last executing test programs: 4.708157163s ago: executing program 3 (id=1956): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x20) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r5, 0x8983, &(0x7f0000000040)={0x0, 'erspan0\x00', {}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) connect$inet6(0xffffffffffffffff, &(0x7f0000000500)={0xa, 0xfffd, 0x0, @loopback, 0x5}, 0x1c) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='freezer.parent_freezing\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000440), 0x1000a) sendfile(0xffffffffffffffff, r7, &(0x7f0000000080)=0x3, 0xffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000100)=ANY=[@ANYBLOB="09002cad9d5eb1a858f60a93d28f421c073eb50c150f752cccf32cef4fde1447b32636a68dc0", @ANYBLOB='\x00\x00\x00\x00\x00'], 0x0, 0x2, 0x0, 0x0, 0x41100, 0xc}, 0x94) r8 = fsopen(&(0x7f0000000280)='nilfs2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) 3.590875334s ago: executing program 3 (id=1964): mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x30) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRES16=r0, @ANYRES8=r0, @ANYRESOCT=r0, @ANYBLOB="2c7eaeaa6f83f16cbc705ce90148ec63f879d3923bd7351eb631605e0825bff9d782a5cece5a435cf96b579afc6372a6518f67e30907667132e9b362e8ae359a6b3788b76c454c1f40f735159421bf995d196da0717230e52dc0b98369cc743ce0ea6014f272c6444d9939b296263a6e962122ee94c57a5a2cf01b02cd4e4b2bdba3c75bbfaedc2b2d710d03848dc7cbf26d25fffede8955147e1605089f397e9a570ec62ff90ee154287fca5aac1b94388082b0638b38d6646a38", @ANYRESDEC=0x0]) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) (async) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000980)='./file2\x00', 0x105000, 0xb2) getdents64(r1, 0x0, 0x0) (async) r2 = socket(0x10, 0x3, 0x0) (async) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffcffffff, 0x20031, 0xffffffffffffffff, 0xbe9f5000) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)) (async) sendmsg$nl_generic(r2, &(0x7f0000000900)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000008c0)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="fc010000150000022cbd7000fcdbdf251300000058001f80016f2d50de29c8329a1e2e53a74c849503b454b8b69e33845ac0d0b9cdeb3e6c3d548db56098c155176f77938c523fc37c523ffa304da0436cf27264040019800c00090000010000000000000800f500ffffffff7a0155800400df800800f20002000000d35e4b1cd5243477c1994f3e194631b252e08ced7e2834d80c4d44f54da728af3117d7aca9d672642cdcb3c6f15afad7ba65aee65d509d76e330f59b20ce48456c0096d3aeada7dd9ead5813d23124705a8c2726e9f8aa65bab7372d97dccf1945f82c2360c0a885cbce08609aadc7559214c941c6a6c8cb070fa37bbc16ac95572e340282a95e17f656fa9dfd6d8e6796350569b50cf8f800013fce07ec6e2540d9d63828809eda28c12a9358d87fc18e7243566bfa107bd971f621e91b05ae58286a2708ca53a316b28975ec8406ac488f3797b489f7e250f072ea2c9da10e7204f568df1049563fbe6b9416a54c2006334aa1c84eda9b0d324917c0c104007b8067002a004860579ca16ddfca57bfef29acba14cbf810f936a03963b0375f7e639877b2b564e9ae73fdf5a86fdce91c8f8b5c6484de4edb99861e893cefc275f4670c6e24e69835398499b018409969a110a457bc8e99f0b2f60001af72a2b221d720ca135aa96600000014004f0000000000000000000000ffff7f000001"], 0x1fc}, 0x1, 0x0, 0x0, 0xc1}, 0x20000000) (async) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) (async) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x18100}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xe4776000) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000480)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './bus\x00'}) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ipvlan1\x00', 0x0}) (async) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000100)={0x50, 0x0, 0x0, {0x7, 0x2d, 0x4, 0x8}}, 0x50) (async) statx(r1, &(0x7f0000000100)='./bus\x00', 0x400, 0x7ff, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000680)={{0x1, 0x1, 0x18, r2, {0x0, r6}}, './file0\x00'}) (async) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r7, &(0x7f0000000040)="09000000010000", 0x7) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@newqdisc={0xe4, 0x24, 0xf0b, 0x70bc26, 0x0, {0x0, 0x0, 0x0, r5, {0x6, 0xffab}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0xac, 0x2, {{0x5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x0, 0x3dc, 0x0, 0x7], [0x0, 0xc, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1000]}, [@TCA_MQPRIO_MODE={0x6, 0x1, 0x1}, @TCA_MQPRIO_SHAPER={0x6, 0x2, 0x1}, @TCA_MQPRIO_MAX_RATE64={0x34, 0x4, 0x0, 0x1, [{0xc, 0x4, 0xdabd}, {0xc, 0x4, 0x2ad4}, {0xc, 0x4, 0xbd4}, {0xc, 0x4, 0x4b99}]}, @TCA_MQPRIO_MODE={0x6}, @TCA_MQPRIO_MODE={0x6, 0x1, 0x1}]}}}, @TCA_RATE={0x6, 0x5, {0xfa, 0x3}}]}, 0xe4}, 0x1, 0x0, 0x0, 0x2004c084}, 0x20000080) mount$bind(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240), 0x10800, 0x0) (async) mount$tmpfs(0x0, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0), 0x1000000, &(0x7f0000000000)=ANY=[@ANYBLOB="6d706f6c3d7072656665723a30302c0037dee519afbc84d6cd05a87055c81362d1cc3b7a657a04da5548b2f086d25d2d4e3c25614b5a1818c6a0a23fcb8fe41dfdef4c0d58c2ef76866785cb87f98f1ec16dbb83d47a513b6a6b6e772c6a3cfbf1ff6bd40ccae5df"]) 3.565922999s ago: executing program 0 (id=1966): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) socket$inet_udp(0x2, 0x2, 0x0) r1 = getpgid(0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$peekuser(0x3, r2, 0x110) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) prlimit64(0x0, 0xc, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(0xffffffffffffffff, 0xc1004110, &(0x7f0000000000)={0x8, [0x6, 0x7fffffff, 0xfffffffb], [{0x0, 0xffffffff, 0x0, 0x1}, {0xb, 0x35}, {0xfff, 0x100000c}, {0xffffffff}, {0x0, 0x3}, {0x3, 0x200}, {0x0, 0xfffffffd}, {0xfffffff8, 0x2010000}, {0x3, 0x82}, {0x1010000, 0x6}, {0xec41, 0xffffffff}, {0x3, 0x8}], 0x4}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000140)="344d3fb9f81f3aa882747fa27af9a34b64539f522899f90df3d8882dd4e048b8652b0e44c864fed0b76e325f5e37", 0x2e}], 0x1) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc00c64b5, &(0x7f00000003c0)={&(0x7f0000000380)}) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r6, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000540)=0x2, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) sendmmsg$inet(r0, &(0x7f0000006740)=[{{0x0, 0x0, &(0x7f0000002740)=[{0x0}, {&(0x7f0000000100)}, {0x0}, {&(0x7f0000000080)="09ebb34c6e6b9bcb890e8fc488c52697590da70578e206547182de9cd141c0012e4926791de3eea4aa103ad545198bf93c390bbdb6f1faf1c0924adb7ebc658f62f9f47ed5f8d851dea2d62af8d6aa9af055c1975558eef4", 0x58}, {&(0x7f0000001580)="5cf0b67aa16bf1dcc2f1ae5aa14e42cb6db77c270b99b1c640ab27453b4a089d9ad367f0f0dd7ab38ddbaeb047ef74d0a1f9aa080b894ea2f067824e2331f63e32eca6dd1196239a33e3ff58a8c40a9c120cca1666ab88492ec25f2ee144dc6b0d2e21651eea22bd79d45e406676df1e1ae9f937ff483c77a3c16a52c736c022b2829500081c0d6159780f114f713eb8364ba6d5b6c9f64f43326bc2219741e92de26f4342bcc6d691ff5f36c990af86750adc5b945e27ee8d6b65cd12841c9b110bad0f2c9a2d2e73410f0cb58d43c433459b820ed4314723626946aa6697e045c1edce001ffe549ae2a44b4377da7d4f3d2857e45c3f25ea44797577256b587f7420a30745a6e373c058200d42edc02b42d028e4cab8d6fe09d677ccd453784f3deb8724be00842dc857e2efe2a752a32b3dcd252d6ccb6ede45cfab2830c0b5947a4b9c9f68705d9e669d8f1e6d60a32812825252a46beadd87ecc1344c9924cffb26c2effcf25244b1f7b717b0e4b3f30b8c136b2385aeb52364d199e97c455117c390d3d3f0524bb4159b15a1803be4d289ee4524a36d70a47f56b1dcb865c40452f9851860601d929a4237c3ff9522ce238fb12761a11b0eeffa5156d5f8f8e8782dd61e291cd691dfebf673c04622ab3d0f41386eaa02f05a9d4f0b83c796ba1a3115ce0132030cd11f4cc797a20e5388ca45936c27282f7c28ae8312654c9f34b28f1c59894449dcc1c993929cff02280f7688100ac4ccba6e534cd44e6cefa6cf2c64fa66f8e3d59b0b851fbbdbbe81d57c44a5eee6a7d96ca176ad33240a703cff52de4fd70ea2d4330f4efc17c55aa688ed5daa1646e50ffc07c95059a2b3ee442f665c9838293b0400b951a1f706bf73b63d9d7a8aed42c0b54bb81be4fc698e1eb0605d656a5446698b76ef5a224cde75c457d49ad7479153d36ce1c2e32011e058866cc94d44604eefc42fdb6bfd82cf4722bf4c73df1ea2d02eb787ec0eb26ea13532a77465da7070bff12fe8c1694ec2eb87285915ab182543db23b45a1ca291e7b9133fccdc0742ce6e6b71e3286412339dc52d696136f47912519545911c246c875ff80dd734f81c41a73493da7da9c4ee125c60dd65a49d490e2fc33ca5fc511ad18148b1177f19eaeffe7a0174875dd03e8e3b32ebcae0a8aabea0d4d1de879332ea50471fc6eb5b7cefcc7b243c22c84d85c73f8c8fc31cbbcd9f4c6b601e02375428fdbd320c2182877da71a2d70330f05fd8e7c50f73c291bc4bff8e306f55c79cfea125876f6e9092ad5598d8fa62d119385061f1ff13bf7c2b44fd363be7229f6b4f2f6fb7f641535c47cca350e598b8290fa73bfc0559e5bfa74228bd4b7048b8f0356c43a439b5731381d575997780e4f57b5c2d6b5bfbb955aa10e9f9cc46eb62b530a156511fa7e0c001f24396af1a9946d07d3c065f7fb88c430c63807652c60cb174735e1466df3bd407a765a4a63ad2cf004bad50ab2049a7f56cdfd53d39eabc749871e70fbab4ffe42756ed05335df15d40420134902a68b69a15dda03c98ed9333174043441f807b70f5a98d35984128a902e7ee8d5ae806ca40e4f5ad2288ec645ca43275c7625eabda5a774d10c9efcc852b4e2a181255308ab1082ad382bb5bdff980865e7caadcec81b4697457d816625097cb4a9659d480145a3d40237e54be17faf12fae9a9a48226fd7e43509e325359642bd8626e37958f83494b15b6c615121238129c15c1fac440dabc71a836ac2976e1987abdc3ecbe78dacda51cf9019e3159b276a877e355c18a9835cdf98522dad7467dcbd97dca4098599ce33ebee7c742ab847d39172608fd8f829e344393b50f29f0e7efdc35bad46c1e20ed7c3f5874f021a8afe3a96cf9e186eafee13b138d92091282414ad896034d8146e849785b364450970abe11f743a12ac977062059ad7f67b01d32cdcc75c6babe2309fc929a9d92c805ecb4ff70719df50807e824ae90f66b0557bff4ebf78dfa43532869ff5164e144defc4d8ee1d6745ed369e7ed7afc981f0f3a0c82a1f97032a12eb8d672b2231040d132971ff2b2ea2eeb0f30fc21fdcd80e32f8a64d325b0fa74919c0b727335230cd340883ed28bd50af63e07f98f91e5d69851b25ab260828303713fa7ce5671c598fabee013bbb6ed04bc70e8d16d9748b885179ae22e4a9ea40d55d6565b0dc5b35719f28199b95ce9ce7f3c81c5a62a5ec1c9c63a8c74cbd26682875ffd2b8c709643d4dfa81199f9828fbe6c1e99d5c003f7ebfbf860fb238f1e427c74eadf459ed60ee73de4d13c8cfc7c58fc371fdd0e8bd70b10e4f9de9928f5c1fa81dffabc7a818fc8d50d9611f06b901bd88a5fc6b9f8bc6503b23822f105653b598c9f0abffbae0d8c56cff568f2c2bc47a88b26c2124a78921462efa4895730f369bf1f0d3227ef1b76dd394317c1726a13f9c15d65bcf6128b61351abac6a54151efcd872d25d9929cf5b7ef141e84b8d145fff6453d6a943af1c0ebd6c2aad77c1cadd21880bcdc362c690e88a914f946c8cfe00ac1936ac8e7ee66156bf76a158b09244aee3c937677067b8d6ce6de5711c80ee00893acf16e86e44037450581e6d06aff72630356644d2345741e76065a15b23cd57ed96a4b702b07a1c2df236ef5d1f0711ed23742a05bf7c047b48338e28115cdce04277cc10936937f0434ae60adbf1a9fc6f422ce8017d1f7b5554c19dc67fdce214afdb8b9a04e3987d16ce5b0b8d9f779914441357347af13f08fec8b05e4f786e88d1346fffd81cd3feb2c518c8a5199ebc2e15754a789febfde86dacb5530ebad117acc0b1cad2669836b5e536dc3df3739f22b85bf1d64353ce65b81707902fc9b471bd159fc80065f26d56aa310d47c276bbd83f5d2e5e4ffbe0e424b21eb940d9e1b3198eae52cdde8c193f4f07e7af9e40f64e2ebdb9aa0f0dc49fae9b024128379eec28ff2b2989907e16bdd9ea22f767f73d21c1c9ed2992b1c5ff5e606c7a3f5f29ce6e30e0118f5c6f88c6bdd27bc58fc74390a97a98590b31fbcbd76449777b253ce0c68da51d402ae862beef5fbfd8afb3aaa62f57826e74c8f6b985aa456e015fd8325eb8fedbc0f0e681bcd8d7626bee70e48d563d1acb03af39d206384b1e8328e588e66fb7243c8c9c2748a8f9efb34a0ab4e76035d9c6e4a7784ead7194f2868f97c580769942b3e81bf02e55c27f43885303d641ab9717618592bf790c119a9033ffce20a8ffcd0d1f1043add8da1a40b2d223920e33625366ccbf515b4e83ba5030df036316798c8cd50b5dca303fddfed3b4d7e89077be0af139ed509243dca68271d02238c85a6dc019897727b6137b18fdf444cff1790631b4c411daa9939b4a4b1abd93b2b1370d62c9e07962cacdde123b75a625553cc8dd2c4f4df4f96a1cdd07fefb232347dbf24e39831251d30e931dc965b789975d93c35d001bb90335f77984b4fe6cfe67eeacbfe8b03dd3b9eccc33ae979b38bf89417e89e0b7c3da65443cb8371353e7b5a44f99db5c73a0f7bc84147ef45847dc0231e00684f0bfb361efc62636c460501a910047db41258c00538b6763b3a79a23395afc6a46be1f53d123202bb598f9e3f40d50939f0cb01c70215e55de53703375e5be090387eaec3717d22e718c31f9d9eb2a81a2bddd846671d14aa42995cd18aca6c804b4b8eba42693eb4d2db995ef26e5a7ab1c4a98d7c268821edf7d2f193f381c15e87fa8355207c3efb209e4214038e99f7c3e7fdcdc4d038b18b08c488edc20a949f7417a7d8dd4e37dbf1b4afcf79ef867d17ca68a0d744b8f6aee7738be4beb737ca9dba34fda810f44c0f51ec9f8e295e7cd78e3256ae73db7186b1e29a04f63065c44fa6c7a16fe4f50851f336b402ce5a73ff88f9b5cdb52ead12060590180f112a4f6c36e5418207bc5dc8635ec831e383ae67fbbe119de517a6932a69440015d014a1d143c8b09f611aa4f79b083c8ea67806cf221ede408771cf2d979feb3e448fcbd859e875d6ff6cff062e073bdb4b32bcf5", 0xb35}], 0x5}}, {{0x0, 0x0, 0x0}}], 0x3fffffffffffe97, 0x2404c845) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x8410) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes256\x00'}, 0x58) r7 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$bt_hci(r7, &(0x7f0000000000)={0x27}, 0x74) 3.560749707s ago: executing program 3 (id=1968): syz_usb_connect$uac1(0x2, 0x9e, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201010200000020050b431740000102030109028c00030109403f0904000000010100000a2401d2000a00020102090401000001020000090401010101020000072401080505000f2402020002ff0f00f441a4440fb209050109ff037808ba072501080403000904020000010200000904020101010200000f240202000007000223c586c54c01072501000e0300e7eb"], 0x0) r0 = syz_usb_connect$uac1(0x3, 0xa9, &(0x7f0000000480)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x0, 0x41e, 0x30df, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x97, 0x3, 0x1, 0x1, 0x90, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x0, 0x18}, [@processing_unit={0x9, 0x24, 0x7, 0x1, 0x6, 0xf, 'Bq'}, @mixer_unit={0x5, 0x24, 0x4, 0x4, 0xc0}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x2, 0x4, 0x5}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x80, 0x3, 0x7, 0x6, "156b"}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x9, 0x7, 0x7d, {0x7, 0x25, 0x1, 0x0, 0xf7, 0x63}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x8, 0xff, 0x4}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x7, 0x1, 0xf, 0x1, "c2c9"}, @as_header={0x7, 0x24, 0x1, 0xd, 0x6, 0x1}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x7, 0xda, 0x0, {0x7, 0x25, 0x1, 0x4, 0x2, 0x4}}}}}}}}]}}, &(0x7f00000009c0)={0xa, &(0x7f0000000580)={0xa, 0x6, 0x51, 0xcc, 0x5, 0x7, 0xff, 0x5}, 0x10, &(0x7f00000005c0)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0x8, 0x40, 0x3, 0x0, 0x8}]}, 0xa, [{0x11, &(0x7f0000000600)=@string={0x11, 0x3, "812d9fa1649c004aa3eb4fe184dcb7"}}, {0x72, &(0x7f00000006c0)=@string={0x72, 0x3, "af1901d742ed691c92bfc6922d0ee582ab09385dcacc5282b923d46d1d9b2275e2c0eeeb03d1a8d3a0959491929c76c73ccca380a5800651884ca5b269689c2b5222e6472f27c0190265f8d2183eba4ffb4edc3fe642cadb74de0b5c36b6532333e76f08353d3f8c591ef04edacfc535"}}, {0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0xc09}}, {0x4, &(0x7f0000000780)=@lang_id={0x4, 0x3, 0xfcff}}, {0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x80a}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x812}}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x2009}}, {0x4, &(0x7f0000000880)=@lang_id={0x4, 0x3, 0xe1f}}, {0xb1, &(0x7f00000008c0)=ANY=[@ANYBLOB="b1032b92d3dea0ac6207406a5a70cd14ecf38a543c5740ebbc3a6acafb8dc2d17f0d2cca214622a68635c2277cd24798934199d4d65c137e567125408d6d0f4226d80a7fa6905dac2c6b8a8522ff4cb6e70c6c599eb96dad20ab7c7177ca29f3df5bd781d80bb851ee7c376158c7c0568706645fdfa391f47e37e363eb6bc8132a524bf0a2086ac51ae18cd8b6b4f69aa9c5e6784d50db0398644ce713c5a44ffb5e6a04b7a7a5e6e304af000000000000"]}, {0x4, &(0x7f0000000980)=@string={0x4, 0x3, '^['}}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_ep_write(r0, 0x76, 0xc0, &(0x7f0000000a40)="d24ec5fe5d2a08da54625d9ff740fae4144307e749600694d437ddc5caba65560c78b2fb01dfa427bf30ef1dc6dbba0761db4271aa28fd0ab306c1dcaf56399763de3b370d2ebce44edae1b2bbbcf16e3f9bf64114ba265b7d5948ef530e2ee5b3476e4f3980cfa204b6db50740a858147f6b1c7e05e188922002aceddb9a41392a8e5ae73ab4042145db31bdedd762c023059484c3195b84cd921ed2f74d0c7f80ea20cfb0fe3673965c29981e8d46f3c2be3aa6470546acfe2c08622c7ae37") ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000180)={0x1}) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3600) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000080)={{0x1002, 0x2, 0xfffd, 0xb}, 'syz1\x00', 0x2d}) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000000)={0x35, {0x1001006, 0xd, 0x2840800, 0x8, 0x14b, 0x4}}) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x3) ioctl$UI_DEV_CREATE(r3, 0x5501) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000240)={[{0x2, 0x5, 0x9b, 0x1, 0x0, 0x5f, 0x9, 0x20, 0xa7, 0x2, 0x5, 0x9, 0x3}, {0x0, 0xfffc, 0x0, 0x0, 0x0, 0x2, 0xce, 0x0, 0x4, 0xff, 0x0, 0x0, 0x800000000000000}, {0xffffff01, 0x35, 0x20, 0x0, 0x4, 0x1, 0x7, 0xfe, 0x7, 0x8, 0x7e, 0x1, 0x1000000000000004}], 0x7}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x0, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x5, 0x7fff, 0x1000200004, 0x3, 0x2, 0x0, 0x1], 0x8080000}) mprotect(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x6) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_usb_control_io(r0, &(0x7f0000000dc0)={0x18, &(0x7f0000000b00)={0x40, 0x24, 0xa1, {0xa1, 0x6, "41c9bd806ba710c52cd356331c94aaa1e5fdb49d7da3f5dbd6013473724610ed33040267bd1605133ecca4b6fd84434d9134bb96dbe098a2ea12097b18b4207cf2c6b562d996d36117960c0c0a9ac5dabaafbfb2194b88b1eb2a8dfe125911a7a72243896ce3055e0966f153a782395e756232985f65bd9cc9ef2906b3d62b7edca1f1e19f4f76b53784da3c7e648d7857d7b0e0306a0d6a48b1bcf88245bf"}}, &(0x7f0000000bc0)={0x0, 0x3, 0xef, @string={0xef, 0x3, "00c9d0c9a6f35454e531b3b1a289b81bce856f42d857f2ad5ea3510af2fb7f60657d2ced9f04e84cde2e5600a6822aabb1d2c5768164df8121d908ab115b1403105417b753c4fe8b731416c0535f7933c65da678535afd9627350b8d0119fa87f1b847d3e63a05b38b94ef861ff379c441606801b0ece93a74f24ab8d74f6763ed30c36d342c6cc04c34961efff75fc89bbd9770eed8c01b5234efd1354f8a57fa706ce403d290e9760f10c68c95b246e1c583754311fb42efb1aa064e55a46887c3b0f024444e3a5c55f5b59c8e01327718e514ea7573381f1b60b20ece35805e5dc2e8a5a3448c6453ce6b79"}}, &(0x7f0000000cc0)={0x0, 0xf, 0x3f, {0x5, 0xf, 0x3f, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x1, 0xf, 0x6, 0x4}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x5, 0x6, 0x2}, @ssp_cap={0x1c, 0x10, 0xa, 0xc, 0x4, 0xc, 0xf00, 0x3, [0xf, 0x0, 0xff, 0xf0]}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0xe, 0xd, 0x6cd5}, @ptm_cap={0x3}]}}, &(0x7f0000000d40)={0x20, 0x29, 0xf, {0xf, 0x29, 0x54, 0x2, 0xff, 0x7, "34d4a3ff", "b9cdd483"}}, &(0x7f0000000d80)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xf, 0x80, 0x1, 0x3, 0x4, 0x8, 0x2}}}, &(0x7f00000012c0)={0x44, &(0x7f0000000e00)={0x20, 0x13, 0xc1, "e18e2c71bc6269f2e6c9651060f6ffadfbaf1f5c4084d0c1322e2390cbbce8b06ec8d863ace01de9f79d5ffe751cdd57179c6e8346f947b3bd51140380b5d07d5eb9044ede501f556d1dd24cfc15a25c8d28c359a4ba903bafec42da6bcc5cc96bee38ffa62245d93cdf6d66dd276b54f6021bebdb1cc5d147f301a4d485a1db692431cc2f69f395591d83bfa789b7a9a8ac43cefe9b4e06e5838e81a70d27a57d51eb640d2a786be582919d5b2bc4dddcc499462905b9858ea04a9ce65f50e8f8"}, &(0x7f0000000f00)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000f40)={0x0, 0x8, 0x1, 0xe2}, &(0x7f0000000f80)={0x20, 0x0, 0x4, {0x2}}, &(0x7f0000000fc0)={0x20, 0x0, 0x8, {0x400, 0x4, [0xf0]}}, &(0x7f0000001000)={0x40, 0x7, 0x2, 0x6}, &(0x7f0000001040)={0x40, 0x9, 0x1, 0x2d}, &(0x7f0000001080)={0x40, 0xb, 0x2, "df6a"}, &(0x7f00000010c0)={0x40, 0xf, 0x2, 0x9}, &(0x7f0000001100)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, &(0x7f0000001140)={0x40, 0x17, 0x6, @local}, &(0x7f0000001180)={0x40, 0x19, 0x2, "1afc"}, &(0x7f00000011c0)={0x40, 0x1a, 0x2, 0x2}, &(0x7f0000001200)={0x40, 0x1c, 0x1, 0x9}, &(0x7f0000001240)={0x40, 0x1e, 0x1, 0x4c}, &(0x7f0000001280)={0x40, 0x21, 0x1, 0xf8}}) ioctl$KVM_GET_PIT(r2, 0xc048ae65, &(0x7f0000000080)) 3.261157112s ago: executing program 2 (id=1972): syz_io_uring_setup(0x3ff1, &(0x7f0000000500)={0x0, 0x78e8, 0x4, 0x0, 0x3de}, 0x0, 0x0, &(0x7f0000000300)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r1, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) recvmsg(r3, &(0x7f00000008c0)={0x0, 0x0, 0x0}, 0x0) fcntl$setsig(r0, 0xa, 0x15) setsockopt(r3, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) io_uring_setup(0x585f, &(0x7f00000001c0)={0x0, 0x2c28, 0x80, 0x0, 0x10000000}) r4 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_IPV6_RTHDR(r4, 0x29, 0x39, &(0x7f0000000080)={0x0, 0x2, 0x2, 0x1, 0x0, [@mcast2]}, 0x18) setsockopt$sock_timeval(r4, 0x1, 0x15, &(0x7f0000000000)={0x0, 0xea60}, 0x10) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) shutdown(0xffffffffffffffff, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x0) r6 = mq_open(&(0x7f0000000380)='&\x00w\xb4N6Bf\xa9\xc2\xd0\b\x06L\xbbQ\xd6T\xe3+SD\xa8\x0f\xefwHw\xdab\xc4\x1a\xe55@hA5\xd6\xec.)\x8f}\xc5#L\x99\"\x84;{\xfa\x04~\xf1\x17\x1d\x90\x83\xfc\x1e\xae\xb0/(\xbb\xd3\xb7\xca\x13j\xab\xfa\xc5Mq\xb7ks\xe0 \x9d\xf8\x7f\x84b\xa4h\xeekc\xffZ\x9fg\x84lm\xd7F\x97\xdcd\v\x00\x00\x90\x03\x12^\xf2{\xf1\xbe\x12[~\xe7\xca\xe4\x13\xd6k\xa6\xf3v5F\xc9.