0x0, 0x0, 0x0) 721.789693ms ago: executing program 1 (id=1304): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b00)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x4c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=ANY=[@ANYBLOB], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r1, 0x70, &(0x7f0000000100)}, 0x1c) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x80800) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_WAIT_VBLANK(r2, 0xc018643a, &(0x7f0000000040)={0x10000000, 0x1c6a8b68, 0x6}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r2, 0xc05064a7, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0)=[0x0], &(0x7f0000000340), 0x0, 0x1, 0x0, 0x0, r3}) r5 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x9) ioctl$TCSETAW(r5, 0x5407, &(0x7f0000000180)={0x2, 0x7, 0x2, 0xfb45, 0x3, "0d5f078393b87ad2"}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r2, 0xc01064ab, &(0x7f0000000380)={0x1, r4, r3}) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) r6 = creat(0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x100, 0x8, '\x00', 0x0, @fallback=0x30, r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffba, 0x0, 0x0, 0x0, 0x9}, 0x94) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x265, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4}}}}}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r7, 0x89b0, &(0x7f0000000080)={'veth0_to_hsr\x00', &(0x7f0000000100)=@ethtool_channels={0x1, 0x1, 0x0, 0x1000, 0x0, 0xffffdffc, 0x3, 0xfffffffc}}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001800410100000000ffdbdf2502180000ff0000080000000208000100ac1414"], 0x3c}}, 0x40) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x68, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4, 0x2}}}}}}, 0x0) 187.53706ms ago: executing program 3 (id=1305): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b00)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x4c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=ANY=[@ANYBLOB], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r1, 0x70, &(0x7f0000000100)}, 0x1c) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x80800) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_WAIT_VBLANK(r2, 0xc018643a, &(0x7f0000000040)={0x10000000, 0x1c6a8b68, 0x6}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r2, 0xc05064a7, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0)=[0x0], &(0x7f0000000340), 0x0, 0x1, 0x0, 0x0, r3}) r5 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x9) ioctl$TCSETAW(r5, 0x5407, &(0x7f0000000180)={0x2, 0x7, 0x2, 0xfb45, 0x3, "0d5f078393b87ad2"}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r2, 0xc01064ab, &(0x7f0000000380)={0x1, r4, r3}) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) r6 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, 0x0, &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x100, 0x8, '\x00', 0x0, @fallback=0x30, r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x265, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4}}}}}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r7, 0x89b0, &(0x7f0000000080)={'veth0_to_hsr\x00', &(0x7f0000000100)=@ethtool_channels={0x1, 0x1, 0x0, 0x1000, 0x0, 0xffffdffc, 0x3, 0xfffffffc}}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001800410100000000ffdbdf2502180000ff0000080000000208000100ac1414"], 0x3c}}, 0x40) syz_emit_ethernet(0x36, &(0x7f0000000680)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x9, 0x28, 0x68, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x4, 0x2}}}}}}, 0x0) 68.7653ms ago: executing program 1 (id=1306): socket(0x2, 0x3, 0xff) close(0x3) syz_genetlink_get_family_id$gtp(0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffffff, &(0x7f0000000480)='./file0\x00', 0xae) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r1) r2 = socket$packet(0x11, 0x2, 0x300) getsockname$packet(r2, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket(0x200000000000011, 0x2, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=@ipv6_newrule={0x24, 0x18, 0x409, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x1e, 0x1}]}, 0x24}}, 0x80) sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xc8000, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x800}) 2.337217ms ago: executing program 3 (id=1307): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0xffe00000, 0x200000, &(0x7f0000200000/0x200000)=nil}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3fff}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x52, '\x00', 0x0, @fallback=0x9af8dba271b76fd5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df12c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f00000005c0), 0x10) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) 1.600622ms ago: executing program 1 (id=1308): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x2, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x104) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB], 0x0, 0x63, 0x0, 0x1}, 0x28) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x24, 0x23, 0x9, 0x70bd25, 0x25dfd3ff, {0x1}, [@typed={0x8, 0x1, 0x0, 0x0, @ipv4=@loopback}, @typed={0x8, 0xb, 0x0, 0x0, @uid}]}, 0x24}, 0x1, 0x0, 0x0, 0x24040811}, 0x8410) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) recvfrom(r0, &(0x7f0000000180)=""/233, 0xe9, 0x40000002, 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000004c0)=@gcm_128={{0x303}, "b7a41f23ed0500", "d21b0e8a0e000000000000000600", "1d000006", "0b18d1465e7cb56e"}, 0x28) openat$kvm(0xffffff9c, &(0x7f0000000000), 0x501b80, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(r0, &(0x7f0000000ac0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000500)=""/245, 0xf5}], 0x1, &(0x7f0000000640)=""/16, 0x10}, 0x3}], 0x1, 0x23, 0x0) sendto$inet6(r0, &(0x7f0000000140)="d0", 0x1, 0x0, 0x0, 0x0) 0s ago: executing program 0 (id=1315): pipe(&(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000001140), 0x700, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r2, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1/file0\x00', 0x181201, 0x0) write(r3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='123456789', 0x9) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000000), 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) splice(r6, 0x0, r5, 0x0, 0xffffffffffff8000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r7 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r7, &(0x7f0000000480)='dummy_udc.0', 0xb) kernel console output (not intermixed with test programs): /0x5e0 [ 305.808238][ T8802] ? __pfx_filename_mkdirat+0x10/0x10 [ 305.808251][ T8802] ? strncpy_from_user+0x19d/0x2d0 [ 305.808268][ T8802] ? do_getname+0x191/0x390 [ 305.808284][ T8802] __ia32_sys_mkdirat+0x88/0xc0 [ 305.808298][ T8802] __do_fast_syscall_32+0x13a/0x8b0 [ 305.808323][ T8802] do_fast_syscall_32+0x32/0x70 [ 305.808339][ T8802] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 305.808354][ T8802] RIP: 0023:0xf7ff5fec [ 305.808368][ T8802] Code: Unable to access opcode bytes at 0xf7ff5fc2. [ 305.808374][ T8802] RSP: 002b:00000000f54b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000128 [ 305.808385][ T8802] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000000 [ 305.808392][ T8802] RDX: 00000000000001ff RSI: 0000000000000000 RDI: 0000000000000000 [ 305.808398][ T8802] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 305.808404][ T8802] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 305.808410][ T8802] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 305.808424][ T8802] [ 305.810744][ T8802] cgroup: cgroup_addrm_files: failed to add cgroup.clone_children, err=-12 [ 306.154520][ T8820] i2c i2c-0: Failed to register i2c client hd3ss3220 at 0x04 (-16) [ 306.159724][ T8820] i2c i2c-0: delete_device: Can't find device in list [ 306.164029][ T8822] netlink: 68 bytes leftover after parsing attributes in process `syz.2.689'. [ 306.272281][ T8830] netlink: 24 bytes leftover after parsing attributes in process `syz.1.691'. [ 306.290526][ T8822] netlink: 4 bytes leftover after parsing attributes in process `syz.2.689'. [ 306.340716][ T8833] netlink: 24 bytes leftover after parsing attributes in process `syz.1.692'. [ 306.418504][ T8836] netlink: 24 bytes leftover after parsing attributes in process `syz.1.693'. [ 306.430460][ T8825] jffs2: notice: (8825) jffs2_build_xattr_subsystem: complete building xattr subsystem, 4 of xdatum (0 unchecked, 0 orphan) and 6 of xref (0 dead, 0 orphan) found. [ 306.815196][ T2145] usb 7-1: new full-speed USB device number 6 using dummy_hcd [ 306.966178][ T2145] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 306.969112][ T2145] usb 7-1: config 0 has an invalid descriptor of length 121, skipping remainder of the config [ 306.969200][ T2145] usb 7-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 306.969223][ T2145] usb 7-1: config 0 interface 0 has no altsetting 0 [ 306.978080][ T2145] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 306.978099][ T2145] usb 7-1: Product: syz [ 306.978108][ T2145] usb 7-1: Manufacturer: syz [ 306.978117][ T2145] usb 7-1: SerialNumber: syz [ 306.991035][ T2145] usb 7-1: config 0 descriptor?? [ 307.082654][ T8849] Invalid ELF header magic: != ELF [ 307.621187][ T2145] snd-usb-audio 7-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 307.640274][ T8851] netlink: 24 bytes leftover after parsing attributes in process `syz.0.698'. [ 307.664794][ T8704] udevd[8704]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 308.456963][ T8862] xt_HMARK: proto mask must be zero with L3 mode [ 308.512669][ T8876] netlink: 24 bytes leftover after parsing attributes in process `syz.0.700'. [ 308.846572][ T6120] usb 7-1: USB disconnect, device number 6 [ 309.927743][ T8868] netlink: 8 bytes leftover after parsing attributes in process `syz.3.699'. [ 309.932952][ T8868] vlan0: entered allmulticast mode [ 309.932972][ T8868] dummy0: entered allmulticast mode [ 309.933235][ T8868] bridge0: port 3(vlan0) entered blocking state [ 309.933311][ T8868] bridge0: port 3(vlan0) entered disabled state [ 309.934838][ T8868] vlan0: entered promiscuous mode [ 309.934854][ T8868] dummy0: entered promiscuous mode [ 310.164013][ T8892] netlink: 4 bytes leftover after parsing attributes in process `syz.2.702'. [ 310.771578][ T8894] netlink: 24 bytes leftover after parsing attributes in process `syz.1.703'. [ 311.931816][ T8913] netlink: 24 bytes leftover after parsing attributes in process `syz.2.705'. [ 312.014287][ T8915] jffs2: notice: (8915) jffs2_build_xattr_subsystem: complete building xattr subsystem, 4 of xdatum (0 unchecked, 0 orphan) and 6 of xref (0 dead, 0 orphan) found. [ 312.056260][ T43] audit: type=1800 audit(1789390466.026:8122): pid=8887 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.710" name="file0" dev="overlay" ino=970 res=0 errno=0 [ 312.567382][ T8927] netlink: 8 bytes leftover after parsing attributes in process `syz.3.711'. [ 312.593400][ T8929] loop2: detected capacity change from 0 to 2640 [ 312.605952][ T8704] Buffer I/O error on dev loop2, logical block 0, async page read [ 312.606503][ T8704] Buffer I/O error on dev loop2, logical block 0, async page read [ 312.619547][ T8929] Buffer I/O error on dev loop2, logical block 0, lost async page write [ 312.619660][ T8929] Buffer I/O error on dev loop2, logical block 1, lost async page write [ 312.619694][ T8929] Buffer I/O error on dev loop2, logical block 2, lost async page write [ 312.619714][ T8929] Buffer I/O error on dev loop2, logical block 3, lost async page write [ 312.619748][ T8929] Buffer I/O error on dev loop2, logical block 4, lost async page write [ 312.619768][ T8929] Buffer I/O error on dev loop2, logical block 5, lost async page write [ 312.619788][ T8929] Buffer I/O error on dev loop2, logical block 6, lost async page write [ 312.619807][ T8929] Buffer I/O error on dev loop2, logical block 7, lost async page write [ 312.726740][ T8927] netlink: 8 bytes leftover after parsing attributes in process `syz.3.711'. [ 312.751609][ T8927] netlink: 8 bytes leftover after parsing attributes in process `syz.3.711'. [ 312.769997][ T8927] netlink: 8 bytes leftover after parsing attributes in process `syz.3.711'. [ 315.567148][ T8941] netlink: 24 bytes leftover after parsing attributes in process `syz.0.717'. [ 315.727659][ T8945] netlink: 24 bytes leftover after parsing attributes in process `syz.0.726'. [ 315.823899][ T8947] xt_HMARK: proto mask must be zero with L3 mode [ 315.920147][ T8955] netlink: 8 bytes leftover after parsing attributes in process `syz.2.718'. [ 315.952831][ T8955] vlan2: entered allmulticast mode [ 315.952853][ T8955] dummy0: entered allmulticast mode [ 315.953709][ T8955] bridge0: port 1(vlan2) entered blocking state [ 315.953789][ T8955] bridge0: port 1(vlan2) entered disabled state [ 315.973258][ T8955] vlan2: entered promiscuous mode [ 316.596842][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.596878][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.874197][ T8957] overlayfs: overlapping lowerdir path [ 316.983926][ T8961] Invalid ELF header magic: != ELF [ 318.954380][ T8973] ubi0: attaching mtd0 [ 318.961125][ T8973] ubi0: scanning is finished [ 318.961172][ T8973] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 319.067077][ T8973] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 319.071055][ T8979] lo speed is unknown, defaulting to 1000 [ 319.071811][ T8979] lo speed is unknown, defaulting to 1000 [ 319.072171][ T8979] lo speed is unknown, defaulting to 1000 [ 319.213290][ T8012] IPVS: starting estimator thread 0... [ 319.280559][ T8979] infiniband syz1: set active [ 319.280611][ T2145] lo speed is unknown, defaulting to 1000 [ 319.280659][ T8979] infiniband syz1: added lo [ 319.293782][ T8979] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 319.293805][ T8979] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 319.293827][ T8979] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 319.309669][ T8983] IPVS: using max 42 ests per chain, 100800 per kthread [ 319.320264][ T8979] RDS/IB: syz1: added [ 319.320290][ T8979] smc: adding ib device syz1 with port count 1 [ 319.320301][ T8979] smc: ib device syz1 port 1 has no pnetid [ 319.320340][ T2145] lo speed is unknown, defaulting to 1000 [ 319.320771][ T8979] lo speed is unknown, defaulting to 1000 [ 319.426979][ T8979] lo speed is unknown, defaulting to 1000 [ 319.527874][ T8979] lo speed is unknown, defaulting to 1000 [ 319.614917][ T8979] lo speed is unknown, defaulting to 1000 [ 319.704840][ T8991] netlink: 24 bytes leftover after parsing attributes in process `syz.1.727'. [ 319.970448][ T8995] netlink: 24 bytes leftover after parsing attributes in process `syz.1.729'. [ 320.144284][ T9002] netlink: 24 bytes leftover after parsing attributes in process `syz.1.738'. [ 320.904764][ T9021] kernel profiling enabled (shift: 17) [ 320.988719][ T43] audit: type=1326 audit(1789390474.956:8123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9014 comm="syz.3.732" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 320.988765][ T43] audit: type=1326 audit(1789390474.956:8124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9014 comm="syz.3.732" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 320.992894][ T43] audit: type=1326 audit(1789390474.956:8125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9014 comm="syz.3.732" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 320.992936][ T43] audit: type=1326 audit(1789390474.956:8126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9014 