last executing test programs: 5m43.452170443s ago: executing program 1 (id=2596): openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="5800000002060102000034e40000000004000008050005000a000000050001000600000005000400000000000900020073797a310000000011000300686173683a69702c706f727400001f000c00078008000640"], 0x58}, 0x1, 0x0, 0x0, 0x400c881}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) 5m43.18865919s ago: executing program 1 (id=2597): keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000026c0)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, 0x0) gettid() pipe2(&(0x7f0000002140)={0x0, 0x0}, 0x0) ioprio_set$pid(0x2, 0x0, 0x4004) read$FUSE(r0, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x34, 0x0, &(0x7f00000001c0)=0x2) msgsnd(0x0, 0x0, 0x8, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) r4 = fcntl$dupfd(r3, 0x406, r3) sendto$inet(r3, 0x0, 0x0, 0x200047fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f00000002c0)='bbr', 0x37) sendmsg$NFT_BATCH(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000007f40)=ANY=[], 0x76b0}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004001) write(r2, 0x0, 0x0) 5m41.372793334s ago: executing program 1 (id=2602): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) dup3(r2, r1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102400, 0x19000) socket$inet6(0xa, 0x2, 0x0) sysinfo(&(0x7f00000001c0)=""/86) close_range(r0, 0xffffffffffffffff, 0x0) 5m31.260797867s ago: executing program 1 (id=2627): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc018937e, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x4, 0xea, 0x440, 0x0, 0x10, 0x0, 0x4}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) recvmmsg(r0, &(0x7f0000001ec0)=[{{0x0, 0x0, 0x0}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x4}], 0x2, 0x0, 0x0) syz_usb_connect$uac1(0x6, 0x0, 0x0, 0x0) openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0) 5m29.456598078s ago: executing program 1 (id=2629): syz_usb_connect(0x6, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) getpid() fsopen(0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1\x00', 0x1) 5m25.810825919s ago: executing program 1 (id=2639): sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x0, 0x0) read(r1, &(0x7f0000000140)=""/9, 0xffffff64) 5m10.755407585s ago: executing program 32 (id=2639): sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x0, 0x0) read(r1, &(0x7f0000000140)=""/9, 0xffffff64) 4m29.139413311s ago: executing program 2 (id=2814): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x58, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8008, 0x4408}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @loopback}, @IFLA_GENEVE_TTL_INHERIT={0x5, 0xc, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 4m27.915777082s ago: executing program 2 (id=2818): socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x43}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x2000c08d) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0xffffffffffffffff, 0x0, 0x800, 0x0, 0x4, 0x10000000}, 0x0, &(0x7f0000000400)={0x1f, 0x0, 0x800000000000, 0x0, 0x1000000000, 0x0, 0xfffffffffffffffe}, 0x0, 0x0) shutdown(r0, 0x1) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x6, 0x0, 0x1, 0x800, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x2}, 0x50) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000340)={'sit0\x00', &(0x7f00000001c0)={'tunl0\x00', 0x0, 0x7f07, 0x700, 0x800, 0xffffff41, {{0x5, 0x4, 0x2, 0x31, 0x14, 0x64, 0x0, 0x4, 0x29, 0x0, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f0000000180)={0xb, 0x83, 0xfffd, 0x9dff, 0xe, "96ca676bc0d8a891"}) write$binfmt_aout(r3, 0x0, 0xff2e) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000100)={0x0, 0x40, 0x3, 0x7, 0x16, "b0bf2ebb48c849ac0000000003000018bfff40"}) r4 = syz_open_pts(r3, 0x0) r5 = dup3(r4, r3, 0x0) read$FUSE(r5, &(0x7f00000008c0)={0x2020}, 0x2020) read$FUSE(r5, &(0x7f0000000ac0)={0x2020}, 0x2020) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x81, 0xa, 0x0, 0x800, r1, 0x5, '\x00', r2, r5, 0x4, 0x4, 0x5, 0xd}, 0x50) 4m26.965173984s ago: executing program 2 (id=2821): r0 = memfd_create(&(0x7f0000002340)='[\v\xdbX\xae[5\xa9\x90\xffc\x1f\x1a\xa9\xfd\xfa\xad\xd1md\xe7\xe2\x7f\x9b\xd5R\x10\xf3\xb6\xffT\xbf\xd1\xc8\xee\b\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%eM\xe2\xc2y1q-\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\x9fc\xda\xa9\x83r\xd8\x98\x00\xffHB\xc5F#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9r\xc3E\xf8\x92\xb7-\x0e\xcf|\x89\xc2tc\xc9d\x9eI\xbaVf\xd1fs\xd1w6\x8a\xe9_', 0x3) mkdir(0x0, 0x1fd) mount(0x0, &(0x7f0000000080)='./myproc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x40000, 0x0) write$binfmt_script(r0, &(0x7f00000005c0)={'#! ', './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x204) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, 0x0, 0x0) write(r2, &(0x7f00000000c0)="240000001e005f0214f6fffffffffff8070000000000000000000000080009", 0x1f) io_uring_enter(r1, 0x533a, 0x8b46, 0x0, &(0x7f00000001c0)={[0xeb8f]}, 0x8) getpriority(0x0, 0x0) unshare(0x8040480) getsockopt(0xffffffffffffffff, 0x400000000000003a, 0x9, 0x0, 0x0) r3 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e20, 0x4, @loopback={0xfffffffffe5e0000}, 0x7}, 0x1c) 4m26.860471934s ago: executing program 2 (id=2822): setns(0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000840)={r2, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000300)=@assoc_value={0x0, 0x9cc}, 0x8) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fcntl$notify(r4, 0x11, 0x286237e8b9b45828) 4m25.162567335s ago: executing program 2 (id=2826): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0x0, 0xfffffffd}, 0x20) connect$l2tp6(r2, &(0x7f0000000080)={0xa, 0x0, 0x7fea, @empty, 0x9, 0xfffffffd}, 0x20) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0x10) socket$nl_route(0x10, 0x3, 0x0) mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x10, 0x3, 0x290, 0xf0, 0x160, 0x160, 0x0, 0x0, 0x1c0, 0x280, 0x280, 0x1c0, 0x1c0, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0, 0x0, {0x0, 0xa4}}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast2}}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, [], [], 'veth0_to_hsr\x00', 'batadv_slave_0\x00'}, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x1}, {0x4, 0x6, 0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SOUND_MIXER_WRITE_RECSRC(r0, 0xc0044dff, &(0x7f0000000180)=0x4) r4 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000000300)={{{@in=@remote, @in6=@mcast2}}, {{@in6=@mcast1}, 0x0, @in6=@empty}}, &(0x7f0000000280)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x16, 0x4, &(0x7f0000000540)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000000)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}, {@index_off}]}) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0x40045010, &(0x7f0000000080)) 4m23.618202297s ago: executing program 2 (id=2831): bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000007880)=""/102400, 0x19000) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000004000a98000000060a0b040000000000000000020000006c00048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000042c0001800a0001006c696d69740000001c0002800c00014000000000000000230c00024000000000000000010900010073797a30000000000900020073797a32"], 0xc0}}, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f00000001c0)=0x7) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x2, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000007c0)={0x0, &(0x7f0000000280)=""/135, &(0x7f0000000340), &(0x7f0000000400)="e1c265e436668db73ed71843fc09a234a96c4ba30436", 0x8629}, 0x38) 4m16.431222638s ago: executing program 3 (id=2851): socket(0x1e, 0x4, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000300), 0x80) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x3f00000000000000) 4m14.677709056s ago: executing program 3 (id=2857): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) 4m14.499873557s ago: executing program 3 (id=2858): r0 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x43}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x2000c08d) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0xffffffffffffffff, 0x0, 0x800, 0x0, 0x4, 0x10000000}, 0x0, &(0x7f0000000400)={0x1f, 0x0, 0x800000000000, 0x0, 0x1000000000, 0x0, 0xfffffffffffffffe}, 0x0, 0x0) shutdown(r0, 0x1) 4m14.299849782s ago: executing program 3 (id=2860): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000059d360205f0501d09288000000010902120001030000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000640)={0x34, &(0x7f00000004c0)={0x0, 0x9, 0x2, "26c1"}, 0x0, 0x0, 0x0, 0x0, 0x0}) 4m12.4917076s ago: executing program 3 (id=2868): r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0x0, 0xfffffffd}, 0x20) connect$l2tp6(r2, &(0x7f0000000080)={0xa, 0x0, 0x7fea, @empty, 0x9, 0xfffffffd}, 0x20) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0x10) socket$nl_route(0x10, 0x3, 0x0) mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x10, 0x3, 0x290, 0xf0, 0x160, 0x160, 0x0, 0x0, 0x1c0, 0x280, 0x280, 0x1c0, 0x1c0, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0, 0x0, {0x0, 0xa4}}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast2}}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, [], [], 'veth0_to_hsr\x00', 'batadv_slave_0\x00'}, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x1}, {0x4, 0x6, 0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SOUND_MIXER_WRITE_RECSRC(r0, 0xc0044dff, &(0x7f0000000180)=0x4) r4 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000000300)={{{@in=@remote, @in6=@mcast2}}, {{@in6=@mcast1}, 0x0, @in6=@empty}}, &(0x7f0000000280)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x16, 0x4, &(0x7f0000000540)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0x40045010, &(0x7f0000000080)) 4m11.8977244s ago: executing program 3 (id=2870): sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) openat$rtc(0xffffffffffffff9c, &(0x7f0000000400), 0x40000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_type(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000040)={0x2, 0xa, 0xfc, 0x0, 0x7, 0x0, 0x70bd28, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in=@empty, @in=@rand_addr=0x64010100, 0x2c, 0x30}]}, 0x38}}, 0x40408c0) 4m8.521870508s ago: executing program 33 (id=2831): bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000007880)=""/102400, 0x19000) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000004000a98000000060a0b040000000000000000020000006c00048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000042c0001800a0001006c696d69740000001c0002800c00014000000000000000230c00024000000000000000010900010073797a30000000000900020073797a32"], 0xc0}}, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f00000001c0)=0x7) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x2, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000007c0)={0x0, &(0x7f0000000280)=""/135, &(0x7f0000000340), &(0x7f0000000400)="e1c265e436668db73ed71843fc09a234a96c4ba30436", 0x8629}, 0x38) 3m56.776936672s ago: executing program 34 (id=2870): sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) openat$rtc(0xffffffffffffff9c, &(0x7f0000000400), 0x40000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_type(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000040)={0x2, 0xa, 0xfc, 0x0, 0x7, 0x0, 0x70bd28, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in=@empty, @in=@rand_addr=0x64010100, 0x2c, 0x30}]}, 0x38}}, 0x40408c0) 10.841234315s ago: executing program 6 (id=3982): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$DVB_DVR_DMX_DQBUF(0xffffffffffffffff, 0xc0186f40, &(0x7f0000000040)={0x1, 0x20000000, 0x9, 0xb, 0x8, 0x6}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000280)={0x9}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0xc50}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xff, 0x0, 0x4, 0x6, 0x7f, 0x20c}, {0xf1c2, 0x3, 0x38, 0xf, 0x84, 0x7, 0x3, 0x50, 0x0, 0x5, 0x4, 0x5, 0x3a}], 0xffffffff}) openat$vimc2(0xffffffffffffff9c, &(0x7f0000003240), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002b40), r4) sendmsg$NLBL_MGMT_C_ADD(r4, &(0x7f0000002c40)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="b0010000", @ANYRES16=r5, @ANYBLOB="010023bd7000fedbdf25010000000800040003000000790101006e016cb1d76a742f6cdc827b5620b8326361700083f2a64c36eb3be6d9a71b736ab02496daf52f9c74db40822d972e4fd677cee5e1496b5eeea93d98dff053960f72329cdc0790cc1938f30d968f4d2a46a25937c3fd1b722e3c1bbd295e9faa72ae78705725f74cc91d3ab1c566e34b7ba3b1d54ef4596a9f7a0377d38f11ef438da9fe22543d3489e653364729ef8c0f6daba4150b8415df87c88224182e7edf5992f5d963d82ece795aedfbd23286c751d599f34d6273b46e8d2304997142460d0fa9213cbe6e0a80326c05491e0080fd1affaa3d5219c64cb32e2f39b8570ad173bac5f8da28fe9c7479b03a5045eed21736104cf99a1de8cb93c98d1ec53cc86da02e60788818e923f40eb5748235941ba011618dabbf4c880efbc3b1ab04264bcf2d19e40094a8c6e14cb8321e64a657ed7faf4d37abc952efcf6770943e5d666be915934bde5544556451b7c419d3dacd913b436090279b80f0b7c71e620ee2aab98b8d98ca96e1bf5d8bc7aabb36a266d8000000080002"], 0x1b0}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000080) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r6, 0x29, 0x3b, &(0x7f00000002c0)={0x3c, 0x4, '\x00', [@jumbo={0xc2, 0x4, 0x2}, @enc_lim={0x4, 0x1, 0x4}, @pad1, @ra, @calipso={0x7, 0x10, {0x0, 0x2, 0x7f, 0x9, [0x100000000]}}, @ra={0x5, 0x2, 0x7}]}, 0x30) ioctl$KVM_RUN(r3, 0xae80, 0x0) socket(0x2a, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f00000001c0)={0x9, r2, 'id1\x00'}) ioctl$HIDIOCGRAWNAME(r7, 0x80404804, &(0x7f0000000240)) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000080)={0x50, 0x0, 0x0, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001c00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x24, 0x20040011}}], 0x1, 0x80) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) 9.653442804s ago: executing program 6 (id=3987): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x33) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000240)={0x1ff, 0x1, 0x200000, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) r1 = openat$dsp1(0xffffffffffffff9c, 0x0, 0x22080, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r2, 0xc138fd03, &(0x7f0000000100)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141") ioctl(r2, 0xc138fd09, &(0x7f0000000300)="0400000032000000000000008a0100003801000001000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141000000000000000008000000000000000000000000000000726169640000000000000000000000007261696431203120382032202d202f6465762f6e756c6c6230202d202f6465762f6e756c6c623100") ioctl(r2, 0xc138fd0c, &(0x7f0000000500)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141") r3 = dup2(r1, r1) read$FUSE(r3, &(0x7f00000063c0)={0x2020}, 0x2020) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x4e23, @remote}}, 0x0, 0x0, 0x3b, 0x0, "38412b7c1ef9ca07c001da998a4df5ca3e516adef94d6e4a18f11d3bc67fd62b45233c367bf16d79eea6821e3874c0c07ad5feb5be8e74072144db691657e44f588c29aa4363e73ab68f91b6a4fb9bc3"}, 0xd8) r4 = add_key(&(0x7f0000000040)='ceph\x00', 0x0, &(0x7f0000000000)="0100000200373a4541062000a59ea940d2cb0b3692f5020000a00000050000000000eb000000a5e5be21c44e", 0x2c, 0xffffffffffffffff) keyctl$get_security(0x11, r4, &(0x7f0000000080)=""/107, 0x6b) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000001640), &(0x7f0000001680)=0xc) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r3, 0xc01864c1, &(0x7f0000005500)) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4038587a, &(0x7f0000005e40)={{0xffffffffffffffff, &(0x7f0000005d00)='/\x00', 0x80280, &(0x7f0000005d40)={@_ha_fsid={[0x3, 0x5]}, {0xd, 0x5, 0x9, 0x5}}, 0x1, &(0x7f0000005d80)={@_ha_fsid}, &(0x7f0000005dc0)=0x5}, {[0xc8, 0x3, 0xd2d]}, 0xa2, 0x0, &(0x7f0000005e00)}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r9 = dup(r8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r9, 0x2000) ioctl$KVM_PRE_FAULT_MEMORY(r7, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) 9.079115659s ago: executing program 6 (id=3990): fsopen(0x0, 0x0) creat(&(0x7f0000000380)='./file0\x00', 0x206) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_emit_vhci(&(0x7f0000000180)=ANY=[@ANYBLOB="042fff01"], 0x102) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x80000) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="c8ed0ec2aff22b790000000000000000", 0x10) recvmmsg(r3, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r3) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x44800}, 0x4048000) getsockopt(0xffffffffffffffff, 0x400, 0x10001, &(0x7f0000000480)=""/165, &(0x7f0000000580)=0xa5) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) 6.858260398s ago: executing program 5 (id=4000): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000200)) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_DIRTYFB(r1, 0xc01864b1, &(0x7f0000000280)={0x0, 0x2, 0x1ff, 0x0, 0x0}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000040)=0x1) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000002940)=0x8000000) syz_open_dev$vim2m(&(0x7f0000000180), 0x0, 0x2) openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/sys/kernel/sem\x00', 0x1, 0x0) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi0\x00', 0x8001, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f00000000c0)={'dmm32at\x00', [0x100, 0x4005, 0x300, 0xe1, 0xe, 0x1, 0x69, 0x10000, 0x3, 0x0, 0x9, 0x5, 0x7, 0x1, 0x1, 0xfd, 0xfffffff4, 0x107ff, 0x2, 0x4, 0x89, 0x7ff, 0x80000, 0x20001e58, 0x7ff, 0xf39d, 0x6, 0x8, 0xa4b5, 0x0, 0xfffffff8]}) 6.711052282s ago: executing program 5 (id=4001): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1, 0x100004, 0x220104, 0xe2a3, 0x1}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x18, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, r0}, 0x38) 6.07322287s ago: executing program 5 (id=4003): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close_range(r0, 0xffffffffffffffff, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000002c0)={'batadv0\x00', 0x0}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000005c0)={'gretap0\x00', &(0x7f0000000440)={'tunl0\x00', 0x0, 0x8, 0x700, 0x5, 0x3a3, {{0x1d, 0x4, 0x1, 0x3, 0x74, 0x67, 0x0, 0xa2, 0x4, 0x0, @rand_addr=0x64010101, @multicast2, {[@timestamp_prespec={0x44, 0x34, 0x4a, 0x3, 0x5, [{@multicast2, 0x5}, {@dev={0xac, 0x14, 0x14, 0x5}, 0x1}, {@empty, 0xffffffff}, {@local, 0x7}, {@broadcast, 0x4}, {@broadcast, 0x10}]}, @timestamp_addr={0x44, 0x14, 0x81, 0x1, 0x1, [{@empty, 0x7d91}, {@remote}]}, @cipso={0x86, 0x15, 0x3, [{0x7, 0xa, "216d94c13827b652"}, {0x7, 0x2}, {0x2, 0x3, ';'}]}]}}}}}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000600)={'wg1\x00', 0x0}) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000400)={'vcan0\x00', 0x0}) (async) r8 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r8, &(0x7f0000000080)={0x1d, r7, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) (async) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x74, r7, {0x6, 0xc}, {0x2}, {0xd, 0x3}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) (async) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000640)=0x0, &(0x7f0000000680)=0x4) (async) r10 = socket$kcm(0x11, 0x3, 0x0) (async) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r10, 0x107, 0xf, &(0x7f0000000600), 0x56) (async) sendmsg$kcm(r10, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x11, r12, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x48, 0x2, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x48}}, 0x8804) (async) sendmsg$nl_route(r13, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="880000001900010000000000000000001d01000005000d0001000000150003000000000000000000062e346aa0f998570000000015000200000000000002000003ef7506ecbef9700600000015000400000000000000000000000000000000010100000008000900", @ANYRES32=0x0, @ANYBLOB="0c000b00000000000000000008000e00", @ANYRES32=0x0, @ANYBLOB='\b'], 0x88}}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000780)={'ip_vti0\x00', &(0x7f00000006c0)={'syztnl0\x00', 0x0, 0x1, 0x40, 0x1, 0xb54, {{0x23, 0x4, 0x2, 0x23, 0x8c, 0x64, 0x0, 0x8, 0x2f, 0x0, @multicast1, @rand_addr=0x64010100, {[@ra={0x94, 0x4}, @timestamp_prespec={0x44, 0xc, 0x7d, 0x3, 0x9, [{@dev={0xac, 0x14, 0x14, 0x44}, 0x13d}]}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x14, 0x1c, 0x1, 0xe, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, {@loopback, 0xcdd}]}, @noop, @rr={0x7, 0xf, 0xde, [@multicast2, @dev={0xac, 0x14, 0x14, 0x40}, @rand_addr=0x64010101]}, @cipso={0x86, 0x1d, 0x3, [{0x6, 0xa, "8c452ce55ee2e520"}, {0x5, 0x3, '#'}, {0x0, 0xa, "5913cab9127190d0"}]}, @ssrr={0x89, 0xf, 0xdb, [@multicast1, @multicast1, @rand_addr=0x64010102]}, @generic={0x1, 0x5, "851ad7"}, @lsrr={0x83, 0xf, 0xf5, [@rand_addr=0x64010102, @remote, @loopback]}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000840)={'gre0\x00', &(0x7f00000007c0)={'syztnl1\x00', 0x0, 0x700, 0x700, 0x8, 0x8, {{0x13, 0x4, 0x0, 0x3, 0x4c, 0x68, 0x0, 0x4, 0x4, 0x0, @empty, @rand_addr=0x64010100, {[@rr={0x7, 0x27, 0x75, [@multicast1, @dev={0xac, 0x14, 0x14, 0x36}, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x10}, @broadcast, @loopback, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010102]}, @lsrr={0x83, 0xf, 0xde, [@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @dev={0xac, 0x14, 0x14, 0xb}]}]}}}}}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r2, &(0x7f0000000300)={&(0x7f00000001c0), 0xc, &(0x7f0000000a40)={&(0x7f0000000880)={0x18c, 0x0, 0x20, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}]}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nicvf0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r15}]}]}, 0x18c}, 0x1, 0x0, 0x0, 0x4}, 0x44) (async) syz_open_dev$MSR(&(0x7f0000000080), 0xd, 0x0) (async) r16 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r16, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) r17 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="230000000400000008000000c00b000001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r17, @ANYBLOB="000000000300000000"], 