last executing test programs: 2m6.442015646s ago: executing program 0 (id=18417): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11000000040000000400000002"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000180)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x7d}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r1, 0x2000012, 0xe, 0x0, &(0x7f0000000280)="63ec33c9e9b98600000000000000", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 2m6.376982029s ago: executing program 0 (id=18418): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) 2m6.266179185s ago: executing program 0 (id=18427): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xc, &(0x7f0000000100), 0x4) 2m6.198279215s ago: executing program 0 (id=18421): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$nfs4(&(0x7f0000000040)='/', &(0x7f0000000080)='./file0\x00', 0x0, 0x197841, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0xc) 2m6.194067894s ago: executing program 0 (id=18423): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x4) mount$9p_virtio(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x10000, 0x0) removexattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)=@known='system.posix_acl_default\x00') 2m6.098168234s ago: executing program 2 (id=18425): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r0) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)={0x34, r1, 0x1, 0x0, 0x25dfdbfe, {}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000084}, 0x0) 2m6.098009806s ago: executing program 2 (id=18426): r0 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r0, &(0x7f0000001980)={0x28, 0x0, 0x0, @my=0x1}, 0x10) connect$vsock_stream(r0, &(0x7f0000002100)={0x28, 0x0, 0x2711, @my=0x0}, 0x10) 2m6.048286362s ago: executing program 2 (id=18428): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) 2m6.048235107s ago: executing program 0 (id=18429): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000140)=0x4) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000000)=0x5) 2m5.933154766s ago: executing program 32 (id=18429): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000140)=0x4) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000000)=0x5) 2m5.920958154s ago: executing program 2 (id=18433): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$nfs4(&(0x7f0000000040)='/', &(0x7f0000000080)='./file0\x00', 0x0, 0x197841, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0xc) 2m5.860556939s ago: executing program 2 (id=18436): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4000000010003b150c00"/20, @ANYRES32=0x0, @ANYBLOB="c1900000815c00001800128008000100677470000c00028008000200", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00g'], 0x40}}, 0x48010) 2m5.65113448s ago: executing program 2 (id=18438): madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) 2m5.571451083s ago: executing program 33 (id=18438): madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) 1m37.566718436s ago: executing program 5 (id=19328): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) 1m37.482187159s ago: executing program 5 (id=19330): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_settings={0x8, 0x4, @te1=0x0}}) ioctl$sock_netdev_private(r0, 0x8947, &(0x7f0000000000)) 1m37.415291871s ago: executing program 5 (id=19333): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff0000000002000000000000000400010008000a000008000005001e"], 0x50}}, 0x4000850) r0 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0x4924b68, 0x0) 1m37.414875038s ago: executing program 5 (id=19335): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000080), 0x12) close(r0) 1m37.360638749s ago: executing program 5 (id=19338): r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0)=0x10) link(&(0x7f0000000140)='.\x00', &(0x7f00000001c0)='./file0\x00') 1m37.2715043s ago: executing program 5 (id=19339): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000dc0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000e00)={0x14, r1, 0x1, 0x6, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x8004}, 0x20000000) 1m21.100792647s ago: executing program 34 (id=19339): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000dc0), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000e00)={0x14, r1, 0x1, 0x6, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x8004}, 0x20000000) 1m8.31764304s ago: executing program 4 (id=20187): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_EEE_GET(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000540)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abd7000fcdbdf251700000018000180140002006c6f"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x200040d4) 1m8.261909176s ago: executing program 4 (id=20191): r0 = memfd_create(&(0x7f0000000400)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\xd1x4]PZ\x9e\xd5Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\x97\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev\x15h$\x01\xdd\xe5\xce\xf8*\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xa2\xab\xf6\x84\xe0\xcf1\x9a', 0x0) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000000)='./file0\x00', 0x0) 1m8.200858257s ago: executing program 4 (id=20195): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x2) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1c00000007060500000000000000000001000002050001006f"], 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) 1m8.122142541s ago: executing program 4 (id=20199): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000080)={0x14, 0x88, 0xfa00, {r1, 0x30, 0x0, @ib={0x1b, 0x8, 0x6, {"00000000000000000000000000000001"}, 0x1119dff, 0xffffffff7fffffff, 0xcd41}}}, 0x90) 1m8.049644527s ago: executing program 4 (id=20209): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x20) unlink(&(0x7f0000000000)='./cgroup\x00') 1m7.979537456s ago: executing program 4 (id=20203): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 51.930314626s ago: executing program 35 (id=20203): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 36.580655042s ago: executing program 7 (id=21179): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448cb, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x100, 0x0) 34.610649537s ago: executing program 7 (id=21215): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000180)={'multiq3\x00', [0x100, 0x3ff, 0x1, 0x2, 0x3, 0x100, 0x1, 0x20000000, 0x8, 0x80000a, 0x0, 0x7, 0x40, 0x401, 0x9, 0x0, 0x1, 0xb30, 0xfe9, 0x400, 0x7, 0x2, 0xec, 0x9, 0x48, 0x10000, 0x7, 0x0, 0x81, 0x7, 0x8]}) 34.525175366s ago: executing program 7 (id=21220): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000004c0)={r1, 0x3, 0x6, @link_local}, 0x10) 34.368592462s ago: executing program 7 (id=21222): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$nfs4(&(0x7f0000000040)='/', &(0x7f0000000080)='./file0\x00', 0x0, 0x197841, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0x8) 34.368310525s ago: executing program 7 (id=21223): r0 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x82c02) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000240)={0x200, 0x76e6d370}) 34.102814504s ago: executing program 7 (id=21236): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)={0x14, r1, 0x1}, 0x14}}, 0x0) 34.002789573s ago: executing program 36 (id=21236): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)={0x14, r1, 0x1}, 0x14}}, 0x0) 6.210089046s ago: executing program 1 (id=22218): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xf, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000014c80020850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 6.134399725s ago: executing program 1 (id=22219): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000200)={0x14, r1, 0x1, 0x70bd2c}, 0x14}, 0x1, 0x0, 0x0, 0x884}, 0x4000004) 6.131940362s ago: executing program 1 (id=22227): syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x181603, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000040)=@e={0xff, 0xa, 0x7, 0x9, @generic=0xd, 0x10, 0x7, 0x8b}) 2.272574442s ago: executing program 1 (id=22232): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xd, &(0x7f0000000200)=@framed={{0x18, 0x2, 0x0, 0x0, 0x6}, [@call={0x85, 0x0, 0x0, 0x41}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xf15}}]}, &(0x7f0000000280)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 2.199441366s ago: executing program 1 (id=22236): syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100008e88052086800095d8b601020301090212000100000000090401"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x40402) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000140)={0x1, 0x6, 0x6, &(0x7f00000001c0)={0x17, "c955feb77e1d79a896356be7d707c8e7c7b00310dd308e527ef49847e457ebe789"}}) 558.940512ms ago: executing program 3 (id=22278): io_setup(0x9, &(0x7f00000000c0)=0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/rcu_normal', 0x20001, 0x100) io_submit(r0, 0x1, &(0x7f0000000040)=[&(0x7f0000001500)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000100)='9', 0x20000101}]) 417.749086ms ago: executing program 3 (id=22282): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010000400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100697036746e6c0000140002800600130000000000080014"], 0x44}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4000000) 356.622524ms ago: executing program 3 (id=22285): r0 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x0) io_setup(0x1, &(0x7f0000000b80)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000001a80)={0x0, 0x0, 0x0, 0x5, 0xfffc, r0, 0x0}]) 353.037448ms ago: executing program 6 (id=22286): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000001c0)={0x8, 0x8000000, 0xc}) 201.922228ms ago: executing program 3 (id=22289): r0 = userfaultfd(0x80801) setresuid(0x0, 0xee00, 0x0) cachestat(r0, &(0x7f00000001c0)={0x1, 0x10000}, 0x0, 0xee) 200.323209ms ago: executing program 6 (id=22290): r0 = msgget$private(0x0, 0x1f3) msgrcv(r0, 0x0, 0x0, 0x3, 0x2000) msgsnd(r0, &(0x7f0000000040)={0x1}, 0x8, 0x0) 200.18565ms ago: executing program 3 (id=22291): capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000540)='.log\x00', 0x1c10c1, 0x9c37611dc13d0db7) fsetxattr$security_capability(r0, &(0x7f0000000e00), &(0x7f0000000e40)=@v3={0x3000000, [{0x8, 0x9}, {0xff8, 0x3}]}, 0x18, 0x0) 136.493075ms ago: executing program 3 (id=22292): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r0, &(0x7f0000000480), 0x400000000000179, 0x0, 0x0) 133.581054ms ago: executing program 8 (id=22293): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r0, 0x0, 0x0}, 0x10) 130.334056ms ago: executing program 8 (id=22294): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x42, 0x2, 0x2}, 0x10) sendmsg$tipc(r0, &(0x7f0000000180)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x43, 0x2, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xc4040}, 0x4048804) 81.619221ms ago: executing program 6 (id=22295): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000b80), r0) sendmsg$NFC_CMD_VENDOR(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r1, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2400c000}, 0x200048c0) 81.416236ms ago: executing program 8 (id=22296): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000500000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000440)={r0}, 0xc) 80.266429ms ago: executing program 6 (id=22297): r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r1 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000240)={0x40000018}) 75.175243ms ago: executing program 8 (id=22298): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) rt_sigtimedwait(&(0x7f0000000000)={[0xe]}, 0x0, 0x0, 0x8) 57.37858ms ago: executing program 6 (id=22299): r0 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r0, 0x8) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000000)=0x8000, 0x4) 7.586182ms ago: executing program 8 (id=22300): r0 = syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) fsopen(&(0x7f00000000c0)='hfs\x00', 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 7.281474ms ago: executing program 6 (id=22301): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000a00)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd29, 0x25dfdbfe, {{@in6=@mcast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0xfffffffffffffffd}, {0x0, 0x5, 0x6}, 0x0, 0x0, 0x1, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x24008040}, 0x8000) syz_emit_ethernet(0x46, &(0x7f0000000400)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x9, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x11}, {[@ssrr={0x89, 0x7, 0xa2, [@broadcast]}, @cipso={0x86, 0x6, 0x1}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) 6.273272ms ago: executing program 8 (id=22302): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x28, r1, 0x325, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x28}}, 0x0) 0s ago: executing program 1 (id=22303): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x4) kernel console output (not intermixed with test programs): 424.058299][ T40] audit: type=1326 audit(404.538:26461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13332 comm="syz.5.19107" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa3fcc code=0x7ffc0000 [ 424.071317][ T40] audit: type=1326 audit(404.538:26462): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13332 comm="syz.5.19107" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa3fcc code=0x7ffc0000 [ 424.101843][ T40] audit: type=1326 audit(404.538:26463): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13332 comm="syz.5.19107" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa3fcc code=0x7ffc0000 [ 424.110259][ T40] audit: type=1326 audit(404.538:26464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13332 comm="syz.5.19107" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa3fcc code=0x7ffc0000 [ 424.117500][ T40] audit: type=1326 audit(404.538:26465): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13332 comm="syz.5.19107" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7fa3fcc code=0x7ffc0000 [ 424.125082][ T40] audit: type=1326 audit(404.538:26466): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13332 comm="syz.5.19107" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa3fcc code=0x7ffc0000 [ 424.132509][ T40] audit: type=1326 audit(404.538:26467): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13332 comm="syz.5.19107" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa3fcc code=0x7ffc0000 [ 424.140178][ T40] audit: type=1326 audit(404.538:26468): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13332 comm="syz.5.19107" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa3fcc code=0x7ffc0000 [ 424.147242][ T40] audit: type=1326 audit(404.538:26469): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13332 comm="syz.5.19107" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa3fcc code=0x7ffc0000 [ 424.154339][ T40] audit: type=1326 audit(404.538:26470): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13332 comm="syz.5.19107" exe="/syz-executor" sig=0 arch=40000003 syscall=148 compat=1 ip=0xf7fa3fcc code=0x7ffc0000 [ 424.756609][T13370] netlink: 28 bytes leftover after parsing attributes in process `syz.5.19121'. [ 424.796883][T13374] sg_write: data in/out 12582877/14 bytes for SCSI command 0x0-- guessing data in; [ 424.796883][T13374] program syz.1.19123 not setting count and/or reply_len properly [ 425.022019][T13394] netlink: 4 bytes leftover after parsing attributes in process `syz.4.19133'. [ 425.086022][T13400] netlink: 20 bytes leftover after parsing attributes in process `syz.4.19136'. [ 425.597217][T13440] netlink: 24 bytes leftover after parsing attributes in process `syz.1.19154'. [ 426.022173][T13489] netlink: 4 bytes leftover after parsing attributes in process `syz.4.19172'. [ 426.349364][T13510] netlink: 'syz.4.19183': attribute type 2 has an invalid length. [ 426.352641][T13510] netlink: 'syz.4.19183': attribute type 1 has an invalid length. [ 426.356023][T13510] netlink: 'syz.4.19183': attribute type 1 has an invalid length. [ 426.588897][T13524] hugetlbfs: Bad value 't1' for mount option 'nr_inodes' [ 426.588897][T13524] [ 426.646863][T13530] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 427.385326][T13612] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 428.405176][T13682] __nla_validate_parse: 3 callbacks suppressed [ 428.405194][T13682] netlink: 4 bytes leftover after parsing attributes in process `syz.4.19257'. [ 428.418051][T13682] netlink: 277 bytes leftover after parsing attributes in process `syz.4.19257'. [ 428.422531][T13682] netlink: 277 bytes leftover after parsing