comm="syz.3.732" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 320.993631][ T43] audit: type=1326 audit(1789390474.956:8127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9014 comm="syz.3.732" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf707efec code=0x7ffc0000 [ 320.993670][ T43] audit: type=1326 audit(1789390474.956:8128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9014 comm="syz.3.732" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 320.993705][ T43] audit: type=1326 audit(1789390474.956:8129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9014 comm="syz.3.732" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 320.994289][ T43] audit: type=1326 audit(1789390474.956:8130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9014 comm="syz.3.732" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf707efec code=0x7ffc0000 [ 322.007379][ T9042] netlink: 24 bytes leftover after parsing attributes in process `syz.0.740'. [ 322.304466][ T9043] netlink: 8 bytes leftover after parsing attributes in process `syz.2.739'. [ 322.340479][ T9043] netlink: 8 bytes leftover after parsing attributes in process `syz.2.739'. [ 322.341059][ T9043] netlink: 8 bytes leftover after parsing attributes in process `syz.2.739'. [ 322.341614][ T9043] netlink: 8 bytes leftover after parsing attributes in process `syz.2.739'. [ 322.341751][ T9043] netlink: 8 bytes leftover after parsing attributes in process `syz.2.739'. [ 324.506128][ T42] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 324.525958][ T9068] netlink: 24 bytes leftover after parsing attributes in process `syz.2.748'. [ 324.665871][ T42] usb 8-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 324.666842][ T42] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 324.666864][ T42] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 324.666883][ T42] usb 8-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 324.666908][ T42] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 324.701662][ T9064] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 324.701804][ T9064] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 324.712361][ T42] pl2303 8-1:1.0: required interrupt-in endpoint missing [ 324.866756][ T9073] netlink: 24 bytes leftover after parsing attributes in process `syz.0.751'. [ 324.954042][ T9077] netlink: 24 bytes leftover after parsing attributes in process `syz.0.752'. [ 325.444498][ T42] usb 8-1: USB disconnect, device number 7 [ 325.612785][ T9091] netlink: 24 bytes leftover after parsing attributes in process `syz.2.757'. [ 325.795805][ T9095] netlink: 24 bytes leftover after parsing attributes in process `syz.2.760'. [ 325.873988][ T9099] netlink: 24 bytes leftover after parsing attributes in process `syz.1.762'. [ 325.994184][ T9104] 9pnet_virtio: no channels available for device 127.0.0.1 [ 326.012470][ T9104] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 326.404455][ T9107] netlink: 24 bytes leftover after parsing attributes in process `syz.1.764'. [ 326.449621][ T9109] netlink: 24 bytes leftover after parsing attributes in process `syz.3.765'. [ 326.617874][ T9115] netlink: 24 bytes leftover after parsing attributes in process `syz.3.768'. [ 327.047059][ T9117] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 327.806684][ T43] audit: type=1800 audit(1789390481.746:8131): pid=9127 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.771" name="file0" dev="overlay" ino=1042 res=0 errno=0 [ 328.149415][ T9132] sit1: entered promiscuous mode [ 328.405726][ T9139] netlink: 24 bytes leftover after parsing attributes in process `syz.3.775'. [ 328.466794][ T9141] netlink: 24 bytes leftover after parsing attributes in process `syz.2.776'. [ 330.146218][ T9167] __nla_validate_parse: 1 callbacks suppressed [ 330.146231][ T9167] netlink: 24 bytes leftover after parsing attributes in process `syz.1.785'. [ 330.245811][ T9170] netlink: 24 bytes leftover after parsing attributes in process `syz.2.787'. [ 330.441300][ T9176] netlink: 24 bytes leftover after parsing attributes in process `syz.1.786'. [ 330.627587][ T9179] 9p: Bad value for 'rfdno' [ 331.183092][ T43] audit: type=1800 audit(1789390485.146:8132): pid=9163 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.783" name="file0" dev="overlay" ino=1131 res=0 errno=0 [ 331.642448][ T9186] netlink: 24 bytes leftover after parsing attributes in process `syz.3.791'. [ 331.780510][ T9192] netlink: 24 bytes leftover after parsing attributes in process `syz.3.795'. [ 332.030484][ T9193] Invalid ELF header magic: != ELF [ 332.092235][ T9197] netlink: 24 bytes leftover after parsing attributes in process `syz.3.796'. [ 332.162368][ T9201] netlink: 'syz.1.798': attribute type 1 has an invalid length. [ 332.162382][ T9201] netlink: 244 bytes leftover after parsing attributes in process `syz.1.798'. [ 333.325636][ T9219] netlink: 24 bytes leftover after parsing attributes in process `syz.3.802'. [ 333.477717][ T9221] netlink: 24 bytes leftover after parsing attributes in process `syz.3.803'. [ 333.720973][ T43] audit: type=1804 audit(1789390487.686:8133): pid=9225 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.804" name="/newroot/193/bus/bus" dev="overlay" ino=1106 res=1 errno=0 [ 333.959098][ T9227] netlink: 224 bytes leftover after parsing attributes in process `syz.0.804'. [ 334.009088][ T9227] team0: Port device team_slave_1 removed [ 337.033532][ T9257] __nla_validate_parse: 2 callbacks suppressed [ 337.033551][ T9257] netlink: 8 bytes leftover after parsing attributes in process `syz.1.815'. [ 337.043179][ T43] audit: type=1800 audit(1789390491.006:8134): pid=9257 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.815" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 337.144223][ T9266] netlink: 24 bytes leftover after parsing attributes in process `syz.2.818'. [ 338.557775][ T9274] netlink: 24 bytes leftover after parsing attributes in process `syz.1.820'. [ 339.433523][ T9288] netlink: 24 bytes leftover after parsing attributes in process `syz.3.824'. [ 339.460994][ T9291] netlink: 24 bytes leftover after parsing attributes in process `syz.2.825'. [ 339.652558][ T9295] netlink: 24 bytes leftover after parsing attributes in process `syz.0.828'. [ 339.669770][ T1277] IPVS: starting estimator thread 0... [ 339.735672][ T9300] ubi0: attaching mtd0 [ 339.755247][ T9297] IPVS: using max 43 ests per chain, 103200 per kthread [ 339.771676][ T9300] ubi0: scanning is finished [ 339.771703][ T9300] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 339.831266][ T9307] netlink: 24 bytes leftover after parsing attributes in process `syz.3.829'. [ 339.946277][ T9300] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 340.693394][ T9313] netlink: 24 bytes leftover after parsing attributes in process `syz.3.835'. [ 340.899126][ T9320] netlink: 8 bytes leftover after parsing attributes in process `syz.0.834'. [ 340.907236][ T9320] netlink: 8 bytes leftover after parsing attributes in process `syz.0.834'. [ 340.915772][ T5751] Bluetooth: hci4: command 0x1003 tx timeout [ 340.915857][ T5747] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 341.849907][ T9319] workqueue: Failed to create a rescuer kthread for wq "ceph-watch-notify": -EINTR [ 342.060698][ T9338] __nla_validate_parse: 4 callbacks suppressed [ 342.060715][ T9338] netlink: 24 bytes leftover after parsing attributes in process `syz.0.839'. [ 342.098510][ T9340] netlink: 24 bytes leftover after parsing attributes in process `syz.0.842'. [ 342.207341][ T9345] netlink: 24 bytes leftover after parsing attributes in process `syz.2.841'. [ 342.215578][ T9347] netlink: 24 bytes leftover after parsing attributes in process `syz.3.844'. [ 342.735192][ T1036] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 342.885579][ T1036] usb 6-1: New USB device found, idVendor=13d3, idProduct=3211, bcdDevice=7a.67 [ 342.888133][ T1036] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 342.888146][ T1036] usb 6-1: Product: syz [ 342.888153][ T1036] usb 6-1: Manufacturer: syz [ 342.888161][ T1036] usb 6-1: SerialNumber: syz [ 342.904026][ T6120] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 343.055810][ T6120] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 343.057360][ T6120] usb 5-1: config 0 has an invalid descriptor of length 121, skipping remainder of the config [ 343.057381][ T6120] usb 5-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 343.057394][ T6120] usb 5-1: config 0 interface 0 has no altsetting 0 [ 343.060628][ T6120] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 343.060641][ T6120] usb 5-1: Product: syz [ 343.060648][ T6120] usb 5-1: Manufacturer: syz [ 343.060655][ T6120] usb 5-1: SerialNumber: syz [ 343.063006][ T6120] usb 5-1: config 0 descriptor?? [ 343.110715][ T9354] netlink: zone id is out of range [ 343.110723][ T9354] netlink: zone id is out of range [ 343.110727][ T9354] netlink: zone id is out of range [ 343.110731][ T9354] netlink: zone id is out of range [ 343.110734][ T9354] netlink: zone id is out of range [ 343.110738][ T9354] netlink: zone id is out of range [ 343.110752][ T9354] netlink: zone id is out of range [ 343.110756][ T9354] netlink: zone id is out of range [ 343.110806][ T9354] netlink: zone id is out of range [ 343.110811][ T9354] netlink: zone id is out of range [ 343.216772][ T9364] jffs2: notice: (9364) jffs2_build_xattr_subsystem: complete building xattr subsystem, 4 of xdatum (0 unchecked, 0 orphan) and 6 of xref (0 dead, 0 orphan) found. [ 343.436931][ T1036] dvb-usb: found a 'Pinnacle PCTV 310e' in cold state, will try to load a firmware [ 343.436943][ T1036] dvb-usb: did not find the firmware file '(null)' (status -22). You can use /scripts/get_dvb_firmware to get the firmware [ 343.444020][ T1036] usb 6-1: USB disconnect, device number 15 [ 343.511735][ T6120] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 343.591869][ T8704] udevd[8704]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 344.050826][ T9370] netlink: 24 bytes leftover after parsing attributes in process `syz.1.850'. [ 344.125379][ T1036] usb 5-1: USB disconnect, device number 11 [ 344.138205][ T9372] netlink: 24 bytes leftover after parsing attributes in process `syz.3.851'. [ 344.326426][ T9384] netlink: 24 bytes leftover after parsing attributes in process `syz.3.857'. [ 344.645061][ T1036] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 344.767258][ T9393] netlink: 24 bytes leftover after parsing attributes in process `syz.1.861'. [ 344.798360][ T1036] usb 8-1: New USB device found, idVendor=13d3, idProduct=3211, bcdDevice=7a.67 [ 344.800706][ T1036] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 344.800719][ T1036] usb 8-1: Product: syz [ 344.800727][ T1036] usb 8-1: Manufacturer: syz [ 344.800734][ T1036] usb 8-1: SerialNumber: syz [ 344.824177][ T43] audit: type=1804 audit(1789390498.786:8135): pid=9395 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.862" name="/newroot/205/bus/bus" dev="overlay" ino=1168 res=1 errno=0 [ 344.909001][ T9396] netlink: 224 bytes leftover after parsing attributes in process `syz.1.862'. [ 344.909613][ T9396] netlink: 4 bytes leftover after parsing attributes in process `syz.1.862'. [ 344.915875][ T9396] team0: Port device team_slave_1 removed [ 345.091157][ T1036] dvb-usb: found a 'Pinnacle PCTV 310e' in cold state, will try to load a firmware [ 345.091169][ T1036] dvb-usb: did not find the firmware file '(null)' (status -22). You can use /scripts/get_dvb_firmware to get the firmware [ 345.098086][ T1036] usb 8-1: USB disconnect, device number 8 [ 347.431543][ T43] audit: type=1326 audit(1789390501.396:8136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9427 comm="syz.1.873" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 347.433017][ T43] audit: type=1326 audit(1789390501.396:8137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9427 comm="syz.1.873" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 347.437650][ T43] audit: type=1326 audit(1789390501.406:8138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9427 comm="syz.1.873" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 347.437730][ T43] audit: type=1326 audit(1789390501.406:8139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9427 comm="syz.1.873" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 347.443251][ T43] audit: type=1326 audit(1789390501.406:8140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9427 comm="syz.1.873" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 347.443289][ T43] audit: type=1326 audit(1789390501.406:8141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9427 comm="syz.1.873" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 347.443322][ T43] audit: type=1326 audit(1789390501.406:8142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9427 comm="syz.1.873" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 347.447677][ T43] audit: type=1326 audit(1789390501.406:8143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9427 comm="syz.1.873" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 348.179811][ T43] audit: type=1326 audit(1789390502.146:8144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9427 comm="syz.1.873" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 349.519862][ T9448] syzkaller0: left promiscuous mode [ 349.611784][ T9448] __nla_validate_parse: 2 callbacks suppressed [ 349.611893][ T9448] netlink: 224 bytes leftover after parsing attributes in process `syz.2.875'. [ 349.632679][ T9448] netlink: 4 bytes leftover after parsing attributes in process `syz.2.875'. [ 349.953361][ T9455] netlink: 8 bytes leftover after parsing attributes in process `syz.1.883'. [ 349.954178][ T9457] netlink: 8 bytes leftover after parsing attributes in process `syz.1.883'. [ 349.954578][ T9457] netlink: 8 bytes leftover after parsing attributes in process `syz.1.883'. [ 350.024444][ T9457] netlink: 8 bytes leftover after parsing attributes in process `syz.1.883'. [ 350.049022][ T9457] netlink: 8 bytes leftover after parsing attributes in process `syz.1.883'. [ 351.754519][ T9450] x_tables: ip_tables: TCPMSS.0 target: invalid size 8 (kernel) != (user) 16 [ 353.003979][ T9483] netlink: 24 bytes leftover after parsing attributes in process `syz.0.880'. [ 354.087864][ T9489] netlink: 24 bytes leftover after parsing attributes in process `syz.0.881'. [ 354.368174][ T9498] ptrace attach of "/syz-executor exec"[5737] was attempted by "/syz-executor exec"[9498] [ 356.260692][ T9540] bridge0: port 2(syz_tun) entered blocking state [ 356.261227][ T9540] bridge0: port 2(syz_tun) entered disabled state [ 356.261367][ T9540] syz_tun: entered allmulticast mode [ 356.524445][ T9548] netlink: 24 bytes leftover after parsing attributes in process `syz.2.893'. [ 356.569339][ T9550] netlink: 24 bytes leftover after parsing attributes in process `syz.2.894'. [ 356.601691][ T9553] netlink: 56 bytes leftover after parsing attributes in process `syz.2.898'. [ 356.614879][ T9555] netlink: 24 bytes leftover after parsing attributes in process `syz.1.896'. [ 356.668390][ T9541] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 356.678641][ T9553] netlink: 4 bytes leftover after parsing attributes in process `syz.2.898'. [ 356.679124][ T9553] netlink: 280 bytes leftover after parsing attributes in process `syz.2.898'. [ 356.731668][ T9559] warning: `syz.2.898' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 359.404777][ T9579] netlink: 24 bytes leftover after parsing attributes in process `syz.0.905'. [ 359.744825][ T9589] netlink: 24 