last executing test programs: 9m9.345233765s ago: executing program 0 (id=415): r0 = syz_open_procfs(0x0, &(0x7f0000000300)='task\x00') fchdir(r0) r1 = syz_clone(0x0, 0x0, 0x1d, 0x0, 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000000)='proc\x00', 0x0, 0x0) r2 = syz_open_procfs(r1, &(0x7f0000000040)='maps\x00') pread64(r2, &(0x7f0000000140)=""/15, 0xf, 0x4) 9m9.197725741s ago: executing program 0 (id=416): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000280)={r0, r0, 0xc, 0x0, &(0x7f0000000340), 0xb, 0x1, 0x4c4a, 0x4155, 0x9, 0x2, 0x1, 'syz1\x00'}) 9m9.137651867s ago: executing program 0 (id=417): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001ac0)={0x70, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private}, {0x8, 0x2, @multicast2}}}]}, @CTA_TIMEOUT={0x8}, @CTA_MARK={0x8}, @CTA_TUPLE_MASTER={0x4}]}, 0x70}}, 0x0) 9m9.137441053s ago: executing program 0 (id=418): sendto$packet(0xffffffffffffffff, &(0x7f00000002c0)="05031600d3fc14000000478803", 0xd, 0x4, &(0x7f0000000140)={0x11, 0x86dd, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_BEACON(0xffffffffffffffff, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000340)=ANY=[@ANYBLOB="09fe7f"], 0x1e8}}, 0x10) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r1, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}, 0x1, 0x0, 0x0, 0x4}, 0x0) 9m9.067422724s ago: executing program 0 (id=421): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1b2) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/cpu/cpu1/hotplug/target\x00', 0x82100, 0x114) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x1, &(0x7f0000000600)=0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs$userns(0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0xc050) connect$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf00) io_submit(r1, 0x1, &(0x7f00000008c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x7fff, r0, &(0x7f0000000140)="b7", 0x1, 0x0, 0x0, 0x2}]) 9m7.334047686s ago: executing program 0 (id=428): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) r2 = syz_open_dev$usbmon(&(0x7f0000000280), 0x80000001, 0x28100) ioctl$MON_IOCQ_RING_SIZE(r2, 0x9205) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, 0x0, 0xd0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180040000000000000000000000000000d030000000000000000000003000000000200000002000000fdffffff00"/65], 0x0, 0x4e}, 0x28) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r3, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0') pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000300)=[{0x0}, {0x0}], 0x2, 0x0) bind$x25(r3, &(0x7f0000000080), 0x12) connect$x25(r3, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bond0\x00', 0x2000}) r6 = openat$panthor(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[], 0x68}}, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$DRM_IOCTL_GET_STATS(r6, 0x807c6406, &(0x7f0000002140)=""/29) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000000c3f000000000000"], 0x0, 0x28}, 0x28) 8m52.252752379s ago: executing program 32 (id=428): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) r2 = syz_open_dev$usbmon(&(0x7f0000000280), 0x80000001, 0x28100) ioctl$MON_IOCQ_RING_SIZE(r2, 0x9205) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, 0x0, 0xd0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180040000000000000000000000000000d030000000000000000000003000000000200000002000000fdffffff00"/65], 0x0, 0x4e}, 0x28) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r3, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0') pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000300)=[{0x0}, {0x0}], 0x2, 0x0) bind$x25(r3, &(0x7f0000000080), 0x12) connect$x25(r3, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bond0\x00', 0x2000}) r6 = openat$panthor(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[], 0x68}}, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$DRM_IOCTL_GET_STATS(r6, 0x807c6406, &(0x7f0000002140)=""/29) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000000c3f000000000000"], 0x0, 0x28}, 0x28) 10.189738649s ago: executing program 4 (id=2866): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) write$tcp_mem(0xffffffffffffffff, &(0x7f0000019080)={0x40, 0x20, 0x9, 0x20, 0x7}, 0x48) socket(0x2, 0xa, 0x0) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x1}) 9.019833777s ago: executing program 1 (id=2868): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') pread64(r5, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) write$tcp_mem(0xffffffffffffffff, &(0x7f0000019080)={0x40, 0x20, 0x9, 0x20, 0x7}, 0x48) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x1}) 6.657776598s ago: executing program 1 (id=2869): socket(0x18, 0x3, 0x0) epoll_create1(0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x44080) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$igmp(0x2, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x18, 0x8, 0x40, 0x42, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) bind$rxrpc(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, 0x0) sendmsg$nl_generic(r0, 0x0, 0xc000) 6.628940304s ago: executing program 4 (id=2871): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) write$tcp_mem(0xffffffffffffffff, &(0x7f0000019080)={0x40, 0x20, 0x9, 0x20, 0x7}, 0x48) socket(0x2, 0xa, 0x0) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x1}) 6.53342703s ago: executing program 3 (id=2873): socket(0x18, 0x3, 0x0) epoll_create1(0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x44080) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$igmp(0x2, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x18, 0x8, 0x40, 0x42, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2100, 0x10000004, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) bind$rxrpc(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, 0x0) sendmsg$nl_generic(r0, 0x0, 0xc000) 5.304637458s ago: executing program 1 (id=2874): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000380), 0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7}) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x4b, &(0x7f0000000040)={&(0x7f0000000180)={0x58, 0x1, 0x2, 0x201, 0x0, 0x0, {0xa}, [@CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_MASTER={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}]}, 0x58}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001980)=@newchain={0x24, 0x1e, 0x101, 0x0, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {0x4, 0x1}, {0x10, 0xb}}}, 0x24}}, 0x44004) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) r5 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000080)={0x40000002}) write$P9_RSTATu(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e) openat$sequencer(0xffffff9c, &(0x7f0000000100), 0x8ec02, 0x0) ioctl$SIOCX25SENDCALLACCPT(0xffffffffffffffff, 0x89e9) 4.790991664s ago: executing program 4 (id=2876): mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000840)='./config\x00', &(0x7f0000000880)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./img\x00', 0x42, 0x1ff) ftruncate(r0, 0x1000000) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x2, 0x0) write(r1, &(0x7f0000000980)='1\n\x00', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f00000009c0)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x2, 0x0) write(r2, &(0x7f0000000a40)='./img\n', 0x6) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x2, 0x0) write(r3, &(0x7f0000000ac0)='1\n\x00', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/nvmet/subsystems/testsubsys/namespaces/1/resv_enable\x00', 0x2, 0x0) write(r4, &(0x7f0000000b40)='1\n\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000b80)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x2, 0x0) write(r5, &(0x7f0000000bc0)='1\n\x00', 0x2) close(r5) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/nvmet/ports/1\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000c40)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r6, &(0x7f0000000c80)='loop\n\x00', 0x5) close(r6) symlinkat(&(0x7f0000000cc0)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000d00)='./config/nvmet/ports/1/subsystems/testsubsys\x00') r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000d40), 0x2, 0x0) write(r7, &(0x7f0000000d80)='transport=loop,nqn=testsubsys\x00', 0x1e) close(r7) nanosleep(&(0x7f0000000dc0)={0x0, 0xee6b280}, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e00)='/proc/diskstats\x00', 0x0, 0x0) read(r8, &(0x7f0000000e40)=""/2000, 0x7d0) close(r8) 4.310788803s ago: executing program 3 (id=2877): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') pread64(r4, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) write$tcp_mem(0xffffffffffffffff, &(0x7f0000019080)={0x40, 0x20, 0x9, 0x20, 0x7}, 0x48) socket(0x2, 0xa, 0x0) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x1}) 4.24056554s ago: executing program 1 (id=2878): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000380), 