attributes in process `syz.4.19257'. [ 429.339779][T13697] netlink: 12 bytes leftover after parsing attributes in process `syz.1.19264'. [ 430.859743][T13792] netlink: 8 bytes leftover after parsing attributes in process `syz.5.19310'. [ 431.453174][T13838] netlink: 36 bytes leftover after parsing attributes in process `syz.5.19333'. [ 431.842847][T13867] netlink: 36 bytes leftover after parsing attributes in process `syz.1.19347'. [ 431.898427][T13873] smc: ib device syz1 ibport 1 applied user defined pnetid SYZ0 [ 431.926571][T13875] netlink: 4 bytes leftover after parsing attributes in process `syz.1.19351'. [ 432.013404][T13883] netlink: 260 bytes leftover after parsing attributes in process `syz.1.19355'. [ 432.457868][T13899] netlink: 20 bytes leftover after parsing attributes in process `syz.1.19362'. [ 433.096885][T13925] hpfs: Bad magic ... probably not HPFS [ 433.104704][T13925] hpfs: Bad magic ... probably not HPFS [ 433.391052][T13945] ucma_write: process 424 (syz.4.19384) changed security contexts after opening file descriptor, this is not allowed. [ 433.487606][T13949] nbd: must specify a size in bytes for the device [ 433.694472][T13959] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 433.852194][T13971] max out of range [ 433.923593][T13979] netlink: 'syz.1.19401': attribute type 83 has an invalid length. [ 433.999581][T13988] netlink: 8 bytes leftover after parsing attributes in process `syz.3.19406'. [ 434.078378][T13995] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 434.102118][T13998] netlink: 16 bytes leftover after parsing attributes in process `syz.4.19411'. [ 434.124701][T14001] netlink: 'syz.1.19412': attribute type 4 has an invalid length. [ 434.128444][T14001] netlink: 17 bytes leftover after parsing attributes in process `syz.1.19412'. [ 434.239388][T14010] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 434.329857][T14020] max out of range [ 434.348311][T14024] netlink: 16 bytes leftover after parsing attributes in process `syz.1.19423'. [ 434.532660][T14037] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 434.719076][ T3262] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 434.725917][ T3262] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 434.730121][ T3262] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 434.734309][ T3262] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 434.739895][ T3262] rtc rtc0: __rtc_set_alarm: err=-22 [ 435.325545][T14056] max out of range [ 435.478500][T14070] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 435.712715][ T3262] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 435.722737][ T3262] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 435.725978][ T3262] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 435.729506][ T3262] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 435.730052][ T40] kauditd_printk_skb: 4 callbacks suppressed [ 435.730062][ T40] audit: type=1800 audit(415.458:26475): pid=14100 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.19457" name="SYSV00000000" dev="tmpfs" ino=4 res=0 errno=0 [ 435.731968][ T3262] rtc rtc0: __rtc_set_alarm: err=-22 [ 435.795144][T14106] netlink: 'syz.4.19461': attribute type 2 has an invalid length. [ 436.082702][ T40] audit: type=1800 audit(415.786:26476): pid=14120 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.19468" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 436.330628][ T40] audit: type=1400 audit(416.020:26477): apparmor="DENIED" operation="change_hat" class="file" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=14134 comm="syz.4.19475" [ 436.392392][T14138] openvswitch: netlink: Invalid MD length 0 for MD type 0 [ 436.397721][T14138] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 436.418755][T14142] random: crng reseeded on system resumption [ 436.430896][T14142] Restarting kernel threads ... [ 436.446428][T14142] Done restarting kernel threads. [ 436.489288][T14147] netlink: 8 bytes leftover after parsing attributes in process `syz.3.19481'. [ 436.492840][T14147] netlink: 12 bytes leftover after parsing attributes in process `syz.3.19481'. [ 436.754476][T14167] netem: change failed [ 436.930377][T14180] binder: 14179:14180 ioctl 400c620e 80000100 returned -22 [ 437.149871][T14201] IPVS: Error connecting to the multicast addr [ 437.551051][T14217] netlink: 20 bytes leftover after parsing attributes in process `syz.1.19513'. [ 437.755482][T14222] netlink: 4 bytes leftover after parsing attributes in process `syz.1.19516'. [ 437.760533][T14222] netlink: 4 bytes leftover after parsing attributes in process `syz.1.19516'. [ 437.939533][T14238] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19523'. [ 438.228509][ T9879] udevd[9879]: inotify_add_watch(7, /dev/pmem0p13, 10) failed: No such file or directory [ 438.726768][ T40] audit: type=1326 audit(418.266:26478): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14302 comm="syz.1.19554" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf706efcc code=0x0 [ 439.492961][T14349] netlink: 'syz.3.19575': attribute type 2 has an invalid length. [ 439.701238][T14356] netlink: 'syz.3.19579': attribute type 58 has an invalid length. [ 439.708036][T14356] __nla_validate_parse: 4 callbacks suppressed [ 439.708047][T14356] netlink: 20 bytes leftover after parsing attributes in process `syz.3.19579'. [ 439.859923][T14313] syz.4.19558 (14313) used greatest stack depth: 19000 bytes left [ 439.895696][T14366] netlink: 68 bytes leftover after parsing attributes in process `syz.3.19584'. [ 440.453121][T14380] netlink: 4 bytes leftover after parsing attributes in process `syz.1.19590'. [ 440.537194][ T3262] kernel write not supported for file /dsp1 (pid: 3262 comm: kworker/2:2) [ 440.781950][T11971] kernel write not supported for file /uinput (pid: 11971 comm: kworker/0:0) [ 441.024991][T14434] netlink: 64 bytes leftover after parsing attributes in process `syz.4.19616'. [ 441.609816][T14460] warn_alloc: 1 callbacks suppressed [ 441.609829][T14460] syz.1.19628: page allocation failure: order:10, mode:0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 441.622450][T14460] CPU: 3 UID: 0 PID: 14460 Comm: syz.1.19628 Tainted: G L syzkaller #0 PREEMPT(full) [ 441.622482][T14460] Tainted: [L]=SOFTLOCKUP [ 441.622486][T14460] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 441.622492][T14460] Call Trace: [ 441.622497][T14460] [ 441.622501][T14460] dump_stack_lvl+0x100/0x190 [ 441.622518][T14460] warn_alloc.cold+0x95/0x1c1 [ 441.622530][T14460] ? __pfx_warn_alloc+0x10/0x10 [ 441.622555][T14460] ? __pfx___might_resched+0x10/0x10 [ 441.622571][T14460] __alloc_frozen_pages_noprof+0xf25/0x2bc0 [ 441.622595][T14460] ? __lock_acquire+0x4a5/0x2630 [ 441.622605][T14460] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 441.622625][T14460] ? find_held_lock+0x2b/0x80 [ 441.622643][T14460] ? find_held_lock+0x2b/0x80 [ 441.622659][T14460] ? aa_file_perm+0x7e4/0x14d0 [ 441.622672][T14460] ? aa_file_perm+0x7e4/0x14d0 [ 441.622687][T14460] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 441.622704][T14460] ? policy_nodemask+0xed/0x4f0 [ 441.622717][T14460] alloc_pages_mpol+0x1fb/0x540 [ 441.622730][T14460] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 441.622746][T14460] ? qrtr_tun_write_iter+0xc1/0x1b0 [ 441.622758][T14460] ___kmalloc_large_node+0xe5/0x120 [ 441.622773][T14460] __kmalloc_large_node_noprof+0x1c/0x70 [ 441.622788][T14460] __kmalloc_noprof+0x5be/0x850 [ 441.622801][T14460] qrtr_tun_write_iter+0xc1/0x1b0 [ 441.622814][T14460] aio_write+0x3ba/0x920 [ 441.622832][T14460] ? __pfx_aio_write+0x10/0x10 [ 441.622846][T14460] ? __lock_acquire+0x4a5/0x2630 [ 441.622864][T14460] ? __might_fault+0xc5/0x140 [ 441.622927][T14460] ? io_submit_one+0x1142/0x1fb0 [ 441.622950][T14460] io_submit_one+0x1142/0x1fb0 [ 441.622974][T14460] ? __lock_acquire+0x4a5/0x2630 [ 441.622993][T14460] ? __pfx_io_submit_one+0x10/0x10 [ 441.623023][T14460] ? __might_fault+0xc5/0x140 [ 441.623052][T14460] ? __ia32_compat_sys_io_submit+0x1a7/0x3b0 [ 441.623079][T14460] __ia32_compat_sys_io_submit+0x1a7/0x3b0 [ 441.623109][T14460] ? __pfx___ia32_compat_sys_io_submit+0x10/0x10 [ 441.623137][T14460] ? xfd_validate_state+0x129/0x190 [ 441.623163][T14460] ? rcu_is_watching+0x12/0xc0 [ 441.623188][T14460] __do_fast_syscall_32+0xe7/0x950 [ 441.623220][T14460] do_fast_syscall_32+0x32/0x70 [ 441.623246][T14460] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 441.623270][T14460] RIP: 0023:0xf706efcc [ 441.623286][T14460] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 441.623304][T14460] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 00000000000000f8 [ 441.623341][T14460] RAX: ffffffffffffffda RBX: 00000000f743f000 RCX: 0000000000000001 [ 441.623354][T14460] RDX: 0000000080000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 441.623366][T14460] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 441.623377][T14460] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 441.623389][T14460] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 441.623415][T14460] [ 441.623533][T14460] Mem-Info: [ 441.754815][T14460] active_anon:1536 inactive_anon:529 isolated_anon:0 [ 441.754815][T14460] active_file:2163 inactive_file:9940 isolated_file:0 [ 441.754815][T14460] unevictable:1768 dirty:24 writeback:0 [ 441.754815][T14460] slab_reclaimable:7109 slab_unreclaimable:64915 [ 441.754815][T14460] mapped:22238 shmem:1781 pagetables:1569 [ 441.754815][T14460] sec_pagetables:329 bounce:0 [ 441.754815][T14460] kernel_misc_reclaimable:0 [ 441.754815][T14460] free:78432 free_pcp:986 free_cma:0 [ 441.770796][T14460] Node 0 active_anon:136kB inactive_anon:92kB active_file:264kB inactive_file:2084kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:128kB dirty:16kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7960kB pagetables:1488kB sec_pagetables:1100kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 441.784896][T14460] Node 1 active_anon:6104kB inactive_anon:1920kB active_file:8388kB inactive_file:37676kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:88824kB dirty:80kB writeback:0kB shmem:3588kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:6340kB pagetables:4888kB sec_pagetables:216kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 441.811711][T14460] Node 0 DMA free:2696kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 441.827250][T14460] lowmem_reserve[]: 0 285 285 285 285 [ 441.830675][T14460] Node 0 DMA32 free:34644kB boost:18432kB min:31520kB low:34792kB high:38064kB reserved_highatomic:0KB free_highatomic:0KB active_anon:136kB inactive_anon:92kB active_file:264kB inactive_file:2084kB unevictable:3536kB writepending:16kB zspages:504kB present:1032196kB managed:292572kB mlocked:0kB bounce:0kB free_pcp:848kB local_pcp:120kB free_cma:0kB [ 441.851710][T14460] lowmem_reserve[]: 0 0 0 0 0 [ 441.853439][T14460] Node 1 DMA32 free:278812kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0KB free_highatomic:0KB active_anon:2568kB inactive_anon:5528kB active_file:4012kB inactive_file:40296kB unevictable:3536kB writepending:280kB zspages:4212kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:2364kB local_pcp:844kB free_cma:0kB [ 441.866498][T14460] lowmem_reserve[]: 0 0 0 0 0 [ 441.868209][T14460] Node 0 DMA: 38*4kB (U) 18*8kB (U) 12*16kB (U) 13*32kB (U) 2*64kB (U) 1*128kB (U) 0*256kB 1*512kB (U) 1*1024kB (U) 0*2048kB 0*4096kB = 2696kB [ 441.873033][T14460] Node 0 DMA32: 1132*4kB (UME) 675*8kB (UME) 260*16kB (UM) 298*32kB (UME) 80*64kB (UME) 29*128kB (UME) 6*256kB (UME) 1*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 34504kB [ 441.878669][T14460] Node 1 DMA32: 6586*4kB (UME) 6976*8kB (UME) 6003*16kB (UME) 557*32kB (UME) 153*64kB (UME) 48*128kB (UME) 32*256kB (UM) 105*512kB (UME) 8*1024kB (UME) 0*2048kB 0*4096kB = 282104kB [ 441.884745][T14460] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 441.887884][T14460] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 441.890946][T14460] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 441.894469][T14460] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 441.897715][T14460] 12842 total pagecache pages [ 441.899269][T14460] 723 pages in swap cache [ 441.900658][T14460] Free swap = 69540kB [ 441.901969][T14460] Total swap = 124996kB [ 441.903375][T14460] 524155 pages RAM [ 441.904578][T14460] 0 pages HighMem/MovableOnly [ 441.907316][T14460] 210119 pages reserved [ 441.908678][T14460] 0 pages cma reserved [ 441.986552][T14475] netlink: 16146 bytes leftover after parsing attributes in process `syz.3.19635'. [ 442.050638][T14477] syz.3.19637 (14477) used obsolete PPPIOCDETACH ioctl [ 442.156138][T14491] netlink: 32 bytes leftover after parsing attributes in process `syz.1.19644'. [ 442.543433][T14525] binder_alloc: binder_alloc_mmap_handler: 14524 80ffd000-81000000 already mapped failed -16 [ 443.037164][T14559] autofs: Bad value for 'fd' [ 443.200934][ T40] audit: type=1326 audit(422.458:26479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14509 comm="syz.1.19653" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efcc code=0x7fc00000 [ 443.874093][T14633] nbd: must specify a device to reconfigure [ 444.047043][T14655] netlink: 4 bytes leftover after parsing attributes in process `syz.3.19720'. [ 444.194066][T14661] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19724'. [ 444.463503][T14691] netlink: 88 bytes leftover after parsing attributes in process `syz.4.19735'. [ 444.658402][ T3262] kernel read not supported for file /vga_arbiter (pid: 3262 comm: kworker/2:2) [ 444.796706][ C1] sr 2:0:0:0: [sr0] tag#17 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 444.801054][ C1] sr 2:0:0:0: [sr0] tag#17 CDB: Regenerate(16) 82 5a 86 a5 26 a3 50 1f b1 dd 8d ff 3e 90 d6 f5 [ 445.370516][ T62] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 445.377869][ T62] Bluetooth: hci0: command 0x0c1a tx timeout [ 445.703942][T11988] kernel read not supported for file /9961/net/snmp6 (pid: 11988 comm: kworker/0:3) [ 445.759506][T14762] netlink: 'syz.3.19766': attribute type 2 has an invalid length. [ 446.361849][T14777] openvswitch: netlink: Invalid MD length 0 for MD type 0 [ 446.364349][T14777] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 446.415796][ T40] audit: type=1400 audit(425.462:26480): apparmor="DENIED" operation="change_hat" class="file" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=14781 comm="syz.3.19777" [ 446.415811][T14784] netlink: 'syz.1.19776': attribute type 58 has an invalid length. [ 446.435730][T14784] netlink: 20 bytes leftover after parsing attributes in process `syz.1.19776'. [ 446.573857][T14795] random: crng reseeded on system resumption [ 446.588250][T14795] Restarting kernel threads ... [ 446.590758][T14795] Done restarting kernel threads. [ 446.842884][T14820] netlink: 12 bytes leftover after parsing attributes in process `syz.1.19793'. [ 447.166400][T14845] netlink: 4 bytes leftover after parsing attributes in process `syz.4.19804'. [ 447.171497][T14845] netlink: 4 bytes leftover after parsing attributes in process `syz.4.19804'. [ 447.314187][ T40] audit: type=1326 audit(426.304:26481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14854 comm="syz.1.19811" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf706efcc code=0x0 [ 447.920654][ T5750] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 447.934395][ T5750] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 447.938469][ T5750] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 447.948119][ T5750] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 447.953633][ T5750] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 448.123099][T14884] netlink: 8 bytes leftover after parsing attributes in process `syz.4.19819'. [ 448.302745][ T60] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.417790][T14912] netlink: 24 bytes leftover after parsing attributes in process `syz.4.19827'. [ 448.446928][ T60] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.570304][ T60] team0: Port device netdevsim1 removed [ 448.581003][ T60] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.595433][T14869] bridge0: port 1(bridge_slave_0) entered blocking state [ 448.597980][T14869] bridge0: port 1(bridge_slave_0) entered disabled state [ 448.602714][T14869] bridge_slave_0: entered allmulticast mode [ 448.606311][T14869] bridge_slave_0: entered promiscuous mode [ 448.609960][T14869] bridge0: port 2(bridge_slave_1) entered blocking state [ 448.612398][T14869] bridge0: port 2(bridge_slave_1) entered disabled state [ 448.614944][T14869] bridge_slave_1: entered allmulticast mode [ 448.617817][T14869] bridge_slave_1: entered promiscuous mode [ 