bytes leftover after parsing attributes in process `syz.0.906'. [ 360.391566][ T9598] 9p: Bad value for 'rfdno' [ 361.758416][ T9618] netlink: 24 bytes leftover after parsing attributes in process `syz.1.914'. [ 361.819093][ T9614] xt_CT: No such helper "syz1" [ 361.856302][ T9622] netlink: 24 bytes leftover after parsing attributes in process `syz.1.915'. [ 361.956997][ T43] kauditd_printk_skb: 2 callbacks suppressed [ 361.957009][ T43] audit: type=1804 audit(1789390515.926:8147): pid=9626 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.917" name="/newroot/219/bus/bus" dev="overlay" ino=1277 res=1 errno=0 [ 362.035544][ T9629] netlink: 224 bytes leftover after parsing attributes in process `syz.0.917'. [ 362.088121][ T9632] netlink: 4 bytes leftover after parsing attributes in process `syz.0.917'. [ 364.126868][ T9655] netlink: 24 bytes leftover after parsing attributes in process `syz.1.924'. [ 364.176919][ T9659] netlink: 24 bytes leftover after parsing attributes in process `syz.1.926'. [ 364.533056][ T7992] Bluetooth: hci4: Frame reassembly failed (-84) [ 365.490219][ T9677] netlink: 'syz.1.932': attribute type 4 has an invalid length. [ 365.834242][ T9687] netlink: 24 bytes leftover after parsing attributes in process `syz.1.935'. [ 365.939674][ T9691] netlink: 24 bytes leftover after parsing attributes in process `syz.1.936'. [ 366.364039][ T43] audit: type=1326 audit(1789390520.326:8148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 366.364230][ T43] audit: type=1326 audit(1789390520.326:8149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 366.373012][ T43] audit: type=1326 audit(1789390520.336:8150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=114 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 366.491360][ T43] audit: type=1326 audit(1789390520.456:8151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7ff4008 code=0x7ffc0000 [ 366.491524][ T43] audit: type=1326 audit(1789390520.456:8152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 366.491615][ T43] audit: type=1326 audit(1789390520.456:8153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 366.595074][ T5751] Bluetooth: hci4: command 0x1003 tx timeout [ 366.652211][ T5747] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 366.686092][ T42] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 367.135602][ T42] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 367.137965][ T42] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.137979][ T42] usb 6-1: Product: syz [ 367.137986][ T42] usb 6-1: Manufacturer: syz [ 367.137994][ T42] usb 6-1: SerialNumber: syz [ 367.195866][ T2145] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 367.428683][ T43] audit: type=1326 audit(1789390521.396:8154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 367.428711][ T43] audit: type=1326 audit(1789390521.396:8155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71f75ab code=0x7ffc0000 [ 367.596532][ T9717] netlink: 24 bytes leftover after parsing attributes in process `syz.3.944'. [ 367.628797][ T43] audit: type=1326 audit(1789390521.596:8156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 367.630234][ T43] audit: type=1326 audit(1789390521.596:8157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 367.633795][ T43] audit: type=1326 audit(1789390521.596:8158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 367.750954][ T9721] netlink: 24 bytes leftover after parsing attributes in process `syz.2.945'. [ 367.872448][ T9697] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 367.872794][ T9697] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 368.205339][ T9697] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 368.205404][ T9697] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 368.209364][ T9697] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 368.209421][ T9697] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 368.225439][ T43] audit: type=1326 audit(1789390522.186:8159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 368.225994][ T43] audit: type=1326 audit(1789390522.186:8160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 368.226169][ T43] audit: type=1326 audit(1789390522.186:8161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 368.226334][ T43] audit: type=1326 audit(1789390522.186:8162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 368.226370][ T43] audit: type=1326 audit(1789390522.186:8163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9696 comm="syz.1.938" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fec code=0x7ffc0000 [ 368.231357][ T9] usb 6-1: USB disconnect, device number 16 [ 368.242402][ C2] dummy_hcd dummy_hcd.1: timer fired with no URBs pending? [ 368.278782][ T2145] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 368.281234][ T2145] ath9k_htc: Failed to initialize the device [ 368.297356][ T9] usb 6-1: ath9k_htc: USB layer deinitialized [ 368.780595][ T9729] netlink: 24 bytes leftover after parsing attributes in process `syz.0.948'. [ 368.797389][ T9732] netlink: 24 bytes leftover after parsing attributes in process `syz.3.949'. [ 368.819853][ T9734] netlink: 24 bytes leftover after parsing attributes in process `syz.2.950'. [ 369.020366][ T9748] netlink: 24 bytes leftover after parsing attributes in process `syz.1.955'. [ 369.212202][ T9756] capability: warning: `syz.0.954' uses deprecated v2 capabilities in a way that may be insecure [ 369.277611][ T9] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 369.436046][ T9] usb 7-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 369.436856][ T9] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 369.436873][ T9] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 369.436885][ T9] usb 7-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 369.436901][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.444125][ T9749] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 369.444177][ T9749] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 369.445335][ T9] pl2303 7-1:1.0: required interrupt-in endpoint missing [ 369.545319][ T6120] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 369.695224][ T6120] usb 5-1: Using ep0 maxpacket: 32 [ 369.704639][ T6120] usb 5-1: unable to get BOS descriptor or descriptor too short [ 369.704679][ T6120] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 369.710432][ T6120] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 369.710448][ T6120] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 369.710458][ T6120] usb 5-1: config 14 has no interface number 0 [ 369.710465][ T6120] usb 5-1: config 14 has no interface number 1 [ 369.710522][ T6120] usb 5-1: config 14 interface 57 has no altsetting 0 [ 369.710533][ T6120] usb 5-1: config 14 interface 228 has no altsetting 0 [ 369.724469][ T6120] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 369.724485][ T6120] usb 5-1: Product: syz [ 369.724492][ T6120] usb 5-1: Manufacturer: syz [ 369.724499][ T6120] usb 5-1: SerialNumber: syz [ 369.752532][ T9] usb 7-1: USB disconnect, device number 7 [ 369.875810][ T5747] Bluetooth: hci0: command 0x0406 tx timeout [ 370.275263][ T5751] Bluetooth: hci2: command 0x0406 tx timeout [ 370.275340][ T5747] Bluetooth: hci3: command 0x0406 tx timeout [ 370.365865][ T9768] netlink: 24 bytes leftover after parsing attributes in process `syz.2.959'. [ 370.416766][ T9770] netlink: 24 bytes leftover after parsing attributes in process `syz.2.960'. [ 370.468636][ T9772] netlink: 24 bytes leftover after parsing attributes in process `syz.2.961'. [ 370.515933][ T9774] netlink: 24 bytes leftover after parsing attributes in process `syz.2.962'. [ 370.616528][ T9764] input: syz1 as /devices/virtual/input/input5 [ 371.955062][ T5747] Bluetooth: hci0: command 0x0406 tx timeout [ 372.356661][ T5747] Bluetooth: hci3: command 0x0406 tx timeout [ 372.356728][ T5747] Bluetooth: hci2: command 0x0406 tx timeout [ 372.832106][ T9784] __nla_validate_parse: 4 callbacks suppressed [ 372.832150][ T9784] netlink: 8 bytes leftover after parsing attributes in process `syz.3.967'. [ 372.843696][ T9784] netlink: 8 bytes leftover after parsing attributes in process `syz.3.967'. [ 372.846414][ T9784] netlink: 8 bytes leftover after parsing attributes in process `syz.3.967'. [ 372.848120][ T9784] netlink: 8 bytes leftover after parsing attributes in process `syz.3.967'. [ 373.040992][ T6120] legousbtower 5-1:14.57: interrupt endpoints not found [ 373.072376][ T6120] legousbtower 5-1:14.228: interrupt endpoints not found [ 373.084444][ T6120] usb 5-1: USB disconnect, device number 12 [ 373.426210][ T9788] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 373.631019][ T9815] netlink: 1064 bytes leftover after parsing attributes in process `syz.1.976'. [ 373.811047][ T9817] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 373.811062][ T9817] overlayfs: failed to set xattr on upper [ 373.811066][ T9817] overlayfs: ...falling back to redirect_dir=nofollow. [ 373.811070][ T9817] overlayfs: ...falling back to metacopy=off. [ 373.811074][ T9817] overlayfs: ...falling back to index=off. [ 373.811078][ T9817] overlayfs: ...falling back to uuid=null. [ 373.822391][ T43] kauditd_printk_skb: 8 callbacks suppressed [ 373.822514][ T43] audit: type=1326 audit(1789390527.786:8172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9822 comm="syz.0.975" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 373.822555][ T43] audit: type=1326 audit(1789390527.786:8173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9822 comm="syz.0.975" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 373.823583][ T43] audit: type=1326 audit(1789390527.786:8174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9822 comm="syz.0.975" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 373.823618][ T43] audit: type=1326 audit(1789390527.786:8175): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9822 comm="syz.0.975" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 373.823775][ T43] audit: type=1326 audit(1789390527.786:8176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9822 comm="syz.0.975" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 373.824106][ T43] audit: type=1326 audit(1789390527.786:8177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9822 comm="syz.0.975" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 373.824311][ T43] audit: type=1326 audit(1789390527.786:8178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9822 comm="syz.0.975" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 373.825548][ T43] audit: type=1326 audit(1789390527.786:8179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9822 comm="syz.0.975" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 374.360834][ T9827] netlink: 24 bytes leftover after parsing attributes in process `syz.2.978'. [ 374.387058][ T9829] netlink: 24 bytes leftover after parsing attributes in process `syz.3.979'. [ 374.512857][ T43] audit: type=1326 audit(1789390528.476:8180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9822 comm="syz.0.975" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 374.512960][ T43] audit: type=1326 audit(1789390528.476:8181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9822 comm="syz.0.975" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 374.519567][ T9831] netlink: 24 bytes leftover after parsing attributes in process `syz.3.980'. [ 375.023193][ T9838] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 375.023301][ T9838] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 375.023370][ T9838] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 375.054719][ T9839] netlink: 8 bytes leftover after parsing attributes in process `syz.2.982'. [ 375.378740][ T9839] netlink: 8 bytes leftover after parsing attributes in process `syz.2.982'. [ 377.075241][ T5747] Bluetooth: hci3: command 0x0406 tx timeout [ 377.075279][ T5747] Bluetooth: hci2: command 0x0406 tx timeout [ 377.075301][ T5747] Bluetooth: hci0: command 0x0406 tx timeout [ 378.049840][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.049890][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.503957][ T9858] __nla_validate_parse: 3 callbacks suppressed [ 378.503975][ T9858] netlink: 24 bytes leftover after parsing attributes in process `syz.2.988'. [ 378.590286][ T9860] netlink: 24 bytes leftover after parsing attributes in process `syz.3.989'. [ 378.819749][ T9856] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 379.708355][ T9867] netlink: 24 bytes leftover after parsing attributes in process `syz.2.991'. [ 380.559985][ T9885] bridge0: port 4(syz_tun) entered blocking state [ 380.560042][ T9885] bridge0: port 4(syz_tun) entered disabled state [ 380.560196][ T9885] syz_tun: entered allmulticast mode [ 386.757085][ T6120] libceph: connect (1)[c::]:6789 error -22 [ 386.763178][ T6120] libceph: mon0 (1)[c::]:6789 connect error [ 386.780043][ T6120] libceph: connect (1)[c::]:6789 error -22 [ 386.788125][ T6120] libceph: mon0 (1)[c::]:6789 connect error [ 386.807766][ T9914] ceph: No mds server is up or the cluster is laggy [ 387.236073][ T9922] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1003'. [ 388.215275][ T6120] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 388.369117][ T6120] usb 5-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 388.370323][ T6120] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 388.370350][ T6120] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 388.370371][ T6120] usb 5-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 388.370399][ T6120] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 388.395267][ T9933] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 388.395404][ T9933] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 388.407391][ T6120] pl2303 5-1:1.0: required interrupt-in endpoint missing [ 388.622164][ T6120] usb 5-1: USB disconnect, device number 13 [ 389.192537][ T9942] kAFS: unable to lookup cell '/,cL' [ 390.656950][ T9963] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1014'. [ 390.704053][ T9965] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1015'. [ 391.284490][ T43] audit: type=1326 audit(1789390545.246:8182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9973 comm="syz.2.1018" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff5fec code=0x7ffc0000 [ 391.285502][ T43] audit: type=1326 audit(1789390545.256:8183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9973 comm="syz.2.1018" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff5fec code=0x7ffc0000 [ 391.288143][ T43] audit: type=1326 audit(1789390545.256:8184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9973 comm="syz.2.1018" exe="/syz-executor" sig=0 arch=40000003 syscall=114 compat=1 ip=0xf7ff5fec code=0x7ffc0000 [ 391.351773][ T9972] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 391.367733][ T9972] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1017'. [ 391.518985][ T43] audit: type=1326 audit(1789390545.486:8185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9973 comm="syz.2.1018" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff5fec code=0x7ffc0000 [ 391.519090][ T43] audit: type=1326 audit(1789390545.486:8186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9973 comm="syz.2.1018" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff5fec code=0x7ffc0000 [ 391.745160][ T5164] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 391.895803][ T5164] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 391.898704][ T5164] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.898720][ T5164] usb 7-1: Product: syz [ 391.898733][ T5164] usb 7-1: Manufacturer: syz [ 391.898741][ T5164] usb 7-1: SerialNumber: syz [ 391.953804][ T5164] usb 7-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 392.253263][ T43] audit: type=1326 audit(1789390546.216:8187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9973 comm="syz.2.1018" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7ff5fec code=0x7ffc0000 [ 392.253311][ T43] audit: type=1326 audit(1789390546.216:8188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9973 comm="syz.2.1018" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71f75ab code=0x7ffc0000 [ 392.391174][ T9988] jffs2: notice: (9988) jffs2_build_xattr_subsystem: complete building xattr subsystem, 4 of xdatum (0 unchecked, 0 orphan) and 6 of xref (0 dead, 0 orphan) found. [ 392.449648][ T9988] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1020'. [ 392.478622][ T43] audit: type=1326 audit(1789390546.446:8189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9973 comm="syz.2.1018" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff5fec code=0x7ffc0000 [ 392.478666][ T43] audit: type=1326 audit(1789390546.446:8190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9973 comm="syz.2.1018" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff5fec code=0x7ffc0000 [ 392.479651][ T43] audit: type=1326 audit(1789390546.446:8191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9973 comm="syz.2.1018" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7ff5fec code=0x7ffc0000 [ 392.616302][ T9974] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 392.616508][ T9974] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 392.616681][ T9974] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 392.745134][ T9993] ptrace attach of "/syz-executor exec"[5738] was attempted by "/syz-executor exec"[9993] [ 392.892805][ T42] usb 7-1: USB disconnect, device number 8 [ 392.996901][ T5164] ath9k_htc 7-1:1.0: ath9k_htc: Target is unresponsive [ 392.997003][ T5164] ath9k_htc: Failed to initialize the device [ 392.997274][ T42] usb 7-1: ath9k_htc: USB layer deinitialized [ 393.503824][T10005] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1026'. [ 393.625282][ T6120] usb 8-1: new low-speed USB device number 9 using dummy_hcd [ 393.775772][ T6120] usb 8-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 393.776748][ T6120] usb 8-1: config 0 has an invalid interface number: 1 but max is 0 [ 393.776762][ T6120] usb 8-1: config 0 has no interface number 0 [ 393.776780][ T6120] usb 8-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 393.776793][ T6120] usb 8-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 393.776812][ T6120] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 393.778825][ T6120] usb 8-1: config 0 descriptor?? [ 393.781423][T10003] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 393.813260][ T6120] iowarrior 8-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 394.675355][ T5751] Bluetooth: hci3: command 0x0406 tx timeout [ 394.675382][ T5751] Bluetooth: hci2: command 0x0406 tx timeout [ 394.675396][ T5751] Bluetooth: hci0: command 0x0406 tx timeout [ 394.906964][T10017] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1029'. [ 395.061928][T10017] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1029'. [ 395.097873][T10017] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1029'. [ 395.120218][T10017] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1029'. [ 395.148242][T10017] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1029'. [ 395.827544][ T5164] usb 8-1: USB disconnect, device number 9 [ 396.074771][T10023] program syz.2.1030 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 396.209091][T10027] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1031'. [ 396.780179][ T43] kauditd_printk_skb: 19 callbacks suppressed [ 396.780198][ T43] audit: type=1326 audit(1789390550.746:8211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10038 comm="syz.0.1035" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 396.780376][ T43] audit: type=1326 audit(1789390550.746:8212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10038 comm="syz.0.1035" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 396.782514][ T43] audit: type=1326 audit(1789390550.746:8213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10038 comm="syz.0.1035" exe="/syz-executor" sig=0 arch=40000003 syscall=114 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 396.878217][ T43] audit: type=1326 audit(1789390550.846:8214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10038 comm="syz.0.1035" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7ff8008 code=0x7ffc0000 [ 396.878266][ T43] audit: type=1326 audit(1789390550.846:8215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10038 comm="syz.0.1035" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 396.878304][ T43] audit: type=1326 audit(1789390550.846:8216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10038 comm="syz.0.1035" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 396.889793][ T43] audit: type=1326 audit(1789390550.856:8217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10038 comm="syz.0.1035" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 396.889838][ T43] audit: type=1326 audit(1789390550.856:8218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10038 comm="syz.0.1035" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 396.889875][ T43] audit: type=1326 audit(1789390550.856:8219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10038 comm="syz.0.1035" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 396.895820][ T43] audit: type=1326 audit(1789390550.856:8220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10038 comm="syz.0.1035" exe="/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 397.655145][ T6120] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 397.805784][ T6120] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 397.811509][ T6120] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.811532][ T6120] usb 5-1: Product: syz [ 397.811543][ T6120] usb 5-1: Manufacturer: syz [ 397.811555][ T6120] usb 5-1: SerialNumber: syz [ 397.853638][ T5164] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 398.465525][T10039] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 398.465669][T10039] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 398.465809][T10039] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 398.752694][T10053] ptrace attach of "/syz-executor exec"[5746] was attempted by "/syz-executor exec"[10053] [ 398.915152][ T5164] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 398.915304][ T5164] ath9k_htc: Failed to initialize the device [ 398.963817][ T5164] usb 5-1: ath9k_htc: USB layer deinitialized [ 399.183561][ T42] usb 5-1: USB disconnect, device number 14 [ 399.383371][T10055] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1038'. [ 400.515075][ T5747] Bluetooth: hci3: command 0x0406 tx timeout [ 400.515113][ T5747] Bluetooth: hci2: command 0x0406 tx timeout [ 400.515129][ T5747] Bluetooth: hci0: command 0x0406 tx timeout [ 400.830789][T10067] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 400.834348][T10067] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1042'. [ 401.172944][T10074] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1044'. [ 401.775101][ T6120] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 401.925931][ T6120] usb 6-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 401.926923][ T6120] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 401.926948][ T6120] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 401.926967][ T6120] usb 6-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 401.926995][ T6120] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.953789][T10085] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 401.953897][T10085] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 401.960074][ T6120] pl2303 6-1:1.0: required interrupt-in endpoint missing [ 402.267442][ T6120] usb 6-1: USB disconnect, device number 17 [ 403.823885][T10098] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1050'. [ 404.753173][ T42] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 404.875267][T10121] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 404.879232][T10121] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 404.879926][T10121] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 405.650162][T10136] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1055'. [ 406.915159][ T5751] Bluetooth: hci3: command 0x0406 tx timeout [ 406.915185][ T5751] Bluetooth: hci2: command 0x0406 tx timeout [ 406.915200][ T5751] Bluetooth: hci0: command 0x0406 tx timeout [ 407.140579][T10147] input: syz1 as /devices/virtual/input/input6 [ 415.111953][T10180] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1060'. [ 415.395617][ T2145] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 415.665154][ T42] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 415.774051][T10191] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1067'. [ 415.880686][ T42] usb 6-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 416.419080][ T42] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 416.419100][ T42] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 416.419111][ T42] usb 6-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 416.419128][ T42] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 416.492578][T10182] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 416.492737][T10182] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 416.495057][ T42] pl2303 6-1:1.0: required interrupt-in endpoint missing [ 416.643120][T10198] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 416.652936][T10198] pci 0000:00:01.0: BAR 0 [mem 0xfd000000-0xfdffffff pref] [ 416.653070][T10198] pci 0000:00:01.0: BAR 2 [mem 0xfeaf4000-0xfeaf4fff] [ 416.653245][T10198] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 416.654336][T10198] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 416.684919][T10198] pci 0000:00:01.0: Adding to iommu group 1 [ 416.690261][T10198] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 416.690275][T10198] pci 0000:00:01.0: vgaarb: bridge control possible [ 416.690283][T10198] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 416.699092][T10198] pci 0000:00:1d.0: [8086:2934] type 00 class 0x0c0300 conventional PCI endpoint [ 416.702024][T10198] pci 0000:00:1d.0: BAR 4 [io 0xc0e0-0xc0ff] [ 416.717399][T10198] pci 0000:00:1d.0: Adding to iommu group 7 [ 416.745297][T10198] pci 0000:00:01.0: BAR 0 [mem 0x81000000-0x81ffffff pref]: assigned [ 416.772738][T10198] pci 0000:00:01.0: BAR 2 [mem 0x80001000-0x80001fff]: assigned [ 416.774785][T10198] pci 0000:00:1d.0: BAR 4 [io 0x2020-0x203f]: assigned [ 416.783773][T10198] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 416.800367][T10198] [drm] Found bochs VGA, ID 0xb0c5. [ 416.800379][T10198] [drm] Framebuffer size 16384 kB @ 0x81000000, mmio @ 0x80001000. [ 418.142357][T10198] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 418.182251][ T9] usb 6-1: USB disconnect, device number 18 [ 418.538565][T10208] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 418.538779][T10208] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 418.538896][T10208] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 420.515332][ T5751] Bluetooth: hci0: command 0x0406 tx timeout [ 420.596545][ T5747] Bluetooth: hci2: command 0x0406 tx timeout [ 420.596583][ T5751] Bluetooth: hci3: command 0x0406 tx timeout [ 420.919906][T10229] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 420.945099][T10229] md: couldn't update array info. -22 [ 420.945540][ T6052] md_update_sb: can't update sb for read-only array md0 [ 420.979194][T10233] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1073'. [ 420.996279][T10229] md0: detected capacity change from 2048 to 0 [ 420.996292][T10229] md: md0 stopped. [ 421.047969][T10198] Console: switching to colour frame buffer device 160x50 [ 421.061177][T10234] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 421.091652][T10198] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 421.211638][T10198] pci 0000:00:1d.0: quirk_usb_early_handoff+0x0/0x1360 took 112096 usecs [ 421.285622][T10198] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 421.308079][T10198] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1 [ 421.308258][T10198] uhci_hcd 0000:00:1d.0: detected 2 ports [ 421.311537][T10198] uhci_hcd 0000:00:1d.0: irq 16, io port 0x00002020 [ 421.317157][T10198] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.03 [ 421.319685][T10198] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 421.319698][T10198] usb usb1: Product: UHCI Host Controller [ 421.319706][T10198] usb usb1: Manufacturer: Linux syzkaller uhci_hcd [ 421.319714][T10198] usb usb1: SerialNumber: 0000:00:1d.0 [ 421.401412][T10198] hub 1-0:1.0: USB hub found [ 421.410257][T10198] hub 1-0:1.0: 2 ports detected [ 421.638348][T10239] netlink: 'syz.2.1074': attribute type 1 has an invalid length. [ 421.638362][T10239] netlink: 244 bytes leftover after parsing attributes in process `syz.2.1074'. [ 421.734383][T10241] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1077'. [ 423.055111][ T2145] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 423.073589][T10256] netlink: 'syz.3.1081': attribute type 2 has an invalid length. [ 423.073611][T10256] netlink: 'syz.3.1081': attribute type 2 has an invalid length. [ 423.206530][ T2145] usb 6-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 423.211055][ T2145] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 423.211072][ T2145] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 423.211084][ T2145] usb 6-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 423.211100][ T2145] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.215230][T10248] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 423.215281][T10248] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 423.226418][ T2145] pl2303 6-1:1.0: required interrupt-in endpoint missing [ 424.425969][ T2145] usb 6-1: USB disconnect, device number 19 [ 427.085163][ T9] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 427.494911][T10277] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 427.495178][T10277] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 427.495302][T10277] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 427.537299][ T9] usb 7-1: Using ep0 maxpacket: 32 [ 427.598617][ T9] usb 7-1: unable to get BOS descriptor or descriptor too short [ 427.598659][ T9] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 427.621608][ T9] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 427.621633][ T9] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 427.621653][ T9] usb 7-1: config 14 has no interface number 0 [ 427.621667][ T9] usb 7-1: config 14 has no interface number 1 [ 427.621709][ T9] usb 7-1: config 14 interface 57 has no altsetting 0 [ 427.621726][ T9] usb 7-1: config 14 interface 228 has no altsetting 0 [ 427.649533][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.649558][ T9] usb 7-1: Product: syz [ 427.649570][ T9] usb 7-1: Manufacturer: syz [ 427.649583][ T9] usb 7-1: SerialNumber: syz [ 428.489772][ T9] legousbtower 7-1:14.57: interrupt endpoints not found [ 428.514864][ T9] legousbtower 7-1:14.228: interrupt endpoints not found [ 428.540744][ T9] usb 7-1: USB