\xce\x87z\xd4<\xa8\xba\xd0\x9c\ff\xe1\xe2\xf9\x18\xc0\xd0\xa1\x02K\xdd0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0xfffa, 0x94, 0xf9, 0x3}]}, 0x8) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000481000/0x1000)=nil) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000480)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$UFFDIO_COPY(r1, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) 2.144630937s ago: executing program 1 (id=1977): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x10, 0x300, 0xa00, 0x280, 0x1000, 0x40, 0x1, 0x0, {0x0, 0x9}, {0x350, 0x20002, 0xfffffffd}, {0xf4ef, 0x6}, {0x4, 0x0, 0x7fe}, 0x1, 0x80, 0x0, 0xd614, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x8}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00"/11], 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f00000001c0), 0x1, &(0x7f0000000400)) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000080), 0x4a) sendmmsg$inet(r1, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) close(r2) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x20, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000f7000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) r4 = openat$vicodec0(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r4, 0xc0185648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90b, 0x9e69, '\x00', @p_u32=&(0x7f0000000440)=0x9}}) r5 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r3, 0x0, 0x2d, 0x0, @val=@perf_event={0xa}}, 0x18) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r5, r3, 0x0, r3}, 0xfffffffffffffefd) process_mrelease(0xffffffffffffffff, 0x0) 2.014755187s ago: executing program 1 (id=1978): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = dup(r1) getsockopt$IPT_SO_GET_REVISION_MATCH(r2, 0x0, 0x42, &(0x7f0000000080)={'HL\x00'}, &(0x7f00000000c0)=0x1e) ioctl$USBDEVFS_BULK(r0, 0xc0185502, 0x0) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1ff) symlink(0x0, 0x0) syz_usb_connect$midi(0x6, 0xa2, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0) r3 = syz_ublk_setup_io_uring(0x1c14, &(0x7f0000000240)={0x0, 0x5437, 0x8, 0x0, 0x2f6}, &(0x7f00000002c0), &(0x7f0000000340), &(0x7f0000000380)) fcntl$dupfd(r3, 0x406, r1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000b00)='\n', 0x1) (fail_nth: 1) 1.701551351s ago: executing program 0 (id=1979): r0 = getuid() setreuid(0x0, r0) shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newtaction={0x88c, 0x30, 0x1, 0x0, 0x0, {0x7a}, [{0x878, 0x1, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0xf, 0x2, 0xff, 0xfffffff4, 0x8, 0x80, 0xc, 0xb, 0x0, 0xfffffffd, 0x7, 0x400, 0x0, 0x2, 0xe5, 0x1, 0x6, 0x1, 0xd4, 0x4, 0x4c, 0x1, 0x3, 0x0, 0x3, 0x7165, 0x4, 0x197f, 0xad, 0x4, 0x5, 0x780a, 0xa, 0xea95, 0x1, 0x4, 0xfffffff7, 0x0, 0x7, 0x3, 0x993, 0x8, 0xffc000, 0x6, 0x2, 0x4, 0x3, 0x9, 0x0, 0xe9e, 0x3aaa50ff, 0xc1, 0x5, 0x8, 0x7fffffff, 0x4, 0x3, 0x0, 0x1, 0x8d6, 0x7, 0x2, 0x10001, 0x401, 0xa6e, 0x8, 0x8, 0x90100000, 0x9, 0x28e, 0x0, 0x0, 0x3, 0x200, 0x7, 0x7, 0xbfb, 0x6, 0x0, 0x16, 0x3, 0x6, 0x6, 0xd0, 0x4, 0x0, 0x6, 0x58, 0x81, 0x400, 0x0, 0x80000000, 0x7fff, 0x4, 0x100, 0x7, 0x7e0, 0x971, 0x7ff, 0x5, 0x0, 0xfffffe01, 0x8, 0x2, 0x6894, 0x100, 0x0, 0x14e2, 0x10000, 0x8, 0x9, 0x9, 0x9, 0x6, 0x2, 0x1, 0x8, 0x7fffffff, 0x0, 0x67d3, 0x0, 0xb, 0x4, 0x3, 0xd3e, 0x1, 0x0, 0xfffffffd, 0x2, 0x9610, 0x4, 0x1, 0x0, 0x7, 0x7fffffff, 0x1bd, 0x80, 0x7, 0xb2, 0x400, 0x200, 0x7, 0x5, 0x6, 0x76, 0xbf, 0x5, 0x8001, 0x280000, 0x8, 0xfffffffe, 0xb, 0x0, 0x1f390edd, 0x3, 0x7ff, 0x8, 0xfffffffc, 0xf1, 0x1, 0x1, 0xcd2, 0x1, 0x2, 0x8, 0x2c, 0x2, 0xa74, 0x400, 0xba3, 0x7, 0xffff, 0x5, 0x8, 0x6, 0x1, 0xa, 0x6, 0x8, 0x2, 0x9, 0x200, 0x3fd06135, 0x4, 0xced, 0x8, 0x8, 0x10000, 0xbe6e, 0x36, 0x97d5, 0x8d, 0x9, 0x2, 0xfffffff6, 0x3, 0x3, 0xba60, 0x8001, 0x1, 0x15b5, 0xedfe, 0x5, 0x80000001, 0x100, 0x0, 0x40, 0x0, 0x2, 0x3, 0x3, 0x4, 0x9, 0x0, 0x8, 0x1, 0x80000000, 0x0, 0x5, 0x7f, 0x2, 0xfff, 0x7, 0xe08, 0xff, 0x6, 0xb, 0x17e, 0x7, 0x53fe3df6, 0xffffffff, 0x6ac, 0x4, 0x0, 0x0, 0xffffffff, 0xfffffff8, 0x7, 0x7, 0x6, 0x4, 0x1f80000, 0x0, 0x63, 0x3ff, 0x452, 0x22, 0x6, 0xa, 0x2, 0x101, 0x5, 0x5e, 0xfb3, 0x3, 0x81]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x4, 0x4, 0x33900000, 0x3, 0x6, {0x9, 0x2, 0xe, 0x9, 0x7ff, 0x3}, {0xb1, 0x0, 0x5, 0x6, 0x4, 0x3}, 0x6, 0x9, 0x4}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1ff, 0x7ff, 0x2, 0x400, 0xe, 0x5, 0x1, 0x97, 0x8001, 0x5, 0x3, 0x484fd177, 0xa48f, 0x80000001, 0xfffffff9, 0xe, 0x731ed3b9, 0xffff, 0x2, 0x7fff, 0x0, 0xc, 0x3ff, 0x8001, 0x5ff, 0x400, 0x3a, 0x6, 0x4, 0x394, 0xffffff00, 0x9, 0x400, 0x8, 0x8, 0x5, 0x7, 0x1b54, 0x9, 0xfffffff9, 0x4, 0xc, 0x1, 0xffff, 0x3, 0x1, 0x2000000, 0x6, 0x10001, 0x3, 0xff, 0xfffffffe, 0x10001, 0x6, 0xfffffff8, 0x6, 0x31874ac2, 0x80, 0x6, 0x4, 0x8, 0xb3b7, 0x95c, 0x9, 0xfffffe00, 0x7c87, 0x2, 0x42bb, 0x7ff, 0x7f, 0xfffffff8, 0x82, 0x4, 0x9, 0xe56, 0x0, 0x4, 0x3, 0xdfc, 0xffffffff, 0x7fffffff, 0x7, 0x7fffffff, 0x9, 0x8, 0x1, 0x3, 0x5, 0x5, 0xf, 0x80000000, 0xaa, 0xa, 0x0, 0x4, 0x10001, 0x4, 0x800, 0x9, 0x4b, 0x2a30, 0x1d, 0x80, 0xb57, 0x3, 0xb, 0x7fffffff, 0x1, 0x76d, 0x0, 0xd, 0x46f, 0x49600000, 0xd, 0xffffffff, 0xe, 0x1, 0x8, 0xfff, 0xa, 0x5d7, 0xd81, 0x8, 0x9, 0xff, 0x9, 0xffffff0a, 0x4, 0xf, 0x3bea, 0x696, 0x5, 0x0, 0x6, 0x2, 0x744, 0x3, 0x8, 0x3, 0xfffffffe, 0x0, 0x8, 0xffffd1ba, 0x6, 0xf, 0x1ff, 0x3, 0x8000, 0x0, 0x5, 0x7, 0x3, 0x1, 0x0, 0xbecf, 0x4, 0xa54, 0x1000, 0x8, 0x7780, 0xfffffff8, 0xb29e, 0x7, 0x3, 0xfff, 0x6, 0x7f, 0x6, 0x200, 0x9f, 0x8, 0x40, 0x22, 0x4, 0x7fff, 0x2, 0xcb, 0x4, 0x0, 0x8, 0x1, 0x3, 0x5, 0x54b, 0x8, 0x665, 0x0, 0x9, 0x7ff, 0x4, 0x5, 0x8, 0x8, 0xa, 0xf, 0x3, 0xf, 0x7f, 0x8000, 0x1, 0xc, 0xeda, 0x8, 0x3, 0x4, 0x4781, 0x8, 0xd, 0x80, 0x77, 0x5, 0x6, 0x7, 0x2, 0x9, 0x1, 0xffffb52a, 0x7, 0x1, 0x8, 0xfffffff7, 0x7ff, 0x1800, 0x101, 0x1, 0x5, 0x1, 0x41, 0x1, 0xfffffffc, 0x9, 0x7055, 0x7, 0x10, 0x7, 0x8001, 0x5, 0x0, 0x1, 0x9, 0x1ff, 0x4, 0x5, 0x3ba8, 0x4f8, 0x6, 0x1, 0x7fff, 0x10, 0xe, 0x4, 0xc, 0x38eda7d4, 0x9, 0xfffffff7, 0x10000]}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x20}}}}]}]}, 0x88c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) mount$nfs(&(0x7f0000000000)='\x00', &(0x7f00000002c0)='./sys/bus/platform/drivers/usb_phy_generic/bind\x00', &(0x7f0000000300), 0x1140000, &(0x7f0000000500)=ANY=[@ANYBLOB="7379ae8db9a78a154b44ea27736673022c7379736673002c282c736773dc6be9636e73000bb1c2e3593a28ef2c0000000000"]) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) syz_emit_ethernet(0x6a, &(0x7f0000000c00)=ANY=[@ANYBLOB="ffffffffffff0180c200000008004503002b000000000400000000000000e0000001248088a80000000000ff000010000800000086dd080088be00000000100000000100000000000000080022eb0000000020000000020000000000000000000000080065580000000078344b6b62973d7cda1a93f90fee52b8b889ae6b677924c6a5663a5284c236f9a5476725ad10e4304e12a93a86a96988c4f44ca2a2626edb83dac86f4c4f11659322f864ef3b022d94a901"], 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000b00)=ANY=[@ANYBLOB="aaaaaaaaaaaa72b4000000f2ab6c233f5908060001080006040002aaaaaaaaaaaaac1414aaaaaaaaaaaa2ac10fc5e87046f28006eb77280566fb262812c09f9a35ed81527b7bbe54400f805c4c58c2484a0a26cb24f0c304e8ab0c7269c8761805ef9f459c047eb8aad11b21ec52d09df6f9f681683e3110315189b96f560004920c5ac54348b956b1e44cdc0f88283f56791162b479d73dc30e0685313e93212e1490797d01ec95d92bb077355097ac9108240785470065c5b0dd61ea3753b70c259b336ad72f60c3676296c911d3f71166"], 0x0) sendto$packet(r2, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @link_local}, 0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000400)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='vfat\x00', 0x8ac020, 0x0) r4 = openat$dir(0xffffff9c, &(0x7f0000000380)='./sys/bus/platform/devices/pcspkr/uevent\x00', 0x1, 0x0) r5 = openat(r4, &(0x7f0000000140)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) write(r5, &(0x7f0000000180)='usb_phy_gene', 0xc) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/platform/drivers/usb_phy_generic/bind\x00', 0x1, 0x0) write(r6, &(0x7f0000000200)='pcspkr\x00', 0x6) openat$ublk_ctrl(0xffffff9c, &(0x7f00000003c0), 0x2, 0x0) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r7, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f0000000280)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r7, 0x7a6, &(0x7f0000000040)={0x20000020064e, 0x6, 0x200000, 0x3, 0x5, 0x9}) close(r6) openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/platform/devices/pcspkr/uevent\x00', 0x1, 0x0) r8 = openat2$dir(0xffffff9c, &(0x7f0000000440)='./sys\x00', &(0x7f0000000480)={0x40181, 0x24, 0x10}, 0x18) mknodat$null(r8, &(0x7f00000004c0)='./sys/bus/platform/drivers/usb_phy_generic/bind\x00', 0x8000, 0x103) 1.62931626s ago: executing program 0 (id=1980): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x24}}, 0x48850) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x44010) socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x8000000004) syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {0x0}], 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={0x0, 0x10}}, 0x0) syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r3, 0xffffffffffffffff, 0x0) openat$ptp1(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0) clock_gettime(0xfffffffffffffffb, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) ioctl$EVIOCGSND(r4, 0x8040451a, &(0x7f0000000000)=""/144) syz_emit_ethernet(0xf7, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaabb00000000000008004e1f00e90066000000069078ac1414350000000044341353ac1414bb000000020a01010000000006ac1414bbfffffffbac1414bb00000005920d340d088f74bc0a01010200000002892ba00a010100ac1414bb0a01010000000003ac1414bbffffffffe000000200000000ac1e0101000000008907b2ffffffff442cf0a36401010200000000e000000200000005ac1414aa80000000ffffffff00007fffe000000200000002890f9eac1414aa00000000ac1414aa0000000000000000000000000000000000000100004e2200004e2100000001000000040000000300000001000000000000000000"], 0x0) 1.129880581s ago: executing program 2 (id=1981): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/ehci-pci/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='0000:00:1d.7', 0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x40, 0x0, &(0x7f0000000100)=[@increfs_done={0x40106308, 0x2}, @acquire_done={0x40106309, 0x1}, @exit_looper, @acquire_done={0x40106309, 0x2}], 0x4e, 0x0, &(0x7f0000000180)="68cb4db74b2748e431368b7422a48e754339328f5985226ac0dbf78e9e4e5ac528a503bad1b9da4d0847b2a02c7ad802004ffd69951f452fa40e9eb5a87a4b2633abf7f1b3cc8e8598b99e5406a0"}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/pci/drivers/ehci-pci/bind\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='0000:00:1d.7', 0xc) 1.010542808s ago: executing program 3 (id=1982): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) socket$inet_udp(0x2, 0x2, 0x0) r1 = getpgid(0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$peekuser(0x3, r2, 0x110) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) prlimit64(0x0, 0xc, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(0xffffffffffffffff, 0xc1004110, &(0x7f0000000000)={0x8, [0x6, 0x7fffffff, 0xfffffffb], [{0x0, 0xffffffff, 0x0, 0x1}, {0xb, 0x35}, {0xfff, 0x100000c}, {0xffffffff}, {0x0, 0x3}, {0x3, 0x200}, {0x0, 0xfffffffd}, {0xfffffff8, 0x2010000}, {0x3, 0x82}, {0x1010000, 0x6}, {0xec41, 0xffffffff}, {0x3, 0x8}], 0x4}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000140)="344d3fb9f81f3aa882747fa27af9a34b64539f522899f90df3d8882dd4e048b8652b0e44c864fed0b76e325f5e37", 0x2e}], 0x1) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc00c64b5, &(0x7f00000003c0)={&(0x7f0000000380)}) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r6, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000540)=0x2, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) sendmmsg$inet(r0, &(0x7f0000006740)=[{{0x0, 0x0, &(0x7f0000002740)=[{0x0}, {&(0x7f0000000100)}, {0x0}, {&(0x7f0000000080)="09ebb34c6e6b9bcb890e8fc488c52697590da70578e206547182de9cd141c0012e4926791de3eea4aa103ad545198bf93c390bbdb6f1faf1c0924adb7ebc658f62f9f47ed5f8d851dea2d62af8d6aa9af055c1975558eef4", 0x58}, {&(0x7f0000001580)="5cf0b67aa16bf1dcc2f1ae5aa14e42cb6db77c270b99b1c640ab27453b4a089d9ad367f0f0dd7ab38ddbaeb047ef74d0a1f9aa080b894ea2f067824e2331f63e32eca6dd1196239a33e3ff58a8c40a9c120cca1666ab88492ec25f2ee144dc6b0d2e21651eea22bd79d45e406676df1e1ae9f937ff483c77a3c16a52c736c022b2829500081c0d6159780f114f713eb8364ba6d5b6c9f64f43326bc2219741e92de26f4342bcc6d691ff5f36c990af86750adc5b945e27ee8d6b65cd12841c9b110bad0f2c9a2d2e73410f0cb58d43c433459b820ed4314723626946aa6697e045c1edce001ffe549ae2a44b4377da7d4f3d2857e45c3f25ea44797577256b587f7420a30745a6e373c058200d42edc02b42d028e4cab8d6fe09d677ccd453784f3deb8724be00842dc857e2efe2a752a32b3dcd252d6ccb6ede45cfab2830c0b5947a4b9c9f68705d9e669d8f1e6d60a32812825252a46beadd87ecc1344c9924cffb26c2effcf25244b1f7b717b0e4b3f30b8c136b2385aeb52364d199e97c455117c390d3d3f0524bb4159b15a1803be4d289ee4524a36d70a47f56b1dcb865c40452f9851860601d929a4237c3ff9522ce238fb12761a11b0eeffa5156d5f8f8e8782dd61e291cd691dfebf673c04622ab3d0f41386eaa02f05a9d4f0b83c796ba1a3115ce0132030cd11f4cc797a20e5388ca45936c27282f7c28ae8312654c9f34b28f1c59894449dcc1c993929cff02280f7688100ac4ccba6e534cd44e6cefa6cf2c64fa66f8e3d59b0b851fbbdbbe81d57c44a5eee6a7d96ca176ad33240a703cff52de4fd70ea2d4330f4efc17c55aa688ed5daa1646e50ffc07c95059a2b3ee442f665c9838293b0400b951a1f706bf73b63d9d7a8aed42c0b54bb81be4fc698e1eb0605d656a5446698b76ef5a224cde75c457d49ad7479153d36ce1c2e32011e058866cc94d44604eefc42fdb6bfd82cf4722bf4c73df1ea2d02eb787ec0eb26ea13532a77465da7070bff12fe8c1694ec2eb87285915ab182543db23b45a1ca291e7b9133fccdc0742ce6e6b71e3286412339dc52d696136f47912519545911c246c875ff80dd734f81c41a73493da7da9c4ee125c60dd65a49d490e2fc33ca5fc511ad18148b1177f19eaeffe7a0174875dd03e8e3b32ebcae0a8aabea0d4d1de879332ea50471fc6eb5b7cefcc7b243c22c84d85c73f8c8fc31cbbcd9f4c6b601e02375428fdbd320c2182877da71a2d70330f05fd8e7c50f73c291bc4bff8e306f55c79cfea125876f6e9092ad5598d8fa62d119385061f1ff13bf7c2b44fd363be7229f6b4f2f6fb7f641535c47cca350e598b8290fa73bfc0559e5bfa74228bd4b7048b8f0356c43a439b5731381d575997780e4f57b5c2d6b5bfbb955aa10e9f9cc46eb62b530a156511fa7e0c001f24396af1a9946d07d3c065f7fb88c430c63807652c60cb174735e1466df3bd407a765a4a63ad2cf004bad50ab2049a7f56cdfd53d39eabc749871e70fbab4ffe42756ed05335df15d40420134902a68b69a15dda03c98ed9333174043441f807b70f5a98d35984128a902e7ee8d5ae806ca40e4f5ad2288ec645ca43275c7625eabda5a774d10c9efcc852b4e2a181255308ab1082ad382bb5bdff980865e7caadcec81b4697457d816625097cb4a9659d480145a3d40237e54be17faf12fae9a9a48226fd7e43509e325359642bd8626e37958f83494b15b6c615121238129c15c1fac440dabc71a836ac2976e1987abdc3ecbe78dacda51cf9019e3159b276a877e355c18a9835cdf98522dad7467dcbd97dca4098599ce33ebee7c742ab847d39172608fd8f829e344393b50f29f0e7efdc35bad46c1e20ed7c3f5874f021a8afe3a96cf9e186eafee13b138d92091282414ad896034d8146e849785b364450970abe11f743a12ac977062059ad7f67b01d32cdcc75c6babe2309fc929a9d92c805ecb4ff70719df50807e824ae90f66b0557bff4ebf78dfa43532869ff5164e144defc4d8ee1d6745ed369e7ed7afc981f0f3a0c82a1f97032a12eb8d672b2231040d132971ff2b2ea2eeb0f30fc21fdcd80e32f8a64d325b0fa74919c0b727335230cd340883ed28bd50af63e07f98f91e5d69851b25ab260828303713fa7ce5671c598fabee013bbb6ed04bc70e8d16d9748b885179ae22e4a9ea40d55d6565b0dc5b35719f28199b95ce9ce7f3c81c5a62a5ec1c9c63a8c74cbd26682875ffd2b8c709643d4dfa81199f9828fbe6c1e99d5c003f7ebfbf860fb238f1e427c74eadf459ed60ee73de4d13c8cfc7c58fc371fdd0e8bd70b10e4f9de9928f5c1fa81dffabc7a818fc8d50d9611f06b901bd88a5fc6b9f8bc6503b23822f105653b598c9f0abffbae0d8c56cff568f2c2bc47a88b26c2124a78921462efa4895730f369bf1f0d3227ef1b76dd394317c1726a13f9c15d65bcf6128b61351abac6a54151efcd872d25d9929cf5b7ef141e84b8d145fff6453d6a943af1c0ebd6c2aad77c1cadd21880bcdc362c690e88a914f946c8cfe00ac1936ac8e7ee66156bf76a158b09244aee3c937677067b8d6ce6de5711c80ee00893acf16e86e44037450581e6d06aff72630356644d2345741e76065a15b23cd57ed96a4b702b07a1c2df236ef5d1f0711ed23742a05bf7c047b48338e28115cdce04277cc10936937f0434ae60adbf1a9fc6f422ce8017d1f7b5554c19dc67fdce214afdb8b9a04e3987d16ce5b0b8d9f779914441357347af13f08fec8b05e4f786e88d1346fffd81cd3feb2c518c8a5199ebc2e15754a789febfde86dacb5530ebad117acc0b1cad2669836b5e536dc3df3739f22b85bf1d64353ce65b81707902fc9b471bd159fc80065f26d56aa310d47c276bbd83f5d2e5e4ffbe0e424b21eb940d9e1b3198eae52cdde8c193f4f07e7af9e40f64e2ebdb9aa0f0dc49fae9b024128379eec28ff2b2989907e16bdd9ea22f767f73d21c1c9ed2992b1c5ff5e606c7a3f5f29ce6e30e0118f5c6f88c6bdd27bc58fc74390a97a98590b31fbcbd76449777b253ce0c68da51d402ae862beef5fbfd8afb3aaa62f57826e74c8f6b985aa456e015fd8325eb8fedbc0f0e681bcd8d7626bee70e48d563d1acb03af39d206384b1e8328e588e66fb7243c8c9c2748a8f9efb34a0ab4e76035d9c6e4a7784ead7194f2868f97c580769942b3e81bf02e55c27f43885303d641ab9717618592bf790c119a9033ffce20a8ffcd0d1f1043add8da1a40b2d223920e33625366ccbf515b4e83ba5030df036316798c8cd50b5dca303fddfed3b4d7e89077be0af139ed509243dca68271d02238c85a6dc019897727b6137b18fdf444cff1790631b4c411daa9939b4a4b1abd93b2b1370d62c9e07962cacdde123b75a625553cc8dd2c4f4df4f96a1cdd07fefb232347dbf24e39831251d30e931dc965b789975d93c35d001bb90335f77984b4fe6cfe67eeacbfe8b03dd3b9eccc33ae979b38bf89417e89e0b7c3da65443cb8371353e7b5a44f99db5c73a0f7bc84147ef45847dc0231e00684f0bfb361efc62636c460501a910047db41258c00538b6763b3a79a23395afc6a46be1f53d123202bb598f9e3f40d50939f0cb01c70215e55de53703375e5be090387eaec3717d22e718c31f9d9eb2a81a2bddd846671d14aa42995cd18aca6c804b4b8eba42693eb4d2db995ef26e5a7ab1c4a98d7c268821edf7d2f193f381c15e87fa8355207c3efb209e4214038e99f7c3e7fdcdc4d038b18b08c488edc20a949f7417a7d8dd4e37dbf1b4afcf79ef867d17ca68a0d744b8f6aee7738be4beb737ca9dba34fda810f44c0f51ec9f8e295e7cd78e3256ae73db7186b1e29a04f63065c44fa6c7a16fe4f50851f336b402ce5a73ff88f9b5cdb52ead12060590180f112a4f6c36e5418207bc5dc8635ec831e383ae67fbbe119de517a6932a69440015d014a1d143c8b09f611aa4f79b083c8ea67806cf221ede408771cf2d979feb3e448fcbd859e875d6ff6cff062e073bdb4b32bcf5", 0xb35}], 0x5}}, {{0x0, 0x0, 0x0}}], 0x3fffffffffffe97, 0x2404c845) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x8410) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes256\x00'}, 0x58) r7 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$bt_hci(r7, &(0x7f0000000000)={0x27}, 0x74) 732.708907ms ago: executing program 1 (id=1983): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f00000003c0)=""/4096) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/platform/vhci_hcd.0/detach\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='0', 0x1) 725.25039ms ago: executing program 0 (id=1984): socket(0x10, 0x3, 0x0) socket$inet(0x2, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000040000004000000005"], 0x48) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r0) socket(0x10, 0x803, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000400)={0x0, 0x0, 0x1000, 0x2, 0x55}, 0x0, 0x0, 0x0) socket(0x10, 0x3, 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) r1 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) socket$phonet_pipe(0x23, 0x5, 0x2) socket$packet(0x11, 0x2, 0x300) r3 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{}, 0x0, &(0x7f0000000200)=r3}, 0x20) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r2], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0)}) 681.106941ms ago: executing program 2 (id=1985): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000001c0)=[@in6={0xa, 0x4e24, 0xf1, @empty, 0x19f49a9}], 0x1c) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f00000000c0)="8907040400", 0x5) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) dup(r0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x1, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYRES32=r4, @ANYBLOB="0000000000000000b708000000001000738af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) fchdir(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x458081, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x88, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2, 0x0, 0xffff}, [@CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}, @CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x2, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_MASTER={0x24, 0xe, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x93}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @rand_addr=0x64010102}}}]}]}, 0x88}}, 0x0) open$dir(&(0x7f0000000000)='./file1\x00', 0x412281, 0x40) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200) write$P9_RCLUNK(r3, &(0x7f00000000c0)={0x7, 0x79, 0x2}, 0x7) mount$tmpfs(0x0, 0x0, &(0x7f0000000140), 0x10008, &(0x7f0000000040)=ANY=[@ANYBLOB="6d706f6c3d7072656665720e"]) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) close(r8) socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 645.651313ms ago: executing program 1 (id=1986): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x10, 0x300, 0xa00, 0x280, 0x1000, 0x40, 0x1, 0x0, {0x0, 0x9}, {0x350, 0x20002, 0xfffffffd}, {0xf4ef, 0x6}, {0x4, 0x0, 0x7fe}, 0x1, 0x80, 0x0, 0xd614, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x8}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00"/11], 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f00000001c0), 0x1, &(0x7f0000000400)) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000080), 0x4a) sendmmsg$inet(r1, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) close(r2) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x20, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000f7000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) r4 = openat$vicodec0(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r4, 0xc0185648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90b, 0x9e69, '\x00', @p_u32=&(0x7f0000000440)=0x9}}) r5 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r3, 0x0, 0x2d, 0x0, @val=@perf_event={0xa}}, 0x18) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r5, r3, 0x0, r3}, 0xfffffffffffffefd) process_mrelease(0xffffffffffffffff, 0x0) 611.109181ms ago: executing program 0 (id=1987): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB="9feb0100180000000000000024000000240000000200000000000000000000100200000000000000010000050000000000000000010000"], 0x0, 0x3e}, 0x20) r2 = syz_io_uring_setup(0x4b5, &(0x7f0000010400)={0x0, 0x86dd, 0x80, 0x8, 0xe8}, &(0x7f0000010080), &(0x7f0000000100), &(0x7f0000000000)=0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r2, 0x24, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0}, 0x20) r4 = syz_usbip_server_init(0x1) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = dup(r5) write$UHID_INPUT(r6, &(0x7f00000009c0)={0xf, {"a2e3ad214fc752f90b5e09094bf70e0dd038e7ff7fc6e5539b1b48078b089b3b0838721a0890e0878f0e1ac6e7049b3d6c959b4c9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31320d07420736cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e2c5070000179c6f30e065cd5b91cd0ae17d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3bb469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918070000003f0000000c558cdc0a3621c56cea8d20fa911afe40db6ebe8cac64289fd3da232f1b5dbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860421c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000e0a37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2f09000000000000007747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847354b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d27c9a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d483d4675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516ab68032f88c042ffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d95f2e8c77d95a3d3a6df40babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f06f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9d1a3d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f39a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdfa1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60559516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442748af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d8224fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d784cfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500", 0xb29}}, 0x1006) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r7, 0x0) r8 = openat$hpet(0xffffff9c, &(0x7f0000000140), 0xc0000, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000006c0)={'gre0\x00', &(0x7f0000000640)={'gre0\x00', 0x0, 0x7800, 0x80, 0x1, 0x517f, {{0xb, 0x4, 0x0, 0x8, 0x2c, 0x66, 0x0, 0x3, 0x4, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x3d}, {[@ssrr={0x89, 0x7, 0x4d, [@loopback]}, @lsrr={0x83, 0xf, 