last executing test programs: 3.241859787s ago: executing program 1 (id=714): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0xb, &(0x7f00000000c0)=ANY=[], &(0x7f0000000140)='syzkaller\x00', 0xa, 0xff5, &(0x7f0000000740)=""/4085, 0x41100}, 0x94) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2e, &(0x7f0000000180)=0xb1e0, 0x4) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = fsopen(&(0x7f00000001c0)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0xa) 3.24158309s ago: executing program 3 (id=715): set_mempolicy(0x3, &(0x7f0000000300)=0xfffffffffffffff7, 0x9) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000740)={'veth1_virt_wifi\x00', 0x0}) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000c00)=0x3da, 0x4) sendto$packet(r2, &(0x7f0000000c40)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000cc0)={0xc9, 0x0, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) 3.179306029s ago: executing program 1 (id=716): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc\x00', 0x10) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) write(r0, &(0x7f0000000000)='100', 0x3) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$nci(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) 3.15181556s ago: executing program 1 (id=718): syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, 0x0, 0x0, 0x0) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000500)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000580)=0x0, &(0x7f0000000600)=0x0, &(0x7f0000000640)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000680)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) r4 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000700), 0x2) r5 = memfd_create(&(0x7f0000000a00)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2) ftruncate(r5, 0xffff) fcntl$addseals(r5, 0x409, 0x3) close(0x3) ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f0000000bc0)={r5, 0x1, 0x0, 0x2000}) io_uring_enter(r0, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) 3.146457057s ago: executing program 3 (id=719): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) syz_usb_disconnect(r0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 3.079981462s ago: executing program 1 (id=720): add_key(&(0x7f00000055c0)='rxrpc\x00', 0x0, &(0x7f0000005640)="000000000000000463656c6c00000001000000440000000600"/44, 0x2c, 0xffffffffffffffff) 3.011975493s ago: executing program 1 (id=721): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$kcm(0x21, 0x2, 0xa) socket(0xa, 0x3, 0xff) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) write(r0, &(0x7f0000000600)='0', 0x1) 2.242015785s ago: executing program 1 (id=722): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl(r0, 0x400452c8, &(0x7f0000000180)="000000000000000000000000000000000000000001") mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000067c0)='./dev\x00', &(0x7f0000006800)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000006840)='./dev/rfcomm0\x00', 0x802, 0x0) syz_open_dev$dvb_demux(0x0, 0x0, 0x121023) write$UHID_GET_REPORT_REPLY(r1, &(0x7f0000010500)={0xa, {0x3, 0x5, 0x40}}, 0xa) 1.849788812s ago: executing program 2 (id=725): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0xb, &(0x7f00000000c0)=ANY=[], &(0x7f0000000140)='syzkaller\x00', 0xa, 0xff5, &(0x7f0000000740)=""/4085, 0x41100}, 0x94) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2e, &(0x7f0000000180)=0xb1e0, 0x4) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = fsopen(&(0x7f00000001c0)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0xa) 1.762360681s ago: executing program 3 (id=727): eventfd2(0x9, 0x0) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000200)={0x0, 0x2ca6, 0x3000, 0x1, 0x40055}, &(0x7f0000000280)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000300)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000340)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r0, 0x2000000, 0xfffffffd, 0x4b, 0x0, 0x0) 1.76221726s ago: executing program 3 (id=728): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000200)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r0, 0x5) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="02c90012000e00050017420a00800000020002"], 0x17) close(0x3) 1.617917066s ago: executing program 2 (id=731): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000000040)=[{{&(0x7f0000000080)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) shutdown(r0, 0x1) 1.532083579s ago: executing program 2 (id=732): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) write$dsp(r0, &(0x7f0000000080)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000340)={0x0, 0x3, 0x800, 0x1, 0x40055}, &(0x7f00000003c0)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000440)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000480)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x54}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) r5 = syz_open_procfs(0x0, 0x0) getdents(r5, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f00000000c0)=0xa) landlock_restrict_self(0xffffffffffffffff, 0xc) 1.151861263s ago: executing program 3 (id=733): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x8021}, 0x4048800) r0 = gettid() r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000300), 0x0) read(r1, &(0x7f0000000340)=""/201, 0xc9) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000440)={0x335, @tick=0xe, 0x42, {}, 0x2}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r1, 0xc04c5349, 0x0) tkill(r0, 0x7) 1.002235185s ago: executing program 3 (id=735): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) syz_usb_disconnect(r0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 651.898209ms ago: executing program 2 (id=736): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xf, 0x4, 0x4, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1e, 0x11, &(0x7f0000000340)=ANY=[@ANYBLOB="bf16000000000000620afcff00000000bfa200000000000007020000fcffffff1851000000000000000000000000000085000000010000001500070000000000bf"], &(0x7f0000000400)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=[r0], 0x0, 0x0}, 0x94) 651.174239ms ago: executing program 2 (id=737): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(0x0, r0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, 0x0, 0x400c004) syz_emit_ethernet(0x36, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa05, 0x0) r2 = msgget$private(0x0, 0x1f3) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, 0x0, 0x8000) recvmsg(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000000)=""/233, 0xe9}], 0x1, &(0x7f0000002d00)=""/4080, 0xff0}, 0x0) close(r3) msgsnd(r2, &(0x7f00000001c0)=ANY=[], 0x8, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc040) 380.510824ms ago: executing program 2 (id=738): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) syz_usb_connect(0x6, 0x371, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x6ad01, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sysfs$3(0x3) close(0x3) 202.303274ms ago: executing program 0 (id=739): r0 = fsopen(&(0x7f00000001c0)='overlay\x00', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='.\x00', 0x0, 0x10) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000240)='workdir', 0x0, r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000540)={0x1, &(0x7f0000000580)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 202.174451ms ago: executing program 0 (id=740): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00') close_range(r0, 0xffffffffffffffff, 0x0) 152.189426ms ago: executing program 0 (id=741): openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x8416, 0x0) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) write(r0, &(0x7f0000000400)="ffee13e00e441feb772871b38542755abb79ac4adaa3a56151b4e5049aac7d66b3eb2c5f2da7fdaa1cbac88f60d46f2121992056e5cac8ae771d0f4bc4ab6be46a270e18", 0x44) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r0, 0xc020662a, &(0x7f00000004c0)={0x4, 0x4, 0x5, 0x102, 0x1, 0x0, [{0x80, 0x5, 0x7, '\x00', 0x600}]}) 151.879464ms ago: executing program 0 (id=742): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bb26, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0xffff, 0xb}, {0xfff7, 0xffe0}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x4894) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 833.259µs ago: executing program 0 (id=743): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0xb, &(0x7f00000000c0)=ANY=[], &(0x7f0000000140)='syzkaller\x00', 0xa, 0xff5, &(0x7f0000000740)=""/4085, 0x41100}, 0x94) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2e, &(0x7f0000000180)=0xb1e0, 0x4) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) fsopen(&(0x7f00000001c0)='sysfs\x00', 0x0) r0 = fsopen(&(0x7f0000000200)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0xa) 0s ago: executing program 0 (id=744): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) write$dsp(r0, &(0x7f0000000080)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000340)={0x0, 0x3, 0x800, 0x1, 0x40055}, &(0x7f00000003c0)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000440)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000480)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x54}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f00000000c0)=0xa) landlock_restrict_self(0xffffffffffffffff, 0xc) 0s ago: executing program 2 (id=745): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r0 = syz_open_dev$dvb_demux(0x0, 0x2, 0x45200) ioctl$DVB_DEMUX_DMX_QUERYBUF(r0, 0xc0186f3d, &(0x7f0000000280)={0x4, 0xd7c, 0x0, 0x9, 0x4, 0x9}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, 0x0) symlinkat(&(0x7f0000000440)='./sys\x00', 0xffffffffffffff9c, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, &(0x7f0000001440)=[{{&(0x7f0000001480)={0xa, 0x4e23, 0x6, @mcast2, 0x10}, 0x1c, &(0x7f00000014c0)}}], 0x1, 0x1c010) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc018643a, &(0x7f0000001500)={0x10000000, 0x1c6a8b68, 0x6}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000001540)={0x0, 0x0, 0x0, &(0x7f00000015c0)}) mount(0x0, &(0x7f0000001600)='./sys\x00', &(0x7f0000001640)='sysfs\x00', 0x9048ef, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001680)='./file0\x00', 0x1, 0x0) write(r2, &(0x7f00000016c0)='usbip', 0x5) openat(0xffffffffffffff9c, &(0x7f0000001700)='./file0\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001740)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000001780)='./config\x00', &(0x7f00000017c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001800)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001880)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000018c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001940)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff) symlinkat(&(0x7f0000001980)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000019c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00') symlinkat(&(0x7f0000001a00)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001a40)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000001a80)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001ac0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00') symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000001b00)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00') r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000001b80)={0x0, 0x0, &(0x7f0000001bc0)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x0) symlinkat(&(0x7f0000001c00)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001c40)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00') kernel console output (not intermixed with test programs): after parsing attributes in process `syz.1.34'. [ 48.340493][ T6027] Invalid ELF header magic: != ELF [ 48.469029][ T6026] Invalid ELF header magic: != ELF [ 48.492755][ T6026] overlay: Unknown parameter '/' [ 48.902849][ T6036] Invalid ELF header magic: != ELF [ 48.959914][ T6036] overlay: Unknown parameter '/' [ 49.214880][ T9] rxe_eth0 speed is unknown, defaulting to 1000 [ 49.433936][ T6042] Invalid ELF header magic: != ELF [ 49.440622][ T6042] overlay: Unknown parameter '/' [ 49.731897][ T6049] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 49.733193][ T6049] qnx6: wrong signature (magic) in superblock #1. [ 49.733200][ T6049] qnx6: unable to read the first superblock [ 49.738732][ T6049] netlink: 'syz.2.41': attribute type 2 has an invalid length. [ 49.738744][ T6049] netlink: 208 bytes leftover after parsing attributes in process `syz.2.41'. [ 49.738753][ T6049] netlink: 'syz.2.41': attribute type 2 has an invalid length. [ 49.982827][ T6060] binder: 6056:6060 ioctl c0306201 80000200 returned -14 [ 50.072191][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 50.388627][ T6079] Invalid ELF header magic: != ELF [ 50.555572][ T6078] overlay: Unknown parameter '/' [ 50.986688][ T6083] Invalid ELF header magic: != ELF [ 51.136409][ T6089] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 51.136495][ T6089] qnx6: wrong signature (magic) in superblock #1. [ 51.136501][ T6089] qnx6: unable to read the first superblock [ 51.141902][ T6089] netlink: 'syz.3.51': attribute type 2 has an invalid length. [ 51.141914][ T6089] netlink: 208 bytes leftover after parsing attributes in process `syz.3.51'. [ 51.141922][ T6089] netlink: 'syz.3.51': attribute type 2 has an invalid length. [ 51.292055][ T6097] overlayfs: missing 'lowerdir' [ 51.298078][ T6099] FAULT_INJECTION: forcing a failure. [ 51.298078][ T6099] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 51.298097][ T6099] CPU: 3 UID: 0 PID: 6099 Comm: syz.3.54 Not tainted syzkaller #0 PREEMPT(full) [ 51.298109][ T6099] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 51.298116][ T6099] Call Trace: [ 51.298120][ T6099] [ 51.298125][ T6099] dump_stack_lvl+0x100/0x190 [ 51.298143][ T6099] should_fail_ex.cold+0x5/0xa [ 51.298158][ T6099] _copy_from_user+0x2e/0xd0 [ 51.298170][ T6099] get_compat_msghdr+0xb3/0x480 [ 51.298187][ T6099] ? __pfx_get_compat_msghdr+0x10/0x10 [ 51.298208][ T6099] ___sys_sendmsg+0x1b6/0x1e0 [ 51.298226][ T6099] ? __pfx____sys_sendmsg+0x10/0x10 [ 51.298249][ T6099] ? find_held_lock+0x2b/0x80 [ 51.298270][ T6099] __sys_sendmsg+0x160/0x210 [ 51.298284][ T6099] ? __pfx___sys_sendmsg+0x10/0x10 [ 51.298300][ T6099] ? __pfx_ksys_write+0x10/0x10 [ 51.298317][ T6099] __do_fast_syscall_32+0x13a/0x8b0 [ 51.298329][ T6099] ? lockdep_hardirqs_on+0x7d/0x110 [ 51.298347][ T6099] do_fast_syscall_32+0x32/0x70 [ 51.298358][ T6099] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 51.298372][ T6099] RIP: 0023:0xf739efec [ 51.298384][ T6099] Code: Unable to access opcode bytes at 0xf739efc2. [ 51.298389][ T6099] RSP: 002b:00000000f53b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 51.298400][ T6099] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000e00 [ 51.298407][ T6099] RDX: 0000000024080888 RSI: 0000000000000000 RDI: 0000000000000000 [ 51.298413][ T6099] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 51.298419][ T6099] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 51.298425][ T6099] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 51.298438][ T6099] [ 51.298810][ T6097] binder: 6096:6097 ioctl c0306201 80000500 returned -14 [ 51.299067][ T6097] binder: 6096:6097 ioctl c0306201 800005c0 returned -14 [ 51.299591][ T6097] binder: 6096:6097 ioctl c0306201 80000680 returned -14 [ 51.344770][ T6102] overlay: Unknown parameter '/' [ 51.699657][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 51.708775][ T6101] trusted_key: encrypted_key: insufficient parameters specified [ 51.914945][ T6113] Invalid ELF header magic: != ELF [ 51.922362][ T6113] overlay: Unknown parameter '/' [ 52.122371][ T6117] Invalid ELF header magic: != ELF [ 52.266152][ T6116] overlay: Unknown parameter '/' [ 52.405663][ T6124] Invalid ELF header magic: != ELF [ 52.584636][ T6129] Invalid ELF header magic: != ELF [ 52.585544][ T6120] overlay: Unknown parameter '/' [ 52.809797][ T5838] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 53.036534][ T5838] usb 6-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 53.043088][ T5838] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 53.043140][ T5838] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 53.043189][ T5838] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 52, changing to 9 [ 53.043239][ T5838] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 8241, setting to 1024 [ 53.053445][ T5838] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.053465][ T5838] usb 6-1: Product: syz [ 53.053476][ T5838] usb 6-1: Manufacturer: syz [ 53.053487][ T5838] usb 6-1: SerialNumber: syz [ 53.078127][ T5838] usb 6-1: config 0 descriptor?? [ 53.111988][ T6136] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 53.112080][ T6136] qnx6: wrong signature (magic) in superblock #1. [ 53.112085][ T6136] qnx6: unable to read the first superblock [ 53.117828][ T6136] netlink: 'syz.0.67': attribute type 2 has an invalid length. [ 53.117840][ T6136] netlink: 208 bytes leftover after parsing