disconnect, device number 9 [ 429.454387][T10290] Console: switching to colour dummy device 80x25 [ 429.556397][ T5747] Bluetooth: hci3: command 0x0406 tx timeout [ 429.556432][ T5747] Bluetooth: hci2: command 0x0406 tx timeout [ 429.556457][ T5747] Bluetooth: hci0: command 0x0406 tx timeout [ 429.895989][T10292] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 429.915847][ T6120] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 430.076510][ T6120] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 430.077872][ T6120] usb 8-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 430.077897][ T6120] usb 8-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 430.077915][ T6120] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 430.077953][ T6120] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 430.077977][ T6120] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 430.079760][ T6120] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 430.079781][ T6120] usb 8-1: Product: syz [ 430.079794][ T6120] usb 8-1: Manufacturer: syz [ 430.156175][ T6120] cdc_wdm 8-1:1.0: skipping garbage [ 430.156238][ T6120] cdc_wdm 8-1:1.0: skipping garbage [ 430.177714][ T6120] cdc_wdm 8-1:1.0: cdc-wdm0: USB WDM device [ 430.177733][ T6120] cdc_wdm 8-1:1.0: Unknown control protocol [ 430.770325][T10294] futex_wake_op: syz.3.1088 tries to shift op by 144; fix this program [ 430.770582][T10294] futex_wake_op: syz.3.1088 tries to shift op by 144; fix this program [ 430.964727][T10292] pci 0000:00:01.0: BAR 0 [mem 0x81000000-0x81ffffff pref] [ 430.964881][T10292] pci 0000:00:01.0: BAR 2 [mem 0x80001000-0x80001fff] [ 430.965584][T10292] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 430.966168][T10292] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 431.004532][ T6120] usb 8-1: USB disconnect, device number 10 [ 431.207779][T10292] pci 0000:00:01.0: Adding to iommu group 1 [ 431.227321][T10304] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1090'. [ 431.227369][T10304] syz_tun: left allmulticast mode [ 431.228124][T10304] bridge0: port 2(syz_tun) entered disabled state [ 431.256895][T10292] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 431.256918][T10292] pci 0000:00:01.0: vgaarb: bridge control possible [ 431.256930][T10292] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 431.264716][T10304] vlan2: left promiscuous mode [ 431.264936][T10304] bridge0: port 1(vlan2) entered disabled state [ 431.284245][T10292] pci 0000:00:01.0: BAR 0 [mem 0x81000000-0x81ffffff pref]: assigned [ 431.284355][T10292] pci 0000:00:01.0: BAR 2 [mem 0x80001000-0x80001fff]: assigned [ 431.288402][T10292] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 431.300787][T10292] [drm] Found bochs VGA, ID 0xb0c5. [ 431.300796][T10292] [drm] Framebuffer size 16384 kB @ 0x81000000, mmio @ 0x80001000. [ 431.331698][T10292] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 431.491484][T10309] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1094'. [ 431.500477][T10309] syzkaller1: entered promiscuous mode [ 431.500490][T10309] syzkaller1: entered allmulticast mode [ 431.667455][ T43] kauditd_printk_skb: 25 callbacks suppressed [ 431.667475][ T43] audit: type=1807 audit(1789390585.626:8246): action=measure res=1 [ 431.667869][T10312] ima: policy update completed [ 431.667986][ T43] audit: type=1802 audit(1789390585.636:8247): pid=10312 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=completed comm="syz.2.1095" res=1 errno=0 [ 431.882985][T10292] Console: switching to colour frame buffer device 160x50 [ 432.027454][T10292] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 432.102760][ T43] audit: type=1800 audit(1789390586.066:8248): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=188240 res=0 errno=0 [ 432.104709][ T43] audit: type=1800 audit(1789390586.066:8249): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 432.259112][ T43] audit: type=1800 audit(1789390586.226:8250): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 432.261779][ T43] audit: type=1800 audit(1789390586.226:8251): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34540 res=0 errno=0 [ 432.281123][ T43] audit: type=1800 audit(1789390586.246:8252): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34563 res=0 errno=0 [ 432.495127][ T2145] usb 6-1: new low-speed USB device number 20 using dummy_hcd [ 432.498052][ T43] audit: type=1800 audit(1789390586.466:8253): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 432.524548][ T43] audit: type=1800 audit(1789390586.486:8254): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 432.645583][ T2145] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 432.646496][ T2145] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 432.646510][ T2145] usb 6-1: config 0 has no interface number 0 [ 432.646527][ T2145] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 432.646539][ T2145] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 432.646558][ T2145] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.647813][ T2145] usb 6-1: config 0 descriptor?? [ 432.648269][T10320] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 432.649248][ T43] audit: type=1800 audit(1789390586.616:8255): pid=10201 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=188524 res=0 errno=0 [ 433.040621][ T2145] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 434.887176][ T9] usb 6-1: USB disconnect, device number 20 [ 436.072255][T10364] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1103'. [ 436.072316][T10364] vlan2: left promiscuous mode [ 436.072329][T10364] dummy0: left promiscuous mode [ 436.074720][T10364] bridge0: port 3(vlan2) entered disabled state [ 436.435984][T10364] bridge_slave_1: left allmulticast mode [ 436.436002][T10364] bridge_slave_1: left promiscuous mode [ 436.436156][T10364] bridge0: port 2(bridge_slave_1) entered disabled state [ 436.476467][T10364] bridge_slave_0: left allmulticast mode [ 436.476496][T10364] bridge_slave_0: left promiscuous mode [ 436.476671][T10364] bridge0: port 1(bridge_slave_0) entered disabled state [ 436.673292][T10371] netlink: 'syz.3.1105': attribute type 4 has an invalid length. [ 436.673307][T10371] netlink: 17 bytes leftover after parsing attributes in process `syz.3.1105'. [ 436.734421][ T43] kauditd_printk_skb: 10 callbacks suppressed [ 436.734444][ T43] audit: type=1800 audit(1789390590.696:8266): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 436.974241][ T43] audit: type=1804 audit(1789390590.936:8267): pid=10378 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1106" name="/newroot/284/file0" dev="tmpfs" ino=1627 res=1 errno=0 [ 437.503380][T10386] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1107'. [ 437.690160][ T43] audit: type=1800 audit(1789390591.656:8268): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=188637 res=0 errno=0 [ 437.693318][ T43] audit: type=1800 audit(1789390591.656:8269): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=188686 res=0 errno=0 [ 437.729876][ T43] audit: type=1800 audit(1789390591.696:8270): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=188701 res=0 errno=0 [ 437.764074][ T43] audit: type=1800 audit(1789390591.726:8271): pid=10387 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1108" name="allow_writes" dev="sysfs" ino=57275 res=0 errno=0 [ 437.773241][T10387] msr: Write to unrecognized MSR 0x1a0 by syz.0.1108 (pid: 10387), tainting CPU_OUT_OF_SPEC. [ 437.773261][T10387] msr: See https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/about for details. [ 438.811924][ T43] audit: type=1800 audit(1789390592.776:8272): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 439.098911][ T43] audit: type=1800 audit(1789390593.066:8273): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 439.150611][ T43] audit: type=1800 audit(1789390593.116:8274): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34590 res=0 errno=0 [ 439.156317][ T43] audit: type=1800 audit(1789390593.126:8275): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34613 res=0 errno=0 [ 439.257031][T10402] bridge0: port 2(bridge_slave_1) entered disabled state [ 439.257160][T10402] bridge0: port 1(bridge_slave_0) entered disabled state [ 439.370579][ T9] lo speed is unknown, defaulting to 1000 [ 439.370595][ T9] syz1: Port: 1 Link DOWN [ 439.371207][ T9] lo speed is unknown, defaulting to 1000 [ 439.375616][ T6120] usb 7-1: new low-speed USB device number 10 using dummy_hcd [ 439.385372][ T5831] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.385470][ T5831] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.385700][ T5831] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.385760][ T5831] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.479782][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.479879][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.521139][T10412] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1114'. [ 439.527133][ T6120] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 439.527950][ T6120] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 439.527963][ T6120] usb 7-1: config 0 has no interface number 0 [ 439.527981][ T6120] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 439.527995][ T6120] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 439.528014][ T6120] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.529795][ T6120] usb 7-1: config 0 descriptor?? [ 439.530373][T10401] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 439.541190][ T6120] iowarrior 7-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 439.725681][T10416] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 439.730726][T10416] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 439.730876][T10416] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 441.293791][T10434] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1120'. [ 441.715362][ T5751] Bluetooth: hci0: command 0x0406 tx timeout [ 441.795137][ T5747] Bluetooth: hci2: command 0x0406 tx timeout [ 441.795171][ T5751] Bluetooth: hci3: command 0x0406 tx timeout [ 442.198379][ T6120] usb 7-1: USB disconnect, device number 10 [ 442.202251][ T43] kauditd_printk_skb: 14 callbacks suppressed [ 442.202268][ T43] audit: type=1800 audit(1789390596.166:8290): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34590 res=0 errno=0 [ 442.342729][ T43] audit: type=1800 audit(1789390596.306:8291): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 442.370977][ T43] audit: type=1800 audit(1789390596.336:8292): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 442.376961][ T43] audit: type=1800 audit(1789390596.346:8293): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34613 res=0 errno=0 [ 442.810377][ T43] audit: type=1800 audit(1789390596.776:8294): pid=10455 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1126" name="quirks" dev="sysfs" ino=62326 res=0 errno=0 [ 443.114199][ T43] audit: type=1800 audit(1789390597.076:8295): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 443.209444][T10459] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1127'. [ 443.210564][ T43] audit: type=1800 audit(1789390597.176:8296): pid=10456 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1126" name="new_device" dev="sysfs" ino=45677 res=0 errno=0 [ 443.253078][ T43] audit: type=1800 audit(1789390597.216:8297): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=188915 res=0 errno=0 [ 443.255343][ T43] audit: type=1800 audit(1789390597.226:8298): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=45673 res=0 errno=0 [ 443.256210][ T43] audit: type=1800 audit(1789390597.226:8299): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="name" dev="sysfs" ino=188916 res=0 errno=0 [ 443.301250][T10456] usb3503 0-0008: unknown mode is requested [ 443.301263][T10456] usb3503 0-0008: usb3503_probe: probed in standby mode [ 443.325467][T10456] i2c i2c-0: new_device: Instantiated device usb3503 at 0x08 [ 444.204254][T10469] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1129'. [ 444.609517][T10470] IPVS: Error connecting to the multicast addr [ 444.761802][T10476] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1131'. [ 444.792622][T10479] veth0: entered promiscuous mode [ 445.014174][T10479] veth0: left promiscuous mode [ 446.822490][ T74] Process accounting resumed [ 447.403556][T10487] xt_CT: No such helper "syz1" [ 448.007126][T10491] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1136'. [ 448.007464][T10491] syz_tun: left allmulticast mode [ 448.008469][T10491] bridge0: port 4(syz_tun) entered disabled state [ 448.039759][T10491] bridge0: port 3(vlan2) entered disabled state [ 448.066077][T10491] bridge_slave_1: left allmulticast mode [ 448.067256][T10491] bridge0: port 2(bridge_slave_1) entered disabled state [ 448.084198][T10491] bridge_slave_0: left allmulticast mode [ 448.092477][T10491] bridge0: port 1(bridge_slave_0) entered disabled state [ 448.506061][ T43] kauditd_printk_skb: 5 callbacks suppressed [ 448.506079][ T43] audit: type=1800 audit(1789390602.466:8305): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 448.613139][ T43] audit: type=1800 audit(1789390602.576:8306): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 448.746093][T10503] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1138'. [ 448.759695][ T43] audit: type=1800 audit(1789390602.726:8307): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=4812 res=0 errno=0 [ 448.938673][ T43] audit: type=1800 audit(1789390602.906:8308): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34490 res=0 errno=0 [ 448.957686][ T43] audit: type=1800 audit(1789390602.926:8309): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34513 res=0 errno=0 [ 449.801331][ T43] audit: type=1800 audit(1789390603.766:8310): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 449.919780][T10512] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1142'. [ 449.978839][ T43] audit: type=1800 audit(1789390603.946:8311): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 450.061930][ T43] audit: type=1800 audit(1789390604.026:8312): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 450.169267][T10521] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 450.169369][T10521] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 450.169434][T10521] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 450.279231][T10527] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1147'. [ 450.279278][T10527] vlan0: left promiscuous mode [ 450.279288][T10527] dummy0: left promiscuous mode [ 450.280035][T10527] bridge0: port 3(vlan0) entered disabled state [ 450.283788][T10527] bridge_slave_1: left allmulticast mode [ 450.283801][T10527] bridge_slave_1: left promiscuous mode [ 450.284082][T10527] bridge0: port 2(bridge_slave_1) entered disabled state [ 450.297415][T10527] bridge_slave_0: left allmulticast mode [ 450.297431][T10527] bridge_slave_0: left promiscuous mode [ 450.297537][T10527] bridge0: port 1(bridge_slave_0) entered disabled state [ 450.436797][ T43] audit: type=1800 audit(1789390604.386:8313): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 450.786768][ T42] Process accounting resumed [ 451.447636][ T43] audit: type=1800 audit(1789390605.406:8314): pid=10535 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1148" name="file1" dev="tmpfs" ino=1671 res=0 errno=0 [ 451.607296][T10540] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1149'. [ 452.195538][ T5747] Bluetooth: hci3: command 0x0406 tx timeout [ 452.195580][ T5747] Bluetooth: hci0: command 0x0406 tx timeout [ 452.195618][ T5751] Bluetooth: hci2: command 0x0406 tx timeout [ 452.708434][T10548] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1153'. [ 452.720086][T10549] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1152'. [ 452.977643][T10549] team0 (unregistering): Port device team_slave_0 removed [ 453.384634][T10561] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1157'. [ 453.486155][T10559] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1156'. [ 453.551283][ T43] kauditd_printk_skb: 6 callbacks suppressed [ 453.551295][ T43] audit: type=1800 audit(1789390607.516:8321): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 453.770411][T10569] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1159'. [ 453.880740][ T43] audit: type=1800 audit(1789390607.846:8322): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 454.423860][ T43] audit: type=1800 audit(1789390608.376:8323): pid=10584 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1163" name="remove" dev="sysfs" ino=188242 res=0 errno=0 [ 454.423911][ T43] audit: type=1800 audit(1789390608.376:8324): pid=10584 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1163" name="rescan" dev="sysfs" ino=820 res=0 errno=0 [ 454.472151][ T43] audit: type=1800 audit(1789390608.436:8325): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 454.500510][ T43] audit: type=1800 audit(1789390608.466:8326): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 454.759352][T10591] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1165'. [ 454.940861][T10595] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1166'. [ 455.449948][ T43] audit: type=1800 audit(1789390609.416:8327): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 455.578685][ T43] audit: type=1800 audit(1789390609.546:8328): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 455.843890][T10605] IPVS: Error connecting to the multicast addr [ 456.207461][T10604] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1169'. [ 456.209148][T10603] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 456.312180][ T43] audit: type=1800 audit(1789390610.276:8329): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 456.553456][T10603] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 456.884839][T10603] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.037070][T10603] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.225438][ T5831] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 457.225480][ T5831] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 457.248344][ T5831] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 457.248387][ T5831] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 457.294928][ T43] audit: type=1800 audit(1789390611.246:8330): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 458.804187][ T1347] Process accounting resumed [ 458.847326][ T43] kauditd_printk_skb: 1 callbacks suppressed [ 458.847345][ T43] audit: type=1800 audit(1789390612.816:8332): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 458.917494][ T43] audit: type=1800 audit(1789390612.886:8333): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=189781 res=0 errno=0 [ 458.980202][ T43] audit: type=1800 audit(1789390612.946:8334): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 459.037203][T10629] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1175'. [ 459.330234][ T43] audit: type=1800 audit(1789390613.296:8335): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 459.552163][ T43] audit: type=1800 audit(1789390613.516:8336): pid=10637 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1176" name="crash_size" dev="sysfs" ino=929 res=0 errno=0 [ 459.844012][ T43] audit: type=1800 audit(1789390613.806:8337): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 460.069817][T10646] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1178'. [ 460.332123][T10647] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1179'. [ 460.538033][ T43] audit: type=1800 audit(1789390614.506:8338): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 460.995079][ T5751] Bluetooth: hci3: command 0x2016 tx timeout [ 461.252912][ T43] audit: type=1800 audit(1789390615.216:8339): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 461.511076][ T43] audit: type=1800 audit(1789390615.476:8340): pid=10660 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1181" name="hardlockup_count" dev="sysfs" ino=66480 res=0 errno=0 [ 462.491900][T10666] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 462.492081][T10666] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 462.509082][T10666] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 462.519688][ T43] audit: type=1800 audit(1789390616.476:8341): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 462.738565][T10669] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1187'. [ 462.819841][T10671] input: syz1 as /devices/virtual/input/input7 [ 463.382758][T10683] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1189'. [ 463.855913][ T43] kauditd_printk_skb: 14 callbacks suppressed [ 463.855925][ T43] audit: type=1800 audit(1789390617.816:8356): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34640 res=0 errno=0 [ 463.855988][ T43] audit: type=1800 audit(1789390617.826:8357): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34663 res=0 errno=0 [ 464.019492][T10691] netlink: 'syz.2.1190': attribute type 1 has an invalid length. [ 464.095039][ T9] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 464.147439][ T43] audit: type=1800 audit(1789390618.116:8358): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=189844 res=0 errno=0 [ 464.179212][ T43] audit: type=1800 audit(1789390618.146:8359): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="type" dev="sysfs" ino=189848 res=0 errno=0 [ 464.185540][ T43] audit: type=1800 audit(1789390618.146:8360): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="ifindex" dev="sysfs" ino=189852 res=0 errno=0 [ 464.187977][T10691] 8021q: adding VLAN 0 to HW filter on device bond1 [ 464.191241][ T43] audit: type=1800 audit(1789390618.156:8361): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="iflink" dev="sysfs" ino=189851 res=0 errno=0 [ 464.191501][ T43] audit: type=1800 audit(1789390618.156:8362): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="addr_assign_type" dev="sysfs" ino=189854 res=0 errno=0 [ 464.207010][ T43] audit: type=1800 audit(1789390618.176:8363): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=190092 res=0 errno=0 [ 464.226302][ T43] audit: type=1800 audit(1789390618.186:8364): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=190166 res=0 errno=0 [ 464.226330][ T43] audit: type=1800 audit(1789390618.196:8365): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="type" dev="sysfs" ino=190170 res=0 errno=0 [ 464.261529][T10693] bond1: (slave geneve0): making interface the new active one [ 464.265105][ T9] usb 8-1: Using ep0 maxpacket: 32 [ 464.271842][ T9] usb 8-1: unable to get BOS descriptor or descriptor too short [ 464.271873][ T9] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 464.275085][ T9] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 464.275100][ T9] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 464.275110][ T9] usb 8-1: config 14 has no interface number 0 [ 464.275118][ T9] usb 8-1: config 14 has no interface number 1 [ 464.275140][ T9] usb 8-1: config 14 interface 57 has no altsetting 0 [ 464.275149][ T9] usb 8-1: config 14 interface 228 has no altsetting 0 [ 464.287661][T10693] bond1: (slave geneve0): Enslaving as an active interface with an up link [ 464.290201][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.290216][ T9] usb 8-1: Product: syz [ 464.290223][ T9] usb 8-1: Manufacturer: syz [ 464.290231][ T9] usb 8-1: SerialNumber: syz [ 464.515622][ T5751] Bluetooth: hci0: command 0x0406 tx timeout [ 464.515947][ T5751] Bluetooth: hci3: command 0x2016 tx timeout [ 464.519818][ T5747] Bluetooth: hci2: command 0x0406 tx timeout [ 466.018476][ T9] legousbtower 8-1:14.57: interrupt endpoints not found [ 466.024387][ T9] legousbtower 8-1:14.228: interrupt endpoints not found [ 466.030128][ T9] usb 8-1: USB disconnect, device number 11 [ 466.196220][T10732] netlink: 'syz.3.1194': attribute type 3 has an invalid length. [ 466.224402][T10732] FAULT_INJECTION: forcing a failure. [ 466.224402][T10732] name failslab, interval 1, probability 0, space 0, times 0 [ 466.224424][T10732] CPU: 0 UID: 0 PID: 10732 Comm: syz.3.1194 Tainted: G L syzkaller #0 PREEMPT(full) [ 466.224439][T10732] Tainted: [L]=SOFTLOCKUP [ 466.224443][T10732] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 466.224449][T10732] Call Trace: [ 466.224453][T10732] [ 466.224458][T10732] dump_stack_lvl+0x100/0x190 [ 466.224525][T10732] should_fail_ex.cold+0x5/0xa [ 466.224541][T10732] should_failslab+0xc2/0x120 [ 466.224576][T10732] __kmalloc_noprof+0xfc/0x840 [ 466.224588][T10732] ? kvm_io_bus_register_dev+0x1d2/0x710 [ 466.224605][T10732] kvm_io_bus_register_dev+0x1d2/0x710 [ 466.224622][T10732] kvm_pic_init+0x25e/0x380 [ 466.224641][T10732] kvm_arch_vm_ioctl+0xec4/0x18d0 [ 466.224654][T10732] ? __pfx_kvm_arch_vm_ioctl+0x10/0x10 [ 466.224687][T10732] ? stack_trace_save+0x8e/0xc0 [ 466.224723][T10732] ? __pfx_stack_trace_save+0x10/0x10 [ 466.224738][T10732] ? stack_depot_save_flags+0x27/0x9f0 [ 466.224755][T10732] ? __lock_acquire+0x5c0/0x1f40 [ 466.224773][T10732] ? process_measurement+0x10d0/0x2350 [ 466.224787][T10732] ? kasan_save_stack+0x3f/0x50 [ 466.224799][T10732] ? kasan_save_stack+0x30/0x50 [ 466.224810][T10732] ? kasan_save_track+0x14/0x30 [ 466.224822][T10732] ? kasan_save_free_info+0x3b/0x70 [ 466.224838][T10732] ? __kasan_slab_free+0x5f/0x80 [ 466.224850][T10732] ? kfree+0x22b/0x6d0 [ 466.224865][T10732] ? process_measurement+0x10d0/0x2350 [ 466.224877][T10732] ? ima_file_check+0xcc/0x120 [ 466.224889][T10732] ? security_file_post_open+0xc4/0x210 [ 466.224904][T10732] ? path_openat+0x5cd/0x2440 [ 466.224916][T10732] ? do_file_open+0x20e/0x430 [ 466.224928][T10732] ? do_sys_openat2+0x10f/0x1e0 [ 466.224943][T10732] ? __ia32_compat_sys_openat+0x12d/0x210 [ 466.224957][T10732] ? __do_fast_syscall_32+0x13a/0x8b0 [ 466.224997][T10732] ? do_fast_syscall_32+0x32/0x70 [ 466.225014][T10732] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 466.225034][T10732] ? __lock_acquire+0x5c0/0x1f40 [ 466.225065][T10732] ? __lock_acquire+0x5c0/0x1f40 [ 466.225090][T10732] ? __lock_acquire+0x5c0/0x1f40 [ 466.225112][T10732] ? lock_acquire+0x1d1/0x380 [ 466.225126][T10732] ? unwind_next_frame+0xbd/0x2090 [ 466.225141][T10732] ? lock_acquire+0x1d1/0x380 [ 466.225155][T10732] ? is_bpf_text_address+0x25/0x1a0 [ 466.225171][T10732] ? find_held_lock+0x2b/0x80 [ 466.225182][T10732] ? is_bpf_text_address+0x8a/0x1a0 [ 466.225196][T10732] ? is_bpf_text_address+0x8a/0x1a0 [ 466.225211][T10732] ? bpf_ksym_find+0x124/0x1c0 [ 466.225222][T10732] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 466.225237][T10732] ? is_bpf_text_address+0x94/0x1a0 [ 466.225252][T10732] ? kernel_text_address+0x8d/0x100 [ 466.225270][T10732] ? __pfx_widen_string+0x10/0x10 [ 466.225283][T10732] ? __kernel_text_address+0xd/0x30 [ 466.225297][T10732] ? unwind_get_return_address+0x59/0xa0 [ 466.225314][T10732] kvm_vm_ioctl+0x167d/0x42d0 [ 466.225329][T10732] ? tomoyo_path_number_perm+0x46d/0x580 [ 466.225345][T10732] ? stack_trace_save+0x8e/0xc0 [ 466.225360][T10732] ? __pfx_stack_trace_save+0x10/0x10 [ 466.225375][T10732] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 466.225385][T10732] ? __lock_acquire+0x5c0/0x1f40 [ 466.225400][T10732] ? tomoyo_path_number_perm+0x46d/0x580 [ 466.225416][T10732] ? kasan_save_stack+0x3f/0x50 [ 466.225428][T10732] ? kasan_save_stack+0x30/0x50 [ 466.225439][T10732] ? kasan_save_track+0x14/0x30 [ 466.225450][T10732] ? kasan_save_free_info+0x3b/0x70 [ 466.225466][T10732] ? __kasan_slab_free+0x5f/0x80 [ 466.225478][T10732] ? kfree+0x22b/0x6d0 [ 466.225493][T10732] ? tomoyo_path_number_perm+0x46d/0x580 [ 466.225507][T10732] ? security_file_ioctl_compat+0xd3/0x230 [ 466.225522][T10732] ? __ia32_compat_sys_ioctl+0xc2/0x360 [ 466.225539][T10732] ? __do_fast_syscall_32+0x13a/0x8b0 [ 466.225554][T10732] ? kvm_arch_vm_compat_ioctl+0x2d0/0x470 [ 466.225571][T10732] ? __pfx_kvm_arch_vm_compat_ioctl+0x10/0x10 [ 466.225601][T10732] ? kasan_quarantine_put+0x104/0x240 [ 466.225613][T10732] ? lockdep_hardirqs_on+0x7d/0x110 [ 466.225629][T10732] ? find_held_lock+0x2b/0x80 [ 466.225640][T10732] ? tomoyo_path_number_perm+0x28f/0x580 [ 466.225655][T10732] ? tomoyo_path_number_perm+0x28f/0x580 [ 466.225673][T10732] ? tomoyo_path_number_perm+0x188/0x580 [ 466.225689][T10732] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 466.225710][T10732] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 466.225726][T10732] ? do_vfs_ioctl+0x226/0x13e0 [ 466.225742][T10732] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 466.225761][T10732] kvm_vm_compat_ioctl+0x2f7/0x3f0 [ 466.225772][T10732] ? __pfx_kvm_vm_compat_ioctl+0x10/0x10 [ 466.225782][T10732] ? __fget_files+0x34/0x3d0 [ 466.225794][T10732] ? find_held_lock+0x2b/0x80 [ 466.225804][T10732] ? __fget_files+0x215/0x3d0 [ 466.225815][T10732] ? hook_file_ioctl_common+0x140/0x440 [ 466.225834][T10732] ? __fget_files+0x21f/0x3d0 [ 466.225849][T10732] ? __pfx_kvm_vm_compat_ioctl+0x10/0x10 [ 466.225860][T10732] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 466.225879][T10732] __do_fast_syscall_32+0x13a/0x8b0 [ 466.225898][T10732] do_fast_syscall_32+0x32/0x70 [ 466.225914][T10732] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 466.225928][T10732] RIP: 0023:0xf707efec [ 466.225942][T10732] Code: Unable to access opcode bytes at 0xf707efc2. [ 466.225947][T10732] RSP: 002b:00000000f546d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 466.225960][T10732] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 000000000000ae60 [ 466.225967][T10732] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 466.225974][T10732] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 466.225980][T10732] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 466.225986][T10732] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 466.226001][T10732] [ 466.834786][T10743] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1196'. [ 467.652375][T10735] ALSA: mixer_oss: invalid OSS volume '' [ 467.652404][T10735] ALSA: mixer_oss: invalid OSS volume '9[&?ļx;Bb[rSHٝsr' [ 467.652417][T10735] ALSA: mixer_oss: invalid OSS volume '`~'5{&]c} {x.e8' [ 467.652434][T10735] ALSA: mixer_oss: invalid OSS volume 'j'|]jpi?.