0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7}) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x4b, &(0x7f0000000040)={&(0x7f0000000180)={0x58, 0x1, 0x2, 0x201, 0x0, 0x0, {0xa}, [@CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_MASTER={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}]}, 0x58}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001980)=@newchain={0x24, 0x1e, 0x101, 0x0, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {0x4, 0x1}, {0x10, 0xb}}}, 0x24}}, 0x44004) recvmsg(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, 0x0}, 0x40010120) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) r5 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000080)={0x40000002}) write$P9_RSTATu(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e) openat$sequencer(0xffffff9c, &(0x7f0000000100), 0x8ec02, 0x0) ioctl$SIOCX25SENDCALLACCPT(0xffffffffffffffff, 0x89e9) 3.512896111s ago: executing program 4 (id=2880): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x16) bpf$PROG_LOAD(0x5, &(0x7f0000001200)={0x3, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b400000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000080000003f00000000000000850000000600000095"], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r3, &(0x7f0000000700)="000000001bed00002a75d6d38e9cb3583c321201a24dd52b110251a3a00700e798850d77e53d64a91208843eee874d24e80075a130995f4219672fae81635f09546019722d57c9fb110eb9270f9ecdedef2920abd69534abab5f6ae8b5f916a0810e580293a6aeb2d1027bb5baaf02e1e7c9987b475af42d0679d5225ca3061dd33bd1c646e9cfa4a8014dd8008000ef048a5276c0cfbee6afb43704a70e8fc60000e07f34c8e1f5fb6b9e6dd50fd836c2e16638cd9d0425096b41fec7fadc9b3a5ec9fa85329ca9dbc533502f91ee68b2537cac369dc839655132b02361fd577ac031833639f32073b00f1cd2ee08b5056117967e0400000000000000972713e099acade11d0e11b211c456ab77c4b529f7651b285d888957337c7f7b6372e851fd57cdbfca8223507f9d806609510242de0140aafff42d2c0950c541e6cb176a34aa0c5b22459ca47ea7b7a5513229cbf4ac4e98a1cec8684f91102a1a19259e8589532d2537ddb23333ea82c0f04a6eff74000000003c20e4f21b8932e810e5d0ee29a95d9e7bc170105c433e40ba5e6ae8fd17996b18acf6b98e19e35d20d98d2d51225e73a63ac19d", 0x1ab) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r4, 0x0, 0xb00) r5 = io_uring_setup(0x667, &(0x7f0000000000)={0x0, 0xa14a, 0x1000, 0x2, 0x235}) r6 = socket$rds(0x15, 0x5, 0x0) setsockopt$sock_int(r6, 0x1, 0x3c, &(0x7f0000000080)=0x1, 0x4) bind$rds(r6, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r6, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000300)=""/4, 0xd000}], 0x1, &(0x7f0000001740)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x800}], 0x18}, 0x4000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeec, 0xc8031, 0xffffffffffffffff, 0x4000) close_range(r5, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@newtfilter={0x38, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xa}, {0x0, 0xfff3}, {0x2, 0xa}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20005000}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x24, 0x0, 0x300, 0x70bc2d, 0x21dfdbff, {}, [@NL80211_ATTR_WIPHY_RETRY_SHORT={0x5, 0x3d, 0x80}, @NL80211_ATTR_TXQ_QUANTUM={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008850}, 0x20040800) sendmsg$NL80211_CMD_SET_COALESCE(r7, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, 0x0, 0x1, 0x14, 0x0, {{0x2}, {@val={0x8, 0x3, r8}, @void}}}, 0x28}}, 0x0) r9 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r9, &(0x7f00000040c0)={0x2020}, 0x2020) 3.37120738s ago: executing program 4 (id=2882): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') pread64(r4, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) write$tcp_mem(0xffffffffffffffff, &(0x7f0000019080)={0x40, 0x20, 0x9, 0x20, 0x7}, 0x48) socket(0x2, 0xa, 0x0) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x1}) 3.234386288s ago: executing program 2 (id=2883): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x16) bpf$PROG_LOAD(0x5, &(0x7f0000001200)={0x3, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b400000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000080000003f00000000000000850000000600000095"], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r3, &(0x7f0000000700)="000000001bed00002a75d6d38e9cb3583c321201a24dd52b110251a3a00700e798850d77e53d64a91208843eee874d24e80075a130995f4219672fae81635f09546019722d57c9fb110eb9270f9ecdedef2920abd69534abab5f6ae8b5f916a0810e580293a6aeb2d1027bb5baaf02e1e7c9987b475af42d0679d5225ca3061dd33bd1c646e9cfa4a8014dd8008000ef048a5276c0cfbee6afb43704a70e8fc60000e07f34c8e1f5fb6b9e6dd50fd836c2e16638cd9d0425096b41fec7fadc9b3a5ec9fa85329ca9dbc533502f91ee68b2537cac369dc839655132b02361fd577ac031833639f32073b00f1cd2ee08b5056117967e0400000000000000972713e099acade11d0e11b211c456ab77c4b529f7651b285d888957337c7f7b6372e851fd57cdbfca8223507f9d806609510242de0140aafff42d2c0950c541e6cb176a34aa0c5b22459ca47ea7b7a5513229cbf4ac4e98a1cec8684f91102a1a19259e8589532d2537ddb23333ea82c0f04a6eff74000000003c20e4f21b8932e810e5d0ee29a95d9e7bc170105c433e40ba5e6ae8fd17996b18acf6b98e19e35d20d98d2d51225e73a63ac19d", 0x1ab) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r4, 0x0, 0xb00) r5 = io_uring_setup(0x667, &(0x7f0000000000)={0x0, 0xa14a, 0x1000, 0x2, 0x235}) r6 = socket$rds(0x15, 0x5, 0x0) setsockopt$sock_int(r6, 0x1, 0x3c, &(0x7f0000000080)=0x1, 0x4) bind$rds(r6, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r6, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000300)=""/4, 0xd000}], 0x1, &(0x7f0000001740)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x800}], 0x18}, 0x4000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeec, 0xc8031, 0xffffffffffffffff, 0x4000) close_range(r5, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@newtfilter={0x38, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xa}, {0x0, 0xfff3}, {0x2, 0xa}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20005000}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x24, r7, 0x300, 0x70bc2d, 0x21dfdbff, {}, [@NL80211_ATTR_WIPHY_RETRY_SHORT={0x5, 0x3d, 0x80}, @NL80211_ATTR_TXQ_QUANTUM={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008850}, 0x20040800) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r7, 0x1, 0x14, 0x0, {{0x2}, {@val={0x8, 0x3, r8}, @void}}}, 0x28}}, 0x0) r9 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r9, &(0x7f00000040c0)={0x2020}, 0x2020) 3.106238508s ago: executing program 3 (id=2884): socket(0x18, 0x3, 0x0) epoll_create1(0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x44080) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$igmp(0x2, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x18, 0x8, 0x40, 0x42, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2100, 0x10000004, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) bind$rxrpc(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, 0x0) sendmsg$nl_generic(r0, 0x0, 0xc000) 2.707682028s ago: executing program 1 (id=2885): ioctl$VIDIOC_S_INPUT(0xffffffffffffffff, 0xc0045627, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(0xffffffffffffffff, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0xe10, 0x870, 0x1, 0x1, 0xd59f84, 0x19f2, 0x3f, 0x19ef, 0x3, 0x3, 0x2800, 0x2800, 0x2, 0xd1, 0xb, 0x30, {0x8, 0xfffffff7}, 0xd0, 0x9}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) syz_open_dev$usbmon(&(0x7f0000000300), 0x7, 0x82c0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x10000000002) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0xab1, 0x10000, 0x8, 0x3e3}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f00000004c0)=@nat={'nat\x00', 0x670, 0x5, 0x4a4, 0x348, 0x198, 0xffffffff, 0x198, 0x0, 0x410, 0x410, 0xffffffff, 0x410, 0x410, 0x5, 0x0, {[{{@ip={@rand_addr=0x64010100, @local, 0xff0000ff, 0xffffff00, 'veth1_to_bridge\x00', 'veth0_macvtap\x00', {}, {0xff}, 0x16}, 0x0, 0x164, 0x198, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x7, 0x100c, 'kmp\x00', "48ae43e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x76, 0x2, {0x1}}}, @common=@unspec=@devgroup={{0x34}, {0x3, 0x0, 0x3, 0x3, 0x81}}]}, @DNAT0={0x34, 'DNAT\x00', 0x0, {0xae, {0x2e, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @port=0x4e24, @port=0x4e24}}}}, {{@uncond, 0x0, 0xc8, 0xf8, 0x0, {}, [@common=@addrtype={{0x2c}, {0x40, 0x200, 0x0, 0x1}}, @common=@inet=@tcp={{0x2c}, {[0x4e24, 0x4e22], [0x4e22, 0x4e24], 0x4, 0xc2, 0x1, 0x2}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xfffc, 0xd, 0x1}, {0x2, 0x4, 0x3}, 0x1000, 0x100}}}, {{@ip={@multicast2, @broadcast, 0xff, 0x0, 'virt_wifi0\x00', 'veth1_to_bridge\x00', {}, {}, 0x0, 0x0, 0x5e}, 0x0, 0x70, 0xb8}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x2, @ipv4=@empty, @ipv4=@empty, @port=0x4e22, @icmp_id=0x65}}}, {{@ip={@loopback, @remote, 0xff, 0x0, 'batadv_slave_1\x00', 'ip_vti0\x00', {}, {0xff}, 0x84, 0x1, 0x5}, 0x0, 0x94, 0xc8, 0x0, {}, [@common=@icmp={{0x24}, {0x4, '\x00', 0x1}}]}, @DNAT0={0x34, 'DNAT\x00', 0x0, {0x1, {0x10, @local, @dev={0xac, 0x14, 0x14, 