attributes in process `syz.0.67'. [ 53.117849][ T6136] netlink: 'syz.0.67': attribute type 2 has an invalid length. [ 53.344923][ T5838] adutux 6-1:0.0: ADU208 now attached to /dev/usb/adutux0 [ 53.358619][ T5838] usb 6-1: USB disconnect, device number 2 [ 53.622709][ T6148] Invalid ELF header magic: != ELF [ 54.568137][ T6165] Invalid ELF header magic: != ELF [ 54.572269][ T6164] Invalid ELF header magic: != ELF [ 54.643398][ T6164] overlay: Unknown parameter '/' [ 55.208479][ T6169] netlink: 12 bytes leftover after parsing attributes in process `syz.3.74'. [ 55.829394][ T6174] Invalid ELF header magic: != ELF [ 55.920361][ T6178] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 55.920451][ T6178] qnx6: wrong signature (magic) in superblock #1. [ 55.920456][ T6178] qnx6: unable to read the first superblock [ 55.924242][ T6178] netlink: 'syz.0.77': attribute type 2 has an invalid length. [ 55.924253][ T6178] netlink: 208 bytes leftover after parsing attributes in process `syz.0.77'. [ 55.924261][ T6178] netlink: 'syz.0.77': attribute type 2 has an invalid length. [ 56.016224][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 56.149772][ T42] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 56.304647][ T42] usb 7-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 56.313873][ T42] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 56.314032][ T42] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 56.314045][ T42] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 52, changing to 9 [ 56.314057][ T42] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 8241, setting to 1024 [ 56.322251][ T42] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.322333][ T42] usb 7-1: Product: syz [ 56.322342][ T42] usb 7-1: Manufacturer: syz [ 56.322546][ T42] usb 7-1: SerialNumber: syz [ 56.363710][ T42] usb 7-1: config 0 descriptor?? [ 56.441553][ T6187] FAULT_INJECTION: forcing a failure. [ 56.441553][ T6187] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 56.441573][ T6187] CPU: 1 UID: 0 PID: 6187 Comm: syz.1.81 Not tainted syzkaller #0 PREEMPT(full) [ 56.441585][ T6187] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 56.441592][ T6187] Call Trace: [ 56.441596][ T6187] [ 56.441600][ T6187] dump_stack_lvl+0x100/0x190 [ 56.441620][ T6187] should_fail_ex.cold+0x5/0xa [ 56.441639][ T6187] _copy_from_user+0x2e/0xd0 [ 56.441656][ T6187] get_compat_msghdr+0xb3/0x480 [ 56.441680][ T6187] ? __pfx_get_compat_msghdr+0x10/0x10 [ 56.441711][ T6187] ___sys_sendmsg+0x1b6/0x1e0 [ 56.441740][ T6187] ? __pfx____sys_sendmsg+0x10/0x10 [ 56.441780][ T6187] ? find_held_lock+0x2b/0x80 [ 56.441817][ T6187] __sys_sendmsg+0x160/0x210 [ 56.441838][ T6187] ? __pfx___sys_sendmsg+0x10/0x10 [ 56.441865][ T6187] ? __pfx_ksys_write+0x10/0x10 [ 56.441890][ T6187] __do_fast_syscall_32+0x13a/0x8b0 [ 56.441902][ T6187] ? lockdep_hardirqs_on+0x7d/0x110 [ 56.441920][ T6187] do_fast_syscall_32+0x32/0x70 [ 56.441932][ T6187] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 56.441946][ T6187] RIP: 0023:0xf7fe7fec [ 56.441958][ T6187] Code: Unable to access opcode bytes at 0xf7fe7fc2. [ 56.441964][ T6187] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 56.441974][ T6187] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000d80 [ 56.441981][ T6187] RDX: 0000000000004040 RSI: 0000000000000000 RDI: 0000000000000000 [ 56.442002][ T6187] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 56.442009][ T6187] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 56.442016][ T6187] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 56.442030][ T6187] [ 56.592250][ T42] adutux 7-1:0.0: ADU208 now attached to /dev/usb/adutux0 [ 56.606829][ T42] usb 7-1: USB disconnect, device number 2 [ 56.644946][ T6190] Invalid ELF header magic: != ELF [ 56.651247][ T6190] overlay: Unknown parameter '/' [ 56.773015][ T6194] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 56.773110][ T6194] qnx6: wrong signature (magic) in superblock #1. [ 56.773115][ T6194] qnx6: unable to read the first superblock [ 56.779160][ T6194] netlink: 'syz.3.83': attribute type 2 has an invalid length. [ 56.779177][ T6194] netlink: 208 bytes leftover after parsing attributes in process `syz.3.83'. [ 56.779190][ T6194] netlink: 'syz.3.83': attribute type 2 has an invalid length. [ 56.990876][ T6205] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 56.990960][ T6205] qnx6: wrong signature (magic) in superblock #1. [ 56.990964][ T6205] qnx6: unable to read the first superblock [ 56.993797][ T6205] netlink: 'syz.0.87': attribute type 2 has an invalid length. [ 56.993809][ T6205] netlink: 208 bytes leftover after parsing attributes in process `syz.0.87'. [ 56.993817][ T6205] netlink: 'syz.0.87': attribute type 2 has an invalid length. [ 57.078007][ T6210] netlink: 'syz.0.88': attribute type 2 has an invalid length. [ 57.078031][ T6210] netlink: 'syz.0.88': attribute type 1 has an invalid length. [ 57.078038][ T6210] netlink: 16 bytes leftover after parsing attributes in process `syz.0.88'. [ 57.078046][ T6210] netlink: 16 bytes leftover after parsing attributes in process `syz.0.88'. [ 57.078054][ T6210] iwpm_mapping_error_cb: Received msg seq = 0 err code = 5 client = 2 [ 57.118364][ T6211] Invalid ELF header magic: != ELF [ 57.123857][ T6211] overlay: Unknown parameter '/' [ 57.335173][ T6215] Invalid ELF header magic: != ELF [ 57.617842][ T6219] netlink: 12 bytes leftover after parsing attributes in process `syz.0.90'. [ 58.622298][ T6231] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 58.622463][ T6231] qnx6: wrong signature (magic) in superblock #1. [ 58.622471][ T6231] qnx6: unable to read the first superblock [ 58.626950][ T6231] validate_nla: 2 callbacks suppressed [ 58.626966][ T6231] netlink: 'syz.0.97': attribute type 2 has an invalid length. [ 58.626977][ T6231] netlink: 208 bytes leftover after parsing attributes in process `syz.0.97'. [ 58.626991][ T6231] netlink: 'syz.0.97': attribute type 2 has an invalid length. [ 58.949845][ T5838] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 59.040488][ T6239] Invalid ELF header magic: != ELF [ 59.046177][ T6239] overlay: Unknown parameter '/' [ 59.130169][ T5838] usb 5-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 59.130990][ T5838] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 59.131005][ T5838] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 59.131016][ T5838] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 52, changing to 9 [ 59.131028][ T5838] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 8241, setting to 1024 [ 59.132574][ T5838] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 59.132586][ T5838] usb 5-1: Product: syz [ 59.132593][ T5838] usb 5-1: Manufacturer: syz [ 59.132600][ T5838] usb 5-1: SerialNumber: syz [ 59.134564][ T5838] usb 5-1: config 0 descriptor?? [ 59.242348][ T6244] overlay: Unknown parameter '/' [ 59.352793][ T5838] adutux 5-1:0.0: ADU208 now attached to /dev/usb/adutux0 [ 59.391278][ T5838] usb 5-1: USB disconnect, device number 3 [ 59.481405][ T6251] Invalid ELF header magic: != ELF [ 59.486781][ T6251] overlay: Unknown parameter '/' [ 60.385886][ T6263] overlay: Unknown parameter '/' [ 61.063125][ T6268] Invalid ELF header magic: != ELF [ 61.158071][ T2337] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 61.237340][ T6271] FAULT_INJECTION: forcing a failure. [ 61.237340][ T6271] name failslab, interval 1, probability 0, space 0, times 1 [ 61.237398][ T6271] CPU: 1 UID: 0 PID: 6271 Comm: syz.3.107 Not tainted syzkaller #0 PREEMPT(full) [ 61.237423][ T6271] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 61.237429][ T6271] Call Trace: [ 61.237434][ T6271] [ 61.237439][ T6271] dump_stack_lvl+0x100/0x190 [ 61.237458][ T6271] should_fail_ex.cold+0x5/0xa [ 61.237473][ T6271] should_failslab+0xc2/0x120 [ 61.237491][ T6271] __kmalloc_noprof+0xfc/0x840 [ 61.237505][ T6271] ? rcu_is_watching+0x13/0xc0 [ 61.237518][ T6271] ? tomoyo_realpath_from_path+0xb6/0x690 [ 61.237537][ T6271] tomoyo_realpath_from_path+0xb6/0x690 [ 61.237556][ T6271] tomoyo_path_number_perm+0x23c/0x580 [ 61.237569][ T6271] ? tomoyo_path_number_perm+0x22e/0x580 [ 61.237583][ T6271] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 61.237597][ T6271] ? finish_task_switch.isra.0+0x2bd/0x10d0 [ 61.237619][ T6271] ? __lock_acquire+0x5c0/0x1f40 [ 61.237642][ T6271] ? __fget_files+0x34/0x3d0 [ 61.237657][ T6271] ? find_held_lock+0x2b/0x80 [ 61.237669][ T6271] ? __fget_files+0x215/0x3d0 [ 61.237682][ T6271] ? hook_file_ioctl_common+0x140/0x440 [ 61.237696][ T6271] ? __fget_files+0x215/0x3d0 [ 61.237713][ T6271] ? __fget_files+0x21f/0x3d0 [ 61.237729][ T6271] security_file_ioctl_compat+0xd3/0x230 [ 61.237744][ T6271] __ia32_compat_sys_ioctl+0xc2/0x360 [ 61.237759][ T6271] __do_fast_syscall_32+0x13a/0x8b0 [ 61.237771][ T6271] ? lockdep_hardirqs_on+0x7d/0x110 [ 61.237789][ T6271] do_fast_syscall_32+0x32/0x70 [ 61.237800][ T6271] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 61.237814][ T6271] RIP: 0023:0xf739efec [ 61.237828][ T6271] Code: Unable to access opcode bytes at 0xf739efc2. [ 61.237833][ T6271] RSP: 002b:00000000f539550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 61.237844][ T6271] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000004c81 [ 61.237851][ T6271] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 61.237857][ T6271] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 61.237863][ T6271] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 61.237869][ T6271] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 61.237883][ T6271] [ 61.237910][ T6271] ERROR: Out of memory at tomoyo_realpath_from_path. [ 61.391003][ T2337] usb 5-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 61.391810][ T2337] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 61.391825][ T2337] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 61.391836][ T2337] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 52, changing to 9 [ 61.391849][ T2337] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 8241, setting to 1024 [ 61.393296][ T2337] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.393307][ T2337] usb 5-1: Product: syz [ 61.393314][ T2337] usb 5-1: Manufacturer: syz [ 61.393322][ T2337] usb 5-1: SerialNumber: syz [ 61.395564][ T2337] usb 5-1: config 0 descriptor?? [ 61.556429][ T6273] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 61.556560][ T6273] qnx6: wrong signature (magic) in superblock #1. [ 61.556566][ T6273] qnx6: unable to read the first superblock [ 61.561233][ T6273] netlink: 'syz.2.108': attribute type 2 has an invalid length. [ 61.561245][ T6273] netlink: 208 bytes leftover after parsing attributes in process `syz.2.108'. [ 61.561253][ T6273] netlink: 'syz.2.108': attribute type 2 has an invalid length. [ 61.604390][ T2337] adutux 5-1:0.0: ADU208 now attached to /dev/usb/adutux0 [ 61.608635][ T2337] usb 5-1: USB disconnect, device number 4 [ 61.915012][ T6281] Invalid ELF header magic: != ELF [ 61.925820][ T6281] overlay: Unknown parameter '/' [ 62.364677][ T6290] Invalid ELF header magic: != ELF [ 62.373584][ T6290] overlay: Unknown parameter '/' [ 62.898745][ T6298] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 62.898909][ T6298] qnx6: wrong signature (magic) in superblock #1. [ 62.898916][ T6298] qnx6: unable to read the first superblock [ 62.915541][ T6298] netlink: 'syz.2.118': attribute type 2 has an invalid length. [ 62.915555][ T6298] netlink: 208 bytes leftover after parsing attributes in process `syz.2.118'. [ 62.915563][ T6298] netlink: 'syz.2.118': attribute type 2 has an invalid length. [ 63.172082][ T6308] FAULT_INJECTION: forcing a failure. [ 63.172082][ T6308] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 63.172102][ T6308] CPU: 0 UID: 0 PID: 6308 Comm: syz.0.121 Not tainted syzkaller #0 PREEMPT(full) [ 63.172116][ T6308] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 63.172122][ T6308] Call Trace: [ 63.172126][ T6308] [ 63.172131][ T6308] dump_stack_lvl+0x100/0x190 [ 63.172150][ T6308] should_fail_ex.cold+0x5/0xa [ 63.172164][ T6308] _copy_from_user+0x2e/0xd0 [ 63.172176][ T6308] get_compat_msghdr+0xb3/0x480 [ 63.172193][ T6308] ? __pfx_get_compat_msghdr+0x10/0x10 [ 63.172211][ T6308] ? __lock_acquire+0x5c0/0x1f40 [ 63.172230][ T6308] ___sys_recvmsg+0x193/0x1a0 [ 63.172248][ T6308] ? __pfx____sys_recvmsg+0x10/0x10 [ 63.172265][ T6308] ? lock_acquire+0x1d1/0x380 [ 63.172291][ T6308] do_recvmmsg+0x54d/0x740 [ 63.172310][ T6308] ? __pfx_do_recvmmsg+0x10/0x10 [ 63.172328][ T6308] ? find_held_lock+0x2b/0x80 [ 63.172341][ T6308] ? ksys_write+0x190/0x250 [ 63.172355][ T6308] ? ksys_write+0x190/0x250 [ 63.172373][ T6308] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 63.172387][ T6308] __sys_recvmmsg+0x21f/0x270 [ 63.172401][ T6308] ? __pfx___sys_recvmmsg+0x10/0x10 [ 63.172416][ T6308] ? ksys_write+0x1ac/0x250 [ 63.172431][ T6308] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 63.172449][ T6308] ? __do_fast_syscall_32+0xb3/0x8b0 [ 63.172460][ T6308] ? lockdep_hardirqs_on+0x7d/0x110 [ 63.172476][ T6308] __do_fast_syscall_32+0x13a/0x8b0 [ 63.172487][ T6308] ? lockdep_hardirqs_on+0x7d/0x110 [ 63.172505][ T6308] do_fast_syscall_32+0x32/0x70 [ 63.172516][ T6308] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 63.172530][ T6308] RIP: 0023:0xf743efec [ 63.172542][ T6308] Code: Unable to access opcode bytes at 0xf743efc2. [ 63.172547][ T6308] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 63.172558][ T6308] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 63.172565][ T6308] RDX: 0000000000010106 RSI: 0000000000000002 RDI: 0000000000000000 [ 63.172571][ T6308] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 63.172577][ T6308] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 63.172583][ T6308] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 63.172597][ T6308] [ 63.405171][ T6318] Invalid ELF header magic: != ELF [ 63.416562][ T6318] overlay: Unknown parameter '/' [ 63.426321][ T6319] Invalid ELF header magic: != ELF [ 63.516310][ T6321] Invalid ELF header magic: != ELF [ 63.745611][ T6324] Invalid ELF header magic: != ELF [ 64.054771][ T6330] FAULT_INJECTION: forcing a failure. [ 64.054771][ T6330] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 64.054792][ T6330] CPU: 3 UID: 0 PID: 6330 Comm: syz.1.127 Not tainted syzkaller #0 PREEMPT(full) [ 64.054804][ T6330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 64.054811][ T6330] Call Trace: [ 64.054815][ T6330] [ 64.054819][ T6330] dump_stack_lvl+0x100/0x190 [ 64.054839][ T6330] should_fail_ex.cold+0x5/0xa [ 64.054853][ T6330] _copy_from_user+0x2e/0xd0 [ 64.054865][ T6330] move_addr_to_kernel+0x65/0x170 [ 64.054884][ T6330] __sys_sendto+0x1b8/0x4e0 [ 64.054896][ T6330] ? __pfx___sys_sendto+0x10/0x10 [ 64.054918][ T6330] ? fput+0x7c/0x100 [ 64.054937][ T6330] __ia32_sys_sendto+0xdd/0x1b0 [ 64.054949][ T6330] ? __do_fast_syscall_32+0xb3/0x8b0 [ 64.054960][ T6330] ? lockdep_hardirqs_on+0x7d/0x110 [ 64.054977][ T6330] __do_fast_syscall_32+0x13a/0x8b0 [ 64.054987][ T6330] ? lockdep_hardirqs_on+0x7d/0x110 [ 64.055006][ T6330] do_fast_syscall_32+0x32/0x70 [ 64.055017][ T6330] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 64.055031][ T6330] RIP: 0023:0xf7fe7fec [ 64.055043][ T6330] Code: Unable to access opcode bytes at 0xf7fe7fc2. [ 64.055048][ T6330] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 64.055059][ T6330] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000500 [ 64.055066][ T6330] RDX: 0000000000000001 RSI: 000000002404c081 RDI: 0000000080000300 [ 64.055072][ T6330] RBP: 000000000000001c R08: 0000000000000000 R09: 0000000000000000 [ 64.055079][ T6330] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 64.055086][ T6330] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 64.055100][ T6330] [ 64.231276][ T6332] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 64.231365][ T6332] qnx6: wrong signature (magic) in superblock #1. [ 64.231370][ T6332] qnx6: unable to read the first superblock [ 64.234088][ T6332] netlink: 'syz.1.128': attribute type 2 has an invalid length. [ 64.234100][ T6332] netlink: 208 bytes leftover after parsing attributes in process `syz.1.128'. [ 64.234109][ T6332] netlink: 'syz.1.128': attribute type 2 has an invalid length. [ 64.498236][ T6340] Invalid ELF header magic: != ELF [ 64.503867][ T6340] overlay: Unknown parameter '/' [ 64.847987][ T6344] Invalid ELF header magic: != ELF [ 64.865516][ T6344] overlay: Unknown parameter '/' [ 65.115719][ T6348] netlink: 'syz.3.132': attribute type 7 has an invalid length. [ 65.132123][ T6346] rxe_eth0 speed is unknown, defaulting to 1000 [ 65.341720][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 65.989193][ T6362] Driver unsupported XDP return value 0 on prog (id 45) dev N/A, expect packet loss! [ 66.034925][ T6363] Invalid ELF header magic: != ELF [ 66.105968][ T6369] Invalid ELF header magic: != ELF [ 66.360607][ T6371] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 66.360700][ T6371] qnx6: wrong signature (magic) in superblock #1. [ 66.360705][ T6371] qnx6: unable to read the first superblock [ 66.368018][ T6371] netlink: 'syz.1.139': attribute type 2 has an invalid length. [ 66.368031][ T6371] netlink: 208 bytes leftover after parsing attributes in process `syz.1.139'. [ 66.368039][ T6371] netlink: 'syz.1.139': attribute type 2 has an invalid length. [ 66.441806][ T43] audit: type=1326 audit(1792037580.044:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6373 comm="syz.2.140" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746efec code=0x7ffc0000 [ 66.441837][ T43] audit: type=1326 audit(1792037580.044:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6373 comm="syz.2.140" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746efec code=0x7ffc0000 [ 66.441856][ T43] audit: type=1326 audit(1792037580.044:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6373 comm="syz.2.140" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746efec code=0x7ffc0000 [ 66.441875][ T43] audit: type=1326 audit(1792037580.044:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6373 comm="syz.2.140" exe="/syz-executor" sig=0 arch=40000003 syscall=120 compat=1 ip=0xf746efec code=0x7ffc0000 [ 66.456180][ T43] audit: type=1326 audit(1792037580.054:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6373 comm="syz.2.140" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746efec code=0x7ffc0000 [ 66.458430][ T43] audit: type=1326 audit(1792037580.054:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6382 comm="syz.2.140" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71c77eb code=0x7ffc0000 [ 66.458592][ T43] audit: type=1326 audit(1792037580.054:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6373 comm="syz.2.140" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746efec code=0x7ffc0000 [ 66.468151][ T43] audit: type=1326 audit(1792037580.064:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6373 comm="syz.2.140" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746efec code=0x7ffc0000 [ 66.468560][ T43] audit: type=1326 audit(1792037580.064:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6373 comm="syz.2.140" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746efec code=0x7ffc0000 [ 66.468674][ T43] audit: type=1326 audit(1792037580.064:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6373 comm="syz.2.140" exe="/syz-executor" sig=0 arch=40000003 syscall=42 compat=1 ip=0xf746efec code=0x7ffc0000 [ 66.772691][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 67.463475][ T6407] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 67.463647][ T6407] qnx6: wrong signature (magic) in superblock #1. [ 67.463655][ T6407] qnx6: unable to read the first superblock [ 67.489274][ T6407] netlink: 'syz.2.150': attribute type 2 has an invalid length. [ 67.489293][ T6407] netlink: 208 bytes leftover after parsing attributes in process `syz.2.150'. [ 67.489306][ T6407] netlink: 'syz.2.150': attribute type 2 has an invalid length. [ 67.749314][ T6421] FAULT_INJECTION: forcing a failure. [ 67.749314][ T6421] name failslab, interval 1, probability 0, space 0, times 0 [ 67.749337][ T6421] CPU: 1 UID: 0 PID: 6421 Comm: syz.1.154 Not tainted syzkaller #0 PREEMPT(full) [ 67.749357][ T6421] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 67.749367][ T6421] Call Trace: [ 67.749374][ T6421] [ 67.749381][ T6421] dump_stack_lvl+0x100/0x190 [ 67.749414][ T6421] should_fail_ex.cold+0x5/0xa [ 67.749441][ T6421] should_failslab+0xc2/0x120 [ 67.749467][ T6421] __kmalloc_cache_noprof+0x91/0x6d0 [ 67.749489][ T6421] ? do_raw_spin_lock+0x128/0x260 [ 67.749506][ T6421] ? get_mountpoint+0x174/0x520 [ 67.749522][ T6421] get_mountpoint+0x174/0x520 [ 67.749535][ T6421] do_lock_mount.part.0+0x371/0xab0 [ 67.749556][ T6421] path_mount+0x8f5/0x2850 [ 67.749569][ T6421] ? __pfx_path_mount+0x10/0x10 [ 67.749579][ T6421] ? lockdep_hardirqs_on+0x7d/0x110 [ 67.749605][ T6421] ? __ia32_sys_mount+0x292/0x310 [ 67.749616][ T6421] __ia32_sys_mount+0x292/0x310 [ 67.749627][ T6421] ? __pfx___ia32_sys_mount+0x10/0x10 [ 67.749646][ T6421] __do_fast_syscall_32+0x13a/0x8b0 [ 67.749660][ T6421] do_fast_syscall_32+0x32/0x70 [ 67.749688][ T6421] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 67.749704][ T6421] RIP: 0023:0xf7fe7fec [ 67.749718][ T6421] Code: Unable to access opcode bytes at 0xf7fe7fc2. [ 67.749723][ T6421] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 67.749736][ T6421] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000180 [ 67.749744][ T6421] RDX: 00000000800001c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 67.749752][ T6421] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 67.749759][ T6421] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 67.749766][ T6421] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 67.749781][ T6421] [ 67.770354][ T25] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 67.891450][ T6430] netlink: 28 bytes leftover after parsing attributes in process `syz.2.156'. [ 67.891511][ T6430] netlink: 28 bytes leftover after parsing attributes in process `syz.2.156'. [ 67.989589][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 70.866414][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.866501][ T1439] ieee802154 phy1 wpan1: encryption failed: -22 [ 70.873771][ T35] cfg80211: failed to load regulatory.db [ 78.440860][ T6482] Invalid ELF header magic: != ELF [ 78.456013][ T6482] overlay: Unknown parameter '/' [ 79.532475][ T6493] Invalid ELF header magic: != ELF [ 79.568149][ T6490] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 79.568169][ T6490] overlayfs: fs on './file0' does not support file handles, falling back to xino=off. [ 79.937621][ T6501] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 79.937716][ T6501] qnx6: wrong signature (magic) in superblock #1. [ 79.937720][ T6501] qnx6: unable to read the first superblock [ 79.943067][ T6501] netlink: 'syz.2.170': attribute type 2 has an invalid length. [ 79.943079][ T6501] netlink: 208 bytes leftover after parsing attributes in process `syz.2.170'. [ 79.943087][ T6501] netlink: 'syz.2.170': attribute type 2 has an invalid length. [ 80.244312][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 80.288524][ T6508] Invalid ELF header magic: != ELF [ 80.675789][ T6511] Invalid ELF header magic: != ELF [ 80.693534][ T6511] overlay: Unknown parameter '/' [ 80.965810][ T6514] FAULT_INJECTION: forcing a failure. [ 80.965810][ T6514] name failslab, interval 1, probability 0, space 0, times 0 [ 80.965840][ T6514] CPU: 3 UID: 0 PID: 6514 Comm: syz.3.174 Not tainted syzkaller #0 PREEMPT(full) [ 80.965862][ T6514] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.965873][ T6514] Call Trace: [ 80.965880][ T6514] [ 80.965888][ T6514] dump_stack_lvl+0x100/0x190 [ 80.965919][ T6514] should_fail_ex.cold+0x5/0xa [ 80.965946][ T6514] should_failslab+0xc2/0x120 [ 80.965978][ T6514] kmem_cache_alloc_noprof+0x92/0x6a0 [ 80.966003][ T6514] ? __pfx_map_id_range_down+0x10/0x10 [ 80.966030][ T6514] ? rcu_is_watching+0x13/0xc0 [ 80.966051][ T6514] ? security_inode_alloc+0x3b/0x2c0 [ 80.966076][ T6514] security_inode_alloc+0x3b/0x2c0 [ 80.966099][ T6514] inode_init_always_gfp+0xc6f/0xfb0 [ 80.966130][ T6514] alloc_inode+0x8e/0x250 [ 80.966151][ T6514] sock_alloc+0x44/0x280 [ 80.966174][ T6514] ? security_socket_create+0x7f/0x250 [ 80.966194][ T6514] __sock_create+0xc2/0x860 [ 80.966226][ T6514] __sys_socket+0x14d/0x260 [ 80.966254][ T6514] ? xfd_validate_state+0x129/0x190 [ 80.966282][ T6514] ? __pfx___sys_socket+0x10/0x10 [ 80.966316][ T6514] __ia32_sys_socket+0x72/0xb0 [ 80.966331][ T6514] ? lockdep_hardirqs_on+0x7d/0x110 [ 80.966356][ T6514] __do_fast_syscall_32+0x13a/0x8b0 [ 80.966377][ T6514] do_fast_syscall_32+0x32/0x70 [ 80.966427][ T6514] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 80.966450][ T6514] RIP: 0023:0xf739efec [ 80.966469][ T6514] Code: Unable to access opcode bytes at 0xf739efc2. [ 80.966477][ T6514] RSP: 002b:00000000f539550c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 80.966495][ T6514] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 0000000000000003 [ 80.966507][ T6514] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 80.966519][ T6514] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 80.966530][ T6514] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 80.966548][ T6514] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 80.966575][ T6514] [ 80.966725][ T6514] socket: no more sockets [ 80.971818][ T6514] CIFS mount error: No usable UNC path provided in device string! [ 80.971818][ T6514] [ 80.971909][ T6514] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 81.323712][ T6525] FAULT_INJECTION: forcing a failure. [ 81.323712][ T6525] name failslab, interval 1, probability 0, space 0, times 0 [ 81.323742][ T6525] CPU: 0 UID: 0 PID: 6525 Comm: syz.0.178 Not tainted syzkaller #0 PREEMPT(full) [ 81.323763][ T6525] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 81.323774][ T6525] Call Trace: [ 81.323781][ T6525] [ 81.323788][ T6525] dump_stack_lvl+0x100/0x190 [ 81.323842][ T6525] should_fail_ex.cold+0x5/0xa [ 81.323865][ T6525] should_failslab+0xc2/0x120 [ 81.323891][ T6525] __kmalloc_cache_node_noprof+0x94/0x720 [ 81.323918][ T6525] ? sbitmap_queue_init_node+0x291/0x4a0 [ 81.323947][ T6525] sbitmap_queue_init_node+0x291/0x4a0 [ 81.323979][ T6525] blk_mq_init_tags+0x1ba/0x300 [ 81.324004][ T6525] blk_mq_alloc_map_and_rqs+0x244/0xe30 [ 81.324028][ T6525] ? blk_mq_update_queue_map+0x227/0x3a0 [ 81.324055][ T6525] blk_mq_alloc_tag_set+0x848/0x1330 [ 81.324089][ T6525] loop_add+0x3b7/0xb60 [ 81.324117][ T6525] ? __pfx_loop_add+0x10/0x10 [ 81.324156][ T6525] ? __fget_files+0x34/0x3d0 [ 81.324178][ T6525] ? find_held_lock+0x2b/0x80 [ 81.324197][ T6525] ? __fget_files+0x215/0x3d0 [ 81.324222][ T6525] loop_control_ioctl+0xae/0x620 [ 81.324238][ T6525] ? __pfx_loop_control_ioctl+0x10/0x10 [ 81.324254][ T6525] ? __pfx_loop_control_ioctl+0x10/0x10 [ 81.324265][ T6525] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 81.324281][ T6525] __do_fast_syscall_32+0x13a/0x8b0 [ 81.324295][ T6525] do_fast_syscall_32+0x32/0x70 [ 81.324307][ T6525] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 81.324321][ T6525] RIP: 0023:0xf743efec [ 81.324333][ T6525] Code: Unable to access opcode bytes at 0xf743efc2. [ 81.324339][ T6525] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 81.324350][ T6525] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000004c80 [ 81.324357][ T6525] RDX: 00000000ffffffe4 RSI: 0000000000000000 RDI: 0000000000000000 [ 81.324364][ T6525] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 81.324371][ T6525] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 81.324377][ T6525] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 81.324392][ T6525] [ 81.324963][ T6525] blk-mq: reduced tag depth (128 -> 64) [ 81.454892][ T6530] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 81.454904][ T6530] overlayfs: fs on './file0' does not support file handles, falling back to xino=off. [ 81.519190][ T50] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 81.666229][ T6533] Invalid ELF header magic: != ELF [ 81.926662][ T50] usb 8-1: Using ep0 maxpacket: 16 [ 81.927099][ T50] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 81.930237][ T50] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 81.932150][ T50] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.932163][ T50] usb 8-1: Product: syz [ 81.932170][ T50] usb 8-1: Manufacturer: syz [ 81.932177][ T50] usb 8-1: SerialNumber: syz [ 81.934748][ T50] usb 8-1: config 0 descriptor?? [ 81.937541][ T50] em28xx 8-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 81.937558][ T50] em28xx 8-1:0.0: DVB interface 0 found: bulk [ 82.377779][ T6542] erspan0: entered promiscuous mode [ 82.397375][ T6542] process 'syz.0.183' launched '/dev/fd/8' with NULL argv: empty string added [ 82.552853][ T50] em28xx 8-1:0.0: unknown em28xx chip ID (0) [ 82.587677][ T6547] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 82.587861][ T6547] qnx6: wrong signature (magic) in superblock #1. [ 82.587867][ T6547] qnx6: unable to read the first superblock [ 82.595794][ T6547] netlink: 'syz.2.184': attribute type 2 has an invalid length. [ 82.595805][ T6547] netlink: 208 bytes leftover after parsing attributes in process `syz.2.184'. [ 82.595860][ T6547] netlink: 'syz.2.184': attribute type 2 has an invalid length. [ 82.982600][ T50] em28xx 8-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 82.982628][ T50] em28xx 8-1:0.0: board has no eeprom [ 83.248339][ T6518] em28xx 8-1:0.0: reading from i2c device at 0x0 failed (error=-5) [ 83.502325][ T6562] Invalid ELF header magic: != ELF [ 83.835375][ T50] em28xx 8-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 83.835392][ T50] em28xx 8-1:0.0: dvb set to bulk mode. [ 83.836987][ T30] em28xx 8-1:0.0: Binding DVB extension [ 83.844149][ T50] usb 8-1: USB disconnect, device number 2 [ 83.845546][ T50] em28xx 8-1:0.0: Disconnecting em28xx [ 83.884198][ T30] em28xx 8-1:0.0: Registering input extension [ 83.982091][ T50] em28xx 8-1:0.0: Closing input extension [ 84.055819][ T6570] Invalid ELF header magic: != ELF [ 84.070071][ T6570] overlay: Unknown parameter '/' [ 84.086048][ T50] em28xx: Freeing device [ 84.118212][ T6572] blk-mq: reduced tag depth (128 -> 64) [ 84.507641][ T6588] Invalid ELF header magic: != ELF [ 85.320313][ T6598] Invalid ELF header magic: != ELF [ 85.537985][ T6594] overlay: Unknown parameter '/' [ 86.089755][ T35] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 86.099121][ T6604] netlink: 8 bytes leftover after parsing attributes in process `syz.0.198'. [ 86.249649][ T35] usb 7-1: Using ep0 maxpacket: 16 [ 86.253171][ T35] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 86.254665][ T35] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 86.271392][ T35] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.271414][ T35] usb 7-1: Product: syz [ 86.271426][ T35] usb 7-1: Manufacturer: syz [ 86.271438][ T35] usb 7-1: SerialNumber: syz [ 86.275369][ T35] usb 7-1: config 0 descriptor?? [ 86.291302][ T35] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 86.291320][ T35] em28xx 7-1:0.0: DVB interface 0 found: bulk [ 86.349752][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 86.459917][ T6611] Invalid ELF header magic: != ELF [ 87.017323][ T6614] Invalid ELF header magic: != ELF [ 87.031403][ T6614] overlay: Unknown parameter '/' [ 87.161210][ T35] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 87.265695][ T6621] FAULT_INJECTION: forcing a failure. [ 87.265695][ T6621] name failslab, interval 1, probability 0, space 0, times 0 [ 87.265714][ T6621] CPU: 2 UID: 0 PID: 6621 Comm: syz.1.205 Not tainted syzkaller #0 PREEMPT(full) [ 87.265727][ T6621] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.265734][ T6621] Call Trace: [ 87.265738][ T6621] [ 87.265743][ T6621] dump_stack_lvl+0x100/0x190 [ 87.265771][ T6621] should_fail_ex.cold+0x5/0xa [ 87.265795][ T6621] should_failslab+0xc2/0x120 [ 87.265822][ T6621] __kmalloc_cache_noprof+0x91/0x6d0 [ 87.265846][ T6621] ? do_raw_spin_lock+0x128/0x260 [ 87.265864][ T6621] ? get_mountpoint+0x174/0x520 [ 87.265881][ T6621] get_mountpoint+0x174/0x520 [ 87.265903][ T6621] do_lock_mount.part.0+0x371/0xab0 [ 87.265925][ T6621] path_mount+0x8f5/0x2850 [ 87.265939][ T6621] ? __pfx_path_mount+0x10/0x10 [ 87.265949][ T6621] ? lockdep_hardirqs_on+0x7d/0x110 [ 87.265978][ T6621] ? __ia32_sys_mount+0x292/0x310 [ 87.265989][ T6621] __ia32_sys_mount+0x292/0x310 [ 87.266002][ T6621] ? __pfx___ia32_sys_mount+0x10/0x10 [ 87.266018][ T6621] __do_fast_syscall_32+0x13a/0x8b0 [ 87.266032][ T6621] do_fast_syscall_32+0x32/0x70 [ 87.266044][ T6621] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 87.266058][ T6621] RIP: 0023:0xf7fe7fec [ 87.266072][ T6621] Code: Unable to access opcode bytes at 0xf7fe7fc2. [ 87.266077][ T6621] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 87.266088][ T6621] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000180 [ 87.266095][ T6621] RDX: 00000000800001c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 87.266102][ T6621] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 87.266108][ T6621] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 87.266115][ T6621] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 87.266129][ T6621] [ 87.303420][ T6624] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 87.303504][ T6624] qnx6: wrong signature (magic) in superblock #1. [ 87.303509][ T6624] qnx6: unable to read the first superblock [ 87.313982][ T6624] netlink: 'syz.1.206': attribute type 2 has an invalid length. [ 87.313994][ T6624] netlink: 208 bytes leftover after parsing attributes in process `syz.1.206'. [ 87.314003][ T6624] netlink: 'syz.1.206': attribute type 2 has an invalid length. [ 87.544071][ T35] em28xx 7-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 87.544551][ T35] em28xx 7-1:0.0: board has no eeprom [ 87.640772][ T6636] Invalid ELF header magic: != ELF [ 87.666805][ T6636] overlay: Unknown parameter '/' [ 