0x50) 5.192721505s ago: executing program 5 (id=4009): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) connect$unix(r2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r3) sendmsg$IEEE802154_LIST_PHY(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r4, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x95}, 0x40000) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo\x00') r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) fcntl$dupfd(0xffffffffffffffff, 0x2, 0xffffffffffffffff) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) write$dsp(r6, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDCTL_SEQ_RESET(0xffffffffffffffff, 0x5100) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000001340)={0x3c, 0x2, 0x6, 0x401, 0x0, 0x0, {0x5}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}]}, 0x3c}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000004000)=@newtfilter={0x3c, 0x2c, 0xf3f, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x0, 0xfff3}, {0x0, 0xfff3}, {0xd, 0x5}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x100d597}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20041004}, 0x0) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000000), &(0x7f0000000200)={0x0, 0xfb, 0xf5, 0x3, 0xe, "96a44c720f96b52599b9db8fda47f83f", "ff3249fb49e13e4655913b6e11dd592f16a5d518b6f2b4bb97baa493f6e80c7d254cdcff9103ab1449fea076c51b30afb6f0a3928c12aeb2761068bb1d9e9ed6c23059fd416cec03d4a4f0e38dfa6f3975ecbdbedf6ee6bd986805c2ae54cb7e7e43fe680a1b6c1321cb77caf6b3906554de00a4f8da3e48502df00990eab324459fe9451a168c3728e1bad37ea37b47f2f055e01e1112470e197e5f9396740a4241c7b6da69de202ed26a6a37bc040cfab7f85ec194a88e0588686f7cc45b0f6dc162f8e3c1221e601a4d4f805dafc1c41c2ec77a08e6f3c9f4868c4a759abb"}, 0xf5, 0x3) 5.070205707s ago: executing program 4 (id=4010): r0 = socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r4, 0x1, 0x3}, 0x50) syz_open_procfs$namespace(0x0, &(0x7f0000002e00)='ns/cgroup\x00') syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000180)=r1) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, 0x0}, 0x58) r5 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r5, 0xc0945662, &(0x7f0000000040)={0xfffffff8, 0x0, '\x00', {0x0, @bt={0x6, 0x9f, 0x0, 0x2, 0x7, 0x8, 0x6, 0x11, 0x1, 0x5, 0x6, 0x983, 0x0, 0x20010, 0x1c, 0x21, {0x5, 0x3}, 0x8, 0x5}}}) r6 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x2042, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x4008844) ioctl$AUTOFS_IOC_FAIL(r6, 0x4c80, 0x7000000) socket$nl_sock_diag(0x10, 0x3, 0x4) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000004c0)={'syz0\x00', {0x87, 0x3, 0x1, 0x9}, 0xb, [0x4, 0x6, 0x802, 0xe9a2, 0x1, 0x3, 0xa9ba, 0xc1f, 0x1, 0x7f5b, 0x3, 0x4, 0x5, 0x10004, 0x2, 0x3, 0x0, 0x3, 0xe, 0x3, 0x0, 0x2, 0xd9, 0x2, 0x6, 0x0, 0x3, 0x9, 0xfff, 0x8a0, 0x6, 0x8001, 0x33b5, 0x1, 0xfffffffc, 0x0, 0x9, 0xb, 0xcc, 0x4, 0x80, 0x400, 0x5, 0x5, 0xfffffffd, 0x8, 0xb, 0x3, 0xffff8001, 0x6, 0x3, 0x80000000, 0x1, 0xa, 0x7, 0x8, 0x5, 0xfff, 0x1, 0x7fe, 0x7fff, 0x10000, 0x2, 0x8], [0x2, 0x1, 0x10000, 0x7, 0x9, 0x6, 0x5, 0x4, 0x9, 0x7, 0x5, 0xdd5a, 0x6, 0x5, 0x7, 0x8, 0x5, 0xcc, 0xbc1, 0x80000, 0x0, 0x5e81339d, 0xffffc256, 0xb, 0x80000001, 0x0, 0x0, 0x4, 0x4, 0x7, 0x8, 0x10d, 0x1, 0x5, 0x5, 0xfffffb66, 0xfb5, 0x2, 0x4, 0x7, 0x2, 0x8000, 0x7fff, 0x1, 0x9425, 0x4, 0x6f, 0x80b, 0x1, 0x1, 0x525ba681, 0x4f74, 0x7, 0x1, 0x1, 0xfffffffd, 0x100, 0x6, 0x10000, 0x1306, 0x8b, 0x10000, 0xfe4, 0x3ff], [0x2, 0x40, 0x200, 0xfffffff9, 0x7aa, 0x10, 0x80, 0x8001, 0x5, 0x0, 0x9, 0x8, 0x7fffffff, 0x1, 0x1, 0x4, 0x8, 0xa9, 0x7, 0x49, 0x6, 0x4, 0x5, 0xa3, 0x40003, 0x2, 0x0, 0x3, 0x4c, 0x3, 0x5, 0x4, 0xd21e, 0x9, 0x12, 0x0, 0x2, 0xfff, 0x8, 0x800100, 0x7c83, 0xd, 0x1, 0x4, 0xf, 0x81, 0x47, 0x7, 0x0, 0x11, 0x2, 0xffd, 0x7, 0x7, 0x7ffd, 0x7ff, 0x10, 0x9, 0x10001, 0x8000001, 0x10001, 0x6, 0x71c], [0x81, 0x3, 0x10, 0x4e26, 0x3, 0x7, 0xfffffff3, 0x497, 0x4, 0x1, 0x2, 0x5, 0x56, 0xc28, 0x9, 0x5, 0x5, 0xa, 0x79a, 0x4, 0x9, 0x1ff, 0xc41f, 0x5, 0x8b6, 0xffffffff, 0x0, 0x0, 0x6a, 0x9, 0x0, 0x0, 0x1000, 0x10, 0xd, 0x6, 0x8000, 0x53, 0x78d, 0x4, 0x1, 0x9, 0xfffffff8, 0x9, 0x7, 0x7, 0x101, 0x7, 0x7, 0x4, 0x0, 0xb, 0x400400, 0x8, 0x28, 0x8, 0x7, 0x9, 0x2, 0x0, 0x1, 0x8001, 0xfffffff7, 0x5]}, 0x45c) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000980)={0x78, 0x0, 0xacf5e67dd0b583a1, 0x0, 0x0, {{0x5}, {@val={0x8}, @val={0xc, 0x99, {0x2000000, 0x5d}}}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x4e, 0xe, {{{0x0, 0x2, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x9}, @device_b, @device_a, @random="ec03f3b85ad3", {}, @value=@ver_80211n={0x0, 0x2, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1}}, 0xffffffffffffffa1, @random=0x4, 0x0, @void, @void, @val={0x3, 0x1}, @val={0x4, 0x6, {0x4a, 0x1e, 0x5, 0x81}}, @val={0x6, 0x2, 0x8343}, @void, @void, @val={0x2a, 0x1}, @void, @void, @val={0x72, 0x6}, @void, @val={0x76, 0x6, {0xf, 0xf4, 0x22, 0x4}}}}]]}, 0x78}, 0x1, 0x0, 0x0, 0x8810}, 0x0) 3.719647067s ago: executing program 4 (id=4012): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) inotify_init() r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_DYING(r0, &(0x7f0000000000)={0x0, 0xffffffffffffffab, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) pidfd_send_signal(r2, 0x0, 0x0, 0x10000000000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) rt_sigsuspend(0xffffffffffffffff, 0x8) 3.089192552s ago: executing program 6 (id=4014): r0 = openat2$dir(0xffffff9c, &(0x7f0000000180)='./tracefs_dir/buffer_subbuf_size_kb\x00', &(0x7f00000001c0)={0x40001, 0x20, 0x10}, 0x18) mkdirat(r0, &(0x7f0000000040)='./tracefs_dir\x00', 0x8a) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./tracefs_dir/buffer_subbuf_size_kb\x00', 0x1, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r2 = syz_clone(0x0, 0x0, 0x43, 0x0, 0x0, 0x0) process_vm_writev(r2, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x100000000000026d, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) write(r1, &(0x7f00000002c0)='1', 0x1) epoll_create1(0x80000) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="040e044e3520"], 0x7) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/fscaps', 0x400000, 0x41) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x9, 0x8, 0x0, 0x7, 0x9, 0x100, 0x0, 0x1}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r3, &(0x7f0000000040)={0x23, 0x4}, 0x10) socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(0xffffffffffffffff, &(0x7f0000000000)={0x23, 0x4, 0x1}, 0x10) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) r4 = socket(0x40000000015, 0x5, 0x0) recvmmsg(r4, &(0x7f0000002a80)=[{{0x0, 0x0, 0x0}, 0x10}], 0x1, 0x2, 0x0) r5 = gettid() capset(&(0x7f0000000000)={0x19980330, r5}, &(0x7f0000000080)={0x4, 0x8bc000a, 0x789dab14, 0x3, 0x3, 0x6}) 2.609234793s ago: executing program 4 (id=4015): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b7020000b0ffffffbfa30000000000000703000000feffff7a0af0ff8f00000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000011000000b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb450063dedba767ade51f7f1f66acd19100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb4e4d0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e85cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd0cf8f79a015c7bd3f15aa6aadbeab2a01685108e61aa00000000000000000000000000c67c6c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f10800000000000000826151e3b42bcae95239ef5ca2a730a00c87c493db0300e63fda97a296820000000001000000eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e180022537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d3f00000000000000665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d81ab324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b6e8c71e2603217606637ece1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d2478ce31344b554aca7670000000000000010c65608fda6ed5d08e7a796042aa127d874105787d0347aa37801faff5b9050803a19ff6205aa5c263e407a2f7de56f7a0000e094fa4e3f05528caab5a430c08dd810bc97204b767dd969721a26aa740000000000bc433fe2d0a6ef2a8a91cd3cb305aa80dadef8b0caca780000000000000000863e21db415a222bb1a7ab94bfe4a74157d794f9d0430c2c0eb563350559829865a3dd08fb31bd0801e09aa3ee45e61a56fc83076451cff7632e49a41eadb5044a0d5f73d6932161ae5e9ce218a35cd8e7b747887b1a74798982d0b492c3f0ff53189d80733eb04f8124877b648ff438f7d66c7efcc09a8f3330b6c22d14e80db8e5608bdeab9388b758a15f4ce70390c214bc6838798f5b9b0b500d4e8b5174f329b8501c6feb7a6982bcea74a0f2ced7fa2059234a8d10b7f0597151d5c9067d57d85f4ae933eaf5174ba122f3f702ef8695578d3c08562c9fc185f0f65d11b4c58ae52500cbe99cde3758a5cbe6093dd328ac820e2de309d25a324647aadffcecf0f3bbaeda7af4436d9ffbce1b240a2f5e346eba8812e6329e01b087bde7da4a6448f478102e90c8134f531de08d4cf4f6f35b15a202544c0ced0c1715fd3a90099f785a13a2412bedba2981dd22bd9d736c00000000000000000000000000000000eb6fec8d7d2f77f4d470a9caa5b1bfc00cd1d40830ac35f229f8ffe1c02a63d3c2d9"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x23) r1 = socket$pppoe(0x18, 0x1, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$SIOCSIFHWADDR(r3, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="0100"}) open_by_handle_at(r1, &(0x7f00000000c0)=@FILEID_INO32_GEN={0x8, 0x1, {0x8, 0x1}}, 0x480400) connect$pppoe(r2, &(0x7f0000000180)={0x18, 0x0, {0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 'ip6tnl0\x00'}}, 0x1e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0x0, 0x200003, 0xfffffffd, {0xa, 0x4e21, 0x3, @private2={0xfc, 0x2, '\x00', 0x2}, 0x1814b150}}}, 0x3a) close(0x3) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r0, 0x702, 0x72, 0x0, &(0x7f0000000040)="e460334400005000eb00c15286ddea7b03c6b8564a1ef1cef05bdaa5958a2cb1087dad203447dba73666d209bd02246fe3e0f3be78a37ba851da39f7594a66e7ab3666ee250fa7d5595238df44f22828d26e2591592d02f875b0cea9b4cbbf37fcd33bb7c668e43a945608d8ea0da812d7c7", 0x0, 0xfffffff7, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 2.609098582s ago: executing program 0 (id=4016): sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000680)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}, 0x3}}}, 0x108) r1 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/mcfilter6\x00') preadv(r1, &(0x7f0000000b00)=[{&(0x7f0000000bc0)=""/140, 0x8c}], 0x1, 0x60, 0x2) 2.424315783s ago: executing program 4 (id=4017): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x4) mprotect(&(0x7f000080e000/0x2000)=nil, 0x2000, 0x4000002) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=@newtfilter={0x43c, 0x2c, 0xd27, 0x70bd25, 0x8400, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0xffff, 0x8}}, [@filter_kind_options=@f_flow={{0x9}, {0x40c, 0x2, [@TCA_FLOW_POLICE={0x408, 0xa, 0x0, 0x1, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x81, 0xffffffff, 0xda, 0x3, 0x0, 0x2a, 0x100, 0x73d, 0x3509, 0x3, 0x10000, 0x7, 0x1000, 0x9, 0x3, 0x3, 0x882e, 0x8, 0x8, 0x2, 0x9, 0xfffffffb, 0x2, 0x6, 0x80000000, 0x400, 0x9, 0xffff, 0x7a, 0x5, 0x7, 0x7fff, 0xffffff40, 0x9, 0x6, 0x8, 0x2, 0x57, 0x0, 0x4, 0x7fff, 0x9, 0xfffffffb, 0x2, 0xcf9f, 0x0, 0x1, 0x8, 0x1, 0x5, 0xfffffff9, 0x3, 0x80000001, 0x6, 0x4, 0x9, 0x8, 0xfffffffd, 0x15, 0x7, 0xc, 0x8, 0x4, 0x3, 0xfffffe00, 0x7, 0x3, 0x800, 0x1, 0x4, 0x2, 0xffffffff, 0x1, 0x801e, 0x7, 0x4, 0x0, 0x8, 0x5, 0x8003, 0x5, 0x1, 0x1000, 0x9, 0x3, 0x7ff, 0xd0, 0x8, 0x0, 0x3, 0x1, 0x9, 0xe, 0x7fff, 0xfffffff8, 0x7, 0x0, 0xb1, 0x3, 0xffffff44, 0x1, 0x8, 0x8, 0x6, 0x556, 0x1, 0x2c, 0x5, 0x80000001, 0x1, 0x0, 0xffffff00, 0x3, 0x2, 0x7, 0x9, 0x1c00, 0x5, 0xa2, 0x3, 0x8, 0x0, 0x5, 0x8001, 0xbfffffff, 0x7, 0x2, 0x7, 0x0, 0x743, 0x6, 0x3, 0x7, 0x200, 0x5, 0x0, 0x8, 0x3, 0x100, 0x2, 0x8, 0x1, 0x1, 0x8, 0xe, 0x5, 0x6, 0x4, 0x7ff, 0x5, 0x0, 0x0, 0xf80, 0x7, 0x5a, 0x2302, 0xffff, 0x3ff, 0x2, 0x5, 0x1, 0x6, 0x3, 0x401, 0x10001, 0x512d, 0x1, 0xe, 0x2, 0xa3c0, 0x4, 0x8000, 0x10001, 0x15a, 0x6, 0x120000, 0x9, 0x7fffffff, 0x7, 0x9, 0x80000004, 0x5, 0x7e9, 0x48, 0x9, 0x3, 0x0, 0x5, 0x6, 0xf, 0xff, 0xd, 0x6, 0x9, 0x0, 0x200, 0x9, 0xff, 0x4, 0x7, 0x7, 0x8, 0x4, 0x56, 0x4a82, 0xffff0000, 0x7ff, 0x3e1, 0x8006, 0x80000000, 0x4c0, 0x5, 0xa, 0x6, 0x2, 0x6, 0x8, 0x48, 0x1a, 0x2000000, 0x1ff, 0x844, 0x6, 0x3ff, 0x2, 0x100, 0x6, 0xffffffff, 0x200, 0xc26, 0x4, 0x5, 0x1, 0x7fff, 0xf, 0x401, 0x401, 0x4, 0x7, 0x3565, 0x2000002, 0x4, 0xebf, 0x9, 0x1000, 0x7ff, 0x71f, 0x2, 0x7, 0x6e8, 0x8, 0x0, 0x80000000, 0x6, 0x9, 0x2]}]}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x1}, 0x800) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/dri/1/Virtual-1/edid_override\x00', 0x2, 0x0) write(r0, 0x0, 0x500) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r2, @ANYBLOB="0000000003120100500012800b000100627269646765000040000280080005000100000006002700000000000800010015000800050025000000000008000400000000000c002e"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x100, 0x3c7) listen(r3, 0xe0d7) r4 = timerfd_create(0x0, 0x0) timerfd_create(0x0, 0x0) ppoll(&(0x7f0000000700)=[{r4, 0x3041}], 0x1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r5, &(0x7f0000000000)=ANY=[], 0xfffffe3e) sendmmsg$inet(r5, &(0x7f0000000a80)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000400)="1d", 0x1}], 0x1}}], 0x1, 0x40003) 2.221945969s ago: executing program 0 (id=4018): openat$dir(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x1c3040, 0x0) r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f00000002c0)='./file0\x00', 0x104) write$char_usb(r1, &(0x7f0000000300)="0ef17cb96dfb5577f341e038fff1ef65fb43b24e5b45f33efe3ba3976469d85eade8fd02178fb84da7b56fd5a6b2b48aace8debd6da451d5cc228f0b0b328040af25be431fa22468121e75bf861d7df6e37ebbff6e8ec93a07a6e22b6778d38fe6aede5ce7623419073f39ffa04749c25c60f2a0877c99295e3fb4143fc57609bab9ec2770cd9da66050f64b08eb479c70494c3361890131007dd0926977713369a8e44f36eb2784fbda4918b1b7a3af5ea2ea", 0xb3) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0xc0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) write$P9_RVERSION(r1, &(0x7f0000000c40)=ANY=[], 0x13) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x9, 0x0, r1, 0x6, '\x00', 0x0, r1, 0x4, 0x2, 0x2}, 0x50) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f0000000140)=[0x5], &(0x7f0000000180)=[0x2], 0x0, 0x1, 0x1}}, 0x40) mmap$xdp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x12, r0, 0x80000000) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}], 0x1, 0x0, 0x0, 0x800}], 0x1, 0x40800) syz_emit_ethernet(0x4e, &(0x7f0000000140)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0xf500, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x10) r4 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r5, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000780)={r6, 0x0, 0x4, 0x0, 0x2, [0x0], [0x0, 0x0, 0x400, 0x10000], [0x0, 0x0, 0xfffffffc], [0x1, 0x0, 0x7]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000440)={0x7, 0x3, 0x7}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000080)={r7, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000240)={r6, 0xc89, 0xa, 0xfffffffa, 0x3, [0x0], [0x5, 0x5, 0xfffffffd, 0x2], [0xe, 0x7, 0xffffffff, 0x8000], [0xfffffffffffffffb, 0xa679, 0x1, 0x7f]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000080)={r9}) ioctl$DRM_IOCTL_MODE_GETGAMMA(r4, 0xc02064a4, 0x0) ioctl$DRM_IOCTL_RES_CTX(r4, 0xc0086426, &(0x7f0000000480)={0x3, &(0x7f0000000140)=[{0x0}, {}, {}]}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r8, 0xc008641d, &(0x7f0000000600)={r10, &(0x7f00000005c0)=""/64}) ioctl$DRM_IOCTL_SWITCH_CTX(0xffffffffffffffff, 0x40086424, &(0x7f0000000040)={r10, 0x3}) ioctl$DRM_IOCTL_NEW_CTX(0xffffffffffffffff, 0x40086425, &(0x7f0000000400)={r10, 0x1}) ioctl$DRM_IOCTL_NEW_CTX(0xffffffffffffffff, 0x40086425, &(0x7f0000000240)={r10, 0x1}) syz_clone3(&(0x7f0000000000)={0xa000100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, 0x0}, 0x58) 1.980553945s ago: executing program 0 (id=4019): r0 = syz_ublk_setup_io_uring(0x20, &(0x7f00000003c0)={0x0, 0xd9a0, 0x100, 0x2, 0x1e5}, 0x0, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x123f41, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x3, 0x158, 0x0, r0}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x2, 0xf74, 0x0, 0x0, 0x1000, 0x4, 0x0, 0x0, 0x150}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f0000000180)={0x0, 0x1, 0x3000, 0x3, 0x186}, &(0x7f00000010c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x1, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x1000000, 0x2e4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x800000, 0x1, 0x0, 0x315}}], 0x1, &(0x7f0000000340)={0x2e, 0x50, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) write$binfmt_aout(r1, &(0x7f0000000280)=ANY=[], 0xff2e) 1.918411743s ago: executing program 6 (id=4020): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, 0x0, 0x0) r1 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r1, 0x1, 0x3, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x4e24, 0x6bb, @ipv4={'\x00', '\xff\xff', @local}, 0x5}, 0x1c) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000), 0x3) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000840)=@newsa={0x138, 0x10, 0x401, 0x70bd28, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0x1234, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x4d3, 0x33}, @in=@empty, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x2, 0xffffffffffffffff}, {0x0, 0x36b2, 0xfffffffffffffffc}, {}, 0x0, 0x0, 0xa}, [@algo_auth_trunc={0x4c, 0x14, {{'hmac(sha1)\x00'}, 0x0, 0xa0}}]}, 0x138}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@newpolicy={0xfc, 0x13, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0x1234, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x4d2, 0x33}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r3, &(0x7f0000000200)={&(0x7f0000000400)={0xa, 0x1234, 0x0, @loopback}, 0x1c, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="200000000000000029000000360000000001000000000000c00400000000010020"], 0x40}, 0x0) 1.639761215s ago: executing program 5 (id=4021): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = creat(0x0, 0x175) mknod(&(0x7f00000000c0)='./bus\x00', 0x8000, 0xd02) acct(&(0x7f0000000000)='./bus\x00') syz_open_dev$video(&(0x7f0000000040), 0x8, 0x0) acct(0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a7c000000060a0104000000000000000002000000500004804c0001800c0001007061796c6f6164003c000280080004400000005a0800054000000002080003400000001708000240000000020800064000000002080007400000000808000840000000000900010073797a30000000000900020073797a32"], 0xa4}}, 0x4) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) r5 = open(&(0x7f0000000140)='./file1\x00', 0x66842, 0x21) syz_ublk_setup_queues(r5, 0x0, &(0x7f0000000340)={0x0, 0xfb7e, 0x800, 0x2, 0x321, 0x0, r4}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd3db, 0x200, 0x1, 0x3de, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9e00, 0x200, 0x1, 0x278, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb60e, 0x2000, 0x1, 0x321, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8b94, 0x200, 0x3, 0xc4}}], 0x4, &(0x7f00000017c0)={0x2e, 0x40, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xf6}, 0x0, 0x0, '\x00', {0x5, 0xc81, 0x0, 0x0}}, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'wg1\x00', 0x1}) socket$kcm(0xa, 0x5, 0x0) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f00000001c0)=ANY=[@ANYBLOB="03c90035b5200900000000000000e3df911ecb254f020127326a6db6554156814d17b46fe345be823f828bc881de014c2d245fdd8b457f8512"], 0x39) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r6, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20) socket$l2tp6(0xa, 0x2, 0x73) 930.868479ms ago: executing program 4 (id=4022): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r1 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r0}, 0x8) close(r1) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0x1f, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) socket$alg(0x26, 0x5, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000440)={r1, r2, 0x4, r0}, 0xf) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f000000a180)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r6, r5, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x4e, &(0x7f0000000180)=ANY=[], 0x0) r7 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) r8 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r8, &(0x7f0000000280)={0x13, 0x10, 0x7, {0x0, r9, 0x1}}, 0x18) ioctl$VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f00000003c0)={0x6, @sliced={0xe, [0x6, 0x0, 0x7, 0x9, 0x5, 0x2, 0x5, 0x401, 0x7fff, 0x2000, 0x81, 0x7, 0x0, 0x7, 0xc432, 0x59, 0xff00, 0x3, 0x4, 0x7, 0x5, 0xe, 0x1, 0x7, 0x7, 0x3, 0x0, 0x6, 0x7ff, 0x6, 0x2, 0x6, 0x0, 0x3, 0x101, 0x4, 0x19, 0xfd2, 0x3, 0x7, 0x8, 0x8, 0x9, 0x10, 0x40, 0x6, 0x0, 0x8351], 0x5}}) 930.473002ms ago: executing program 6 (id=4023): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000002c0)={0x84, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0d, &(0x7f0000000040)) (fail_nth: 1) 894.960029ms ago: executing program 0 (id=4024): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000002c0)={0x84, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup(r2, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) r4 = openat$cgroup_type(r3, &(0x7f00000001c0), 0x2, 0x0) write$cgroup_type(r4, &(0x7f0000000240), 0x9) r5 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000079110c00000000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x70) ioctl$KVM_SET_ONE_REG(r7, 0x4010aeac, &(0x7f0000000180)=@other={0x20300002c0000103, 0x0}) r8 = syz_open_dev$cec(&(0x7f00000000c0), 0xffffffffffffffff, 0xa2243) ioctl$CEC_ADAP_S_LOG_ADDRS(r8, 0xc05c6104, &(0x7f0000000040)={'\x00\f\x00', 0x0, 0x5, 0x2, 0x9, 0xc, "00000000020000000000002100", "00004702", '\x00', '\x00', ["fdfeffbf84a438dfc5d5c010", "d78cb8b0211a83be12ff0bff", "0000efffffffffffbfff00", "000003cefd70f14003556000"]}) ioctl$CEC_TRANSMIT(r8, 0xc0386105, &(0x7f0000000100)={0xfffffffffffffff7, 0xfffffffffffffffe, 0x6, 0x9, 0x9, 0x7fff, "16b0bc450cfc47961ed5d8167d4f7865", 0x1, 0x52, 0x1, 0x49, 0x9, 