0x2a}, @port=0x4e22, @gre_key=0x5}}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x500) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) io_uring_enter(r2, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000000), 0x205, 0x44680) 2.45202707s ago: executing program 2 (id=2886): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x16) bpf$PROG_LOAD(0x5, &(0x7f0000001200)={0x3, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b400000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000080000003f00000000000000850000000600000095"], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r3, &(0x7f0000000700)="000000001bed00002a75d6d38e9cb3583c321201a24dd52b110251a3a00700e798850d77e53d64a91208843eee874d24e80075a130995f4219672fae81635f09546019722d57c9fb110eb9270f9ecdedef2920abd69534abab5f6ae8b5f916a0810e580293a6aeb2d1027bb5baaf02e1e7c9987b475af42d0679d5225ca3061dd33bd1c646e9cfa4a8014dd8008000ef048a5276c0cfbee6afb43704a70e8fc60000e07f34c8e1f5fb6b9e6dd50fd836c2e16638cd9d0425096b41fec7fadc9b3a5ec9fa85329ca9dbc533502f91ee68b2537cac369dc839655132b02361fd577ac031833639f32073b00f1cd2ee08b5056117967e0400000000000000972713e099acade11d0e11b211c456ab77c4b529f7651b285d888957337c7f7b6372e851fd57cdbfca8223507f9d806609510242de0140aafff42d2c0950c541e6cb176a34aa0c5b22459ca47ea7b7a5513229cbf4ac4e98a1cec8684f91102a1a19259e8589532d2537ddb23333ea82c0f04a6eff74000000003c20e4f21b8932e810e5d0ee29a95d9e7bc170105c433e40ba5e6ae8fd17996b18acf6b98e19e35d20d98d2d51225e73a63ac19d", 0x1ab) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r4, 0x0, 0xb00) r5 = io_uring_setup(0x667, &(0x7f0000000000)={0x0, 0xa14a, 0x1000, 0x2, 0x235}) r6 = socket$rds(0x15, 0x5, 0x0) setsockopt$sock_int(r6, 0x1, 0x3c, &(0x7f0000000080)=0x1, 0x4) bind$rds(r6, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r6, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000300)=""/4, 0xd000}], 0x1, &(0x7f0000001740)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x800}], 0x18}, 0x4000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeec, 0xc8031, 0xffffffffffffffff, 0x4000) close_range(r5, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@newtfilter={0x38, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xa}, {0x0, 0xfff3}, {0x2, 0xa}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20005000}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x24, 0x0, 0x300, 0x70bc2d, 0x21dfdbff, {}, [@NL80211_ATTR_WIPHY_RETRY_SHORT={0x5, 0x3d, 0x80}, @NL80211_ATTR_TXQ_QUANTUM={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008850}, 0x20040800) sendmsg$NL80211_CMD_SET_COALESCE(r7, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, 0x0, 0x1, 0x14, 0x0, {{0x2}, {@val={0x8, 0x3, r8}, @void}}}, 0x28}}, 0x0) r9 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r9, &(0x7f00000040c0)={0x2020}, 0x2020) 2.22815477s ago: executing program 4 (id=2887): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x16) bpf$PROG_LOAD(0x5, &(0x7f0000001200)={0x3, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b400000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000080000003f00000000000000850000000600000095"], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r3, &(0x7f0000000700)="000000001bed00002a75d6d38e9cb3583c321201a24dd52b110251a3a00700e798850d77e53d64a91208843eee874d24e80075a130995f4219672fae81635f09546019722d57c9fb110eb9270f9ecdedef2920abd69534abab5f6ae8b5f916a0810e580293a6aeb2d1027bb5baaf02e1e7c9987b475af42d0679d5225ca3061dd33bd1c646e9cfa4a8014dd8008000ef048a5276c0cfbee6afb43704a70e8fc60000e07f34c8e1f5fb6b9e6dd50fd836c2e16638cd9d0425096b41fec7fadc9b3a5ec9fa85329ca9dbc533502f91ee68b2537cac369dc839655132b02361fd577ac031833639f32073b00f1cd2ee08b5056117967e0400000000000000972713e099acade11d0e11b211c456ab77c4b529f7651b285d888957337c7f7b6372e851fd57cdbfca8223507f9d806609510242de0140aafff42d2c0950c541e6cb176a34aa0c5b22459ca47ea7b7a5513229cbf4ac4e98a1cec8684f91102a1a19259e8589532d2537ddb23333ea82c0f04a6eff74000000003c20e4f21b8932e810e5d0ee29a95d9e7bc170105c433e40ba5e6ae8fd17996b18acf6b98e19e35d20d98d2d51225e73a63ac19d", 0x1ab) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r4, 0x0, 0xb00) r5 = io_uring_setup(0x667, &(0x7f0000000000)={0x0, 0xa14a, 0x1000, 0x2, 0x235}) r6 = socket$rds(0x15, 0x5, 0x0) setsockopt$sock_int(r6, 0x1, 0x3c, &(0x7f0000000080)=0x1, 0x4) bind$rds(r6, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r6, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000300)=""/4, 0xd000}], 0x1, &(0x7f0000001740)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x800}], 0x18}, 0x4000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeec, 0xc8031, 0xffffffffffffffff, 0x4000) close_range(r5, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@newtfilter={0x38, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xa}, {0x0, 0xfff3}, {0x2, 0xa}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20005000}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r7) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(r7, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r8, 0x1, 0x14, 0x0, {{0x2}, {@val={0x8, 0x3, r9}, @void}}}, 0x28}}, 0x0) r10 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r10, &(0x7f00000040c0)={0x2020}, 0x2020) 2.13328552s ago: executing program 2 (id=2888): mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000840)='./config\x00', &(0x7f0000000880)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./img\x00', 0x42, 0x1ff) ftruncate(r0, 0x1000000) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x2, 0x0) write(r1, &(0x7f0000000980)='1\n\x00', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f00000009c0)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x2, 0x0) write(r2, &(0x7f0000000a40)='./img\n', 0x6) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x2, 0x0) write(r3, &(0x7f0000000ac0)='1\n\x00', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/nvmet/subsystems/testsubsys/namespaces/1/resv_enable\x00', 0x2, 0x0) write(r4, &(0x7f0000000b40)='1\n\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000b80)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x2, 0x0) write(r5, &(0x7f0000000bc0)='1\n\x00', 0x2) close(r5) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/nvmet/ports/1\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000c40)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r6, &(0x7f0000000c80)='loop\n\x00', 0x5) close(r6) symlinkat(&(0x7f0000000cc0)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000d00)='./config/nvmet/ports/1/subsystems/testsubsys\x00') r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000d40), 0x2, 0x0) write(r7, &(0x7f0000000d80)='transport=loop,nqn=testsubsys\x00', 0x1e) close(r7) nanosleep(&(0x7f0000000dc0)={0x0, 0xee6b280}, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e00)='/proc/diskstats\x00', 0x0, 0x0) read(r8, &(0x7f0000000e40)=""/2000, 0x7d0) close(r8) 1.985318241s ago: executing program 3 (id=2890): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') pread64(r4, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) write$tcp_mem(0xffffffffffffffff, &(0x7f0000019080)={0x40, 0x20, 0x9, 0x20, 0x7}, 0x48) socket(0x2, 0xa, 0x0) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x1}) 1.575545693s ago: executing program 2 (id=2891): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x142000) openat$random(0xffffffffffffff9c, &(0x7f000000fe80), 0x40800, 0x0) r1 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000500)={0x0, 0x30b5, 0x0, 0x2, 0x377}, 0x0, 0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r1, 0x0, 0x0, r2, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x6, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff}}}, &(0x7f0000000480)=0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, r3, &(0x7f0000000400)={0x0, 0x20fb87, 0x800, 0x1, 0x32c}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x15a, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ac7, 0x1000, 0x10000000, 0x546}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x8, 0x3, 0xfffffffc}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbd}}], 0x1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x58) r4 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r4, 0xc0505510, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4010}}], 0x1, 0x20008000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r6, &(0x7f0000000000)='3', 0x4e) syz_open_dev$loop(0x0, 0x4, 0x12bb41) socket$inet6(0xa, 0x3, 0x8000000003c) mmap$IORING_OFF_SQ_RING(0x80000000000, 0xc00000, 0x1000001, 0x4c032, 0xffffffffffffffff, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000240)={0x1f, 0xffff, 0x3}, 0x6) sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000001280)=ANY=[@ANYBLOB='B'], 0x4c}}, 0x0) write$binfmt_misc(r7, &(0x7f0000001280), 0x6) ioctl$SG_IO(r0, 0x2285, &(0x7f00000004c0)={0x53, 0xfffffffffffffffe, 0x6, 0x2, @scatter={0x1, 0xdd, &(0x7f0000000040)}, &(0x7f0000000300)="eded501ef663", 0x0, 0x840802, 0x10030, 0x1000, 0x0}) 1.244851905s ago: executing program 2 (id=2892): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') pread64(r4, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) write$tcp_mem(0xffffffffffffffff, &(0x7f0000019080)={0x40, 0x20, 0x9, 0x20, 0x7}, 0x48) socket(0x2, 0xa, 0x0) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x1}) 734.582324ms ago: executing program 3 (id=2893): socket(0x18, 0x3, 0x0) epoll_create1(0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x44080) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$igmp(0x2, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x18, 0x8, 0x40, 0x42, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2100, 0x10000004, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) bind$rxrpc(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, 0x0) sendmsg$nl_generic(r0, 0x0, 0xc000) 31.089336ms ago: executing program 2 (id=2894): syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x7fc8, 0x1000, 0x40002, 0x393}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xffffd000) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) syz_ublk_add_dev(0xffffffffffffffff, r0, r1, r2, &(0x7f0000000400)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x3, 0x603, 0x0, 0x0, 0x1000, 0xb6a7, 0x0, 0x0, 0x28}}}, &(0x7f0000000180)=0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) syz_ublk_setup_queues(r5, r4, &(0x7f0000000480)={0x0, 0x18ee, 0x1000, 0x3, 0x1d2}, &(0x7f0000002680)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb656, 0x20, 0x2, 0x342, 0x0, r5}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x842d, 0x40, 0x2, 0x6a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb6d4, 0x10000, 0x1, 0x252}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xeaff, 0x8, 0x0, 0x231}}], 0x4, &(0x7f0000003900)={0x2e, 0x62, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x9}, 0x0, r3, '\x00', {0x2003, 0xb66, 0x0, 0x0}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)={0x14, 0x23, 0x409, 0x70bd25, 0x25dfd3ff, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x24040811}, 0x8410) syz_clone(0x280000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)="3d183e767f00214c2e5c07799ae108914ae4c2cd24a1470432a3917ac4932ba9e1c6f129861f13f430ca8eeac0f55b39cef14c") bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes256\x00'}, 0x58) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x27}, 0x74) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x3, 0xc, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x20223000, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0x9, 0x1, 0x20010, r6, 0x20000000) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000500)='/sys/kernel/kexec_crash_size', 0x202, 0x0) sendfile(r8, r8, 0x0, 0x6) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$TIPC_NL_BEARER_ADD(r8, &(0x7f0000002500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000024c0)={&(0x7f0000002340)={0x80, 0x0, 0x8, 0x70bd26, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x68, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x64, 0x3, "c907821af0a1a820c8a9d270a15dbabaa1e56e30808953e62fb8fc92d00052d206e217f2dce4148877931e67d9998da21eb88975347d6c0f02b1fcf501d04c3d3332e23cd85edcaa445a27871c8cb8690379961e759cb5262f98620916a88c26"}]}, @TIPC_NLA_NODE={0x4}]}, 0x80}, 0x1, 0x0, 0x0, 0x10}, 0x8000) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r8, 0x40182103, &(0x7f00000003c0)={0x0, 0x1, r9, 0x1, 0x80000}) 30.185011ms ago: executing program 1 (id=2895): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) write$tcp_mem(0xffffffffffffffff, &(0x7f0000019080)={0x40, 0x20, 0x9, 0x20, 0x7}, 0x48) socket(0x2, 0xa, 0x0) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x1}) 0s ago: executing program 3 (id=2896): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000380), 0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7}) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x4b, &(0x7f0000000040)={&(0x7f0000000180)={0x58, 0x1, 0x2, 0x201, 0x0, 0x0, {0xa}, [@CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_MASTER={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}]}, 0x58}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001980)=@newchain={0x24, 0x1e, 0x101, 0x0, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {0x4, 0x1}, {0x10, 0xb}}}, 0x24}}, 0x44004) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) epoll_create(0x3) write$P9_RSTATu(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e) openat$sequencer(0xffffff9c, &(0x7f0000000100), 0x8ec02, 0x0) kernel console output (not intermixed with test programs): no interface number 1 [ 402.862643][ T64] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 402.862662][ T64] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 402.862683][ T64] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 402.862703][ T64] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 402.862725][ T64] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 402.862747][ T64] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 402.862774][ T64] usb 7-1: config 14 interface 57 has no altsetting 0 [ 402.862789][ T64] usb 7-1: config 14 interface 228 has no altsetting 0 [ 402.865689][ T64] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 402.865709][ T64] usb 7-1: Product: syz [ 402.865721][ T64] usb 7-1: Manufacturer: syz [ 402.865734][ T64] usb 7-1: SerialNumber: syz [ 403.261325][T13763] nvmet: disable ns before setting buffered_io value. [ 403.261804][T13763] nvmet: the ns:1 is already enabled. [ 403.263037][T13763] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 403.282426][ T64] legousbtower 7-1:14.57: interrupt endpoints not found [ 403.298004][T10445] nvmet: Created nvm controller 26 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 403.300754][T13763] nvme nvme25: creating 4 I/O queues. [ 403.303466][T13763] nvme nvme25: new ctrl: "testsubsys" [ 403.354760][ T7318] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 403.494731][ T7318] usb 6-1: device descriptor read/64, error -71 [ 403.682833][ T64] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 403.684242][ T64] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 403.754738][ T7318] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 403.819041][T13770] FAULT_INJECTION: forcing a failure. [ 403.819041][T13770] name fail_futex, interval 1, probability 0, space 0, times 0 [ 403.819081][T13770] CPU: 0 UID: 0 PID: 13770 Comm: syz.3.2336 Not tainted syzkaller #0 PREEMPT(full) [ 403.819102][T13770] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 403.819114][T13770] Call Trace: [ 403.819121][T13770] [ 403.819130][T13770] dump_stack_lvl+0x100/0x190 [ 403.819161][T13770] should_fail_ex.cold+0x5/0xa [ 403.819185][T13770] get_futex_key+0x1d0/0x14f0 [ 403.819213][T13770] ? __pfx_get_futex_key+0x10/0x10 [ 403.819236][T13770] ? trace_ipi_send_cpu.constprop.0+0x73/0x220 [ 403.819259][T13770] ? __smp_call_single_queue+0x17e/0x450 [ 403.819284][T13770] ? __pfx___smp_call_single_queue+0x10/0x10 [ 403.819309][T13770] futex_wait_setup+0x91/0x540 [ 403.819335][T13770] __futex_wait+0x19f/0x300 [ 403.819356][T13770] ? __pfx___futex_wait+0x10/0x10 [ 403.819373][T13770] ? __pfx_try_to_wake_up+0x10/0x10 [ 403.819396][T13770] ? futex_hash+0x311/0x400 [ 403.819421][T13770] ? __pfx_futex_wake_mark+0x10/0x10 [ 403.819444][T13770] ? find_held_lock+0x2b/0x80 [ 403.819462][T13770] ? futex_wake+0x4ea/0x5e0 [ 403.819486][T13770] futex_wait+0xe6/0x370 [ 403.819506][T13770] ? __pfx_futex_wait+0x10/0x10 [ 403.819556][T13770] ? up_write+0x2dc/0x5b0 [ 403.819587][T13770] do_futex+0x265/0x440 [ 403.819605][T13770] ? __pfx_do_futex+0x10/0x10 [ 403.819628][T13770] __ia32_sys_futex_time32+0x2f4/0x470 [ 403.819650][T13770] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 403.819669][T13770] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 403.819694][T13770] __do_fast_syscall_32+0x13a/0x8b0 [ 403.819723][T13770] do_fast_syscall_32+0x32/0x70 [ 403.819749][T13770] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 403.819770][T13770] RIP: 0023:0xf707efec [ 403.819789][T13770] Code: Unable to access opcode bytes at 0xf707efc2. [ 403.819797][T13770] RSP: 002b:00000000f546d5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 403.819813][T13770] RAX: ffffffffffffffda RBX: 00000000f7474f88 RCX: 0000000000000080 [ 403.819824][T13770] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7474f8c [ 403.819834][T13770] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 403.819845][T13770] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 403.819855][T13770] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 403.819877][T13770] [ 403.896628][ T7318] usb 6-1: device descriptor read/64, error -71 [ 404.006700][ T7318] usb usb6-port1: attempt power cycle [ 404.248673][T13779] IPVS: length: 8 != 383101893624 [ 404.250415][T13779] JFS: charset not found [ 404.354788][ T7318] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 404.375179][ T7318] usb 6-1: device descriptor read/8, error -71 [ 404.441510][ T25] usb 7-1: USB disconnect, device number 33 [ 