0x66, [@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @dev={0xac, 0x14, 0x14, 0x1b}]}]}}}}}) r10 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) connect$unix(r10, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000007c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000740), &(0x7f0000000780)}, 0x1c) r12 = openat(0xffffffffffffffff, &(0x7f0000000800)='./file0\x00', 0x0, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000008c0)={{0x1}, &(0x7f0000000840), &(0x7f0000000880)='%pI4 \x00'}, 0x1c) r13 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_elf32(r13, &(0x7f00000008c0)=ANY=[@ANYBLOB="7f454c4604070003070000000000000002000300030000000903000038000000fcffffff0e000000000020000100050000000000001400000300000004000000040020000c0000000004"], 0x58) close(r13) r14 = dup3(r1, r2, 0x0) r15 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1e0000000000000000a000007745000080600000", @ANYRES32, @ANYBLOB="0900000000000000000000000000000000000010", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="01000000000000000300"/28], 0x50) r16 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000009c0)=@o_path={&(0x7f0000000980)='./file0\x00', 0x0, 0x4010, r0}, 0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a80)={0x11, 0x9, &(0x7f0000000180)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r16}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r8}}], &(0x7f00000005c0)='syzkaller\x00', 0x1ff, 0xf0, &(0x7f0000000480)=""/240, 0x40f00, 0xc, '\x00', r9, 0x0, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000700)={0x2, 0x8, 0x3, 0x4}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000a00)=[r11, 0x1, r12, r15, r13, r14, r15, r16], &(0x7f00000002c0)=[{0x5, 0x2, 0xd, 0xa}, {0x1, 0x2, 0xe}], 0x10, 0x80000001}, 0x94) write$usbip_server(r4, &(0x7f00000000c0)=ANY=[@ANYBLOB="00000003"], 0x35) r17 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) r18 = socket(0x6, 0xa, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r18, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=ANY=[@ANYRESHEX=r3, @ANYRES16=r17, @ANYRES8=r0, @ANYRESHEX=r17, @ANYBLOB="04003400080026006c090000"], 0x28}}, 0x0) 586.563102ms ago: executing program 2 (id=1988): r0 = getuid() setreuid(0x0, r0) shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newtaction={0x88c, 0x30, 0x1, 0x0, 0x0, {0x7a}, [{0x878, 0x1, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0xf, 0x2, 0xff, 0xfffffff4, 0x8, 0x80, 0xc, 0xb, 0x0, 0xfffffffd, 0x7, 0x400, 0x0, 0x2, 0xe5, 0x1, 0x6, 0x1, 0xd4, 0x4, 0x4c, 0x1, 0x3, 0x0, 0x3, 0x7165, 0x4, 0x197f, 0xad, 0x4, 0x5, 0x780a, 0xa, 0xea95, 0x1, 0x4, 0xfffffff7, 0x0, 0x7, 0x3, 0x993, 0x8, 0xffc000, 0x6, 0x2, 0x4, 0x3, 0x9, 0x0, 0xe9e, 0x3aaa50ff, 0xc1, 0x5, 0x8, 0x7fffffff, 0x4, 0x3, 0x0, 0x1, 0x8d6, 0x7, 0x2, 0x10001, 0x401, 0xa6e, 0x8, 0x8, 0x90100000, 0x9, 0x28e, 0x0, 0x0, 0x3, 0x200, 0x7, 0x7, 0xbfb, 0x6, 0x0, 0x16, 0x3, 0x6, 0x6, 0xd0, 0x4, 0x0, 0x6, 0x58, 0x81, 0x400, 0x0, 0x80000000, 0x7fff, 0x4, 0x100, 0x7, 0x7e0, 0x971, 0x7ff, 0x5, 0x0, 0xfffffe01, 0x8, 0x2, 0x6894, 0x100, 0x0, 0x14e2, 0x10000, 0x8, 0x9, 0x9, 0x9, 0x6, 0x2, 0x1, 0x8, 0x7fffffff, 0x0, 0x67d3, 0x0, 0xb, 0x4, 0x3, 0xd3e, 0x1, 0x0, 0xfffffffd, 0x2, 0x9610, 0x4, 0x1, 0x0, 0x7, 0x7fffffff, 0x1bd, 0x80, 0x7, 0xb2, 0x400, 0x200, 0x7, 0x5, 0x6, 0x76, 0xbf, 0x5, 0x8001, 0x280000, 0x8, 0xfffffffe, 0xb, 0x0, 0x1f390edd, 0x3, 0x7ff, 0x8, 0xfffffffc, 0xf1, 0x1, 0x1, 0xcd2, 0x1, 0x2, 0x8, 0x2c, 0x2, 0xa74, 0x400, 0xba3, 0x7, 0xffff, 0x5, 0x8, 0x6, 0x1, 0xa, 0x6, 0x8, 0x2, 0x9, 0x200, 0x3fd06135, 0x4, 0xced, 0x8, 0x8, 0x10000, 0xbe6e, 0x36, 0x97d5, 0x8d, 0x9, 0x2, 0xfffffff6, 0x3, 0x3, 0xba60, 0x8001, 0x1, 0x15b5, 0xedfe, 0x5, 0x80000001, 0x100, 0x0, 0x40, 0x0, 0x2, 0x3, 0x3, 0x4, 0x9, 0x0, 0x8, 0x1, 0x80000000, 0x0, 0x5, 0x7f, 0x2, 0xfff, 0x7, 0xe08, 0xff, 0x6, 0xb, 0x17e, 0x7, 0x53fe3df6, 0xffffffff, 0x6ac, 0x4, 0x0, 0x0, 0xffffffff, 0xfffffff8, 0x7, 0x7, 0x6, 0x4, 0x1f80000, 0x0, 0x63, 0x3ff, 0x452, 0x22, 0x6, 0xa, 0x2, 0x101, 0x5, 0x5e, 0xfb3, 0x3, 0x81]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x4, 0x4, 0x33900000, 0x3, 0x6, {0x9, 0x2, 0xe, 0x9, 0x7ff, 0x3}, {0xb1, 0x0, 0x5, 0x6, 0x4, 0x3}, 0x6, 0x9, 0x4}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1ff, 0x7ff, 0x2, 0x400, 0xe, 0x5, 0x1, 0x97, 0x8001, 0x5, 0x3, 0x484fd177, 0xa48f, 0x80000001, 0xfffffff9, 0xe, 0x731ed3b9, 0xffff, 0x2, 0x7fff, 0x0, 0xc, 0x3ff, 0x8001, 0x5ff, 0x400, 0x3a, 0x6, 0x4, 0x394, 0xffffff00, 0x9, 0x400, 0x8, 0x8, 0x5, 0x7, 0x1b54, 0x9, 0xfffffff9, 0x4, 0xc, 0x1, 0xffff, 0x3, 0x1, 0x2000000, 0x6, 0x10001, 0x3, 0xff, 0xfffffffe, 0x10001, 0x6, 0xfffffff8, 0x6, 0x31874ac2, 0x80, 0x6, 0x4, 0x8, 0xb3b7, 0x95c, 0x9, 0xfffffe00, 0x7c87, 0x2, 0x42bb, 0x7ff, 0x7f, 0xfffffff8, 0x82, 0x4, 0x9, 0xe56, 0x0, 0x4, 0x3, 0xdfc, 0xffffffff, 0x7fffffff, 0x7, 0x7fffffff, 0x9, 0x8, 0x1, 0x3, 0x5, 0x5, 0xf, 0x80000000, 0xaa, 0xa, 0x0, 0x4, 0x10001, 0x4, 0x800, 0x9, 0x4b, 0x2a30, 0x1d, 0x80, 0xb57, 0x3, 0xb, 0x7fffffff, 0x1, 0x76d, 0x0, 0xd, 0x46f, 0x49600000, 0xd, 0xffffffff, 0xe, 0x1, 0x8, 0xfff, 0xa, 0x5d7, 0xd81, 0x8, 0x9, 0xff, 0x9, 0xffffff0a, 0x4, 0xf, 0x3bea, 0x696, 0x5, 0x0, 0x6, 0x2, 0x744, 0x3, 0x8, 0x3, 0xfffffffe, 0x0, 0x8, 0xffffd1ba, 0x6, 0xf, 0x1ff, 0x3, 0x8000, 0x0, 0x5, 0x7, 0x3, 0x1, 0x0, 0xbecf, 0x4, 0xa54, 0x1000, 0x8, 0x7780, 0xfffffff8, 0xb29e, 0x7, 0x3, 0xfff, 0x6, 0x7f, 0x6, 0x200, 0x9f, 0x8, 0x40, 0x22, 0x4, 0x7fff, 0x2, 0xcb, 0x4, 0x0, 0x8, 0x1, 0x3, 0x5, 0x54b, 0x8, 0x665, 0x0, 0x9, 0x7ff, 0x4, 0x5, 0x8, 0x8, 0xa, 0xf, 0x3, 0xf, 0x7f, 0x8000, 0x1, 0xc, 0xeda, 0x8, 0x3, 0x4, 0x4781, 0x8, 0xd, 0x80, 0x77, 0x5, 0x6, 0x7, 0x2, 0x9, 0x1, 0xffffb52a, 0x7, 0x1, 0x8, 0xfffffff7, 0x7ff, 0x1800, 0x101, 0x1, 0x5, 0x1, 0x41, 0x1, 0xfffffffc, 0x9, 0x7055, 0x7, 0x10, 0x7, 0x8001, 0x5, 0x0, 0x1, 0x9, 0x1ff, 0x4, 0x5, 0x3ba8, 0x4f8, 0x6, 0x1, 0x7fff, 0x10, 0xe, 0x4, 0xc, 0x38eda7d4, 0x9, 0xfffffff7, 0x10000]}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x20}}}}]}]}, 0x88c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) mount$nfs(&(0x7f0000000000)='\x00', &(0x7f00000002c0)='./sys/bus/platform/drivers/usb_phy_generic/bind\x00', &(0x7f0000000300), 0x1140000, &(0x7f0000000500)=ANY=[@ANYBLOB="7379ae8db9a78a154b44ea27736673022c7379736673002c282c736773dc6be9636e73000bb1c2e3593a28ef2c0000000000"]) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) syz_emit_ethernet(0x6a, &(0x7f0000000c00)=ANY=[@ANYBLOB="ffffffffffff0180c200000008004503002b000000000400000000000000e0000001248088a80000000000ff000010000800000086dd080088be00000000100000000100000000000000080022eb0000000020000000020000000000000000000000080065580000000078344b6b62973d7cda1a93f90fee52b8b889ae6b677924c6a5663a5284c236f9a5476725ad10e4304e12a93a86a96988c4f44ca2a2626edb83dac86f4c4f11659322f864ef3b022d94a901"], 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000b00)=ANY=[@ANYBLOB="aaaaaaaaaaaa72b4000000f2ab6c233f5908060001080006040002aaaaaaaaaaaaac1414aaaaaaaaaaaa2ac10fc5e87046f28006eb77280566fb262812c09f9a35ed81527b7bbe54400f805c4c58c2484a0a26cb24f0c304e8ab0c7269c8761805ef9f459c047eb8aad11b21ec52d09df6f9f681683e3110315189b96f560004920c5ac54348b956b1e44cdc0f88283f56791162b479d73dc30e0685313e93212e1490797d01ec95d92bb077355097ac9108240785470065c5b0dd61ea3753b70c259b336ad72f60c3676296c911d3f71166"], 0x0) sendto$packet(r2, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @link_local}, 0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000400)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='vfat\x00', 0x8ac020, 0x0) r4 = openat$dir(0xffffff9c, &(0x7f0000000380)='./sys/bus/platform/devices/pcspkr/uevent\x00', 0x1, 0x0) r5 = openat(r4, &(0x7f0000000140)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) write(r5, &(0x7f0000000180)='usb_phy_gene', 0xc) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/platform/drivers/usb_phy_generic/bind\x00', 0x1, 0x0) write(r6, &(0x7f0000000200)='pcspkr\x00', 0x6) openat$ublk_ctrl(0xffffff9c, &(0x7f00000003c0), 0x2, 0x0) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r7, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f0000000280)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r7, 0x7a6, &(0x7f0000000040)={0x20000020064e, 0x6, 0x200000, 0x3, 0x5, 0x9}) close(r6) openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/platform/devices/pcspkr/uevent\x00', 0x1, 0x0) r8 = openat2$dir(0xffffff9c, &(0x7f0000000440)='./sys\x00', &(0x7f0000000480)={0x40181, 0x24, 0x10}, 0x18) mknodat$null(r8, &(0x7f00000004c0)='./sys/bus/platform/drivers/usb_phy_generic/bind\x00', 0x8000, 0x103) 554.567521ms ago: executing program 1 (id=1989): setns(0xc9, 0x0) r0 = socket(0x2a, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = socket$xdp(0x2c, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x3b70c0, 0x52) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$SNDCTL_SYNTH_ID(r2, 0xc08c5114, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101401, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0xa, 0x1, 0x106) unshare(0x26020480) r4 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x211000, 0x1000}, 0x20) r5 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r5, &(0x7f0000019440)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80ffe0090f000060000000a2bc5603ca00000f7f89000000200000004a2471083ec6991778581acb6c0101ff0000000309", 0x48}], 0x1) mq_open(&(0x7f0000000100)='&\x00', 0x40, 0x100, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000001c00000000000095000000000000cdcd4250cb514382885805004db83396197809ffb75605b0c10ce1ead808dd07576535e142b11cb6d31a81b38732c3c93618ef8c1a8e2719f38459e08906c6e3bcab49b689b6d5ebac164e9be74f34c9a60d4196c8a411d3d7fb42ad61aa27239aab"], &(0x7f0000000340)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x11, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x92}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.swap.current\x00', 0x275a, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000040)) 523.193088ms ago: executing program 2 (id=1990): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x20) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r5, 0x8983, &(0x7f0000000040)={0x0, 'erspan0\x00', {}, 0x26}) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x87) connect$inet6(r7, &(0x7f0000000500)={0xa, 0xfffd, 0x0, @loopback, 0x5}, 0x1c) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='freezer.parent_freezing\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000440), 0x1000a) sendfile(r7, r8, &(0x7f0000000080)=0x3, 0xffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000100)=ANY=[@ANYBLOB="09002cad9d5eb1a858f60a93d28f421c073eb50c150f752cccf32cef4fde1447b32636a68dc0", @ANYBLOB='\x00\x00\x00\x00\x00'], 0x0, 0x2, 0x0, 0x0, 0x41100, 0xc}, 0x94) r9 = fsopen(&(0x7f0000000280)='nilfs2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) 0s ago: executing program 3 (id=1991): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2501, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) open(&(0x7f0000000040)='./my_configfs/target/core/rd_mcp_0/dev0/control\x00', 0x4a0000, 0x64) mkdir(&(0x7f0000000600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) kernel console output (not intermixed with test programs): interval 1, probability 0, space 0, times 0 [ 281.261549][T11829] CPU: 0 UID: 0 PID: 11829 Comm: syz.2.1518 Tainted: G L syzkaller #0 PREEMPT(full) [ 281.261576][T11829] Tainted: [L]=SOFTLOCKUP [ 281.261583][T11829] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 281.261593][T11829] Call Trace: [ 281.261600][T11829] [ 281.261608][T11829] dump_stack_lvl+0x100/0x190 [ 281.261635][T11829] should_fail_ex.cold+0x5/0xa [ 281.261659][T11829] _copy_from_user+0x2e/0xd0 [ 281.261685][T11829] __sys_bpf+0x2f5/0x4e80 [ 281.261711][T11829] ? __pfx___sys_bpf+0x10/0x10 [ 281.261729][T11829] ? find_held_lock+0x2b/0x80 [ 281.261748][T11829] ? get_pid_task+0xfc/0x250 [ 281.261768][T11829] ? get_pid_task+0xfc/0x250 [ 281.261799][T11829] ? proc_fail_nth_write+0x9f/0x220 [ 281.261825][T11829] ? find_held_lock+0x2b/0x80 [ 281.261867][T11829] ? rcu_read_lock_any_held+0x6a/0xa0 [ 281.261891][T11829] ? find_held_lock+0x2b/0x80 [ 281.261910][T11829] ? ksys_write+0x190/0x250 [ 281.261925][T11829] ? ksys_write+0x190/0x250 [ 281.261961][T11829] ? fput+0x79/0x100 [ 281.261985][T11829] ? __ia32_sys_bpf+0xcc/0x170 [ 281.262002][T11829] __ia32_sys_bpf+0xcc/0x170 [ 281.262020][T11829] ? __do_fast_syscall_32+0x98/0x970 [ 281.262044][T11829] __do_fast_syscall_32+0xe7/0x970 [ 281.262066][T11829] ? lockdep_hardirqs_on+0x78/0x100 [ 281.262091][T11829] do_fast_syscall_32+0x32/0x70 [ 281.262118][T11829] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 281.262139][T11829] RIP: 0023:0xf703efec [ 281.262159][T11829] Code: Unable to access opcode bytes at 0xf703efc2. [ 281.262167][T11829] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 281.262184][T11829] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000b80 [ 281.262194][T11829] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 281.262203][T11829] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 281.262212][T11829] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 281.262222][T11829] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 281.262245][T11829] [ 281.272729][T11832] block nbd0: Unsupported socket: should be TCP or UNIX. [ 281.451811][ T5757] Bluetooth: hci1: command tx timeout [ 281.467616][T11854] FAULT_INJECTION: forcing a failure. [ 281.467616][T11854] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 281.471759][T11854] CPU: 2 UID: 0 PID: 11854 Comm: syz.1.1524 Tainted: G L syzkaller #0 PREEMPT(full) [ 281.471786][T11854] Tainted: [L]=SOFTLOCKUP [ 281.471790][T11854] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 281.471798][T11854] Call Trace: [ 281.471803][T11854] [ 281.471808][T11854] dump_stack_lvl+0x100/0x190 [ 281.471825][T11854] should_fail_ex.cold+0x5/0xa [ 281.471839][T11854] _copy_from_user+0x2e/0xd0 [ 281.471872][T11854] get_compat_msghdr+0xb3/0x480 [ 281.471893][T11854] ? __pfx_get_compat_msghdr+0x10/0x10 [ 281.471916][T11854] ___sys_sendmsg+0x1b6/0x1e0 [ 281.471931][T11854] ? __pfx____sys_sendmsg+0x10/0x10 [ 281.471952][T11854] ? find_held_lock+0x2b/0x80 [ 281.471975][T11854] __sys_sendmsg+0x160/0x210 [ 281.471992][T11854] ? __pfx___sys_sendmsg+0x10/0x10 [ 281.472012][T11854] ? __pfx_ksys_write+0x10/0x10 [ 281.472025][T11854] __do_fast_syscall_32+0xe7/0x970 [ 281.472043][T11854] ? lockdep_hardirqs_on+0x78/0x100 [ 281.472059][T11854] do_fast_syscall_32+0x32/0x70 [ 281.472075][T11854] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 281.472090][T11854] RIP: 0023:0xf7f04fec [ 281.472104][T11854] Code: Unable to access opcode bytes at 0xf7f04fc2. [ 281.472110][T11854] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 281.472122][T11854] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 281.472129][T11854] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 281.472136][T11854] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 281.472143][T11854] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 281.472150][T11854] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 281.472164][T11854] [ 281.583552][ T42] audit: type=1326 audit(1785723746.282:640): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11860 comm="syz.3.1526" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 281.594802][T11861] sctp: [Deprecated]: syz.3.1526 (pid 11861) Use of int in max_burst socket option deprecated. [ 281.594802][T11861] Use struct sctp_assoc_value instead [ 281.597654][ T42] audit: type=1326 audit(1785723746.282:641): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11860 comm="syz.3.1526" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 281.606982][ T42] audit: type=1326 audit(1785723746.282:642): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11860 comm="syz.3.1526" exe="/syz-executor" sig=0 arch=40000003 syscall=278 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 281.614205][ T42] audit: type=1326 audit(1785723746.282:643): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11860 comm="syz.3.1526" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 281.650199][ T42] audit: type=1326 audit(1785723746.282:644): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11860 comm="syz.3.1526" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 281.659364][ T42] audit: type=1326 audit(1785723746.282:645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11860 comm="syz.3.1526" exe="/syz-executor" sig=0 arch=40000003 syscall=321 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 281.667696][ T42] audit: type=1326 audit(1785723746.282:646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11860 comm="syz.3.1526" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 281.674890][ T42] audit: type=1326 audit(1785723746.282:647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11860 comm="syz.3.1526" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 281.682816][ T42] audit: type=1326 audit(1785723746.282:648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11860 comm="syz.3.1526" exe="/syz-executor" sig=0 arch=40000003 syscall=39 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 281.683152][T11871] FAULT_INJECTION: forcing a failure. [ 281.683152][T11871] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 281.690133][ T42] audit: type=1326 audit(1785723746.282:649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11860 comm="syz.3.1526" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 281.694777][T11871] CPU: 2 UID: 0 PID: 11871 Comm: syz.3.1529 Tainted: G L syzkaller #0 PREEMPT(full) [ 281.694796][T11871] Tainted: [L]=SOFTLOCKUP [ 281.694801][T11871] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 281.694808][T11871] Call Trace: [ 281.694812][T11871] [ 281.694817][T11871] dump_stack_lvl+0x100/0x190 [ 281.694834][T11871] should_fail_ex.cold+0x5/0xa [ 281.694848][T11871] _copy_from_user+0x2e/0xd0 [ 281.694867][T11871] __sys_bpf+0x2f5/0x4e80 [ 281.694883][T11871] ? __pfx___sys_bpf+0x10/0x10 [ 281.694896][T11871] ? find_held_lock+0x2b/0x80 [ 281.694910][T11871] ? get_pid_task+0xfc/0x250 [ 281.694924][T11871] ? get_pid_task+0xfc/0x250 [ 281.694942][T11871] ? proc_fail_nth_write+0x9f/0x220 [ 281.694958][T11871] ? find_held_lock+0x2b/0x80 [ 281.694975][T11871] ? rcu_read_lock_any_held+0x6a/0xa0 [ 281.694990][T11871] ? find_held_lock+0x2b/0x80 [ 281.695003][T11871] ? ksys_write+0x190/0x250 [ 281.695013][T11871] ? ksys_write+0x190/0x250 [ 281.695033][T11871] ? fput+0x79/0x100 [ 281.695048][T11871] ? __ia32_sys_bpf+0xcc/0x170 [ 281.695060][T11871] __ia32_sys_bpf+0xcc/0x170 [ 281.695072][T11871] ? __do_fast_syscall_32+0x98/0x970 [ 281.695112][T11871] __do_fast_syscall_32+0xe7/0x970 [ 281.695129][T11871] ? lockdep_hardirqs_on+0x78/0x100 [ 281.695145][T11871] do_fast_syscall_32+0x32/0x70 [ 281.695161][T11871] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 281.695176][T11871] RIP: 0023:0xf7f67fec [ 281.695191][T11871] Code: Unable to access opcode bytes at 0xf7f67fc2. [ 281.695197][T11871] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 281.695208][T11871] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 00000000800002c0 [ 281.695215][T11871] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 281.695222][T11871] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 281.695229][T11871] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 281.695236][T11871] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 281.695249][T11871] [ 281.845358][T11886] FAULT_INJECTION: forcing a failure. [ 281.845358][T11886] name failslab, interval 1, probability 0, space 0, times 0 [ 281.892255][T11886] CPU: 3 UID: 0 PID: 11886 Comm: syz.3.1532 Tainted: G L syzkaller #0 PREEMPT(full) [ 281.892276][T11886] Tainted: [L]=SOFTLOCKUP [ 281.892281][T11886] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 281.892288][T11886] Call Trace: [ 281.892293][T11886] [ 281.892299][T11886] dump_stack_lvl+0x100/0x190 [ 281.892316][T11886] should_fail_ex.cold+0x5/0xa [ 281.892329][T11886] should_failslab+0xc2/0x120 [ 281.892346][T11886] __kvmalloc_node_noprof+0x116/0x970 [ 281.892363][T11886] ? __nf_hook_entries_try_shrink+0x164/0x400 [ 281.892382][T11886] __nf_hook_entries_try_shrink+0x164/0x400 [ 281.892401][T11886] __nf_unregister_net_hook+0x1d2/0x6a0 [ 281.892417][T11886] nf_unregister_net_hooks+0x11b/0x170 [ 281.892433][T11886] nf_ct_netns_do_put+0x168/0x2f0 [ 281.892449][T11886] nf_ct_netns_put+0x39/0x90 [ 281.892462][T11886] __nft_release_table+0x657/0x1330 [ 281.892476][T11886] ? __pfx_nft_masq_ipv6_destroy+0x10/0x10 [ 281.892502][T11886] ? synchronize_rcu_expedited+0x303/0x450 [ 281.892525][T11886] ? __pfx___nft_release_table+0x10/0x10 [ 281.892540][T11886] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 281.892562][T11886] nft_rcv_nl_event+0x4de/0x6c0 [ 281.892580][T11886] ? __pfx_nft_rcv_nl_event+0x10/0x10 [ 281.892596][T11886] ? nfulnl_rcv_nl_event+0x64/0x270 [ 281.892613][T11886] notifier_call_chain+0x99/0x3f0 [ 281.892633][T11886] blocking_notifier_call_chain+0x69/0xa0 [ 281.892650][T11886] netlink_release+0x167a/0x1ff0 [ 281.892670][T11886] ? netlink_release+0x1e0/0x1ff0 [ 281.892690][T11886] ? __pfx_netlink_release+0x10/0x10 [ 281.892711][T11886] ? __pfx_locks_remove_file+0x10/0x10 [ 281.892736][T11886] __sock_release+0xb3/0x260 [ 281.892765][T11886] ? __pfx_sock_close+0x10/0x10 [ 281.892790][T11886] sock_close+0x1c/0x30 [ 281.892816][T11886] __fput+0x3ff/0xb50 [ 281.892836][T11886] fput_close_sync+0x118/0x250 [ 281.892851][T11886] ? __pfx_fput_close_sync+0x10/0x10 [ 281.892870][T11886] __ia32_sys_close+0x8b/0x120 [ 281.892886][T11886] __do_fast_syscall_32+0xe7/0x970 [ 281.892908][T11886] ? lockdep_hardirqs_on+0x78/0x100 [ 281.892925][T11886] do_fast_syscall_32+0x32/0x70 [ 281.892941][T11886] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 281.892956][T11886] RIP: 0023:0xf7f67fec [ 281.892971][T11886] Code: Unable to access opcode bytes at 0xf7f67fc2. [ 281.892976][T11886] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000006 [ 281.892988][T11886] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 281.893008][T11886] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 281.893017][T11886] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 281.893024][T11886] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 281.893031][T11886] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 281.893054][T11886] [ 281.905613][T11318] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 282.029569][T11318] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 282.035249][T11907] netlink: 1053 bytes leftover after parsing