448.636734][T14869] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 448.641710][T14869] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 448.668930][T14869] team0: Port device team_slave_0 added [ 448.677192][T14869] team0: Port device team_slave_1 added [ 448.736012][ T60] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.772689][T14869] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 448.775124][T14869] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 448.783347][T14869] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 448.787838][T14869] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 448.790180][T14869] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 448.800166][T14869] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 448.842596][T14869] hsr_slave_0: entered promiscuous mode [ 448.845045][T14869] hsr_slave_1: entered promiscuous mode [ 448.847202][T14869] debugfs: 'hsr0' already exists in 'hsr' [ 448.849080][T14869] Cannot create hsr debugfs directory [ 449.004631][T14963] netlink: 'syz.3.19852': attribute type 21 has an invalid length. [ 449.011468][T14963] IPv6: NLM_F_CREATE should be specified when creating new route [ 449.020571][T14963] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 449.023723][T14963] IPv6: NLM_F_CREATE should be set when creating new route [ 449.031184][T14963] IPv6: NLM_F_CREATE should be set when creating new route [ 449.034182][T14963] IPv6: NLM_F_CREATE should be set when creating new route [ 449.049131][T14963] netlink: 'syz.3.19852': attribute type 21 has an invalid length. [ 449.052840][T14963] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 449.142711][ T60] bridge_slave_1: left allmulticast mode [ 449.144582][ T60] bridge_slave_1: left promiscuous mode [ 449.148750][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 449.163416][ T60] bridge_slave_0: left allmulticast mode [ 449.165248][ T60] bridge_slave_0: left promiscuous mode [ 449.167116][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 449.466127][ T60] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 449.481701][ T60] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 449.485879][ T60] bond0 (unregistering): Released all slaves [ 449.511038][ T5452] 8021q: adding VLAN 0 to HW filter on device eth10 [ 449.645571][T14869] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 449.689413][T14869] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 449.729545][T15024] netlink: 128 bytes leftover after parsing attributes in process `syz.4.19877'. [ 449.773899][T14869] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 449.797294][T14869] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 449.804898][T14869] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 449.815189][T14869] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 449.819065][T14869] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 449.827152][T14869] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 449.859855][ T5452] 8021q: adding VLAN 0 to HW filter on device eth11 [ 449.944258][T14869] 8021q: adding VLAN 0 to HW filter on device bond0 [ 449.958204][T14869] 8021q: adding VLAN 0 to HW filter on device team0 [ 449.966475][ T29] kernel write not supported for file /dsp1 (pid: 29 comm: kworker/1:0) [ 449.966867][T27691] bridge0: port 1(bridge_slave_0) entered blocking state [ 449.972297][T27691] bridge0: port 1(bridge_slave_0) entered forwarding state [ 449.990513][T27688] bridge0: port 2(bridge_slave_1) entered blocking state [ 449.993655][T27688] bridge0: port 2(bridge_slave_1) entered forwarding state [ 450.155764][ T5745] Bluetooth: hci4: command tx timeout [ 450.204350][ T60] hsr_slave_0: left promiscuous mode [ 450.206536][ T60] hsr_slave_1: left promiscuous mode [ 450.219296][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 450.224855][ T60] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 450.234220][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 450.237522][ T60] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 450.261296][ T60] veth1_macvtap: left promiscuous mode [ 450.265417][ T60] veth0_macvtap: left promiscuous mode [ 450.267942][ T60] veth1_vlan: left promiscuous mode [ 450.270358][ T60] veth0_vlan: left promiscuous mode [ 450.481252][ T60] team0 (unregistering): Port device team_slave_1 removed [ 450.488885][ T60] team0 (unregistering): Port device team_slave_0 removed [ 450.567097][ T5452] 8021q: adding VLAN 0 to HW filter on device eth12 [ 450.900234][T14869] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 450.908303][ T5452] 8021q: adding VLAN 0 to HW filter on device eth13 [ 450.950784][T15102] netlink: 24 bytes leftover after parsing attributes in process `syz.1.19896'. [ 451.162247][T14869] veth0_vlan: entered promiscuous mode [ 451.170447][T14869] veth1_vlan: entered promiscuous mode [ 451.189669][T14869] veth0_macvtap: entered promiscuous mode [ 451.194728][T14869] veth1_macvtap: entered promiscuous mode [ 451.203823][T14869] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 451.209513][T14869] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 451.228068][ T13] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.231305][ T13] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.239951][ T13] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.242978][ T13] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.320561][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 451.328776][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 451.385179][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 451.388442][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 451.496183][T15095] Process accounting paused [ 451.623595][T15150] can0: slcan on ptm0. [ 451.713966][T15149] can0 (unregistered): slcan off ptm0. [ 451.758060][T15164] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 451.844896][T15176] netlink: 24 bytes leftover after parsing attributes in process `syz.6.19922'. [ 452.304787][T15204] netlink: 24 bytes leftover after parsing attributes in process `syz.1.19935'. [ 452.377194][ T5745] Bluetooth: hci4: command tx timeout [ 452.471444][T15220] overlay: Unknown parameter '/6M߶}5&IG$ΆPAHB-\,Hftd&C)ZVF*kdՠQcTiw UEpΛS2 p* W~xVAg]XC4M3 !' [ 452.525776][T15224] warn_alloc: 1 callbacks suppressed [ 452.525795][T15224] syz.6.19942: page allocation failure: order:10, mode:0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 452.535729][T15224] CPU: 2 UID: 0 PID: 15224 Comm: syz.6.19942 Tainted: G L syzkaller #0 PREEMPT(full) [ 452.535769][T15224] Tainted: [L]=SOFTLOCKUP [ 452.535779][T15224] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 452.535793][T15224] Call Trace: [ 452.535803][T15224] [ 452.535813][T15224] dump_stack_lvl+0x100/0x190 [ 452.535847][T15224] warn_alloc.cold+0x95/0x1c1 [ 452.535876][T15224] ? __pfx_warn_alloc+0x10/0x10 [ 452.535931][T15224] ? __pfx___might_resched+0x10/0x10 [ 452.535967][T15224] __alloc_frozen_pages_noprof+0xf25/0x2bc0 [ 452.536024][T15224] ? __lock_acquire+0x4a5/0x2630 [ 452.536049][T15224] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 452.536088][T15224] ? find_held_lock+0x2b/0x80 [ 452.536124][T15224] ? find_held_lock+0x2b/0x80 [ 452.536152][T15224] ? aa_file_perm+0x7e4/0x14d0 [ 452.536182][T15224] ? aa_file_perm+0x7e4/0x14d0 [ 452.536215][T15224] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 452.536252][T15224] ? policy_nodemask+0xed/0x4f0 [ 452.536283][T15224] alloc_pages_mpol+0x1fb/0x540 [ 452.536313][T15224] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 452.536350][T15224] ? qrtr_tun_write_iter+0xc1/0x1b0 [ 452.536383][T15224] ___kmalloc_large_node+0xe5/0x120 [ 452.536432][T15224] __kmalloc_large_node_noprof+0x1c/0x70 [ 452.536467][T15224] __kmalloc_noprof+0x5be/0x850 [ 452.536498][T15224] qrtr_tun_write_iter+0xc1/0x1b0 [ 452.536531][T15224] aio_write+0x3ba/0x920 [ 452.536567][T15224] ? __pfx_aio_write+0x10/0x10 [ 452.536598][T15224] ? __lock_acquire+0x4a5/0x2630 [ 452.536640][T15224] ? __might_fault+0xc5/0x140 [ 452.536685][T15224] ? io_submit_one+0x1142/0x1fb0 [ 452.536716][T15224] io_submit_one+0x1142/0x1fb0 [ 452.536753][T15224] ? __lock_acquire+0x4a5/0x2630 [ 452.536781][T15224] ? __pfx_io_submit_one+0x10/0x10 [ 452.536826][T15224] ? __might_fault+0xc5/0x140 [ 452.536870][T15224] ? __ia32_compat_sys_io_submit+0x1a7/0x3b0 [ 452.536907][T15224] __ia32_compat_sys_io_submit+0x1a7/0x3b0 [ 452.536968][T15224] ? __pfx___ia32_compat_sys_io_submit+0x10/0x10 [ 452.537018][T15224] ? rcu_is_watching+0x12/0xc0 [ 452.537053][T15224] __do_fast_syscall_32+0xe7/0x950 [ 452.537097][T15224] do_fast_syscall_32+0x32/0x70 [ 452.537134][T15224] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 452.537162][T15224] RIP: 0023:0xf7f64fcc [ 452.537182][T15224] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 452.537204][T15224] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 00000000000000f8 [ 452.537227][T15224] RAX: ffffffffffffffda RBX: 00000000f7f5c000 RCX: 0000000000000001 [ 452.537242][T15224] RDX: 0000000080000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 452.537253][T15224] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 452.537264][T15224] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 452.537278][T15224] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 452.537332][T15224] [ 452.606987][T15234] netlink: 4 bytes leftover after parsing attributes in process `syz.3.19949'. [ 452.611373][T15224] Mem-Info: [ 452.675254][T15224] active_anon:1168 inactive_anon:996 isolated_anon:0 [ 452.675254][T15224] active_file:941 inactive_file:5911 isolated_file:0 [ 452.675254][T15224] unevictable:1768 dirty:255 writeback:0 [ 452.675254][T15224] slab_reclaimable:7143 slab_unreclaimable:63208 [ 452.675254][T15224] mapped:22217 shmem:1776 pagetables:1692 [ 452.675254][T15224] sec_pagetables:329 bounce:0 [ 452.675254][T15224] kernel_misc_reclaimable:0 [ 452.675254][T15224] free:85268 free_pcp:964 free_cma:0 [ 452.677636][T15234] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 452.694161][T15224] Node 0 active_anon:116kB inactive_anon:92kB active_file:264kB inactive_file:2084kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:124kB dirty:4kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8012kB pagetables:1564kB sec_pagetables:1100kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 452.717014][T15224] Node 1 active_anon:4556kB inactive_anon:3892kB active_file:3500kB inactive_file:21560kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:88844kB dirty:1016kB writeback:0kB shmem:3568kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:6600kB pagetables:5104kB sec_pagetables:216kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 452.732213][T15224] Node 0 DMA free:2696kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 452.744351][T15224] lowmem_reserve[]: 0 285 285 285 285 [ 452.747530][T15224] Node 0 DMA32 free:34712kB boost:18432kB min:31520kB low:34792kB high:38064kB reserved_highatomic:0KB free_highatomic:0KB active_anon:120kB inactive_anon:92kB active_file:264kB inactive_file:2084kB unevictable:3536kB writepending:4kB zspages:512kB present:1032196kB managed:292572kB mlocked:0kB bounce:0kB free_pcp:708kB local_pcp:348kB free_cma:0kB [ 452.761195][T15224] lowmem_reserve[]: 0 0 0 0 0 [ 452.763984][T15224] Node 1 DMA32 free:303320kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4412kB inactive_anon:3892kB active_file:3500kB inactive_file:21568kB unevictable:3536kB writepending:1048kB zspages:4804kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:4112kB local_pcp:1056kB free_cma:0kB [ 452.777525][T15224] lowmem_reserve[]: 0 0 0 0 0 [ 452.784021][T15224] Node 0 DMA: 37*4kB (U) 17*8kB (U) 13*16kB (U) 13*32kB (U) 2*64kB (U) 1*128kB (U) 0*256kB 1*512kB (U) 1*1024kB (U) 0*2048kB 0*4096kB = 2700kB [ 452.792664][T15224] Node 0 DMA32: 1122*4kB (UE) 694*8kB (UME) 263*16kB (UM) 297*32kB (UME) 80*64kB (UME) 29*128kB (UME) 6*256kB (UME) 1*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 34632kB [ 452.802368][T15224] Node 1 DMA32: 5489*4kB (UME) 6488*8kB (UME) 5568*16kB (UME) 732*32kB (UME) 164*64kB (UME) 73*128kB (UME) 57*256kB (UME) 127*512kB (UME) 15*1024kB (UM) 1*2048kB (M) 0*4096kB = 303236kB [ 452.810766][T15224] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 452.814908][T15224] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 452.819688][T15224] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 452.823786][T15224] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 452.828456][T15224] 9511 total pagecache pages [ 452.831070][T15224] 850 pages in swap cache [ 452.832989][T15224] Free swap = 68632kB [ 452.835024][T15224] Total swap = 124996kB [ 452.837701][T15224] 524155 pages RAM [ 452.839529][T15224] 0 pages HighMem/MovableOnly [ 452.841940][T15224] 210119 pages reserved [ 452.843826][T15224] 0 pages cma reserved [ 453.112551][ T40] audit: type=1326 audit(431.723:26482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15282 comm="syz.4.19972" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f46fcc code=0x7ffc0000 [ 453.136491][ T40] audit: type=1326 audit(431.723:26483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15282 comm="syz.4.19972" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f46fcc code=0x7ffc0000 [ 453.143262][ T40] audit: type=1326 audit(431.741:26484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15282 comm="syz.4.19972" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f46fcc code=0x7ffc0000 [ 453.150291][ T40] audit: type=1326 audit(431.741:26485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15282 comm="syz.4.19972" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f46fcc code=0x7ffc0000 [ 453.152189][T15285] netlink: 20 bytes leftover after parsing attributes in process `syz.6.19973'. [ 453.159775][ T40] audit: type=1326 audit(431.741:26486): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15282 comm="syz.4.19972" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f46fcc code=0x7ffc0000 [ 453.178628][ T40] audit: type=1326 audit(431.741:26487): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15282 comm="syz.4.19972" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f46fcc code=0x7ffc0000 [ 453.186704][ T40] audit: type=1326 audit(431.741:26488): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15282 comm="syz.4.19972" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f46fcc code=0x7ffc0000 [ 453.194201][ T40] audit: type=1326 audit(431.741:26489): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15282 comm="syz.4.19972" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f46fcc code=0x7ffc0000 [ 453.203934][ T40] audit: type=1326 audit(431.741:26490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15282 comm="syz.4.19972" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f46fcc code=0x7ffc0000 [ 453.211910][ T40] audit: type=1326 audit(431.751:26491): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15282 comm="syz.4.19972" exe="/syz-executor" sig=0 arch=40000003 syscall=365 compat=1 ip=0xf7f46fcc code=0x7ffc0000 [ 453.426758][T15313] bond0: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 454.610544][ T5745] Bluetooth: hci4: command tx timeout [ 454.975821][T15372] netlink: 348 bytes leftover after parsing attributes in process `syz.3.20014'. [ 455.217260][T15387] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 455.906676][ T54] usb 11-1: new full-speed USB device number 2 using dummy_hcd [ 456.113502][ T54] usb 11-1: unable to get BOS descriptor or descriptor too short [ 456.126567][ T54] usb 11-1: unable to read config index 0 descriptor/start: -71 [ 456.129572][ T54] usb 11-1: can't read configurations, error -71 [ 456.430284][T15451] vlan0: entered promiscuous mode [ 456.633850][T15469] comedi comedi1: aio_iiro_16: I/O port conflict (0x100,8) [ 456.670640][T15471] netlink: 220 bytes leftover after parsing attributes in process `syz.1.20062'. [ 456.673866][T15471] netlink: 184 bytes leftover after parsing attributes in process `syz.1.20062'. [ 456.823123][ T5745] Bluetooth: hci4: command tx timeout [ 457.172064][T15517] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 457.489717][T15548] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 457.809638][T15585] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 457.818830][T15588] netlink: 4 bytes leftover after parsing attributes in process `syz.1.20112'. [ 457.822238][T15588] netlink: 4 bytes leftover after parsing attributes in process `syz.1.20112'. [ 457.986006][T15602] netlink: 24 bytes leftover after parsing attributes in process `syz.1.20119'. [ 458.700224][T15662] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 