404.448364][ T25] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 404.614795][ T7318] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 404.645882][ T7318] usb 6-1: device descriptor read/8, error -71 [ 404.754928][ T7318] usb usb6-port1: unable to enumerate USB device [ 406.352127][T13807] FAULT_INJECTION: forcing a failure. [ 406.352127][T13807] name fail_futex, interval 1, probability 0, space 0, times 0 [ 406.352209][T13807] CPU: 3 UID: 0 PID: 13807 Comm: syz.4.2345 Not tainted syzkaller #0 PREEMPT(full) [ 406.352234][T13807] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 406.352247][T13807] Call Trace: [ 406.352256][T13807] [ 406.352265][T13807] dump_stack_lvl+0x100/0x190 [ 406.352296][T13807] should_fail_ex.cold+0x5/0xa [ 406.352324][T13807] get_futex_key+0x1d0/0x14f0 [ 406.352358][T13807] ? __pfx_get_futex_key+0x10/0x10 [ 406.352388][T13807] ? wakeup_preempt_fair+0x5c3/0xdc0 [ 406.352419][T13807] ? tracing_record_taskinfo_sched_switch+0xac/0x560 [ 406.352450][T13807] futex_wait_setup+0x91/0x540 [ 406.352480][T13807] __futex_wait+0x19f/0x300 [ 406.352505][T13807] ? __pfx___futex_wait+0x10/0x10 [ 406.352527][T13807] ? __pfx_try_to_wake_up+0x10/0x10 [ 406.352553][T13807] ? futex_hash+0x311/0x400 [ 406.352580][T13807] ? __pfx_futex_wake_mark+0x10/0x10 [ 406.352605][T13807] ? find_held_lock+0x2b/0x80 [ 406.352625][T13807] ? futex_wake+0x4ea/0x5e0 [ 406.352653][T13807] futex_wait+0xe6/0x370 [ 406.352675][T13807] ? __pfx_futex_wait+0x10/0x10 [ 406.352713][T13807] ? up_write+0x2dc/0x5b0 [ 406.352747][T13807] do_futex+0x265/0x440 [ 406.352787][T13807] ? __pfx_do_futex+0x10/0x10 [ 406.352817][T13807] __ia32_sys_futex_time32+0x2f4/0x470 [ 406.352843][T13807] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 406.352866][T13807] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 406.352897][T13807] __do_fast_syscall_32+0x13a/0x8b0 [ 406.352935][T13807] do_fast_syscall_32+0x32/0x70 [ 406.352969][T13807] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 406.352996][T13807] RIP: 0023:0xf7f88fec [ 406.353018][T13807] Code: Unable to access opcode bytes at 0xf7f88fc2. [ 406.353028][T13807] RSP: 002b:00000000f54465bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 406.353050][T13807] RAX: ffffffffffffffda RBX: 00000000f7444f88 RCX: 0000000000000080 [ 406.353064][T13807] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7444f8c [ 406.353075][T13807] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 406.353088][T13807] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 406.353100][T13807] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 406.353127][T13807] [ 406.863942][T13822] LUN: removable file: (no medium) [ 408.234778][ T1355] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 408.384928][ T1355] usb 6-1: device descriptor read/64, error -71 [ 408.480035][T13854] FAULT_INJECTION: forcing a failure. [ 408.480035][T13854] name fail_futex, interval 1, probability 0, space 0, times 0 [ 408.480058][T13854] CPU: 1 UID: 0 PID: 13854 Comm: syz.3.2355 Not tainted syzkaller #0 PREEMPT(full) [ 408.480075][T13854] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 408.480083][T13854] Call Trace: [ 408.480088][T13854] [ 408.480095][T13854] dump_stack_lvl+0x100/0x190 [ 408.480115][T13854] should_fail_ex.cold+0x5/0xa [ 408.480131][T13854] ? find_held_lock+0x2b/0x80 [ 408.480147][T13854] get_futex_key+0x1d0/0x14f0 [ 408.480192][T13854] ? __pfx_get_futex_key+0x10/0x10 [ 408.480212][T13854] ? __up_read+0x333/0x980 [ 408.480237][T13854] ? __pfx___up_read+0x10/0x10 [ 408.480255][T13854] ? __mm_populate+0x33a/0x3a0 [ 408.480274][T13854] futex_wake+0xf4/0x5e0 [ 408.480292][T13854] ? __pfx_futex_wake+0x10/0x10 [ 408.480309][T13854] ? up_write+0x2dc/0x5b0 [ 408.480333][T13854] do_futex+0x2b2/0x440 [ 408.480346][T13854] ? __pfx_do_futex+0x10/0x10 [ 408.480375][T13854] __ia32_sys_futex_time32+0x2f4/0x470 [ 408.480393][T13854] ? xfd_validate_state+0x129/0x190 [ 408.480411][T13854] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 408.480430][T13854] __do_fast_syscall_32+0x13a/0x8b0 [ 408.480452][T13854] do_fast_syscall_32+0x32/0x70 [ 408.480471][T13854] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 408.480488][T13854] RIP: 0023:0xf707efec [ 408.480502][T13854] Code: Unable to access opcode bytes at 0xf707efc2. [ 408.480508][T13854] RSP: 002b:00000000f546d5cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 408.480522][T13854] RAX: ffffffffffffffda RBX: 00000000f7474f8c RCX: 0000000000000081 [ 408.480530][T13854] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 408.480537][T13854] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 408.480545][T13854] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 408.480552][T13854] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 408.480567][T13854] [ 408.634756][ T1355] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 408.766523][ T1355] usb 6-1: device descriptor read/64, error -71 [ 408.885109][ T1355] usb usb6-port1: attempt power cycle [ 409.244726][ T1355] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 409.277469][ T1355] usb 6-1: device descriptor read/8, error -71 [ 409.515340][ T1355] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 409.536433][ T1355] usb 6-1: device descriptor read/8, error -71 [ 409.655997][ T1355] usb usb6-port1: unable to enumerate USB device [ 409.957064][T13877] LUN: removable file: (no medium) [ 411.123593][T13895] FAULT_INJECTION: forcing a failure. [ 411.123593][T13895] name fail_futex, interval 1, probability 0, space 0, times 0 [ 411.123645][T13895] CPU: 3 UID: 0 PID: 13895 Comm: syz.1.2364 Not tainted syzkaller #0 PREEMPT(full) [ 411.123671][T13895] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 411.123684][T13895] Call Trace: [ 411.123693][T13895] [ 411.123702][T13895] dump_stack_lvl+0x100/0x190 [ 411.123735][T13895] should_fail_ex.cold+0x5/0xa [ 411.123762][T13895] get_futex_key+0x1d0/0x14f0 [ 411.123797][T13895] ? __pfx_get_futex_key+0x10/0x10 [ 411.123825][T13895] ? __pfx___resched_curr+0x10/0x10 [ 411.123854][T13895] ? wakeup_preempt_fair+0x4a0/0xdc0 [ 411.123887][T13895] ? tracing_record_taskinfo_sched_switch+0xac/0x560 [ 411.123922][T13895] futex_wait_setup+0x91/0x540 [ 411.123953][T13895] __futex_wait+0x19f/0x300 [ 411.123978][T13895] ? __pfx___futex_wait+0x10/0x10 [ 411.124000][T13895] ? __pfx_try_to_wake_up+0x10/0x10 [ 411.124028][T13895] ? futex_hash+0x311/0x400 [ 411.124060][T13895] ? __pfx_futex_wake_mark+0x10/0x10 [ 411.124088][T13895] ? find_held_lock+0x2b/0x80 [ 411.124109][T13895] ? futex_wake+0x4ea/0x5e0 [ 411.124138][T13895] futex_wait+0xe6/0x370 [ 411.124162][T13895] ? __pfx_futex_wait+0x10/0x10 [ 411.124197][T13895] ? up_write+0x2dc/0x5b0 [ 411.124232][T13895] do_futex+0x265/0x440 [ 411.124252][T13895] ? __pfx_do_futex+0x10/0x10 [ 411.124278][T13895] __ia32_sys_futex_time32+0x2f4/0x470 [ 411.124305][T13895] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 411.124330][T13895] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 411.124365][T13895] __do_fast_syscall_32+0x13a/0x8b0 [ 411.124400][T13895] do_fast_syscall_32+0x32/0x70 [ 411.124430][T13895] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 411.124455][T13895] RIP: 0023:0xf70aefec [ 411.124477][T13895] Code: Unable to access opcode bytes at 0xf70aefc2. [ 411.124487][T13895] RSP: 002b:00000000f549d5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 411.124507][T13895] RAX: ffffffffffffffda RBX: 00000000f74a4f88 RCX: 0000000000000080 [ 411.124520][T13895] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f74a4f8c [ 411.124532][T13895] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 411.124545][T13895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 411.124557][T13895] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 411.124582][T13895] [ 413.967695][T13947] LUN: removable file: (no medium) [ 414.058617][T13950] FAULT_INJECTION: forcing a failure. [ 414.058617][T13950] name failslab, interval 1, probability 0, space 0, times 0 [ 414.058648][T13950] CPU: 3 UID: 0 PID: 13950 Comm: syz.3.2374 Not tainted syzkaller #0 PREEMPT(full) [ 414.058670][T13950] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 414.058682][T13950] Call Trace: [ 414.058688][T13950] [ 414.058696][T13950] dump_stack_lvl+0x100/0x190 [ 414.058726][T13950] should_fail_ex.cold+0x5/0xa [ 414.058751][T13950] should_failslab+0xc2/0x120 [ 414.058778][T13950] kmem_cache_alloc_noprof+0x92/0x6a0 [ 414.058803][T13950] ? security_file_alloc+0x34/0x2c0 [ 414.058838][T13950] security_file_alloc+0x34/0x2c0 [ 414.058866][T13950] init_file+0x95/0x480 [ 414.058891][T13950] alloc_empty_file+0x79/0x1c0 [ 414.058917][T13950] path_openat+0xdb/0x2440 [ 414.058945][T13950] ? __pfx_path_openat+0x10/0x10 [ 414.059103][T13950] do_file_open+0x20e/0x430 [ 414.059135][T13950] ? __pfx_do_file_open+0x10/0x10 [ 414.059174][T13950] ? _raw_spin_unlock+0x28/0x50 [ 414.059199][T13950] ? alloc_fd+0x471/0x7a0 [ 414.059230][T13950] do_sys_openat2+0x10f/0x1e0 [ 