0x9, 0xd}) ioctl$CEC_ADAP_S_LOG_ADDRS(r8, 0xc05c6104, &(0x7f0000000140)={"4497acf4", 0xb, 0x15, 0x0, 0x3, 0x3000006, 'U\x00', "1575a859", '\x00', '\'q6O', ["aabe8459c62224475793e8a7", "000400000000000000000040", "fa0700f22b42a3023be516d1"]}) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r9, 0xc0145b0d, &(0x7f0000000040)) 650.634573ms ago: executing program 5 (id=4025): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000001400002400128009000100626f6e7f076ffa2095330559640000000014000280080003000420000008000700010000007b1a6f565e2477d103558b2fc9ffa7dbec3160406a7777"], 0x44}}, 0x0) r3 = socket(0x1d, 0x2, 0x6) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x6a, 0x10, 0x0, &(0x7f0000000080)) r4 = syz_open_dev$usbfs(&(0x7f0000000180), 0x201, 0x2002) mmap(&(0x7f000039f000/0x4000)=nil, 0x4000, 0x9, 0x11, r4, 0x0) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0x1, 0x4}, 0x1}, 0x18) ioctl$AUTOFS_DEV_IOCTL_READY(r1, 0xc0189376, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r5) sendmsg$NL80211_CMD_DISASSOCIATE(r5, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r6, @ANYBLOB="20002bbd7000fedbdf25280000000a0006005050505050500000"], 0x20}, 0x1, 0x0, 0x0, 0x20040001}, 0x84) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) r9 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xfff1, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@newtfilter={0x3c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0x2}, {0xfff1, 0xffff}, {0x300, 0x9702fd4b6861288c}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_CT_STATE={0x6, 0x5b, 0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r11 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) readv(r11, &(0x7f00000002c0)=[{&(0x7f0000000000)=""/9, 0x9}], 0x1) 633.015675ms ago: executing program 4 (id=4026): r0 = socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r4, 0x1, 0x3}, 0x50) syz_open_procfs$namespace(0x0, &(0x7f0000002e00)='ns/cgroup\x00') syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000180)=r1) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, 0x0}, 0x58) r5 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r5, 0xc0945662, &(0x7f0000000040)={0xfffffff8, 0x0, '\x00', {0x0, @bt={0x6, 0x9f, 0x0, 0x2, 0x7, 0x8, 0x6, 0x11, 0x1, 0x5, 0x6, 0x983, 0x0, 0x20010, 0x1c, 0x21, {0x5, 0x3}, 0x8, 0x5}}}) r6 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x2042, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x403, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x88a8ffad, 0x52001}}, 0x20}}, 0x4008844) ioctl$AUTOFS_IOC_FAIL(r6, 0x4c80, 0x7000000) socket$nl_sock_diag(0x10, 0x3, 0x4) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000004c0)={'syz0\x00', {0x87, 0x3, 0x1, 0x9}, 0xb, [0x4, 0x6, 0x802, 0xe9a2, 0x1, 0x3, 0xa9ba, 0xc1f, 0x1, 0x7f5b, 0x3, 0x4, 0x5, 0x10004, 0x2, 0x3, 0x0, 0x3, 0xe, 0x3, 0x0, 0x2, 0xd9, 0x2, 0x6, 0x0, 0x3, 0x9, 0xfff, 0x8a0, 0x6, 0x8001, 0x33b5, 0x1, 0xfffffffc, 0x0, 0x9, 0xb, 0xcc, 0x4, 0x80, 0x400, 0x5, 0x5, 0xfffffffd, 0x8, 0xb, 0x3, 0xffff8001, 0x6, 0x3, 0x80000000, 0x1, 0xa, 0x7, 0x8, 0x5, 0xfff, 0x1, 0x7fe, 0x7fff, 0x10000, 0x2, 0x8], [0x2, 0x1, 0x10000, 0x7, 0x9, 0x6, 0x5, 0x4, 0x9, 0x7, 0x5, 0xdd5a, 0x6, 0x5, 0x7, 0x8, 0x5, 0xcc, 0xbc1, 0x80000, 0x0, 0x5e81339d, 0xffffc256, 0xb, 0x80000001, 0x0, 0x0, 0x4, 0x4, 0x7, 0x8, 0x10d, 0x1, 0x5, 0x5, 0xfffffb66, 0xfb5, 0x2, 0x4, 0x7, 0x2, 0x8000, 0x7fff, 0x1, 0x9425, 0x4, 0x6f, 0x80b, 0x1, 0x1, 0x525ba681, 0x4f74, 0x7, 0x1, 0x1, 0xfffffffd, 0x100, 0x6, 0x10000, 0x1306, 0x8b, 0x10000, 0xfe4, 0x3ff], [0x2, 0x40, 0x200, 0xfffffff9, 0x7aa, 0x10, 0x80, 0x8001, 0x5, 0x0, 0x9, 0x8, 0x7fffffff, 0x1, 0x1, 0x4, 0x8, 0xa9, 0x7, 0x49, 0x6, 0x4, 0x5, 0xa3, 0x40003, 0x2, 0x0, 0x3, 0x4c, 0x3, 0x5, 0x4, 0xd21e, 0x9, 0x12, 0x0, 0x2, 0xfff, 0x8, 0x800100, 0x7c83, 0xd, 0x1, 0x4, 0xf, 0x81, 0x47, 0x7, 0x0, 0x11, 0x2, 0xffd, 0x7, 0x7, 0x7ffd, 0x7ff, 0x10, 0x9, 0x10001, 0x8000001, 0x10001, 0x6, 0x71c], [0x81, 0x3, 0x10, 0x4e26, 0x3, 0x7, 0xfffffff3, 0x497, 0x4, 0x1, 0x2, 0x5, 0x56, 0xc28, 0x9, 0x5, 0x5, 0xa, 0x79a, 0x4, 0x9, 0x1ff, 0xc41f, 0x5, 0x8b6, 0xffffffff, 0x0, 0x0, 0x6a, 0x9, 0x0, 0x0, 0x1000, 0x10, 0xd, 0x6, 0x8000, 0x53, 0x78d, 0x4, 0x1, 0x9, 0xfffffff8, 0x9, 0x7, 0x7, 0x101, 0x7, 0x7, 0x4, 0x0, 0xb, 0x400400, 0x8, 0x28, 0x8, 0x7, 0x9, 0x2, 0x0, 0x1, 0x8001, 0xfffffff7, 0x5]}, 0x45c) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000980)={0x78, 0x0, 0xacf5e67dd0b583a1, 0x0, 0x0, {{0x5}, {@val={0x8}, @val={0xc, 0x99, {0x2000000, 0x5d}}}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x4e, 0xe, {{{0x0, 0x2, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x9}, @device_b, @device_a, @random="ec03f3b85ad3", {}, @value=@ver_80211n={0x0, 0x2, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1}}, 0xffffffffffffffa1, @random=0x4, 0x0, @void, @void, @val={0x3, 0x1}, @val={0x4, 0x6, {0x4a, 0x1e, 0x5, 0x81}}, @val={0x6, 0x2, 0x8343}, @void, @void, @val={0x2a, 0x1}, @void, @void, @val={0x72, 0x6}, @void, @val={0x76, 0x6, {0xf, 0xf4, 0x22, 0x4}}}}]]}, 0x78}, 0x1, 0x0, 0x0, 0x8810}, 0x0) 179.605948ms ago: executing program 0 (id=4027): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x33) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000240)={0x1ff, 0x1, 0x200000, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) r1 = openat$dsp1(0xffffffffffffff9c, 0x0, 0x22080, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r2, 0xc138fd03, &(0x7f0000000100)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141") ioctl(r2, 0xc138fd09, &(0x7f0000000300)="0400000032000000000000008a0100003801000001000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141000000000000000008000000000000000000000000000000726169640000000000000000000000007261696431203120382032202d202f6465762f6e756c6c6230202d202f6465762f6e756c6c623100") ioctl(r2, 0xc138fd0c, &(0x7f0000000500)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141") r3 = dup2(r1, r1) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r3, 0xc0189378, &(0x7f0000005c80)={{0x1, 0x1, 0x18, r0, {r1}}, './file0\x00'}) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x4e23, @remote}}, 0x0, 0x0, 0x3b, 0x0, "38412b7c1ef9ca07c001da998a4df5ca3e516adef94d6e4a18f11d3bc67fd62b45233c367bf16d79eea6821e3874c0c07ad5feb5be8e74072144db691657e44f588c29aa4363e73ab68f91b6a4fb9bc3"}, 0xd8) r5 = add_key(&(0x7f0000000040)='ceph\x00', 0x0, &(0x7f0000000000)="0100000200373a4541062000a59ea940d2cb0b3692f5020000a00000050000000000eb000000a5e5be21c44e", 0x2c, 0xffffffffffffffff) keyctl$get_security(0x11, r5, &(0x7f0000000080)=""/107, 0x6b) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000001640), &(0x7f0000001680)=0xc) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r3, 0xc01864c1, &(0x7f0000005500)) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4038587a, &(0x7f0000005e40)={{r4, &(0x7f0000005d00)='/\x00', 0x80280, &(0x7f0000005d40)={@_ha_fsid={[0x3, 0x5]}, {0xd, 0x5, 0x9, 0x5}}, 0x1, &(0x7f0000005d80)={@_ha_fsid}, &(0x7f0000005dc0)=0x5}, {[0xc8, 0x3, 0xd2d]}, 0xa2, 0x0, &(0x7f0000005e00)}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r10 = dup(r9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r10, 0x2000) ioctl$KVM_PRE_FAULT_MEMORY(r8, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) 0s ago: executing program 0 (id=4028): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1a85, @loopback}, 0x10) listen(r0, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./ceph_mnt\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='127.0.0.1:6789:/\x00', &(0x7f0000000100)='./ceph_mnt\x00', &(0x7f0000000300)='ceph\x00', 0x0, &(0x7f0000000400)='abort_on_full,ms_mode=legacy,nocephx_sign_messages,nocrc,mount_timeout=2\x00') r1 = accept4$inet(r0, 0x0, 0x0, 0x0) write(r1, &(0x7f0000000500)='ceph v027', 0x9) write(r1, &(0x7f0000000600)='\x00'/272, 0x110) write(r1, &(0x7f0000000800)="01ffff7fffffffff3f00"/26, 0x1a) write(r1, &(0x7f0000000900)="070100000000000000000000000000000029000000010018000000000000000000000000000100000000000000000100000000000000000000000000000000000000000000000000000000000000b0e68b83000000000000000000", 0x5b) nanosleep(&(0x7f0000000a00)={0x1}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001d00)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8fff7ff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b70500000000e000720a23fe000000008500000012000000b70000000000000095000000000000004e6258941c823b7505608556ba4ababb42684e890d31ae450400373a0a5447a801b8c1c4f0c4bd97c6555e61345400f9bd42abeb9ade0105000000000000a21902ff07000094a2b51c21df74924f5436a6ed89b98f75e800230c49c90fe1336481f3b92a63336c36fcd745d61d7739c6554ca201000000bebbe8282f8b1e26407437a397bf8f50e87ed4d27adfd876bffc402887781979461c4363bc5c9b6202ea471428197ef88bc333fbcec0ea4334844d232279ae95a90fd41d528f58d305000000435883df6c10ce86188c92292b2d0226082960be682836bdff8b0971f2a5405e453228e7b1005bd73479358a90df3e481947de6453736aa572158af6ea63d6d418fbbd2bba050000001da000ef78df03000000d19913a5fb03c79dac2e489f68127892658115e7ffb588a71dffffff951b8535167ab8069a2c92a3aa18e22517000026637b4c34bf2d0aa304ed42bf70480e9e97203fd169411f37fddd1f7fbe16dbbc0f307bceb5064f388a0350c3dc928b0e638b1e2b2a9d25264233e5d45eb377f56b95241024dbe30f67191c2b56b70328d6d3215dfffe5d89af1d10599bd494d921d1fb2db99b6aba0fa978f41eb1d4c553e5a9326ed550c13f8dd36716a899a1e79234294707c5312b924d142c17b20bb80ee202222c03fa84ccc374e717f694018630366397266090a82343aedfbf7afe892390c2eb775b0d16073da2229958db05de7df6ab7600004000010000006d8081cb3bf251d906c00da0e23b50465f8394820be571e3592d0000c7ef10fdc462e7040e7074ec43aa461fc54401a76406db718d4efd6c1bd10ce1d087cf9bba461162555a95524c84df0952d32093082b7aa71304e0d2d9ec310d1b676b378a5879e47941de1a28c3a8f400000000000000000e032b7d2badd0bc6617a859b7ac273b6304555f664469cec152030f06cc0ca1765838eb5590264736fbccfc3a8f4e3b10daf6a275daf5db2dac7096fe8ac8876acaad043663b3b0fedb05e6d31408fa20140c9d2db1c59ac8a3ce28e489d67d87d3a107ccea3007f58f2c5017e8807107f79ac50cc1d4f546b4443d137eb706b71b1767a10cca7a7c82b76c96e874aff249f36329a6526b354b6e674b08f7ef492b804c4b08fb10de807d79fd782027318cd7632e22d2faa16209272b39b5ec8d239832ea02cc88e249a2e77753a58987547571fbc8de747faab724bebb6401412b496e078fcb6c78ab447e871b76a8b0506f49594aa1d610567e14d739a60ff3ce04d0d2e5681e787c7e1ad25467bb81f2f448128207fe07a83759ec30cf9e0a3fd3f2fcee97fe8d273f8e712a8a64eaf2d89a1fa44554357fcd7ab531ff7a41c27164fca430a62d015b477de61853f5ee2e25b00a63642ec32ece2ff3bb5883deb895f52a923b5c744d8dccdd6a09ded8b90f1eeda8e6e884a4f090edb6ab9fc8107846508d51f3735493d5860cf80200ce31b92eb3563d485b5a7d192092d7a9fd2bc67d305d1d4573aad5f6501d1cd27657ce17330402dacb78d72d776330711645eed7d4c292f4448733c0826c4eb950f3d40457f82d7f792d106518f6bde874aff9e2bea7d73f74bebeeacfc700000000000000000000d40d73be47803297db004264c8c70b7761b22a7114a078a87d63d63b0c9dcc263a5b773bfeba212abef4181ad9e4872e328c0f105d51e3d167a2b717051d7681ba04552eeba18a000000b22b50d76d85040c9000ea68a528049a60d5e26b20455194f4be3b8466fd66d0e6cefcff7891c485d61cb66f4076cd60a22733cb00cf7cc12ca7d9bb864c0e650236a79a5c85349a9b1e6bbc3bace197e72490c566431cd3a08e9d1b641c1ba1f661d01573b904c3fa1427370fa15cecd294ac21fefe3d161fdf58e8bc5957ef145839f4370176e1be88d2e3516a1998c1621a00b4438b85a4dfee6f61827a1e50e158038b037dfda3ffb35069e41fc740ae720800de53948f176c3c15f3a529c02434b920d87f12a6e3420a2fdcb3559e7a5b1ddbb06b7a5977f63bfac701e673bf626d126b213c92e7169a930beb8d76f9db34e8098bea301baa96916d6458c923866dc192928b320738d1b298fb55f2a64500000000000000000000000000509885a38d9d995a46817e7ff7acddcc5f9253c63f86baf33f92820c9ff497cf76b6482c3ab53fb6ecea6d220b91b99b2fb4279ab09ae0645ab92df309000000000000a4868411948f8e3e259b717d722a1eebd3f6860a17f1ae9e10a1178f6aef4951b192d13e9600c1f700ca7b1d127e451034469bf2a8f93dbae6ad8e932e431dc18323794156238625bb9c45c5a76a68a8646e701b29a71ffbd854f50f195823106a5625ff94221f1f04c72525b50aae69081de9626de9847bf53475d90642d9730101d80b1b0000000000000000822b0641698d60160d9157548302dd2636d12c431f96728ae4a45361e6d47a1c4a52d67c0f0a62585c09fcfd70d0f249f87c44b47283c1c6f2430d70c751e4ada9b646e6e7c1719faee476d88a2943c71a21db55b7497dd7ed385ac2e8cb916390a3a0ed52e7371e1a141e69afa07b46ac20f3521fb251b72c82ee1c7eb4f67c0deed5618d0db925ce7a7c50a99835544c540f5d528587d1a26e78df1bc9a8e4d90c57d0b8122eae7b23e4456624f5337c16c42648c7a3d0b799ad409befe0cbe2aa781ba826918df7aa80dff4f62258e54419629eb1d37de7f6a3512bd618781d1ad3a4d4b0da44df9f9a93f0487f79a9b16dfa6f68b06ce6a96ca344d194cded05702c2300d1a4f451b33830765f8131f6c28fada65701851bba089b8a8347900e72d68cea965feb6a06225dd3f0e135323a5bde3b43c9d242b73abf9e05336af040a4a6bb5918146393f1d50705c1d1e986bf2f690de51ee8727d37339df5391db535bb1e9bb3e5dadb6e5a2bb4faa2dcbc6ca9b40ac96e448b9dadeb08fc2cf3a960f22bf20b9e967b7a75687372b8e3edc543896c360674d901a7f56b07ba1479b46eea3d94026a9c7e670ab40bb2c1ca1a7c90299361239bef773140af974c7efc285a64633d21513481b3ac62dec9fa3e8ce6156d76b82baa145bc550b0ccbc0934ccfea45292caa2f0654fe18dc0669a4f2af9fa232a293ad94261f55675cc686db72783a6bacc0df6a1ea943ae266af112f35319980cd681811a369e0d03cf7d22bed7cbe1afe498b88942b1bf7edae441a0d0d88fce65cb4e848793a28cbd7373f6acd3b5a48c034e487750388929d37fa3165f205dab3be5f3e5781a84298687cbf02dcaf0e14a2b260293f349d076eb75a2ddc5382d106f0beea02aa45018fe36d1176cf7704383b6922d10dc80bc7feca3982ae232d4bb47c722c83a7cf6ee8832f038b072eb803a47cd7f753e80c9f6eedb8"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1d4}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x300f000, 0xe, 0x0, &(0x7f0000000080)="0069c2704ade28eddb0000200000", 0x0, 0x48b8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) kernel console output (not intermixed with test programs): 85 not found at 0x00012018: 0xdb3d instead [ 1202.758401][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001203c: 0xb142 instead [ 1202.758441][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013000: 0x4255 instead [ 1202.758457][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013004: 0x0001 instead [ 1202.758471][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013018: 0xdb3d instead [ 1202.758488][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001303c: 0xb142 instead [ 1202.758528][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014000: 0x4255 instead [ 1202.758542][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014004: 0x0001 instead [ 1202.758557][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014018: 0xdb3d instead [ 1202.758570][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001403c: 0xb142 instead [ 1202.758594][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015000: 0x4255 instead [ 1202.758603][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015004: 0x0001 instead [ 1202.758612][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015018: 0xdb3d instead [ 1202.758621][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001503c: 0xb142 instead [ 1202.758644][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016000: 0x4255 instead [ 1202.758653][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016004: 0x0001 instead [ 1202.758662][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016018: 0xdb3d instead [ 1202.758672][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001603c: 0xb142 instead [ 1202.758694][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017000: 0x4255 instead [ 1202.758703][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017004: 0x0001 instead [ 1202.758711][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017018: 0xdb3d instead [ 1202.758721][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001703c: 0xb142 instead [ 1202.758743][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018000: 0x4255 instead [ 1202.758751][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018004: 0x0001 instead [ 1202.758760][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018018: 0xdb3d instead [ 1202.758770][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001803c: 0xb142 instead [ 1202.758796][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019000: 0x4255 instead [ 1202.758805][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019004: 0x0001 instead [ 1202.758814][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019018: 0xdb3d instead [ 1202.758824][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001903c: 0xb142 instead [ 1202.758847][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a000: 0x4255 instead [ 1202.758855][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a004: 0x0001 instead [ 1202.758864][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a018: 0xdb3d instead [ 1202.758874][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a03c: 0xb142 instead [ 1202.758896][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b000: 0x4255 instead [ 1202.758905][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b004: 0x0001 instead [ 1202.758914][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b018: 0xdb3d instead [ 1202.758924][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b03c: 0xb142 instead [ 1202.758946][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c000: 0x4255 instead [ 1202.758955][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c004: 0x0001 instead [ 1202.758964][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c018: 0xdb3d instead [ 1202.758974][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c03c: 0xb142 instead [ 1202.758997][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d000: 0x4255 instead [ 1202.759006][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d004: 0x0001 instead [ 1202.759015][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d018: 0xdb3d instead [ 1202.759025][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d03c: 0xb142 instead [ 1202.759047][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e000: 0x4255 instead [ 1202.759144][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e004: 0x0001 instead [ 1202.759156][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e018: 0xdb3d instead [ 1202.759168][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e03c: 0xb142 instead [ 1202.759196][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4255 instead [ 1202.759206][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x0001 instead [ 1202.759234][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0xdb3d instead [ 1202.759244][T19534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f03c: 0xb142 instead [ 1202.759262][T19534] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 1202.759267][T19534] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 1202.831235][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x4255 instead [ 1202.831251][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0001 instead [ 1202.831261][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0xdb3d instead [ 1202.831272][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000003c: 0xb142 instead [ 1202.831282][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000040: 0x4255 instead [ 1202.831292][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000044: 0x0101 instead [ 1202.831302][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000048: 0xff7f instead [ 1202.831314][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000007c: 0xb365 instead [ 1202.831332][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000128: 0x16f1 instead [ 1202.831350][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000001d4: 0x16f1 instead [ 1202.831359][T19537] jffs2: Further such events for this erase block will not be printed [ 1202.831599][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001000: 0x4255 instead [ 1202.831616][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001004: 0x0001 instead [ 1202.831632][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001018: 0xdb3d instead [ 1202.831650][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000103c: 0xb142 instead [ 1202.831662][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001040: 0x4255 instead [ 1202.831675][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001044: 0x0101 instead [ 1202.831683][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001048: 0xff7f instead [ 1202.831727][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000107c: 0xef7b instead [ 1202.831754][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001128: 0x16f1 instead [ 1202.831780][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000011d4: 0x16f1 instead [ 1202.831794][T19537] jffs2: Further such events for this erase block will not be printed [ 1202.831999][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002000: 0x4255 instead [ 1202.832009][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002004: 0x0001 instead [ 1202.832019][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002018: 0xdb3d instead [ 1202.832030][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000203c: 0xb142 instead [ 1202.832056][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003000: 0x4255 instead [ 1202.832066][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003004: 0x0001 instead [ 1202.832076][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003018: 0xdb3d instead [ 1202.832086][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000303c: 0xb142 instead [ 1202.832181][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004000: 0x4255 instead [ 1202.832196][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004004: 0x0001 instead [ 1202.832206][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004018: 0xdb3d instead [ 1202.832217][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000403c: 0xb142 instead [ 1202.832242][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005000: 0x4255 instead [ 1202.832251][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005004: 0x0001 instead [ 1202.832261][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005018: 0xdb3d instead [ 1202.832272][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000503c: 0xb142 instead [ 1202.832306][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006000: 