458.704805][T11988] team_slave_0: entered promiscuous mode [ 458.708605][T11988] team_slave_1: entered promiscuous mode [ 459.333232][ T40] kauditd_printk_skb: 4 callbacks suppressed [ 459.333259][ T40] audit: type=1326 audit(437.543:26496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15638 comm="syz.3.20137" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7fc00000 [ 459.352167][ T40] audit: type=1326 audit(437.543:26497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15638 comm="syz.3.20137" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7fa2fcc code=0x7fc00000 [ 459.360163][ T40] audit: type=1326 audit(437.543:26498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15638 comm="syz.3.20137" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7fc00000 [ 459.367657][ T40] audit: type=1326 audit(437.543:26499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15638 comm="syz.3.20137" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7fc00000 [ 459.374862][ T40] audit: type=1326 audit(437.543:26500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15638 comm="syz.3.20137" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7fc00000 [ 459.383726][ T40] audit: type=1326 audit(437.543:26501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15638 comm="syz.3.20137" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7fc00000 [ 459.394161][ T40] audit: type=1326 audit(437.543:26502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15638 comm="syz.3.20137" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7fc00000 [ 459.405053][ T40] audit: type=1326 audit(437.543:26503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15638 comm="syz.3.20137" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7fc00000 [ 459.413515][ T40] audit: type=1326 audit(437.543:26504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15638 comm="syz.3.20137" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7fc00000 [ 459.798556][T15679] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.942096][T15679] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 460.108297][T15679] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 460.122416][T15705] tipc: Started in network mode [ 460.124959][T15705] tipc: Node identity e0000001, cluster identity 4711 [ 460.127992][T15705] tipc: Enabling of bearer rejected, failed to enable media [ 460.131747][T15706] netlink: 40 bytes leftover after parsing attributes in process `syz.4.20168'. [ 460.143415][T15706] netlink: 40 bytes leftover after parsing attributes in process `syz.4.20168'. [ 460.211262][T15679] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 460.349735][ T187] netdevsim netdevsim6 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.368678][ T187] netdevsim netdevsim6 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.403659][ T79] netdevsim netdevsim6 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.427176][ T187] netdevsim netdevsim6 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.873220][T15759] syz.3.20194 (15759) used greatest stack depth: 18968 bytes left [ 461.235234][T15813] sctp: [Deprecated]: syz.1.20220 (pid 15813) Use of int in max_burst socket option. [ 461.235234][T15813] Use struct sctp_assoc_value instead [ 462.167484][T15889] binder: 15888:15889 ioctl 4018620d 0 returned -22 [ 462.170956][T15889] binder: 15888:15889 ioctl c0306201 80000180 returned -11 [ 462.210658][T15891] netlink: 7060 bytes leftover after parsing attributes in process `syz.6.20254'. [ 462.628898][T15917] tipc: Started in network mode [ 462.646454][T15917] tipc: Node identity aaaaaaaaaa3a, cluster identity 4711 [ 462.652271][T15917] tipc: Enabled bearer , priority 5 [ 463.588398][T11971] usb 11-1: new high-speed USB device number 4 using dummy_hcd [ 463.666785][T15991] CUSE: unknown device info "" [ 463.668897][T15991] CUSE: unknown device info "" [ 463.671136][T15991] CUSE: unknown device info "" [ 463.673665][T15991] CUSE: unknown device info "" [ 463.675631][T15991] CUSE: unknown device info "" [ 463.677982][T15991] CUSE: unknown device info "" [ 463.679984][T15991] CUSE: unknown device info "" [ 463.682218][T15991] CUSE: unknown device info "" [ 463.684953][T15991] CUSE: unknown device info "" [ 463.687144][T15991] CUSE: unknown device info "" [ 463.689404][T15991] CUSE: unknown device info "" [ 463.691636][T15991] CUSE: unknown device info "r" [ 463.696738][T15991] CUSE: unknown device info "#" [ 463.698668][T15991] CUSE: unknown device info "" [ 463.700521][T15991] CUSE: unknown device info "" [ 463.702077][T15991] CUSE: unknown device info "" [ 463.703680][T15991] CUSE: DEVNAME unspecified [ 463.748805][T11971] usb 11-1: config index 0 descriptor too short (expected 39, got 27) [ 463.758764][T11971] usb 11-1: config 0 interface 0 altsetting 251 has an endpoint descriptor with address 0x46, changing to 0x6 [ 463.771497][T11971] usb 11-1: config 0 interface 0 altsetting 251 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 463.783928][T11971] usb 11-1: config 0 interface 0 altsetting 251 endpoint 0x6 has invalid maxpacket 8459, setting to 1024 [ 463.791184][T11971] usb 11-1: config 0 interface 0 has no altsetting 0 [ 463.796404][T11971] usb 11-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 463.801856][T11971] usb 11-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 463.805607][T11971] usb 11-1: Product: syz [ 463.807416][T11971] usb 11-1: Manufacturer: syz [ 463.809419][T11971] usb 11-1: SerialNumber: syz [ 463.821667][T11971] usb 11-1: config 0 descriptor?? [ 463.827735][T16001] netlink: 56 bytes leftover after parsing attributes in process `syz.3.20297'. [ 463.828675][T11971] hub 11-1:0.0: bad descriptor, ignoring hub [ 463.835250][T11971] hub 11-1:0.0: probe with driver hub failed with error -5 [ 463.841530][T11971] usb 11-1: selecting invalid altsetting 0 [ 463.847649][ T5851] tipc: Node number set to 9480874 [ 464.164723][T11971] usb 11-1: USB disconnect, device number 4 [ 464.635119][T16042] dvmrp1: entered allmulticast mode [ 464.638741][T16041] dvmrp1: left allmulticast mode [ 465.088511][T16070] macsec0: entered promiscuous mode [ 465.090329][T16070] dummy0: entered promiscuous mode [ 465.094546][T16070] macsec0: entered allmulticast mode [ 465.096815][T16070] dummy0: entered allmulticast mode [ 465.101607][T16070] dummy0: left allmulticast mode [ 465.103686][T16070] dummy0: left promiscuous mode [ 465.280614][T16080] block nbd1: not configured, cannot reconfigure [ 465.419254][T16093] netlink: 20 bytes leftover after parsing attributes in process `syz.6.20342'. [ 465.437066][T16093] netlink: 44 bytes leftover after parsing attributes in process `syz.6.20342'. [ 465.611275][ T40] audit: type=1326 audit(443.420:26505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16111 comm="syz.1.20351" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf706efcc code=0x0 [ 466.189809][T16141] netlink: 20 bytes leftover after parsing attributes in process `syz.6.20365'. [ 466.667333][T16180] netlink: 'syz.1.20385': attribute type 1 has an invalid length. [ 466.734143][T16186] Option ' ' to dns_resolver key: bad/missing value [ 466.974949][T16208] netlink: 20 bytes leftover after parsing attributes in process `syz.6.20399'. [ 467.037208][T16215] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20402'. [ 467.043168][T16215] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20402'. [ 467.047155][T16215] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20402'. [ 467.051680][T16215] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20402'. [ 467.164139][T16231] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 467.205507][T16236] netlink: 'syz.3.20411': attribute type 2 has an invalid length. [ 467.233889][T16239] binder: 16238:16239 ioctl c0306201 80000080 returned -22 [ 467.322290][T16247] random: crng reseeded on system resumption [ 467.507571][T16262] netlink: 20 bytes leftover after parsing attributes in process `syz.3.20425'. [ 467.716492][T16276] netlink: 'syz.3.20431': attribute type 11 has an invalid length. [ 468.684954][T16349] netlink: 'syz.3.20467': attribute type 6 has an invalid length. [ 468.687530][T16349] netlink: 'syz.3.20467': attribute type 5 has an invalid length. [ 468.759344][ T5830] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 468.930100][ T5830] usb 6-1: Using ep0 maxpacket: 8 [ 468.935635][ T5830] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 468.939287][ T5830] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 468.944735][ T5830] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 468.949404][ T5830] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 468.955087][ T5830] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 468.959307][ T5830] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 468.965707][ T5830] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 468.970081][ T5830] usb 6-1: config 168 interface 0 has no altsetting 0 [ 468.973284][ T5830] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 468.975614][ T5830] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 468.979296][ T5830] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 468.982956][ T5830] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 468.987761][ T5830] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 468.991605][ T5830] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 468.995416][ T5830] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 469.000468][ T5830] usb 6-1: config 168 interface 0 has no altsetting 0 [ 469.003698][ T5830] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 469.006358][ T5830] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 469.009859][ T5830] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 469.013495][ T5830] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 469.017923][ T5830] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 469.021579][ T5830] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 469.025335][ T5830] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 469.029814][ T5830] usb 6-1: config 168 interface 0 has no altsetting 0 [ 469.034576][ T5830] usb 6-1: string descriptor 0 read error: -22 [ 469.036677][ T5830] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 469.039782][ T5830] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.062958][ T5830] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 469.283232][ T50] usb 6-1: USB disconnect, device number 15 [ 469.656438][T11971] usb 11-1: new high-speed USB device number 5 using dummy_hcd [ 469.816772][T11971] usb 11-1: Using ep0 maxpacket: 32 [ 469.823837][T11971] usb 11-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 469.827156][T11971] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.829779][T11971] usb 11-1: Product: syz [ 469.831225][T11971] usb 11-1: Manufacturer: syz [ 469.833246][T11971] usb 11-1: SerialNumber: syz [ 469.838764][T11971] usb 11-1: config 0 descriptor?? [ 469.852487][T11971] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 469.855500][T11971] dvb-usb: bulk message failed: -22 (4/0) [ 469.857865][T11971] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 469.863096][T11971] dvb-usb: bulk message failed: -22 (5/0) [ 469.867499][T16422] xt_l2tp: invalid flags combination: 0 [ 469.871682][T11971] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 469.884407][T11971] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 469.890390][T11971] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 469.896416][T11971] usb 11-1: media controller created [ 469.909085][T11971] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 469.916204][T16424] program syz.3.20502 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 469.927259][T11971] usb 11-1: selecting invalid altsetting 3 [ 469.929562][T11971] ttusb2: set interface to alts=3 failed [ 469.955329][T11971] DVB: Unable to find symbol tda10086_attach() [ 469.958272][T11971] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 469.962422][T11971] dvb-usb: bulk message failed: -22 (4/0) [ 469.964723][T11971] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 469.968904][T11971] dvb-usb: bulk message failed: -22 (5/0) [ 469.972597][T11971] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 469.976389][T11971] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 470.067494][T16398] ttusb2: i2c rd len=58 too high [ 470.068432][T16439] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 470.072560][T11971] usb 11-1: USB disconnect, device number 5 [ 470.110724][T11971] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 470.752769][T16499] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 471.074060][T16528] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 471.076485][T16528] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 471.079821][T16528] vhci_hcd vhci_hcd.0: Device attached [ 471.344908][ T50] usb 43-1: new high-speed USB device number 2 using vhci_hcd [ 471.562703][T16556] Cannot find add_set index 46338 as target [ 471.947352][T16581] sch_tbf: peakrate 1144786952152247913 is lower than or equals to rate 14721371165588982144 ! [ 471.983822][T16586] sctp: [Deprecated]: syz.6.20579 (pid 16586) Use of struct sctp_assoc_value in delayed_ack socket option. [ 471.983822][T16586] Use struct sctp_sack_info instead [ 472.048405][T16596] [U]  [ 472.049312][T16596] [U] K{ [ 472.050833][T16596] [U] t 1ŠFfˊ`GJgo/mC [ 472.053146][T16596] [U] tؖ/,~Ĝj}8'o1"7-JQKWq5c%"H12YX``+(!(z'tXlnIgjݭp~7!" (5Ob̓J [ 472.058273][T16596] [U] k\&}66XHX .`a$40|϶9ި U4Vbz}wMTQΦr 4 [ 472.061939][T16596] [U] ".h6"k[J4In[Z(C|T]z{3c=x4w)\TXJSH{q;칢t+gd.˂>ywUhfNhl]S2\g%O&z)'pul_< ذ`ұT;_"(u{7j2X /'cIHcճV=Ai%wEs RjgrhIa6-DV i"n Asc~48c*OO5/J~wvK+3Y)Mvyq潀DTrOtpem%fejA5T_-X~^aaۂq [ 472.073508][T16596] [U] +wG?]'a: )' B>tf/<'U'hi.+]e.-ɿ%>2`^U8F.63+A«g3p6:^0tv'EtYCnrϩnPj ;Z8!\Aʖ2$­wi.#/Bai`4jdy@zgW5˿B ٜNy"vI2 [ 472.081029][T16596] [U] T_K5tYJ9c$brLNul 9w|G"ʃ%C؝q 3qN^HP*$ .7yӱ2 [ 472.085016][T16596] [U] ? h*37鍾^#Q"0~ (oX Lb,'v=CSGS0ւ`ه=1(p#2DO*Ƀ [ 472.089114][T16596] [U] sgGud-{|&2Lc_!`oz֥B%>rwSsH"yA4O.Y䏄RTԶB[+/<>{q_՝LX8U{Z)7?rR;crhײڣ1>)Măt(aϝ}9ڥJ*Mќġ'Lq DW=|q ÆW;5Ž!dBx`/E`ƦMX"\ [ 472.120700][T16596] [U] {; ٘_o2)o.2W2yx_ HPϱSD:]{ [ 472.124321][T16596] [U] I,> 51^1N4oǶ'0?֒i9w._.WaV`)Zc6GiӹaXL[F*OW)+'\n[K@2Ǭp"^` [ 472.130011][T16596] [U] 22Ʃx?0;3u [ 472.131842][T16596] [U] ޜsObx8W4(~/KUԖoQe+G-ygY_>v3.hә]̈́2)D, D~d+w; A\FPȘ|$)KؐIɿkYT^R癵A=#ܜ aet1ݯ4K.e"RS|s:>p r"z#P!KY"}FN84hޱosߙ̫%Dlwm [ 472.142964][T16596] [U] [['xn' ,mr/1D=!Dx91BwRlfKZ#` l؛˜b~m [ 472.148559][T16596] [U] L>d+d"5h3<iR=F^fnvDOIO:U>Y [ 472.152197][T16596] [U] 'B6v20瞥׌"t8{9FW]쩍 [ 472.154814][T16596] [U] 72uC6τI]8ctۨQSkYI |V'TV/g$[ 9kh`"}[^=0]%̂TF_v4C [ 472.161397][T16596] [U] ec [ 472.162780][T16596] [U] |<:^3$7nK~-@?