88.436736][ T6646] Invalid ELF header magic: != ELF [ 88.445261][ T6646] overlay: Unknown parameter '/' [ 88.658028][ T6642] Invalid ELF header magic: != ELF [ 88.695760][ T6642] overlay: Unknown parameter '/' [ 88.711331][ T6654] Invalid ELF header magic: != ELF [ 88.863704][ T6654] overlay: Unknown parameter '/' [ 89.019980][ T6596] em28xx 7-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 89.079737][ T35] em28xx 7-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 89.079754][ T35] em28xx 7-1:0.0: dvb set to bulk mode. [ 89.080496][ T5838] em28xx 7-1:0.0: Binding DVB extension [ 89.084329][ T35] usb 7-1: USB disconnect, device number 3 [ 89.090378][ T35] em28xx 7-1:0.0: Disconnecting em28xx [ 89.101342][ T5838] em28xx 7-1:0.0: Registering input extension [ 89.102102][ T35] em28xx 7-1:0.0: Closing input extension [ 89.107959][ T35] em28xx: Freeing device [ 89.732222][ T6668] Invalid ELF header magic: != ELF [ 89.998525][ T6672] Invalid ELF header magic: != ELF [ 90.128263][ T6669] overlay: Unknown parameter '/' [ 90.267902][ T6680] Invalid ELF header magic: != ELF [ 90.292753][ T6680] overlay: Unknown parameter '/' [ 90.582555][ T6681] Invalid ELF header magic: != ELF [ 90.723876][ T6679] overlay: Unknown parameter '/' [ 91.708469][ T6698] Invalid ELF header magic: != ELF [ 91.892301][ T6700] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 91.892443][ T6700] qnx6: wrong signature (magic) in superblock #1. [ 91.892450][ T6700] qnx6: unable to read the first superblock [ 91.918264][ T6700] netlink: 'syz.3.228': attribute type 2 has an invalid length. [ 91.918283][ T6700] netlink: 208 bytes leftover after parsing attributes in process `syz.3.228'. [ 91.918297][ T6700] netlink: 'syz.3.228': attribute type 2 has an invalid length. [ 91.995691][ T6705] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 91.995773][ T6705] qnx6: wrong signature (magic) in superblock #1. [ 91.995778][ T6705] qnx6: unable to read the first superblock [ 92.003694][ T6705] netlink: 'syz.0.229': attribute type 2 has an invalid length. [ 92.003708][ T6705] netlink: 208 bytes leftover after parsing attributes in process `syz.0.229'. [ 92.003716][ T6705] netlink: 'syz.0.229': attribute type 2 has an invalid length. [ 92.108981][ T6714] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 92.109149][ T6714] qnx6: wrong signature (magic) in superblock #1. [ 92.109155][ T6714] qnx6: unable to read the first superblock [ 92.113876][ T6714] netlink: 'syz.0.232': attribute type 2 has an invalid length. [ 92.113887][ T6714] netlink: 208 bytes leftover after parsing attributes in process `syz.0.232'. [ 92.113895][ T6714] netlink: 'syz.0.232': attribute type 2 has an invalid length. [ 92.181184][ T5743] Bluetooth: Unexpected start frame (len 10) [ 92.355412][ T6712] Invalid ELF header magic: != ELF [ 92.627050][ T6720] Invalid ELF header magic: != ELF [ 92.641984][ T6720] overlay: Unknown parameter '/' [ 93.379590][ T6739] Invalid ELF header magic: != ELF [ 93.823283][ T6745] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 93.823420][ T6745] qnx6: wrong signature (magic) in superblock #1. [ 93.823427][ T6745] qnx6: unable to read the first superblock [ 93.837782][ T6745] netlink: 'syz.1.241': attribute type 2 has an invalid length. [ 93.837800][ T6745] netlink: 208 bytes leftover after parsing attributes in process `syz.1.241'. [ 93.837813][ T6745] netlink: 'syz.1.241': attribute type 2 has an invalid length. [ 94.223665][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 94.553501][ T6767] Invalid ELF header magic: != ELF [ 94.565043][ T6767] overlay: Unknown parameter '/' [ 95.079961][ T6768] Invalid ELF header magic: != ELF [ 95.298302][ T6772] Invalid ELF header magic: != ELF [ 95.332519][ T6772] overlay: Unknown parameter '/' [ 95.628288][ T6777] Invalid ELF header magic: != ELF [ 95.637480][ T6777] overlay: Unknown parameter '/' [ 95.943250][ T6785] Invalid ELF header magic: != ELF [ 96.626769][ T6793] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 96.626901][ T6793] qnx6: wrong signature (magic) in superblock #1. [ 96.626907][ T6793] qnx6: unable to read the first superblock [ 96.631716][ T6793] netlink: 'syz.2.255': attribute type 2 has an invalid length. [ 96.631727][ T6793] netlink: 208 bytes leftover after parsing attributes in process `syz.2.255'. [ 96.631736][ T6793] netlink: 'syz.2.255': attribute type 2 has an invalid length. [ 96.844260][ T6803] Invalid ELF header magic: != ELF [ 96.919437][ T6803] overlay: Unknown parameter '/' [ 98.458750][ T6812] Invalid ELF header magic: != ELF [ 98.470272][ T6812] overlay: Unknown parameter '/' [ 98.913865][ T6828] Invalid ELF header magic: != ELF [ 98.949667][ T6828] overlay: Unknown parameter '/' [ 99.206650][ T6830] Invalid ELF header magic: != ELF [ 100.542680][ T5743] Bluetooth: Unexpected start frame (len 10) [ 100.544545][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 100.814243][ T6845] Invalid ELF header magic: != ELF [ 101.840602][ T6855] Invalid ELF header magic: != ELF [ 101.883899][ T6855] overlay: Unknown parameter '/' [ 102.219022][ T6865] Invalid ELF header magic: != ELF [ 102.252334][ T6865] overlay: Unknown parameter '/' [ 102.517436][ T6863] Invalid ELF header magic: != ELF [ 102.599452][ T6874] Invalid ELF header magic: != ELF [ 102.649384][ T6874] overlay: Unknown parameter '/' [ 102.817511][ T6875] Invalid ELF header magic: != ELF [ 102.907851][ T9] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 102.948142][ T6873] overlay: Unknown parameter '/' [ 102.957950][ T6863] overlay: Unknown parameter '/' [ 103.039817][ T9] usb 5-1: device descriptor read/64, error -71 [ 103.279865][ T9] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 103.409812][ T9] usb 5-1: device descriptor read/64, error -71 [ 103.521292][ T9] usb usb5-port1: attempt power cycle [ 103.715122][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 104.289775][ T9] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 104.329949][ T9] usb 5-1: device descriptor read/8, error -71 [ 104.589837][ T9] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 104.620190][ T9] usb 5-1: device descriptor read/8, error -71 [ 104.741130][ T9] usb usb5-port1: unable to enumerate USB device [ 104.952467][ T6899] Invalid ELF header magic: != ELF [ 104.964770][ T6899] overlay: Unknown parameter '/' [ 106.231910][ T6919] Invalid ELF header magic: != ELF [ 106.252780][ T6919] overlay: Unknown parameter '/' [ 106.509773][ T5128] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 106.649838][ T5128] usb 5-1: device descriptor read/64, error -71 [ 106.899768][ T5128] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 107.040224][ T5128] usb 5-1: device descriptor read/64, error -71 [ 107.151250][ T5128] usb usb5-port1: attempt power cycle [ 107.499853][ T5128] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 107.521451][ T5128] usb 5-1: device descriptor read/8, error -71 [ 107.742337][ T6937] Invalid ELF header magic: != ELF [ 107.749820][ T6937] overlay: Unknown parameter '/' [ 107.759884][ T5128] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 107.780198][ T5128] usb 5-1: device descriptor read/8, error -71 [ 107.891761][ T5128] usb usb5-port1: unable to enumerate USB device [ 108.226854][ T6945] Invalid ELF header magic: != ELF [ 108.354820][ T6945] overlay: Unknown parameter '/' [ 108.494399][ T6947] Invalid ELF header magic: != ELF [ 108.501861][ T6947] overlay: Unknown parameter '/' [ 109.281764][ T6963] Invalid ELF header magic: != ELF [ 109.306186][ T6963] overlay: Unknown parameter '/' [ 110.413539][ T6975] Invalid ELF header magic: != ELF [ 110.500503][ T6975] overlay: Unknown parameter '/' [ 110.892362][ T6981] Invalid ELF header magic: != ELF [ 111.383659][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 111.501214][ T853] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 111.671232][ T853] usb 8-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 111.672076][ T853] usb 8-1: config 1 has an invalid interface number: 7 but max is 0 [ 111.672089][ T853] usb 8-1: config 1 has no interface number 0 [ 111.672106][ T853] usb 8-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 111.672118][ T853] usb 8-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 111.672130][ T853] usb 8-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 111.673679][ T853] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.673691][ T853] usb 8-1: Product: syz [ 111.673698][ T853] usb 8-1: Manufacturer: syz [ 111.673705][ T853] usb 8-1: SerialNumber: syz [ 111.676107][ T6983] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 111.877702][ T6983] FAULT_INJECTION: forcing a failure. [ 111.877702][ T6983] name failslab, interval 1, probability 0, space 0, times 0 [ 111.877733][ T6983] CPU: 0 UID: 0 PID: 6983 Comm: syz.3.311 Not tainted syzkaller #0 PREEMPT(full) [ 111.877753][ T6983] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 111.877763][ T6983] Call Trace: [ 111.877779][ T6983] [ 111.877786][ T6983] dump_stack_lvl+0x100/0x190 [ 111.877813][ T6983] should_fail_ex.cold+0x5/0xa [ 111.877829][ T6983] should_failslab+0xc2/0x120 [ 111.877846][ T6983] __kmalloc_noprof+0xfc/0x840 [ 111.877862][ T6983] ? tomoyo_encode2+0xfb/0x3c0 [ 111.877883][ T6983] tomoyo_encode2+0xfb/0x3c0 [ 111.877909][ T6983] tomoyo_encode+0x29/0x50 [ 111.877930][ T6983] tomoyo_realpath_from_path+0x18c/0x690 [ 111.877959][ T6983] tomoyo_path_number_perm+0x23c/0x580 [ 111.877975][ T6983] ? tomoyo_path_number_perm+0x22e/0x580 [ 111.877989][ T6983] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 111.878002][ T6983] ? get_pid_task+0x106/0x250 [ 111.878019][ T6983] ? __lock_acquire+0x5c0/0x1f40 [ 111.878042][ T6983] ? __fget_files+0x34/0x3d0 [ 111.878057][ T6983] ? find_held_lock+0x2b/0x80 [ 111.878070][ T6983] ? __fget_files+0x215/0x3d0 [ 111.878083][ T6983] ? hook_file_ioctl_common+0x140/0x440 [ 111.878097][ T6983] ? __fget_files+0x215/0x3d0 [ 111.878114][ T6983] ? __fget_files+0x21f/0x3d0 [ 111.878131][ T6983] security_file_ioctl_compat+0xd3/0x230 [ 111.878146][ T6983] __ia32_compat_sys_ioctl+0xc2/0x360 [ 111.878161][ T6983] __do_fast_syscall_32+0x13a/0x8b0 [ 111.878173][ T6983] ? lockdep_hardirqs_on+0x7d/0x110 [ 111.878191][ T6983] do_fast_syscall_32+0x32/0x70 [ 111.878203][ T6983] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 111.878216][ T6983] RIP: 0023:0xf739efec [ 111.878229][ T6983] Code: Unable to access opcode bytes at 0xf739efc2. [ 111.878234][ T6983] RSP: 002b:00000000f53b44a4 EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 111.878264][ T6983] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080085502 [ 111.878272][ T6983] RDX: 00000000f53b54f0 RSI: 00000000f738aff4 RDI: 0000000000000000 [ 111.878278][ T6983] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 111.878284][ T6983] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 111.878291][ T6983] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 111.878305][ T6983] [ 111.878352][ T6983] ERROR: Out of memory at tomoyo_realpath_from_path. [ 111.878581][ T6983] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 112.092962][ T853] sierra_net 8-1:1.7 wwan0: register 'sierra_net' at usb-dummy_hcd.3-1, Sierra Wireless USB-to-WWAN Modem, 00:00:00:00:01:07 [ 112.121016][ T6995] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 112.121140][ T6995] qnx6: wrong signature (magic) in superblock #1. [ 112.121146][ T6995] qnx6: unable to read the first superblock [ 112.128246][ T6995] netlink: 'syz.2.316': attribute type 2 has an invalid length. [ 112.128265][ T6995] netlink: 208 bytes leftover after parsing attributes in process `syz.2.316'. [ 112.128278][ T6995] netlink: 'syz.2.316': attribute type 2 has an invalid length. [ 112.309566][ T853] sierra_net 8-1:1.7 wwan0: Submit SYNC failed -71 [ 112.309581][ T853] sierra_net 8-1:1.7 wwan0: Send SYNC failed, status -71 [ 112.310920][ T853] sierra_net 8-1:1.7 wwan0: Submit SYNC failed -71 [ 112.310937][ T853] sierra_net 8-1:1.7 wwan0: Send SYNC failed, status -71 [ 112.321887][ T853] usb 8-1: USB disconnect, device number 3 [ 112.326206][ T853] sierra_net 8-1:1.7 wwan0: unregister 'sierra_net' usb-dummy_hcd.3-1, Sierra Wireless USB-to-WWAN Modem [ 112.347476][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 112.402520][ T853] sierra_net 8-1:1.7 wwan0 (unregistered): usb_control_msg failed, status -19 [ 112.483289][ T7009] Invalid ELF header magic: != ELF [ 112.497471][ T7009] overlay: Unknown parameter '/' [ 114.029552][ T7024] FAULT_INJECTION: forcing a failure. [ 114.029552][ T7024] name failslab, interval 1, probability 0, space 0, times 0 [ 114.029572][ T7024] CPU: 3 UID: 0 PID: 7024 Comm: syz.3.324 Not tainted syzkaller #0 PREEMPT(full) [ 114.029585][ T7024] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 114.029592][ T7024] Call Trace: [ 114.029596][ T7024] [ 114.029601][ T7024] dump_stack_lvl+0x100/0x190 [ 114.029622][ T7024] should_fail_ex.cold+0x5/0xa [ 114.029638][ T7024] should_failslab+0xc2/0x120 [ 114.029657][ T7024] __kmalloc_cache_noprof+0x91/0x6d0 [ 114.029691][ T7024] ? do_raw_spin_lock+0x128/0x260 [ 114.029704][ T7024] ? get_mountpoint+0x174/0x520 [ 114.029721][ T7024] get_mountpoint+0x174/0x520 [ 114.029735][ T7024] do_lock_mount.part.0+0x371/0xab0 [ 114.029756][ T7024] path_mount+0x8f5/0x2850 [ 114.029770][ T7024] ? __pfx_path_mount+0x10/0x10 [ 114.029781][ T7024] ? lockdep_hardirqs_on+0x7d/0x110 [ 114.029809][ T7024] ? __ia32_sys_mount+0x292/0x310 [ 114.029819][ T7024] __ia32_sys_mount+0x292/0x310 [ 114.029830][ T7024] ? __pfx___ia32_sys_mount+0x10/0x10 [ 114.029846][ T7024] __do_fast_syscall_32+0x13a/0x8b0 [ 114.029859][ T7024] do_fast_syscall_32+0x32/0x70 [ 114.029871][ T7024] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 114.029886][ T7024] RIP: 0023:0xf739efec [ 114.029899][ T7024] Code: Unable to access opcode bytes at 0xf739efc2. [ 114.029904][ T7024] RSP: 002b:00000000f53b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 114.029916][ T7024] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000180 [ 114.029923][ T7024] RDX: 00000000800001c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 114.029929][ T7024] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 114.029935][ T7024] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 114.029942][ T7024] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 114.029956][ T7024] [ 114.438918][ T7034] Invalid ELF header magic: != ELF [ 114.590813][ T7039] Invalid ELF header magic: != ELF [ 114.608409][ T7039] overlay: Unknown parameter '/' [ 114.846749][ T7041] Invalid ELF header magic: != ELF [ 114.855813][ T7041] overlay: Unknown parameter '/' [ 115.334625][ T7049] netlink: 8 bytes leftover after parsing attributes in process `syz.3.332'. [ 115.367701][ T7051] Invalid ELF header magic: != ELF [ 115.392254][ T7051] overlay: Unknown parameter '/' [ 116.385198][ T7058] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 116.386073][ T7058] FAULT_INJECTION: forcing a failure. [ 116.386073][ T7058] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 116.386091][ T7058] CPU: 2 UID: 0 PID: 7058 Comm: syz.1.335 Not tainted syzkaller #0 PREEMPT(full) [ 116.386104][ T7058] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.386110][ T7058] Call Trace: [ 116.386114][ T7058] [ 116.386119][ T7058] dump_stack_lvl+0x100/0x190 [ 116.386152][ T7058] should_fail_ex.cold+0x5/0xa [ 116.386167][ T7058] strncpy_from_user+0x3b/0x2d0 [ 116.386182][ T7058] do_getname+0x78/0x390 [ 116.386195][ T7058] do_fchownat+0xc6/0x1f0 [ 116.386212][ T7058] ? __pfx_do_fchownat+0x10/0x10 [ 116.386257][ T7058] ? ksys_write+0x1ac/0x250 [ 116.386273][ T7058] __ia32_sys_lchown16+0xe6/0x120 [ 116.386286][ T7058] __do_fast_syscall_32+0x13a/0x8b0 [ 116.386298][ T7058] ? lockdep_hardirqs_on+0x7d/0x110 [ 116.386316][ T7058] do_fast_syscall_32+0x32/0x70 [ 116.386327][ T7058] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 116.386342][ T7058] RIP: 0023:0xf7fe7fec [ 116.386354][ T7058] Code: Unable to access opcode bytes at 0xf7fe7fc2. [ 116.386360][ T7058] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000010 [ 116.386371][ T7058] RAX: ffffffffffffffda RBX: 0000000080000040 RCX: 0000000000000000 [ 116.386378][ T7058] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 116.386384][ T7058] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 116.386390][ T7058] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 116.386396][ T7058] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 116.386410][ T7058] [ 116.695699][ T7069] Invalid ELF header magic: != ELF [ 116.710525][ T7069] overlay: Unknown parameter '/' [ 116.790533][ T5837] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 116.950188][ T5837] usb 6-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 116.951063][ T5837] usb 6-1: config 1 has an invalid interface number: 7 but max is 0 [ 116.951081][ T5837] usb 6-1: config 1 has no interface number 0 [ 116.951109][ T5837] usb 6-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 116.951128][ T5837] usb 6-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 