>̡|' [ 467.652495][T10735] ALSA: mixer_oss: invalid OSS volume '\SO\ ,4Qx' [ 467.652506][T10735] ALSA: mixer_oss: invalid OSS volume 'Qq*h0;bZ1#<3 P' [ 467.652517][T10735] ALSA: mixer_oss: invalid OSS volume 'S ߌ_q' [ 467.652531][T10735] ALSA: mixer_oss: invalid OSS volume '):{bvijp"g_6fݢ' [ 467.652565][T10735] ALSA: mixer_oss: invalid OSS volume 'Xr]X[*ۇ8tf;v6' [ 467.652582][T10735] ALSA: mixer_oss: invalid OSS volume '8L&wrˍ' [ 467.652594][T10735] ALSA: mixer_oss: invalid OSS volume 'zap1oRR|/`' [ 467.652604][T10735] ALSA: mixer_oss: invalid OSS volume '_y4"PI]Yye3O|K7qa' [ 467.652647][T10735] ALSA: mixer_oss: invalid OSS volume '\Qa2` g34%aFa v' [ 467.652658][T10735] ALSA: mixer_oss: invalid OSS volume 'Avb4xf[k'3Rg' [ 467.652672][T10735] ALSA: mixer_oss: invalid OSS volume 'uneB?' [ 467.652712][T10735] ALSA: mixer_oss: invalid OSS volume 'Y*)i-?9j(/1G:ECWw' [ 467.866395][T10759] bond2 (unregistering): Released all slaves [ 467.997312][T10752] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 468.014467][T10752] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1199'. [ 468.093570][T10769] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 468.093592][T10769] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 468.093603][T10769] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 468.561869][T10784] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1203'. [ 468.579441][T10784] input: syz0 as /devices/virtual/input/input8 [ 469.230661][ T43] kauditd_printk_skb: 31 callbacks suppressed [ 469.230728][ T43] audit: type=1800 audit(1789390623.196:8397): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 469.424562][ T43] audit: type=1800 audit(1789390623.386:8398): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 469.871487][T10798] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1206'. [ 469.975877][ T43] audit: type=1326 audit(1789390623.946:8399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10792 comm="syz.1.1205" exe="/syz-executor" sig=9 arch=40000003 syscall=20 compat=1 ip=0xf7ff3fec code=0x0 [ 470.232358][ T43] audit: type=1800 audit(1789390624.196:8400): pid=10806 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1208" name="attach" dev="sysfs" ino=36236 res=0 errno=0 [ 470.232789][T10806] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(13) [ 470.232803][T10806] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 470.234014][T10806] vhci_hcd vhci_hcd.0: Device attached [ 470.242672][T10807] vhci_hcd: connection closed [ 470.243049][ T43] audit: type=1800 audit(1789390624.206:8401): pid=10806 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1208" name="pm_async" dev="sysfs" ino=579 res=0 errno=0 [ 470.262119][ T13] vhci_hcd vhci_hcd.3: stop threads [ 470.262135][ T13] vhci_hcd vhci_hcd.3: release socket [ 470.262145][ T13] vhci_hcd vhci_hcd.3: disconnect device [ 470.263470][ T43] audit: type=1800 audit(1789390624.226:8402): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 470.327773][ T43] audit: type=1800 audit(1789390624.296:8403): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 470.349459][T10813] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1209'. [ 470.358281][ T43] audit: type=1800 audit(1789390624.316:8404): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=191033 res=0 errno=0 [ 470.368656][T10815] ip6gretap0: entered promiscuous mode [ 470.502498][ T43] audit: type=1800 audit(1789390624.466:8405): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 470.536772][T10823] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1212'. [ 470.942975][ T43] audit: type=1800 audit(1789390624.906:8406): pid=10830 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1214" name="match_busid" dev="sysfs" ino=44074 res=0 errno=0 [ 470.978246][T10825] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 470.983215][T10825] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1213'. [ 471.349834][T10838] input: syz1 as /devices/virtual/input/input9 [ 471.419327][T10842] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1226'. [ 471.995576][T10849] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1228'. [ 472.802640][T10858] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1222'. [ 474.454726][T10878] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1227'. [ 474.768533][T10886] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1230'. [ 475.164919][ T43] kauditd_printk_skb: 18 callbacks suppressed [ 475.164932][ T43] audit: type=1800 audit(1789390629.126:8425): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 475.255654][T10895] syz.3.1233: vmalloc error: size 8589938688, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 475.255880][T10895] CPU: 0 UID: 0 PID: 10895 Comm: syz.3.1233 Tainted: G L syzkaller #0 PREEMPT(full) [ 475.255899][T10895] Tainted: [L]=SOFTLOCKUP [ 475.255904][T10895] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 475.255911][T10895] Call Trace: [ 475.255915][T10895] [ 475.255920][T10895] dump_stack_lvl+0x100/0x190 [ 475.255938][T10895] warn_alloc.cold+0x9e/0xb2 [ 475.255950][T10895] ? __pfx_warn_alloc+0x10/0x10 [ 475.255961][T10895] ? __kasan_kmalloc+0xaa/0xb0 [ 475.255973][T10895] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 475.255990][T10895] ? xskq_create+0x52/0x290 [ 475.256004][T10895] ? do_sock_setsockopt+0xf3/0x1d0 [ 475.256054][T10895] ? __do_fast_syscall_32+0x13a/0x8b0 [ 475.256072][T10895] ? do_fast_syscall_32+0x32/0x70 [ 475.256095][T10895] ? xsk_setsockopt+0x743/0xab0 [ 475.256110][T10895] __vmalloc_node_range_noprof+0x123b/0x1420 [ 475.256132][T10895] ? xsk_setsockopt+0x743/0xab0 [ 475.256149][T10895] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 475.256163][T10895] ? kasan_save_track+0x14/0x30 [ 475.256175][T10895] ? __kasan_kmalloc+0xaa/0xb0 [ 475.256188][T10895] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 475.256205][T10895] ? xskq_create+0x52/0x290 [ 475.256218][T10895] ? xsk_setsockopt+0x743/0xab0 [ 475.256231][T10895] xskq_create+0x18f/0x290 [ 475.256244][T10895] ? xsk_setsockopt+0x743/0xab0 [ 475.256258][T10895] xsk_setsockopt+0x743/0xab0 [ 475.256270][T10895] ? __pfx_aa_sk_perm+0x10/0x10 [ 475.256287][T10895] ? __pfx_xsk_setsockopt+0x10/0x10 [ 475.256299][T10895] ? find_held_lock+0x2b/0x80 [ 475.256313][T10895] ? aa_sock_opt_perm+0x114/0x1e0 [ 475.256326][T10895] ? __pfx_xsk_setsockopt+0x10/0x10 [ 475.256340][T10895] do_sock_setsockopt+0xf3/0x1d0 [ 475.256358][T10895] __sys_setsockopt+0x119/0x190 [ 475.256375][T10895] __ia32_sys_setsockopt+0xbc/0x160 [ 475.256396][T10895] ? __do_fast_syscall_32+0xb3/0x8b0 [ 475.256414][T10895] ? lockdep_hardirqs_on+0x7d/0x110 [ 475.256431][T10895] __do_fast_syscall_32+0x13a/0x8b0 [ 475.256450][T10895] do_fast_syscall_32+0x32/0x70 [ 475.256467][T10895] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 475.256482][T10895] RIP: 0023:0xf707efec [ 475.256495][T10895] Code: Unable to access opcode bytes at 0xf707efc2. [ 475.256500][T10895] RSP: 002b:00000000f546d50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 475.256510][T10895] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000000011b [ 475.256518][T10895] RDX: 0000000000000006 RSI: 0000000080000000 RDI: 0000000000000004 [ 475.256525][T10895] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 475.256532][T10895] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 475.256539][T10895] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 475.256555][T10895] [ 475.256559][T10895] Mem-Info: [ 475.256564][T10895] active_anon:6518 inactive_anon:781 isolated_anon:0 [ 475.256564][T10895] active_file:4327 inactive_file:23733 isolated_file:13 [ 475.256564][T10895] unevictable:1000 dirty:449 writeback:0 [ 475.256564][T10895] slab_reclaimable:6286 slab_unreclaimable:60387 [ 475.256564][T10895] mapped:24012 shmem:1533 pagetables:1271 [ 475.256564][T10895] sec_pagetables:311 bounce:0 [ 475.256564][T10895] kernel_misc_reclaimable:0 [ 475.256564][T10895] free:26903 free_pcp:18488 free_cma:0 [ 475.256590][T10895] Node 0 active_anon:84kB inactive_anon:0kB active_file:16kB inactive_file:116kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8608kB pagetables:1052kB sec_pagetables:1116kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 475.256617][T10895] Node 1 active_anon:25988kB inactive_anon:3124kB active_file:17292kB inactive_file:94816kB unevictable:4000kB isolated(anon):0kB isolated(file):52kB mapped:96020kB dirty:1796kB writeback:0kB shmem:6132kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:6308kB pagetables:4032kB sec_pagetables:128kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 475.256645][T10895] Node 0 DMA free:2020kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:252kB local_pcp:104kB free_cma:0kB [ 475.256698][T10895] lowmem_reserve[]: 0 277 277 277 277 [ 475.256719][T10895] Node 0 DMA32 free:15600kB boost:0kB min:12628kB low:15784kB high:18940kB reserved_highatomic:0kB free_highatomic:0kB active_anon:84kB inactive_anon:0kB active_file:16kB inactive_file:116kB unevictable:0kB writepending:0kB zspages:0kB present:1032196kB managed:284568kB mlocked:0kB bounce:0kB free_pcp:11188kB local_pcp:5072kB free_cma:0kB [ 475.256751][T10895] lowmem_reserve[]: 0 0 0 0 0 [ 475.256770][T10895] Node 1 DMA32 free:89992kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0kB free_highatomic:0kB active_anon:25988kB inactive_anon:3124kB active_file:17292kB inactive_file:94816kB unevictable:4000kB writepending:1796kB zspages:1692kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:62512kB local_pcp:32228kB free_cma:0kB [ 475.256803][T10895] lowmem_reserve[]: 0 0 0 0 0 [ 475.256822][T10895] Node 0 DMA: 7*4kB (U) 1*8kB (U) 0*16kB 6*32kB (UM) 8*64kB (UM) 0*128kB 1*256kB (M) 2*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 2020kB [ 475.256935][T10895] Node 0 DMA32: 70*4kB (UME) 55*8kB (UME) 40*16kB (UME) 59*32kB (UME) 45*64kB (UME) 18*128kB (UME) 12*256kB (UME) 6*512kB (UME) 1*1024kB (M) 0*2048kB 0*4096kB = 15600kB [ 475.257011][T10895] Node 1 DMA32: 972*4kB (UME) 633*8kB (UM) 293*16kB (UM) 330*32kB (UM) 144*64kB (UME) 96*128kB (UME) 65*256kB (UME) 29*512kB (UME) 8*1024kB (UM) 3*2048kB (UM) 0*4096kB = 91528kB [ 475.257106][T10895] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 475.257114][T10895] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 475.257123][T10895] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 475.257130][T10895] Node 1 hugepages_total=4 hugepages_free=0 hugepages_surp=2 hugepages_size=2048kB [ 475.257138][T10895] 29004 total pagecache pages [ 475.257142][T10895] 181 pages in swap cache [ 475.257146][T10895] Free swap = 117624kB [ 475.257150][T10895] Total swap = 124996kB [ 475.257154][T10895] 524155 pages RAM [ 475.257158][T10895] 0 pages HighMem/MovableOnly [ 475.257161][T10895] 212121 pages reserved [ 475.257165][T10895] 0 pages cma reserved [ 475.622984][ T43] audit: type=1800 audit(1789390629.586:8426): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 475.660716][T10903] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1234'. [ 476.980406][ T43] audit: type=1800 audit(1789390630.946:8427): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 477.088783][ T43] audit: type=1800 audit(1789390631.056:8428): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=191497 res=0 errno=0 [ 477.299967][ T43] audit: type=1800 audit(1789390631.266:8429): pid=10912 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1232" name="/" dev="fuse" ino=1 res=0 errno=0 [ 477.977954][T10919] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1237'. [ 478.074668][ T43] audit: type=1800 audit(1789390631.786:8430): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34540 res=0 errno=0 [ 478.075048][ T5164] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 478.075634][ T43] audit: type=1800 audit(1789390631.786:8431): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34563 res=0 errno=0 [ 478.630388][ T43] audit: type=1800 audit(1789390632.596:8432): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=191524 res=0 errno=0 [ 478.745055][ T5164] usb 6-1: Using ep0 maxpacket: 32 [ 478.748308][ T5164] usb 6-1: unable to get BOS descriptor or descriptor too short [ 478.748346][ T5164] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 478.749538][ T5164] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 478.749558][ T5164] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 478.749574][ T5164] usb 6-1: config 14 has no interface number 0 [ 478.749587][ T5164] usb 6-1: config 14 has no interface number 1 [ 478.749624][ T5164] usb 6-1: config 14 interface 57 has no altsetting 0 [ 478.749641][ T5164] usb 6-1: config 14 interface 228 has no altsetting 0 [ 478.752141][ T5164] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.752163][ T5164] usb 6-1: Product: syz [ 478.752176][ T5164] usb 6-1: Manufacturer: syz [ 478.752188][ T5164] usb 6-1: SerialNumber: syz [ 478.884900][ T43] audit: type=1800 audit(1789390632.846:8433): pid=10201 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=191572 res=0 errno=0 [ 478.889748][ T43] audit: type=1800 audit(1789390632.856:8434): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=4638 res=0 errno=0 [ 479.209449][ T5164] legousbtower 6-1:14.57: interrupt endpoints not found [ 479.211754][ T5164] legousbtower 6-1:14.228: interrupt endpoints not found [ 479.214253][ T5164] usb 6-1: USB disconnect, device number 21 [ 480.031936][T10950] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1238'. [ 480.856556][ T43] kauditd_printk_skb: 7 callbacks suppressed [ 480.856569][ T43] audit: type=1800 audit(1789390634.826:8442): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 480.893840][ T43] audit: type=1800 audit(1789390634.856:8443): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 481.043022][T10966] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1245'. [ 481.828321][ T43] audit: type=1800 audit(1789390635.796:8444): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 481.887340][ T43] audit: type=1800 audit(1789390635.856:8445): pid=10967 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1244" name="run" dev="sysfs" ino=1000 res=0 errno=0 [ 481.939964][ T43] audit: type=1800 audit(1789390635.906:8446): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 482.142492][T10973] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1246'. [ 482.261544][ T43] audit: type=1800 audit(1789390636.226:8447): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 482.871961][ T5747] Bluetooth: hci0: unexpected event for opcode 0x201c [ 483.001152][ T43] audit: type=1800 audit(1789390636.966:8448): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 483.269338][ T43] audit: type=1800 audit(1789390637.236:8449): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 483.848576][T11010] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1254'. [ 483.937178][ T43] audit: type=1800 audit(1789390637.906:8450): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 484.230702][T11015] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1256'. [ 484.255111][ T5164] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 484.406423][ T5164] usb 6-1: Using ep0 maxpacket: 32 [ 484.408310][ T5164] usb 6-1: unable to get BOS descriptor or descriptor too short [ 484.408333][ T5164] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 484.410670][ T5164] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 484.410683][ T5164] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 484.410693][ T5164] usb 6-1: config 14 has no interface number 0 [ 484.410701][ T5164] usb 6-1: config 14 has no interface number 1 [ 484.410723][ T5164] usb 6-1: config 14 interface 57 has no altsetting 0 [ 484.410732][ T5164] usb 6-1: config 14 interface 228 has no altsetting 0 [ 484.412698][ T5164] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.412711][ T5164] usb 6-1: Product: syz [ 484.412718][ T5164] usb 6-1: Manufacturer: syz [ 484.412725][ T5164] usb 6-1: SerialNumber: syz [ 484.435676][ T43] audit: type=1800 audit(1789390638.396:8451): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=191780 res=0 errno=0 [ 484.825403][T11021] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1257'. [ 486.095976][ T43] kauditd_printk_skb: 5 callbacks suppressed [ 486.095988][ T43] audit: type=1800 audit(1789390640.066:8457): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 486.251406][ T43] audit: type=1326 audit(1789390640.216:8458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11041 comm="syz.0.