/mtl۾Iw@g~t{P+$jp| IRipm Y 8tV,l, [ 472.169245][T16595] [U] K)0~ʪiP'fzr @B]5{ʼ'8ƥFUTqUdǩK;70c[yYCذmL8T͚5rxW xoQhVi'8L [ 473.234746][T16631] wlan0 speed is unknown, defaulting to 1000 [ 473.237727][T16631] wlan0 speed is unknown, defaulting to 1000 [ 473.239717][ T40] audit: type=1326 audit(450.560:26506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16632 comm="syz.1.20599" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efcc code=0x7ffc0000 [ 473.245814][T16631] wlan0 speed is unknown, defaulting to 1000 [ 473.249952][ T40] audit: type=1326 audit(450.560:26507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16632 comm="syz.1.20599" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efcc code=0x7ffc0000 [ 473.250603][T16631] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 473.257240][ T40] audit: type=1326 audit(450.560:26508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16632 comm="syz.1.20599" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efcc code=0x7ffc0000 [ 473.269867][ T40] audit: type=1326 audit(450.560:26509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16632 comm="syz.1.20599" exe="/syz-executor" sig=0 arch=40000003 syscall=291 compat=1 ip=0xf706efcc code=0x7ffc0000 [ 473.274113][T16631] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 473.276443][ T40] audit: type=1326 audit(450.560:26510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16632 comm="syz.1.20599" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efcc code=0x7ffc0000 [ 473.282048][T16631] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 473.290470][ T40] audit: type=1326 audit(450.560:26511): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16632 comm="syz.1.20599" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efcc code=0x7ffc0000 [ 473.299090][T16631] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 473.301000][ T40] audit: type=1326 audit(450.560:26512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16632 comm="syz.1.20599" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efcc code=0x7ffc0000 [ 473.310821][T16631] wlan0 speed is unknown, defaulting to 1000 [ 473.312002][ T40] audit: type=1326 audit(450.560:26513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16632 comm="syz.1.20599" exe="/syz-executor" sig=0 arch=40000003 syscall=292 compat=1 ip=0xf706efcc code=0x7ffc0000 [ 473.319007][T16631] wlan0 speed is unknown, defaulting to 1000 [ 473.323217][ T40] audit: type=1326 audit(450.560:26514): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16632 comm="syz.1.20599" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efcc code=0x7ffc0000 [ 473.323257][ T40] audit: type=1326 audit(450.560:26515): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16632 comm="syz.1.20599" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efcc code=0x7ffc0000 [ 473.351036][T16631] wlan0 speed is unknown, defaulting to 1000 [ 473.353946][T16631] wlan0 speed is unknown, defaulting to 1000 [ 473.733955][T16672] __nla_validate_parse: 9 callbacks suppressed [ 473.733972][T16672] netlink: 4 bytes leftover after parsing attributes in process `syz.1.20615'. [ 473.920695][T16682] hub 1-0:1.0: USB hub found [ 473.922443][T16682] hub 1-0:1.0: 2 ports detected [ 473.992171][T16688] netlink: 256 bytes leftover after parsing attributes in process `syz.1.20623'. [ 474.273729][T16529] vhci_hcd: connection reset by peer [ 474.281677][ T79] vhci_hcd vhci_hcd.3: stop threads [ 474.285606][ T79] vhci_hcd vhci_hcd.3: release socket [ 474.293392][ T79] vhci_hcd vhci_hcd.3: disconnect device [ 474.948116][T16722] netlink: 32 bytes leftover after parsing attributes in process `syz.3.20639'. [ 475.049349][T16728] netlink: 'syz.3.20642': attribute type 1 has an invalid length. [ 475.051988][T16728] netlink: 96 bytes leftover after parsing attributes in process `syz.3.20642'. [ 475.055056][T16728] netlink: 'syz.3.20642': attribute type 1 has an invalid length. [ 475.057545][T16728] netlink: 634 bytes leftover after parsing attributes in process `syz.3.20642'. [ 475.525626][T16753] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 475.998137][T16775] netlink: 24 bytes leftover after parsing attributes in process `syz.3.20665'. [ 476.078642][T16779] netlink: 4 bytes leftover after parsing attributes in process `syz.3.20667'. [ 476.143036][T16686] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 476.161721][T16781] netlink: 20 bytes leftover after parsing attributes in process `syz.3.20668'. [ 476.425670][T16801] netlink: 4 bytes leftover after parsing attributes in process `syz.1.20677'. [ 476.483058][T16806] : entered promiscuous mode [ 476.827168][ T50] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 477.097294][ T62] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 477.104837][ T62] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 477.110066][ T62] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 477.116560][ T62] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 477.122307][ T62] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 477.592728][T16852] wlan0 speed is unknown, defaulting to 1000 [ 477.722442][T16902] netlink: 4 bytes leftover after parsing attributes in process `syz.6.20719'. [ 477.858015][T16852] bridge0: port 1(bridge_slave_0) entered blocking state [ 477.861076][T16852] bridge0: port 1(bridge_slave_0) entered disabled state [ 477.864031][T16852] bridge_slave_0: entered allmulticast mode [ 477.867063][T16852] bridge_slave_0: entered promiscuous mode [ 477.870552][T16852] bridge0: port 2(bridge_slave_1) entered blocking state [ 477.873471][T16852] bridge0: port 2(bridge_slave_1) entered disabled state [ 477.876698][T16852] bridge_slave_1: entered allmulticast mode [ 477.879554][T16852] bridge_slave_1: entered promiscuous mode [ 477.901193][T16852] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 477.908024][T16852] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 477.952074][T16852] team0: Port device team_slave_0 added [ 477.962851][T16852] team0: Port device team_slave_1 added [ 478.043334][T16852] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 478.049608][T16852] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 478.060879][T16852] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 478.067438][T16852] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 478.072787][T16852] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 478.098631][T16852] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 478.187893][T16852] hsr_slave_0: entered promiscuous mode [ 478.191393][T16852] hsr_slave_1: entered promiscuous mode [ 478.194703][T16852] debugfs: 'hsr0' already exists in 'hsr' [ 478.197149][T16852] Cannot create hsr debugfs directory [ 478.410317][T16852] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 478.423769][T16852] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 478.429071][T16852] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 478.433895][T16852] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 478.437180][T16852] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 478.444771][T16852] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 478.455040][T16852] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 478.468587][T16852] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 478.541504][T16852] 8021q: adding VLAN 0 to HW filter on device bond0 [ 478.557713][T16852] 8021q: adding VLAN 0 to HW filter on device team0 [ 478.567380][ T187] bridge0: port 1(bridge_slave_0) entered blocking state [ 478.570258][ T187] bridge0: port 1(bridge_slave_0) entered forwarding state [ 478.604011][T20460] bridge0: port 2(bridge_slave_1) entered blocking state [ 478.607078][T20460] bridge0: port 2(bridge_slave_1) entered forwarding state [ 478.966244][T16852] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 479.115195][T16852] veth0_vlan: entered promiscuous mode [ 479.121014][T16852] veth1_vlan: entered promiscuous mode [ 479.138772][T16852] veth0_macvtap: entered promiscuous mode [ 479.143074][T16852] veth1_macvtap: entered promiscuous mode [ 479.155331][T16852] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 479.166012][T16852] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 479.173290][ T1237] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.183144][ T1237] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.189204][ T1237] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.195723][ T1237] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.230894][ T79] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 479.237701][ T79] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 479.277179][T20460] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 479.280702][T20460] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 479.318792][ T62] Bluetooth: hci3: command tx timeout [ 479.345019][T17020] syz.1.20762 (17020): drop_caches: 1 [ 479.365457][T17020] syz.1.20762 (17020): drop_caches: 1 [ 479.423261][T17043] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 479.427000][T17043] @0: renamed from bond_slave_1 (while UP) [ 479.776483][T17076] netlink: 'syz.6.20784': attribute type 1 has an invalid length. [ 479.850668][T17082] __nla_validate_parse: 1 callbacks suppressed [ 479.850682][T17082] netlink: 20 bytes leftover after parsing attributes in process `syz.1.20787'. [ 480.018955][T17100] binder: 17099:17100 ioctl c0306201 80000080 returned -22 [ 480.112967][T17107] Option ' ' to dns_resolver key: bad/missing value [ 480.118094][T17109] netlink: 8 bytes leftover after parsing attributes in process `syz.6.20806'. [ 480.135423][T17109] netlink: 8 bytes leftover after parsing attributes in process `syz.6.20806'. [ 480.139626][T17109] netlink: 8 bytes leftover after parsing attributes in process `syz.6.20806'. [ 480.144885][T17109] netlink: 8 bytes leftover after parsing attributes in process `syz.6.20806'. [ 480.425856][T17131] netlink: 'syz.1.20811': attribute type 2 has an invalid length. [ 480.495296][T17139] netlink: 20 bytes leftover after parsing attributes in process `syz.7.20815'. [ 481.539849][ T62] Bluetooth: hci3: command tx timeout [ 482.024788][T17148] netdevsim netdevsim1 netdevsim1 (unregistering): left allmulticast mode [ 482.032292][T17148] netdevsim netdevsim1 netdevsim1 (unregistering): left promiscuous mode [ 482.039580][T17148] bridge0: port 1(netdevsim1) entered disabled state [ 482.140641][T17206] usb usb1: usbfs: interface 0 claimed by hub while 'syz.6.20846' sets config #0 [ 482.147026][T17206] usb usb1: usbfs: interface 0 claimed by hub while 'syz.6.20846' sets config #1 [ 482.709854][T17209] : entered promiscuous mode [ 483.203550][T17246] siw: device registration error -23 [ 483.585495][T17280] Process accounting resumed [ 483.762172][ T62] Bluetooth: hci3: command tx timeout [ 483.843072][T17315] block nbd1: not configured, cannot reconfigure [ 483.956229][T17327] veth0: entered promiscuous mode [ 483.965195][T17323] veth0: left promiscuous mode [ 484.145568][T17356] netlink: 4 bytes leftover after parsing attributes in process `syz.6.20914'. [ 484.299363][T17368] CUSE: DEVNAME unspecified [ 484.908314][T17432] netlink: 16 bytes leftover after parsing attributes in process `syz.7.20946'. [ 485.023130][T17445] pim6reg: entered allmulticast mode [ 485.038165][T17445] pim6reg: left allmulticast mode [ 485.617300][T17497] ALSA: mixer_oss: invalid OSS volume '' [ 485.879796][ T3262] IPVS: starting estimator thread 0... [ 485.974874][ T62] Bluetooth: hci3: command tx timeout [ 485.985191][T17536] IPVS: using max 45 ests per chain, 108000 per kthread [ 486.356464][T17589] netlink: 12 bytes leftover after parsing attributes in process `syz.7.21002'. [ 486.522208][T17604] comedi comedi2: pcl711: I/O port conflict (0x100,16) [ 487.021626][T17667] team0: Cannot enslave team device to itself [ 487.110728][T17683] netlink: 'syz.6.21036': attribute type 12 has an invalid length. [ 487.113514][T17683] netlink: 'syz.6.21036': attribute type 29 has an invalid length. [ 487.116451][T17683] netlink: 148 bytes leftover after parsing attributes in process `syz.6.21036'. [ 487.285502][T17693] ALSA: seq fatal error: cannot create timer (-19) [ 487.409638][T17706] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.498806][ T40] kauditd_printk_skb: 14 callbacks suppressed [ 487.498821][ T40] audit: type=1326 audit(463.905:26530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17717 comm="syz.6.21046" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f64fcc code=0x0 [ 487.527788][T17706] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.622525][T17706] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.730439][T17706] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.824264][ T1158] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 487.835278][ T1237] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 487.848150][ T1158] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 487.858615][ T1158] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 488.081619][T17749] netlink: 'syz.7.21052': attribute type 1 has an invalid length. [ 488.459502][T17796] No buffer was provided with the request [ 489.202351][ T5848] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 489.382980][ T5848] usb 6-1: Using ep0 maxpacket: 32 [ 489.388798][ T5848] usb 6-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 489.392763][ T5848] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.396808][ T5848] usb 6-1: Product: syz [ 489.398648][ T5848] usb 6-1: Manufacturer: syz [ 489.400689][ T5848] usb 6-1: SerialNumber: syz [ 489.408134][ T5848] usb 6-1: config 0 descriptor?? [ 489.416653][ T5848] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 489.420506][ T5848] dvb-usb: bulk message failed: -22 (4/0) [ 489.424270][ T5848] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 489.428727][ T5848] dvb-usb: bulk message failed: -22 (5/0) [ 489.431251][ T5848] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 489.443352][ T5848] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 489.448383][ T5848] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 489.452429][ T5848] usb 6-1: media controller created [ 489.463121][ T5848] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 489.473600][ T5848] usb 6-1: selecting invalid altsetting 3 [ 489.475465][ T5848] ttusb2: set interface to alts=3 failed [ 489.492781][ T5848] DVB: Unable to find symbol tda10086_attach() [ 489.494796][ T5848] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 489.497996][ T5848] dvb-usb: bulk message failed: -22 (4/0) [ 489.500733][ T5848] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 489.510232][ T5848] dvb-usb: bulk message failed: -22 (5/0) [ 489.512686][ T5848] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 489.515859][ T5848] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 489.651453][T17830] dvb-usb: bulk message failed: -22 (7/0) [ 489.656750][T17830] ttusb2: there might have been an error during control message transfer. (rlen = 56, was 0) [ 489.664268][T17830] ttusb2: i2c transfer failed. [ 489.668553][ T24] usb 6-1: USB disconnect, device number 16 [ 489.702652][ T24] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 489.864056][T17931] netlink: 4 bytes leftover after parsing attributes in process `syz.6.21101'. [ 490.253495][T17966] Invalid source name [ 490.255156][T17966] UBIFS error (pid: 17966): cannot open "./file0", error -22 [ 490.320458][T17978] netlink: 44 bytes leftover after parsing attributes in process `syz.6.21115'. [ 490.400016][T17991] netlink: 8 bytes leftover after parsing attributes in process `syz.3.21121'. [ 490.403668][T17991] netlink: 8 bytes leftover after parsing attributes in process `syz.3.21121'. [ 490.739760][T18042] netlink: 100 bytes leftover after parsing attributes in process `syz.3.21134'. [ 492.047590][T18119] comedi comedi3: pcl816: I/O base address not correctly aligned [ 492.112264][T18140] pim6reg99999999: entered allmulticast mode [ 492.238808][T18163] comedi comedi3: pcl816: I/O base address not correctly aligned [ 492.868545][T18219] tipc: Invalid UDP bearer configuration [ 492.868586][T18219] tipc: Enabling of bearer rejected, failed to enable media [ 493.244309][T18179] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 493.247364][T18179] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 493.279856][T18243] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 493.290241][T18179] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 493.677915][T18179] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 493.682588][T18179] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 494.211987][T18179] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 494.609171][ T62] Bluetooth: hci4: command 0x0c1a tx timeout [ 494.693109][T18320] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 494.822804][ T1237] netdevsim netdevsim7 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.944117][ T1237] netdevsim netdevsim7 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.984037][ T5745] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 494.994459][ T5745] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 494.999945][ T5745] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 495.006005][ T5745] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 495.010918][ T5745] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 495.072090][ T1237] netdevsim netdevsim7 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 495.190912][T18366] usb usb3: usbfs: process 18366 (syz.1.21247) did not claim interface 0 before use [ 495.290470][ T1237] netdevsim netdevsim7 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 495.464440][T18337] wlan0 speed is unknown, defaulting to 1000 [ 495.527992][ T1237] bridge_slave_1: left allmulticast mode [ 495.529845][ T1237] bridge_slave_1: left promiscuous mode [ 495.531818][ T1237] bridge0: port 2(bridge_slave_1) entered disabled state [ 495.539630][ T1237] bridge_slave_0: left allmulticast mode [ 495.542190][T18425] netlink: 766 bytes leftover after parsing attributes in process `syz.1.21260'. [ 495.542417][ T1237] bridge_slave_0: left promiscuous mode [ 495.548317][ T1237] bridge0: port 1(bridge_slave_0) entered disabled state [ 495.750998][ T1237] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 495.778872][ T1237] bond0 (unregistering): (slave c@0): Releasing backup interface [ 495.792592][ T1237] bond0 (unregistering): Released all slaves [ 496.133131][ T5452] 8021q: adding VLAN 0 to HW filter on device eth14 [ 