116.951147][ T5837] usb 6-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 116.952999][ T5837] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.953016][ T5837] usb 6-1: Product: syz [ 116.953027][ T5837] usb 6-1: Manufacturer: syz [ 116.953038][ T5837] usb 6-1: SerialNumber: syz [ 116.955649][ T7064] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 117.018261][ T7073] Invalid ELF header magic: != ELF [ 117.161410][ T7064] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 117.373783][ T5837] sierra_net 6-1:1.7 wwan0: register 'sierra_net' at usb-dummy_hcd.1-1, Sierra Wireless USB-to-WWAN Modem, 00:00:00:00:02:07 [ 117.568843][ T5837] sierra_net 6-1:1.7 wwan0: Submit SYNC failed -71 [ 117.568861][ T5837] sierra_net 6-1:1.7 wwan0: Send SYNC failed, status -71 [ 117.569172][ T5837] sierra_net 6-1:1.7 wwan0: Submit SYNC failed -71 [ 117.569183][ T5837] sierra_net 6-1:1.7 wwan0: Send SYNC failed, status -71 [ 117.581819][ T5837] usb 6-1: USB disconnect, device number 3 [ 117.584099][ T5837] sierra_net 6-1:1.7 wwan0: unregister 'sierra_net' usb-dummy_hcd.1-1, Sierra Wireless USB-to-WWAN Modem [ 117.680412][ T5837] sierra_net 6-1:1.7 wwan0 (unregistered): usb_control_msg failed, status -19 [ 118.111096][ T7082] FAULT_INJECTION: forcing a failure. [ 118.111096][ T7082] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 118.111115][ T7082] CPU: 0 UID: 0 PID: 7082 Comm: syz.1.341 Not tainted syzkaller #0 PREEMPT(full) [ 118.111128][ T7082] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 118.111134][ T7082] Call Trace: [ 118.111138][ T7082] [ 118.111143][ T7082] dump_stack_lvl+0x100/0x190 [ 118.111160][ T7082] should_fail_ex.cold+0x5/0xa [ 118.111176][ T7082] _copy_from_user+0x2e/0xd0 [ 118.111187][ T7082] memdup_user+0x6b/0xe0 [ 118.111201][ T7082] strndup_user+0x78/0xe0 [ 118.111215][ T7082] __ia32_sys_mount+0x136/0x310 [ 118.111226][ T7082] ? __pfx___ia32_sys_mount+0x10/0x10 [ 118.111237][ T7082] ? ksys_write+0x1ac/0x250 [ 118.111253][ T7082] ? __pfx_ksys_write+0x10/0x10 [ 118.111269][ T7082] __do_fast_syscall_32+0x13a/0x8b0 [ 118.111280][ T7082] ? lockdep_hardirqs_on+0x7d/0x110 [ 118.111298][ T7082] do_fast_syscall_32+0x32/0x70 [ 118.111310][ T7082] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 118.111324][ T7082] RIP: 0023:0xf7fe7fec [ 118.111336][ T7082] Code: Unable to access opcode bytes at 0xf7fe7fc2. [ 118.111341][ T7082] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 118.111353][ T7082] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000800000c0 [ 118.111360][ T7082] RDX: 0000000080000080 RSI: 0000000000000000 RDI: 0000000080000180 [ 118.111366][ T7082] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 118.111372][ T7082] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 118.111379][ T7082] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 118.111392][ T7082] [ 118.219977][ T5837] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 118.328832][ T7084] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 118.336356][ T7084] evm: overlay not supported [ 118.371343][ T5837] usb 5-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 118.372216][ T5837] usb 5-1: config 1 has an invalid interface number: 7 but max is 0 [ 118.372229][ T5837] usb 5-1: config 1 has no interface number 0 [ 118.372246][ T5837] usb 5-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 118.372259][ T5837] usb 5-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 118.372271][ T5837] usb 5-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 118.374424][ T5837] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.374438][ T5837] usb 5-1: Product: syz [ 118.374445][ T5837] usb 5-1: Manufacturer: syz [ 118.374453][ T5837] usb 5-1: SerialNumber: syz [ 118.378763][ T7080] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 118.467662][ T7089] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 118.533317][ T7090] Invalid ELF header magic: != ELF [ 118.538155][ T7090] overlay: Unknown parameter '/' [ 118.623103][ T7080] 8021q: adding VLAN 0 to HW filter on device bond1 [ 118.636940][ T7080] netlink: 8 bytes leftover after parsing attributes in process `syz.0.340'. [ 118.636957][ T7080] netlink: 4 bytes leftover after parsing attributes in process `syz.0.340'. [ 118.647396][ T7080] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 118.868888][ T5837] usb 5-1: Incompatible driver and firmware versions [ 119.007265][ T7100] Invalid ELF header magic: != ELF [ 119.056469][ T853] usb 5-1: USB disconnect, device number 13 [ 119.063900][ T7100] overlay: Unknown parameter '/' [ 119.115300][ T7102] Invalid ELF header magic: != ELF [ 119.129377][ T7102] overlay: Unknown parameter '/' [ 119.857471][ T7112] Invalid ELF header magic: != ELF [ 119.879519][ T7112] overlay: Unknown parameter '/' [ 120.037768][ T7110] Invalid ELF header magic: != ELF [ 120.040474][ T7110] overlay: Unknown parameter '/' [ 120.040659][ T7113] overlay: Unknown parameter '/' [ 121.191081][ T7124] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 121.191184][ T7124] qnx6: wrong signature (magic) in superblock #1. [ 121.191189][ T7124] qnx6: unable to read the first superblock [ 121.193945][ T7124] netlink: 'syz.2.354': attribute type 2 has an invalid length. [ 121.193957][ T7124] netlink: 208 bytes leftover after parsing attributes in process `syz.2.354'. [ 121.193965][ T7124] netlink: 'syz.2.354': attribute type 2 has an invalid length. [ 121.305070][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 121.519399][ T7138] Invalid ELF header magic: != ELF [ 121.555343][ T7138] overlay: Unknown parameter '/' [ 122.033244][ T853] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 122.430138][ T7148] syz.2.362 uses obsolete (PF_INET,SOCK_PACKET) [ 122.431557][ T7148] netlink: 8 bytes leftover after parsing attributes in process `syz.2.362'. [ 122.438221][ T7148] vlan2: entered promiscuous mode [ 122.438236][ T7148] bond0: entered promiscuous mode [ 122.438244][ T7148] bond_slave_0: entered promiscuous mode [ 122.438344][ T7148] bond_slave_1: entered promiscuous mode [ 122.461501][ T7148] netlink: 'syz.2.362': attribute type 10 has an invalid length. [ 122.466232][ T7148] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 122.467164][ T7148] netdevsim netdevsim2 netdevsim1: entered promiscuous mode [ 122.467655][ T7148] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 122.552114][ T853] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 122.587997][ T853] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 122.588018][ T853] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 122.588029][ T853] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 122.588048][ T853] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.724340][ T853] usb 6-1: config 0 descriptor?? [ 123.165114][ T853] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 123.165139][ T853] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 123.165151][ T853] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 123.165163][ T853] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 123.165175][ T853] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 123.165186][ T853] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 123.165198][ T853] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 123.165210][ T853] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 123.165221][ T853] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 123.165233][ T853] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 123.179399][ T853] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw1: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 123.422272][ T853] usb 6-1: USB disconnect, device number 4 [ 123.884853][ T7161] syzkaller0: entered promiscuous mode [ 123.884873][ T7161] syzkaller0: entered allmulticast mode [ 123.906894][ T5743] Bluetooth: Unexpected start frame (len 10) [ 123.906932][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 124.203228][ T7168] netlink: 8 bytes leftover after parsing attributes in process `syz.0.370'. [ 124.208482][ T7168] vlan2: entered promiscuous mode [ 124.208500][ T7168] bond0: entered promiscuous mode [ 124.208512][ T7168] bond_slave_0: entered promiscuous mode [ 124.208652][ T7168] bond_slave_1: entered promiscuous mode [ 124.345528][ T7168] netlink: 'syz.0.370': attribute type 10 has an invalid length. [ 124.387194][ T7168] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 124.398751][ T7168] netdevsim netdevsim0 netdevsim1: entered promiscuous mode [ 124.402979][ T7168] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 124.926279][ T7175] netlink: 8 bytes leftover after parsing attributes in process `syz.0.372'. [ 124.929195][ T7175] vlan2: entered promiscuous mode [ 124.978819][ T7176] netlink: 'syz.0.372': attribute type 10 has an invalid length. [ 125.603331][ T7191] FAULT_INJECTION: forcing a failure. [ 125.603331][ T7191] name failslab, interval 1, probability 0, space 0, times 0 [ 125.603353][ T7191] CPU: 3 UID: 0 PID: 7191 Comm: syz.3.376 Tainted: G L syzkaller #0 PREEMPT(full) [ 125.603368][ T7191] Tainted: [L]=SOFTLOCKUP [ 125.603372][ T7191] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 125.603378][ T7191] Call Trace: [ 125.603382][ T7191] [ 125.603386][ T7191] dump_stack_lvl+0x100/0x190 [ 125.603405][ T7191] should_fail_ex.cold+0x5/0xa [ 125.603420][ T7191] should_failslab+0xc2/0x120 [ 125.603438][ T7191] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 125.603453][ T7191] ? __alloc_skb+0x5b7/0x710 [ 125.603466][ T7191] ? __alloc_skb+0x140/0x710 [ 125.603480][ T7191] __alloc_skb+0x140/0x710 [ 125.603491][ T7191] ? __alloc_skb+0x5b7/0x710 [ 125.603502][ T7191] ? __pfx___alloc_skb+0x10/0x10 [ 125.603515][ T7191] ? aa_sk_perm+0x389/0xab0 [ 125.603530][ T7191] netlink_alloc_large_skb+0x69/0x150 [ 125.603543][ T7191] netlink_sendmsg+0x680/0xda0 [ 125.603556][ T7191] ? __pfx_netlink_sendmsg+0x10/0x10 [ 125.603569][ T7191] ? apparmor_socket_sendmsg+0x165/0x280 [ 125.603583][ T7191] ____sys_sendmsg+0xa4d/0xbe0 [ 125.603598][ T7191] ? __pfx_netlink_sendmsg+0x10/0x10 [ 125.603611][ T7191] ? __pfx_____sys_sendmsg+0x10/0x10 [ 125.603632][ T7191] ___sys_sendmsg+0x190/0x1e0 [ 125.603649][ T7191] ? __pfx____sys_sendmsg+0x10/0x10 [ 125.603672][ T7191] ? find_held_lock+0x2b/0x80 [ 125.603694][ T7191] __sys_sendmsg+0x160/0x210 [ 125.603707][ T7191] ? __pfx___sys_sendmsg+0x10/0x10 [ 125.603724][ T7191] ? __pfx_ksys_write+0x10/0x10 [ 125.603753][ T7191] __do_fast_syscall_32+0x13a/0x8b0 [ 125.603766][ T7191] ? lockdep_hardirqs_on+0x7d/0x110 [ 125.603784][ T7191] do_fast_syscall_32+0x32/0x70 [ 125.603796][ T7191] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 125.603810][ T7191] RIP: 0023:0xf739efec [ 125.603823][ T7191] Code: Unable to access opcode bytes at 0xf739efc2. [ 125.603827][ T7191] RSP: 002b:00000000f539550c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 125.603839][ T7191] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000480 [ 125.603845][ T7191] RDX: 0000000004000054 RSI: 0000000000000000 RDI: 0000000000000000 [ 125.603852][ T7191] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 125.603858][ T7191] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 125.603864][ T7191] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 125.603877][ T7191] [ 126.038042][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 126.231221][ T7211] Invalid ELF header magic: != ELF [ 126.243020][ T7210] Invalid ELF header magic: != ELF [ 126.243897][ T7211] overlay: Unknown parameter '/' [ 126.733916][ T7217] netlink: 20 bytes leftover after parsing attributes in process `syz.2.383'. [ 129.061768][ T7242] netlink: 'syz.2.391': attribute type 10 has an invalid length. [ 129.116783][ T7240] Invalid ELF header magic: != ELF [ 129.126801][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 129.141439][ T7240] overlay: Unknown parameter '/' [ 129.588908][ T7252] Invalid ELF header magic: != ELF [ 129.824266][ T7257] tipc: Enabling of bearer rejected, failed to enable media [ 129.845755][ T7257] i2c i2c-0: new_device: Missing parameters [ 129.888723][ T7257] wusb3801 0-0004: supply vbus not found, using dummy regulator [ 129.952079][ T7257] i2c i2c-0: new_device: Instantiated device wusb3801 at 0x04 [ 130.239788][ T5888] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 130.392480][ T5888] usb 7-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 130.393897][ T5888] usb 7-1: config 0 has an invalid descriptor of length 52, skipping remainder of the config [ 130.393911][ T5888] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 130.396373][ T5888] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.396386][ T5888] usb 7-1: Product: syz [ 130.396393][ T5888] usb 7-1: Manufacturer: syz [ 130.396400][ T5888] usb 7-1: SerialNumber: syz [ 130.397641][ T5888] usb 7-1: config 0 descriptor?? [ 130.639795][ T5128] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 130.652207][ T5820] usb 7-1: USB disconnect, device number 4 [ 130.810814][ T5128] usb 8-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 130.873147][ T5128] usb 8-1: config 0 has an invalid descriptor of length 52, skipping remainder of the config [ 130.873165][ T5128] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 130.926033][ T5128] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.926058][ T5128] usb 8-1: Product: syz [ 130.926073][ T5128] usb 8-1: Manufacturer: syz [ 130.926086][ T5128] usb 8-1: SerialNumber: syz [ 131.477261][ T5128] usb 8-1: config 0 descriptor?? [ 131.479192][ T5743] Bluetooth: Frame is too long (len 10, expected len 4) [ 131.674089][ T7287] tipc: Enabling of bearer rejected, failed to enable media [ 131.682641][ T7287] i2c i2c-0: new_device: Missing parameters [ 131.683048][ T7287] FAULT_INJECTION: forcing a failure. [ 131.683048][ T7287] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 131.683066][ T7287] CPU: 0 UID: 0 PID: 7287 Comm: syz.0.405 Tainted: G L syzkaller #0 PREEMPT(full) [ 131.683081][ T7287] Tainted: [L]=SOFTLOCKUP [ 131.683085][ T7287] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 131.683092][ T7287] Call Trace: [ 131.683096][ T7287] [ 131.683100][ T7287] dump_stack_lvl+0x100/0x190 [ 131.683119][ T7287] should_fail_ex.cold+0x5/0xa [ 131.683134][ T7287] _copy_from_iter+0x1f4/0x1690 [ 131.683149][ T7287] ? __pfx__copy_from_iter+0x10/0x10 [ 131.683160][ T7287] ? trace_kmalloc+0xeb/0x110 [ 131.683176][ T7287] ? __kasan_kmalloc+0xaa/0xb0 [ 131.683192][ T7287] ? __kmalloc_noprof+0x350/0x840 [ 131.683207][ T7287] ? kernfs_fop_write_iter+0x26a/0x5f0 [ 131.683223][ T7287] kernfs_fop_write_iter+0x186/0x5f0 [ 131.683238][ T7287] vfs_write+0x6af/0x1050 [ 131.683253][ T7287] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 131.683267][ T7287] ? __pfx_vfs_write+0x10/0x10 [ 131.683284][ T7287] ? find_held_lock+0x2b/0x80 [ 131.683320][ T7287] ksys_write+0x12a/0x250 [ 131.683341][ T7287] ? __pfx_ksys_write+0x10/0x10 [ 131.683364][ T7287] ? ksys_write+0x1ac/0x250 [ 131.683378][ T7287] ? __pfx_ksys_write+0x10/0x10 [ 131.683395][ T7287] __do_fast_syscall_32+0x13a/0x8b0 [ 131.683407][ T7287] ? lockdep_hardirqs_on+0x7d/0x110 [ 131.683425][ T7287] do_fast_syscall_32+0x32/0x70 [ 131.683436][ T7287] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 131.683451][ T7287] RIP: 0023:0xf743efec [ 131.683464][ T7287] Code: Unable to access opcode bytes at 0xf743efc2. [ 131.683468][ T7287] RSP: 002b:00000000f543550c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 131.683480][ T7287] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000400 [ 131.683487][ T7287] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 131.683493][ T7287] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 131.683499][ T7287] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 131.683505][ T7287] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 131.683519][ T7287] [ 131.705124][ T5128] usb 8-1: USB disconnect, device number 4 [ 131.939809][ T5888] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 132.089767][ T5888] usb 6-1: Using ep0 maxpacket: 8 [ 132.094507][ T5888] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 132.255530][ T5888] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 132.255547][ T5888] usb 6-1: config 0 has no interface number 0 [ 132.255568][ T5888] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 132.255579][ T5888] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 132.255591][ T5888] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 132.255604][ T5888] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 132.255624][ T5888] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.258935][ T5888] usb 6-1: config 0 descriptor?? [ 132.302898][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.302960][ T1439] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.337062][ T5888] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 133.728374][ T42] usb 6-1: USB disconnect, device number 5 [ 133.738689][ T42] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 134.384965][ T7317] tipc: Enabling of bearer