attributes in process `syz.3.1537'. [ 282.036388][T11318] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 282.044628][T11318] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 282.047606][T11318] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 282.061260][T11318] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 282.074228][T11318] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 282.082541][T11318] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 282.087781][T11907] syzkaller0: entered promiscuous mode [ 282.089766][T11907] syzkaller0: entered allmulticast mode [ 282.246064][T11940] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1542'. [ 282.290775][T11318] 8021q: adding VLAN 0 to HW filter on device bond0 [ 282.336661][T11318] 8021q: adding VLAN 0 to HW filter on device team0 [ 282.343164][ T8225] bridge0: port 1(bridge_slave_0) entered blocking state [ 282.345641][ T8225] bridge0: port 1(bridge_slave_0) entered forwarding state [ 282.353150][ T8225] bridge0: port 2(bridge_slave_1) entered blocking state [ 282.355762][ T8225] bridge0: port 2(bridge_slave_1) entered forwarding state [ 282.394011][T11950] FAULT_INJECTION: forcing a failure. [ 282.394011][T11950] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 282.399513][T11950] CPU: 3 UID: 0 PID: 11950 Comm: syz.3.1544 Tainted: G L syzkaller #0 PREEMPT(full) [ 282.399533][T11950] Tainted: [L]=SOFTLOCKUP [ 282.399537][T11950] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 282.399545][T11950] Call Trace: [ 282.399550][T11950] [ 282.399555][T11950] dump_stack_lvl+0x100/0x190 [ 282.399572][T11950] should_fail_ex.cold+0x5/0xa [ 282.399586][T11950] _copy_from_user+0x2e/0xd0 [ 282.399605][T11950] do_ipv6_setsockopt+0x73d/0x43a0 [ 282.399636][T11950] ? _kstrtoull+0x13c/0x1f0 [ 282.399649][T11950] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 282.399667][T11950] ? aa_label_sk_perm+0x194/0x5f0 [ 282.399683][T11950] ? __lock_acquire+0x49f/0x1a40 [ 282.399701][T11950] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 282.399722][T11950] ? find_held_lock+0x2b/0x80 [ 282.399743][T11950] ? ipv6_setsockopt+0xcb/0x170 [ 282.399758][T11950] ipv6_setsockopt+0xcb/0x170 [ 282.399774][T11950] sctp_setsockopt+0x161/0xb370 [ 282.399791][T11950] ? __pfx_aa_sk_perm+0x10/0x10 [ 282.399807][T11950] ? __pfx_sctp_setsockopt+0x10/0x10 [ 282.399822][T11950] ? aa_sock_opt_perm+0xfe/0x1b0 [ 282.399833][T11950] ? sock_common_setsockopt+0x2e/0xf0 [ 282.399845][T11950] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 282.399858][T11950] do_sock_setsockopt+0xf3/0x1d0 [ 282.399871][T11950] __sys_setsockopt+0x119/0x190 [ 282.399890][T11950] __ia32_sys_setsockopt+0xbc/0x160 [ 282.399905][T11950] ? __do_fast_syscall_32+0x98/0x970 [ 282.399922][T11950] ? lockdep_hardirqs_on+0x78/0x100 [ 282.399937][T11950] __do_fast_syscall_32+0xe7/0x970 [ 282.399952][T11950] ? lockdep_hardirqs_on+0x78/0x100 [ 282.399968][T11950] do_fast_syscall_32+0x32/0x70 [ 282.399985][T11950] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 282.399999][T11950] RIP: 0023:0xf7f67fec [ 282.400014][T11950] Code: Unable to access opcode bytes at 0xf7f67fc2. [ 282.400020][T11950] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 282.400032][T11950] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000029 [ 282.400040][T11950] RDX: 0000000000000022 RSI: 0000000080000100 RDI: 0000000000000120 [ 282.400047][T11950] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 282.400054][T11950] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 282.400061][T11950] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 282.400075][T11950] [ 282.619117][T11954] could not allocate digest TFM handle rmd256-generic [ 282.754476][T11318] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 282.772257][T11981] FAULT_INJECTION: forcing a failure. [ 282.772257][T11981] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 282.778413][T11981] CPU: 0 UID: 0 PID: 11981 Comm: syz.3.1550 Tainted: G L syzkaller #0 PREEMPT(full) [ 282.778442][T11981] Tainted: [L]=SOFTLOCKUP [ 282.778448][T11981] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 282.778458][T11981] Call Trace: [ 282.778465][T11981] [ 282.778473][T11981] dump_stack_lvl+0x100/0x190 [ 282.778500][T11981] should_fail_ex.cold+0x5/0xa [ 282.778523][T11981] _copy_from_user+0x2e/0xd0 [ 282.778550][T11981] get_compat_msghdr+0xb3/0x480 [ 282.778582][T11981] ? __pfx_get_compat_msghdr+0x10/0x10 [ 282.778621][T11981] ___sys_sendmsg+0x1b6/0x1e0 [ 282.778662][T11981] ? __pfx____sys_sendmsg+0x10/0x10 [ 282.778696][T11981] ? find_held_lock+0x2b/0x80 [ 282.778734][T11981] __sys_sendmsg+0x160/0x210 [ 282.778762][T11981] ? __pfx___sys_sendmsg+0x10/0x10 [ 282.778794][T11981] ? __pfx_ksys_write+0x10/0x10 [ 282.778818][T11981] __do_fast_syscall_32+0xe7/0x970 [ 282.778847][T11981] ? lockdep_hardirqs_on+0x78/0x100 [ 282.778873][T11981] do_fast_syscall_32+0x32/0x70 [ 282.778899][T11981] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 282.778922][T11981] RIP: 0023:0xf7f67fec [ 282.778946][T11981] Code: Unable to access opcode bytes at 0xf7f67fc2. [ 282.778953][T11981] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 282.778978][T11981] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 282.778988][T11981] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 282.778998][T11981] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 282.779010][T11981] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 282.779019][T11981] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 282.779042][T11981] [ 282.862058][T11318] veth0_vlan: entered promiscuous mode [ 282.867802][T11318] veth1_vlan: entered promiscuous mode [ 282.883932][T11318] veth0_macvtap: entered promiscuous mode [ 282.892076][T11318] veth1_macvtap: entered promiscuous mode [ 282.901227][T11318] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 282.912344][T11318] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 282.990447][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.026975][ T5823] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.030839][ T5823] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.060109][ T8209] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 283.065693][ T8209] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 283.077283][ T5823] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.092211][ T8252] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 283.094728][ T8252] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 283.105801][T11318] EXT4-fs error (device sda1): ext4_validate_inode_bitmap:106: comm syz-executor: Corrupt inode bitmap - block_group = 0, inode_bitmap = 137 [ 283.112744][T12016] netdevsim netdevsim3: Direct firmware load for . [ 283.112744][T12016] failed with error -2 [ 283.128752][T12016] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 283.128752][T12016] [ 283.191021][T12026] netlink: 'syz.0.1484': attribute type 8 has an invalid length. [ 283.195270][T12026] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 283.198833][T12026] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 283.527202][ T5757] Bluetooth: hci1: command tx timeout [ 284.646396][T12038] FAULT_INJECTION: forcing a failure. [ 284.646396][T12038] name failslab, interval 1, probability 0, space 0, times 0 [ 284.657628][T12038] CPU: 2 UID: 0 PID: 12038 Comm: syz.1.1557 Tainted: G L syzkaller #0 PREEMPT(full) [ 284.657648][T12038] Tainted: [L]=SOFTLOCKUP [ 284.657653][T12038] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 284.657660][T12038] Call Trace: [ 284.657665][T12038] [ 284.657670][T12038] dump_stack_lvl+0x100/0x190 [ 284.657687][T12038] should_fail_ex.cold+0x5/0xa [ 284.657700][T12038] should_failslab+0xc2/0x120 [ 284.657716][T12038] __kmalloc_noprof+0xfc/0x820 [ 284.657732][T12038] ? rcu_is_watching+0x12/0xc0 [ 284.657746][T12038] ? tomoyo_realpath_from_path+0xb6/0x690 [ 284.657767][T12038] tomoyo_realpath_from_path+0xb6/0x690 [ 284.657788][T12038] tomoyo_path_number_perm+0x23c/0x580 [ 284.657816][T12038] ? tomoyo_path_number_perm+0x22e/0x580 [ 284.657832][T12038] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 284.657847][T12038] ? get_pid_task+0x106/0x250 [ 284.657874][T12038] ? find_held_lock+0x2b/0x80 [ 284.657888][T12038] ? __fget_files+0x215/0x3d0 [ 284.657898][T12038] ? hook_file_ioctl_common+0x140/0x440 [ 284.657913][T12038] ? __fget_files+0x215/0x3d0 [ 284.657926][T12038] ? __fget_files+0x21f/0x3d0 [ 284.657938][T12038] security_file_ioctl_compat+0xd3/0x230 [ 284.657954][T12038] __ia32_compat_sys_ioctl+0xc2/0x360 [ 284.657974][T12038] __do_fast_syscall_32+0xe7/0x970 [ 284.657990][T12038] ? lockdep_hardirqs_on+0x78/0x100 [ 284.658006][T12038] do_fast_syscall_32+0x32/0x70 [ 284.658022][T12038] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 284.658038][T12038] RIP: 0023:0xf7f04fec [ 284.658053][T12038] Code: Unable to access opcode bytes at 0xf7f04fc2. [ 284.658058][T12038] RSP: 002b:00000000f53a550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 284.658070][T12038] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000040146f2c [ 284.658077][T12038] RDX: 00000000800000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 284.658084][T12038] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 284.658091][T12038] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 284.658098][T12038] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 284.658112][T12038] [ 284.658154][T12038] ERROR: Out of memory at tomoyo_realpath_from_path. [ 284.978602][ T5824] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 285.036966][T12060] Bluetooth: hci3: Opcode 0x0401 failed: -22 [ 285.118106][T12060] FAULT_INJECTION: forcing a failure. [ 285.118106][T12060] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 285.133629][T12060] CPU: 3 UID: 0 PID: 12060 Comm: syz.0.1564 Tainted: G L syzkaller #0 PREEMPT(full) [ 285.133650][T12060] Tainted: [L]=SOFTLOCKUP [ 285.133654][T12060] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 285.133661][T12060] Call Trace: [ 285.133667][T12060] [ 285.133672][T12060] dump_stack_lvl+0x100/0x190 [ 285.133689][T12060] should_fail_ex.cold+0x5/0xa [ 285.133703][T12060] _copy_to_user+0x32/0xd0 [ 285.133722][T12060] rng_dev_read+0x223/0x910 [ 285.133741][T12060] ? __pfx_virtio_read+0x10/0x10 [ 285.133754][T12060] ? __pfx_rng_dev_read+0x10/0x10 [ 285.133774][T12060] ? bpf_lsm_file_permission+0x9/0x10 [ 285.133785][T12060] ? security_file_permission+0x76/0x210 [ 285.133802][T12060] ? rw_verify_area+0xce/0x6d0 [ 285.133818][T12060] ? __pfx_rng_dev_read+0x10/0x10 [ 285.133836][T12060] vfs_read+0x1e4/0xb40 [ 285.133848][T12060] ? __pfx_vfs_read+0x10/0x10 [ 285.133858][T12060] ? find_held_lock+0x2b/0x80 [ 285.133873][T12060] ? __fget_files+0x215/0x3d0 [ 285.133883][T12060] ? __fget_files+0x215/0x3d0 [ 285.133896][T12060] ? __fget_files+0x21f/0x3d0 [ 285.133910][T12060] ksys_read+0x12a/0x250 [ 285.133926][T12060] ? __pfx_ksys_read+0x10/0x10 [ 285.133936][T12060] ? ksys_write+0x1ac/0x250 [ 285.133946][T12060] ? __pfx_ksys_write+0x10/0x10 [ 285.133960][T12060] __do_fast_syscall_32+0xe7/0x970 [ 285.133977][T12060] ? lockdep_hardirqs_on+0x78/0x100 [ 285.133994][T12060] do_fast_syscall_32+0x32/0x70 [ 285.134010][T12060] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 285.134024][T12060] RIP: 0023:0xf70cefec [ 285.134038][T12060] Code: Unable to access opcode bytes at 0xf70cefc2. [ 285.134044][T12060] RSP: 002b:00000000f54bd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000003 [ 285.134056][T12060] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080006540 [ 285.134063][T12060] RDX: 00000000fffffce2 RSI: 0000000000000000 RDI: 0000000000000000 [ 285.134071][T12060] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 285.134077][T12060] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 285.134084][T12060] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 285.134098][T12060] [ 285.216970][ T6128] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 285.314006][T12079] 9p: Bad value for 'trans' [ 285.318333][T12079] netlink: 55631 bytes leftover after parsing attributes in process `syz.1.1569'. [ 285.488282][T12087] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 285.490410][T12087] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 285.507115][T12087] vhci_hcd vhci_hcd.0: Device attached [ 285.586128][T12095] binder: 12094:12095 ioctl 4018620d 0 returned -22 [ 285.609693][ T5757] Bluetooth: hci1: command tx timeout [ 286.406056][T12110] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 286.410528][ T8252] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 286.415337][ T8252] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 286.538027][T12088] vhci_hcd: connection closed [ 286.538416][ T8744] vhci_hcd vhci_hcd.2: stop threads [ 286.542623][ T8744] vhci_hcd vhci_hcd.2: release socket [ 286.544915][ T8744] vhci_hcd vhci_hcd.2: disconnect device [ 286.596999][T12121] kernel read not supported for file /eth0 (pid: 12121 comm: syz.3.1580) [ 286.602840][ T42] kauditd_printk_skb: 22 callbacks suppressed [ 286.602855][ T42] audit: type=1800 audit(1785723751.302:672): pid=12121 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1580" name="eth0" dev="mqueue" ino=38160 res=0 errno=0 [ 286.604667][T12122] FAULT_INJECTION: forcing a failure. [ 286.604667][T12122] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 286.616799][ T5824] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 286.656847][T12122] CPU: 3 UID: 0 PID: 12122 Comm: syz.1.1581 Tainted: G L syzkaller #0 PREEMPT(full) [ 286.656869][T12122] Tainted: [L]=SOFTLOCKUP [ 286.656874][T12122] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 286.656881][T12122] Call Trace: [ 286.656887][T12122] [ 286.656905][T12122] dump_stack_lvl+0x100/0x190 [ 286.656924][T12122] should_fail_ex.cold+0x5/0xa [ 286.656958][T12122] _copy_from_user+0x2e/0xd0 [ 286.656977][T12122] get_compat_msghdr+0xb3/0x480 [ 286.656998][T12122] ? __pfx_get_compat_msghdr+0x10/0x10 [ 286.657021][T12122] ___sys_sendmsg+0x1b6/0x1e0 [ 286.657037][T12122] ? __pfx____sys_sendmsg+0x10/0x10 [ 286.657056][T12122] ? find_held_lock+0x2b/0x80 [ 286.657080][T12122] __sys_sendmsg+0x160/0x210 [ 286.657097][T12122] ? __pfx___sys_sendmsg+0x10/0x10 [ 286.657124][T12122] ? __pfx_ksys_write+0x10/0x10 [ 286.657145][T12122] __do_fast_syscall_32+0xe7/0x970 [ 286.657172][T12122] ? lockdep_hardirqs_on+0x78/0x100 [ 286.657199][T12122] do_fast_syscall_32+0x32/0x70 [ 286.657225][T12122] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 286.657248][T12122] RIP: 0023:0xf7f04fec [ 286.657279][T12122] Code: Unable to access opcode bytes at 0xf7f04fc2. [ 286.657285][T12122] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 286.657298][T12122] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 286.657305][T12122] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 286.657312][T12122] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 286.657319][T12122] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 286.657326][T12122] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 286.657340][T12122] [ 287.856443][T12164] FAULT_INJECTION: forcing a failure. [ 287.856443][T12164] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 287.861016][T12164] CPU: 3 UID: 0 PID: 12164 Comm: syz.1.1591 Tainted: G L syzkaller #0 PREEMPT(full) [ 287.861037][T12164] Tainted: [L]=SOFTLOCKUP [ 287.861041][T12164] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 287.861048][T12164] Call Trace: [ 287.861053][T12164] [ 287.861058][T12164] dump_stack_lvl+0x100/0x190 [ 287.861074][T12164] should_fail_ex.cold+0x5/0xa [ 287.861087][T12164] _copy_from_iter+0x1f4/0x1690 [ 287.861107][T12164] ? __lock_acquire+0x49f/0x1a40 [ 287.861127][T12164] ? __pfx__copy_from_iter+0x10/0x10 [ 287.861144][T12164] ? __lock_acquire+0x49f/0x1a40 [ 287.861167][T12164] copy_page_from_iter+0x238/0x300 [ 287.861187][T12164] tun_build_skb.constprop.0+0x2ea/0x18f0 [ 287.861207][T12164] ? __pfx_tun_build_skb.constprop.0+0x10/0x10 [ 287.861221][T12164] ? unwind_get_return_address+0x59/0xa0 [ 287.861238][T12164] ? arch_stack_walk+0xa6/0xf0 [ 287.861256][T12164] ? __lock_acquire+0x49f/0x1a40 [ 287.861282][T12164] tun_get_user+0x16d6/0x3c20 [ 287.861306][T12164] ? __pfx_tun_get_user+0x10/0x10 [ 287.861320][T12164] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 287.861337][T12164] ? find_held_lock+0x2b/0x80 [ 287.861350][T12164] ? tun_get+0x191/0x370 [ 287.861362][T12164] ? tun_get+0x191/0x370 [ 287.861377][T12164] tun_chr_write_iter+0xdc/0x200 [ 287.861392][T12164] vfs_write+0x6ac/0x1050 [ 287.861404][T12164] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 287.861419][T12164] ? __pfx_vfs_write+0x10/0x10 [ 287.861429][T12164] ? find_held_lock+0x2b/0x80 [ 287.861451][T12164] ksys_write+0x12a/0x250 [ 287.861461][T12164] ? __pfx_ksys_write+0x10/0x10 [ 287.861476][T12164] do_int80_emulation+0x14b/0x720 [ 287.861495][T12164] asm_int80_emulation+0x1a/0x20 [ 287.861506][T12164] RIP: 0023:0xf71073eb [ 287.861516][T12164] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 287.861527][T12164] RSP: 002b:00000000f53c644c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 287.861539][T12164] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080000880 [ 287.861547][T12164] RDX: 0000000000000056 RSI: 0000000000000000 RDI: 0000000000000000 [ 287.861553][T12164] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 287.861560][T12164] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 287.861567][T12164] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 287.861581][T12164] [ 288.191446][T12184] Bluetooth: hci3: Opcode 0x0401 failed: -22 [ 288.274297][T12192] FAULT_INJECTION: forcing a failure. [ 288.274297][T12192] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 288.279986][T12192] CPU: 2 UID: 0 PID: 12192 Comm: syz.0.1599 Tainted: G L syzkaller #0 PREEMPT(full) [ 288.280014][T12192] Tainted: [L]=SOFTLOCKUP [ 288.280021][T12192] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 288.280033][T12192] Call Trace: [ 288.280040][T12192] [ 288.280047][T12192] dump_stack_lvl+0x100/0x190 [ 288.280074][T12192] should_fail_ex.cold+0x5/0xa [ 288.280096][T12192] _copy_from_user+0x2e/0xd0 [ 288.280125][T12192] get_compat_msghdr+0xb3/0x480 [ 288.280155][T12192] ? __pfx_get_compat_msghdr+0x10/0x10 [ 288.280194][T12192] ___sys_sendmsg+0x1b6/0x1e0 [ 288.280218][T12192] ? __pfx____sys_sendmsg+0x10/0x10 [ 288.280251][T12192] ? find_held_lock+0x2b/0x80 [ 288.280289][T12192] __sys_sendmsg+0x160/0x210 [ 288.280316][T12192] ? __pfx___sys_sendmsg+0x10/0x10 [ 288.280349][T12192] ? __pfx_ksys_write+0x10/0x10 [ 288.280374][T12192] __do_fast_syscall_32+0xe7/0x970 [ 288.280401][T12192] ? lockdep_hardirqs_on+0x78/0x100 [ 288.280427][T12192] do_fast_syscall_32+0x32/0x70 [ 288.280453][T12192] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 288.280476][T12192] RIP: 0023:0xf70cefec [ 288.280498][T12192] Code: Unable to access opcode bytes at 0xf70cefc2. [ 288.280506][T12192] RSP: 002b:00000000f54bd50c EFLAGS: 00000292 [ 288.280507][T12197] ehci-pci 0000:00:1d.7: remove, state 1 [ 288.280518][T12192] ORIG_RAX: 0000000000000172 [ 288.280526][T12192] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 288.280539][T12192] RDX: 0000000000000060 RSI: 0000000000000000 RDI: 0000000000000000 [ 288.280550][T12192] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 288.280561][T12192] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 288.280572][T12192] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 288.280595][T12192] [ 288.346820][T12197] usb usb2: USB disconnect, device number 1 [ 288.355436][T12197] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 288.500876][T12200] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 288.505568][T12200] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 288.524144][T12200] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 288.546885][T12200] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 288.559569][T12200] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 288.562493][T12200] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 288.565390][T12200] usb usb2: Product: EHCI Host Controller [ 288.571100][T12200] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 288.577117][T12200] usb usb2: SerialNumber: 0000:00:1d.7 [ 289.188299][T12233] FAULT_INJECTION: forcing a failure. [ 289.188299][T12233] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 289.192529][T12233] CPU: 2 UID: 0 PID: 12233 Comm: syz.1.1604 Tainted: G L syzkaller #0 PREEMPT(full) [ 289.192549][T12233] Tainted: [L]=SOFTLOCKUP [ 289.192553][T12233] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 289.192560][T12233] Call Trace: [ 289.192566][T12233] [ 289.192571][T12233] dump_stack_lvl+0x100/0x190 [ 289.192588][T12233] should_fail_ex.cold+0x5/0xa [ 289.192601][T12233] _copy_from_user+0x2e/0xd0 [ 289.192620][T12233] __sys_bpf+0x2f5/0x4e80 [ 289.192637][T12233] ? __pfx___sys_bpf+0x10/0x10 [ 289.192650][T12233] ? find_held_lock+0x2b/0x80 [ 289.192664][T12233] ? get_pid_task+0xfc/0x250 [ 289.192678][T12233] ? get_pid_task+0xfc/0x250 [ 289.192695][T12233] ? proc_fail_nth_write+0x9f/0x220 [ 289.192711][T12233] ? find_held_lock+0x2b/0x80 [ 289.192728][T12233] ? rcu_read_lock_any_held+0x6a/0xa0 [ 289.192743][T12233] ? find_held_lock+0x2b/0x80 [ 289.192756][T12233] ? ksys_write+0x190/0x250 [ 289.192766][T12233] ? ksys_write+0x190/0x250 [ 289.192786][T12233] ? fput+0x79/0x100 [ 289.192801][T12233] ? __ia32_sys_bpf+0xcc/0x170 [ 289.192813][T12233] __ia32_sys_bpf+0xcc/0x170 [ 289.192826][T12233] ? __do_fast_syscall_32+0x98/0x970 [ 289.192843][T12233] __do_fast_syscall_32+0xe7/0x970 [ 289.192859][T12233] ? lockdep_hardirqs_on+0x78/0x100 [ 289.192875][T12233] do_fast_syscall_32+0x32/0x70 [ 289.192891][T12233] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 289.192906][T12233] RIP: 0023:0xf7f04fec [ 289.192920][T12233] Code: Unable to access opcode bytes at 0xf7f04fc2. [ 289.192925][T12233] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 289.192937][T12233] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 00000000800002c0 [ 289.192945][T12233] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 289.192952][T12233] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 289.192959][T12233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 289.192966][T12233] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 289.192980][T12233] [ 289.716818][T12256] FAULT_INJECTION: forcing a failure. [ 289.716818][T12256] name failslab, interval 1, probability 