0x4255 instead [ 1202.834391][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006004: 0x0001 instead [ 1202.834406][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006018: 0xdb3d instead [ 1202.834418][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000603c: 0xb142 instead [ 1202.834450][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007000: 0x4255 instead [ 1202.834460][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007004: 0x0001 instead [ 1202.834470][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007018: 0xdb3d instead [ 1202.834481][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000703c: 0xb142 instead [ 1202.834506][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008000: 0x4255 instead [ 1202.834516][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008004: 0x0001 instead [ 1202.834527][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008018: 0xdb3d instead [ 1202.834538][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000803c: 0xb142 instead [ 1202.834562][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009000: 0x4255 instead [ 1202.834571][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009004: 0x0001 instead [ 1202.834581][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009018: 0xdb3d instead [ 1202.834593][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000903c: 0xb142 instead [ 1202.834617][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a000: 0x4255 instead [ 1202.834626][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a004: 0x0001 instead [ 1202.834635][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a018: 0xdb3d instead [ 1202.834645][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a03c: 0xb142 instead [ 1202.834668][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b000: 0x4255 instead [ 1202.834677][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b004: 0x0001 instead [ 1202.834686][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b018: 0xdb3d instead [ 1202.834696][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b03c: 0xb142 instead [ 1202.834719][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c000: 0x4255 instead [ 1202.834728][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c004: 0x0001 instead [ 1202.834738][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c018: 0xdb3d instead [ 1202.834752][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c03c: 0xb142 instead [ 1202.834787][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d000: 0x4255 instead [ 1202.834800][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d004: 0x0001 instead [ 1202.834815][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d018: 0xdb3d instead [ 1202.834825][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d03c: 0xb142 instead [ 1202.834849][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e000: 0x4255 instead [ 1202.834857][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e004: 0x0001 instead [ 1202.834866][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e018: 0xdb3d instead [ 1202.834876][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e03c: 0xb142 instead [ 1202.834899][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f000: 0x4255 instead [ 1202.834908][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f004: 0x0001 instead [ 1202.834917][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f018: 0xdb3d instead [ 1202.834928][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f03c: 0xb142 instead [ 1202.834964][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0x4255 instead [ 1202.834979][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010004: 0x0001 instead [ 1202.834996][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010018: 0xdb3d instead [ 1202.835013][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001003c: 0xb142 instead [ 1202.835054][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011000: 0x4255 instead [ 1202.835068][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011004: 0x0001 instead [ 1202.835080][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011018: 0xdb3d instead [ 1202.835090][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001103c: 0xb142 instead [ 1202.835113][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012000: 0x4255 instead [ 1202.835121][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012004: 0x0001 instead [ 1202.835130][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012018: 0xdb3d instead [ 1202.835140][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001203c: 0xb142 instead [ 1202.835163][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013000: 0x4255 instead [ 1202.835171][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013004: 0x0001 instead [ 1202.835181][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013018: 0xdb3d instead [ 1202.835191][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001303c: 0xb142 instead [ 1202.835213][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014000: 0x4255 instead [ 1202.835225][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014004: 0x0001 instead [ 1202.835239][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014018: 0xdb3d instead [ 1202.835254][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001403c: 0xb142 instead [ 1202.835302][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015000: 0x4255 instead [ 1202.835319][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015004: 0x0001 instead [ 1202.835336][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015018: 0xdb3d instead [ 1202.835352][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001503c: 0xb142 instead [ 1202.835394][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016000: 0x4255 instead [ 1202.835407][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016004: 0x0001 instead [ 1202.835416][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016018: 0xdb3d instead [ 1202.835426][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001603c: 0xb142 instead [ 1202.835448][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017000: 0x4255 instead [ 1202.835457][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017004: 0x0001 instead [ 1202.835466][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017018: 0xdb3d instead [ 1202.835476][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001703c: 0xb142 instead [ 1202.835504][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018000: 0x4255 instead [ 1202.835512][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018004: 0x0001 instead [ 1202.835630][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018018: 0xdb3d instead [ 1202.835647][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001803c: 0xb142 instead [ 1202.835710][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019000: 0x4255 instead [ 1202.835728][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019004: 0x0001 instead [ 1202.835746][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019018: 0xdb3d instead [ 1202.835766][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001903c: 0xb142 instead [ 1202.835804][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a000: 0x4255 instead [ 1202.835819][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a004: 0x0001 instead [ 1202.835833][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a018: 0xdb3d instead [ 1202.835849][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a03c: 0xb142 instead [ 1202.835888][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b000: 0x4255 instead [ 1202.835901][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b004: 0x0001 instead [ 1202.835915][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b018: 0xdb3d instead [ 1202.835932][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b03c: 0xb142 instead [ 1202.835975][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c000: 0x4255 instead [ 1202.835991][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c004: 0x0001 instead [ 1202.836006][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c018: 0xdb3d instead [ 1202.836023][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c03c: 0xb142 instead [ 1202.836066][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d000: 0x4255 instead [ 1202.836082][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d004: 0x0001 instead [ 1202.836097][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d018: 0xdb3d instead [ 1202.836114][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d03c: 0xb142 instead [ 1202.836157][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e000: 0x4255 instead [ 1202.836172][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e004: 0x0001 instead [ 1202.836187][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e018: 0xdb3d instead [ 1202.836206][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e03c: 0xb142 instead [ 1202.836248][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4255 instead [ 1202.836264][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x0001 instead [ 1202.836286][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0xdb3d instead [ 1202.836304][T19537] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f03c: 0xb142 instead [ 1202.836339][T19537] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 1202.836348][T19537] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 1202.967305][ T5740] Bluetooth: hci2: unexpected event for opcode 0x2035 [ 1203.507711][ T43] audit: type=1800 audit(1789146558.627:9): pid=19554 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.3562" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 1203.553286][T19558] netlink: 'syz.4.3563': attribute type 9 has an invalid length. [ 1203.556274][T19558] fuse: Bad value for 'fd' [ 1203.671129][ T43] audit: type=1326 audit(1789146558.787:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19561 comm="syz.4.3564" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 1203.677521][ T43] audit: type=1326 audit(1789146558.787:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19561 comm="syz.4.3564" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 1203.679408][ T43] audit: type=1326 audit(1789146558.797:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19561 comm="syz.4.3564" exe="/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 1203.679578][ T43] audit: type=1326 audit(1789146558.797:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19561 comm="syz.4.3564" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 1203.680978][ T43] audit: type=1326 audit(1789146558.797:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19561 comm="syz.4.3564" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 1203.684433][ T43] audit: type=1326 audit(1789146558.797:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19561 comm="syz.4.3564" exe="/syz-executor" sig=0 arch=40000003 syscall=330 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 1203.684597][ T43] audit: type=1326 audit(1789146558.797:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19561 comm="syz.4.3564" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff7fec code=0x7ffc0000 [ 1203.761596][T19560] __nla_validate_parse: 6 callbacks suppressed [ 1203.761610][T19560] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3561'. [ 1203.922367][ T43] audit: type=1107 audit(1789146559.007:17): pid=19567 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 1203.972102][ T5740] Bluetooth: hci2: unexpected event for opcode 0x2035 [ 1204.229902][ T5740] Bluetooth: hci1: unexpected event for opcode 0x2035 [ 1204.855956][T19591] FAULT_INJECTION: forcing a failure. [ 1204.855956][T19591] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1204.855989][T19591] CPU: 3 UID: 0 PID: 19591 Comm: syz.5.3574 Tainted: G L syzkaller #0 PREEMPT(full) [ 1204.856015][T19591] Tainted: [L]=SOFTLOCKUP [ 1204.856023][T19591] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1204.856036][T19591] Call Trace: [ 1204.856044][T19591] [ 1204.856053][T19591] dump_stack_lvl+0x100/0x190 [ 1204.856083][T19591] should_fail_ex.cold+0x5/0xa [ 1204.856108][T19591] _copy_from_user+0x2e/0xd0 [ 1204.856136][T19591] __sys_bpf+0x2f5/0x4a30 [ 1204.856156][T19591] ? plist_check_list+0x1b8/0x280 [ 1204.856183][T19591] ? plist_check_list+0x190/0x280 [ 1204.856207][T19591] ? __pfx___sys_bpf+0x10/0x10 [ 1204.856226][T19591] ? find_held_lock+0x2b/0x80 [ 1204.856246][T19591] ? futex_wake+0x4ea/0x5e0 [ 1204.856272][T19591] ? futex_private_hash_put.part.0+0xdc/0x180 [ 1204.856303][T19591] ? futex_private_hash_put+0x24/0x30 [ 1204.856337][T19591] ? __pfx_futex_wake+0x10/0x10 [ 1204.856384][T19591] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 1204.856406][T19591] ? __ia32_sys_futex_time32+0x2fd/0x470 [ 1204.856431][T19591] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 1204.856451][T19591] ? kmem_cache_free+0x127/0x6c0 [ 1204.856485][T19591] ? __ia32_sys_bpf+0xcc/0x170 [ 1204.856504][T19591] __ia32_sys_bpf+0xcc/0x170 [ 1204.856525][T19591] ? __do_fast_syscall_32+0xb3/0x8b0 [ 1204.856557][T19591] __do_fast_syscall_32+0x13a/0x8b0 [ 1204.856590][T19591] do_fast_syscall_32+0x32/0x70 [ 1204.856620][T19591] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1204.856645][T19591] RIP: 0023:0xf706efec [ 1204.856664][T19591] Code: Unable to access opcode bytes at 0xf706efc2. [ 1204.856673][T19591] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1204.856692][T19591] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800006c0 [ 1204.856704][T19591] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 1204.856716][T19591] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1204.856727][T19591] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1204.856738][T19591] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1204.856764][T19591] [ 1205.094615][T19594] capability: warning: `syz.0.3575' uses deprecated v2 capabilities in a way that may be insecure [ 1205.826441][T19605] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3578'. [ 1205.875368][T19605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1205.880400][T19605] mac80211_hwsim hwsim19 wlan1: entered promiscuous mode [ 1205.882226][T19605] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1206.149527][T19609] mmap: syz.4.3580 (19609): VmData 20725760 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 1206.801690][ T5740] Bluetooth: hci2: unexpected event for opcode 0x2035 [ 1206.923935][T14921] Process accounting resumed [ 1207.454011][T19628] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3585'. [ 1207.760894][T19631] Console: switching to colour dummy device 80x25 [ 1207.788221][T19632] i2c i2c-1: new_device: Invalid device name [ 1207.879556][T19638] FAULT_INJECTION: forcing a failure. [ 1207.879556][T19638] name failslab, interval 1, probability 0, space 0, times 0 [ 1207.879590][T19638] CPU: 0 UID: 0 PID: 19638 Comm: syz.5.3588 Tainted: G L syzkaller #0 PREEMPT(full) [ 1207.879615][T19638] Tainted: [L]=SOFTLOCKUP [ 1207.879622][T19638] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1207.879633][T19638] Call Trace: [ 1207.879640][T19638] [ 1207.879648][T19638] dump_stack_lvl+0x100/0x190 [ 1207.879701][T19638] should_fail_ex.cold+0x5/0xa [ 1207.879727][T19638] should_failslab+0xc2/0x120 [ 1207.879750][T19638] __kmalloc_noprof+0xfc/0x840 [ 1207.879766][T19638] ? rcu_is_watching+0x13/0xc0 [ 1207.879778][T19638] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1207.879794][T19638] tomoyo_realpath_from_path+0xb6/0x690 [ 1207.879808][T19638] tomoyo_path_number_perm+0x23c/0x580 [ 1207.879824][T19638] ? tomoyo_path_number_perm+0x22e/0x580 [ 1207.879846][T19638] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1207.879868][T19638] ? __lock_acquire+0x5c0/0x1f40 [ 1207.879889][T19638] ? __fget_files+0x34/0x3d0 [ 1207.879902][T19638] ? find_held_lock+0x2b/0x80 [ 1207.879914][T19638] ? __fget_files+0x215/0x3d0 [ 1207.879925][T19638] ? hook_file_ioctl_common+0x140/0x440 [ 1207.879941][T19638] ? __fget_files+0x215/0x3d0 [ 1207.879955][T19638] ? __fget_files+0x21f/0x3d0 [ 1207.879970][T19638] security_file_ioctl_compat+0xd3/0x230 [ 1207.879988][T19638] __ia32_compat_sys_ioctl+0xc2/0x360 [ 1207.880008][T19638] __do_fast_syscall_32+0x13a/0x8b0 [ 1207.880028][T19638] do_fast_syscall_32+0x32/0x70 [ 1207.880045][T19638] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1207.880060][T19638] RIP: 0023:0xf706efec [ 1207.880073][T19638] Code: Unable to access opcode bytes at 0xf706efc2. [ 1207.880079][T19638] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1207.880090][T19638] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040041271 [ 1207.880097][T19638] RDX: 0000000080000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 1207.880104][T19638] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1207.880110][T19638] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1207.880117][T19638] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1207.880131][T19638] [ 1207.880136][T19638] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1208.070113][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x4255 instead [ 1208.070130][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0001 instead [ 1208.070142][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0xdb3d instead [ 1208.070153][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000003c: 0xb142 instead [ 1208.070162][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000040: 0x4255 instead [ 1208.070171][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000044: 0x0101 instead [ 1208.070180][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000048: 0xff7f instead [ 1208.070192][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000007c: 0xb365 instead [ 1208.070210][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000128: 0x16f1 instead [ 1208.070261][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000001d4: 0x16f1 instead [ 1208.070271][T19645] jffs2: Further such events for this erase block will not be printed [ 1208.070473][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001000: 0x4255 instead [ 1208.070482][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001004: 0x0001 instead [ 1208.070491][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001018: 0xdb3d instead [ 1208.070501][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000103c: 0xb142 instead [ 1208.070509][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001040: 0x4255 instead [ 1208.070517][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001044: 0x0101 instead [ 1208.070526][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001048: 0xff7f instead [ 1208.070536][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000107c: 0xef7b instead [ 1208.070552][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001128: 0x16f1 instead [ 1208.070569][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000011d4: 0x16f1 instead [ 1208.070577][T19645] jffs2: Further such events for this erase block will not be printed [ 1208.070760][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002000: 0x4255 instead [ 1208.070769][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002004: 0x0001 instead [ 1208.070778][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002018: 0xdb3d instead [ 1208.070787][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000203c: 0xb142 instead [ 1208.070810][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003000: 0x4255 instead [ 1208.070819][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003004: 0x0001 instead [ 1208.070828][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003018: 0xdb3d instead [ 1208.070838][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000303c: 0xb142 instead [ 1208.070860][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004000: 0x4255 instead [ 1208.070869][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004004: 0x0001 instead [ 1208.070879][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004018: 0xdb3d instead [ 1208.070889][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000403c: 0xb142 instead [ 1208.070919][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005000: 0x4255 instead [ 1208.070928][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005004: 0x0001 instead [ 1208.070938][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005018: 0xdb3d instead [ 1208.070949][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000503c: 0xb142 instead [ 1208.070973][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006000: 0x4255 instead [ 1208.070982][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006004: 0x0001 instead [ 1208.070993][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006018: 0xdb3d instead [ 1208.071004][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000603c: 0xb142 instead [ 1208.071027][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007000: 0x4255 instead [ 1208.071037][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007004: 0x0001 instead [ 1208.071046][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007018: 0xdb3d instead [ 1208.071056][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000703c: 0xb142 instead [ 1208.071080][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008000: 0x4255 instead [ 1208.072468][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008004: 0x0001 instead [ 1208.072482][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008018: 0xdb3d instead [ 1208.072493][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000803c: 0xb142 instead [ 1208.072521][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009000: 0x4255 instead [ 1208.072530][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009004: 0x0001 instead [ 1208.072539][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009018: 0xdb3d instead [ 1208.072550][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000903c: 