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 486.252384][ T43] audit: type=1326 audit(1789390640.216:8459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11041 comm="syz.0.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 486.286990][ T43] audit: type=1326 audit(1789390640.256:8460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11041 comm="syz.0.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 486.287986][ T43] audit: type=1326 audit(1789390640.256:8461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11041 comm="syz.0.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 486.288642][ T43] audit: type=1326 audit(1789390640.256:8462): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11041 comm="syz.0.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 486.311594][ T43] audit: type=1326 audit(1789390640.266:8463): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11041 comm="syz.0.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 486.332027][ T43] audit: type=1326 audit(1789390640.296:8464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11041 comm="syz.0.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 486.357586][ T43] audit: type=1326 audit(1789390640.316:8465): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11041 comm="syz.0.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 486.490662][ T43] audit: type=1326 audit(1789390640.456:8466): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11041 comm="syz.0.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71f75ab code=0x7ffc0000 [ 486.609827][ T5164] legousbtower 6-1:14.57: interrupt endpoints not found [ 486.612243][ T5164] legousbtower 6-1:14.228: interrupt endpoints not found [ 486.621037][ T5164] usb 6-1: USB disconnect, device number 22 [ 486.896908][T11044] /dev/nullb0: Can't open blockdev [ 487.227768][T11047] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1262'. [ 487.623023][T11055] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1264'. [ 487.638170][T11051] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1263'. [ 487.640987][T11054] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1265'. [ 487.701591][T11058] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1267'. [ 487.701984][T11059] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1266'. [ 489.415029][ T6120] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 489.520862][T11089] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1274'. [ 489.565088][ T6120] usb 7-1: Using ep0 maxpacket: 32 [ 489.568137][ T6120] usb 7-1: unable to get BOS descriptor or descriptor too short [ 489.568166][ T6120] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 489.569125][ T6120] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 489.569145][ T6120] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 489.569160][ T6120] usb 7-1: config 14 has no interface number 0 [ 489.569172][ T6120] usb 7-1: config 14 has no interface number 1 [ 489.569213][ T6120] usb 7-1: config 14 interface 57 has no altsetting 0 [ 489.569227][ T6120] usb 7-1: config 14 interface 228 has no altsetting 0 [ 489.571667][ T6120] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.571686][ T6120] usb 7-1: Product: syz [ 489.571698][ T6120] usb 7-1: Manufacturer: syz [ 489.571708][ T6120] usb 7-1: SerialNumber: syz [ 491.252871][T11097] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1276'. [ 491.330741][ T43] kauditd_printk_skb: 23 callbacks suppressed [ 491.330755][ T43] audit: type=1800 audit(1789390645.296:8490): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 491.379959][ T6120] legousbtower 7-1:14.57: interrupt endpoints not found [ 491.391249][ T6120] legousbtower 7-1:14.228: interrupt endpoints not found [ 491.392135][T11101] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1277'. [ 491.400557][ T6120] usb 7-1: USB disconnect, device number 11 [ 491.403714][ T43] audit: type=1800 audit(1789390645.366:8491): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="manufacturer" dev="sysfs" ino=191947 res=0 errno=0 [ 491.403761][ T43] audit: type=1800 audit(1789390645.366:8492): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="product" dev="sysfs" ino=191948 res=0 errno=0 [ 491.403795][ T43] audit: type=1800 audit(1789390645.366:8493): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="bcdDevice" dev="sysfs" ino=191927 res=0 errno=0 [ 491.419383][ T43] audit: type=1800 audit(1789390645.376:8494): pid=10206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="serial" dev="sysfs" ino=191949 res=0 errno=0 [ 491.464639][T11104] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1278'. [ 491.599394][ T43] audit: type=1800 audit(1789390645.566:8495): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 492.458106][ T43] audit: type=1800 audit(1789390646.426:8496): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 492.492185][ T43] audit: type=1800 audit(1789390646.456:8497): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 492.541044][ T43] audit: type=1800 audit(1789390646.506:8498): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15664 res=0 errno=0 [ 492.780959][T11127] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1286'. [ 492.906923][ T43] audit: type=1800 audit(1789390646.876:8499): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 493.003072][T11139] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1289'. [ 493.558086][T11149] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1290'. [ 494.205716][T11157] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1295'. [ 494.675302][T11169] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 494.681779][T11169] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1299'. [ 495.036223][T11181] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1300'. [ 495.270777][T11186] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1302'. [ 495.455618][T11192] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1304'. [ 495.931357][T11196] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1305'. [ 496.313573][T11207] [ 496.314390][T11207] ====================================================== [ 496.316571][T11207] WARNING: possible circular locking dependency detected [ 496.318745][T11207] syzkaller #0 Tainted: G L [ 496.320803][T11207] ------------------------------------------------------ [ 496.323213][T11207] syz.0.1315/11207 is trying to acquire lock: [ 496.325120][T11207] ffff88804e50df70 (&p->frag_sem){.+.+}-{4:4}, at: __configfs_open_file+0xe8/0x9c0 [ 496.328026][T11207] [ 496.328026][T11207] but task is already holding lock: [ 496.330315][T11207] ffff88806ae3a168 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x5ab/0x2350 [ 496.333604][T11207] [ 496.333604][T11207] which lock already depends on the new lock. [ 496.333604][T11207] [ 496.336790][T11207] [ 496.336790][T11207] the existing dependency chain (in reverse order) is: [ 496.339557][T11207] [ 496.339557][T11207] -> #3 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 496.342224][T11207] lock_acquire+0x1d1/0x380 [ 496.343829][T11207] __mutex_lock+0x1a4/0x1bd0 [ 496.345458][T11207] process_measurement+0x5ab/0x2350 [ 496.347228][T11207] ima_file_check+0xcc/0x120 [ 496.348836][T11207] security_file_post_open+0xc4/0x210 [ 496.350686][T11207] path_openat+0x5cd/0x2440 [ 496.352269][T11207] do_file_open+0x20e/0x430 [ 496.353861][T11207] do_sys_openat2+0x10f/0x1e0 [ 496.355653][T11207] __x64_sys_openat+0x12d/0x210 [ 496.357384][T11207] do_syscall_64+0x121/0x770 [ 496.359140][T11207] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.361159][T11207] [ 496.361159][T11207] -> #2 (sb_writers#5){.+.+}-{0:0}: [ 496.363465][T11207] lock_acquire+0x1d1/0x380 [ 496.365150][T11207] mnt_want_write+0x6f/0x420 [ 496.367193][T11207] lookup_open+0x150/0x1990 [ 496.369381][T11207] path_openat+0xa2c/0x2440 [ 496.371524][T11207] do_file_open+0x20e/0x430 [ 496.373670][T11207] file_open_name+0x1c3/0x3e0 [ 496.375885][T11207] filp_open+0x2e/0x50 [ 496.377870][T11207] nvmet_file_ns_enable+0x95/0x420 [ 496.380237][T11207] nvmet_ns_enable+0x43b/0x650 [ 496.382492][T11207] nvmet_ns_enable_store+0x11e/0x160 [ 496.384941][T11207] configfs_write_iter+0x302/0x4e0 [ 496.387316][T11207] vfs_write+0x6af/0x1050 [ 496.389382][T11207] ksys_write+0x12a/0x250 [ 496.391447][T11207] __do_fast_syscall_32+0x13a/0x8b0 [ 496.393856][T11207] do_fast_syscall_32+0x32/0x70 [ 496.396188][T11207] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 496.399021][T11207] [ 496.399021][T11207] -> #1 (&subsys->lock){+.+.}-{4:4}: [ 496.401955][T11207] lock_acquire+0x1d1/0x380 [ 496.404067][T11207] __mutex_lock+0x1a4/0x1bd0 [ 496.406273][T11207] nvmet_ns_buffered_io_store+0xc0/0x1e0 [ 496.408830][T11207] configfs_write_iter+0x302/0x4e0 [ 496.411181][T11207] vfs_write+0x6af/0x1050 [ 496.413248][T11207] ksys_write+0x12a/0x250 [ 496.415267][T11207] __do_fast_syscall_32+0x13a/0x8b0 [ 496.417635][T11207] do_fast_syscall_32+0x32/0x70 [ 496.419851][T11207] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 496.422701][T11207] [ 496.422701][T11207] -> #0 (&p->frag_sem){.+.+}-{4:4}: [ 496.425820][T11207] check_prev_add+0xeb/0xe60 [ 496.427967][T11207] __lock_acquire+0x1528/0x1f40 [ 496.429834][T11207] lock_acquire+0x1d1/0x380 [ 496.431522][T11207] down_read+0x99/0x4c0 [ 496.432984][T11207] __configfs_open_file+0xe8/0x9c0 [ 496.434688][T11207] do_dentry_open+0x6ab/0x14d0 [ 496.436335][T11207] vfs_open+0x82/0x3f0 [ 496.437763][T11207] dentry_open+0x71/0xd0 [ 496.439617][T11207] ima_calc_file_hash+0xe1/0x380 [ 496.441312][T11207] ima_collect_measurement+0x94f/0xb30 [ 496.443170][T11207] process_measurement+0xdfe/0x2350 [ 496.444938][T11207] ima_file_check+0xcc/0x120 [ 496.446490][T11207] security_file_post_open+0xc4/0x210 [ 496.448344][T11207] path_openat+0x5cd/0x2440 [ 496.449904][T11207] do_file_open+0x20e/0x430 [ 496.451472][T11207] do_sys_openat2+0x10f/0x1e0 [ 496.453107][T11207] __ia32_compat_sys_openat+0x12d/0x210 [ 496.454968][T11207] __do_fast_syscall_32+0x13a/0x8b0 [ 496.456734][T11207] do_fast_syscall_32+0x32/0x70 [ 496.458521][T11207] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 496.461380][T11207] [ 496.461380][T11207] other info that might help us debug this: [ 496.461380][T11207] [ 496.465598][T11207] Chain exists of: [ 496.465598][T11207] &p->frag_sem --> sb_writers#5 --> &ima_iint_mutex_key[depth] [ 496.465598][T11207] [ 496.470909][T11207] Possible unsafe locking scenario: [ 496.470909][T11207] [ 496.473987][T11207] CPU0 CPU1 [ 496.476201][T11207] ---- ---- [ 496.478418][T11207] lock(&ima_iint_mutex_key[depth]); [ 496.478744][ T43] kauditd_printk_skb: 12 callbacks suppressed [ 496.478759][ T43] audit: type=1800 audit(1789390650.446:8512): pid=11211 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1315" name="serialnumber" dev="configfs" ino=36632 res=0 errno=0 [ 496.492034][T11207] lock(sb_writers#5); [ 496.494573][T11207] lock(&ima_iint_mutex_key[depth]); [ 496.497295][T11207] rlock(&p->frag_sem); [ 496.498658][T11207] [ 496.498658][T11207] *** DEADLOCK *** [ 496.498658][T11207] [ 496.501480][T11207] locks held by syz.0.1315/11207: 1, last CPU#3: [ 496.503427][T11207] #0: ffff88806ae3a168 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x5ab/0x2350 [ 496.507633][T11207] [ 496.507633][T11207] stack backtrace: [ 496.509895][T11207] CPU: 3 UID: 0 PID: 11207 Comm: syz.0.1315 Tainted: G L syzkaller #0 PREEMPT(full) [ 496.513321][T11207] Tainted: [L]=SOFTLOCKUP [ 496.514611][T11207] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 496.517563][T11207] Call Trace: [ 496.518651][T11207] [ 496.519592][T11207] dump_stack_lvl+0x100/0x190 [ 496.521089][T11207] print_circular_bug.cold+0x178/0x1be [ 496.522802][T11207] check_noncircular+0x146/0x160 [ 496.524371][T11207] ? kasan_save_stack+0x30/0x50 [ 496.525906][T11207] ? process_measurement+0xdfe/0x2350 [ 496.527591][T11207] check_prev_add+0xeb/0xe60 [ 496.529072][T11207] ? do_fast_syscall_32+0x32/0x70 [ 496.530664][T11207] __lock_acquire+0x1528/0x1f40 [ 496.532229][T11207] lock_acquire+0x1d1/0x380 [ 496.533410][ T43] audit: type=1800 audit(1789390650.496:8513): pid=11210 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1315" name="UDC" dev="configfs" ino=36635 res=0 errno=0 [ 496.540426][T11207] ? __configfs_open_file+0xe8/0x9c0 [ 496.542681][T11207] ? __pfx___might_resched+0x10/0x10 [ 496.544886][T11207] down_read+0x99/0x4c0 [ 496.546605][T11207] ? __configfs_open_file+0xe8/0x9c0 [ 496.548811][T11207] ? __pfx_down_read+0x10/0x10 [ 496.550812][T11207] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 496.553112][T11207] ? __configfs_open_file+0xcb/0x9c0 [ 496.554809][T11207] __configfs_open_file+0xe8/0x9c0 [ 496.556730][T11207] do_dentry_open+0x6ab/0x14d0 [ 496.558431][T11207] ? __pfx_configfs_open_file+0x10/0x10 [ 496.560711][T11207] vfs_open+0x82/0x3f0 [ 496.562237][T11207] dentry_open+0x71/0xd0 [ 496.563590][T11207] ima_calc_file_hash+0xe1/0x380 [ 496.565163][T11207] ima_collect_measurement+0x94f/0xb30 [ 496.566865][T11207] ? __pfx_ima_collect_measurement+0x10/0x10 [ 496.568771][T11207] ? process_measurement+0x5ab/0x2350 [ 496.570447][T11207] ? is_bad_inode+0xd/0x40 [ 496.571842][T11207] ? xattr_resolve_name+0x27d/0x3f0 [ 496.573475][T11207] ? vfs_getxattr_alloc+0xec/0x350 [ 496.575072][T11207] ? ima_get_hash_algo+0x241/0x400 [ 496.576668][T11207] ? __pfx_ima_get_hash_algo+0x10/0x10 [ 496.578481][T11207] ? process_measurement+0xdfe/0x2350 [ 496.580748][T11207] process_measurement+0xdfe/0x2350 [ 496.582430][T11207] ? __pfx_process_measurement+0x10/0x10 [ 496.584206][T11207] ? lock_acquire+0x1d1/0x380 [ 496.585691][T11207] ? __configfs_open_file+0x6ca/0x9c0 [ 496.587364][T11207] ima_file_check+0xcc/0x120 [ 496.588846][T11207] ? __pfx_ima_file_check+0x10/0x10 [ 496.590475][T11207] security_file_post_open+0xc4/0x210 [ 496.592150][T11207] path_openat+0x5cd/0x2440 [ 496.593609][T11207] ? __pfx_path_openat+0x10/0x10 [ 496.595159][T11207] do_file_open+0x20e/0x430 [ 496.596594][T11207] ? __pfx_do_file_open+0x10/0x10 [ 496.598205][T11207] ? _raw_spin_unlock+0x28/0x50 [ 496.600108][T11207] ? alloc_fd+0x471/0x7a0 [ 496.601501][T11207] do_sys_openat2+0x10f/0x1e0 [ 496.602994][T11207] ? __pfx_do_sys_openat2+0x10/0x10 [ 496.604651][T11207] __ia32_compat_sys_openat+0x12d/0x210 [ 496.606372][T11207] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 496.608286][T11207] ? kmem_cache_free+0x127/0x6c0 [ 496.609991][T11207] __do_fast_syscall_32+0x13a/0x8b0 [ 496.611738][T11207] do_fast_syscall_32+0x32/0x70 [ 496.613476][T11207] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 496.615458][T11207] RIP: 0023:0xf7ff7fec [ 496.616867][T11207] Code: Unable to access opcode bytes at 0xf7ff7fc2. [ 496.619091][T11207] RSP: 002b:00000000f549550c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 496.621695][T11207] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000140 [ 496.624137][T11207] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 496.626634][T11207] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 496.629147][T11207] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 496.631607][T11207] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 496.634613][T11207] [ 496.653032][ T43] audit: type=1800 audit(1789390650.616:8514): pid=11207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1315" name="idVendor" dev="configfs" ino=28336 res=0 errno=0 [ 496.750156][ T43] audit: type=1800 audit(1789390650.716:8515): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15535 res=0 errno=0 [ 500.915842][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 500.915865][ T1441] ieee802154 phy1 wpan1: encryption failed: -22