0, space 0, times 0 [ 289.722163][T12256] CPU: 2 UID: 0 PID: 12256 Comm: syz.0.1610 Tainted: G L syzkaller #0 PREEMPT(full) [ 289.722206][T12256] Tainted: [L]=SOFTLOCKUP [ 289.722213][T12256] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 289.722223][T12256] Call Trace: [ 289.722230][T12256] [ 289.722238][T12256] dump_stack_lvl+0x100/0x190 [ 289.722264][T12256] should_fail_ex.cold+0x5/0xa [ 289.722282][T12256] should_failslab+0xc2/0x120 [ 289.722306][T12256] __kmalloc_noprof+0xfc/0x820 [ 289.722325][T12256] ? rcu_is_watching+0x12/0xc0 [ 289.722345][T12256] ? tomoyo_realpath_from_path+0xb6/0x690 [ 289.722375][T12256] tomoyo_realpath_from_path+0xb6/0x690 [ 289.722404][T12256] tomoyo_path_number_perm+0x23c/0x580 [ 289.722425][T12256] ? tomoyo_path_number_perm+0x22e/0x580 [ 289.722447][T12256] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 289.722470][T12256] ? get_pid_task+0x106/0x250 [ 289.722510][T12256] ? find_held_lock+0x2b/0x80 [ 289.722527][T12256] ? __fget_files+0x215/0x3d0 [ 289.722542][T12256] ? hook_file_ioctl_common+0x140/0x440 [ 289.722562][T12256] ? __fget_files+0x215/0x3d0 [ 289.722581][T12256] ? __fget_files+0x21f/0x3d0 [ 289.722601][T12256] security_file_ioctl_compat+0xd3/0x230 [ 289.722625][T12256] __ia32_compat_sys_ioctl+0xc2/0x360 [ 289.722651][T12256] __do_fast_syscall_32+0xe7/0x970 [ 289.722677][T12256] ? lockdep_hardirqs_on+0x78/0x100 [ 289.722699][T12256] do_fast_syscall_32+0x32/0x70 [ 289.722723][T12256] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 289.722743][T12256] RIP: 0023:0xf70cefec [ 289.722763][T12256] Code: Unable to access opcode bytes at 0xf70cefc2. [ 289.722771][T12256] RSP: 002b:00000000f549c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 289.722788][T12256] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000000005501 [ 289.722799][T12256] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 289.722809][T12256] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 289.722819][T12256] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 289.722829][T12256] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 289.722850][T12256] [ 289.722877][T12256] ERROR: Out of memory at tomoyo_realpath_from_path. [ 289.852385][ T5752] Bluetooth: hci1: command 0x0405 tx timeout [ 289.877229][T12256] input: syz0 as /devices/virtual/input/input10 [ 290.640199][T12274] netlink: 'syz.3.1613': attribute type 1 has an invalid length. [ 290.922611][T12324] FAULT_INJECTION: forcing a failure. [ 290.922611][T12324] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 290.927031][T12324] CPU: 1 UID: 0 PID: 12324 Comm: syz.3.1616 Tainted: G L syzkaller #0 PREEMPT(full) [ 290.927078][T12324] Tainted: [L]=SOFTLOCKUP [ 290.927085][T12324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 290.927093][T12324] Call Trace: [ 290.927098][T12324] [ 290.927103][T12324] dump_stack_lvl+0x100/0x190 [ 290.927122][T12324] should_fail_ex.cold+0x5/0xa [ 290.927147][T12324] _copy_from_user+0x2e/0xd0 [ 290.927168][T12324] get_compat_msghdr+0xb3/0x480 [ 290.927189][T12324] ? __pfx_get_compat_msghdr+0x10/0x10 [ 290.927212][T12324] ___sys_sendmsg+0x1b6/0x1e0 [ 290.927227][T12324] ? __pfx____sys_sendmsg+0x10/0x10 [ 290.927247][T12324] ? find_held_lock+0x2b/0x80 [ 290.927270][T12324] __sys_sendmsg+0x160/0x210 [ 290.927287][T12324] ? __pfx___sys_sendmsg+0x10/0x10 [ 290.927307][T12324] ? __pfx_ksys_write+0x10/0x10 [ 290.927321][T12324] __do_fast_syscall_32+0xe7/0x970 [ 290.927338][T12324] ? lockdep_hardirqs_on+0x78/0x100 [ 290.927354][T12324] do_fast_syscall_32+0x32/0x70 [ 290.927370][T12324] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 290.927385][T12324] RIP: 0023:0xf7f67fec [ 290.927399][T12324] Code: Unable to access opcode bytes at 0xf7f67fc2. [ 290.927405][T12324] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 290.927416][T12324] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 290.927424][T12324] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 290.927430][T12324] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 290.927437][T12324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 290.927444][T12324] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 290.927458][T12324] [ 291.080525][T12336] netlink: 'syz.3.1620': attribute type 21 has an invalid length. [ 291.083224][T12336] netlink: 'syz.3.1620': attribute type 1 has an invalid length. [ 291.088764][ T42] audit: type=1326 audit(1785723755.792:673): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 291.095954][ T42] audit: type=1326 audit(1785723755.792:674): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 291.104189][ T42] audit: type=1326 audit(1785723755.802:675): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=186 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 291.114504][ T42] audit: type=1326 audit(1785723755.802:676): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 291.122146][ T42] audit: type=1326 audit(1785723755.802:677): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 291.129782][ T42] audit: type=1326 audit(1785723755.802:678): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=224 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 291.136773][ T42] audit: type=1326 audit(1785723755.802:679): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 291.144063][ T42] audit: type=1326 audit(1785723755.802:680): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 291.151586][ T42] audit: type=1326 audit(1785723755.812:681): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 291.537730][T12343] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 291.543744][T12343] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 291.551302][T12343] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 291.585448][T12343] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 291.606825][ T42] kauditd_printk_skb: 3959 callbacks suppressed [ 291.606839][ T42] audit: type=1326 audit(1785723756.312:4641): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 291.623551][ T42] audit: type=1326 audit(1785723756.312:4642): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f68017 code=0x7ffc0000 [ 291.630870][ T42] audit: type=1326 audit(1785723756.312:4643): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 291.637886][ T42] audit: type=1326 audit(1785723756.312:4644): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f68017 code=0x7ffc0000 [ 291.645042][ T42] audit: type=1326 audit(1785723756.312:4645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 291.652193][ T42] audit: type=1326 audit(1785723756.312:4646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f68017 code=0x7ffc0000 [ 291.658891][ T42] audit: type=1326 audit(1785723756.312:4647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 291.665865][ T42] audit: type=1326 audit(1785723756.312:4648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f68017 code=0x7ffc0000 [ 291.672820][ T42] audit: type=1326 audit(1785723756.312:4649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f67fec code=0x7ffc0000 [ 291.679797][ T42] audit: type=1326 audit(1785723756.312:4650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12335 comm="syz.3.1620" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f68017 code=0x7ffc0000 [ 292.136407][T12361] FAULT_INJECTION: forcing a failure. [ 292.136407][T12361] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 292.145789][T12361] CPU: 2 UID: 0 PID: 12361 Comm: syz.3.1625 Tainted: G L syzkaller #0 PREEMPT(full) [ 292.145822][T12361] Tainted: [L]=SOFTLOCKUP [ 292.145828][T12361] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 292.145839][T12361] Call Trace: [ 292.145846][T12361] [ 292.145855][T12361] dump_stack_lvl+0x100/0x190 [ 292.145881][T12361] should_fail_ex.cold+0x5/0xa [ 292.145902][T12361] _copy_from_user+0x2e/0xd0 [ 292.145931][T12361] get_compat_msghdr+0xb3/0x480 [ 292.145961][T12361] ? __pfx_get_compat_msghdr+0x10/0x10 [ 292.145997][T12361] ___sys_sendmsg+0x1b6/0x1e0 [ 292.146022][T12361] ? __pfx____sys_sendmsg+0x10/0x10 [ 292.146053][T12361] ? find_held_lock+0x2b/0x80 [ 292.146091][T12361] __sys_sendmsg+0x160/0x210 [ 292.146117][T12361] ? __pfx___sys_sendmsg+0x10/0x10 [ 292.146148][T12361] ? __pfx_ksys_write+0x10/0x10 [ 292.146169][T12361] __do_fast_syscall_32+0xe7/0x970 [ 292.146197][T12361] ? lockdep_hardirqs_on+0x78/0x100 [ 292.146221][T12361] do_fast_syscall_32+0x32/0x70 [ 292.146251][T12361] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 292.146274][T12361] RIP: 0023:0xf7f67fec [ 292.146296][T12361] Code: Unable to access opcode bytes at 0xf7f67fc2. [ 292.146304][T12361] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 292.146322][T12361] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000c00 [ 292.146334][T12361] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 292.146344][T12361] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 292.146354][T12361] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 292.146365][T12361] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 292.146388][T12361] [ 292.237261][T12363] netlink: 'syz.3.1626': attribute type 8 has an invalid length. [ 293.185106][T12387] siw: device registration error -23 [ 293.314274][T12391] ehci-pci 0000:00:1d.7: remove, state 1 [ 293.316207][T12391] usb usb2: USB disconnect, device number 1 [ 293.328869][T12391] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 293.479662][T12391] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 293.499989][T12391] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 293.512618][T12391] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 293.536908][T12391] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 293.542408][T12391] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 293.546484][T12391] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 293.551076][T12391] usb usb2: Product: EHCI Host Controller [ 293.554298][T12391] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 293.557745][T12391] usb usb2: SerialNumber: 0000:00:1d.7 [ 293.780151][T12411] event trace: Could not enable event p [ 294.042304][T12414] lo: entered allmulticast mode [ 294.096055][T12414] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 294.722256][T12413] lo: left allmulticast mode [ 295.034566][T12450] FAULT_INJECTION: forcing a failure. [ 295.034566][T12450] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 295.038995][T12450] CPU: 1 UID: 0 PID: 12450 Comm: syz.1.1645 Tainted: G L syzkaller #0 PREEMPT(full) [ 295.039016][T12450] Tainted: [L]=SOFTLOCKUP [ 295.039020][T12450] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 295.039052][T12450] Call Trace: [ 295.039074][T12450] [ 295.039079][T12450] dump_stack_lvl+0x100/0x190 [ 295.039114][T12450] should_fail_ex.cold+0x5/0xa [ 295.039127][T12450] _copy_from_user+0x2e/0xd0 [ 295.039149][T12450] get_compat_msghdr+0xb3/0x480 [ 295.039195][T12450] ? __pfx_get_compat_msghdr+0x10/0x10 [ 295.039218][T12450] ___sys_sendmsg+0x1b6/0x1e0 [ 295.039239][T12450] ? __pfx____sys_sendmsg+0x10/0x10 [ 295.039258][T12450] ? find_held_lock+0x2b/0x80 [ 295.039281][T12450] __sys_sendmsg+0x160/0x210 [ 295.039303][T12450] ? __pfx___sys_sendmsg+0x10/0x10 [ 295.039323][T12450] ? __pfx_ksys_write+0x10/0x10 [ 295.039337][T12450] __do_fast_syscall_32+0xe7/0x970 [ 295.039392][T12450] ? lockdep_hardirqs_on+0x78/0x100 [ 295.039408][T12450] do_fast_syscall_32+0x32/0x70 [ 295.039425][T12450] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 295.039440][T12450] RIP: 0023:0xf7f04fec [ 295.039454][T12450] Code: Unable to access opcode bytes at 0xf7f04fc2. [ 295.039472][T12450] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 295.039485][T12450] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800002c0 [ 295.039493][T12450] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 295.039500][T12450] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 295.039507][T12450] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 295.039514][T12450] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 295.039528][T12450] [ 295.070309][T12461] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1647'. [ 295.290583][T12476] bridge0: port 1(bridge_slave_0) entered disabled state [ 295.299625][T12476] bridge0: port 2(bridge_slave_1) entered disabled state [ 295.343611][T12483] NILFS (nbd1): device size too small [ 295.354522][T12483] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1651'. [ 295.357586][T12483] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1651'. [ 295.410512][T12478] tipc: New replicast peer: ff01:0000:0000:0000:0000:0000:0000:0001 [ 295.616811][ T6128] usb 6-1: new full-speed USB device number 12 using dummy_hcd [ 295.625282][T12491] netlink: 'syz.0.1653': attribute type 1 has an invalid length. [ 295.659004][T12491] bond1: entered promiscuous mode [ 295.661301][T12491] 8021q: adding VLAN 0 to HW filter on device bond1 [ 295.753929][T12491] bond1: (slave bridge1): making interface the new active one [ 295.757057][T12491] bridge1: entered promiscuous mode [ 295.760037][T12491] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 295.789786][ T6128] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 295.795343][ T6128] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x89 has an invalid bInterval 0, changing to 10 [ 295.802846][ T6128] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x89 has invalid wMaxPacketSize 0 [ 295.811210][ T6128] usb 6-1: config 0 interface 0 has no altsetting 0 [ 295.815456][ T6128] usb 6-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 295.820355][ T6128] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 295.825985][ T6128] usb 6-1: Product: syz [ 295.831176][ T6128] usb 6-1: Manufacturer: syz [ 295.836931][ T6128] usb 6-1: SerialNumber: syz [ 295.946213][T12533] FAULT_INJECTION: forcing a failure. [ 295.946213][T12533] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 295.952128][T12533] CPU: 3 UID: 0 PID: 12533 Comm: syz.0.1655 Tainted: G L syzkaller #0 PREEMPT(full) [ 295.952158][T12533] Tainted: [L]=SOFTLOCKUP [ 295.952165][T12533] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 295.952175][T12533] Call Trace: [ 295.952182][T12533] [ 295.952190][T12533] dump_stack_lvl+0x100/0x190 [ 295.952215][T12533] should_fail_ex.cold+0x5/0xa [ 295.952236][T12533] _copy_from_user+0x2e/0xd0 [ 295.952265][T12533] get_compat_msghdr+0xb3/0x480 [ 295.952295][T12533] ? __pfx_get_compat_msghdr+0x10/0x10 [ 295.952326][T12533] ? _kstrtoull+0x13c/0x1f0 [ 295.952345][T12533] ? __pfx__kstrtoull+0x10/0x10 [ 295.952368][T12533] ___sys_sendmsg+0x1b6/0x1e0 [ 295.952390][T12533] ? __pfx____sys_sendmsg+0x10/0x10 [ 295.952408][T12533] ? __lock_acquire+0x49f/0x1a40 [ 295.952459][T12533] __sys_sendmmsg+0x309/0x440 [ 295.952488][T12533] ? __pfx___sys_sendmmsg+0x10/0x10 [ 295.952512][T12533] ? find_held_lock+0x2b/0x80 [ 295.952540][T12533] ? __mutex_unlock_slowpath+0x35d/0x930 [ 295.952574][T12533] ? fput+0x79/0x100 [ 295.952605][T12533] ? ksys_write+0x1ac/0x250 [ 295.952625][T12533] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 295.952642][T12533] ? lockdep_hardirqs_on+0x78/0x100 [ 295.952666][T12533] __do_fast_syscall_32+0xe7/0x970 [ 295.952690][T12533] ? lockdep_hardirqs_on+0x78/0x100 [ 295.952715][T12533] do_fast_syscall_32+0x32/0x70 [ 295.952739][T12533] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 295.952763][T12533] RIP: 0023:0xf70cefec [ 295.952798][T12533] Code: Unable to access opcode bytes at 0xf70cefc2. [ 295.952806][T12533] RSP: 002b:00000000f54bd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 295.952823][T12533] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000008000d6c0 [ 295.952834][T12533] RDX: 0000000000000001 RSI: 0000000004000000 RDI: 0000000000000000 [ 295.952844][T12533] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 295.952853][T12533] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 295.952863][T12533] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 295.952884][T12533] [ 296.890603][T12558] netlink: 'syz.2.1661': attribute type 3 has an invalid length. [ 297.162960][T12569] netlink: 'syz.0.1663': attribute type 1 has an invalid length. [ 297.184760][T12569] bond2: entered promiscuous mode [ 297.189299][T12569] 8021q: adding VLAN 0 to HW filter on device bond2 [ 297.282955][T12569] bond2: (slave bridge2): making interface the new active one [ 297.286092][T12569] bridge2: entered promiscuous mode [ 297.291407][T12605] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 297.294033][T12605] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 297.297621][T12569] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 297.297713][T12605] vhci_hcd vhci_hcd.0: Device attached [ 297.307811][T12609] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1664'. [ 297.376216][T12605] wg2 speed is unknown, defaulting to 1000 [ 297.391671][T12605] wg2 speed is unknown, defaulting to 1000 [ 297.397339][T12605] wg2 speed is unknown, defaulting to 1000 [ 297.439427][T12617] trusted_key: syz.3.1667 sent an empty control message without MSG_MORE. [ 297.578573][ T5895] usb 42-1: SetAddress Request (18) to port 0 [ 297.580615][ T5895] usb 42-1: new SuperSpeed USB device number 18 using vhci_hcd [ 297.639955][ T5824] wg2 speed is unknown, defaulting to 1000 [ 297.644698][T12605] infiniband syz2: set active [ 297.649572][T12605] infiniband syz2: added wg2 [ 297.666312][T12605] smbdirect: ib_dev[syz2]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 297.671562][T12605] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 297.677756][T12605] smbdirect: ib_dev[syz2]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 297.791789][T12605] RDS/IB: syz2: added [ 297.793401][T12605] smc: adding ib device syz2 with port count 1 [ 297.795676][T12605] smc: ib device syz2 port 1 has no pnetid [ 297.805576][ T5824] wg2 speed is unknown, defaulting to 1000 [ 297.832630][T12644] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 297.841913][T12605] wg2 speed is unknown, defaulting to 1000 [ 297.974217][T12606] vhci_hcd: connection reset by peer [ 297.984340][ T8744] vhci_hcd vhci_hcd.2: stop threads [ 297.986420][ T8744] vhci_hcd vhci_hcd.2: release socket [ 297.992808][ T8744] vhci_hcd vhci_hcd.2: disconnect device [ 298.239595][T12605] wg2 speed is unknown, defaulting to 1000 [ 298.302252][ T5855] usb 6-1: USB disconnect, device number 12 [ 298.429847][T12605] wg2 speed is unknown, defaulting to 1000 [ 298.499599][T12655] netlink: 'syz.1.1674': attribute type 1 has an invalid length. [ 298.608141][T12655] bond13: entered promiscuous mode [ 298.610970][T12655] 8021q: adding VLAN 0 to HW filter on device bond13 [ 298.617886][T12605] wg2 speed is unknown, defaulting to 1000 [ 298.648822][T12655] bond13: (slave bridge11): making interface the new active one [ 298.655446][T12655] bridge11: entered promiscuous mode [ 298.662931][T12655] bond13: (slave bridge11): Enslaving as an active interface with an up link [ 298.825595][T12697] FAULT_INJECTION: forcing a failure. [ 298.825595][T12697] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 298.842983][T12697] CPU: 0 UID: 0 PID: 12697 Comm: syz.1.1675 Tainted: G L syzkaller #0 PREEMPT(full) [ 298.843003][T12697] Tainted: [L]=SOFTLOCKUP [ 298.843031][T12697] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 298.843040][T12697] Call Trace: [ 298.843045][T12697] [ 298.843050][T12697] dump_stack_lvl+0x100/0x190 [ 298.843069][T12697] should_fail_ex.cold+0x5/0xa [ 298.843082][T12697] _copy_to_user+0x32/0xd0 [ 298.843101][T12697] simple_read_from_buffer+0xcb/0x170 [ 298.843121][T12697] proc_fail_nth_read+0x1af/0x230 [ 298.843138][T12697] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 298.843154][T12697] ? rw_verify_area+0xce/0x6d0 [ 298.843171][T12697] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 298.843187][T12697] vfs_read+0x1e4/0xb40 [ 298.843199][T12697] ? __pfx_vfs_read+0x10/0x10 [ 298.843208][T12697] ? find_held_lock+0x2b/0x80 [ 298.843223][T12697] ? __fget_files+0x215/0x3d0 [ 298.843236][T12697] ? __fget_files+0x21f/0x3d0 [ 298.843250][T12697] ksys_read+0x12a/0x250 [ 298.843261][T12697] ? __pfx_ksys_read+0x10/0x10 [ 298.843275][T12697] do_int80_emulation+0x14b/0x720 [ 298.843299][T12697] asm_int80_emulation+0x1a/0x20 [ 298.843311][T12697] RIP: 0023:0xf71073eb [ 298.843322][T12697] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 298.843334][T12697] RSP: 002b:00000000f53a54bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 298.843347][T12697] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f53a55d0 [ 298.843354][T12697] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 298.843361][T12697] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 298.843367][T12697] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 298.843374][T12697] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 298.843388][T12697] [ 299.073219][T12718] ehci-pci 0000:00:1d.7: remove, state 1 [ 299.075143][T12718] usb usb2: USB disconnect, device number 1 [ 299.083130][T12718] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 299.190912][T12730] netlink: 'syz.1.1684': attribute type 1 has an invalid length. [ 299.191571][T12728] netdevsim netdevsim3: Direct firmware load for . [ 299.191571][T12728] failed with error -2 [ 299.199318][T12728] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 299.199318][T12728] [ 299.236056][T12730] bond14: entered promiscuous mode [ 299.240432][T12730] 8021q: adding VLAN 0 to HW filter on device bond14 [ 299.244423][T12718] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 299.262325][T12718] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 299.273158][T12718] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 299.282200][T12730] bond14: (slave bridge12): making interface the new active one [ 299.289661][T12730] bridge12: entered promiscuous mode [ 299.294758][T12730] bond14: (slave bridge12): Enslaving as an active interface with an up link [ 299.317161][T12718] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 299.322646][T12718] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 299.325636][T12718] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 299.329673][T12718] usb usb2: Product: EHCI Host Controller [ 299.332182][T12718] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 299.335079][T12718] usb usb2: SerialNumber: 0000:00:1d.7 [ 299.745392][T12797] i2c i2c-0: delete_device: Can't find device in list [ 299.926324][T12804] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1694'. [ 300.002741][T12839] netlink: 'syz.0.1695': attribute type 1 has an invalid length. [ 