0xb142 instead [ 1208.072574][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a000: 0x4255 instead [ 1208.072583][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a004: 0x0001 instead [ 1208.072593][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a018: 0xdb3d instead [ 1208.072604][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a03c: 0xb142 instead [ 1208.072629][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b000: 0x4255 instead [ 1208.072638][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b004: 0x0001 instead [ 1208.072648][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b018: 0xdb3d instead [ 1208.072660][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b03c: 0xb142 instead [ 1208.072684][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c000: 0x4255 instead [ 1208.072693][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c004: 0x0001 instead [ 1208.072702][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c018: 0xdb3d instead [ 1208.072712][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c03c: 0xb142 instead [ 1208.072735][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d000: 0x4255 instead [ 1208.072743][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d004: 0x0001 instead [ 1208.072752][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d018: 0xdb3d instead [ 1208.072762][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d03c: 0xb142 instead [ 1208.072785][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e000: 0x4255 instead [ 1208.072794][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e004: 0x0001 instead [ 1208.072803][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e018: 0xdb3d instead [ 1208.072812][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e03c: 0xb142 instead [ 1208.072835][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f000: 0x4255 instead [ 1208.072843][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f004: 0x0001 instead [ 1208.072852][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f018: 0xdb3d instead [ 1208.072862][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f03c: 0xb142 instead [ 1208.072884][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0x4255 instead [ 1208.072893][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010004: 0x0001 instead [ 1208.072902][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010018: 0xdb3d instead [ 1208.072917][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001003c: 0xb142 instead [ 1208.072941][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011000: 0x4255 instead [ 1208.072952][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011004: 0x0001 instead [ 1208.072962][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011018: 0xdb3d instead [ 1208.072973][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001103c: 0xb142 instead [ 1208.072997][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012000: 0x4255 instead [ 1208.073007][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012004: 0x0001 instead [ 1208.073017][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012018: 0xdb3d instead [ 1208.073027][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001203c: 0xb142 instead [ 1208.073051][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013000: 0x4255 instead [ 1208.073061][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013004: 0x0001 instead [ 1208.073071][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013018: 0xdb3d instead [ 1208.073081][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001303c: 0xb142 instead [ 1208.073122][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014000: 0x4255 instead [ 1208.073132][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014004: 0x0001 instead [ 1208.073141][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014018: 0xdb3d instead [ 1208.073150][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001403c: 0xb142 instead [ 1208.073173][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015000: 0x4255 instead [ 1208.073266][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015004: 0x0001 instead [ 1208.073278][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015018: 0xdb3d instead [ 1208.073290][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001503c: 0xb142 instead [ 1208.073315][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016000: 0x4255 instead [ 1208.073324][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016004: 0x0001 instead [ 1208.073334][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016018: 0xdb3d instead [ 1208.073349][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001603c: 0xb142 instead [ 1208.073373][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017000: 0x4255 instead [ 1208.073382][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017004: 0x0001 instead [ 1208.073391][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017018: 0xdb3d instead [ 1208.073401][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001703c: 0xb142 instead [ 1208.073427][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018000: 0x4255 instead [ 1208.073436][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018004: 0x0001 instead [ 1208.073445][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018018: 0xdb3d instead [ 1208.073455][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001803c: 0xb142 instead [ 1208.073477][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019000: 0x4255 instead [ 1208.073485][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019004: 0x0001 instead [ 1208.073494][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019018: 0xdb3d instead [ 1208.073504][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001903c: 0xb142 instead [ 1208.074313][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a000: 0x4255 instead [ 1208.074325][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a004: 0x0001 instead [ 1208.074334][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a018: 0xdb3d instead [ 1208.074345][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a03c: 0xb142 instead [ 1208.074369][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b000: 0x4255 instead [ 1208.074378][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b004: 0x0001 instead [ 1208.074388][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b018: 0xdb3d instead [ 1208.074399][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b03c: 0xb142 instead [ 1208.074423][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c000: 0x4255 instead [ 1208.074434][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c004: 0x0001 instead [ 1208.074444][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c018: 0xdb3d instead [ 1208.074455][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c03c: 0xb142 instead [ 1208.074478][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d000: 0x4255 instead [ 1208.074487][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d004: 0x0001 instead [ 1208.074496][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d018: 0xdb3d instead [ 1208.074506][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d03c: 0xb142 instead [ 1208.074528][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e000: 0x4255 instead [ 1208.074537][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e004: 0x0001 instead [ 1208.074546][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e018: 0xdb3d instead [ 1208.074556][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e03c: 0xb142 instead [ 1208.074579][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4255 instead [ 1208.074587][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x0001 instead [ 1208.074596][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0xdb3d instead [ 1208.074606][T19645] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f03c: 0xb142 instead [ 1208.074624][T19645] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 1208.074629][T19645] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 1208.104886][T19632] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 1208.145042][T19632] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 1208.145145][T19632] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 1208.145394][T19632] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 1208.149532][T19632] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 1208.194398][T19632] pci 0000:00:01.0: Adding to iommu group 1 [ 1208.295757][T19632] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 1208.295772][T19632] pci 0000:00:01.0: vgaarb: bridge control possible [ 1208.295779][T19632] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 1208.338044][T19632] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 1208.338157][T19632] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 1208.344888][T19632] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 1208.621292][T19632] [drm] Found bochs VGA, ID 0xb0c5. [ 1208.621312][T19632] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 1208.697191][T19632] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 1208.914788][ T43] audit: type=1326 audit(1789146564.027:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19658 comm="syz.5.3594" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 1208.915203][ T43] audit: type=1326 audit(1789146564.027:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19658 comm="syz.5.3594" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 1208.916577][ T43] audit: type=1326 audit(1789146564.037:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19658 comm="syz.5.3594" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 1208.916678][ T43] audit: type=1326 audit(1789146564.037:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19658 comm="syz.5.3594" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 1208.916794][ T43] audit: type=1326 audit(1789146564.037:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19658 comm="syz.5.3594" exe="/syz-executor" sig=0 arch=40000003 syscall=435 compat=1 ip=0xf706efec code=0x7ffc0000 [ 1208.950555][ T43] audit: type=1326 audit(1789146564.057:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19658 comm="syz.5.3594" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 1208.955856][ T43] audit: type=1326 audit(1789146564.057:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19658 comm="syz.5.3594" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 1208.961354][ T43] audit: type=1326 audit(1789146564.067:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19661 comm="syz.5.3594" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71a75ab code=0x7ffc0000 [ 1208.978730][ T43] audit: type=1326 audit(1789146564.087:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19658 comm="syz.5.3594" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 1208.978758][ T43] audit: type=1326 audit(1789146564.087:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19658 comm="syz.5.3594" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 1209.012687][T19632] Console: switching to colour frame buffer device 160x50 [ 1209.052158][T19632] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 1209.685634][ T10] usb 11-1: new high-speed USB device number 24 using dummy_hcd [ 1209.836254][ T10] usb 11-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1209.837179][ T10] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1209.837195][ T10] usb 11-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1209.840479][ T10] usb 11-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1209.840493][ T10] usb 11-1: Manufacturer: syz [ 1209.846659][ T10] usb 11-1: config 0 descriptor?? [ 1210.106302][T19687] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3602'. [ 1210.698314][T19700] netlink: 'syz.5.3606': attribute type 15 has an invalid length. [ 1211.064992][T19715] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3611'. [ 1211.085171][ T5740] Bluetooth: hci1: unexpected event for opcode 0x2035 [ 1212.165681][T10164] usb 10-1: new high-speed USB device number 24 using dummy_hcd [ 1212.317624][T10164] usb 10-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1212.318654][T10164] usb 10-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1212.318689][T10164] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1212.318710][T10164] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1212.318728][T10164] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1212.319779][T10164] usb 10-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1212.319798][T10164] usb 10-1: Manufacturer: syz [ 1212.321940][T10164] usb 10-1: config 0 descriptor?? [ 1212.369948][T17279] usb 11-1: USB disconnect, device number 24 [ 1212.447148][T19742] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 1212.447164][T19742] device-mapper: raid: Choosing default region size of 4MiB [ 1212.706227][T19742] device-mapper: table: 248:1: raid: RAID device lookup failure (-ENOENT) [ 1212.706246][T19742] device-mapper: ioctl: error adding target to table [ 1212.856655][T10164] usbhid 10-1:0.0: can't add hid device: -71 [ 1212.856725][T10164] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 1212.861853][T10164] usb 10-1: USB disconnect, device number 24 [ 1213.624714][ T5740] Bluetooth: hci1: unexpected event for opcode 0x2035 [ 1213.653769][T18656] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1213.656052][T18656] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1213.726814][T19771] can0: slcan on ptm0. [ 1213.740670][T19771] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 1213.820280][T19770] can0 (unregistered): slcan off ptm0. [ 1213.890479][T19781] FAULT_INJECTION: forcing a failure. [ 1213.890479][T19781] name failslab, interval 1, probability 0, space 0, times 0 [ 1213.890502][T19781] CPU: 0 UID: 0 PID: 19781 Comm: syz.6.3626 Tainted: G L syzkaller #0 PREEMPT(full) [ 1213.890517][T19781] Tainted: [L]=SOFTLOCKUP [ 1213.890521][T19781] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1213.890528][T19781] Call Trace: [ 1213.890532][T19781] [ 1213.890537][T19781] dump_stack_lvl+0x100/0x190 [ 1213.890607][T19781] should_fail_ex.cold+0x5/0xa [ 1213.890622][T19781] should_failslab+0xc2/0x120 [ 1213.890657][T19781] __kmalloc_cache_noprof+0x91/0x6d0 [ 1213.890675][T19781] ? __lock_acquire+0x5c0/0x1f40 [ 1213.890690][T19781] ? snd_seq_create_port+0xcd/0x4f0 [ 1213.890733][T19781] snd_seq_create_port+0xcd/0x4f0 [ 1213.890748][T19781] snd_seq_ioctl_create_port+0x250/0x9e0 [ 1213.890764][T19781] ? __pfx_snd_seq_ioctl_create_port+0x10/0x10 [ 1213.890778][T19781] ? clientptr+0x20/0x190 [ 1213.890792][T19781] ? find_held_lock+0x2b/0x80 [ 1213.890804][T19781] ? clientptr+0x80/0x190 [ 1213.890820][T19781] call_seq_client_ctl+0xa3/0x130 [ 1213.890835][T19781] snd_seq_kernel_client_ctl+0x35/0x50 [ 1213.890852][T19781] create_port+0x19b/0x270 [ 1213.890867][T19781] ? __pfx_create_port+0x10/0x10 [ 1213.890885][T19781] ? __pfx_snd_seq_oss_event_input+0x10/0x10 [ 1213.890914][T19781] ? __pfx_free_devinfo+0x10/0x10 [ 1213.890938][T19781] ? find_held_lock+0x2b/0x80 [ 1213.890951][T19781] ? mark_held_locks+0x40/0x70 [ 1213.890968][T19781] snd_seq_oss_open+0x292/0xa10 [ 1213.890987][T19781] odev_open+0x6f/0x90 [ 1213.891001][T19781] ? __pfx_odev_open+0x10/0x10 [ 1213.891015][T19781] soundcore_open+0x2e3/0x5a0 [ 1213.891032][T19781] ? __pfx_soundcore_open+0x10/0x10 [ 1213.891047][T19781] chrdev_open+0x234/0x6a0 [ 1213.891060][T19781] ? __pfx_apparmor_file_open+0x10/0x10 [ 1213.891079][T19781] ? __pfx_chrdev_open+0x10/0x10 [ 1213.891093][T19781] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 1213.891111][T19781] do_dentry_open+0x6ab/0x14d0 [ 1213.891124][T19781] ? __pfx_chrdev_open+0x10/0x10 [ 1213.891146][T19781] vfs_open+0x82/0x3f0 [ 1213.891169][T19781] path_openat+0x19fa/0x2440 [ 1213.891194][T19781] ? __pfx_path_openat+0x10/0x10 [ 1213.891219][T19781] do_file_open+0x20e/0x430 [ 1213.891236][T19781] ? __pfx_do_file_open+0x10/0x10 [ 1213.891259][T19781] ? _raw_spin_unlock+0x28/0x50 [ 1213.891294][T19781] ? alloc_fd+0x471/0x7a0 [ 1213.891311][T19781] do_sys_openat2+0x10f/0x1e0 [ 1213.891326][T19781] ? __pfx_do_sys_openat2+0x10/0x10 [ 1213.891342][T19781] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1213.891363][T19781] __ia32_compat_sys_openat+0x12d/0x210 [ 1213.891380][T19781] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 1213.891416][T19781] __do_fast_syscall_32+0x13a/0x8b0 [ 1213.891434][T19781] ? lockdep_hardirqs_on+0x7d/0x110 [ 1213.891451][T19781] do_fast_syscall_32+0x32/0x70 [ 1213.891468][T19781] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1213.891482][T19781] RIP: 0023:0xf705efec [ 1213.891495][T19781] Code: Unable to access opcode bytes at 0xf705efc2. [ 1213.891501][T19781] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 1213.891512][T19781] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800018c0 [ 1213.891519][T19781] RDX: 0000000000080a00 RSI: 0000000000000000 RDI: 0000000000000000 [ 1213.891525][T19781] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1213.891532][T19781] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1213.891539][T19781] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1213.891553][T19781] [ 1213.891603][T19781] ALSA: seq_oss: can't create port [ 1213.892149][T19781] sg_write: data in/out 16777180/120 bytes for SCSI command 0x0-- guessing data in; [ 1213.892149][T19781] program syz.6.3626 not setting count and/or reply_len properly [ 1214.172508][T19792] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 1214.172518][T19792] device-mapper: raid: Choosing default region size of 4MiB [ 1214.390316][T19792] device-mapper: table: 248:1: raid: RAID device lookup failure (-ENOENT) [ 1214.390345][T19792] device-mapper: ioctl: error adding target to table [ 1214.595780][T19804] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3630'. [ 1214.598943][T19804] FAULT_INJECTION: forcing a failure. [ 1214.598943][T19804] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1214.598975][T19804] CPU: 2 UID: 0 PID: 19804 Comm: syz.6.3630 Tainted: G L syzkaller #0 PREEMPT(full) [ 1214.599000][T19804] Tainted: [L]=SOFTLOCKUP [ 1214.599008][T19804] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1214.599019][T19804] Call Trace: [ 1214.599025][T19804] [ 1214.599032][T19804] dump_stack_lvl+0x100/0x190 [ 1214.599059][T19804] should_fail_ex.cold+0x5/0xa [ 1214.599079][T19804] _copy_from_user+0x2e/0xd0 [ 1214.599094][T19804] get_compat_msghdr+0xb3/0x480 [ 1214.599113][T19804] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1214.599137][T19804] ? _kstrtoull+0x144/0x200 [ 1214.599169][T19804] ? __pfx__kstrtoull+0x10/0x10 [ 1214.599197][T19804] ___sys_sendmsg+0x1b6/0x1e0 [ 1214.599220][T19804] ? __pfx____sys_sendmsg+0x10/0x10 [ 1214.599237][T19804] ? __lock_acquire+0x5c0/0x1f40 [ 1214.599271][T19804] ? __fget_files+0x34/0x3d0 [ 1214.599316][T19804] __sys_sendmmsg+0x309/0x440 [ 1214.599343][T19804] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1214.599367][T19804] ? find_held_lock+0x2b/0x80 [ 1214.599393][T19804] ? __mutex_unlock_slowpath+0x35d/0x930 [ 1214.599432][T19804] ? fput+0x7c/0x100 [ 1214.599454][T19804] ? ksys_write+0x1ac/0x250 [ 1214.599477][T19804] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 1214.599496][T19804] ? lockdep_hardirqs_on+0x7d/0x110 [ 1214.599521][T19804] __do_fast_syscall_32+0x13a/0x8b0 [ 1214.599547][T19804] ? lockdep_hardirqs_on+0x7d/0x110 [ 1214.599575][T19804] do_fast_syscall_32+0x32/0x70 [ 1214.599604][T19804] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1214.599627][T19804] RIP: 0023:0xf705efec [ 1214.599673][T19804] Code: Unable to access opcode bytes at 0xf705efc2. [ 1214.599684][T19804] RSP: 002b:00000000f542c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 1214.599703][T19804] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 1214.599715][T19804] RDX: 0000000000000001 RSI: 0000000004000801 RDI: 0000000000000000 [ 1214.599726][T19804] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1214.599737][T19804] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1214.599747][T19804] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1214.599771][T19804] [ 1215.665652][ T5924] usb 11-1: new high-speed USB device number 25 using dummy_hcd [ 1215.816165][ T5924] usb 11-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1215.817090][ T5924] usb 11-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1215.817111][ T5924] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1215.817124][ T5924] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1215.817135][ T5924] usb 11-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1215.817970][ T5924] usb 11-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1215.817982][ T5924] usb 11-1: Manufacturer: syz [ 1215.825898][ T5924] usb 11-1: config 0 descriptor?? [ 1216.385017][ T5740] Bluetooth: hci2: unexpected event for opcode 0x2035 [ 1216.416987][T19835] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3639'. [ 1216.598382][ T5924] usbhid 11-1:0.0: can't add hid device: -71 [ 1216.598480][ T5924] usbhid 11-1:0.0: probe with driver usbhid failed with error -71 [ 1216.632857][ T5924] usb 11-1: USB disconnect, device number 25 [ 1217.426641][T19856] FAULT_INJECTION: forcing a failure. [ 1217.426641][T19856] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1217.426663][T19856] CPU: 1 UID: 0 PID: 19856 Comm: syz.5.3646 Tainted: G L syzkaller #0 PREEMPT(full) [ 1217.426679][T19856] Tainted: [L]=SOFTLOCKUP [ 1217.426683][T19856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1217.426690][T19856] Call Trace: [ 1217.426694][T19856] [ 1217.426710][T19856] dump_stack_lvl+0x100/0x190 [ 1217.426731][T19856] should_fail_ex.cold+0x5/0xa [ 1217.426746][T19856] _copy_to_user+0x32/0xd0 [ 1217.426761][T19856] simple_read_from_buffer+0xcb/0x170 [ 1217.426776][T19856] proc_fail_nth_read+0x1af/0x230 [ 