414.059258][T13950] ? __pfx_do_sys_openat2+0x10/0x10 [ 414.059288][T13950] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 414.059314][T13950] __ia32_compat_sys_openat+0x12d/0x210 [ 414.059343][T13950] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 414.059379][T13950] do_int80_emulation+0x166/0x650 [ 414.059412][T13950] asm_int80_emulation+0x1a/0x20 [ 414.059431][T13950] RIP: 0023:0xf71b75ab [ 414.059445][T13950] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 414.059464][T13950] RSP: 002b:00000000f546d42c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 414.059507][T13950] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f72819a5 [ 414.059521][T13950] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 414.059533][T13950] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 414.059545][T13950] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 414.059558][T13950] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 414.059583][T13950] [ 416.923369][T14016] LUN: removable file: (no medium) [ 422.306152][ T1164] nvmet: Created nvm controller 27 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 422.323558][T14149] nvme nvme26: creating 4 I/O queues. [ 422.335610][T14149] nvme nvme26: new ctrl: "testsubsys" [ 422.590344][T14157] LUN: removable file: (no medium) [ 426.244718][ T6318] usb 8-1: new high-speed USB device number 33 using dummy_hcd [ 426.404705][ T6318] usb 8-1: Using ep0 maxpacket: 32 [ 426.406836][ T6318] usb 8-1: unable to get BOS descriptor or descriptor too short [ 426.406876][ T6318] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 426.407912][ T6318] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 426.407932][ T6318] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 426.407947][ T6318] usb 8-1: config 14 has no interface number 0 [ 426.407962][ T6318] usb 8-1: config 14 has no interface number 1 [ 426.408013][ T6318] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 426.408032][ T6318] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 426.408053][ T6318] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 426.408072][ T6318] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 426.408092][ T6318] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 426.408112][ T6318] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 426.408132][ T6318] usb 8-1: config 14 interface 57 has no altsetting 0 [ 426.408146][ T6318] usb 8-1: config 14 interface 228 has no altsetting 0 [ 426.410439][ T6318] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.410458][ T6318] usb 8-1: Product: syz [ 426.410470][ T6318] usb 8-1: Manufacturer: syz [ 426.410483][ T6318] usb 8-1: SerialNumber: syz [ 426.520267][T10458] nvmet: Created nvm controller 28 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 426.523183][T14231] nvme nvme27: creating 4 I/O queues. [ 426.539069][T14231] nvme nvme27: new ctrl: "testsubsys" [ 426.720249][T14239] FAULT_INJECTION: forcing a failure. [ 426.720249][T14239] name fail_futex, interval 1, probability 0, space 0, times 0 [ 426.720284][T14239] CPU: 1 UID: 0 PID: 14239 Comm: syz.2.2410 Not tainted syzkaller #0 PREEMPT(full) [ 426.720307][T14239] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 426.720321][T14239] Call Trace: [ 426.720329][T14239] [ 426.720338][T14239] dump_stack_lvl+0x100/0x190 [ 426.720372][T14239] should_fail_ex.cold+0x5/0xa [ 426.720396][T14239] get_futex_key+0x1d0/0x14f0 [ 426.720430][T14239] ? __pfx_get_futex_key+0x10/0x10 [ 426.720459][T14239] ? wakeup_preempt_fair+0x5c3/0xdc0 [ 426.720489][T14239] ? tracing_record_taskinfo_sched_switch+0xac/0x560 [ 426.720521][T14239] futex_wait_setup+0x91/0x540 [ 426.720552][T14239] __futex_wait+0x19f/0x300 [ 426.720580][T14239] ? __pfx___futex_wait+0x10/0x10 [ 426.720600][T14239] ? __pfx_try_to_wake_up+0x10/0x10 [ 426.720631][T14239] ? futex_hash+0x311/0x400 [ 426.720662][T14239] ? __pfx_futex_wake_mark+0x10/0x10 [ 426.720689][T14239] ? find_held_lock+0x2b/0x80 [ 426.720707][T14239] ? futex_wake+0x4ea/0x5e0 [ 426.720733][T14239] futex_wait+0xe6/0x370 [ 426.720756][T14239] ? __pfx_futex_wait+0x10/0x10 [ 426.720805][T14239] ? up_write+0x2dc/0x5b0 [ 426.720841][T14239] do_futex+0x265/0x440 [ 426.720862][T14239] ? __pfx_do_futex+0x10/0x10 [ 426.720889][T14239] __ia32_sys_futex_time32+0x2f4/0x470 [ 426.720913][T14239] ? xfd_validate_state+0x129/0x190 [ 426.720940][T14239] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 426.720977][T14239] __do_fast_syscall_32+0x13a/0x8b0 [ 426.721011][T14239] do_fast_syscall_32+0x32/0x70 [ 426.721041][T14239] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 426.721066][T14239] RIP: 0023:0xf7fb4fec [ 426.721087][T14239] Code: Unable to access opcode bytes at 0xf7fb4fc2. [ 426.721095][T14239] RSP: 002b:00000000f54765bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 426.721115][T14239] RAX: ffffffffffffffda RBX: 00000000f7474f88 RCX: 0000000000000080 [ 426.721128][T14239] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7474f8c [ 426.721139][T14239] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 426.721151][T14239] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 426.721162][T14239] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 426.721186][T14239] [ 426.904003][ T6318] legousbtower 8-1:14.57: interrupt endpoints not found [ 427.306812][ T6318] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 427.309100][ T6318] legousbtower 8-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 427.870414][T14270] IPVS: length: 8 != 383101893624 [ 427.871202][T14270] JFS: charset not found [ 428.065583][T10168] usb 8-1: USB disconnect, device number 33 [ 428.089073][T10168] legousbtower 8-1:14.228: LEGO USB Tower #-160 now disconnected [ 428.490138][ T5738] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 428.492920][ T5738] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 428.493589][ T5738] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 428.494482][ T5738] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 428.514879][ T5738] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 428.758396][T14295] FAULT_INJECTION: forcing a failure. [ 428.758396][T14295] name fail_futex, interval 1, probability 0, space 0, times 0 [ 428.758425][T14295] CPU: 0 UID: 0 PID: 14295 Comm: syz.3.2419 Not tainted syzkaller #0 PREEMPT(full) [ 428.758445][T14295] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 428.758455][T14295] Call Trace: [ 428.758462][T14295] [ 428.758469][T14295] dump_stack_lvl+0x100/0x190 [ 428.758504][T14295] should_fail_ex.cold+0x5/0xa [ 428.758524][T14295] get_futex_key+0x1d0/0x14f0 [ 428.758552][T14295] ? __pfx_get_futex_key+0x10/0x10 [ 428.758579][T14295] ? wakeup_preempt_fair+0x5c3/0xdc0 [ 428.758608][T14295] ? tracing_record_taskinfo_sched_switch+0xac/0x560 [ 428.758649][T14295] futex_wait_setup+0x91/0x540 [ 428.758673][T14295] __futex_wait+0x19f/0x300 [ 428.758696][T14295] ? __pfx___futex_wait+0x10/0x10 [ 428.758713][T14295] ? __pfx_try_to_wake_up+0x10/0x10 [ 428.758739][T14295] ? futex_hash+0x311/0x400 [ 428.758764][T14295] ? __pfx_futex_wake_mark+0x10/0x10 [ 428.758788][T14295] ? find_held_lock+0x2b/0x80 [ 428.758806][T14295] ? futex_wake+0x4ea/0x5e0 [ 428.758833][T14295] futex_wait+0xe6/0x370 [ 428.758857][T14295] ? __pfx_futex_wait+0x10/0x10 [ 428.758881][T14295] ? up_write+0x2dc/0x5b0 [ 428.758911][T14295] do_futex+0x265/0x440 [ 428.758949][T14295] ? __pfx_do_futex+0x10/0x10 [ 428.758975][T14295] __ia32_sys_futex_time32+0x2f4/0x470 [ 428.758998][T14295] ? xfd_validate_state+0x129/0x190 [ 428.759022][T14295] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 428.759053][T14295] __do_fast_syscall_32+0x13a/0x8b0 [ 428.759086][T14295] do_fast_syscall_32+0x32/0x70 [ 428.759114][T14295] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 428.759137][T14295] RIP: 0023:0xf707efec [ 428.759158][T14295] Code: Unable to access opcode bytes at 0xf707efc2. [ 428.759167][T14295] RSP: 002b:00000000f546d5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 428.759187][T14295] RAX: ffffffffffffffda RBX: 00000000f7474f88 RCX: 0000000000000080 [ 428.759200][T14295] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7474f8c [ 428.759209][T14295] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 428.759219][T14295] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 428.759230][T14295] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 428.759254][T14295] [ 428.763149][T14295] Bluetooth: MGMT ver 1.23 [ 428.880450][ T5741] bond0: (slave syz_tun): Releasing backup interface [ 429.338761][T10456] nvmet: Created nvm controller 29 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 429.383970][T14304] nvme nvme28: creating 4 I/O queues. [ 429.487989][T14304] nvme nvme28: new ctrl: "testsubsys" [ 429.829444][ T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.023270][ T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.182586][ T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.271249][ T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.335904][T14285] bridge0: port 1(bridge_slave_0) entered blocking state [ 430.336019][T14285] bridge0: port 1(bridge_slave_0) entered disabled state [ 430.336098][T14285] bridge_slave_0: entered allmulticast mode [ 430.336823][T14285] bridge_slave_0: entered promiscuous mode [ 430.340337][T14285] bridge0: port 2(bridge_slave_1) entered blocking state [ 430.340383][T14285] bridge0: port 2(bridge_slave_1) entered disabled state [ 430.340438][T14285] bridge_slave_1: entered allmulticast mode [ 430.341163][T14285] bridge_slave_1: entered promiscuous mode [ 430.358389][T14285] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 430.359869][T14285] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 430.376124][T14285] team0: Port device team_slave_0 added [ 430.377692][T14285] team0: Port device team_slave_1 added [ 430.392763][T14285] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 430.392775][T14285] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 430.392788][T14285] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 430.393749][T14285] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 430.393757][T14285] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 430.393770][T14285] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 430.416037][T14285] hsr_slave_0: entered promiscuous mode [ 430.416576][T14285] hsr_slave_1: entered promiscuous mode [ 430.417563][T14285] debugfs: 'hsr0' already exists in 'hsr' [ 430.418943][T14285] Cannot create hsr debugfs directory [ 430.562736][ T13] bridge_slave_1: left allmulticast mode [ 430.562760][ T13] bridge_slave_1: left promiscuous mode [ 430.562900][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 430.575128][ T13] bridge_slave_0: left allmulticast mode [ 430.575144][ T13] bridge_slave_0: left promiscuous mode [ 430.575351][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 430.586696][ T5740] Bluetooth: hci0: command tx timeout [ 430.891920][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 430.903320][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 430.907787][ T13] bond0 (unregistering): Released all slaves [ 430.921333][ T5448] 8021q: adding VLAN 0 to HW filter on device eth6 [ 430.940128][T14353] FAULT_INJECTION: forcing a failure. [ 430.940128][T14353] name failslab, interval 1, probability 0, space 0, times 0 [ 430.940157][T14353] CPU: 1 UID: 0 PID: 14353 Comm: syz.1.2427 Not tainted syzkaller #0 PREEMPT(full) [ 430.940176][T14353] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 430.940185][T14353] Call Trace: [ 430.940191][T14353] [ 430.940198][T14353] dump_stack_lvl+0x100/0x190 [ 430.940225][T14353] should_fail_ex.cold+0x5/0xa [ 430.940246][T14353] should_failslab+0xc2/0x120 [ 430.940268][T14353] kmem_cache_alloc_noprof+0x92/0x6a0 [ 430.940290][T14353] ? up_write+0x2dc/0x5b0 [ 430.940313][T14353] ? do_getname+0x35/0x390 [ 430.940339][T14353] do_getname+0x35/0x390 [ 430.940363][T14353] do_sys_openat2+0xc7/0x1e0 [ 430.940384][T14353] ? __pfx_do_sys_openat2+0x10/0x10 [ 430.940410][T14353] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 430.940429][T14353] ? __ia32_sys_futex_time32+0x2fd/0x470 [ 430.940452][T14353] __ia32_compat_sys_openat+0x12d/0x210 [ 430.940479][T14353] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 430.940519][T14353] do_int80_emulation+0x166/0x650 [ 430.940549][T14353] asm_int80_emulation+0x1a/0x20 [ 430.940569][T14353] RIP: 0023:0xf71e75ab [ 430.940583][T14353] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 430.940597][T14353] RSP: 002b:00000000f549d42c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 430.940615][T14353] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f72b19a5 [ 430.940627][T14353] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 430.940636][T14353] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 430.940646][T14353] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 430.940657][T14353] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 430.940680][T14353] [ 431.066733][ T13] rxrpc: Leaked peer c1 {1} [0000:0000:0000:0000:0000:0000:0000:0000]:7003 [ 431.114754][ T25] usb 9-1: new high-speed USB device number 38 using dummy_hcd [ 431.268584][ T25] usb 9-1: Using ep0 maxpacket: 32 [ 431.273934][ T25] usb 9-1: unable to get BOS descriptor or descriptor too short [ 431.273974][ T25] usb 9-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 431.280366][ T25] usb 9-1: config 14 has an invalid interface number: 57 but max is 1 [ 431.280391][ T25] usb 9-1: config 14 has an invalid interface number: 228 but max is 1 [ 431.280408][ T25] usb 9-1: config 14 has no interface number 0 [ 431.280421][ T25] usb 9-1: config 14 has no interface number 1 [ 431.280478][ T25] usb 9-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 431.280497][ T25] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 431.280517][ T25] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 431.280538][ T25] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 431.280560][ T25] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 431.280580][ T25] usb 9-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 431.280661][ T25] usb 9-1: config 14 interface 57 has no altsetting 0 [ 431.280677][ T25] usb 9-1: config 14 interface 228 has no altsetting 0 [ 431.285241][ T25] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 431.285256][ T25] usb 9-1: Product: syz [ 431.285264][ T25] usb 9-1: Manufacturer: syz [ 431.285272][ T25] usb 9-1: SerialNumber: syz [ 431.492890][ T13] hsr_slave_0: left promiscuous mode [ 431.493326][ T13] hsr_slave_1: left promiscuous mode [ 431.493784][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 431.493800][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 431.494425][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 431.494439][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 431.508065][ T13] veth0_macvtap: left promiscuous mode [ 431.705822][ T25] legousbtower 9-1:14.57: interrupt endpoints not found [ 431.939117][ T13] team0 (unregistering): Port device team_slave_1 removed [ 431.958903][ T13] team0 (unregistering): Port device team_slave_0 removed [ 432.109195][ T25] legousbtower 9-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 432.119986][ T25] legousbtower 9-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 432.255758][T14285] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 432.270437][T14285] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 432.271259][T14285] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 432.287124][T14285] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 432.288120][T14285] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 432.290838][T14285] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 432.293936][T14285] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 432.302929][T14285] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 432.386837][T14285] 8021q: adding VLAN 0 to HW filter on device bond0 [ 432.498713][T14285] 8021q: adding VLAN 0 to HW filter on device team0 [ 432.508092][T10437] bridge0: port 1(bridge_slave_0) entered blocking state [ 432.508187][T10437] bridge0: port 1(bridge_slave_0) entered forwarding state [ 432.522293][T10437] bridge0: port 2(bridge_slave_1) entered blocking state [ 432.522383][T10437] bridge0: port 2(bridge_slave_1) entered forwarding state [ 432.600077][T14285] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 432.674910][ T5740] Bluetooth: hci0: command tx timeout [ 432.784335][T14407] IPVS: length: 8 != 383101893624 [ 432.798983][T14407] JFS: charset not found [ 432.802556][ T13] IPVS: stop unused estimator thread 0... [ 432.961650][ T64] usb 9-1: USB disconnect, device number 38 [ 433.166025][ T64] legousbtower 9-1:14.228: LEGO USB Tower #-160 now disconnected [ 434.251018][T14453] FAULT_INJECTION: forcing a failure. [ 434.251018][T14453] name fail_futex, interval 1, probability 0, space 0, times 0 [ 434.251043][T14453] CPU: 2 UID: 0 PID: 14453 Comm: syz.1.2435 Not tainted syzkaller #0 PREEMPT(full) [ 434.251067][T14453] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 434.251075][T14453] Call Trace: [ 434.251081][T14453] [ 434.251087][T14453] dump_stack_lvl+0x100/0x190 [ 434.251108][T14453] should_fail_ex.cold+0x5/0xa [ 434.251125][T14453] get_futex_key+0x1d0/0x14f0 [ 434.251147][T14453] ? __pfx_get_futex_key+0x10/0x10 [ 434.251166][T14453] ? wakeup_preempt_fair+0x5c3/0xdc0 [ 434.251187][T14453] ? tracing_record_taskinfo_sched_switch+0xac/0x560 [ 434.251208][T14453] futex_wait_setup+0x91/0x540 [ 434.251230][T14453] __futex_wait+0x19f/0x300 [ 434.251246][T14453] ? __pfx___futex_wait+0x10/0x10 [ 434.251259][T14453] ? __pfx_try_to_wake_up+0x10/0x10 [ 434.251276][T14453] ? futex_hash+0x311/0x400 [ 434.251294][T14453] ? __pfx_futex_wake_mark+0x10/0x10 [ 434.251311][T14453] ? find_held_lock+0x2b/0x80 [ 434.251323][T14453] ? futex_wake+0x4ea/0x5e0 [ 434.251340][T14453] futex_wait+0xe6/0x370 [ 