300.077406][T12839] bond4: entered promiscuous mode [ 300.081523][T12839] 8021q: adding VLAN 0 to HW filter on device bond4 [ 300.107301][T12839] bond4: (slave bridge3): making interface the new active one [ 300.109866][T12839] bridge3: entered promiscuous mode [ 300.112517][T12839] bond4: (slave bridge3): Enslaving as an active interface with an up link [ 300.122291][T12881] FAULT_INJECTION: forcing a failure. [ 300.122291][T12881] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 300.136171][T12881] CPU: 0 UID: 0 PID: 12881 Comm: syz.2.1697 Tainted: G L syzkaller #0 PREEMPT(full) [ 300.136192][T12881] Tainted: [L]=SOFTLOCKUP [ 300.136197][T12881] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 300.136204][T12881] Call Trace: [ 300.136209][T12881] [ 300.136214][T12881] dump_stack_lvl+0x100/0x190 [ 300.136232][T12881] should_fail_ex.cold+0x5/0xa [ 300.136245][T12881] _copy_from_user+0x2e/0xd0 [ 300.136264][T12881] get_compat_msghdr+0xb3/0x480 [ 300.136285][T12881] ? __pfx_get_compat_msghdr+0x10/0x10 [ 300.136305][T12881] ? _kstrtoull+0x13c/0x1f0 [ 300.136317][T12881] ? __pfx__kstrtoull+0x10/0x10 [ 300.136347][T12881] ___sys_sendmsg+0x1b6/0x1e0 [ 300.136363][T12881] ? __pfx____sys_sendmsg+0x10/0x10 [ 300.136375][T12881] ? __lock_acquire+0x49f/0x1a40 [ 300.136409][T12881] __sys_sendmmsg+0x309/0x440 [ 300.136428][T12881] ? __pfx___sys_sendmmsg+0x10/0x10 [ 300.136444][T12881] ? find_held_lock+0x2b/0x80 [ 300.136462][T12881] ? __mutex_unlock_slowpath+0x35d/0x930 [ 300.136485][T12881] ? fput+0x79/0x100 [ 300.136499][T12881] ? ksys_write+0x1ac/0x250 [ 300.136511][T12881] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 300.136523][T12881] ? lockdep_hardirqs_on+0x78/0x100 [ 300.136539][T12881] __do_fast_syscall_32+0xe7/0x970 [ 300.136555][T12881] ? lockdep_hardirqs_on+0x78/0x100 [ 300.136581][T12881] do_fast_syscall_32+0x32/0x70 [ 300.136597][T12881] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 300.136612][T12881] RIP: 0023:0xf703efec [ 300.136626][T12881] Code: Unable to access opcode bytes at 0xf703efc2. [ 300.136632][T12881] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 300.136644][T12881] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 300.136652][T12881] RDX: 00000000000001f2 RSI: 0000000000000000 RDI: 0000000000000000 [ 300.136659][T12881] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 300.136665][T12881] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 300.136672][T12881] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 300.136686][T12881] [ 300.302363][ T42] kauditd_printk_skb: 1718 callbacks suppressed [ 300.302377][ T42] audit: type=1804 audit(1785723765.002:6369): pid=12882 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1696" name="/newroot/440/bus/bus" dev="overlay" ino=2385 res=1 errno=0 [ 300.429353][T12895] FAULT_INJECTION: forcing a failure. [ 300.429353][T12895] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 300.433685][T12895] CPU: 3 UID: 0 PID: 12895 Comm: syz.2.1702 Tainted: G L syzkaller #0 PREEMPT(full) [ 300.433705][T12895] Tainted: [L]=SOFTLOCKUP [ 300.433709][T12895] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 300.433717][T12895] Call Trace: [ 300.433722][T12895] [ 300.433727][T12895] dump_stack_lvl+0x100/0x190 [ 300.433744][T12895] should_fail_ex.cold+0x5/0xa [ 300.433757][T12895] save_fsave_header+0x14c/0x2f0 [ 300.433770][T12895] ? __pfx_save_fsave_header+0x10/0x10 [ 300.433786][T12895] ? copy_fpstate_to_sigframe+0x2b8/0xae0 [ 300.433799][T12895] ? __local_bh_enable_ip+0x9e/0x120 [ 300.433814][T12895] copy_fpstate_to_sigframe+0x755/0xae0 [ 300.433826][T12895] ? do_raw_spin_lock+0x128/0x260 [ 300.433841][T12895] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 300.433855][T12895] ? posixtimer_deliver_signal+0x19d/0x6e0 [ 300.433870][T12895] ? x86_task_fpu+0x5f/0x90 [ 300.433888][T12895] get_sigframe+0x3fb/0x940 [ 300.433908][T12895] ? __pfx_get_sigframe+0x10/0x10 [ 300.433926][T12895] ? rcu_is_watching+0x12/0xc0 [ 300.433940][T12895] ? siginfo_layout+0x156/0x290 [ 300.433955][T12895] ia32_setup_rt_frame+0xe7/0xaf0 [ 300.433972][T12895] ? __pfx_ia32_setup_rt_frame+0x10/0x10 [ 300.433990][T12895] arch_do_signal_or_restart+0x459/0x7a0 [ 300.434002][T12895] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 300.434025][T12895] ? fput+0x79/0x100 [ 300.434040][T12895] exit_to_user_mode_loop+0x139/0x6f0 [ 300.434052][T12895] ? rcu_is_watching+0x12/0xc0 [ 300.434066][T12895] do_int80_emulation+0x513/0x720 [ 300.434085][T12895] asm_int80_emulation+0x1a/0x20 [ 300.434097][T12895] RIP: 0023:0xf71773eb [ 300.434107][T12895] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 300.434119][T12895] RSP: 002b:00000000f542d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 300.434131][T12895] RAX: 0000000000000001 RBX: 0000000000000003 RCX: 00000000f542d5c0 [ 300.434138][T12895] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 300.434145][T12895] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 300.434151][T12895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 300.434158][T12895] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 300.434171][T12895] [ 301.770560][T12976] netlink: 'syz.1.1722': attribute type 1 has an invalid length. [ 301.822724][T12976] bond15: entered promiscuous mode [ 301.825155][T12976] 8021q: adding VLAN 0 to HW filter on device bond15 [ 301.830063][T13014] FAULT_INJECTION: forcing a failure. [ 301.830063][T13014] name failslab, interval 1, probability 0, space 0, times 0 [ 301.836972][T13014] CPU: 2 UID: 0 PID: 13014 Comm: syz.0.1721 Tainted: G L syzkaller #0 PREEMPT(full) [ 301.837015][T13014] Tainted: [L]=SOFTLOCKUP [ 301.837021][T13014] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 301.837032][T13014] Call Trace: [ 301.837040][T13014] [ 301.837047][T13014] dump_stack_lvl+0x100/0x190 [ 301.837073][T13014] should_fail_ex.cold+0x5/0xa [ 301.837094][T13014] should_failslab+0xc2/0x120 [ 301.837119][T13014] __kmalloc_noprof+0xfc/0x820 [ 301.837139][T13014] ? rcu_is_watching+0x12/0xc0 [ 301.837160][T13014] ? tomoyo_realpath_from_path+0xb6/0x690 [ 301.837192][T13014] tomoyo_realpath_from_path+0xb6/0x690 [ 301.837223][T13014] tomoyo_path_number_perm+0x23c/0x580 [ 301.837244][T13014] ? tomoyo_path_number_perm+0x22e/0x580 [ 301.837268][T13014] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 301.837291][T13014] ? get_pid_task+0x106/0x250 [ 301.837336][T13014] ? find_held_lock+0x2b/0x80 [ 301.837357][T13014] ? __fget_files+0x215/0x3d0 [ 301.837373][T13014] ? hook_file_ioctl_common+0x140/0x440 [ 301.837394][T13014] ? __fget_files+0x215/0x3d0 [ 301.837414][T13014] ? __fget_files+0x21f/0x3d0 [ 301.837436][T13014] security_file_ioctl_compat+0xd3/0x230 [ 301.837460][T13014] __ia32_compat_sys_ioctl+0xc2/0x360 [ 301.837488][T13014] __do_fast_syscall_32+0xe7/0x970 [ 301.837514][T13014] ? lockdep_hardirqs_on+0x78/0x100 [ 301.837539][T13014] do_fast_syscall_32+0x32/0x70 [ 301.837562][T13014] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 301.837582][T13014] RIP: 0023:0xf70cefec [ 301.837604][T13014] Code: Unable to access opcode bytes at 0xf70cefc2. [ 301.837611][T13014] RSP: 002b:00000000f549c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 301.837628][T13014] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000000540b [ 301.837639][T13014] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 301.837648][T13014] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 301.837658][T13014] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 301.837667][T13014] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 301.837689][T13014] [ 301.838103][T13014] ERROR: Out of memory at tomoyo_realpath_from_path. [ 301.926139][T12976] bond15: (slave bridge13): making interface the new active one [ 301.929462][T12976] bridge13: entered promiscuous mode [ 301.936122][T12976] bond15: (slave bridge13): Enslaving as an active interface with an up link [ 302.366796][T13034] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 302.379077][T13034] CIFS: Attempting to mount //127.0.0.1/share [ 302.514877][T13036] ehci-pci 0000:00:1d.7: remove, state 1 [ 302.517112][T13036] usb usb2: USB disconnect, device number 1 [ 302.523382][T13036] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 302.646864][ T5895] usb 42-1: device descriptor read/8, error -110 [ 302.674631][T13036] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 302.682572][T13036] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 302.697174][T13036] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 302.716920][T13036] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 302.722265][T13036] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 302.726226][T13036] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 302.731032][T13036] usb usb2: Product: EHCI Host Controller [ 302.733626][T13036] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 302.736429][T13036] usb usb2: SerialNumber: 0000:00:1d.7 [ 302.885311][T13063] netlink: 'syz.2.1732': attribute type 1 has an invalid length. [ 302.904717][T13063] bond8: entered promiscuous mode [ 302.908208][T13063] 8021q: adding VLAN 0 to HW filter on device bond8 [ 302.935269][T13063] bond8: (slave bridge8): making interface the new active one [ 302.948229][T13063] bridge8: entered promiscuous mode [ 302.950957][T13063] bond8: (slave bridge8): Enslaving as an active interface with an up link [ 302.975411][T13034] CIFS: VFS: Error connecting to socket. Aborting operation. [ 302.987830][T13034] CIFS: VFS: cifs_mount failed w/return code = -4 [ 303.208121][T13122] ehci-pci 0000:00:1d.7: remove, state 1 [ 303.221084][T13122] usb usb2: USB disconnect, device number 1 [ 303.247451][T13122] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 303.321162][T13129] binder: BINDER_SET_CONTEXT_MGR already set [ 303.325801][T13129] binder: 13119:13129 ioctl 4018620d 80004a80 returned -16 [ 303.393365][T13126] binder: 13112:13126 ioctl 4018620d 0 returned -22 [ 303.508834][ T5895] usb usb42-port1: attempt power cycle [ 303.689822][T13127] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 303.694541][T13127] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 303.699119][T13127] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 303.717072][T13127] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 303.720565][T13127] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 303.723760][T13127] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 303.726356][T13127] usb usb2: Product: EHCI Host Controller [ 303.729664][T13127] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 303.731721][T13127] usb usb2: SerialNumber: 0000:00:1d.7 [ 304.066629][T13152] netlink: 'syz.0.1744': attribute type 1 has an invalid length. [ 304.067751][ T5895] usb usb42-port1: unable to enumerate USB device [ 304.096105][T13152] bond5: entered promiscuous mode [ 304.098313][T13152] 8021q: adding VLAN 0 to HW filter on device bond5 [ 304.148847][T13152] bond5: (slave bridge4): making interface the new active one [ 304.165456][T13152] bridge4: entered promiscuous mode [ 304.175795][T13152] bond5: (slave bridge4): Enslaving as an active interface with an up link [ 304.392297][T13186] binder: 13148:13186 ioctl 4018620d 0 returned -22 [ 305.102970][T13210] netdevsim netdevsim3: Direct firmware load for . [ 305.102970][T13210] failed with error -2 [ 305.111459][T13210] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 305.111459][T13210] [ 305.554764][T13219] binder: BINDER_SET_CONTEXT_MGR already set [ 305.557418][T13219] binder: 13217:13219 ioctl 4018620d 80004a80 returned -16 [ 306.334959][T13235] siw: device registration error -23 [ 308.446957][T13300] ehci-pci 0000:00:1d.7: remove, state 1 [ 308.449050][T13300] usb usb2: USB disconnect, device number 1 [ 308.464046][T13300] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 308.847792][T13300] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 308.857952][T13300] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 308.862484][T13300] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 308.877112][T13300] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 308.884044][T13300] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 308.889725][T13300] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 308.892579][T13300] usb usb2: Product: EHCI Host Controller [ 308.894386][T13300] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 308.896887][T13300] usb usb2: SerialNumber: 0000:00:1d.7 [ 309.112036][T13338] tmpfs: Bad value for 'mpol' [ 309.157057][ T5855] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 309.311405][T13359] mass_storage.usb0/lun.0: unable to open backing file: fil [ 309.358244][ T5855] usb 7-1: config index 0 descriptor too short (expected 32, got 21) [ 309.362834][ T5855] usb 7-1: config 1 has an invalid descriptor of length 7, skipping remainder of the config [ 309.367398][ T5855] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 309.374980][ T5855] usb 7-1: New USB device found, idVendor=0a99, idProduct=0001, bcdDevice= 0.00 [ 309.380594][ T5855] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 309.383387][ T5855] usb 7-1: Product: syz [ 309.384774][ T5855] usb 7-1: Manufacturer: syz [ 309.514621][T13374] netlink: 'syz.3.1785': attribute type 1 has an invalid length. [ 309.637308][T13374] bond15: entered promiscuous mode [ 309.643477][T13374] 8021q: adding VLAN 0 to HW filter on device bond15 [ 309.684272][T13376] bond15: (slave bridge14): making interface the new active one [ 309.691686][T13376] bridge14: entered promiscuous mode [ 309.696542][T13376] bond15: (slave bridge14): Enslaving as an active interface with an up link [ 309.756459][T13418] gadgetfs: bound to dummy_udc driver [ 309.847496][T13422] wg2 speed is unknown, defaulting to 1000 [ 309.996840][ T5895] usb 6-1: new full-speed USB device number 13 using dummy_hcd [ 309.999582][ C1] gadgetfs: connected [ 310.002983][ T5895] gadgetfs: disconnected [ 310.197456][ C1] gadgetfs: connected [ 310.200158][ T5895] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 310.203286][ T5895] usb 6-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 310.206354][ T5895] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 310.587297][T13417] gadgetfs: suspended from state 3 [ 310.589746][T13417] gadgetfs: disconnected [ 310.592081][ T6128] usb 6-1: USB disconnect, device number 13 [ 311.193856][T13471] mass_storage.usb0/lun.0: unable to open backing file: fi [ 311.239158][T13474] netlink: 'syz.1.1792': attribute type 1 has an invalid length. [ 311.256108][T13474] bond16: entered promiscuous mode [ 311.259355][T13474] 8021q: adding VLAN 0 to HW filter on device bond16 [ 311.295147][T13474] bond16: (slave bridge14): making interface the new active one [ 311.299009][T13474] bridge14: entered promiscuous mode [ 311.301507][T13474] bond16: (slave bridge14): Enslaving as an active interface with an up link [ 311.887856][ T6128] usb 7-1: USB disconnect, device number 21 [ 312.393460][T13551] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 312.397102][T13551] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 312.703194][T13570] fuse: Bad value for 'user_id' [ 312.705173][T13570] fuse: Bad value for 'user_id' [ 312.794110][T13578] netlink: 'syz.0.1806': attribute type 1 has an invalid length. [ 312.864831][T13578] bond6: entered promiscuous mode [ 312.867175][T13578] 8021q: adding VLAN 0 to HW filter on device bond6 [ 312.885193][T13584] bond6: (slave bridge5): making interface the new active one [ 312.890181][T13584] bridge5: entered promiscuous mode [ 312.893580][T13584] bond6: (slave bridge5): Enslaving as an active interface with an up link [ 313.725219][T13636] FAULT_INJECTION: forcing a failure. [ 313.725219][T13636] name failslab, interval 1, probability 0, space 0, times 0 [ 313.731240][T13636] CPU: 1 UID: 0 PID: 13636 Comm: syz.2.1812 Tainted: G L syzkaller #0 PREEMPT(full) [ 313.731266][T13636] Tainted: [L]=SOFTLOCKUP [ 313.731272][T13636] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 313.731281][T13636] Call Trace: [ 313.731289][T13636] [ 313.731295][T13636] dump_stack_lvl+0x100/0x190 [ 313.731319][T13636] should_fail_ex.cold+0x5/0xa [ 313.731337][T13636] should_failslab+0xc2/0x120 [ 313.731359][T13636] __kmalloc_noprof+0xfc/0x820 [ 313.731376][T13636] ? rcu_is_watching+0x12/0xc0 [ 313.731394][T13636] ? tomoyo_realpath_from_path+0xb6/0x690 [ 313.731421][T13636] tomoyo_realpath_from_path+0xb6/0x690 [ 313.731449][T13636] tomoyo_path_number_perm+0x23c/0x580 [ 313.731468][T13636] ? tomoyo_path_number_perm+0x22e/0x580 [ 313.731489][T13636] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 313.731509][T13636] ? get_pid_task+0x106/0x250 [ 313.731546][T13636] ? find_held_lock+0x2b/0x80 [ 313.731564][T13636] ? __fget_files+0x215/0x3d0 [ 313.731578][T13636] ? hook_file_ioctl_common+0x140/0x440 [ 313.731597][T13636] ? __fget_files+0x215/0x3d0 [ 313.731613][T13636] ? __fget_files+0x21f/0x3d0 [ 313.731631][T13636] security_file_ioctl_compat+0xd3/0x230 [ 313.731652][T13636] __ia32_compat_sys_ioctl+0xc2/0x360 [ 313.731677][T13636] __do_fast_syscall_32+0xe7/0x970 [ 313.731702][T13636] ? lockdep_hardirqs_on+0x78/0x100 [ 313.731723][T13636] do_fast_syscall_32+0x32/0x70 [ 313.731745][T13636] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 313.731764][T13636] RIP: 0023:0xf703efec [ 313.731785][T13636] Code: Unable to access opcode bytes at 0xf703efc2. [ 313.731808][T13636] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 313.731824][T13636] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040986f00 [ 313.731833][T13636] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 313.731843][T13636] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 313.731852][T13636] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 313.731861][T13636] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 313.731881][T13636] [ 313.731888][T13636] ERROR: Out of memory at tomoyo_realpath_from_path. [ 314.085644][T13667] netlink: 'syz.0.1821': attribute type 1 has an invalid length. [ 314.099193][T13667] bond7: entered promiscuous mode [ 314.100983][T13667] 8021q: adding VLAN 0 to HW filter on device bond7 [ 314.137114][T13667] bond7: (slave bridge6): making interface the new active one [ 314.139991][T13667] bridge6: entered promiscuous mode [ 314.143027][T13667] bond7: (slave bridge6): Enslaving as an active interface with an up link [ 315.005793][T13737] ehci-pci 0000:00:1d.7: remove, state 1 [ 315.007745][T13737] usb usb2: USB disconnect, device number 1 [ 315.019393][T13737] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 315.149843][T13737] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 315.155500][T13737] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 315.166876][T13737] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 315.197114][T13737] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 315.200811][T13737] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 315.203699][T13737] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 315.206175][T13737] usb usb2: Product: EHCI Host Controller [ 315.209248][T13737] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 315.211245][T13737] usb usb2: SerialNumber: 0000:00:1d.7 [ 315.265560][T13767] netlink: 'syz.0.1832': attribute type 1 has an invalid length. [ 315.311783][T13767] bond8: entered promiscuous mode [ 315.316191][T13767] 8021q: adding VLAN 0 to HW filter on device bond8 [ 315.342601][T13767] bond8: (slave bridge7): making interface the new active one [ 315.347441][T13767] bridge7: entered promiscuous mode [ 315.352251][T13767] bond8: (slave bridge7): Enslaving as an active interface with an up link [ 315.529271][T13823] binder: 13813:13823 ioctl c0306201 0 returned -14 [ 316.549729][T13844] FAULT_INJECTION: forcing a failure. [ 316.549729][T13844] name failslab, interval 1, probability 0, space 0, times 0 [ 316.556306][T13844] CPU: 0 UID: 0 PID: 13844 Comm: syz.2.1838 Tainted: G L syzkaller #0 PREEMPT(full) [ 316.556326][T13844] Tainted: [L]=SOFTLOCKUP [ 316.556331][T13844] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 316.556337][T13844] Call Trace: [ 316.556342][T13844] [ 316.556347][T13844] dump_stack_lvl+0x100/0x190 [ 316.556365][T13844] should_fail_ex.cold+0x5/0xa [ 316.556378][T13844] should_failslab+0xc2/0x120 [ 316.556395][T13844] kmem_cache_alloc_noprof+0x91/0x6a0 [ 316.556410][T13844] ? fuse_request_alloc+0x22/0x200 [ 316.556426][T13844] fuse_request_alloc+0x22/0x200 [ 316.556440][T13844] fuse_get_req+0x20a/0x400 [ 316.556454][T13844] ? __pfx_fuse_get_req+0x10/0x10 [ 316.556469][T13844] ? from_kgid+0x8f/0xd0 [ 316.556485][T13844] ? __pfx_from_kgid+0x10/0x10 [ 316.556501][T13844] ? is_bpf_text_address+0x94/0x1a0 [ 316.556520][T13844] fuse_chan_send+0x257/0x9a0 [ 316.556538][T13844] __fuse_simple_request+0x18e/0x1e0 [ 316.556556][T13844] fuse_do_getattr+0x27a/0x530 [ 316.556569][T13844] ? __pfx_fuse_do_getattr+0x10/0x10 [ 316.556581][T13844] ? find_held_lock+0x2b/0x80 [ 316.556599][T13844] ? aa_file_perm+0x7f3/0x14d0 [ 316.556618][T13844] ? look_up_lock_class+0x55/0x120 [ 316.556639][T13844] ? __lock_acquire+0x49f/0x1a40 [ 316.556657][T13844] ? __pfx___might_resched+0x10/0x10 [ 316.556674][T13844] ? find_held_lock+0x2b/0x80 [ 316.556707][T13844] ? get_pid_task+0xfc/0x250 [ 316.556723][T13844] fuse_update_get_attr+0x5e1/0x6c0 [ 316.556738][T13844] fuse_file_write_iter+0x5f2/0x960 [ 316.556758][T13844] vfs_write+0x6ac/0x1050 [ 316.556769][T13844] ? __pfx_fuse_file_write_iter+0x10/0x10 [ 316.556788][T13844] ? __pfx_vfs_write+0x10/0x10 [ 316.556797][T13844] ? find_held_lock+0x2b/0x80 [ 316.556820][T13844] ksys_write+0x1f8/0x250 [ 316.556830][T13844] ? __pfx_ksys_write+0x10/0x10 [ 316.556840][T13844] ? ksys_write+0x1ac/0x250 [ 316.556850][T13844] ? __pfx_ksys_write+0x10/0x10 [ 316.556864][T13844] __do_fast_syscall_32+0xe7/0x970 [ 316.556880][T13844] ? lockdep_hardirqs_on+0x78/0x100 [ 316.556895][T13844] do_fast_syscall_32+0x32/0x70 [ 316.556911][T13844] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 316.556926][T13844] RIP: 0023:0xf703efec [ 316.556941][T13844] Code: Unable to access opcode bytes at 0xf703efc2. [ 316.556947][T13844] RSP: 002b:00000000f53eb50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 316.556958][T13844] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800000c0 [ 316.556965][T13844] RDX: 00000000fffffdef RSI: 0000000000000000 RDI: 0000000000000000 [ 316.556972][T13844] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 316.556979][T13844] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 