rejected, failed to enable media [ 134.386484][ T7317] FAULT_INJECTION: forcing a failure. [ 134.386484][ T7317] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 134.386582][ T7317] CPU: 2 UID: 0 PID: 7317 Comm: syz.1.413 Tainted: G L syzkaller #0 PREEMPT(full) [ 134.386610][ T7317] Tainted: [L]=SOFTLOCKUP [ 134.386614][ T7317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.386620][ T7317] Call Trace: [ 134.386624][ T7317] [ 134.386629][ T7317] dump_stack_lvl+0x100/0x190 [ 134.386648][ T7317] should_fail_ex.cold+0x5/0xa [ 134.386662][ T7317] _copy_from_user+0x2e/0xd0 [ 134.386674][ T7317] memdup_user+0x6b/0xe0 [ 134.386688][ T7317] strndup_user+0x78/0xe0 [ 134.386701][ T7317] __ia32_sys_mount+0x136/0x310 [ 134.386713][ T7317] ? __pfx___ia32_sys_mount+0x10/0x10 [ 134.386724][ T7317] ? ksys_write+0x1ac/0x250 [ 134.386737][ T7317] ? __pfx_ksys_write+0x10/0x10 [ 134.386754][ T7317] __do_fast_syscall_32+0x13a/0x8b0 [ 134.386765][ T7317] ? lockdep_hardirqs_on+0x7d/0x110 [ 134.386783][ T7317] do_fast_syscall_32+0x32/0x70 [ 134.386798][ T7317] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 134.386812][ T7317] RIP: 0023:0xf7fe7fec [ 134.386825][ T7317] Code: Unable to access opcode bytes at 0xf7fe7fc2. [ 134.386830][ T7317] RSP: 002b:00000000f547550c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 134.386840][ T7317] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000000 [ 134.386847][ T7317] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 134.386872][ T7317] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 134.386880][ T7317] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 134.386886][ T7317] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 134.386900][ T7317] [ 135.446248][ T7328] Invalid ELF header magic: != ELF [ 135.451338][ T7328] overlay: Unknown parameter '/' [ 135.557495][ T7329] Invalid ELF header magic: != ELF [ 135.854830][ T7322] overlay: Unknown parameter '/' [ 135.976844][ T7332] Invalid ELF header magic: != ELF [ 136.026733][ T7332] overlay: Unknown parameter '/' [ 136.044333][ T7333] Invalid ELF header magic: != ELF [ 136.174652][ T7335] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 136.174737][ T7335] qnx6: wrong signature (magic) in superblock #1. [ 136.174742][ T7335] qnx6: unable to read the first superblock [ 136.181128][ T7335] netlink: 'syz.0.418': attribute type 2 has an invalid length. [ 136.181144][ T7335] netlink: 208 bytes leftover after parsing attributes in process `syz.0.418'. [ 136.181155][ T7335] netlink: 'syz.0.418': attribute type 2 has an invalid length. [ 136.314194][ T7331] overlay: Unknown parameter '/' [ 136.869803][ T5820] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 137.039740][ T5820] usb 6-1: Using ep0 maxpacket: 8 [ 137.040334][ T5820] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 137.041359][ T5820] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 137.041378][ T5820] usb 6-1: config 0 has no interface number 0 [ 137.041406][ T5820] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 137.041423][ T5820] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 137.041442][ T5820] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 137.041461][ T5820] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 137.041490][ T5820] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.046322][ T5820] usb 6-1: config 0 descriptor?? [ 137.054083][ T5820] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 137.264073][ T50] usb 6-1: USB disconnect, device number 6 [ 137.267542][ T50] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 137.353423][ T7364] batman_adv: batadv0: Adding interface: gretap1 [ 137.353436][ T7364] batman_adv: batadv0: The MTU of interface gretap1 is too small (1438) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 137.353455][ T7364] batman_adv: batadv0: Interface activated: gretap1 [ 137.779766][ T5837] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 137.951049][ T5837] usb 8-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 137.951881][ T5837] usb 8-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 137.951897][ T5837] usb 8-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 137.951915][ T5837] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.953877][ T7369] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 137.963634][ T5837] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 138.158805][ T42] usb 8-1: USB disconnect, device number 5 [ 138.179836][ T50] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 138.308259][ T7384] syzkaller0: entered promiscuous mode [ 138.308273][ T7384] syzkaller0: entered allmulticast mode [ 138.313202][ T7384] tipc: Enabled bearer , priority 0 [ 138.317365][ T7384] tipc: Resetting bearer [ 138.322420][ T7383] tipc: Resetting bearer [ 138.328108][ T7383] tipc: Disabling bearer [ 138.340148][ T50] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 138.340953][ T50] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 138.340968][ T50] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 138.340980][ T50] usb 6-1: config 1 interface 0 has no altsetting 0 [ 138.342428][ T50] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.342440][ T50] usb 6-1: Product: syz [ 138.342447][ T50] usb 6-1: Manufacturer: syz [ 138.342454][ T50] usb 6-1: SerialNumber: syz [ 138.344529][ T7379] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 138.344582][ T7379] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 138.592269][ T50] rtl8150 6-1:1.0: couldn't reset the device [ 138.592413][ T50] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 138.594976][ T50] usb 6-1: USB disconnect, device number 7 [ 138.728451][ T7393] netlink: 16 bytes leftover after parsing attributes in process `syz.0.439'. [ 138.732672][ T7393] netlink: 'syz.0.439': attribute type 10 has an invalid length. [ 138.741919][ T7393] team0 (unregistering): Port device team_slave_0 removed [ 138.744928][ T7393] team0 (unregistering): Port device team_slave_1 removed [ 138.857417][ T7395] futex_wake_op: syz.0.440 tries to shift op by 144; fix this program [ 139.330554][ T43] kauditd_printk_skb: 40 callbacks suppressed [ 139.330567][ T43] audit: type=1326 audit(1792037652.924:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7404 comm="syz.0.445" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743efec code=0x7fc00000 [ 139.330591][ T43] audit: type=1326 audit(1792037652.924:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7404 comm="syz.0.445" exe="/syz-executor" sig=0 arch=40000003 syscall=332 compat=1 ip=0xf743efec code=0x7fc00000 [ 139.330611][ T43] audit: type=1326 audit(1792037652.924:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7404 comm="syz.0.445" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743efec code=0x7fc00000 [ 139.330630][ T43] audit: type=1326 audit(1792037652.924:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7404 comm="syz.0.445" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743efec code=0x7fc00000 [ 139.330651][ T43] audit: type=1326 audit(1792037652.924:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7404 comm="syz.0.445" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743efec code=0x7fc00000 [ 139.330671][ T43] audit: type=1326 audit(1792037652.924:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7404 comm="syz.0.445" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743efec code=0x7fc00000 [ 139.330690][ T43] audit: type=1326 audit(1792037652.924:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7404 comm="syz.0.445" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743efec code=0x7fc00000 [ 139.330713][ T43] audit: type=1326 audit(1792037652.924:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7404 comm="syz.0.445" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743efec code=0x7fc00000 [ 139.330733][ T43] audit: type=1326 audit(1792037652.934:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7404 comm="syz.0.445" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743efec code=0x7fc00000 [ 139.330754][ T43] audit: type=1326 audit(1792037652.934:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7404 comm="syz.0.445" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743efec code=0x7fc00000 [ 139.404025][ T7413] comedi comedi1: 8255: I/O base address not correctly aligned [ 139.849739][ T42] usb 5-1: new low-speed USB device number 14 using dummy_hcd [ 140.024085][ T42] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 140.025161][ T42] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 140.025181][ T42] usb 5-1: config 0 has no interface number 0 [ 140.025210][ T42] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 140.025231][ T42] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 140.025264][ T42] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 140.027456][ T42] usb 5-1: config 0 descriptor?? [ 140.029104][ T7421] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 140.041238][ T42] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 140.266617][ T7430] pci 0000:00:00.0: [8086:29c0] type 00 class 0x060000 conventional PCI endpoint [ 140.277427][ T7430] pci 0000:00:00.0: Adding to iommu group 0 [ 140.315221][ T7439] netlink: 4 bytes leftover after parsing attributes in process `syz.2.457'. [ 140.818225][ T5837] usb 5-1: USB disconnect, device number 14 [ 142.188173][ T7489] pci 0000:00:00.0: [8086:29c0] type 00 class 0x060000 conventional PCI endpoint [ 142.197504][ T7489] pci 0000:00:00.0: Adding to iommu group 0 [ 142.439521][ T7504] netlink: 8 bytes leftover after parsing attributes in process `syz.0.471'. [ 142.557616][ T7510] syzkaller0: entered promiscuous mode [ 142.557651][ T7510] syzkaller0: entered allmulticast mode [ 144.367213][ T43] kauditd_printk_skb: 21 callbacks suppressed [ 144.367227][ T43] audit: type=1326 audit(1792037657.964:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7545 comm="syz.1.479" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe7fec code=0x7fc00000 [ 145.035061][ T7575] syzkaller0: entered promiscuous mode [ 145.035076][ T7575] syzkaller0: entered allmulticast mode [ 145.055006][ T7575] tipc: Started in network mode [ 145.055024][ T7575] tipc: Node identity ee8011614ae7, cluster identity 4711 [ 145.055574][ T7575] tipc: Enabled bearer , priority 0 [ 145.069851][ T7575] tipc: Resetting bearer [ 145.091180][ T7572] tipc: Resetting bearer [ 145.194178][ T7572] tipc: Disabling bearer [ 146.697886][ T7606] syzkaller0: entered promiscuous mode [ 146.697900][ T7606] syzkaller0: entered allmulticast mode [ 146.700699][ T7606] tipc: Started in network mode [ 146.700714][ T7606] tipc: Node identity 06ad8c889f2d, cluster identity 4711 [ 146.701023][ T7606] tipc: Enabled bearer , priority 0 [ 146.710067][ T7606] tipc: Resetting bearer [ 146.783451][ T7605] tipc: Resetting bearer [ 146.804153][ T7605] tipc: Disabling bearer [ 146.859799][ T25] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 147.030110][ T25] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 147.030935][ T25] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 147.030949][ T25] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 147.030958][ T25] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 147.030977][ T25] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 147.032142][ T25] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 147.032154][ T25] usb 6-1: Product: syz [ 147.032161][ T25] usb 6-1: Manufacturer: syz [ 147.039496][ T25] cdc_wdm 6-1:1.0: skipping garbage [ 147.039507][ T25] cdc_wdm 6-1:1.0: skipping garbage [ 147.047177][ T25] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 147.047188][ T25] cdc_wdm 6-1:1.0: Unknown control protocol [ 147.091212][ T7610] netlink: 4 bytes leftover after parsing attributes in process `syz.3.497'. [ 147.255791][ T25] usb 6-1: USB disconnect, device number 8 [ 147.430895][ T7576] syz.3.483 (7576) used greatest stack depth: 18136 bytes left [ 147.587572][ T7626] ubi0: attaching mtd0 [ 147.594162][ T7626] ubi0: scanning is finished [ 147.594178][ T7626] ubi0: empty MTD device detected [ 147.732025][ T7626] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 147.732048][ T7626] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 147.732063][ T7626] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 147.732076][ T7626] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 147.732090][ T7626] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 147.732106][ T7626] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 147.732123][ T7626] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 980093626 [ 147.732140][ T7626] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 147.733706][ T7630] ubi0: background thread "ubi_bgt0d" started, PID 7630 [ 147.789794][ T25] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 147.950533][ T25] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 147.951389][ T25] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 147.951402][ T25] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 147.951412][ T25] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 147.951431][ T25] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 147.959877][ T25] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 147.959898][ T25] usb 6-1: Product: syz [ 147.959910][ T25] usb 6-1: Manufacturer: syz [ 147.964490][ T25] cdc_wdm 6-1:1.0: skipping garbage [ 147.964505][ T25] cdc_wdm 6-1:1.0: skipping garbage [ 147.966458][ T25] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 147.966471][ T25] cdc_wdm 6-1:1.0: Unknown control protocol [ 148.395130][ T7647] syzkaller0: entered promiscuous mode [ 148.395145][ T7647] syzkaller0: entered allmulticast mode [ 148.400547][ T7647] tipc: Started in network mode [ 148.400563][ T7647] tipc: Node identity 0e617d6397d2, cluster identity 4711 [ 148.400689][ T7647] tipc: Enabled bearer , priority 0 [ 148.410736][ T7647] tipc: Resetting bearer [ 148.425876][ T7643] tipc: Resetting bearer [ 148.477118][ T7643] tipc: Disabling bearer [ 148.677032][ T7660] FAULT_INJECTION: forcing a failure. [ 148.677032][ T7660] name failslab, interval 1, probability 0, space 0, times 0 [ 148.677066][ T7660] CPU: 2 UID: 0 PID: 7660 Comm: syz.0.508 Tainted: G L syzkaller #0 PREEMPT(full) [ 148.677093][ T7660] Tainted: [L]=SOFTLOCKUP [ 148.677100][ T7660] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 148.677111][ T7660] Call Trace: [ 148.677119][ T7660] [ 148.677126][ T7660] dump_stack_lvl+0x100/0x190 [ 148.677159][ T7660] should_fail_ex.cold+0x5/0xa [ 148.677184][ T7660] should_failslab+0xc2/0x120 [ 148.677213][ T7660] kmem_cache_alloc_noprof+0x92/0x6a0 [ 148.677239][ T7660] ? __kernfs_new_node+0xd2/0xa10 [ 148.677262][ T7660] __kernfs_new_node+0xd2/0xa10 [ 148.677286][ T7660] ? __pfx___kernfs_new_node+0x10/0x10 [ 148.677307][ T7660] ? lock_acquire+0x1d1/0x380 [ 148.677335][ T7660] ? kernfs_root+0x23/0x2a0 [ 148.677361][ T7660] ? find_held_lock+0x2b/0x80 [ 148.677383][ T7660] ? kernfs_root+0xee/0x2a0 [ 148.677408][ T7660] ? kernfs_root+0xee/0x2a0 [ 148.677440][ T7660] kernfs_create_dir_ns+0xa6/0x2b0 [ 148.677464][ T7660] internal_create_group+0x36f/0xfb0 [ 148.677498][ T7660] ? kernfs_add_one+0x214/0xaa0 [ 148.677519][ T7660] ? __pfx_internal_create_group+0x10/0x10 [ 148.677549][ T7660] ? bus_add_device+0x2e2/0x6c0 [ 148.677570][ T7660] ? __pfx_bus_add_device+0x10/0x10 [ 148.677588][ T7660] ? __pfx_dev_add_physical_location+0x10/0x10 [ 148.677635][ T7660] dpm_sysfs_add+0x80/0x280 [ 148.677665][ T7660] device_add+0x9f4/0x1970 [ 148.677696][ T7660] ? __pfx_device_add+0x10/0x10 [ 148.677739][ T7660] nfc_register_device+0x41/0x3e0 [ 148.677776][ T7660] nci_register_device+0x7f1/0xb80 [ 148.677805][ T7660] ? __pfx_nci_register_device+0x10/0x10 [ 148.677835][ T7660] ? lockdep_init_map_type+0x5c/0x250 [ 148.677868][ T7660] virtual_ncidev_open+0x141/0x220 [ 148.677896][ T7660] ? __pfx_virtual_ncidev_open+0x10/0x10 [ 148.677922][ T7660] misc_open+0x26d/0x450 [ 148.677943][ T7660] ? __pfx_misc_open+0x10/0x10 [ 148.677962][ T7660] chrdev_open+0x234/0x6a0 [ 148.677990][ T7660] ? __pfx_apparmor_file_open+0x10/0x10 [ 148.678017][ T7660] ? __pfx_chrdev_open+0x10/0x10 [ 148.678046][ T7660] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 148.678098][ T7660] do_dentry_open+0x6ab/0x14d0 [ 148.678127][ T7660] ? __pfx_chrdev_open+0x10/0x10 [ 148.678163][ T7660] vfs_open+0x82/0x3f0 [ 148.678189][ T7660] path_openat+0x19fa/0x2440 [ 148.678221][ T7660] ? __pfx_path_openat+0x10/0x10 [ 148.678258][ T7660] do_file_open+0x20e/0x430 [ 148.678288][ T7660] ? __pfx_do_file_open+0x10/0x10 [ 148.678337][ T7660] ? _raw_spin_unlock+0x28/0x50 [ 148.678365][ T7660] ? alloc_fd+0x471/0x7a0 [ 148.678401][ T7660] do_sys_openat2+0x10f/0x1e0 [ 148.678422][ T7660] ? __pfx_do_sys_openat2+0x10/0x10 [ 148.678454][ T7660] __ia32_compat_sys_openat+0x12d/0x210 [ 148.678477][ T7660] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 148.678512][ T7660] __do_fast_syscall_32+0x13a/0x8b0 [ 148.678532][ T7660] ? lockdep_hardirqs_on+0x7d/0x110 [ 148.678565][ T7660] do_fast_syscall_32+0x32/0x70 [ 148.678585][ T7660] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 148.678610][ T7660] RIP: 0023:0xf743efec [ 148.678632][ T7660] Code: Unable to access opcode bytes at 0xf743efc2. [ 148.678642][ T7660] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 148.678662][ T7660] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000280 [ 148.678677][ T7660] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 148.678690][ T7660] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 148.678702][ T7660] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 148.678722][ T7660] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 148.678751][ T7660] [ 149.317555][ T25] usb 6-1: USB disconnect, device number 9 [ 149.350558][ T7678] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input8 [ 149.871689][ T7691] netlink: 'syz.0.517': attribute type 4 has an invalid length. [ 149.975281][ T7697] FAULT_INJECTION: forcing a failure. [ 149.975281][ T7697] name failslab, interval 1, probability 0, space 0, times 0 [ 149.975318][ T7697] CPU: 2 UID: 0 PID: 7697 Comm: syz.0.519 Tainted: G L syzkaller #0 PREEMPT(full) [ 149.975347][ T7697] Tainted: [L]=SOFTLOCKUP [ 149.975354][ T7697] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 149.975367][ T7697] Call Trace: [ 149.975374][ T7697] [ 149.975384][ T7697] dump_stack_lvl+0x100/0x190 [ 149.975418][ T7697] should_fail_ex.cold+0x5/0xa [ 149.975444][ T7697] should_failslab+0xc2/0x120 [ 149.975478][ T7697] __kmalloc_cache_noprof+0x91/0x6d0 [ 149.975503][ T7697] ? lockdep_init_map_type+0x5c/0x250 [ 149.975534][ T7697] ? snd_seq_prioq_new+0x3f/0x110 [ 149.975561][ T7697] snd_seq_prioq_new+0x3f/0x110 [ 149.975581][ T7697] snd_seq_queue_alloc+0x12b/0x540 [ 149.975616][ T7697] snd_seq_ioctl_create_queue+0xa9/0x370 [ 149.975643][ T7697] snd_seq_ioctl+0x219/0x410 [ 149.975675][ T7697] ? __pfx_snd_seq_ioctl+0x10/0x10 [ 149.975718][ T7697] ? __fget_files+0x21f/0x3d0 [ 149.975751][ T7697] snd_seq_ioctl_compat+0x13b/0x300 [ 149.975777][ T7697] ? __pfx_snd_seq_ioctl_compat+0x10/0x10 [ 149.975804][ T7697] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 149.975834][ T7697] __do_fast_syscall_32+0x13a/0x8b0 [ 149.975861][ T7697] do_fast_syscall_32+0x32/0x70 [ 149.975882][ T7697] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 149.975908][ T7697] RIP: 0023:0xf743efec [ 149.975929][ T7697] Code: Unable to access opcode bytes at 0xf743efc2. [ 149.975940][ T7697] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 149.975962][ T7697] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c08c5332 [ 149.975976][ T7697] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 149.975989][ T7697] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 149.976001][ T7697] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 149.976013][ T7697] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 149.976041][ T7697] [ 150.040372][ T7700] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input9 [ 151.264893][ T7722] syzkaller0: entered promiscuous mode [ 151.264915][ T7722] syzkaller0: entered allmulticast mode [ 151.267782][ T7722] tipc: Enabled bearer , priority 0 [ 151.280565][ T7722] tipc: Resetting bearer [ 151.284584][ T7720] tipc: Resetting bearer [ 151.284843][ T7726] netlink: 'syz.0.530': attribute type 10 has an invalid length. [ 151.300933][ T7720] tipc: Disabling bearer [ 151.303378][ T7726] bridge0: port 2(bridge_slave_1) entered disabled state [ 151.303990][ T7726] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.312626][ T7726] bridge0: port 2(bridge_slave_1) entered blocking state [ 151.312675][ T7726] bridge0: port 2(bridge_slave_1) entered forwarding state [ 151.313027][ T7726] bridge0: port 1(bridge_slave_0) entered blocking state [ 151.313076][ T7726] bridge0: port 1(bridge_slave_0) entered forwarding state [ 151.316631][ T7726] bridge0: entered promiscuous mode [ 151.316953][ T7726] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 151.908411][ T7755] syzkaller0: entered promiscuous mode [ 151.908425][ T7755] syzkaller0: entered allmulticast mode [ 151.917338][ T7755] tipc: Enabled bearer , priority 0 [ 151.919354][ T7755] tipc: Resetting bearer [ 151.927242][ T7754] tipc: Resetting bearer [ 151.947484][ T7754] tipc: Disabling bearer [ 152.652742][ T7768] netlink: 16 bytes leftover after parsing attributes in process `syz.1.546'. [ 153.406287][ T7784] syzkaller0: entered promiscuous mode [ 153.406302][ T7784] syzkaller0: entered allmulticast mode [ 153.411227][ T7784] tipc: Enabled bearer , priority 0 [ 153.417467][ T7783] tipc: Resetting bearer [ 153.434988][ T7783] tipc: Disabling bearer [ 153.557924][ T7793] syz_tun: entered allmulticast mode [ 154.270422][ T7803] netdevsim netdevsim2: Direct firmware load for ./file0 failed with error -2 [ 154.270464][ T7803] netdevsim netdevsim2: Falling back to sysfs fallback for: ./file0 [ 154.470250][ T1163] IPVS: starting estimator thread 0... [ 154.580162][ T7806] IPVS: using max 43 ests per chain, 103200 per kthread [ 155.139626][ T13] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x82 [ 155.374432][ T7819] syzkaller0: entered promiscuous mode [ 155.374447][ T7819] syzkaller0: entered allmulticast mode [ 155.570386][ T7825] netlink: 'syz.1.563': attribute type 1 has an invalid length. [ 155.588209][ T7825] bond1: entered promiscuous mode [ 155.588506][ T7825] 8021q: adding VLAN 0 to HW filter on device bond1 [ 155.620067][ T7825] bond1: (slave bridge1): making interface the new active one [ 155.620082][ T7825] bridge1: entered promiscuous mode [ 155.621384][ T7825] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 155.932781][ T7832] cgroup: none used incorrectly [ 157.535736][ T7840] syz_tun: entered allmulticast mode [ 157.592758][ T7842] warning: `syz.1.569' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 157.810830][ T7808] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 157.884356][ T7851] netlink: 'syz.3.573': attribute type 1 has an invalid length. [ 157.893991][ T7851] bond1: entered promiscuous mode [ 157.894299][ T7851] 8021q: adding VLAN 0 to HW filter on device bond1 [ 157.906456][ T7851] bond1: (slave bridge1): making interface the new active one [ 157.906469][ T7851] bridge1: entered promiscuous mode [ 157.908338][ T7851] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 157.981641][ T7861] syz_tun: entered allmulticast mode [ 157.981928][ T7862] netlink: 'syz.1.577': attribute type 4 has an invalid length. [ 158.073465][ T7868] syzkaller0: entered promiscuous mode [ 158.073481][ T7868] syzkaller0: entered allmulticast mode [ 158.076696][ T7868] tipc: Enabled bearer , priority 0 [ 158.077722][ T7867] tipc: Resetting bearer [ 158.089445][ T7867] tipc: Disabling bearer [ 158.282470][ T7883] netlink: 'syz.3.585': attribute type 1 has an invalid length. [ 158.330627][ T7883] bond2: entered promiscuous mode [ 158.331266][ T7883] 8021q: adding VLAN 0 to HW filter on device bond2 [ 158.368391][ T7883] bond2: (slave bridge2): making interface the new active one [ 158.368408][ T7883] bridge2: entered promiscuous mode [ 158.369176][ T7883] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 158.629878][ T7894] netlink: 'syz.3.588': attribute type 4 has an invalid length. [ 159.105653][ T7905] syzkaller0: entered promiscuous mode [ 159.105667][ T7905] syzkaller0: entered allmulticast mode [ 159.111577][ T7905] tipc: Enabled bearer , priority 0 [ 159.121209][ T7904] tipc: Resetting bearer [ 159.129660][ T7908] netlink: 'syz.2.595': attribute type 1 has an invalid length. [ 159.132133][ T7904] tipc: Disabling bearer [ 159.198385][ T7908] bond1: entered promiscuous mode [ 159.198592][ T7908] 8021q: adding VLAN 0 to HW filter on device bond1 [ 159.210544][ T7908] bond1: (slave bridge1): making interface the new active one [ 159.210559][ T7908] bridge1: entered promiscuous mode [ 159.211289][ T7908] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 159.295997][ T7915] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 159.296026][ T7915] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 159.365022][ T97] IPVS: starting estimator thread 0... [ 159.450311][ T7922] IPVS: using max 42 ests per chain, 100800 per kthread [ 159.536051][ T7924] netlink: 'syz.3.597': attribute type 4 has an invalid length. [ 159.981616][ T5740] Bluetooth: hci2: command 0x0406 tx timeout [ 159.985436][ T5740] Bluetooth: hci0: command 0x0406 tx timeout [ 159.987923][ T5096] Bluetooth: hci1: command 0x0406 tx timeout [ 160.366488][ T7939] netlink: 'syz.0.605': attribute type 1 has an invalid length. [ 160.390789][ T7939] bond2: entered promiscuous mode [ 160.390961][ T7939] 8021q: adding VLAN 0 to HW filter on device bond2 [ 160.405169][ T7939] bond2: (slave bridge1): making interface the new active one [ 160.405184][ T7939] bridge1: entered promiscuous mode [ 160.406102][ T7939] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 160.420310][ T7943] netlink: 4 bytes leftover after parsing attributes in process `syz.3.606'. [ 160.443090][ T7944] syzkaller0: entered promiscuous mode [ 160.443103][ T7944] syzkaller0: entered allmulticast mode [ 160.447309][ T7944] tipc: Enabled bearer , priority 0 [ 160.452219][ T7942] tipc: Resetting bearer [ 160.465762][ T7947] netlink: 'syz.0.608': attribute type 4 has an invalid length. [ 160.466566][ T7942] tipc: Disabling bearer [ 160.720145][ T7978] netlink: 'syz.1.617': attribute type 1 has an invalid length. [ 160.742750][ T7978] bond2: entered promiscuous mode [ 160.742958][ T7978] 8021q: adding VLAN 0 to HW filter on device bond2 [ 160.758582][ T7978] bond2: (slave bridge2): making interface the new active one [ 160.758595][ T7978] bridge2: entered promiscuous mode [ 160.759275][ T7978] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 160.786435][ T7981] netdevsim netdevsim0: Direct firmware load for ./file0 failed with error -2 [ 160.786478][ T7981] netdevsim netdevsim0: Falling back to sysfs fallback for: ./file0 [ 160.848985][ T97] IPVS: starting estimator thread 0... [ 160.873786][ T7986] syzkaller0: entered promiscuous mode [ 160.873808][ T7986] syzkaller0: entered allmulticast mode [ 160.876936][ T7986] tipc: Enabled bearer , priority 0 [ 160.879203][ T7985] tipc: Resetting bearer [ 160.891770][ T7985] tipc: Disabling bearer [ 160.939815][ T7984] IPVS: using max 23 ests per chain, 55200 per kthread [ 162.263101][ T8014] syzkaller0: entered promiscuous mode [ 162.263117][ T8014] syzkaller0: entered allmulticast mode [ 162.266377][ T8014] tipc: Enabled bearer , priority 0 [ 162.267626][ T8013] tipc: Resetting bearer [ 162.287383][ T8013] tipc: Disabling bearer [ 162.438378][ T8027] veth0: entered promiscuous mode [ 162.446349][ T8025] veth0: left promiscuous mode [ 164.503154][ T8063] netlink: 168 bytes leftover after parsing attributes in process `syz.0.639'. [ 164.923959][ T8082] netlink: 'syz.3.646': attribute type 1 has an invalid length. [ 164.956632][ T8082] bond3: entered promiscuous mode [ 164.956825][ T8082] 8021q: adding VLAN 0 to HW filter on device bond3 [ 164.985862][ T8082] bond3: (slave bridge3): making interface the new active one [ 164.985878][ T8082] bridge3: entered promiscuous mode [ 164.998630][ T8082] bond3: (slave bridge3): Enslaving as an active interface with an up link [ 165.154635][ T62] Bluetooth: hci4: Frame reassembly failed (-84) [ 165.449761][ T927] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 165.545615][ T8096] bond2: Removing last arp target with arp_interval on [ 165.546147][ T8096] 8021q: adding VLAN 0 to HW filter on device bond2 [ 165.601707][ T927] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 165.602532][ T927] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 165.602547][ T927] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 165.602556][ T927] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 165.602575][ T927] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 165.603775][ T927] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 165.603787][ T927] usb 6-1: Product: syz [ 165.603795][ T927] usb 6-1: Manufacturer: syz [ 165.608102][ T927] cdc_wdm 6-1:1.0: skipping garbage [ 165.608111][ T927] cdc_wdm 6-1:1.0: skipping garbage [ 165.612759][ T927] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 165.612770][ T927] cdc_wdm 6-1:1.0: Unknown control protocol [ 165.662828][ T8103] syzkaller0: entered promiscuous mode [ 165.662843][ T8103] syzkaller0: entered allmulticast mode [ 165.691300][ T8107] netlink: 'syz.2.656': attribute type 1 has an invalid length. [ 165.700389][ T8107] bond3: entered promiscuous mode [ 165.700589][ T8107] 8021q: adding VLAN 0 to HW filter on device bond3 [ 165.715960][ T8107] bond3: (slave bridge2): making interface the new active one [ 165.715974][ T8107] bridge2: entered promiscuous mode [ 165.716626][ T8107] bond3: (slave bridge2): Enslaving as an active interface with an up link [ 165.810035][ T927] usb 6-1: USB disconnect, device number 10 [ 166.249797][ T6935] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 166.335319][ T8124] netlink: 84 bytes leftover after parsing attributes in process `syz.2.661'. [ 166.401233][ T6935] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 166.402067][ T6935] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 166.402082][ T6935] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 166.402092][ T6935] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 166.402129][ T6935] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 166.403592][ T6935] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 166.403612][ T6935] usb 6-1: Product: syz [ 166.403623][ T6935] usb 6-1: Manufacturer: syz [ 166.407849][ T6935] cdc_wdm 6-1:1.0: skipping garbage [ 166.407858][ T6935] cdc_wdm 6-1:1.0: skipping garbage [ 166.411619][ T6935] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 166.411634][ T6935] cdc_wdm 6-1:1.0: Unknown control protocol [ 166.644871][ T8135] syzkaller0: entered promiscuous mode [ 166.644886][ T8135] syzkaller0: entered allmulticast mode [ 166.691197][ T8137] netlink: 'syz.0.667': attribute type 1 has an invalid length. [ 166.700222][ T8137] bond3: entered promiscuous mode [ 166.700423][ T8137] 8021q: adding VLAN 0 to HW filter on device bond3 [ 166.714764][ T8137] bond3: (slave bridge2): making interface the new active one [ 166.714778][ T8137] bridge2: entered promiscuous mode [ 166.715321][ T8137] bond3: (slave bridge2): Enslaving as an active interface with an up link [ 167.119918][ T5846] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 167.179814][ T5744] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 167.179833][ T66] Bluetooth: hci4: command 0x1003 tx timeout [ 167.270822][ T5846] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 167.271691][ T5846] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 167.271738][ T5846] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.273978][ T5846] usb 5-1: config 0 descriptor?? [ 167.279392][ T5846] pwc: Askey VC010 type 2 USB webcam detected. [ 167.392225][ T8167] syzkaller0: entered promiscuous mode [ 167.392240][ T8167] syzkaller0: entered allmulticast mode [ 167.575534][ T8172] netlink: 'syz.2.679': attribute type 1 has an invalid length. [ 167.597589][ T8172] bond4: entered promiscuous mode [ 167.598970][ T8172] 8021q: adding VLAN 0 to HW filter on device bond4 [ 167.617182][ T8172] bond4: (slave bridge3): making interface the new active one [ 167.617197][ T8172] bridge3: entered promiscuous mode [ 167.618464][ T8172] bond4: (slave bridge3): Enslaving as an active interface with an up link [ 167.679116][ T5846] pwc: recv_control_msg error -32 req 02 val 2b00 [ 167.679793][ T5846] pwc: recv_control_msg error -32 req 02 val 2700 [ 167.680223][ T5846] pwc: recv_control_msg error -32 req 02 val 2c00 [ 167.681548][ T5846] pwc: recv_control_msg error -32 req 04 val 1000 [ 167.681952][ T5846] pwc: recv_control_msg error -32 req 04 val 1300 [ 167.682433][ T5846] pwc: recv_control_msg error -32 req 04 val 1400 [ 167.683250][ T5846] pwc: recv_control_msg error -32 req 02 val 2000 [ 167.683887][ T5846] pwc: recv_control_msg error -32 req 02 val 2100 [ 167.888837][ T5846] pwc: recv_control_msg error -71 req 02 val 2500 [ 167.891939][ T5846] pwc: recv_control_msg error -71 req 02 val 2400 [ 167.892224][ T5846] pwc: recv_control_msg error -71 req 02 val 2600 [ 167.892470][ T5846] pwc: recv_control_msg error -71 req 02 val 2900 [ 167.892713][ T5846] pwc: recv_control_msg error -71 req 02 val 2800 [ 167.893015][ T5846] pwc: recv_control_msg error -71 req 04 val 1100 [ 167.893312][ T5846] pwc: recv_control_msg error -71 req 04 val 1200 [ 167.898455][ T5846] pwc: Registered as video103. [ 167.899561][ T5846] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb5/5-1/input/input10 [ 167.913334][ T5846] usb 5-1: USB disconnect, device number 15 [ 168.334025][ T30] usb 6-1: USB disconnect, device number 11 [ 168.441212][ T8193] syzkaller0: entered promiscuous mode [ 168.441234][ T8193] syzkaller0: entered allmulticast mode [ 168.725630][ T8213] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 