496.329032][T18416] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 496.333340][T18402] Bluetooth: hci0: Opcode 0x0c03 failed: -112 [ 496.341351][T18416] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 496.352653][ T1237] hsr_slave_0: left promiscuous mode [ 496.366047][ T1237] hsr_slave_1: left promiscuous mode [ 496.373355][ T1237] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 496.380328][ T1237] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 496.395617][ T1237] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 496.397885][T18506] sg_read: process 11168 (syz.1.21280) changed security contexts after opening file descriptor, this is not allowed. [ 496.398337][ T1237] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 496.444635][ T1237] veth1_macvtap: left promiscuous mode [ 496.446711][ T1237] veth0_macvtap: left promiscuous mode [ 496.448697][ T1237] veth1_vlan: left promiscuous mode [ 496.451044][ T1237] veth0_vlan: left promiscuous mode [ 496.529137][T18520] usb usb9: usbfs: process 18520 (syz.3.21286) did not claim interface 0 before use [ 496.575878][T18523] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 496.579265][T18523] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 496.582578][T18523] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 496.585949][T18523] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 496.589296][T18523] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 496.592629][T18523] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 496.596126][T18523] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 496.599751][T18523] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 497.227380][ T1237] team0 (unregistering): Port device team_slave_1 removed [ 497.243120][ T1237] team0 (unregistering): Port device team_slave_0 removed [ 497.338976][ T5452] 8021q: adding VLAN 0 to HW filter on device eth15 [ 497.512629][T18337] bridge0: port 1(bridge_slave_0) entered blocking state [ 497.525837][T18337] bridge0: port 1(bridge_slave_0) entered disabled state [ 497.528863][T18337] bridge_slave_0: entered allmulticast mode [ 497.532673][T18337] bridge_slave_0: entered promiscuous mode [ 497.537429][T18337] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.540120][T18337] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.542581][T18337] bridge_slave_1: entered allmulticast mode [ 497.545707][T18337] bridge_slave_1: entered promiscuous mode [ 497.567580][T18337] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 497.573176][ T5452] 8021q: adding VLAN 0 to HW filter on device eth16 [ 497.576843][T18337] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 497.603673][T18337] team0: Port device team_slave_0 added [ 497.618787][T18337] team0: Port device team_slave_1 added [ 497.631768][T18337] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 497.635606][T18337] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 497.643865][T18337] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 497.649737][T18337] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 497.652076][T18337] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 497.661905][T18337] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 497.687569][T18337] hsr_slave_0: entered promiscuous mode [ 497.690126][T18337] hsr_slave_1: entered promiscuous mode [ 497.692230][T18337] debugfs: 'hsr0' already exists in 'hsr' [ 497.694461][T18337] Cannot create hsr debugfs directory [ 497.744740][ T1237] IPVS: stop unused estimator thread 0... [ 497.836459][T18337] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 497.841127][T18337] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 497.844377][T18337] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 497.849866][T18337] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 497.852786][T18337] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 497.857303][T18337] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 497.861786][T18337] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 497.866921][T18337] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 497.884094][T18337] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.886456][T18337] bridge0: port 2(bridge_slave_1) entered forwarding state [ 497.888992][T18337] bridge0: port 1(bridge_slave_0) entered blocking state [ 497.891598][T18337] bridge0: port 1(bridge_slave_0) entered forwarding state [ 497.923665][T18337] 8021q: adding VLAN 0 to HW filter on device bond0 [ 497.933558][ T1237] bridge0: port 1(bridge_slave_0) entered disabled state [ 497.937347][ T1237] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.948034][ T5452] 8021q: adding VLAN 0 to HW filter on device eth17 [ 497.952618][T18337] 8021q: adding VLAN 0 to HW filter on device team0 [ 497.961221][T20460] bridge0: port 1(bridge_slave_0) entered blocking state [ 497.964428][T20460] bridge0: port 1(bridge_slave_0) entered forwarding state [ 497.974611][ T79] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.977369][ T79] bridge0: port 2(bridge_slave_1) entered forwarding state [ 498.051376][T18531] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 498.052180][T18528] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 498.061620][T18531] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 498.328580][T18337] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 498.464999][T18855] sock: sock_timestamping_bind_phc: sock not bind to device [ 498.479545][ T24] kernel read not supported for file /bluetooth/6lowpan_control (pid: 24 comm: kworker/2:0) [ 498.538179][T18337] veth0_vlan: entered promiscuous mode [ 498.547615][T18337] veth1_vlan: entered promiscuous mode [ 498.561031][T18337] veth0_macvtap: entered promiscuous mode [ 498.578013][T18337] veth1_macvtap: entered promiscuous mode [ 498.589225][T18337] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 498.590881][T18869] hugetlbfs: Bad value '' for mount option 'size' [ 498.590881][T18869] [ 498.597663][T18337] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 498.608630][ T187] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 498.623720][ T187] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 498.629450][ T1158] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 498.638242][ T1158] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 498.651422][ T40] audit: type=1326 audit(474.348:26531): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18874 comm="syz.3.21314" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7ffc0000 [ 498.678795][ T40] audit: type=1326 audit(474.348:26532): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18874 comm="syz.3.21314" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7ffc0000 [ 498.700931][ T40] audit: type=1326 audit(474.348:26533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18874 comm="syz.3.21314" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71a61ab code=0x7ffc0000 [ 498.714513][ T40] audit: type=1326 audit(474.348:26534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18874 comm="syz.3.21314" exe="/syz-executor" sig=0 arch=40000003 syscall=346 compat=1 ip=0xf7fa2fcc code=0x7ffc0000 [ 498.725490][ T40] audit: type=1326 audit(474.348:26535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18874 comm="syz.3.21314" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7fa2fcc code=0x7ffc0000 [ 498.736006][ T40] audit: type=1326 audit(474.348:26536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18874 comm="syz.3.21314" exe="/syz-executor" sig=0 arch=40000003 syscall=346 compat=1 ip=0xf7fa2fcc code=0x7ffc0000 [ 498.745804][ T40] audit: type=1326 audit(474.348:26537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18874 comm="syz.3.21314" exe="/syz-executor" sig=0 arch=40000003 syscall=6 compat=1 ip=0xf71a61ab code=0x7ffc0000 [ 498.752786][ T40] audit: type=1326 audit(474.348:26538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18874 comm="syz.3.21314" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7ffc0000 [ 498.763931][ T40] audit: type=1326 audit(474.348:26539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18874 comm="syz.3.21314" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7ffc0000 [ 498.771764][ T40] audit: type=1326 audit(474.348:26540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18874 comm="syz.3.21314" exe="/syz-executor" sig=0 arch=40000003 syscall=373 compat=1 ip=0xf7fa2fcc code=0x7ffc0000 [ 498.782493][T20460] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 498.787992][T20460] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 498.811380][T20460] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 498.817586][T20460] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 498.886983][T18903] netlink: 'syz.3.21321': attribute type 4 has an invalid length. [ 498.890381][T18903] netlink: 224 bytes leftover after parsing attributes in process `syz.3.21321'. [ 499.082467][ T187] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 499.086541][ T187] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 499.097233][ T187] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 499.101111][ T187] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 499.144156][T18945] netlink: 8 bytes leftover after parsing attributes in process `syz.1.21334'. [ 499.371006][T18975] comedi comedi3: fl512: I/O base address not correctly aligned [ 499.385341][T18977] netlink: 8 bytes leftover after parsing attributes in process `syz.6.21346'. [ 499.388567][T18977] netlink: 24 bytes leftover after parsing attributes in process `syz.6.21346'. [ 499.394357][T18977] netlink: 24 bytes leftover after parsing attributes in process `syz.6.21346'. [ 499.645039][T19009] smc: net device vcan0 applied user defined pnetid SYZ1 [ 499.662978][ T5745] Bluetooth: hci4: command 0x0c1a tx timeout [ 499.853123][T19038] pimreg3: entered allmulticast mode [ 499.897542][T19046] [U]  [ 499.899770][T19046] [U] K{ [ 499.901221][T19046] [U] T 1ŠFFˊ`GJǘGO/MC [ 499.904830][T19046] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 499.911440][T19046] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 499.915760][T19046] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 499.931155][T19046] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 499.934988][T19051] netlink: 8 bytes leftover after parsing attributes in process `syz.8.21367'. [ 499.941032][T19046] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 499.941958][T19046] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 499.953266][T19046] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<>{Q_՝LX8U{Zؐ)7?RR;CRHײڣ1>)Mă‰T(Aϝ}9ڥJ*Mќġ'LQ DWظ=|Q ÆW;5Ž!DBX`ɧ/E`Ʀ\ [ 499.985923][T19046] [U] MX"{; ե٘_O2)O.2W2ʲYX_ HPϱSD:]{Ƚ [ 499.990830][T19046] [U] I,>Ӥ 51^1N4OǶ'0?֒I9W._.WAV`)ZC6GIӹAXL[F*OW)+'\N[K@2ǬP"^` ؿ [ 500.003727][T19046] [U] 22Ʃ۩X?0;3U [ 500.006205][T19046] [U] ޜƍSOBX8W4(~/KUԖOQE+G-YGY_>V3.Hә]̈́2)D, D~D+W; A\FPȘ|$)KؐIɿKYT^RǙA=#ܜ ͿAET1ݯ4K.E"RS|ПS:>P R"Zڭ#P!KY"}FN84ܳHޱOS̫%DLWMƲ [ 500.018473][T19046] [U] [['XN' ,MR/1D=!DX91BWǻRLFK̤Z#`̑ L؛˜B~M [ 500.023086][T19046] [U] L>сD+D"5ʍH3<IR=F^FNVDOIO:U>Y [ 500.028336][T19046] [U] 'B6V20ķǞ׌"T8{9FW]̩ [ 500.031641][T19046] [U] 72މUC6τI]8CTۨQSKYI¹ |V'TV/G$[ 9KH`"ܑ}[^=0]%̂TF_V4C [ 500.048137][T19046] [U] EC [ 500.049392][T19046] [U] |<:^3$7NK~-@?/MTL۾IWȬ@G~T{P+$JP| IRIӍPM Y ڔ8TV,L, [ 500.099587][T19042] [U] K)0~ܳʪIP'FҜZR @B]5{ʼ'8ƥFUTQUDǩK;7ͪ0C[YYCذML8T͚5RXW XOQHVI'8L [ 500.630675][T19136] smc: net device vcan0 applied user defined pnetid SYZ1 [ 501.006586][T19182] netlink: 26 bytes leftover after parsing attributes in process `syz.8.21406'. [ 501.018542][T19171] wlan0 speed is unknown, defaulting to 1000 [ 501.335959][T19224] ptrace attach of "/syz-executor exec"[14869] was attempted by ""[19224] [ 501.389961][T19227] netlink: 4 bytes leftover after parsing attributes in process `syz.8.21416'. [ 501.448774][T19227] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 501.455963][T19227] team0: Device ipvlan2 is already an upper device of the team interface [ 501.767308][T19252] net_ratelimit: 5268 callbacks suppressed [ 501.767328][T19252] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 501.798431][T19260] netlink: 8 bytes leftover after parsing attributes in process `syz.8.21427'. [ 501.875516][ T5745] Bluetooth: hci4: command 0x0c1a tx timeout [ 502.310648][T19299] netlink: 72 bytes leftover after parsing attributes in process `syz.8.21438'. [ 502.320529][T19302] PKCS7: Unknown OID: [5] (bad) [ 502.322917][T19302] PKCS7: Only support pkcs7_signedData type [ 502.639613][T19345] xt_l2tp: missing protocol rule (udp|l2tpip) [ 502.876172][T19393] netlink: 8 bytes leftover after parsing attributes in process `syz.6.21474'. [ 502.883611][T19393] netlink: 8 bytes leftover after parsing attributes in process `syz.6.21474'. [ 502.946138][T19403] netlink: 8 bytes leftover after parsing attributes in process `syz.6.21477'. [ 502.950358][T19403] netlink: 4 bytes leftover after parsing attributes in process `syz.6.21477'. [ 502.953491][T19403] netlink: 'syz.6.21477': attribute type 14 has an invalid length. [ 502.956490][T19403] netlink: 'syz.6.21477': attribute type 12 has an invalid length. [ 503.050987][T19417] netlink: 'syz.6.21482': attribute type 11 has an invalid length. [ 503.056875][T19417] netlink: 'syz.6.21482': attribute type 4 has an invalid length. [ 503.061463][T19417] netlink: 199768 bytes leftover after parsing attributes in process `syz.6.21482'. [ 503.072881][T19420] netlink: 8 bytes leftover after parsing attributes in process `syz.8.21483'. [ 503.785035][T19488] overlayfs: regular lower layers cannot follow data lower layers [ 503.990978][ T50] usb 13-1: new high-speed USB device number 2 using dummy_hcd [ 504.061445][T19521] IPVS: ip_vs_add_dest(): server weight less than zero [ 504.183327][ T50] usb 13-1: Using ep0 maxpacket: 32 [ 504.190856][ T50] usb 13-1: config 0 has an invalid interface number: 67 but max is 0 [ 504.193508][ T50] usb 13-1: config 0 has no interface number 0 [ 504.198045][ T50] usb 13-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 504.201381][ T50] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.204385][ T50] usb 13-1: Product: syz [ 504.205780][ T50] usb 13-1: Manufacturer: syz [ 504.207342][ T50] usb 13-1: SerialNumber: syz [ 504.216375][ T50] usb 13-1: config 0 descriptor?? [ 504.968954][T19611] program syz.1.21546 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 505.002700][T19615] [U]  [ 505.376396][ C3] sr 2:0:0:0: [sr0] tag#13 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 505.379683][ C3] sr 2:0:0:0: [sr0] tag#13 CDB: Regenerate(16) 82 5a 86 a5 26 a3 50 1f b1 dd 8d ff 3e 90 d6 f5 [ 505.383543][T19673] comedi comedi3: comedi_test: 10 microvolt, 2046 microsecond waveform attached [ 505.528343][T19055] kernel read not supported for file /vcs (pid: 19055 comm: kworker/1:4) [ 506.036364][T19055] IPVS: starting estimator thread 0... [ 506.038280][T19765] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 506.149604][T19766] IPVS: using max 45 ests per chain, 108000 per kthread [ 506.287019][T19802] sch_fq: defrate 4294967295 ignored. [ 506.304350][T19805] tmpfs: Unknown parameter 'smackfsdef' [ 506.357170][T19812] netlink: 'syz.3.21628': attribute type 1 has an invalid length. [ 506.361714][T19812] netlink: 'syz.3.21628': attribute type 2 has an invalid length. [ 506.364962][T19812] netlink: 'syz.3.21628': attribute type 2 has an invalid length. [ 506.939327][ T50] smsc95xx 13-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 506.943351][ T50] smsc95xx 13-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 506.955694][ T50] smsc95xx 13-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 506.961115][T19868] __nla_validate_parse: 2 callbacks suppressed [ 506.961127][T19868] netlink: 16 bytes leftover after parsing attributes in process `syz.3.21648'. [ 506.963074][ T50] smsc95xx 13-1:0.67: probe with driver smsc95xx failed with error -71 [ 506.977799][ T50] usb 13-1: USB disconnect, device number 2 [ 507.048434][T19888] netlink: 'syz.8.21653': attribute type 11 has an invalid length. [ 507.887365][T19971] netlink: 32 bytes leftover after parsing attributes in process `syz.3.21690'. [ 507.890413][T19974] sctp: [Deprecated]: syz.1.21689 (pid 19974) Use of struct sctp_assoc_value in delayed_ack socket option. [ 507.890413][T19974] Use struct sctp_sack_info instead [ 507.903538][T19974] sctp: [Deprecated]: syz.1.21689 (pid 19974) Use of struct sctp_assoc_value in delayed_ack socket option. [ 507.903538][T19974] Use struct sctp_sack_info instead [ 508.392462][T20032] wlan0 speed is unknown, defaulting to 1000 [ 508.837791][T20112] syz.3.21723: page allocation failure: order:2, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 508.843468][T20112] CPU: 1 UID: 0 PID: 20112 Comm: syz.3.21723 Tainted: G L syzkaller #0 PREEMPT(full) [ 508.843499][T20112] Tainted: [L]=SOFTLOCKUP [ 508.843506][T20112] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 508.843517][T20112] Call Trace: [ 508.843523][T20112] [ 508.843531][T20112] dump_stack_lvl+0x100/0x190 [ 508.843556][T20112] warn_alloc.cold+0x95/0x1c1 [ 508.843578][T20112] ? __pfx_warn_alloc+0x10/0x10 [ 508.843613][T20112] ? __mutex_unlock_slowpath+0x15d/0x8a0 [ 508.843647][T20112] ? _mutex_trylock_nest_lock+0x170/0x310 [ 508.843686][T20112] __alloc_frozen_pages_noprof+0xf25/0x2bc0 [ 508.843732][T20112] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 508.843762][T20112] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 508.843788][T20112] ? lockdep_hardirqs_on+0x78/0x100 [ 508.843817][T20112] ? stack_depot_save_flags+0x479/0x9d0 [ 508.843843][T20112] ? comedi_isadma_alloc+0xc6/0x620 [ 508.843870][T20112] ? kasan_save_stack+0x3f/0x50 [ 508.843888][T20112] ? kasan_save_stack+0x30/0x50 [ 508.843905][T20112] ? kasan_save_track+0x14/0x30 [ 508.843922][T20112] ? __kasan_kmalloc+0xaa/0xb0 [ 508.843944][T20112] ? __do_fast_syscall_32+0xe7/0x950 [ 508.843970][T20112] ? do_fast_syscall_32+0x32/0x70 [ 508.843996][T20112] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 508.844026][T20112] __alloc_pages_noprof+0xb/0x110 [ 508.844055][T20112] __dma_direct_alloc_pages.isra.0+0x47c/0x8f0 [ 508.844088][T20112] ? __pfx___dma_direct_alloc_pages.isra.0+0x10/0x10 [ 508.844117][T20112] ? dma_alloc_from_dev_coherent+0x2e0/0x570 [ 508.844147][T20112] dma_direct_alloc+0x8f/0x590 [ 508.844174][T20112] dma_alloc_attrs+0x185/0x2b0 [ 508.844194][T20112] ? __pfx_dma_alloc_attrs+0x10/0x10 [ 508.844214][T20112] ? dma_direct_supported+0xca/0x220 [ 508.844244][T20112] comedi_isadma_alloc+0x331/0x620 [ 508.844274][T20112] ? __pfx_comedi_isadma_alloc+0x10/0x10 [ 508.844302][T20112] ? request_threaded_irq+0x27b/0x3e0 [ 508.844335][T20112] pcl818_attach+0xffa/0x17d0 [ 508.844366][T20112] comedi_device_attach+0x40e/0x6b0 [ 508.844394][T20112] do_devconfig_ioctl+0x1b3/0x6d0 [ 508.844418][T20112] ? comedi_unlocked_ioctl+0x180/0x3310 [ 508.844466][T20112] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 508.844505][T20112] ? tomoyo_path_number_perm+0x46d/0x580 [ 508.844526][T20112] ? kasan_save_stack+0x3f/0x50 [ 508.844543][T20112] ? kasan_save_stack+0x30/0x50 [ 508.844560][T20112] ? kasan_save_track+0x14/0x30 [ 508.844576][T20112] ? kasan_save_free_info+0x3b/0x70 [ 508.844613][T20112] comedi_unlocked_ioctl+0x860/0x3310 [ 508.844649][T20112] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 508.844699][T20112] ? kasan_quarantine_put+0x104/0x240 [ 508.844717][T20112] ? lockdep_hardirqs_on+0x78/0x100 [ 508.844744][T20112] ? find_held_lock+0x2b/0x80 [ 508.844768][T20112] ? tomoyo_path_number_perm+0x28f/0x580 [ 508.844787][T20112] ? tomoyo_path_number_perm+0x28f/0x580 [ 508.844811][T20112] ? tomoyo_path_number_perm+0x188/0x580 [ 508.844837][T20112] comedi_compat_ioctl+0x438/0xe20 [ 508.844867][T20112] ? __pfx_comedi_compat_ioctl+0x10/0x10 [ 508.844895][T20112] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 508.844923][T20112] ? do_vfs_ioctl+0x226/0x13e0 [ 508.844943][T20112] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 508.844970][T20112] ? find_held_lock+0x2b/0x80 [ 508.844992][T20112] ? __fget_files+0x215/0x3d0 [ 508.845011][T20112] ? hook_file_ioctl_common+0x149/0x410 [ 508.845039][T20112] ? __fget_files+0x21f/0x3d0 [ 508.845064][T20112] ? __pfx_comedi_compat_ioctl+0x10/0x10 [ 508.845093][T20112] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 508.845116][T20112] __do_fast_syscall_32+0xe7/0x950 [ 508.845149][T20112] do_fast_syscall_32+0x32/0x70 [ 508.845179][T20112] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 508.845203][T20112] RIP: 0023:0xf7fa2fcc [ 508.845219][T20112] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 508.845237][T20112] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 508.845256][T20112] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040946400 [ 508.845268][T20112] RDX: 00000000800000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 508.845279][T20112] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 508.845289][T20112] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 508.845299][T20112] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 508.845325][T20112] [ 508.845442][T20112] Mem-Info: [ 509.000437][T20112] active_anon:1034 inactive_anon:1273 isolated_anon:0 [ 509.000437][T20112] active_file:5697 inactive_file:14102 isolated_file:0 [ 509.000437][T20112] unevictable:1768 dirty:340 writeback:0 [ 509.000437][T20112] slab_reclaimable:7205 slab_unreclaimable:67142 [ 509.000437][T20112] mapped:22350 shmem:1794 pagetables:2024 [ 509.000437][T20112] sec_pagetables:335 bounce:0 [ 509.000437][T20112] kernel_misc_reclaimable:0 [ 509.000437][T20112] free:66832 free_pcp:0 free_cma:0 [ 509.016027][T20112] Node 0 active_anon:0kB inactive_anon:180kB active_file:0kB inactive_file:228kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:120kB dirty:16kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8148kB pagetables:1488kB sec_pagetables:1100kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 509.026870][T20112] Node 0 DMA free:2700kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 509.036331][T20112] lowmem_reserve[]: 0 285 285 285 285 [ 509.038117][T20112] Node 0 DMA: 37*4kB (U) 17*8kB (U) 13*16kB (U) 13*32kB (U) 2*64kB (U) 1*128kB (U) 0*256kB 1*512kB (U) 1*1024kB (U) 0*2048kB 0*4096kB = 2700kB [ 509.042995][T20112] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 509.046157][T20112] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 509.049069][T20112] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 509.052051][T20112] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 509.054958][T20112] 22818 total pagecache pages [ 509.056932][T20112] 1229 pages in swap cache [ 509.058517][T20112] Free swap = 64344kB [ 509.060007][T20112] Total swap = 124996kB [ 509.061510][T20112] 524155 pages RAM [ 509.062945][T20112] 0 pages HighMem/MovableOnly [ 509.064576][T20112] 210119 pages reserved [ 509.065927][T20112] 0 pages cma reserved [ 509.367206][T20175] netlink: 12 bytes leftover after parsing attributes in process `syz.1.21745'. [ 509.693690][T20210] CIFS: VFS: UNC: path must begin with // or \\ [ 509.696677][T20210] CIFS: VFS: Malformed UNC in devname [ 509.732569][T20213] Bluetooth: MGMT ver 1.23 [ 509.782553][ T5851] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 509.944826][ T5851] usb 6-1: config 0 has an invalid interface number: 8 but max is 0 [ 509.948461][ T5851] usb 6-1: config 0 has no interface number 0 [ 509.951188][ T5851] usb 6-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 509.956062][ T5851] usb 6-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 509.960241][ T5851] usb 6-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 509.969758][ T5851] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 509.973553][ T5851] usb 6-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 509.977630][ T5851] usb 6-1: Product: syz [ 509.979568][ T5851] usb 6-1: SerialNumber: syz [ 509.991417][ T5851] usb 6-1: config 0 descriptor?? [ 509.997400][ T5851] cm109 6-1:0.8: invalid payload size 0, expected 4 [ 510.003899][ T5851] input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.8/input/input64 [ 510.107171][T19055] kernel write not supported for file /sg0 (pid: 19055 comm: kworker/1:4) [ 510.159240][T19055] kernel write not supported for file /video8 (pid: 19055 comm: kworker/1:4) [ 510.197611][T20281] comedi comedi3: unsupported base address 0x4f23 [ 510.231788][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 510.238265][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 510.241325][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 510.244934][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 510.248470][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 510.251322][ T5851] usb 6-1: USB disconnect, device number 17 [ 510.253498][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 510.253511][ C0] cm109 6-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 510.271728][ T5851] cm109 6-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 510.441255][T20330] atomic_op ffff8880271ab998 conn xmit_atomic 0000000000000000 [ 510.490333][T20337] tipc: Enabling of bearer rejected, failed to enable media [ 510.576740][T20347] netlink: 4 bytes leftover after parsing attributes in process `syz.3.21797'. [ 510.955478][T20395] nbd: must specify an index to disconnect [ 510.967719][T20397] atomic_op ffff888053cfd198 conn xmit_atomic 0000000000000000 [ 511.263706][T20450] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 511.269535][T20350] usb 13-1: new full-speed USB device number 3 using dummy_hcd [ 511.432468][T20350] usb 13-1: config 0 has an invalid interface number: 8 but max is 0 [ 511.441429][T20350] usb 13-1: config 0 has no interface number 0 [ 511.446457][T20350] usb 13-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 511.462246][T20350] usb 13-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 511.468595][T20350] usb 13-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 511.475650][T20350] usb 13-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 511.482019][T20350] usb 13-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 511.492299][T20350] usb 13-1: Product: syz [ 511.494170][T20350] usb 13-1: SerialNumber: syz [ 511.497213][T20350] usb 13-1: config 0 descriptor?? [ 511.504467][T20350] cm109 13-1:0.8: invalid payload size 0, expected 4 [ 511.509566][T20350] input: CM109 USB driver as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:0.8/input/input65 [ 511.728880][ C3] cm109 13-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 511.729079][T19055] usb 13-1: USB disconnect, device number 3 [ 511.731863][ C3] cm109 13-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 511.744422][T19055] cm109 13-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 511.763908][T20507] netlink: 4352 bytes leftover after parsing attributes in process `syz.1.21838'. [ 511.772233][T20507] netlink: 4352 bytes leftover after parsing attributes in process `syz.1.21838'. [ 512.976382][T20571] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 513.266267][ T10] usb 11-1: new high-speed USB device number 6 using dummy_hcd [ 513.426529][ T10] usb 11-1: Using ep0 maxpacket: 16 [ 513.430487][ T10] usb 11-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 513.436220][ T10] usb 11-1: config 0 interface 0 altsetting 1 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 513.447871][ T10] usb 11-1: config 0 interface 0 altsetting 1 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 513.456584][ T10] usb 11-1: config 0 interface 0 altsetting 1 endpoint 0x8F has invalid wMaxPacketSize 0 [ 513.461746][ T10] usb 11-1: config 0 interface 0 has no altsetting 0 [ 513.467204][ T10] usb 11-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 513.474143][ T10] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.477891][ T10] usb 11-1: Product: syz [ 513.479763][ T10] usb 11-1: Manufacturer: syz [ 513.482304][ T10] usb 11-1: SerialNumber: syz [ 513.490364][ T10] usb 11-1: config 0 descriptor?? [ 513.740234][ T10] input: syz syz as /devices/platform/dummy_hcd.6/usb11/11-1/11-1:0.0/input/input66 [ 513.762676][ T5134] synaptics_usb 11-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 513.801503][ T5134] synaptics_usb 11-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 513.820391][ T5134] synaptics_usb 11-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 513.848358][ T5134] synaptics_usb 11-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 513.917685][ T9876] synaptics_usb 11-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 513.946288][ T5134] synaptics_usb 11-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 513.956156][ T5134] synaptics_usb 11-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 514.014825][T20576] synaptics_usb 11-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 514.053374][ T10] usb 11-1: USB disconnect, device number 6 [ 514.076687][T20636] netlink: 8 bytes leftover after parsing attributes in process `syz.3.21885'. [ 514.352038][T20661] netlink: 'syz.3.21890': attribute type 15 has an invalid length. [ 514.354639][T20661] netlink: 666 bytes leftover after parsing attributes in process `syz.3.21890'. [ 514.753181][T20683] xt_l2tp: wrong L2TP version: 0 [ 514.995785][T20705] netlink: 16 bytes leftover after parsing attributes in process `syz.8.21905'. [ 514.996788][T20707] netlink: 'syz.6.21904': attribute type 1 has an invalid length. [ 515.002372][T20707] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 515.649981][T20812] Process accounting paused [ 515.674321][T20816] netlink: 220 bytes leftover after parsing attributes in process `syz.1.21952'. [ 515.678348][T20816] netlink: 8 bytes leftover after parsing attributes in process `syz.1.21952'. [ 515.966193][T20860] netlink: 8 bytes leftover after parsing attributes in process `syz.3.21966'. [ 516.139154][T20881] netlink: 8 bytes leftover after parsing attributes in process `syz.6.21975'. [ 516.147089][T20881] netlink: 'syz.6.21975': attribute type 5 has an invalid length. [ 516.149972][T20881] netlink: 12 bytes leftover after parsing attributes in process `syz.6.21975'. [ 516.157246][T20881] geneve2: entered promiscuous mode [ 516.159333][T20881] geneve2: entered allmulticast mode [ 516.163403][T27688] netdevsim netdevsim6 eth0: set [1, 1] type 2 family 0 port 256 - 0 [ 516.169491][T27688] netdevsim netdevsim6 eth1: set [1, 1] type 2 family 0 port 256 - 0 [ 516.174447][T27688] netdevsim netdevsim6 eth2: set [1, 1] type 2 family 0 port 256 - 0 [ 516.178637][T27688] netdevsim netdevsim6 eth3: set [1, 1] type 2 family 0 port 256 - 0 [ 516.217165][T20889] netlink: 35 bytes leftover after parsing attributes in process `syz.6.21977'. [ 516.364740][T20903] netlink: 28 bytes leftover after parsing attributes in process `syz.3.21981'. [ 516.527196][T20921] netlink: 'syz.3.21995': attribute type 5 has an invalid length. [ 516.538202][T20921] geneve5: entered promiscuous mode [ 516.540501][T20921] geneve5: entered allmulticast mode [ 516.544201][ T1237] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 516.548210][ T1237] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 516.554115][ T1237] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 516.560440][ T1237] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 516.578587][T20929] [U] k [ 516.830449][T20954] netlink: 'syz.1.22002': attribute type 5 has an invalid length. [ 516.836668][T20954] geneve3: entered promiscuous mode [ 516.838456][T20954] geneve3: entered allmulticast mode [ 516.841005][ T79] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 516.844481][ T79] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 516.848030][ T79] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 516.851573][ T79] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 516.932230][T20963] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 516.974858][T20965] netlink: 'syz.1.22006': attribute type 3 has an invalid length. [ 518.203270][ T62] Bluetooth: hci3: command 0x1003 tx timeout [ 518.204051][ T5745] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 518.565411][T21069] netlink: 'syz.3.22044': attribute type 1 has an invalid length. [ 518.568825][T21069] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 518.869465][ T40] kauditd_printk_skb: 29 callbacks suppressed [ 518.869483][ T40] audit: type=1326 audit(493.261:26570): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21092 comm=22 exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7ffc0000 [ 518.888651][ T40] audit: type=1326 audit(493.261:26571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21092 comm=22 exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7ffc0000 [ 518.907399][ T40] audit: type=1326 audit(493.261:26572): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21092 comm="syz.3.22054" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7ffc0000 [ 518.921029][ T40] audit: type=1326 audit(493.261:26573): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21092 comm="syz.3.22054" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7ffc0000 [ 518.929511][ T40] audit: type=1326 audit(493.261:26574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21092 comm=22 exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf7fa2fcc code=0x7ffc0000 [ 