1217.426788][T19856] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1217.426800][T19856] ? rw_verify_area+0xce/0x6d0 [ 1217.426817][T19856] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1217.426829][T19856] vfs_read+0x1e4/0xb40 [ 1217.426840][T19856] ? lock_acquire+0x1d1/0x380 [ 1217.426855][T19856] ? __fget_files+0x34/0x3d0 [ 1217.426873][T19856] ? __pfx_vfs_read+0x10/0x10 [ 1217.426883][T19856] ? find_held_lock+0x2b/0x80 [ 1217.426895][T19856] ? __fget_files+0x215/0x3d0 [ 1217.426909][T19856] ? __fget_files+0x21f/0x3d0 [ 1217.426925][T19856] ksys_read+0x12a/0x250 [ 1217.426936][T19856] ? __pfx_ksys_read+0x10/0x10 [ 1217.426951][T19856] do_int80_emulation+0x166/0x650 [ 1217.426971][T19856] asm_int80_emulation+0x1a/0x20 [ 1217.426982][T19856] RIP: 0023:0xf71a75ab [ 1217.426991][T19856] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1217.427002][T19856] RSP: 002b:00000000f545d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1217.427013][T19856] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f545d5d0 [ 1217.427020][T19856] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1217.427026][T19856] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1217.427033][T19856] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1217.427039][T19856] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1217.427053][T19856] [ 1217.621424][T19863] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3648'. [ 1218.548447][T19891] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3657'. [ 1218.548475][T19891] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3657'. [ 1219.885378][T19906] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3664'. [ 1220.123876][T19909] FAULT_INJECTION: forcing a failure. [ 1220.123876][T19909] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1220.123909][T19909] CPU: 0 UID: 0 PID: 19909 Comm: syz.6.3662 Tainted: G L syzkaller #0 PREEMPT(full) [ 1220.123935][T19909] Tainted: [L]=SOFTLOCKUP [ 1220.123943][T19909] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1220.123954][T19909] Call Trace: [ 1220.123961][T19909] [ 1220.123970][T19909] dump_stack_lvl+0x100/0x190 [ 1220.123999][T19909] should_fail_ex.cold+0x5/0xa [ 1220.124025][T19909] _copy_from_user+0x2e/0xd0 [ 1220.124050][T19909] get_compat_msghdr+0xb3/0x480 [ 1220.124080][T19909] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1220.124116][T19909] ___sys_sendmsg+0x1b6/0x1e0 [ 1220.124139][T19909] ? __pfx____sys_sendmsg+0x10/0x10 [ 1220.124168][T19909] ? find_held_lock+0x2b/0x80 [ 1220.124205][T19909] __sys_sendmsg+0x160/0x210 [ 1220.124231][T19909] ? __pfx___sys_sendmsg+0x10/0x10 [ 1220.124264][T19909] ? __pfx_ksys_write+0x10/0x10 [ 1220.124290][T19909] __do_fast_syscall_32+0x13a/0x8b0 [ 1220.124319][T19909] ? lockdep_hardirqs_on+0x7d/0x110 [ 1220.124347][T19909] do_fast_syscall_32+0x32/0x70 [ 1220.124375][T19909] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1220.124399][T19909] RIP: 0023:0xf705efec [ 1220.124421][T19909] Code: Unable to access opcode bytes at 0xf705efc2. [ 1220.124431][T19909] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1220.124450][T19909] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000580 [ 1220.124464][T19909] RDX: 0000000000000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 1220.124476][T19909] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1220.124488][T19909] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1220.124500][T19909] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1220.124525][T19909] [ 1220.130482][T19876] pci 0000:00:03.0: [1af4:1005] type 00 class 0x00ff00 conventional PCI endpoint [ 1220.145830][T19876] pci 0000:00:03.0: BAR 0 [io 0xc0a0-0xc0bf] [ 1220.145892][T19876] pci 0000:00:03.0: BAR 1 [mem 0xfeaf5000-0xfeaf5fff] [ 1220.146082][T19876] pci 0000:00:03.0: BAR 4 [mem 0xfe200000-0xfe203fff 64bit pref] [ 1220.161367][T19876] pci 0000:00:03.0: Adding to iommu group 3 [ 1220.195452][T19876] pci 0000:00:03.0: BAR 4 [mem 0x580004000-0x580007fff 64bit pref]: assigned [ 1220.216004][T19876] pci 0000:00:03.0: BAR 1 [mem 0x81002000-0x81002fff]: assigned [ 1220.216904][T19876] pci 0000:00:03.0: BAR 0 [io 0x2020-0x203f]: assigned [ 1221.540718][T19940] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3673'. [ 1223.297364][T19963] netlink: 'syz.4.3678': attribute type 1 has an invalid length. [ 1223.368505][T19963] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1223.384712][T19974] bridge1: entered promiscuous mode [ 1223.399095][T19974] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 1223.834772][T19962] FAULT_INJECTION: forcing a failure. [ 1223.834772][T19962] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1223.834804][T19962] CPU: 0 UID: 0 PID: 19962 Comm: syz.6.3679 Tainted: G L syzkaller #0 PREEMPT(full) [ 1223.834828][T19962] Tainted: [L]=SOFTLOCKUP [ 1223.834834][T19962] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1223.834844][T19962] Call Trace: [ 1223.834850][T19962] [ 1223.834858][T19962] dump_stack_lvl+0x100/0x190 [ 1223.834883][T19962] should_fail_ex.cold+0x5/0xa [ 1223.834905][T19962] get_futex_key+0x1d0/0x14f0 [ 1223.834932][T19962] ? __pfx_get_futex_key+0x10/0x10 [ 1223.834958][T19962] ? __mutex_unlock_slowpath+0x35d/0x930 [ 1223.834988][T19962] futex_wake+0xf4/0x5e0 [ 1223.835010][T19962] ? __pfx_futex_wake+0x10/0x10 [ 1223.835033][T19962] ? detach_task_ctx_data+0x83/0x490 [ 1223.835062][T19962] do_futex+0x2b2/0x440 [ 1223.835079][T19962] ? __pfx_do_futex+0x10/0x10 [ 1223.835093][T19962] ? __might_fault+0xc5/0x140 [ 1223.835123][T19962] mm_exit_exec_release+0x256/0x2f0 [ 1223.835150][T19962] do_exit+0x707/0x2ae0 [ 1223.835172][T19962] ? __pfx_do_exit+0x10/0x10 [ 1223.835189][T19962] ? do_raw_spin_lock+0x128/0x260 [ 1223.835214][T19962] ? find_held_lock+0x2b/0x80 [ 1223.835230][T19962] ? get_signal+0x7e0/0x21e0 [ 1223.835256][T19962] do_group_exit+0xd5/0x2a0 [ 1223.835276][T19962] get_signal+0x1ec7/0x21e0 [ 1223.835300][T19962] ? __local_bh_enable_ip+0xa5/0x120 [ 1223.835324][T19962] ? tcp_sendmsg+0x38/0x50 [ 1223.835340][T19962] ? __pfx_tcp_sendmsg+0x10/0x10 [ 1223.835370][T19962] ? __pfx_get_signal+0x10/0x10 [ 1223.835394][T19962] ? __pfx___sys_sendto+0x10/0x10 [ 1223.835418][T19962] arch_do_signal_or_restart+0x91/0x7a0 [ 1223.835441][T19962] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1223.835476][T19962] exit_to_user_mode_loop+0x139/0x700 [ 1223.835499][T19962] ? rcu_is_watching+0x13/0xc0 [ 1223.835538][T19962] __do_fast_syscall_32+0x59f/0x8b0 [ 1223.835566][T19962] ? lockdep_hardirqs_on+0x7d/0x110 [ 1223.835616][T19962] do_fast_syscall_32+0x32/0x70 [ 1223.835644][T19962] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1223.835680][T19962] RIP: 0023:0xf705efec [ 1223.835700][T19962] Code: Unable to access opcode bytes at 0xf705efc2. [ 1223.835708][T19962] RSP: 002b:00000000f542c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 1223.835725][T19962] RAX: fffffffffffffe00 RBX: 0000000000000003 RCX: 0000000080000900 [ 1223.835736][T19962] RDX: 0000000000000003 RSI: 0000000000000012 RDI: 0000000000000000 [ 1223.835746][T19962] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1223.835756][T19962] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1223.835766][T19962] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1223.835789][T19962] [ 1223.885094][T19976] FAULT_INJECTION: forcing a failure. [ 1223.885094][T19976] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1223.885115][T19976] CPU: 0 UID: 0 PID: 19976 Comm: syz.6.3682 Tainted: G L syzkaller #0 PREEMPT(full) [ 1223.885131][T19976] Tainted: [L]=SOFTLOCKUP [ 1223.885135][T19976] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1223.885142][T19976] Call Trace: [ 1223.885158][T19976] [ 1223.885164][T19976] dump_stack_lvl+0x100/0x190 [ 1223.885183][T19976] should_fail_ex.cold+0x5/0xa [ 1223.885198][T19976] _copy_from_user+0x2e/0xd0 [ 1223.885213][T19976] get_compat_msghdr+0xb3/0x480 [ 1223.885231][T19976] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1223.885253][T19976] ___sys_sendmsg+0x1b6/0x1e0 [ 1223.885266][T19976] ? __pfx____sys_sendmsg+0x10/0x10 [ 1223.885285][T19976] ? find_held_lock+0x2b/0x80 [ 1223.885305][T19976] __sys_sendmsg+0x160/0x210 [ 1223.885321][T19976] ? __pfx___sys_sendmsg+0x10/0x10 [ 1223.885340][T19976] ? __pfx_ksys_write+0x10/0x10 [ 1223.885355][T19976] __do_fast_syscall_32+0x13a/0x8b0 [ 1223.885377][T19976] ? lockdep_hardirqs_on+0x7d/0x110 [ 1223.885394][T19976] do_fast_syscall_32+0x32/0x70 [ 1223.885412][T19976] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1223.885426][T19976] RIP: 0023:0xf705efec [ 1223.885438][T19976] Code: Unable to access opcode bytes at 0xf705efc2. [ 1223.885443][T19976] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1223.885454][T19976] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000340 [ 1223.885461][T19976] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1223.885468][T19976] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1223.885474][T19976] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1223.885481][T19976] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1223.885494][T19976] [ 1224.309853][ T5924] Process accounting resumed [ 1225.442742][T20005] fuse: Bad value for 'group_id' [ 1225.442763][T20005] fuse: Bad value for 'group_id' [ 1225.457839][T20001] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3686'. [ 1225.642432][T14921] Process accounting resumed [ 1225.728715][ T1346] Process accounting resumed [ 1226.032806][T20040] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1227.325687][T17279] usb 10-1: new high-speed USB device number 25 using dummy_hcd [ 1227.506014][T17279] usb 10-1: Using ep0 maxpacket: 16 [ 1227.513996][T17279] usb 10-1: New USB device found, idVendor=1e7d, idProduct=3264, bcdDevice= 0.00 [ 1227.516048][T17279] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1227.516077][T17279] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1227.516111][T17279] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1227.518248][T17279] usb 10-1: config 0 descriptor?? [ 1227.982181][T17279] usbhid 10-1:0.0: can't add hid device: -71 [ 1227.982239][T17279] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 1227.983732][ T1161] IPVS: starting estimator thread 0... [ 1227.983754][T17279] usb 10-1: USB disconnect, device number 25 [ 1228.065661][T20069] IPVS: using max 43 ests per chain, 103200 per kthread [ 1228.282756][T20079] FAULT_INJECTION: forcing a failure. [ 1228.282756][T20079] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1228.282779][T20079] CPU: 3 UID: 0 PID: 20079 Comm: syz.6.3710 Tainted: G L syzkaller #0 PREEMPT(full) [ 1228.282794][T20079] Tainted: [L]=SOFTLOCKUP [ 1228.282799][T20079] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1228.282806][T20079] Call Trace: [ 1228.282810][T20079] [ 1228.282814][T20079] dump_stack_lvl+0x100/0x190 [ 1228.282833][T20079] should_fail_ex.cold+0x5/0xa [ 1228.282848][T20079] _copy_from_user+0x2e/0xd0 [ 1228.282863][T20079] __sys_bpf+0x2f5/0x4a30 [ 1228.282879][T20079] ? __pfx___sys_bpf+0x10/0x10 [ 1228.282889][T20079] ? lock_acquire+0x1d1/0x380 [ 1228.282904][T20079] ? get_pid_task+0x2a/0x250 [ 1228.282916][T20079] ? find_held_lock+0x2b/0x80 [ 1228.282928][T20079] ? get_pid_task+0xfc/0x250 [ 1228.282938][T20079] ? get_pid_task+0xfc/0x250 [ 1228.282953][T20079] ? proc_fail_nth_write+0x9f/0x220 [ 1228.282969][T20079] ? find_held_lock+0x2b/0x80 [ 1228.282991][T20079] ? rcu_read_lock_any_held+0x6a/0x90 [ 1228.283010][T20079] ? find_held_lock+0x2b/0x80 [ 1228.283045][T20079] ? ksys_write+0x190/0x250 [ 1228.283065][T20079] ? ksys_write+0x190/0x250 [ 1228.283084][T20079] ? lock_acquire+0x1d1/0x380 [ 1228.283124][T20079] ? fput+0x7c/0x100 [ 1228.283149][T20079] ? __ia32_sys_bpf+0xcc/0x170 [ 1228.283168][T20079] __ia32_sys_bpf+0xcc/0x170 [ 1228.283187][T20079] ? __do_fast_syscall_32+0xb3/0x8b0 [ 1228.283217][T20079] __do_fast_syscall_32+0x13a/0x8b0 [ 1228.283244][T20079] ? lockdep_hardirqs_on+0x7d/0x110 [ 1228.283272][T20079] do_fast_syscall_32+0x32/0x70 [ 1228.283302][T20079] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1228.283325][T20079] RIP: 0023:0xf705efec [ 1228.283346][T20079] Code: Unable to access opcode bytes at 0xf705efc2. [ 1228.283355][T20079] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1228.283374][T20079] RAX: ffffffffffffffda RBX: 0000000000000026 RCX: 0000000000000000 [ 1228.283386][T20079] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1228.283398][T20079] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1228.283409][T20079] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1228.283420][T20079] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1228.283444][T20079] [ 1228.740172][ T43] kauditd_printk_skb: 113 callbacks suppressed [ 1228.740192][ T43] audit: type=1800 audit(1789146583.857:141): pid=20085 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.3712" name="file2" dev="sda1" ino=2048 res=0 errno=0 [ 1229.233937][T20107] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3721'. [ 1229.251091][ T5924] Process accounting resumed [ 1229.703548][T20113] tipc: Started in network mode [ 1229.703598][T20113] tipc: Node identity 4, cluster identity 4711 [ 1229.703612][T20113] tipc: Node number set to 4 [ 1229.715513][T20113] tipc: Enabled bearer , priority 0 [ 1229.969524][T20119] overlayfs: failed to clone upperpath [ 1230.252504][T20126] bridge0: port 2(bridge_slave_1) entered disabled state [ 1230.252977][T20126] bridge0: port 1(bridge_slave_0) entered disabled state [ 1230.515917][ T12] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1230.515969][ T12] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1230.516004][ T12] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1230.516031][ T12] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1230.543830][T20144] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3731'. [ 1230.543855][T20144] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3731'. [ 1231.127876][T14921] Process accounting resumed [ 1231.213156][T20155] tipc: Enabling of bearer rejected, already enabled [ 1231.215063][T20155] tipc: Resetting bearer [ 1231.247698][T20155] tipc: Disabling bearer [ 1232.099169][T20162] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 1232.099186][T20162] device-mapper: raid: Choosing default region size of 4MiB [ 1232.296332][T20162] device-mapper: table: 248:1: raid: RAID device lookup failure (-ENOENT) [ 1232.296359][T20162] device-mapper: ioctl: error adding target to table [ 1233.126815][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 1233.255697][T20173] FAULT_INJECTION: forcing a failure. [ 1233.255697][T20173] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1233.255720][T20173] CPU: 3 UID: 0 PID: 20173 Comm: syz.5.3740 Tainted: G L syzkaller #0 PREEMPT(full) [ 1233.255736][T20173] Tainted: [L]=SOFTLOCKUP [ 1233.255741][T20173] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1233.255748][T20173] Call Trace: [ 1233.255752][T20173] [ 1233.255757][T20173] dump_stack_lvl+0x100/0x190 [ 1233.255776][T20173] should_fail_ex.cold+0x5/0xa [ 1233.255793][T20173] _copy_from_user+0x2e/0xd0 [ 1233.255807][T20173] get_compat_msghdr+0xb3/0x480 [ 1233.255827][T20173] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1233.255850][T20173] ___sys_sendmsg+0x1b6/0x1e0 [ 1233.255863][T20173] ? __pfx____sys_sendmsg+0x10/0x10 [ 1233.255882][T20173] ? find_held_lock+0x2b/0x80 [ 1233.255903][T20173] __sys_sendmsg+0x160/0x210 [ 1233.255919][T20173] ? __pfx___sys_sendmsg+0x10/0x10 [ 1233.255947][T20173] ? __pfx_ksys_write+0x10/0x10 [ 1233.255969][T20173] __do_fast_syscall_32+0x13a/0x8b0 [ 1233.255986][T20173] ? lockdep_hardirqs_on+0x7d/0x110 [ 1233.256004][T20173] do_fast_syscall_32+0x32/0x70 [ 1233.256022][T20173] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1233.256037][T20173] RIP: 0023:0xf706efec [ 1233.256050][T20173] Code: Unable to access opcode bytes at 0xf706efc2. [ 1233.256055][T20173] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1233.256067][T20173] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000800001c0 [ 1233.256074][T20173] RDX: 0000000020000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 1233.256081][T20173] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1233.256097][T20173] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1233.256104][T20173] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1233.256118][T20173] [ 1233.600101][T20177] MTRR 2 not used [ 1234.835692][T17279] usb 11-1: new high-speed USB device number 26 using dummy_hcd [ 1234.986320][T17279] usb 11-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1234.987107][T17279] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1234.987123][T17279] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1234.987136][T17279] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 1234.987157][T17279] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1234.991005][T17279] usb 11-1: config 0 descriptor?? [ 1235.075718][ T10] usb 10-1: new high-speed USB device number 26 using dummy_hcd [ 1235.235645][ T10] usb 10-1: Using ep0 maxpacket: 16 [ 1235.237683][ T10] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1235.237708][ T10] usb 10-1: New USB device found, idVendor=1235, idProduct=8212, bcdDevice= 0.40 [ 1235.238597][ T10] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1235.238609][ T10] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1235.240643][ T10] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1235.240655][ T10] usb 10-1: Product: syz [ 1235.240663][ T10] usb 10-1: Manufacturer: syz [ 1235.240670][ T10] usb 10-1: SerialNumber: syz [ 1235.515124][T20213] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1235.515324][T20213] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1235.516074][T20213] FAULT_INJECTION: forcing a failure. [ 1235.516074][T20213] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1235.516101][T20213] CPU: 1 UID: 0 PID: 20213 Comm: syz.5.3754 Tainted: G L syzkaller #0 PREEMPT(full) [ 1235.516123][T20213] Tainted: [L]=SOFTLOCKUP [ 1235.516132][T20213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1235.516142][T20213] Call Trace: [ 1235.516148][T20213] [ 1235.516155][T20213] dump_stack_lvl+0x100/0x190 [ 1235.516185][T20213] should_fail_ex.cold+0x5/0xa [ 1235.516209][T20213] _copy_from_user+0x2e/0xd0 [ 1235.516230][T20213] get_compat_msghdr+0xb3/0x480 [ 1235.516254][T20213] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1235.516277][T20213] ___sys_sendmsg+0x1b6/0x1e0 [ 1235.516290][T20213] ? __pfx____sys_sendmsg+0x10/0x10 [ 1235.516308][T20213] ? find_held_lock+0x2b/0x80 [ 1235.516328][T20213] __sys_sendmsg+0x160/0x210 [ 1235.516343][T20213] ? __pfx___sys_sendmsg+0x10/0x10 [ 1235.516362][T20213] ? syscall_user_dispatch+0x76/0x130 [ 1235.516382][T20213] __do_fast_syscall_32+0x13a/0x8b0 [ 1235.516400][T20213] ? lockdep_hardirqs_on+0x7d/0x110 [ 1235.516417][T20213] do_fast_syscall_32+0x32/0x70 [ 1235.516434][T20213] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1235.516448][T20213] RIP: 0023:0xf706efec [ 1235.516460][T20213] Code: Unable to access opcode bytes at 0xf706efc2. [ 1235.516465][T20213] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1235.516477][T20213] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000080000240 [ 1235.516484][T20213] RDX: 0000000020000090 RSI: 0000000000000000 RDI: 0000000000000000 [ 1235.516491][T20213] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1235.516497][T20213] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1235.516504][T20213] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1235.516518][T20213] [ 1235.529448][ T10] usb 10-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8212); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 1235.529538][ T10] usb 10-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 1235.579147][ T10] snd-usb-audio 10-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1235.584215][ T10] usb 10-1: USB disconnect, device number 26 [ 1235.603183][T18038] udevd[18038]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1236.186922][T20237] ip6tnl0: entered promiscuous mode [ 1236.189183][T20237] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3762'. [ 1236.482562][T20251] random: crng reseeded on system resumption [ 1236.679736][T20257] vlan2: entered allmulticast mode [ 1236.679751][T20257] macsec0: entered allmulticast mode [ 1236.679759][T20257] veth1_macvtap: entered allmulticast mode [ 1237.419509][T20263] overlayfs: failed to clone upperpath [ 1237.427141][T20263] xt_l2tp: v2 sid > 0xffff: 1114112 [ 1237.429944][T20263] IPVS: set_ctl: invalid protocol: 235 224.0.0.2:20004 [ 1237.490929][T20265] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3771'. [ 1237.491013][T20265] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3771'. [ 1237.560586][T17279] usbhid 11-1:0.0: can't add hid device: -71 [ 1237.560663][T17279] usbhid 11-1:0.0: probe with driver usbhid failed with error -71 [ 1237.574026][T17279] usb 11-1: USB disconnect, device number 26 [ 1237.576712][T20251] hwrng_fill thread creation failed [ 1237.639361][T20269] netlink: 'syz.4.3772': attribute type 39 has an invalid length. [ 1238.188539][T20289] FAULT_INJECTION: forcing a failure. [ 1238.188539][T20289] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1238.188561][T20289] CPU: 2 UID: 0 PID: 20289 Comm: syz.5.3779 Tainted: G L syzkaller #0 PREEMPT(full) [ 1238.188576][T20289] Tainted: [L]=SOFTLOCKUP [ 1238.188580][T20289] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1238.188588][T20289] Call Trace: [ 1238.188592][T20289] [ 1238.188599][T20289] dump_stack_lvl+0x100/0x190 [ 1238.188624][T20289] should_fail_ex.cold+0x5/0xa [ 1238.188646][T20289] _copy_from_user+0x2e/0xd0 [ 1238.188671][T20289] get_compat_msghdr+0xb3/0x480 [ 1238.188701][T20289] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1238.188736][T20289] ___sys_sendmsg+0x1b6/0x1e0 [ 1238.188758][T20289] ? __pfx____sys_sendmsg+0x10/0x10 [ 1238.188796][T20289] ? find_held_lock+0x2b/0x80 [ 1238.188830][T20289] __sys_sendmsg+0x160/0x210 [ 1238.188857][T20289] ? __pfx___sys_sendmsg+0x10/0x10 [ 1238.188887][T20289] ? __pfx_ksys_write+0x10/0x10 [ 1238.188913][T20289] __do_fast_syscall_32+0x13a/0x8b0 [ 1238.188940][T20289] ? lockdep_hardirqs_on+0x7d/0x110 [ 1238.188968][T20289] do_fast_syscall_32+0x32/0x70 [ 1238.188996][T20289] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1238.189019][T20289] RIP: 0023:0xf706efec [ 1238.189039][T20289] Code: Unable to access opcode bytes at 0xf706efc2. [ 1238.189048][T20289] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1238.189068][T20289] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000140 [ 1238.189079][T20289] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1238.189089][T20289] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1238.189101][T20289] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1238.189114][T20289] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1238.189137][T20289] [ 1239.308470][T20310] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 1239.308481][T20310] device-mapper: raid: Choosing default region size of 4MiB [ 1239.361644][T20312] netlink: 96 bytes leftover after parsing attributes in process `syz.6.3786'. [ 1239.361660][T20312] netlink: 96 bytes leftover after parsing attributes in process `syz.6.3786'. [ 1239.496327][T20310] device-mapper: table: 248:1: raid: RAID device lookup failure (-ENOENT) [ 1239.496354][T20310] device-mapper: ioctl: error adding target to table [ 1239.628565][T20316] netlink: 24 bytes leftover after parsing attributes in process `syz.6.3788'. [ 1239.628597][T20316] bond0: ARP target 8.0.0.0 is already present [ 1239.628612][T20316] bond0: option arp_ip_target: invalid value (8) [ 1239.844499][T20322] trusted_key: encrypted_key: keylen parameter is missing [ 1240.118886][ T1346] usb 11-1: new high-speed USB device number 27 using dummy_hcd [ 1240.266191][ T1346] usb 11-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1240.267317][ T1346] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1240.267341][ T1346] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1240.267359][ T1346] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 1240.267388][ T1346] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1240.272998][ T1346] usb 11-1: config 0 descriptor?? [ 1240.734041][ T1346] plantronics 0003:047F:FFFF.005D: hiddev0,hidraw0: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 1240.773172][T14871] Process accounting resumed [ 1241.426333][T20352] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3802'. [ 1241.985758][T17279] usb 10-1: new high-speed USB device number 27 using dummy_hcd [ 1242.094861][T10501] Process accounting resumed [ 1242.125650][ T1346] usb 11-1: reset high-speed USB device number 27 using dummy_hcd [ 1242.155872][T17279] usb 10-1: Using ep0 maxpacket: 16 [ 1242.156548][T17279] usb 10-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1242.157481][T17279] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1242.159096][T17279] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1242.159109][T17279] usb 10-1: Product: syz [ 1242.159117][T17279] usb 10-1: Manufacturer: syz [ 1242.159126][T17279] usb 10-1: SerialNumber: syz [ 1242.163364][T17279] usb 10-1: config 0 descriptor?? [ 1242.168000][T17279] em28xx 10-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1242.168021][T17279] em28xx 10-1:0.0: DVB interface 0 found: bulk [ 1242.789459][T17279] em28xx 10-1:0.0: unknown em28xx chip ID (0) [ 1242.993984][T20361] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1243.168822][T20390] FAULT_INJECTION: forcing a failure. [ 1243.168822][T20390] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1243.168846][T20390] CPU: 3 UID: 0 PID: 20390 Comm: syz.6.3816 Tainted: G L syzkaller #0 PREEMPT(full) [ 1243.168861][T20390] Tainted: [L]=SOFTLOCKUP [ 1243.168865][T20390] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1243.168872][T20390] Call Trace: [ 1243.168876][T20390] [ 1243.168881][T20390] dump_stack_lvl+0x100/0x190 [ 1243.168900][T20390] should_fail_ex.cold+0x5/0xa [ 1243.168915][T20390] _copy_from_user+0x2e/0xd0 [ 1243.168930][T20390] get_compat_msghdr+0xb3/0x480 [ 1243.168949][T20390] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1243.168971][T20390] ___sys_sendmsg+0x1b6/0x1e0 [ 1243.168984][T20390] ? __pfx____sys_sendmsg+0x10/0x10 [ 1243.169002][T20390] ? find_held_lock+0x2b/0x80 [ 1243.169024][T20390] __sys_sendmsg+0x160/0x210 [ 1243.169039][T20390] ? __pfx___sys_sendmsg+0x10/0x10 [ 1243.169058][T20390] ? __pfx_ksys_write+0x10/0x10 [ 1243.169072][T20390] __do_fast_syscall_32+0x13a/0x8b0 [ 1243.169089][T20390] ? lockdep_hardirqs_on+0x7d/0x110 [ 1243.169129][T20390] do_fast_syscall_32+0x32/0x70 [ 1243.169147][T20390] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1243.169161][T20390] RIP: 0023:0xf705efec [ 1243.169174][T20390] Code: Unable to access opcode bytes at 0xf705efc2. [ 1243.169179][T20390] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1243.169190][T20390] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 1243.169197][T20390] RDX: 0000000024044010 RSI: 0000000000000000 RDI: 0000000000000000 [ 1243.169204][T20390] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1243.169210][T20390] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1243.169217][T20390] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1243.169230][T20390] [ 1243.296646][T20396] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 1243.296657][T20396] device-mapper: raid: Choosing default region size of 4MiB [ 1243.371014][T20398] netlink: 96 bytes leftover after parsing attributes in process `syz.6.3818'. [ 1243.371030][T20398] netlink: 96 bytes leftover after parsing attributes in process `syz.6.3818'. [ 1243.533878][ T5094] Bluetooth: hci2: unexpected event for opcode 0x2035 [ 1243.537654][T20396] device-mapper: table: 248:1: raid: RAID device lookup failure (-ENOENT) [ 1243.537682][T20396] device-mapper: ioctl: error adding target to table [ 1243.725312][T20405] FAULT_INJECTION: forcing a failure. [ 1243.725312][T20405] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1243.725345][T20405] CPU: 1 UID: 0 PID: 20405 Comm: syz.6.3820 Tainted: G L syzkaller #0 PREEMPT(full) [ 1243.725370][T20405] Tainted: [L]=SOFTLOCKUP [ 1243.725377][T20405] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1243.725388][T20405] Call Trace: [ 1243.725394][T20405] [ 1243.725401][T20405] dump_stack_lvl+0x100/0x190 [ 1243.725430][T20405] should_fail_ex.cold+0x5/0xa [ 1243.725471][T20405] _copy_from_user+0x2e/0xd0 [ 1243.725493][T20405] get_compat_msghdr+0xb3/0x480 [ 1243.725522][T20405] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1243.725558][T20405] ___sys_sendmsg+0x1b6/0x1e0 [ 1243.725581][T20405] ? __pfx____sys_sendmsg+0x10/0x10 [ 1243.725609][T20405] ? find_held_lock+0x2b/0x80 [ 1243.725644][T20405] __sys_sendmsg+0x160/0x210 [ 1243.725668][T20405] ? __pfx___sys_sendmsg+0x10/0x10 [ 1243.725698][T20405] ? __pfx_ksys_write+0x10/0x10 [ 1243.725723][T20405] __do_fast_syscall_32+0x13a/0x8b0 [ 1243.725750][T20405] ? lockdep_hardirqs_on+0x7d/0x110 [ 1243.725778][T20405] do_fast_syscall_32+0x32/0x70 [ 1243.725805][T20405] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1243.725827][T20405] RIP: 0023:0xf705efec [ 1243.725847][T20405] Code: Unable to access opcode bytes at 0xf705efc2. [ 1243.725855][T20405] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1243.725873][T20405] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 1243.725886][T20405] RDX: 0000000004044094 RSI: 0000000000000000 RDI: 0000000000000000 [ 1243.725896][T20405] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1243.725907][T20405] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1243.725918][T20405] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1243.725942][T20405] [ 1243.908121][ T5924] usb 11-1: USB disconnect, device number 27 [ 1244.083161][T17399] Process accounting resumed [ 1244.822546][T20415] Invalid ELF header type: 3 != 1 [ 1244.946648][T17279] em28xx 10-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1244.946682][T17279] em28xx 10-1:0.0: board has no eeprom [ 1245.015668][T17279] em28xx 10-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1245.015686][T17279] em28xx 10-1:0.0: dvb set to bulk mode. [ 1245.021630][T17279] usb 10-1: USB disconnect, device number 27 [ 1245.026803][ T10] em28xx 10-1:0.0: Binding DVB extension [ 1245.037574][T17279] em28xx 10-1:0.0: Disconnecting em28xx [ 1245.152439][ T10] em28xx 10-1:0.0: Registering input extension [ 1245.153037][T17279] em28xx 10-1:0.0: Closing input extension [ 1245.177395][T10501] kernel write not supported for file /sequencer2 (pid: 10501 comm: kworker/3:0) [ 1245.194149][T17279] em28xx: Freeing device [ 1245.596200][T17279] usb 10-1: new high-speed USB device number 28 using dummy_hcd [ 1245.735993][T17279] usb 10-1: device descriptor read/64, error -71 [ 1245.985748][T17279] usb 10-1: new high-speed USB device number 29 using dummy_hcd [ 1246.018848][T20436] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 1246.018859][T20436] device-mapper: raid: Choosing default region size of 4MiB [ 1246.137290][T17279] usb 10-1: device descriptor read/64, error -71 [ 1246.256692][T17279] usb usb10-port1: attempt power cycle [ 1246.336320][T20436] device-mapper: table: 248:1: raid: RAID device lookup failure (-ENOENT) [ 1246.336350][T20436] device-mapper: ioctl: error adding target to table [ 1246.479447][T20449] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 1246.479459][T20449] device-mapper: raid: Choosing default region size of 4MiB [ 1246.545029][T20451] netlink: 96 bytes leftover after parsing attributes in process `syz.6.3832'. [ 1246.545045][T20451] netlink: 96 bytes leftover after parsing attributes in process `syz.6.3832'. [ 1246.616162][T17279] usb 10-1: new high-speed USB device number 30 using dummy_hcd [ 1246.646181][T17279] usb 10-1: device descriptor read/8, error -71 [ 1246.676709][T20449] device-mapper: table: 248:1: raid: RAID device lookup failure (-ENOENT) [ 1246.676738][T20449] device-mapper: ioctl: error adding target to table [ 1246.916122][T17279] usb 10-1: new high-speed USB device number 31 using dummy_hcd [ 1246.939311][T17279] usb 10-1: device descriptor read/8, error -71 [ 1247.010545][ T5740] Bluetooth: hci4: unexpected event for opcode 0x2035 [ 1247.056441][T17279] usb usb10-port1: unable to enumerate USB device [ 1250.129894][T20491] usb usb9: usbfs: process 20491 (syz.5.3843) did not claim interface 1 before use [ 1251.112256][ T5740] Bluetooth: hci1: unexpected event for opcode 0x2035 [ 1252.057168][ T12] bond0: (slave wlan1): link status definitely down, disabling slave [ 1252.078300][ T12] bond0: now running without any active interface! [ 1252.173678][T14921] Process accounting resumed [ 1253.370356][T20551] FAULT_INJECTION: forcing a failure. [ 1253.370356][T20551] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1253.370378][T20551] CPU: 2 UID: 0 PID: 20551 Comm: syz.6.3860 Tainted: G L syzkaller #0 PREEMPT(full) [ 1253.370393][T20551] Tainted: [L]=SOFTLOCKUP [ 1253.370398][T20551] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1253.370404][T20551] Call Trace: [ 1253.370408][T20551] [ 1253.370413][T20551] dump_stack_lvl+0x100/0x190 [ 1253.370432][T20551] should_fail_ex.cold+0x5/0xa [ 1253.370447][T20551] _copy_to_user+0x32/0xd0 [ 1253.370463][T20551] simple_read_from_buffer+0xcb/0x170 [ 1253.370477][T20551] proc_fail_nth_read+0x1af/0x230 [ 1253.370490][T20551] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1253.370503][T20551] ? rw_verify_area+0xce/0x6d0 [ 1253.370519][T20551] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1253.370531][T20551] vfs_read+0x1e4/0xb40 [ 1253.370554][T20551] ? lock_acquire+0x1d1/0x380 [ 1253.370571][T20551] ? __fget_files+0x34/0x3d0 [ 1253.370583][T20551] ? __pfx_vfs_read+0x10/0x10 [ 1253.370593][T20551] ? find_held_lock+0x2b/0x80 [ 1253.370605][T20551] ? __fget_files+0x215/0x3d0 [ 1253.370619][T20551] ? __fget_files+0x21f/0x3d0 [ 1253.370635][T20551] ksys_read+0x12a/0x250 [ 1253.370646][T20551] ? __pfx_ksys_read+0x10/0x10 [ 1253.370662][T20551] do_int80_emulation+0x166/0x650 [ 1253.370682][T20551] asm_int80_emulation+0x1a/0x20 [ 1253.370693][T20551] RIP: 0023:0xf71975ab [ 1253.370703][T20551] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1253.370713][T20551] RSP: 002b:00000000f544d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1253.370725][T20551] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f544d5d0 [ 1253.370733][T20551] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1253.370739][T20551] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1253.370745][T20551] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1253.370752][T20551] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1253.370766][T20551] [ 1253.490570][T20555] FAULT_INJECTION: forcing a failure. [ 1253.490570][T20555] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1253.490593][T20555] CPU: 3 UID: 0 PID: 20555 Comm: syz.6.3862 Tainted: G L syzkaller #0 PREEMPT(full) [ 1253.490608][T20555] Tainted: [L]=SOFTLOCKUP [ 1253.490613][T20555] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1253.490619][T20555] Call Trace: [ 1253.490623][T20555] [ 1253.490628][T20555] dump_stack_lvl+0x100/0x190 [ 1253.490647][T20555] should_fail_ex.cold+0x5/0xa [ 1253.490662][T20555] _copy_from_iter+0x1f4/0x1690 [ 1253.490677][T20555] ? __lock_acquire+0x5c0/0x1f40 [ 1253.490695][T20555] ? __pfx__copy_from_iter+0x10/0x10 [ 1253.490710][T20555] ? lock_acquire+0x1d1/0x380 [ 1253.490724][T20555] ? aa_file_perm+0x197/0x14d0 [ 1253.490736][T20555] ? find_held_lock+0x2b/0x80 [ 1253.490750][T20555] tun_get_user+0x265/0x3cc0 [ 1253.490770][T20555] ? __lock_acquire+0x5c0/0x1f40 [ 1253.490785][T20555] ? __pfx_tun_get_user+0x10/0x10 [ 1253.490800][T20555] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1253.490822][T20555] ? find_held_lock+0x2b/0x80 [ 1253.490833][T20555] ? tun_get+0x191/0x370 [ 1253.490845][T20555] ? tun_get+0x191/0x370 [ 1253.490862][T20555] tun_chr_write_iter+0xdc/0x200 [ 1253.490878][T20555] vfs_write+0x6af/0x1050 [ 1253.490890][T20555] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 1253.490906][T20555] ? __pfx_vfs_write+0x10/0x10 [ 1253.490916][T20555] ? find_held_lock+0x2b/0x80 [ 1253.490936][T20555] ksys_write+0x12a/0x250 [ 1253.490948][T20555] ? __pfx_ksys_write+0x10/0x10 [ 1253.490958][T20555] ? ksys_write+0x1ac/0x250 [ 1253.490969][T20555] ? __pfx_ksys_write+0x10/0x10 [ 1253.490983][T20555] __do_fast_syscall_32+0x13a/0x8b0 [ 1253.491001][T20555] ? lockdep_hardirqs_on+0x7d/0x110 [ 1253.491018][T20555] do_fast_syscall_32+0x32/0x70 [ 1253.491035][T20555] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1253.491049][T20555] RIP: 0023:0xf705efec [ 1253.491062][T20555] Code: Unable to access opcode bytes at 0xf705efc2. [ 1253.491068][T20555] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 1253.491079][T20555] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800003c0 [ 1253.491086][T20555] RDX: 0000000000000097 RSI: 0000000000000000 RDI: 0000000000000000 [ 1253.491093][T20555] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1253.491099][T20555] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1253.491105][T20555] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1253.491120][T20555] [ 1254.553713][ T1346] Process accounting resumed [ 1254.868436][T20579] FAULT_INJECTION: forcing a failure. [ 1254.868436][T20579] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1254.868469][T20579] CPU: 3 UID: 0 PID: 20579 Comm: syz.6.3871 Tainted: G L syzkaller #0 PREEMPT(full) [ 1254.868494][T20579] Tainted: [L]=SOFTLOCKUP [ 1254.868501][T20579] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1254.868512][T20579] Call Trace: [ 1254.868519][T20579] [ 1254.868527][T20579] dump_stack_lvl+0x100/0x190 [ 1254.868557][T20579] should_fail_ex.cold+0x5/0xa [ 1254.868597][T20579] _copy_from_user+0x2e/0xd0 [ 1254.868621][T20579] get_compat_msghdr+0xb3/0x480 [ 1254.868652][T20579] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1254.868689][T20579] ___sys_sendmsg+0x1b6/0x1e0 [ 1254.868717][T20579] ? __pfx____sys_sendmsg+0x10/0x10 [ 1254.868748][T20579] ? find_held_lock+0x2b/0x80 [ 1254.868785][T20579] __sys_sendmsg+0x160/0x210 [ 1254.868810][T20579] ? __pfx___sys_sendmsg+0x10/0x10 [ 1254.868837][T20579] ? __pfx_ksys_write+0x10/0x10 [ 1254.868860][T20579] __do_fast_syscall_32+0x13a/0x8b0 [ 1254.868884][T20579] ? lockdep_hardirqs_on+0x7d/0x110 [ 1254.868911][T20579] do_fast_syscall_32+0x32/0x70 [ 1254.868937][T20579] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1254.868960][T20579] RIP: 0023:0xf705efec [ 1254.868979][T20579] Code: Unable to access opcode bytes at 0xf705efc2. [ 1254.868988][T20579] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1254.869006][T20579] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080009b40 [ 1254.869017][T20579] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 1254.869028][T20579] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1254.869038][T20579] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1254.869049][T20579] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1254.869073][T20579] [ 1254.953451][ T10] Process accounting resumed [ 1255.659075][T20595] fuse: fd is not a fuse device [ 1256.566361][T20608] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3883'. [ 1256.566382][T20608] openvswitch: netlink: Flow key attr not present in new flow. [ 1256.633048][T20611] bridge_slave_0: left allmulticast mode [ 1256.633065][T20611] bridge_slave_0: left promiscuous mode [ 1256.633169][T20611] bridge0: port 1(bridge_slave_0) entered disabled state [ 1256.658244][T20611] bridge_slave_1: left allmulticast mode [ 1256.658264][T20611] bridge_slave_1: left promiscuous mode [ 1256.658359][T20611] bridge0: port 2(bridge_slave_1) entered disabled state [ 1256.677976][T20611] bond0: (slave bond_slave_0): Releasing backup interface [ 1256.682953][T20611] bond0: (slave bond_slave_1): Releasing backup interface [ 1256.694401][T20611] team0: Port device team_slave_0 removed [ 1256.701961][T20611] team0: Port device team_slave_1 removed [ 1256.702616][T20611] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1256.702632][T20611] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1256.710054][T20611] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1256.710075][T20611] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1256.728159][T20611] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1257.590308][T20628] FAULT_INJECTION: forcing a failure. [ 1257.590308][T20628] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1257.590483][T20628] CPU: 2 UID: 0 PID: 20628 Comm: syz.6.3888 Tainted: G L syzkaller #0 PREEMPT(full) [ 1257.590508][T20628] Tainted: [L]=SOFTLOCKUP [ 1257.590515][T20628] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1257.590525][T20628] Call Trace: [ 1257.590537][T20628] [ 1257.590545][T20628] dump_stack_lvl+0x100/0x190 [ 1257.590572][T20628] should_fail_ex.cold+0x5/0xa [ 1257.590594][T20628] _copy_from_user+0x2e/0xd0 [ 1257.590616][T20628] __sys_bpf+0x2f5/0x4a30 [ 1257.590641][T20628] ? __pfx___sys_bpf+0x10/0x10 [ 1257.590656][T20628] ? lock_acquire+0x1d1/0x380 [ 1257.590677][T20628] ? get_pid_task+0x2a/0x250 [ 1257.590694][T20628] ? find_held_lock+0x2b/0x80 [ 1257.590711][T20628] ? get_pid_task+0xfc/0x250 [ 1257.590726][T20628] ? get_pid_task+0xfc/0x250 [ 1257.590749][T20628] ? proc_fail_nth_write+0x9f/0x220 [ 1257.590769][T20628] ? find_held_lock+0x2b/0x80 [ 1257.590791][T20628] ? rcu_read_lock_any_held+0x6a/0x90 [ 1257.590810][T20628] ? find_held_lock+0x2b/0x80 [ 1257.590826][T20628] ? ksys_write+0x190/0x250 [ 1257.590843][T20628] ? ksys_write+0x190/0x250 [ 1257.590859][T20628] ? lock_acquire+0x1d1/0x380 [ 1257.590897][T20628] ? fput+0x7c/0x100 [ 1257.590919][T20628] ? __ia32_sys_bpf+0xcc/0x170 [ 1257.590935][T20628] __ia32_sys_bpf+0xcc/0x170 [ 1257.590954][T20628] ? __do_fast_syscall_32+0xb3/0x8b0 [ 1257.590979][T20628] __do_fast_syscall_32+0x13a/0x8b0 [ 1257.591002][T20628] ? lockdep_hardirqs_on+0x7d/0x110 [ 1257.591027][T20628] do_fast_syscall_32+0x32/0x70 [ 1257.591052][T20628] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1257.591074][T20628] RIP: 0023:0xf705efec [ 1257.591093][T20628] Code: Unable to access opcode bytes at 0xf705efc2. [ 1257.591101][T20628] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1257.591118][T20628] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000640 [ 1257.591129][T20628] RDX: 000000000000004c RSI: 0000000000000000 RDI: 0000000000000000 [ 1257.591139][T20628] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1257.591149][T20628] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1257.591160][T20628] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1257.591182][T20628] [ 1257.639148][T20630] fuse: Bad value for 'fd' [ 1258.189884][T20654] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3896'. [ 1258.190001][T20655] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3896'. [ 1258.243927][T20654] lo speed is unknown, defaulting to 1000 [ 1258.243973][T20654] lo speed is unknown, defaulting to 1000 [ 1258.247632][T20654] lo speed is unknown, defaulting to 1000 [ 1258.248435][T20654] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 1258.248466][T20654] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 1258.248501][T20654] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 1258.257733][T20654] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 1258.270084][T20654] lo speed is unknown, defaulting to 1000 [ 1258.270857][T20654] lo speed is unknown, defaulting to 1000 [ 1258.278149][T20654] lo speed is unknown, defaulting to 1000 [ 1258.279854][T20654] lo speed is unknown, defaulting to 1000 [ 1258.281863][T20654] lo speed is unknown, defaulting to 1000 [ 1258.785712][ T10] usb 11-1: new high-speed USB device number 28 using dummy_hcd [ 1258.965685][ T10] usb 11-1: Using ep0 maxpacket: 16 [ 1258.972665][T20679] syzkaller0: entered promiscuous mode [ 1258.972679][T20679] syzkaller0: entered allmulticast mode [ 1258.983875][T20665] tipc: Started in network mode [ 1258.983899][T20665] tipc: Node identity d2f318b1ac24, cluster identity 4711 [ 1258.984025][T20665] tipc: Enabled bearer , priority 0 [ 1259.936083][T20722] Invalid ELF header magic: != ELF [ 1260.193672][T14921] tipc: Node number set to 2128025777 [ 1260.417156][T20731] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1260.909035][T20750] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 1260.909067][T20750] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1260.974771][T20754] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3912'. [ 1261.145695][T10501] usb 10-1: new high-speed USB device number 32 using dummy_hcd [ 1261.297441][T10501] usb 10-1: Using ep0 maxpacket: 8 [ 1261.298689][T10501] usb 10-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1261.299506][T10501] usb 10-1: config 168 descriptor has 1 excess byte, ignoring [ 1261.299523][T10501] usb 10-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1261.299541][T10501] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1261.299555][T10501] usb 10-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1261.299568][T10501] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1261.299580][T10501] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1261.299593][T10501] usb 10-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1261.299607][T10501] usb 10-1: config 168 interface 0 has no altsetting 0 [ 1261.300619][T10501] usb 10-1: config 168 descriptor has 1 excess byte, ignoring [ 1261.300635][T10501] usb 10-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1261.300657][T10501] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1261.300671][T10501] usb 10-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1261.300683][T10501] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1261.300695][T10501] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1261.300708][T10501] usb 10-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1261.300721][T10501] usb 10-1: config 168 interface 0 has no altsetting 0 [ 1261.301491][T10501] usb 10-1: config 168 descriptor has 1 excess byte, ignoring [ 1261.301507][T10501] usb 10-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1261.301526][T10501] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1261.301539][T10501] usb 10-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1261.301551][T10501] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1261.301564][T10501] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1261.301577][T10501] usb 10-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1261.301590][T10501] usb 10-1: config 168 interface 0 has no altsetting 0 [ 1261.303768][T10501] usb 10-1: string descriptor 0 read error: -22 [ 1261.303827][T10501] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1261.317645][T10501] adutux 10-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1261.671527][ T2367] usb 10-1: USB disconnect, device number 32 [ 1261.682623][T20664] tipc: Resetting bearer [ 1261.703658][T20664] tipc: Disabling bearer [ 1261.784240][ T10] usb 11-1: unable to get BOS descriptor or descriptor too short [ 1261.784267][ T10] usb 11-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 1261.784288][ T10] usb 11-1: no configurations [ 1261.784294][ T10] usb 11-1: can't read configurations, error -22 [ 1261.825237][T20788] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 1261.825254][T20788] device-mapper: raid: Choosing default region size of 4MiB [ 1261.953460][T20797] netlink: 96 bytes leftover after parsing attributes in process `syz.6.3914'. [ 1261.953476][T20797] netlink: 96 bytes leftover after parsing attributes in process `syz.6.3914'. [ 1262.000225][T20800] Invalid ELF header magic: != ELF [ 1262.165943][T20788] device-mapper: table: 248:1: raid: RAID device lookup failure (-ENOENT) [ 1262.165962][T20788] device-mapper: ioctl: error adding target to table [ 1262.552371][T20813] syzkaller1: entered promiscuous mode [ 1262.552393][T20813] syzkaller1: entered allmulticast mode [ 1262.714798][T20815] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1262.714812][T20815] IPv6: NLM_F_CREATE should be set when creating new route [ 1262.714864][T20815] IPv6: NLM_F_CREATE should be set when creating new route [ 1262.951920][T20824] comedi comedi3: s526: I/O base address or length out of range [ 1263.282567][T20841] trusted_key: encrypted_key: insufficient parameters specified [ 1264.109010][T20863] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1264.241794][T20858] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3934'. [ 1264.259489][T20858] fuse: fd is not a fuse device [ 1264.382551][T20871] FAULT_INJECTION: forcing a failure. [ 1264.382551][T20871] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1264.382584][T20871] CPU: 0 UID: 0 PID: 20871 Comm: syz.5.3939 Tainted: G L syzkaller #0 PREEMPT(full) [ 1264.382602][T20871] Tainted: [L]=SOFTLOCKUP [ 1264.382607][T20871] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1264.382613][T20871] Call Trace: [ 1264.382618][T20871] [ 1264.382622][T20871] dump_stack_lvl+0x100/0x190 [ 1264.382641][T20871] should_fail_ex.cold+0x5/0xa [ 1264.382662][T20871] _copy_from_user+0x2e/0xd0 [ 1264.382683][T20871] __sys_bpf+0x2f5/0x4a30 [ 1264.382706][T20871] ? __pfx___sys_bpf+0x10/0x10 [ 1264.382721][T20871] ? lock_acquire+0x1d1/0x380 [ 1264.382764][T20871] ? get_pid_task+0x2a/0x250 [ 1264.382782][T20871] ? find_held_lock+0x2b/0x80 [ 1264.382800][T20871] ? get_pid_task+0xfc/0x250 [ 1264.382810][T20871] ? get_pid_task+0xfc/0x250 [ 1264.382825][T20871] ? proc_fail_nth_write+0x9f/0x220 [ 1264.382837][T20871] ? find_held_lock+0x2b/0x80 [ 1264.382852][T20871] ? rcu_read_lock_any_held+0x6a/0x90 [ 1264.382864][T20871] ? find_held_lock+0x2b/0x80 [ 1264.382876][T20871] ? ksys_write+0x190/0x250 [ 1264.382886][T20871] ? ksys_write+0x190/0x250 [ 1264.382897][T20871] ? lock_acquire+0x1d1/0x380 [ 1264.382921][T20871] ? fput+0x7c/0x100 [ 1264.382941][T20871] ? __ia32_sys_bpf+0xcc/0x170 [ 1264.382953][T20871] __ia32_sys_bpf+0xcc/0x170 [ 1264.382965][T20871] ? __do_fast_syscall_32+0xb3/0x8b0 [ 1264.382983][T20871] __do_fast_syscall_32+0x13a/0x8b0 [ 1264.383000][T20871] ? lockdep_hardirqs_on+0x7d/0x110 [ 1264.383017][T20871] do_fast_syscall_32+0x32/0x70 [ 1264.383034][T20871] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1264.383049][T20871] RIP: 0023:0xf706efec [ 1264.383062][T20871] Code: Unable to access opcode bytes at 0xf706efc2. [ 1264.383067][T20871] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1264.383079][T20871] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000840 [ 1264.383086][T20871] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 1264.383092][T20871] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1264.383099][T20871] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1264.383105][T20871] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1264.383119][T20871] [ 1264.447441][T20873] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1264.677364][ T73] IPVS: starting estimator thread 0... [ 1264.698915][T20880] netlink: 88 bytes leftover after parsing attributes in process `syz.5.3942'. [ 1264.785873][T20881] IPVS: using max 28 ests per chain, 67200 per kthread [ 1264.929989][T20883] netlink: 88 bytes leftover after parsing attributes in process `syz.4.3943'. [ 1265.106333][T17399] Process accounting resumed [ 1265.549947][T20903] ªªªªªª: renamed from vlan0 [ 1265.625180][T20907] netlink: 17 bytes leftover after parsing attributes in process `syz.4.3952'. [ 1265.625209][T20907] openvswitch: netlink: Tunnel attr 0 has unexpected len 65 expected 8 [ 1265.648111][T20905] trusted_key: encrypted_key: keylen parameter is missing [ 1266.220193][T20934] trusted_key: encrypted_key: keylen parameter is missing [ 1266.422667][T20942] FAULT_INJECTION: forcing a failure. [ 1266.422667][T20942] name failslab, interval 1, probability 0, space 0, times 0 [ 1266.422689][T20942] CPU: 1 UID: 0 PID: 20942 Comm: syz.5.3968 Tainted: G L syzkaller #0 PREEMPT(full) [ 1266.422704][T20942] Tainted: [L]=SOFTLOCKUP [ 1266.422709][T20942] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1266.422715][T20942] Call Trace: [ 1266.422720][T20942] [ 1266.422725][T20942] dump_stack_lvl+0x100/0x190 [ 1266.422743][T20942] should_fail_ex.cold+0x5/0xa [ 1266.422758][T20942] should_failslab+0xc2/0x120 [ 1266.422773][T20942] __kmalloc_noprof+0xfc/0x840 [ 1266.422785][T20942] ? rcu_is_watching+0x13/0xc0 [ 1266.422797][T20942] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1266.422813][T20942] tomoyo_realpath_from_path+0xb6/0x690 [ 1266.422828][T20942] tomoyo_path_number_perm+0x23c/0x580 [ 1266.422843][T20942] ? tomoyo_path_number_perm+0x22e/0x580 [ 1266.422860][T20942] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1266.422877][T20942] ? get_pid_task+0x106/0x250 [ 1266.422893][T20942] ? __lock_acquire+0x5c0/0x1f40 [ 1266.422914][T20942] ? __fget_files+0x34/0x3d0 [ 1266.422927][T20942] ? find_held_lock+0x2b/0x80 [ 1266.422938][T20942] ? __fget_files+0x215/0x3d0 [ 1266.422949][T20942] ? hook_file_ioctl_common+0x140/0x440 [ 1266.422965][T20942] ? __fget_files+0x215/0x3d0 [ 1266.422980][T20942] ? __fget_files+0x21f/0x3d0 [ 1266.422994][T20942] security_file_ioctl_compat+0xd3/0x230 [ 1266.423011][T20942] __ia32_compat_sys_ioctl+0xc2/0x360 [ 1266.423031][T20942] __do_fast_syscall_32+0x13a/0x8b0 [ 1266.423048][T20942] ? lockdep_hardirqs_on+0x7d/0x110 [ 1266.423071][T20942] do_fast_syscall_32+0x32/0x70 [ 1266.423088][T20942] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1266.423102][T20942] RIP: 0023:0xf706efec [ 1266.423115][T20942] Code: Unable to access opcode bytes at 0xf706efc2. [ 1266.423120][T20942] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1266.423132][T20942] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000004008662c [ 1266.423139][T20942] RDX: 0000000080000180 RSI: 0000000000000000 RDI: 0000000000000000 [ 1266.423146][T20942] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1266.423152][T20942] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1266.423159][T20942] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1266.423173][T20942] [ 1266.423177][T20942] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1266.434998][T20944] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3969'. [ 1266.536665][T20948] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 1266.536681][T20948] device-mapper: raid: Choosing default region size of 4MiB [ 1266.636976][T20958] trusted_key: encrypted_key: keylen parameter is missing [ 1266.825892][T20948] device-mapper: table: 248:1: raid: RAID device lookup failure (-ENOENT) [ 1266.825911][T20948] device-mapper: ioctl: error adding target to table [ 1266.844123][T20953] macvlan0: entered promiscuous mode [ 1267.080931][T20972] FAULT_INJECTION: forcing a failure. [ 1267.080931][T20972] name failslab, interval 1, probability 0, space 0, times 0 [ 1267.080954][T20972] CPU: 0 UID: 0 PID: 20972 Comm: syz.5.3977 Tainted: G L syzkaller #0 PREEMPT(full) [ 1267.080969][T20972] Tainted: [L]=SOFTLOCKUP [ 1267.080973][T20972] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1267.080980][T20972] Call Trace: [ 1267.080984][T20972] [ 1267.080989][T20972] dump_stack_lvl+0x100/0x190 [ 1267.081009][T20972] should_fail_ex.cold+0x5/0xa [ 1267.081023][T20972] should_failslab+0xc2/0x120 [ 1267.081039][T20972] __kvmalloc_node_noprof+0x113/0x9b0 [ 1267.081052][T20972] ? lock_acquire+0x1d1/0x380 [ 1267.081068][T20972] ? traverse.part.0.constprop.0+0x397/0x650 [ 1267.081084][T20972] traverse.part.0.constprop.0+0x397/0x650 [ 1267.081101][T20972] seq_lseek+0x2fb/0x430 [ 1267.081128][T20972] ksys_lseek+0xf3/0x1b0 [ 1267.081147][T20972] __do_fast_syscall_32+0x13a/0x8b0 [ 1267.081165][T20972] ? lockdep_hardirqs_on+0x7d/0x110 [ 1267.081182][T20972] do_fast_syscall_32+0x32/0x70 [ 1267.081199][T20972] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1267.081213][T20972] RIP: 0023:0xf706efec [ 1267.081226][T20972] Code: Unable to access opcode bytes at 0xf706efc2. [ 1267.081231][T20972] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000013 [ 1267.081242][T20972] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000002004 [ 1267.081250][T20972] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1267.081256][T20972] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1267.081263][T20972] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1267.081269][T20972] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1267.081284][T20972] [ 1267.581040][ T5740] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 1267.581696][T20978] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 1267.596539][T20978] input: syz0 as /devices/virtual/input/input97 [ 1268.043373][T20984] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1268.053758][T20984] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3982'. [ 1268.838292][T21006] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 1268.838307][T21006] device-mapper: raid: Choosing default region size of 4MiB [ 1269.190544][T21015] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3989'. [ 1269.260499][T21006] device-mapper: table: 248:1: raid: RAID device lookup failure (-ENOENT) [ 1269.260535][T21006] device-mapper: ioctl: error adding target to table [ 1269.946337][T21026] netlink: 'syz.5.3992': attribute type 4 has an invalid length. [ 1270.127314][T21030] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 1270.127331][T21030] device-mapper: raid: Choosing default region size of 4MiB [ 1270.149534][T21033] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3995'. [ 1270.547360][T21030] device-mapper: table: 248:1: raid: RAID device lookup failure (-ENOENT) [ 1270.547403][T21030] device-mapper: ioctl: error adding target to table [ 1271.475468][T21054] trusted_key: encrypted_key: keylen parameter is missing [ 1271.476348][T21054] ucma_write: process 707 (syz.5.3998) changed security contexts after opening file descriptor, this is not allowed. [ 1271.925883][T21064] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4002'. [ 1271.961044][T21064] fuse: Unknown parameter 'ÿÿÿÿÿÿÿÿÿ0x0000000000000008MWE' [ 1276.042198][ T5740] Bluetooth: hci4: unexpected event for opcode 0x2035 [ 1276.402975][ T43] audit: type=1804 audit(1789146631.517:142): pid=21111 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.4018" name="file0" dev="tmpfs" ino=2643 res=1 errno=0 [ 1276.988571][T10164] Process accounting resumed [ 1278.135648][T10164] usb 11-1: new high-speed USB device number 30 using dummy_hcd [ 1278.299749][T10164] usb 11-1: Using ep0 maxpacket: 8 [ 1278.301208][T10164] usb 11-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1278.302463][T10164] usb 11-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1278.302491][T10164] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1278.302513][T10164] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1278.302533][T10164] usb 11-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1278.302567][T10164] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1278.542004][T10164] usb 11-1: GET_CAPABILITIES returned 0 [ 1278.542046][T10164] usbtmc 11-1:16.0: can't read capabilities [ 1278.741851][T14921] ------------[ cut here ]------------ [ 1278.741866][T14921] con->v1.connect_seq != le32_to_cpu(con->v1.in_reply.connect_seq) [ 1278.741876][T14921] WARNING: net/ceph/messenger_v1.c:901 at ceph_con_v1_try_read+0x447d/0x6ca0, CPU#3: kworker/3:3/14921 [ 1278.753848][T14921] Modules linked in: [ 1278.755974][T14921] CPU: 3 UID: 0 PID: 14921 Comm: kworker/3:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 1278.761745][T14921] Tainted: [L]=SOFTLOCKUP [ 1278.763697][T14921] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1278.768138][T14921] Workqueue: ceph-msgr ceph_con_workfn [ 1278.770461][T14921] RIP: 0010:ceph_con_v1_try_read+0x447d/0x6ca0 [ 1278.773102][T14921] Code: f6 84 db 0f 84 1b ee ff ff e9 fc a6 e1 f5 e8 fa 4f 78 f6 90 0f 0b 90 e9 9f db ff ff e8 ec 4f 78 f6 90 0f 0b e8 e4 4f 78 f6 90 <0f> 0b 90 e9 84 e5 ff ff e8 d6 4f 78 f6 90 0f 0b e8 ce 4f 78 f6 90 [ 1278.782095][T14921] RSP: 0018:ffffc900067ef9e8 EFLAGS: 00010293 [ 1278.784767][T14921] RAX: 0000000000000000 RBX: ffff888021f9c88b RCX: 0000000000000000 [ 1278.788262][T14921] RDX: ffff888025428000 RSI: ffffffff8b9311ec RDI: ffff888025428000 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1278.791593][T14921] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000000 [ 1278.795011][T14921] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 1278.798312][T14921] R13: ffff888021f9c950 R14: ffff888021f9c418 R15: dffffc0000000000 [ 1278.801560][T14921] FS: 0000000000000000(0000) GS:ffff888096c60000(0000) knlGS:0000000000000000 [ 1278.805261][T14921] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1278.808164][T14921] CR2: 00000000f7327d6c CR3: 0000000064758000 CR4: 0000000000352ef0 [ 1278.811464][T14921] Call Trace: [ 1278.812899][T14921] [ 1278.814139][T14921] ? ceph_con_workfn+0x48/0x13e0 [ 1278.816718][T14921] ? register_lock_class+0x3f/0x7b0 [ 1278.819198][T14921] ? __lock_acquire+0x5c0/0x1f40 [ 1278.824120][T14921] ? __pfx___mutex_lock+0x10/0x10 [ 1278.827448][T14921] ? __pfx_ceph_con_v1_try_read+0x10/0x10 [ 1278.829871][T14921] ceph_con_workfn+0x9a5/0x13e0 [ 1278.832165][T14921] process_one_work+0xac7/0x1b10 [ 1278.834618][T14921] ? __pfx_process_one_work+0x10/0x10 [ 1278.837204][T14921] ? lock_acquire+0x1d1/0x380 [ 1278.839234][T14921] ? __pfx_ceph_con_workfn+0x10/0x10 [ 1278.841493][T14921] worker_thread+0x5ef/0xe50 [ 1278.843482][T14921] ? __pfx_worker_thread+0x10/0x10 [ 1278.845798][T14921] ? kthread+0x13a/0x450 [ 1278.847624][T14921] ? __pfx_worker_thread+0x10/0x10 [ 1278.849831][T14921] kthread+0x373/0x450 [ 1278.851598][T14921] ? __pfx_kthread+0x10/0x10 [ 1278.853575][T14921] ret_from_fork+0x730/0xd60 [ 1278.855647][T14921] ? __pfx_ret_from_fork+0x10/0x10 [ 1278.859114][T14921] ? __switch_to+0x800/0x10f0 [ 1278.862516][T14921] ? __pfx_kthread+0x10/0x10 [ 1278.866372][T14921] ret_from_fork_asm+0x1a/0x30 [ 1278.868546][T14921] [ 1278.870332][T14921] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1278.873550][T14921] CPU: 3 UID: 0 PID: 14921 Comm: kworker/3:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 1278.878065][T14921] Tainted: [L]=SOFTLOCKUP [ 1278.880156][T14921] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1278.884704][T14921] Workqueue: ceph-msgr ceph_con_workfn [ 1278.887191][T14921] Call Trace: [ 1278.888890][T14921] [ 1278.890278][T14921] dump_stack_lvl+0x100/0x190 [ 1278.892268][T14921] vpanic+0x553/0x970 [ 1278.894035][T14921] ? __pfx_vpanic+0x10/0x10 [ 1278.895941][T14921] panic+0xd1/0xe0 [ 1278.897501][T14921] ? __pfx_panic+0x10/0x10 [ 1278.899233][T14921] check_panic_on_warn.cold+0x19/0x34 [ 1278.901413][T14921] ? ceph_con_v1_try_read+0x447d/0x6ca0 [ 1278.903658][T14921] __warn.cold+0x191/0x318 [ 1278.905503][T14921] __report_bug+0x30f/0x440 [ 1278.907447][T14921] ? ceph_con_v1_try_read+0x447d/0x6ca0 [ 1278.909752][T14921] ? __pfx___report_bug+0x10/0x10 [ 1278.911962][T14921] ? __pfx_tcp_recvmsg+0x10/0x10 [ 1278.914121][T14921] ? inet_recvmsg+0xdc/0x4c0 [ 1278.916271][T14921] ? bpf_lsm_socket_recvmsg+0x9/0x10 [ 1278.918443][T14921] ? rcu_is_watching+0x13/0xc0 [ 1278.920334][T14921] ? ceph_con_v1_try_read+0x447d/0x6ca0 [ 1278.922577][T14921] report_bug+0xb3/0x220 [ 1278.924336][T14921] ? ceph_con_v1_try_read+0x447d/0x6ca0 [ 1278.926651][T14921] handle_bug+0x16a/0x2a0 [ 1278.928545][T14921] exc_invalid_op+0x17/0x50 [ 1278.930525][T14921] asm_exc_invalid_op+0x1a/0x20 [ 1278.932619][T14921] RIP: 0010:ceph_con_v1_try_read+0x447d/0x6ca0 [ 1278.935102][T14921] Code: f6 84 db 0f 84 1b ee ff ff e9 fc a6 e1 f5 e8 fa 4f 78 f6 90 0f 0b 90 e9 9f db ff ff e8 ec 4f 78 f6 90 0f 0b e8 e4 4f 78 f6 90 <0f> 0b 90 e9 84 e5 ff ff e8 d6 4f 78 f6 90 0f 0b e8 ce 4f 78 f6 90 [ 1278.942791][T14921] RSP: 0018:ffffc900067ef9e8 EFLAGS: 00010293 [ 1278.945354][T14921] RAX: 0000000000000000 RBX: ffff888021f9c88b RCX: 0000000000000000 [ 1278.948724][T14921] RDX: ffff888025428000 RSI: ffffffff8b9311ec RDI: ffff888025428000 [ 1278.951994][T14921] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000000 [ 1278.955325][T14921] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 1278.958674][T14921] R13: ffff888021f9c950 R14: ffff888021f9c418 R15: dffffc0000000000 [ 1278.962007][T14921] ? ceph_con_v1_try_read+0x447c/0x6ca0 [ 1278.964345][T14921] ? ceph_con_v1_try_read+0x447c/0x6ca0 [ 1278.966779][T14921] ? ceph_con_workfn+0x48/0x13e0 [ 1278.969136][T14921] ? register_lock_class+0x3f/0x7b0 [ 1278.971705][T14921] ? __lock_acquire+0x5c0/0x1f40 [ 1278.973676][T14921] ? __pfx___mutex_lock+0x10/0x10 [ 1278.975847][T14921] ? __pfx_ceph_con_v1_try_read+0x10/0x10 [ 1278.978286][T14921] ceph_con_workfn+0x9a5/0x13e0 [ 1278.980403][T14921] process_one_work+0xac7/0x1b10 [ 1278.982411][T14921] ? __pfx_process_one_work+0x10/0x10 [ 1278.984959][T14921] ? lock_acquire+0x1d1/0x380 [ 1278.987263][T14921] ? __pfx_ceph_con_workfn+0x10/0x10 [ 1278.989657][T14921] worker_thread+0x5ef/0xe50 [ 1278.991685][T14921] ? __pfx_worker_thread+0x10/0x10 [ 1278.993890][T14921] ? kthread+0x13a/0x450 [ 1278.995748][T14921] ? __pfx_worker_thread+0x10/0x10 [ 1278.997925][T14921] kthread+0x373/0x450 [ 1278.999618][T14921] ? __pfx_kthread+0x10/0x10 [ 1279.001624][T14921] ret_from_fork+0x730/0xd60 [ 1279.003742][T14921] ? __pfx_ret_from_fork+0x10/0x10 [ 1279.006098][T14921] ? __switch_to+0x800/0x10f0 [ 1279.007924][T14921] ? __pfx_kthread+0x10/0x10 [ 1279.009980][T14921] ret_from_fork_asm+0x1a/0x30 [ 1279.012121][T14921] [ 1279.014193][T14921] Kernel Offset: disabled [ 1279.016050][T14921] Rebooting in 86400 seconds..