168.751623][ T8213] md: invalid superblock checksum on ram0 [ 168.751635][ T8213] md: ram0 does not have a valid v1.2 superblock, not importing! [ 168.851439][ T50] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 168.972584][ T8224] syzkaller0: entered promiscuous mode [ 168.972605][ T8224] syzkaller0: entered allmulticast mode [ 169.030199][ T50] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 169.030984][ T50] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 169.030997][ T50] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 169.031006][ T50] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 169.031026][ T50] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 169.032150][ T50] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 169.032162][ T50] usb 5-1: Product: syz [ 169.032169][ T50] usb 5-1: Manufacturer: syz [ 169.036858][ T50] cdc_wdm 5-1:1.0: skipping garbage [ 169.036867][ T50] cdc_wdm 5-1:1.0: skipping garbage [ 169.038038][ T50] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 169.038047][ T50] cdc_wdm 5-1:1.0: Unknown control protocol [ 169.109812][ T30] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 169.240312][ T50] usb 5-1: USB disconnect, device number 16 [ 169.271463][ T30] usb 8-1: Using ep0 maxpacket: 32 [ 169.271919][ T30] usb 8-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 169.272704][ T30] usb 8-1: config 0 has an invalid interface number: 85 but max is 0 [ 169.272717][ T30] usb 8-1: config 0 has no interface number 0 [ 169.272734][ T30] usb 8-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 169.272747][ T30] usb 8-1: config 0 interface 85 has no altsetting 0 [ 169.274272][ T30] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 169.274289][ T30] usb 8-1: Product: syz [ 169.274301][ T30] usb 8-1: Manufacturer: syz [ 169.274312][ T30] usb 8-1: SerialNumber: syz [ 169.276538][ T30] usb 8-1: config 0 descriptor?? [ 169.680593][ T50] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 169.830368][ T50] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 169.831263][ T50] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 169.831313][ T50] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 169.831324][ T50] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 169.831351][ T50] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 169.832697][ T50] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 169.832709][ T50] usb 5-1: Product: syz [ 169.832716][ T50] usb 5-1: Manufacturer: syz [ 169.836872][ T50] cdc_wdm 5-1:1.0: skipping garbage [ 169.836883][ T50] cdc_wdm 5-1:1.0: skipping garbage [ 169.842522][ T50] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 169.842578][ T50] cdc_wdm 5-1:1.0: Unknown control protocol [ 169.886176][ T30] appletouch 8-1:0.85: Geyser mode initialized. [ 169.887303][ T30] input: appletouch as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.85/input/input11 [ 170.088006][ T30] usb 8-1: USB disconnect, device number 6 [ 170.100404][ T30] appletouch 8-1:0.85: input: appletouch disconnected [ 170.329538][ T8251] tipc: Cannot configure node identity twice [ 170.371074][ T8253] netlink: 'syz.2.710': attribute type 1 has an invalid length. [ 170.387265][ T8253] bond5: entered promiscuous mode [ 170.387575][ T8253] 8021q: adding VLAN 0 to HW filter on device bond5 [ 170.408125][ T8253] bond5: (slave bridge4): making interface the new active one [ 170.408147][ T8253] bridge4: entered promiscuous mode [ 170.409218][ T8253] bond5: (slave bridge4): Enslaving as an active interface with an up link [ 170.451057][ T8257] bridge0: port 2(bridge_slave_1) entered disabled state [ 170.451480][ T8257] bridge0: port 1(bridge_slave_0) entered disabled state [ 170.452016][ T8257] bridge0: entered allmulticast mode [ 170.669356][ T8268] FAULT_INJECTION: forcing a failure. [ 170.669356][ T8268] name failslab, interval 1, probability 0, space 0, times 0 [ 170.669380][ T8268] CPU: 1 UID: 0 PID: 8268 Comm: syz.1.716 Tainted: G L syzkaller #0 PREEMPT(full) [ 170.669398][ T8268] Tainted: [L]=SOFTLOCKUP [ 170.669403][ T8268] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 170.669410][ T8268] Call Trace: [ 170.669414][ T8268] [ 170.669419][ T8268] dump_stack_lvl+0x100/0x190 [ 170.669439][ T8268] should_fail_ex.cold+0x5/0xa [ 170.669455][ T8268] should_failslab+0xc2/0x120 [ 170.669473][ T8268] __kmalloc_noprof+0xfc/0x840 [ 170.669504][ T8268] ? nfc_llcp_build_tlv+0x105/0x250 [ 170.669526][ T8268] nfc_llcp_build_tlv+0x105/0x250 [ 170.669547][ T8268] nfc_llcp_build_gb.isra.0+0x15e/0x3f0 [ 170.669564][ T8268] ? __pfx___debug_object_init+0x10/0x10 [ 170.669579][ T8268] ? __pfx_nfc_llcp_build_gb.isra.0+0x10/0x10 [ 170.669595][ T8268] ? __pfx___debug_object_init+0x10/0x10 [ 170.669610][ T8268] ? lockdep_init_map_type+0x5c/0x250 [ 170.669629][ T8268] ? lockdep_init_map_type+0x5c/0x250 [ 170.669646][ T8268] ? lockdep_init_map_type+0x5c/0x250 [ 170.669665][ T8268] nfc_llcp_register_device+0x6e2/0xb70 [ 170.669684][ T8268] nfc_register_device+0x6d/0x3e0 [ 170.669704][ T8268] nci_register_device+0x7f1/0xb80 [ 170.669721][ T8268] ? __pfx_nci_register_device+0x10/0x10 [ 170.669739][ T8268] ? lockdep_init_map_type+0x5c/0x250 [ 170.669759][ T8268] virtual_ncidev_open+0x141/0x220 [ 170.669775][ T8268] ? __pfx_virtual_ncidev_open+0x10/0x10 [ 170.669790][ T8268] misc_open+0x26d/0x450 [ 170.669801][ T8268] ? __pfx_misc_open+0x10/0x10 [ 170.669811][ T8268] chrdev_open+0x234/0x6a0 [ 170.669827][ T8268] ? __pfx_apparmor_file_open+0x10/0x10 [ 170.669843][ T8268] ? __pfx_chrdev_open+0x10/0x10 [ 170.669861][ T8268] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 170.669877][ T8268] do_dentry_open+0x6ab/0x14d0 [ 170.669893][ T8268] ? __pfx_chrdev_open+0x10/0x10 [ 170.669912][ T8268] vfs_open+0x82/0x3f0 [ 170.669925][ T8268] path_openat+0x19fa/0x2440 [ 170.669944][ T8268] ? __pfx_path_openat+0x10/0x10 [ 170.669964][ T8268] do_file_open+0x20e/0x430 [ 170.670003][ T8268] ? __pfx_do_file_open+0x10/0x10 [ 170.670031][ T8268] ? _raw_spin_unlock+0x28/0x50 [ 170.670049][ T8268] ? alloc_fd+0x471/0x7a0 [ 170.670075][ T8268] do_sys_openat2+0x10f/0x1e0 [ 170.670088][ T8268] ? __pfx_do_sys_openat2+0x10/0x10 [ 170.670112][ T8268] __ia32_compat_sys_openat+0x12d/0x210 [ 170.670131][ T8268] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 170.670152][ T8268] __do_fast_syscall_32+0x13a/0x8b0 [ 170.670163][ T8268] ? lockdep_hardirqs_on+0x7d/0x110 [ 170.670182][ T8268] do_fast_syscall_32+0x32/0x70 [ 170.670194][ T8268] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 170.670209][ T8268] RIP: 0023:0xf7fe7fec [ 170.670222][ T8268] Code: Unable to access opcode bytes at 0xf7fe7fc2. [ 170.670228][ T8268] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 170.670240][ T8268] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000280 [ 170.670247][ T8268] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 170.670254][ T8268] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 170.670260][ T8268] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 170.670267][ T8268] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 170.670282][ T8268] [ 170.979798][ T50] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 171.130515][ T50] usb 8-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 171.131627][ T50] usb 8-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 171.131649][ T50] usb 8-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 171.131674][ T50] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.136020][ T8278] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 171.160825][ T50] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 171.377170][ T50] usb 8-1: USB disconnect, device number 7 [ 171.769651][ T5837] usb 5-1: USB disconnect, device number 17 [ 172.168793][ T8302] netlink: 'syz.0.729': attribute type 1 has an invalid length. [ 172.178123][ T8302] bond4: entered promiscuous mode [ 172.178315][ T8302] 8021q: adding VLAN 0 to HW filter on device bond4 [ 172.193110][ T8302] 8021q: adding VLAN 0 to HW filter on device bond4 [ 172.193364][ T8302] bond4: (slave gre1): The slave device specified does not support setting the MAC address [ 172.193383][ T8302] bond4: (slave gre1): Setting fail_over_mac to active for active-backup mode [ 172.197408][ T8302] bond4: (slave gre1): making interface the new active one [ 172.197427][ T8302] gre1: entered promiscuous mode [ 172.198976][ T8302] bond4: (slave gre1): Enslaving as an active interface with an up link [ 173.089784][ T5888] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 173.240444][ T5888] usb 8-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 173.243169][ T5888] usb 8-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 173.243188][ T5888] usb 8-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 173.243206][ T5888] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.247220][ T8324] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 173.253214][ T5888] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 173.455239][ T5888] usb 8-1: USB disconnect, device number 8 [ 173.741714][ T8341] syzkaller0: entered promiscuous mode [ 173.741728][ T8341] syzkaller0: entered allmulticast mode [ 173.997544][ T8349] [ 173.998569][ T8349] ====================================================== [ 174.001529][ T8349] WARNING: possible circular locking dependency detected [ 174.004436][ T8349] syzkaller #0 Tainted: G L [ 174.006496][ T8349] ------------------------------------------------------ [ 174.008720][ T8349] syz.2.745/8349 is trying to acquire lock: [ 174.010636][ T8349] ffffffff914028c8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_streaming_header_allow_link+0x7c/0x650 [ 174.014070][ T8349] [ 174.014070][ T8349] but task is already holding lock: [ 174.016337][ T8349] ffff8880140d5b80 (&sb->s_type->i_mutex_key#32){+.+.}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 174.019596][ T8349] [ 174.019596][ T8349] which lock already depends on the new lock. [ 174.019596][ T8349] [ 174.022793][ T8349] [ 174.022793][ T8349] the existing dependency chain (in reverse order) is: [ 174.025571][ T8349] [ 174.025571][ T8349] -> #3 (&sb->s_type->i_mutex_key#32){+.+.}-{4:4}: [ 174.028256][ T8349] lock_acquire+0x1d1/0x380 [ 174.029883][ T8349] down_write+0x8b/0x1f0 [ 174.031382][ T8349] configfs_depend_item_unlocked+0xf3/0x6a0 [ 174.033358][ T8349] usbg_make_tpg+0x251/0x610 [ 174.034961][ T8349] target_fabric_make_tpg+0xab/0x8c0 [ 174.036799][ T8349] configfs_mkdir+0x525/0xd40 [ 174.038468][ T8349] vfs_mkdir+0x364/0x850 [ 174.039963][ T8349] filename_mkdirat+0x48b/0x5e0 [ 174.041633][ T8349] __ia32_sys_mkdirat+0x88/0xc0 [ 174.043310][ T8349] __do_fast_syscall_32+0x13a/0x8b0 [ 174.045066][ T8349] do_fast_syscall_32+0x32/0x70 [ 174.047060][ T8349] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 174.049938][ T8349] [ 174.049938][ T8349] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 174.053266][ T8349] lock_acquire+0x1d1/0x380 [ 174.055413][ T8349] __mutex_lock+0x1a4/0x1bd0 [ 174.057613][ T8349] tcm_alloc_inst+0x5f/0x1e0 [ 174.059789][ T8349] try_get_usb_function_instance+0x136/0x1f0 [ 174.062515][ T8349] usb_get_function_instance+0x16/0x70 [ 174.064852][ T8349] function_make+0x18c/0x3f0 [ 174.066471][ T8349] configfs_mkdir+0x525/0xd40 [ 174.068108][ T8349] vfs_mkdir+0x364/0x850 [ 174.069659][ T8349] filename_mkdirat+0x48b/0x5e0 [ 174.071345][ T8349] __ia32_sys_mkdirat+0x88/0xc0 [ 174.073012][ T8349] __do_fast_syscall_32+0x13a/0x8b0 [ 174.074784][ T8349] do_fast_syscall_32+0x32/0x70 [ 174.076475][ T8349] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 174.078643][ T8349] [ 174.078643][ T8349] -> #1 (func_lock){+.+.}-{4:4}: [ 174.080825][ T8349] lock_acquire+0x1d1/0x380 [ 174.082405][ T8349] __mutex_lock+0x1a4/0x1bd0 [ 174.083998][ T8349] try_get_usb_function_instance+0x26/0x1f0 [ 174.086603][ T8349] usb_get_function_instance+0x16/0x70 [ 174.088720][ T8349] function_make+0x18c/0x3f0 [ 174.090347][ T8349] configfs_mkdir+0x525/0xd40 [ 174.091959][ T8349] vfs_mkdir+0x364/0x850 [ 174.093454][ T8349] filename_mkdirat+0x48b/0x5e0 [ 174.095146][ T8349] __ia32_sys_mkdirat+0x88/0xc0 [ 174.096815][ T8349] __do_fast_syscall_32+0x13a/0x8b0 [ 174.098664][ T8349] do_fast_syscall_32+0x32/0x70 [ 174.100329][ T8349] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 174.102455][ T8349] [ 174.102455][ T8349] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 174.105031][ T8349] check_prev_add+0xeb/0xe60 [ 174.106592][ T8349] __lock_acquire+0x1528/0x1f40 [ 174.108284][ T8349] lock_acquire+0x1d1/0x380 [ 174.109879][ T8349] __mutex_lock+0x1a4/0x1bd0 [ 174.111485][ T8349] uvcg_streaming_header_allow_link+0x7c/0x650 [ 174.114211][ T8349] configfs_symlink+0x695/0x1340 [ 174.116076][ T8349] vfs_symlink+0x178/0x4d0 [ 174.117651][ T8349] filename_symlinkat+0x2a6/0x560 [ 174.119417][ T8349] __ia32_sys_symlinkat+0x9b/0xe0 [ 174.121137][ T8349] __do_fast_syscall_32+0x13a/0x8b0 [ 174.122906][ T8349] do_fast_syscall_32+0x32/0x70 [ 174.124569][ T8349] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 174.126675][ T8349] [ 174.126675][ T8349] other info that might help us debug this: [ 174.126675][ T8349] [ 174.130349][ T8349] Chain exists of: [ 174.130349][ T8349] gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#32 [ 174.130349][ T8349] [ 174.134901][ T8349] Possible unsafe locking scenario: [ 174.134901][ T8349] [ 174.137184][ T8349] CPU0 CPU1 [ 174.138883][ T8349] ---- ---- [ 174.140537][ T8349] lock(&sb->s_type->i_mutex_key#32); [ 174.142235][ T8349] lock(tpg_instances_lock); [ 174.144474][ T8349] lock(&sb->s_type->i_mutex_key#32); [ 174.146921][ T8349] lock(gadget_subsys.su_mutex); [ 174.148543][ T8349] [ 174.148543][ T8349] *** DEADLOCK *** [ 174.148543][ T8349] [ 174.151033][ T8349] locks held by syz.2.745/8349: 2, last CPU#0: [ 174.152933][ T8349] #0: ffff888023a94460 (sb_writers#18){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 174.155874][ T8349] #1: ffff8880140d5b80 (&sb->s_type->i_mutex_key#32){+.+.}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 174.159328][ T8349] [ 174.159328][ T8349] stack backtrace: [ 174.161153][ T8349] CPU: 0 UID: 0 PID: 8349 Comm: syz.2.745 Tainted: G L syzkaller #0 PREEMPT(full) [ 174.164419][ T8349] Tainted: [L]=SOFTLOCKUP [ 174.165758][ T8349] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.168882][ T8349] Call Trace: [ 174.169971][ T8349] [ 174.170908][ T8349] dump_stack_lvl+0x100/0x190 [ 174.172386][ T8349] print_circular_bug.cold+0x178/0x1be [ 174.174106][ T8349] check_noncircular+0x146/0x160 [ 174.175662][ T8349] check_prev_add+0xeb/0xe60 [ 174.177137][ T8349] ? stack_trace_save+0x8e/0xc0 [ 174.178708][ T8349] __lock_acquire+0x1528/0x1f40 [ 174.180235][ T8349] ? kasan_save_track+0x14/0x30 [ 174.181762][ T8349] ? kasan_save_free_info+0x3b/0x70 [ 174.183410][ T8349] lock_acquire+0x1d1/0x380 [ 174.184835][ T8349] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 174.186805][ T8349] ? __pfx___might_resched+0x10/0x10 [ 174.188513][ T8349] __mutex_lock+0x1a4/0x1bd0 [ 174.189968][ T8349] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 174.191933][ T8349] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 174.193896][ T8349] ? __lock_acquire+0x5c0/0x1f40 [ 174.195459][ T8349] ? __pfx___mutex_lock+0x10/0x10 [ 174.197072][ T8349] ? make_vfsuid+0xec/0x140 [ 174.198540][ T8349] ? __pfx___might_resched+0x10/0x10 [ 174.200190][ T8349] ? make_vfsgid+0xf1/0x140 [ 174.201617][ T8349] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 174.203588][ T8349] ? security_inode_permission+0xbf/0x250 [ 174.205294][ T8349] uvcg_streaming_header_allow_link+0x7c/0x650 [ 174.207214][ T8349] ? inode_permission+0x374/0x620 [ 174.208805][ T8349] ? mntput_no_expire+0xe8/0x220 [ 174.210378][ T8349] configfs_symlink+0x695/0x1340 [ 174.211917][ T8349] ? bpf_lsm_inode_permission+0x9/0x10 [ 174.213618][ T8349] ? security_inode_permission+0xbf/0x250 [ 174.215386][ T8349] ? __pfx_configfs_symlink+0x10/0x10 [ 174.217067][ T8349] vfs_symlink+0x178/0x4d0 [ 174.218531][ T8349] filename_symlinkat+0x2a6/0x560 [ 174.220104][ T8349] ? __pfx_filename_symlinkat+0x10/0x10 [ 174.221819][ T8349] ? strncpy_from_user+0x19d/0x2d0 [ 174.223441][ T8349] ? do_getname+0x191/0x390 [ 174.224860][ T8349] __ia32_sys_symlinkat+0x9b/0xe0 [ 174.226443][ T8349] __do_fast_syscall_32+0x13a/0x8b0 [ 174.228055][ T8349] do_fast_syscall_32+0x32/0x70 [ 174.229598][ T8349] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 174.231557][ T8349] RIP: 0023:0xf746efec [ 174.232832][ T8349] Code: Unable to access opcode bytes at 0xf746efc2. [ 174.234881][ T8349] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000130 [ 174.237462][ T8349] RAX: ffffffffffffffda RBX: 0000000080001980 RCX: 00000000ffffff9c [ 174.239944][ T8349] RDX: 00000000800019c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 174.242392][ T8349] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 174.244822][ T8349] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 174.247260][ T8349] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.249752][ T8349]