316.556985][T13844] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 316.556999][T13844] [ 316.870980][T13858] ehci-pci 0000:00:1d.7: remove, state 1 [ 316.874657][T13858] usb usb2: USB disconnect, device number 1 [ 316.887154][T13858] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 317.220837][T13861] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 317.229723][T13861] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 317.236047][T13861] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 317.257221][T13861] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 317.267543][T13861] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 317.271324][T13861] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 317.274669][T13861] usb usb2: Product: EHCI Host Controller [ 317.279686][T13861] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 317.284717][T13861] usb usb2: SerialNumber: 0000:00:1d.7 [ 317.460952][T13877] netlink: 'syz.0.1845': attribute type 1 has an invalid length. [ 317.479423][T13877] bond9: entered promiscuous mode [ 317.481351][T13877] 8021q: adding VLAN 0 to HW filter on device bond9 [ 317.501613][T13877] bond9: (slave bridge8): making interface the new active one [ 317.504366][T13877] bridge8: entered promiscuous mode [ 317.508718][T13877] bond9: (slave bridge8): Enslaving as an active interface with an up link [ 317.621524][T13928] tipc: Started in network mode [ 317.625995][T13928] tipc: Node identity fae4577ea9ca, cluster identity 4711 [ 317.631530][T13928] tipc: Enabled bearer , priority 0 [ 317.641342][T13928] tipc: Resetting bearer [ 317.645331][T13932] tipc: Enabled bearer , priority 0 [ 317.648435][T13932] FAULT_INJECTION: forcing a failure. [ 317.648435][T13932] name failslab, interval 1, probability 0, space 0, times 0 [ 317.652318][T13932] CPU: 1 UID: 0 PID: 13932 Comm: syz.2.1851 Tainted: G L syzkaller #0 PREEMPT(full) [ 317.652343][T13932] Tainted: [L]=SOFTLOCKUP [ 317.652350][T13932] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 317.652362][T13932] Call Trace: [ 317.652370][T13932] [ 317.652377][T13932] dump_stack_lvl+0x100/0x190 [ 317.652422][T13932] should_fail_ex.cold+0x5/0xa [ 317.652442][T13932] should_failslab+0xc2/0x120 [ 317.652459][T13932] __kmalloc_noprof+0xfc/0x820 [ 317.652473][T13932] ? rcu_is_watching+0x12/0xc0 [ 317.652487][T13932] ? tomoyo_realpath_from_path+0xb6/0x690 [ 317.652509][T13932] tomoyo_realpath_from_path+0xb6/0x690 [ 317.652530][T13932] tomoyo_path_number_perm+0x23c/0x580 [ 317.652545][T13932] ? tomoyo_path_number_perm+0x22e/0x580 [ 317.652561][T13932] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 317.652577][T13932] ? get_pid_task+0x106/0x250 [ 317.652604][T13932] ? find_held_lock+0x2b/0x80 [ 317.652618][T13932] ? __fget_files+0x215/0x3d0 [ 317.652631][T13932] ? hook_file_ioctl_common+0x140/0x440 [ 317.652646][T13932] ? __fget_files+0x215/0x3d0 [ 317.652659][T13932] ? __fget_files+0x21f/0x3d0 [ 317.652672][T13932] security_file_ioctl_compat+0xd3/0x230 [ 317.652688][T13932] __ia32_compat_sys_ioctl+0xc2/0x360 [ 317.652708][T13932] __do_fast_syscall_32+0xe7/0x970 [ 317.652726][T13932] ? lockdep_hardirqs_on+0x78/0x100 [ 317.652743][T13932] do_fast_syscall_32+0x32/0x70 [ 317.652759][T13932] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 317.652774][T13932] RIP: 0023:0xf703efec [ 317.652787][T13932] Code: Unable to access opcode bytes at 0xf703efc2. [ 317.652793][T13932] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 317.652805][T13932] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000008922 [ 317.652813][T13932] RDX: 0000000080002280 RSI: 0000000000000000 RDI: 0000000000000000 [ 317.652820][T13932] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 317.652827][T13932] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 317.652833][T13932] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 317.652848][T13932] [ 317.652930][T13932] ERROR: Out of memory at tomoyo_realpath_from_path. [ 317.721900][T13927] tipc: Disabling bearer [ 317.735793][T13932] tipc: Resetting bearer [ 317.742807][T13931] tipc: Disabling bearer [ 318.199426][T13952] ehci-pci 0000:00:1d.7: remove, state 1 [ 318.201577][T13952] usb usb2: USB disconnect, device number 1 [ 318.326080][T13952] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 318.854550][T13953] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 318.860743][T13953] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 318.875753][T13953] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 318.896862][T13953] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 318.904086][T13953] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 318.907925][T13953] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 318.910912][T13953] usb usb2: Product: EHCI Host Controller [ 318.913123][T13953] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 318.915394][T13953] usb usb2: SerialNumber: 0000:00:1d.7 [ 319.119683][T13994] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1863'. [ 319.122586][T13994] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 319.124858][T13994] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 319.128405][T13994] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 319.130844][T13994] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 319.510358][T14016] ehci-pci 0000:00:1d.7: remove, state 1 [ 319.512698][T14016] usb usb2: USB disconnect, device number 1 [ 319.537082][T14016] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 319.707668][T14019] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 319.720517][T14019] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 319.726184][T14019] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 319.746829][T14019] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 319.750517][T14019] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 319.753460][T14019] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 319.756080][T14019] usb usb2: Product: EHCI Host Controller [ 319.760731][T14019] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 319.763402][T14019] usb usb2: SerialNumber: 0000:00:1d.7 [ 319.822888][T14037] netlink: 'syz.1.1869': attribute type 1 has an invalid length. [ 319.872684][T14037] bond17: entered promiscuous mode [ 319.878036][T14037] 8021q: adding VLAN 0 to HW filter on device bond17 [ 319.913508][T14072] bond17: (slave bridge15): making interface the new active one [ 319.927924][T14072] bridge15: entered promiscuous mode [ 319.946204][T14072] bond17: (slave bridge15): Enslaving as an active interface with an up link [ 320.070250][T14079] ehci-pci 0000:00:1d.7: remove, state 1 [ 320.071948][T14079] usb usb2: USB disconnect, device number 1 [ 320.085748][T14079] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 320.146558][T14081] syzkaller0: entered promiscuous mode [ 320.151057][T14081] syzkaller0: entered allmulticast mode [ 320.290499][T14079] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 320.294214][T14079] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 320.303189][T14079] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 320.332538][T14079] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 320.336419][T14079] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 320.339492][T14079] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 320.342364][T14079] usb usb2: Product: EHCI Host Controller [ 320.344197][T14079] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 320.346208][T14079] usb usb2: SerialNumber: 0000:00:1d.7 [ 320.381060][T14104] netdevsim netdevsim2: Direct firmware load for . [ 320.381060][T14104] failed with error -2 [ 320.385321][T14104] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 320.385321][T14104] [ 320.560076][T14117] siw: device registration error -23 [ 322.303131][T14140] FAULT_INJECTION: forcing a failure. [ 322.303131][T14140] name failslab, interval 1, probability 0, space 0, times 0 [ 322.307041][T14140] CPU: 0 UID: 0 PID: 14140 Comm: syz.1.1879 Tainted: G L syzkaller #0 PREEMPT(full) [ 322.307059][T14140] Tainted: [L]=SOFTLOCKUP [ 322.307063][T14140] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 322.307071][T14140] Call Trace: [ 322.307075][T14140] [ 322.307080][T14140] dump_stack_lvl+0x100/0x190 [ 322.307097][T14140] should_fail_ex.cold+0x5/0xa [ 322.307110][T14140] should_failslab+0xc2/0x120 [ 322.307127][T14140] __kmalloc_cache_noprof+0x91/0x6c0 [ 322.307139][T14140] ? alloc_pipe_info+0x10e/0x590 [ 322.307154][T14140] alloc_pipe_info+0x10e/0x590 [ 322.307167][T14140] splice_direct_to_actor+0x78f/0xa30 [ 322.307181][T14140] ? __pfx_direct_splice_actor+0x10/0x10 [ 322.307194][T14140] ? __pfx_aa_file_perm+0x10/0x10 [ 322.307213][T14140] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 322.307229][T14140] do_splice_direct+0x174/0x240 [ 322.307242][T14140] ? __pfx_do_splice_direct+0x10/0x10 [ 322.307255][T14140] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 322.307267][T14140] ? bpf_lsm_file_permission+0x9/0x10 [ 322.307278][T14140] ? security_file_permission+0x76/0x210 [ 322.307295][T14140] ? rw_verify_area+0xce/0x6d0 [ 322.307313][T14140] do_sendfile+0xadc/0xe20 [ 322.307333][T14140] ? __pfx_do_sendfile+0x10/0x10 [ 322.307351][T14140] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 322.307368][T14140] ? __fget_files+0x21f/0x3d0 [ 322.307381][T14140] __ia32_compat_sys_sendfile+0x1e5/0x220 [ 322.307395][T14140] ? fput+0x79/0x100 [ 322.307407][T14140] ? __pfx___ia32_compat_sys_sendfile+0x10/0x10 [ 322.307420][T14140] ? ksys_write+0x1ac/0x250 [ 322.307431][T14140] ? __pfx_ksys_write+0x10/0x10 [ 322.307444][T14140] __do_fast_syscall_32+0xe7/0x970 [ 322.307461][T14140] ? lockdep_hardirqs_on+0x78/0x100 [ 322.307476][T14140] do_fast_syscall_32+0x32/0x70 [ 322.307493][T14140] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 322.307507][T14140] RIP: 0023:0xf7f04fec [ 322.307522][T14140] Code: Unable to access opcode bytes at 0xf7f04fc2. [ 322.307527][T14140] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 00000000000000bb [ 322.307539][T14140] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000000005 [ 322.307547][T14140] RDX: 0000000000000000 RSI: 0000000080004700 RDI: 0000000000000000 [ 322.307553][T14140] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 322.307560][T14140] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 322.307567][T14140] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 322.307580][T14140] [ 322.561025][T14151] netlink: 'syz.1.1882': attribute type 1 has an invalid length. [ 322.592691][T14151] bond18: entered promiscuous mode [ 322.594692][T14151] 8021q: adding VLAN 0 to HW filter on device bond18 [ 322.620069][T14151] bond18: (slave bridge16): making interface the new active one [ 322.623229][T14151] bridge16: entered promiscuous mode [ 322.630944][T14151] bond18: (slave bridge16): Enslaving as an active interface with an up link [ 323.017355][T14197] netdevsim netdevsim1: Direct firmware load for . [ 323.017355][T14197] failed with error -2 [ 323.021819][T14197] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 323.021819][T14197] [ 323.205126][T14206] ehci-pci 0000:00:1d.7: remove, state 1 [ 323.207272][T14206] usb usb2: USB disconnect, device number 1 [ 323.215682][T14206] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 323.366815][ T5858] usb 8-1: new high-speed USB device number 21 using dummy_hcd [ 323.373050][T14209] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 323.374382][T14216] FAULT_INJECTION: forcing a failure. [ 323.374382][T14216] name failslab, interval 1, probability 0, space 0, times 0 [ 323.379596][T14216] CPU: 2 UID: 0 PID: 14216 Comm: syz.0.1888 Tainted: G L syzkaller #0 PREEMPT(full) [ 323.379615][T14216] Tainted: [L]=SOFTLOCKUP [ 323.379620][T14216] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 323.379627][T14216] Call Trace: [ 323.379632][T14216] [ 323.379636][T14216] dump_stack_lvl+0x100/0x190 [ 323.379669][T14216] should_fail_ex.cold+0x5/0xa [ 323.379682][T14216] should_failslab+0xc2/0x120 [ 323.379699][T14216] __kmalloc_noprof+0xfc/0x820 [ 323.379714][T14216] ? kernfs_fop_write_iter+0x26a/0x5f0 [ 323.379730][T14216] kernfs_fop_write_iter+0x26a/0x5f0 [ 323.379746][T14216] vfs_write+0x6ac/0x1050 [ 323.379757][T14216] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 323.379772][T14216] ? __pfx_vfs_write+0x10/0x10 [ 323.379782][T14216] ? find_held_lock+0x2b/0x80 [ 323.379805][T14216] ksys_write+0x12a/0x250 [ 323.379816][T14216] ? __pfx_ksys_write+0x10/0x10 [ 323.379826][T14216] ? ksys_write+0x1ac/0x250 [ 323.379836][T14216] ? __pfx_ksys_write+0x10/0x10 [ 323.379849][T14216] __do_fast_syscall_32+0xe7/0x970 [ 323.379866][T14216] ? lockdep_hardirqs_on+0x78/0x100 [ 323.379883][T14216] do_fast_syscall_32+0x32/0x70 [ 323.379899][T14216] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 323.379914][T14216] RIP: 0023:0xf70cefec [ 323.379929][T14216] Code: Unable to access opcode bytes at 0xf70cefc2. [ 323.379934][T14216] RSP: 002b:00000000f54bd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 323.379947][T14216] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000800003c0 [ 323.379954][T14216] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000000 [ 323.379961][T14216] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 323.379968][T14216] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 323.379975][T14216] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 323.379989][T14216] [ 323.380857][T14209] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 323.460738][T14209] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 323.517394][T14209] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 323.518306][ T5858] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 323.521200][T14209] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 323.522483][ T5858] usb 8-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 323.525096][T14209] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 323.529229][ T5858] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 323.532726][ T5858] usb 8-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 323.535532][T14209] usb usb2: Product: EHCI Host Controller [ 323.538127][ T5858] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.539768][T14209] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 323.542224][ T5858] usb 8-1: Product: syz [ 323.543979][T14209] usb usb2: SerialNumber: 0000:00:1d.7 [ 323.545226][ T5858] usb 8-1: Manufacturer: syz [ 323.548249][ T5858] usb 8-1: SerialNumber: syz [ 324.096856][ T845] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 324.257255][ T845] usb 7-1: Using ep0 maxpacket: 32 [ 324.266942][ T845] usb 7-1: config 0 has no interfaces? [ 324.273173][ T845] usb 7-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 324.276091][ T845] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 324.279594][ T845] usb 7-1: Product: syz [ 324.280888][ T845] usb 7-1: Manufacturer: syz [ 324.282316][ T845] usb 7-1: SerialNumber: syz [ 325.360067][T14305] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1899'. [ 326.150972][ T845] usb 8-1: USB disconnect, device number 21 [ 326.185425][T14315] netdevsim netdevsim3: Direct firmware load for . [ 326.185425][T14315] failed with error -2 [ 326.191568][T14315] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 326.191568][T14315] [ 326.726536][ T845] usb 7-1: USB disconnect, device number 22 [ 327.084628][T14340] netlink: 'syz.3.1906': attribute type 1 has an invalid length. [ 327.408343][T14340] bond16: entered promiscuous mode [ 327.410308][T14340] 8021q: adding VLAN 0 to HW filter on device bond16 [ 327.422276][T14343] bond16: (slave bridge15): making interface the new active one [ 327.424965][T14343] bridge15: entered promiscuous mode [ 327.427557][T14343] bond16: (slave bridge15): Enslaving as an active interface with an up link [ 327.661797][T14383] FAULT_INJECTION: forcing a failure. [ 327.661797][T14383] name failslab, interval 1, probability 0, space 0, times 0 [ 327.665767][T14383] CPU: 1 UID: 0 PID: 14383 Comm: syz.1.1909 Tainted: G L syzkaller #0 PREEMPT(full) [ 327.665785][T14383] Tainted: [L]=SOFTLOCKUP [ 327.665789][T14383] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 327.665797][T14383] Call Trace: [ 327.665802][T14383] [ 327.665807][T14383] dump_stack_lvl+0x100/0x190 [ 327.665825][T14383] should_fail_ex.cold+0x5/0xa [ 327.665838][T14383] should_failslab+0xc2/0x120 [ 327.665855][T14383] __kmalloc_noprof+0xfc/0x820 [ 327.665868][T14383] ? rcu_is_watching+0x12/0xc0 [ 327.665882][T14383] ? tomoyo_realpath_from_path+0xb6/0x690 [ 327.665903][T14383] tomoyo_realpath_from_path+0xb6/0x690 [ 327.665923][T14383] tomoyo_path_number_perm+0x23c/0x580 [ 327.665938][T14383] ? tomoyo_path_number_perm+0x22e/0x580 [ 327.665954][T14383] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 327.665970][T14383] ? get_pid_task+0x106/0x250 [ 327.665996][T14383] ? find_held_lock+0x2b/0x80 [ 327.666010][T14383] ? __fget_files+0x215/0x3d0 [ 327.666020][T14383] ? hook_file_ioctl_common+0x140/0x440 [ 327.666036][T14383] ? __fget_files+0x215/0x3d0 [ 327.666049][T14383] ? __fget_files+0x21f/0x3d0 [ 327.666061][T14383] security_file_ioctl_compat+0xd3/0x230 [ 327.666077][T14383] __ia32_compat_sys_ioctl+0xc2/0x360 [ 327.666096][T14383] __do_fast_syscall_32+0xe7/0x970 [ 327.666114][T14383] ? lockdep_hardirqs_on+0x78/0x100 [ 327.666130][T14383] do_fast_syscall_32+0x32/0x70 [ 327.666146][T14383] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 327.666161][T14383] RIP: 0023:0xf7f04fec [ 327.666176][T14383] Code: Unable to access opcode bytes at 0xf7f04fc2. [ 327.666181][T14383] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 327.666193][T14383] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000040047454 [ 327.666204][T14383] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 327.666211][T14383] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 327.666218][T14383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 327.666225][T14383] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 327.666239][T14383] [ 327.666244][T14383] ERROR: Out of memory at tomoyo_realpath_from_path. [ 327.761285][ T10] wg2 speed is unknown, defaulting to 1000 [ 327.770776][T14387] fuse: Unknown parameter '0000000000000000400;0' [ 327.885287][T14396] ehci-pci 0000:00:1d.7: remove, state 1 [ 327.889494][T14396] usb usb2: USB disconnect, device number 1 [ 327.906007][T14396] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 328.045194][T14407] overlayfs: missing 'lowerdir' [ 328.089009][T14416] netlink: 'syz.0.1916': attribute type 1 has an invalid length. [ 328.109509][T14416] bond10: entered promiscuous mode [ 328.112403][T14416] 8021q: adding VLAN 0 to HW filter on device bond10 [ 328.130774][T14400] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 328.137301][T14400] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 328.143441][T14400] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 328.146363][T14416] bond10: (slave bridge9): making interface the new active one [ 328.153619][T14416] bridge9: entered promiscuous mode [ 328.157757][T14400] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 328.160757][T14416] bond10: (slave bridge9): Enslaving as an active interface with an up link [ 328.168632][T14400] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 328.175630][T14400] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 328.185678][T14400] usb usb2: Product: EHCI Host Controller [ 328.197640][T14400] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 328.203147][T14400] usb usb2: SerialNumber: 0000:00:1d.7 [ 328.330022][T14453] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.448859][T14453] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.549137][T14453] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.660732][T14453] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.664589][T14493] siw: device registration error -23 [ 328.792149][T14499] oom_control is deprecated and will be removed. Please report your usecase to linux-mm-@kvack.org if you depend on this functionality. [ 328.820529][T14499] FAULT_INJECTION: forcing a failure. [ 328.820529][T14499] name failslab, interval 1, probability 0, space 0, times 0 [ 328.824638][ T5823] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.827508][T14499] CPU: 3 UID: 0 PID: 14499 Comm: syz.2.1925 Tainted: G L syzkaller #0 PREEMPT(full) [ 328.827526][T14499] Tainted: [L]=SOFTLOCKUP [ 328.827531][T14499] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 328.827537][T14499] Call Trace: [ 328.827542][T14499] [ 328.827547][T14499] dump_stack_lvl+0x100/0x190 [ 328.827564][T14499] should_fail_ex.cold+0x5/0xa [ 328.827578][T14499] should_failslab+0xc2/0x120 [ 328.827594][T14499] __kmalloc_noprof+0xfc/0x820 [ 328.827608][T14499] ? rcu_is_watching+0x12/0xc0 [ 328.827622][T14499] ? tomoyo_realpath_from_path+0xb6/0x690 [ 328.827643][T14499] tomoyo_realpath_from_path+0xb6/0x690 [ 328.827664][T14499] tomoyo_path_number_perm+0x23c/0x580 [ 328.827679][T14499] ? tomoyo_path_number_perm+0x22e/0x580 [ 328.827695][T14499] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 328.827710][T14499] ? get_pid_task+0x106/0x250 [ 328.827737][T14499] ? find_held_lock+0x2b/0x80 [ 328.827757][T14499] ? __fget_files+0x215/0x3d0 [ 328.827767][T14499] ? hook_file_ioctl_common+0x140/0x440 [ 328.827781][T14499] ? __fget_files+0x215/0x3d0 [ 328.827794][T14499] ? __fget_files+0x21f/0x3d0 [ 328.827807][T14499] security_file_ioctl_compat+0xd3/0x230 [ 328.827823][T14499] __ia32_compat_sys_ioctl+0xc2/0x360 [ 328.827842][T14499] __do_fast_syscall_32+0xe7/0x970 [ 328.827859][T14499] ? lockdep_hardirqs_on+0x78/0x100 [ 328.827875][T14499] do_fast_syscall_32+0x32/0x70 [ 328.827891][T14499] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 328.827906][T14499] RIP: 0023:0xf703efec [ 328.827921][T14499] Code: Unable to access opcode bytes at 0xf703efc2. [ 328.827927][T14499] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 328.827939][T14499] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00000000c040aed5 [ 328.827946][T14499] RDX: 0000000080000400 RSI: 0000000000000000 RDI: 0000000000000000 [ 328.827953][T14499] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 328.827960][T14499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 328.827967][T14499] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 328.827981][T14499] [ 328.827985][T14499] ERROR: Out of memory at tomoyo_realpath_from_path. [ 328.856978][ T5823] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.939063][ T5823] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.057397][ T8744] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.057651][ T6128] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 329.326997][ T61] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 329.487493][ T61] usb 6-1: Using ep0 maxpacket: 16 [ 329.498450][ T61] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 329.505178][ T61] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 329.513899][ T61] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 329.520445][ T61] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 329.526469][ T61] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 329.553413][ T61] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 329.558352][ T61] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 329.564922][ T61] usb 6-1: Manufacturer: syz [ 329.846867][ T61] usb 8-1: new high-speed USB device number 22 using dummy_hcd [ 329.986904][ T61] usb 8-1: device descriptor read/64, error -71 [ 330.236800][ T61] usb 8-1: new high-speed USB device number 23 using dummy_hcd [ 330.386776][ T61] usb 8-1: device descriptor read/64, error -71 [ 330.497221][ T61] usb usb8-port1: attempt power cycle [ 330.837336][ T61] usb 8-1: new high-speed USB device number 24 using dummy_hcd [ 330.877266][ T61] usb 8-1: device descriptor read/8, error -71 [ 331.136888][ T61] usb 8-1: new high-speed USB device number 25 using dummy_hcd [ 331.157412][ T61] usb 8-1: device descriptor read/8, error -71 [ 331.172600][T14551] ehci-pci 0000:00:1d.7: remove, state 1 [ 331.174477][T14551] usb usb2: USB disconnect, device number 1 [ 331.182022][T14551] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 331.267146][ T61] usb usb8-port1: unable to enumerate USB device [ 331.338941][T14551] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 331.342930][T14551] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 331.348421][T14551] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 331.377121][T14551] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 331.380378][T14551] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 331.383191][T14551] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 331.385756][T14551] usb usb2: Product: EHCI Host Controller [ 331.387991][T14551] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 331.390125][T14551] usb usb2: SerialNumber: 0000:00:1d.7 [ 331.568654][T14565] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1936'. [ 331.675942][T14569] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1938'. [ 332.075867][ T5895] usb 6-1: USB disconnect, device number 14 [ 332.703243][T14608] loop5: detected capacity change from 0 to 7 [ 332.732317][T14608] Dev loop5: unable to read RDB block 7 [ 332.735347][T14608] loop5: unable to read partition table [ 332.738835][T14608] loop5: partition table beyond EOD, truncated [ 332.743291][T14608] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 333.506189][T14618] FAULT_INJECTION: forcing a failure. [ 333.506189][T14618] name failslab, interval 1, probability 0, space 0, times 0 [ 333.514056][T14618] CPU: 3 UID: 0 PID: 14618 Comm: syz.1.1947 Tainted: G L syzkaller #0 PREEMPT(full) [ 333.514075][T14618] Tainted: [L]=SOFTLOCKUP [ 333.514080][T14618] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 333.514087][T14618] Call Trace: [ 333.514092][T14618] [ 333.514098][T14618] dump_stack_lvl+0x100/0x190 [ 333.514116][T14618] should_fail_ex.cold+0x5/0xa [ 333.514129][T14618] should_failslab+0xc2/0x120 [ 333.514148][T14618] __kmalloc_cache_noprof+0x91/0x6c0 [ 333.514161][T14618] ? configfs_write_iter+0x388/0x4e0 [ 333.514176][T14618] configfs_write_iter+0x388/0x4e0 [ 333.514189][T14618] vfs_write+0x6ac/0x1050 [ 333.514201][T14618] ? __pfx_configfs_write_iter+0x10/0x10 [ 333.514213][T14618] ? __pfx_vfs_write+0x10/0x10 [ 333.514223][T14618] ? find_held_lock+0x2b/0x80 [ 333.514246][T14618] ksys_write+0x12a/0x250 [ 333.514257][T14618] ? __pfx_ksys_write+0x10/0x10 [ 333.514266][T14618] ? ksys_write+0x1ac/0x250 [ 333.514277][T14618] ? __pfx_ksys_write+0x10/0x10 [ 333.514290][T14618] __do_fast_syscall_32+0xe7/0x970 [ 333.514307][T14618] ? lockdep_hardirqs_on+0x78/0x100 [ 333.514324][T14618] do_fast_syscall_32+0x32/0x70 [ 333.514341][T14618] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 333.514356][T14618] RIP: 0023:0xf7f04fec [ 333.514370][T14618] Code: Unable to access opcode bytes at 0xf7f04fc2. [ 333.514375][T14618] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 333.514387][T14618] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000b00 [ 333.514394][T14618] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 333.514401][T14618] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 333.514408][T14618] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 333.514415][T14618] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 333.514429][T14618] [ 334.078344][T14671] overlay: Unknown parameter 'smackfsfloor' [ 334.689567][T14685] ehci-pci 0000:00:1d.7: remove, state 1 [ 334.691463][T14685] usb usb2: USB disconnect, device number 1 [ 334.700969][T14685] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 334.772824][T14690] FAULT_INJECTION: forcing a failure. [ 334.772824][T14690] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 334.778301][T14690] CPU: 3 UID: 0 PID: 14690 Comm: syz.2.1959 Tainted: G L syzkaller #0 PREEMPT(full) [ 334.778327][T14690] Tainted: [L]=SOFTLOCKUP [ 334.778333][T14690] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 334.778343][T14690] Call Trace: [ 334.778349][T14690] [ 334.778356][T14690] dump_stack_lvl+0x100/0x190 [ 334.778381][T14690] should_fail_ex.cold+0x5/0xa [ 334.778401][T14690] _copy_from_user+0x2e/0xd0 [ 334.778427][T14690] get_compat_msghdr+0xb3/0x480 [ 334.778454][T14690] ? __pfx_get_compat_msghdr+0x10/0x10 [ 334.778482][T14690] ? __lock_acquire+0x49f/0x1a40 [ 334.778511][T14690] ___sys_recvmsg+0x193/0x1a0 [ 334.778534][T14690] ? __pfx____sys_recvmsg+0x10/0x10 [ 334.778571][T14690] do_recvmmsg+0x54d/0x740 [ 334.778594][T14690] ? __pfx_do_recvmmsg+0x10/0x10 [ 334.778631][T14690] ? find_held_lock+0x2b/0x80 [ 334.778651][T14690] ? ksys_write+0x190/0x250 [ 334.778671][T14690] ? ksys_write+0x190/0x250 [ 334.778695][T14690] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 334.778722][T14690] __sys_recvmmsg+0x21f/0x270 [ 334.778747][T14690] ? __pfx___sys_recvmmsg+0x10/0x10 [ 334.778772][T14690] ? ksys_write+0x1ac/0x250 [ 334.778791][T14690] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 334.778809][T14690] ? __do_fast_syscall_32+0x98/0x970 [ 334.778831][T14690] ? lockdep_hardirqs_on+0x78/0x100 [ 334.778872][T14690] __do_fast_syscall_32+0xe7/0x970 [ 334.778894][T14690] ? lockdep_hardirqs_on+0x78/0x100 [ 334.778916][T14690] do_fast_syscall_32+0x32/0x70 [ 334.778940][T14690] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 334.778961][T14690] RIP: 0023:0xf703efec [ 334.778981][T14690] Code: Unable to access opcode bytes at 0xf703efc2. [ 334.778989][T14690] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 334.779006][T14690] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800004c0 [ 334.779017][T14690] RDX: 0000000000000f02 RSI: 00000000000000f0 RDI: 0000000000000000 [ 334.779028][T14690] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 334.779038][T14690] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 334.779047][T14690] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 334.779069][T14690] [ 334.831365][T14685] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 334.875831][T14685] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 334.881664][T14685] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 334.897579][T14701] netlink: 'syz.1.1960': attribute type 1 has an invalid length. [ 334.897916][T14685] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 334.904678][T14685] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 334.910999][T14685] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 334.912053][T14701] bond19: entered promiscuous mode [ 334.913744][T14685] usb usb2: Product: EHCI Host Controller [ 334.915540][T14701] 8021q: adding VLAN 0 to HW filter on device bond19 [ 334.917908][T14685] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 334.917923][T14685] usb usb2: SerialNumber: 0000:00:1d.7 [ 334.950438][T14701] macvtap7: entered allmulticast mode [ 335.001734][T14749] fuse: Bad value for 'fd' [ 335.110519][T14773] FAULT_INJECTION: forcing a failure. [ 335.110519][T14773] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 335.114663][T14773] CPU: 3 UID: 0 PID: 14773 Comm: syz.1.1969 Tainted: G L syzkaller #0 PREEMPT(full) [ 335.114690][T14773] Tainted: [L]=SOFTLOCKUP [ 335.114696][T14773] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 335.114708][T14773] Call Trace: [ 335.114716][T14773] [ 335.114723][T14773] dump_stack_lvl+0x100/0x190 [ 335.114749][T14773] should_fail_ex.cold+0x5/0xa [ 335.114769][T14773] _copy_from_user+0x2e/0xd0 [ 335.114797][T14773] get_compat_msghdr+0xb3/0x480 [ 335.114827][T14773] ? __pfx_get_compat_msghdr+0x10/0x10 [ 335.114887][T14773] ___sys_sendmsg+0x1b6/0x1e0 [ 335.114913][T14773] ? __pfx____sys_sendmsg+0x10/0x10 [ 335.114944][T14773] ? find_held_lock+0x2b/0x80 [ 335.114979][T14773] __sys_sendmsg+0x160/0x210 [ 335.115004][T14773] ? __pfx___sys_sendmsg+0x10/0x10 [ 335.115036][T14773] ? __pfx_ksys_write+0x10/0x10 [ 335.115057][T14773] __do_fast_syscall_32+0xe7/0x970 [ 335.115075][T14773] ? lockdep_hardirqs_on+0x78/0x100 [ 335.115092][T14773] do_fast_syscall_32+0x32/0x70 [ 335.115109][T14773] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 335.115124][T14773] RIP: 0023:0xf7f04fec [ 335.115139][T14773] Code: Unable to access opcode bytes at 0xf7f04fc2. [ 335.115145][T14773] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 335.115157][T14773] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300 [ 335.115167][T14773] RDX: 0000000020004800 RSI: 0000000000000000 RDI: 0000000000000000 [ 335.115175][T14773] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 335.115182][T14773] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 335.115189][T14773] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 335.115203][T14773] [ 335.326902][ T6128] usb 8-1: new full-speed USB device number 26 using dummy_hcd [ 335.513516][T14765] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 335.519102][T14765] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 335.545589][T14765] input: syz1 as /devices/virtual/input/input11 [ 335.590241][T14765] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 335.602058][T14788] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.637655][ T8581] udevd[8581]: setting owner of /dev/input/event1 to uid=0, gid=104 failed: No such file or directory [ 335.866159][T14788] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.942663][ T6128] usb 8-1: unable to get BOS descriptor or descriptor too short [ 335.959473][ T6128] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 335.963741][ T6128] usb 8-1: can't read configurations, error -71 [ 336.003970][T14819] ehci-pci 0000:00:1d.7: remove, state 1 [ 336.008317][T14819] usb usb2: USB disconnect, device number 1 [ 336.030175][T14819] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 336.143794][T14788] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 336.178699][T14823] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 336.183084][T14823] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 336.189202][T14823] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 336.202589][T14788] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 336.316792][ T8743] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.346952][ T8743] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.350490][ T8743] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.356855][ T8743] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.716564][T14857] FAULT_INJECTION: forcing a failure. [ 336.716564][T14857] name failslab, interval 1, probability 0, space 0, times 0 [ 336.720848][T14857] CPU: 1 UID: 0 PID: 14857 Comm: syz.1.1978 Tainted: G L syzkaller #0 PREEMPT(full) [ 336.720868][T14857] Tainted: [L]=SOFTLOCKUP [ 336.720872][T14857] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 336.720880][T14857] Call Trace: [ 336.720885][T14857] [ 336.720890][T14857] dump_stack_lvl+0x100/0x190 [ 336.720909][T14857] should_fail_ex.cold+0x5/0xa [ 336.720922][T14857] should_failslab+0xc2/0x120 [ 336.720938][T14857] __kmalloc_cache_noprof+0x91/0x6c0 [ 336.720951][T14857] ? configfs_write_iter+0x388/0x4e0 [ 336.720966][T14857] configfs_write_iter+0x388/0x4e0 [ 336.720979][T14857] vfs_write+0x6ac/0x1050 [ 336.720991][T14857] ? __pfx_configfs_write_iter+0x10/0x10 [ 336.721017][T14857] ? __pfx_vfs_write+0x10/0x10 [ 336.721029][T14857] ? find_held_lock+0x2b/0x80 [ 336.721053][T14857] ksys_write+0x12a/0x250 [ 336.721064][T14857] ? __pfx_ksys_write+0x10/0x10 [ 336.721074][T14857] ? ksys_write+0x1ac/0x250 [ 336.721084][T14857] ? __pfx_ksys_write+0x10/0x10 [ 336.721098][T14857] __do_fast_syscall_32+0xe7/0x970 [ 336.721115][T14857] ? lockdep_hardirqs_on+0x78/0x100 [ 336.721131][T14857] do_fast_syscall_32+0x32/0x70 [ 336.721147][T14857] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 336.721162][T14857] RIP: 0023:0xf7f04fec [ 336.721177][T14857] Code: Unable to access opcode bytes at 0xf7f04fc2. [ 336.721183][T14857] RSP: 002b:00000000f53a550c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 336.721195][T14857] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080000b00 [ 336.721203][T14857] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 336.721209][T14857] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 336.721216][T14857] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 336.721222][T14857] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 336.721237][T14857] [ 336.807319][T14823] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 336.813294][T14823] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 336.816321][T14823] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 336.819019][T14823] usb usb2: Product: EHCI Host Controller [ 336.820917][T14823] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 336.823061][T14823] usb usb2: SerialNumber: 0000:00:1d.7 [ 337.550482][T14874] ehci-pci 0000:00:1d.7: remove, state 1 [ 337.552702][T14874] usb usb2: USB disconnect, device number 1 [ 337.560644][T14874] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 337.715773][T14874] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 337.728754][T14874] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 337.738789][T14874] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 337.756872][T14874] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 337.760799][T14874] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 337.763695][T14874] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 337.768403][T14874] usb usb2: Product: EHCI Host Controller [ 337.770825][T14874] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 337.773471][T14874] usb usb2: SerialNumber: 0000:00:1d.7 [ 337.949682][T14894] vhci_hcd: not connected 4 [ 338.049998][T14908] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 338.052137][T14908] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 338.055461][T14908] vhci_hcd vhci_hcd.0: Device attached [ 338.116369][T14909] usbip_core: unknown command [ 338.118225][T14909] vhci_hcd: unknown pdu 1835363695 [ 338.120226][T14909] usbip_core: unknown command [ 338.122243][ T8743] vhci_hcd vhci_hcd.0: stop threads [ 338.124331][ T8743] vhci_hcd vhci_hcd.0: release socket [ 338.126460][ T8743] vhci_hcd vhci_hcd.0: disconnect device [ 338.710710][T14926] [ 338.711559][T14926] ====================================================== [ 338.714038][T14926] WARNING: possible circular locking dependency detected [ 338.716449][T14926] syzkaller #0 Tainted: G L [ 338.718583][T14926] ------------------------------------------------------ [ 338.720863][T14926] syz.3.1991/14926 is trying to acquire lock: [ 338.722850][T14926] ffff88801e4ebf00 (&sb->s_type->i_mutex_key#26){++++}-{4:4}, at: configfs_depend_item_unlocked+0xf3/0x6a0 [ 338.727391][T14926] [ 338.727391][T14926] but task is already holding lock: [ 338.730404][T14926] ffff88804f378918 (&opts->dep_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x1a4/0x620 [ 338.733977][T14926] [ 338.733977][T14926] which lock already depends on the new lock. [ 338.733977][T14926] [ 338.737331][T14926] [ 338.737331][T14926] the existing dependency chain (in reverse order) is: [ 338.740333][T14926] [ 338.740333][T14926] -> #2 (&opts->dep_lock){+.+.}-{4:4}: [ 338.742745][T14926] lock_acquire+0x1b9/0x370 [ 338.744404][T14926] __mutex_lock+0x1a4/0x1bd0 [ 338.746089][T14926] tcm_set_name+0x29/0xb0 [ 338.747635][T14926] function_make+0x21c/0x3f0 [ 338.749277][T14926] configfs_mkdir+0x51e/0xb70 [ 338.750916][T14926] vfs_mkdir+0x361/0x850 [ 338.752442][T14926] filename_mkdirat+0x48b/0x5e0 [ 338.754199][T14926] __ia32_sys_mkdir+0x6a/0x90 [ 338.755880][T14926] __do_fast_syscall_32+0xe7/0x970 [ 338.757670][T14926] do_fast_syscall_32+0x32/0x70 [ 338.759371][T14926] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 338.761778][T14926] [ 338.761778][T14926] -> #1 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 338.764999][T14926] lock_acquire+0x1b9/0x370 [ 338.767093][T14926] __mutex_lock+0x1a4/0x1bd0 [ 338.769158][T14926] configfs_rmdir+0x5ae/0x950 [ 338.771000][T14926] vfs_rmdir+0x328/0x8a0 [ 338.772541][T14926] filename_rmdir+0x31a/0x5c0 [ 338.774271][T14926] __ia32_sys_rmdir+0x45/0x60 [ 338.775947][T14926] __do_fast_syscall_32+0xe7/0x970 [ 338.778241][T14926] do_fast_syscall_32+0x32/0x70 [ 338.780416][T14926] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 338.783079][T14926] [ 338.783079][T14926] -> #0 (&sb->s_type->i_mutex_key#26){++++}-{4:4}: [ 338.786166][T14926] check_prev_add+0xeb/0xe60 [ 338.787947][T14926] __lock_acquire+0x136c/0x1a40 [ 338.789798][T14926] lock_acquire+0x1b9/0x370 [ 338.791619][T14926] down_write+0x8b/0x1f0 [ 338.793352][T14926] configfs_depend_item_unlocked+0xf3/0x6a0 [ 338.795685][T14926] usbg_make_tpg+0x261/0x620 [ 338.797744][T14926] target_fabric_make_tpg+0xab/0x8c0 [ 338.799725][T14926] configfs_mkdir+0x51e/0xb70 [ 338.801364][T14926] vfs_mkdir+0x361/0x850 [ 338.802886][T14926] filename_mkdirat+0x48b/0x5e0 [ 338.804666][T14926] __ia32_sys_mkdir+0x6a/0x90 [ 338.806319][T14926] __do_fast_syscall_32+0xe7/0x970 [ 338.808110][T14926] do_fast_syscall_32+0x32/0x70 [ 338.809818][T14926] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 338.812319][T14926] [ 338.812319][T14926] other info that might help us debug this: [ 338.812319][T14926] [ 338.815811][T14926] Chain exists of: [ 338.815811][T14926] &sb->s_type->i_mutex_key#26 --> gadget_subsys.su_mutex --> &opts->dep_lock [ 338.815811][T14926] [ 338.820321][T14926] Possible unsafe locking scenario: [ 338.820321][T14926] [ 338.822646][T14926] CPU0 CPU1 [ 338.824421][T14926] ---- ---- [ 338.826106][T14926] lock(&opts->dep_lock); [ 338.827460][T14926] lock(gadget_subsys.su_mutex); [ 338.829613][T14926] lock(&opts->dep_lock); [ 338.831783][T14926] lock(&sb->s_type->i_mutex_key#26); [ 338.833621][T14926] [ 338.833621][T14926] *** DEADLOCK *** [ 338.833621][T14926] [ 338.836275][T14926] 5 locks held by syz.3.1991/14926: [ 338.837940][T14926] #0: ffff8880222bc450 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 338.841835][T14926] #1: ffff888027f2f800 (&sb->s_type->i_mutex_key#8/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 [ 338.846978][T14926] #2: ffffffff8fd8a928 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_mkdir+0x4b5/0xb70 [ 338.851892][T14926] #3: ffffffff90255c40 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x10b/0x620 [ 338.855866][T14926] #4: ffff88804f378918 (&opts->dep_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x1a4/0x620 [ 338.859638][T14926] [ 338.859638][T14926] stack backtrace: [ 338.861968][T14926] CPU: 3 UID: 0 PID: 14926 Comm: syz.3.1991 Tainted: G L syzkaller #0 PREEMPT(full) [ 338.861997][T14926] Tainted: [L]=SOFTLOCKUP [ 338.862017][T14926] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 338.862028][T14926] Call Trace: [ 338.862037][T14926] [ 338.862044][T14926] dump_stack_lvl+0x100/0x190 [ 338.862067][T14926] print_circular_bug.cold+0x178/0x1c7 [ 338.862098][T14926] check_noncircular+0x146/0x160 [ 338.862126][T14926] check_prev_add+0xeb/0xe60 [ 338.862153][T14926] __lock_acquire+0x136c/0x1a40 [ 338.862181][T14926] ? rcu_is_watching+0x12/0xc0 [ 338.862203][T14926] lock_acquire+0x1b9/0x370 [ 338.862229][T14926] ? configfs_depend_item_unlocked+0xf3/0x6a0 [ 338.862252][T14926] ? __pfx___might_resched+0x10/0x10 [ 338.862282][T14926] down_write+0x8b/0x1f0 [ 338.862309][T14926] ? configfs_depend_item_unlocked+0xf3/0x6a0 [ 338.862329][T14926] ? __pfx_down_write+0x10/0x10 [ 338.862357][T14926] configfs_depend_item_unlocked+0xf3/0x6a0 [ 338.862377][T14926] ? __lock_acquire+0x49f/0x1a40 [ 338.862407][T14926] usbg_make_tpg+0x261/0x620 [ 338.862452][T14926] ? __pfx_usbg_make_tpg+0x10/0x10 [ 338.862477][T14926] ? find_held_lock+0x2b/0x80 [ 338.862497][T14926] ? __pfx_usbg_make_tpg+0x10/0x10 [ 338.862527][T14926] target_fabric_make_tpg+0xab/0x8c0 [ 338.862555][T14926] configfs_mkdir+0x51e/0xb70 [ 338.862576][T14926] ? __pfx_target_fabric_make_tpg+0x10/0x10 [ 338.862601][T14926] ? __pfx_configfs_mkdir+0x10/0x10 [ 338.862625][T14926] vfs_mkdir+0x361/0x850 [ 338.862649][T14926] filename_mkdirat+0x48b/0x5e0 [ 338.862670][T14926] ? __pfx_filename_mkdirat+0x10/0x10 [ 338.862689][T14926] ? strncpy_from_user+0x19d/0x2d0 [ 338.862716][T14926] ? do_getname+0x191/0x390 [ 338.862739][T14926] __ia32_sys_mkdir+0x6a/0x90 [ 338.862756][T14926] __do_fast_syscall_32+0xe7/0x970 [ 338.862783][T14926] do_fast_syscall_32+0x32/0x70 [ 338.862806][T14926] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 338.862825][T14926] RIP: 0023:0xf7f67fec [ 338.862872][T14926] Code: Unable to access opcode bytes at 0xf7f67fc2. [ 338.862880][T14926] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000027 [ 338.862898][T14926] RAX: ffffffffffffffda RBX: 0000000080000600 RCX: 00000000000001ff [ 338.862909][T14926] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 338.862920][T14926] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 338.862932][T14926] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 338.862943][T14926] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 338.862957][T14926]