518.936821][ T40] audit: type=1326 audit(493.261:26575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21092 comm=22 exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf71a61ab code=0x7ffc0000 [ 518.945656][ T40] audit: type=1326 audit(493.261:26576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21092 comm=22 exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf71a61ab code=0x7ffc0000 [ 518.955820][ T40] audit: type=1326 audit(493.261:26577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21092 comm=22 exe="/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf71a61ab code=0x7ffc0000 [ 518.963510][ T40] audit: type=1326 audit(493.261:26578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21092 comm=22 exe="/syz-executor" sig=0 arch=40000003 syscall=6 compat=1 ip=0xf71a61ab code=0x7ffc0000 [ 518.972917][ T40] audit: type=1326 audit(493.261:26579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21092 comm=22 exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa2fcc code=0x7ffc0000 [ 519.051391][T21113] netlink: 'syz.6.22062': attribute type 1 has an invalid length. [ 519.326130][T21142] comedi comedi2: dt2801: I/O base address or length out of range [ 519.386532][ T3262] kernel read not supported for file /media0 (pid: 3262 comm: kworker/2:2) [ 519.499740][T21165] __nla_validate_parse: 6 callbacks suppressed [ 519.499759][T21165] netlink: 4 bytes leftover after parsing attributes in process `syz.6.22082'. [ 519.600515][T21181] program syz.8.22088 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 520.272667][T21272] netlink: 24 bytes leftover after parsing attributes in process `syz.3.22123'. [ 520.700246][T21330] [U] V3Fپ"S/4:XTZWTLW= [ 520.709635][T21330] [U] J"E:" [ 520.819323][T21345] netlink: 24 bytes leftover after parsing attributes in process `syz.3.22134'. [ 521.011994][T21378] overlayfs: only single ':' or double '::' sequences of unescaped colons in lowerdir mount option allowed. [ 521.316597][T21424] tipc: Enabling of bearer rejected, media not registered [ 521.569809][T21470] devpts: Bad value for 'max' [ 521.645455][T21483] overlayfs: only single ':' or double '::' sequences of unescaped colons in lowerdir mount option allowed. [ 521.921294][T21515] overlayfs: only single ':' or double '::' sequences of unescaped colons in lowerdir mount option allowed. [ 522.101774][T21534] netlink: 12 bytes leftover after parsing attributes in process `syz.8.22202'. [ 522.217609][T11988] hid_parser_main: 24 callbacks suppressed [ 522.217629][T11988] hid-generic 000F:FFFFFFFA:0009.0004: unknown main item tag 0x5 [ 522.235549][T11988] hid-generic 000F:FFFFFFFA:0009.0004: hidraw1: HID v0.02 Device [syz0] on syz1 [ 522.349827][T21565] netlink: 20 bytes leftover after parsing attributes in process `syz.1.22211'. [ 522.353062][T21565] netlink: 20 bytes leftover after parsing attributes in process `syz.1.22211'. [ 522.382364][T21560] fido_id[21560]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 523.022637][T11988] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 523.184660][T11988] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 523.189243][T11988] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 523.193408][T11988] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 523.197335][T11988] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 523.203684][T21588] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 523.210386][T11988] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 523.509533][T20350] usb 6-1: USB disconnect, device number 18 [ 526.933732][T11988] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 527.094373][T11988] usb 6-1: Using ep0 maxpacket: 32 [ 527.097939][T11988] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 527.100617][T11988] usb 6-1: config 0 has no interface number 0 [ 527.104405][T11988] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 527.108101][T11988] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.110679][T11988] usb 6-1: Product: syz [ 527.112149][T11988] usb 6-1: Manufacturer: syz [ 527.113708][T11988] usb 6-1: SerialNumber: syz [ 527.119116][T11988] usb 6-1: config 0 descriptor?? [ 527.126670][T11988] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 527.129696][T11988] usb 6-1: selecting invalid altsetting 1 [ 527.131544][T11988] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 527.135121][T11988] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 527.139580][T11988] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 527.144395][T11988] usb 6-1: media controller created [ 527.152286][T11988] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 527.286358][ T5851] usb 13-1: new high-speed USB device number 4 using dummy_hcd [ 527.448082][ T5851] usb 13-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x19, changing to 0x9 [ 527.452038][ T5851] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 527.457785][ T5851] usb 13-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 527.461082][ T5851] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.463881][ T5851] usb 13-1: Product: syz [ 527.465682][ T5851] usb 13-1: Manufacturer: syz [ 527.467592][ T5851] usb 13-1: SerialNumber: syz [ 527.472288][ T5851] usb 13-1: config 0 descriptor?? [ 527.744144][T12168] hid-generic 0007:0001:FFFFFFFF.0005: unknown main item tag 0x0 [ 527.747983][T12168] hid-generic 0007:0001:FFFFFFFF.0005: unknown main item tag 0x0 [ 527.750626][T12168] hid-generic 0007:0001:FFFFFFFF.0005: unknown main item tag 0x0 [ 527.753551][T12168] hid-generic 0007:0001:FFFFFFFF.0005: unknown main item tag 0x0 [ 527.757175][T12168] hid-generic 0007:0001:FFFFFFFF.0005: unknown main item tag 0x0 [ 527.760237][T12168] hid-generic 0007:0001:FFFFFFFF.0005: unknown main item tag 0x0 [ 527.764355][T12168] hid-generic 0007:0001:FFFFFFFF.0005: unknown main item tag 0x0 [ 527.770747][T12168] hid-generic 0007:0001:FFFFFFFF.0005: unknown main item tag 0x0 [ 527.775799][T12168] hid-generic 0007:0001:FFFFFFFF.0005: unknown main item tag 0x0 [ 527.791107][T12168] hid-generic 0007:0001:FFFFFFFF.0005: unknown main item tag 0x0 [ 527.796532][T12168] hid-generic 0007:0001:FFFFFFFF.0005: hidraw1: HID va.e8 Device [syz0] on syz1 [ 527.878499][T21761] fido_id[21761]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 527.929815][T11989] usb 13-1: USB disconnect, device number 4 [ 527.935308][T21779] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 528.199699][T21817] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 528.293133][T11988] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 528.303160][T21829] netem: change failed [ 528.304157][T21676] usb 6-1: dvb_usb_ce6230: I2C read not implemented [ 528.309465][T11988] zl10353_read_register: readreg error (reg=127, ret==-110) [ 528.347498][T11988] usb 6-1: USB disconnect, device number 19 [ 528.487730][T21856] netlink: 8 bytes leftover after parsing attributes in process `syz.3.22282'. [ 528.491268][T21856] netlink: 4 bytes leftover after parsing attributes in process `syz.3.22282'. [ 528.495559][T21856] netlink: 'syz.3.22282': attribute type 19 has an invalid length. [ 528.498873][T21856] netlink: 'syz.3.22282': attribute type 20 has an invalid length. [ 528.874403][T21912] netlink: 4 bytes leftover after parsing attributes in process `syz.6.22301'. [ 528.886166][T21912] ------------[ cut here ]------------ [ 528.890209][T21912] 1 [ 528.890221][T21912] WARNING: net/ipv4/route.c:1275 at ip_rt_bug+0x2b/0x150, CPU#3: syz.6.22301/21912 [ 528.894385][T21912] Modules linked in: [ 528.896264][T21912] CPU: 3 UID: 0 PID: 21912 Comm: syz.6.22301 Tainted: G L syzkaller #0 PREEMPT(full) [ 528.900149][T21912] Tainted: [L]=SOFTLOCKUP [ 528.901570][T21912] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 528.904733][T21912] RIP: 0010:ip_rt_bug+0x2b/0x150 [ 528.906305][T21912] Code: 0f 1e fa 41 54 55 53 48 89 d3 48 83 ec 08 e8 bc b7 1b f8 66 90 e8 b5 b7 1b f8 ba 02 00 00 00 48 89 de 31 ff e8 76 31 6c ff 90 <0f> 0b 90 48 83 c4 08 31 c0 5b 5d 41 5c c3 cc cc cc cc e8 8e b7 1b [ 528.912341][T21912] RSP: 0000:ffffc9002151f390 EFLAGS: 00010287 [ 528.914257][T21912] RAX: 0000000000000d9a RBX: ffff8880758ea140 RCX: ffffc9002777a000 [ 528.916730][T21912] RDX: 0000000000080000 RSI: ffffffff89587da4 RDI: ffffffff8c1c2800 [ 528.919207][T21912] RBP: ffff8880758ea140 R08: 0000000000000001 R09: 0000000000000000 [ 528.921704][T21912] R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880718b8000 [ 528.924197][T21912] R13: ffff88802171f800 R14: 0000000000000000 R15: ffff8880758ea198 [ 528.926642][T21912] FS: 0000000000000000(0000) GS:ffff888097477000(0063) knlGS:00000000f5426b40 [ 528.929490][T21912] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 528.931643][T21912] CR2: 00000000f74352f0 CR3: 000000006c707000 CR4: 0000000000352ef0 [ 528.934263][T21912] Call Trace: [ 528.935465][T21912] [ 528.936465][T21912] ? __pfx_ip_rt_bug+0x10/0x10 [ 528.938057][T21912] ip_push_pending_frames+0x29e/0x300 [ 528.939821][T21912] icmp_push_reply+0x30e/0x450 [ 528.941374][T21912] __icmp_send+0x11b4/0x2c70 [ 528.942993][T21912] ? __pfx___icmp_send+0x10/0x10 [ 528.944591][T21912] ? __pfx_ip_route_input_slow+0x10/0x10 [ 528.946518][T21912] ? __lock_acquire+0x4a5/0x2630 [ 528.948188][T21912] ? __ip_options_compile+0x604/0x16a0 [ 528.950039][T21912] ? ip_route_input_noref+0x15f/0x2e0 [ 528.951871][T21912] ip_options_compile+0xb6/0x100 [ 528.953537][T21912] ? __pfx_ip_options_compile+0x10/0x10 [ 528.955364][T21912] ? __pfx_ip_rcv_finish+0x10/0x10 [ 528.957045][T21912] ip_rcv_finish_core+0x693/0x2c30 [ 528.958709][T21912] ip_rcv+0x1c0/0x3c0 [ 528.960269][T21912] ? __pfx_ip_rcv+0x10/0x10 [ 528.961922][T21912] __netif_receive_skb_one_core+0x197/0x1e0 [ 528.963932][T21912] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 528.965934][T21912] ? lock_acquire+0x1b1/0x370 [ 528.967317][T21912] __netif_receive_skb+0x1f/0x120 [ 528.969057][T21912] netif_receive_skb+0x13b/0x7f0 [ 528.970619][T21912] ? __pfx_netif_receive_skb+0x10/0x10 [ 528.972611][T21912] tun_rx_batched.isra.0+0x3f6/0x750 [ 528.974463][T21912] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 528.976434][T21912] ? rcu_is_watching+0x12/0xc0 [ 528.977998][T21912] ? tun_get_user+0x1cc8/0x3c20 [ 528.979626][T21912] tun_get_user+0x1e31/0x3c20 [ 528.981152][T21912] ? __pfx_tun_get_user+0x10/0x10 [ 528.982780][T21912] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 528.984507][T21912] ? find_held_lock+0x2b/0x80 [ 528.986012][T21912] ? tun_get+0x191/0x370 [ 528.987333][T21912] ? tun_get+0x191/0x370 [ 528.988704][T21912] tun_chr_write_iter+0xdc/0x200 [ 528.990296][T21912] vfs_write+0x6ac/0x1070 [ 528.991679][T21912] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 528.993464][T21912] ? __pfx_vfs_write+0x10/0x10 [ 528.994999][T21912] ? find_held_lock+0x2b/0x80 [ 528.996580][T21912] ksys_write+0x12a/0x250 [ 528.997924][T21912] ? __pfx_ksys_write+0x10/0x10 [ 528.999482][T21912] ? rcu_is_watching+0x12/0xc0 [ 529.001011][T21912] ? rcu_is_watching+0x12/0xc0 [ 529.002558][T21912] do_int80_emulation+0x141/0x700 [ 529.004180][T21912] asm_int80_emulation+0x1a/0x20 [ 529.005776][T21912] RIP: 0023:0xf71661ab [ 529.007147][T21912] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 529.013276][T21912] RSP: 002b:00000000f542644c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 529.015997][T21912] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080000400 [ 529.018603][T21912] RDX: 0000000000000046 RSI: 0000000000000000 RDI: 0000000000000000 [ 529.021277][T21912] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 529.023805][T21912] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 529.026460][T21912] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 529.029548][T21912] [ 529.030655][T21912] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 529.033068][T21912] CPU: 3 UID: 0 PID: 21912 Comm: syz.6.22301 Tainted: G L syzkaller #0 PREEMPT(full) [ 529.036635][T21912] Tainted: [L]=SOFTLOCKUP [ 529.038062][T21912] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 529.041107][T21912] Call Trace: [ 529.042173][T21912] [ 529.043101][T21912] dump_stack_lvl+0x100/0x190 [ 529.044533][T21912] vpanic+0x552/0x970 [ 529.045780][T21912] ? __pfx_vpanic+0x10/0x10 [ 529.047432][T21912] panic+0xd1/0xe0 [ 529.048584][T21912] ? __pfx_panic+0x10/0x10 [ 529.049971][T21912] check_panic_on_warn.cold+0x19/0x34 [ 529.051682][T21912] ? ip_rt_bug+0x2b/0x150 [ 529.053105][T21912] __warn.cold+0x191/0x328 [ 529.054531][T21912] __report_bug+0x296/0x3d0 [ 529.056157][T21912] ? ip_rt_bug+0x2b/0x150 [ 529.057538][T21912] ? __pfx___report_bug+0x10/0x10 [ 529.059123][T21912] ? ip_rt_bug+0x2b/0x150 [ 529.060630][T21912] report_bug+0xb2/0x220 [ 529.062219][T21912] ? ip_rt_bug+0x2b/0x150 [ 529.063799][T21912] handle_bug+0x16a/0x2a0 [ 529.065418][T21912] exc_invalid_op+0x17/0x50 [ 529.067250][T21912] asm_exc_invalid_op+0x1a/0x20 [ 529.068811][T21912] RIP: 0010:ip_rt_bug+0x2b/0x150 [ 529.070439][T21912] Code: 0f 1e fa 41 54 55 53 48 89 d3 48 83 ec 08 e8 bc b7 1b f8 66 90 e8 b5 b7 1b f8 ba 02 00 00 00 48 89 de 31 ff e8 76 31 6c ff 90 <0f> 0b 90 48 83 c4 08 31 c0 5b 5d 41 5c c3 cc cc cc cc e8 8e b7 1b [ 529.076681][T21912] RSP: 0000:ffffc9002151f390 EFLAGS: 00010287 [ 529.078738][T21912] RAX: 0000000000000d9a RBX: ffff8880758ea140 RCX: ffffc9002777a000 [ 529.081244][T21912] RDX: 0000000000080000 RSI: ffffffff89587da4 RDI: ffffffff8c1c2800 [ 529.083802][T21912] RBP: ffff8880758ea140 R08: 0000000000000001 R09: 0000000000000000 [ 529.086366][T21912] R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880718b8000 [ 529.088855][T21912] R13: ffff88802171f800 R14: 0000000000000000 R15: ffff8880758ea198 [ 529.091363][T21912] ? sk_skb_reason_drop+0x114/0x1b0 [ 529.093022][T21912] ? __pfx_ip_rt_bug+0x10/0x10 [ 529.094556][T21912] ip_push_pending_frames+0x29e/0x300 [ 529.096348][T21912] icmp_push_reply+0x30e/0x450 [ 529.097945][T21912] __icmp_send+0x11b4/0x2c70 [ 529.099461][T21912] ? __pfx___icmp_send+0x10/0x10 [ 529.101075][T21912] ? __pfx_ip_route_input_slow+0x10/0x10 [ 529.103068][T21912] ? __lock_acquire+0x4a5/0x2630 [ 529.104689][T21912] ? __ip_options_compile+0x604/0x16a0 [ 529.106502][T21912] ? ip_route_input_noref+0x15f/0x2e0 [ 529.108157][T21912] ip_options_compile+0xb6/0x100 [ 529.109770][T21912] ? __pfx_ip_options_compile+0x10/0x10 [ 529.111593][T21912] ? __pfx_ip_rcv_finish+0x10/0x10 [ 529.113384][T21912] ip_rcv_finish_core+0x693/0x2c30 [ 529.115141][T21912] ip_rcv+0x1c0/0x3c0 [ 529.116653][T21912] ? __pfx_ip_rcv+0x10/0x10 [ 529.118251][T21912] __netif_receive_skb_one_core+0x197/0x1e0 [ 529.120229][T21912] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 529.122328][T21912] ? lock_acquire+0x1b1/0x370 [ 529.123908][T21912] __netif_receive_skb+0x1f/0x120 [ 529.125473][T21912] netif_receive_skb+0x13b/0x7f0 [ 529.127284][T21912] ? __pfx_netif_receive_skb+0x10/0x10 [ 529.129002][T21912] tun_rx_batched.isra.0+0x3f6/0x750 [ 529.130700][T21912] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 529.132605][T21912] ? rcu_is_watching+0x12/0xc0 [ 529.134100][T21912] ? tun_get_user+0x1cc8/0x3c20 [ 529.135614][T21912] tun_get_user+0x1e31/0x3c20 [ 529.137394][T21912] ? __pfx_tun_get_user+0x10/0x10 [ 529.139008][T21912] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 529.140750][T21912] ? find_held_lock+0x2b/0x80 [ 529.142290][T21912] ? tun_get+0x191/0x370 [ 529.143624][T21912] ? tun_get+0x191/0x370 [ 529.144996][T21912] tun_chr_write_iter+0xdc/0x200 [ 529.146725][T21912] vfs_write+0x6ac/0x1070 [ 529.148126][T21912] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 529.149957][T21912] ? __pfx_vfs_write+0x10/0x10 [ 529.151469][T21912] ? find_held_lock+0x2b/0x80 [ 529.153066][T21912] ksys_write+0x12a/0x250 [ 529.154482][T21912] ? __pfx_ksys_write+0x10/0x10 [ 529.156101][T21912] ? rcu_is_watching+0x12/0xc0 [ 529.157951][T21912] ? rcu_is_watching+0x12/0xc0 [ 529.159610][T21912] do_int80_emulation+0x141/0x700 [ 529.161221][T21912] asm_int80_emulation+0x1a/0x20 [ 529.162805][T21912] RIP: 0023:0xf71661ab [ 529.164128][T21912] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 529.170159][T21912] RSP: 002b:00000000f542644c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 529.172731][T21912] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080000400 [ 529.175226][T21912] RDX: 0000000000000046 RSI: 0000000000000000 RDI: 0000000000000000 [ 529.177827][T21912] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 529.180411][T21912] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 529.182871][T21912] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 529.185272][T21912] [ 529.187004][T21912] Kernel Offset: disabled [ 529.188522][T21912] Rebooting in 86400 seconds..