434.251394][T14453] ? __pfx_futex_wait+0x10/0x10 [ 434.251415][T14453] ? up_write+0x2dc/0x5b0 [ 434.251438][T14453] do_futex+0x265/0x440 [ 434.251452][T14453] ? __pfx_do_futex+0x10/0x10 [ 434.251468][T14453] __ia32_sys_futex_time32+0x2f4/0x470 [ 434.251484][T14453] ? xfd_validate_state+0x129/0x190 [ 434.251506][T14453] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 434.251530][T14453] __do_fast_syscall_32+0x13a/0x8b0 [ 434.251551][T14453] do_fast_syscall_32+0x32/0x70 [ 434.251569][T14453] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 434.251585][T14453] RIP: 0023:0xf70aefec [ 434.251600][T14453] Code: Unable to access opcode bytes at 0xf70aefc2. [ 434.251605][T14453] RSP: 002b:00000000f549d5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 434.251618][T14453] RAX: ffffffffffffffda RBX: 00000000f74a4f88 RCX: 0000000000000080 [ 434.251625][T14453] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f74a4f8c [ 434.251633][T14453] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 434.251640][T14453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 434.251647][T14453] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 434.251662][T14453] [ 434.327246][T14285] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 434.365602][T14285] veth0_vlan: entered promiscuous mode [ 434.396333][T14285] veth1_vlan: entered promiscuous mode [ 434.557161][T14285] veth0_macvtap: entered promiscuous mode [ 434.606144][T14285] veth1_macvtap: entered promiscuous mode [ 434.673447][T14285] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 434.709432][T14285] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 434.735158][ T5606] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.735184][ T5606] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.735202][ T5606] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.735220][ T5606] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.744715][ T5740] Bluetooth: hci0: command tx timeout [ 435.623321][T10445] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 435.623342][T10445] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 436.095496][T10447] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 436.097096][T10447] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 436.834883][ T5740] Bluetooth: hci0: command tx timeout [ 439.787206][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.787291][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.484780][ T64] usb 9-1: new high-speed USB device number 39 using dummy_hcd [ 440.635398][ T64] usb 9-1: Using ep0 maxpacket: 32 [ 440.639314][ T64] usb 9-1: unable to get BOS descriptor or descriptor too short [ 440.639380][ T64] usb 9-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 440.640456][ T64] usb 9-1: config 14 has an invalid interface number: 57 but max is 1 [ 440.640477][ T64] usb 9-1: config 14 has an invalid interface number: 228 but max is 1 [ 440.640494][ T64] usb 9-1: config 14 has no interface number 0 [ 440.640506][ T64] usb 9-1: config 14 has no interface number 1 [ 440.640549][ T64] usb 9-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 440.640567][ T64] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 440.640586][ T64] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 440.640606][ T64] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 440.640628][ T64] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 440.640648][ T64] usb 9-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 440.640668][ T64] usb 9-1: config 14 interface 57 has no altsetting 0 [ 440.640682][ T64] usb 9-1: config 14 interface 228 has no altsetting 0 [ 440.642723][ T64] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.642745][ T64] usb 9-1: Product: syz [ 440.642759][ T64] usb 9-1: Manufacturer: syz [ 440.642772][ T64] usb 9-1: SerialNumber: syz [ 441.060153][ T64] legousbtower 9-1:14.57: interrupt endpoints not found [ 441.609512][ T64] legousbtower 9-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 442.028803][ T64] legousbtower 9-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 442.183996][T14564] IPVS: length: 8 != 383101893624 [ 442.193352][T14564] JFS: charset not found [ 443.300066][T10168] usb 9-1: USB disconnect, device number 39 [ 443.317909][T10168] legousbtower 9-1:14.228: LEGO USB Tower #-160 now disconnected [ 448.634711][ T7318] usb 9-1: new high-speed USB device number 40 using dummy_hcd [ 448.805395][ T7318] usb 9-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 448.806483][ T7318] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 448.806502][ T7318] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 448.808871][ T7318] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.808890][ T7318] usb 9-1: Product: syz [ 448.808903][ T7318] usb 9-1: Manufacturer: syz [ 448.808916][ T7318] usb 9-1: SerialNumber: syz [ 451.433386][ T1355] usb 9-1: USB disconnect, device number 40 [ 451.954821][ T7318] usb 9-1: new high-speed USB device number 41 using dummy_hcd [ 452.105121][ T7318] usb 9-1: Using ep0 maxpacket: 32 [ 452.121577][ T7318] usb 9-1: unable to get BOS descriptor or descriptor too short [ 452.121619][ T7318] usb 9-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 452.122565][ T7318] usb 9-1: config 14 has an invalid interface number: 57 but max is 1 [ 452.122584][ T7318] usb 9-1: config 14 has an invalid interface number: 228 but max is 1 [ 452.122602][ T7318] usb 9-1: config 14 has no interface number 0 [ 452.122615][ T7318] usb 9-1: config 14 has no interface number 1 [ 452.122659][ T7318] usb 9-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 452.122679][ T7318] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 452.122700][ T7318] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 452.122722][ T7318] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 452.122744][ T7318] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 452.122765][ T7318] usb 9-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 452.122787][ T7318] usb 9-1: config 14 interface 57 has no altsetting 0 [ 452.122802][ T7318] usb 9-1: config 14 interface 228 has no altsetting 0 [ 452.151772][ T7318] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.151795][ T7318] usb 9-1: Product: syz [ 452.151808][ T7318] usb 9-1: Manufacturer: syz [ 452.151820][ T7318] usb 9-1: SerialNumber: syz [ 452.419120][T14699] FAULT_INJECTION: forcing a failure. [ 452.419120][T14699] name failslab, interval 1, probability 0, space 0, times 0 [ 452.419220][T14699] CPU: 1 UID: 0 PID: 14699 Comm: syz.2.2460 Not tainted syzkaller #0 PREEMPT(full) [ 452.419256][T14699] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 452.419266][T14699] Call Trace: [ 452.419271][T14699] [ 452.419277][T14699] dump_stack_lvl+0x100/0x190 [ 452.419323][T14699] should_fail_ex.cold+0x5/0xa [ 452.419341][T14699] should_failslab+0xc2/0x120 [ 452.419360][T14699] kmem_cache_alloc_noprof+0x92/0x6a0 [ 452.419376][T14699] ? do_getname+0x35/0x390 [ 452.419404][T14699] do_getname+0x35/0x390 [ 452.419424][T14699] do_sys_openat2+0xc7/0x1e0 [ 452.419444][T14699] ? __pfx_do_sys_openat2+0x10/0x10 [ 452.419466][T14699] ? irqentry_exit+0x24d/0xa10 [ 452.419485][T14699] ? lockdep_hardirqs_on+0x7d/0x110 [ 452.419506][T14699] __ia32_compat_sys_openat+0x12d/0x210 [ 452.419526][T14699] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 452.419568][T14699] do_int80_emulation+0x166/0x650 [ 452.419591][T14699] asm_int80_emulation+0x1a/0x20 [ 452.419605][T14699] RIP: 0023:0xf71a75ab [ 452.419616][T14699] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 452.419629][T14699] RSP: 002b:00000000f545d42c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 452.419643][T14699] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f72719a5 [ 452.419652][T14699] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 452.419659][T14699] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 452.419667][T14699] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 452.419675][T14699] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 452.419691][T14699] [ 452.619321][ T7318] legousbtower 9-1:14.57: interrupt endpoints not found [ 453.024741][ T7318] legousbtower 9-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 453.574365][ T7318] legousbtower 9-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 453.636118][T14721] IPVS: length: 8 != 383101893624 [ 453.640236][T14721] JFS: charset not found [ 455.244093][ T7318] usb 9-1: USB disconnect, device number 41 [ 455.615760][ T7318] legousbtower 9-1:14.228: LEGO USB Tower #-160 now disconnected [ 463.363553][T10394] nvmet: Created nvm controller 30 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 463.382592][T14886] nvme nvme29: creating 4 I/O queues. [ 463.636047][T14886] nvme nvme29: new ctrl: "testsubsys" [ 501.262645][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.262676][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 505.485371][T15555] FAULT_INJECTION: forcing a failure. [ 505.485371][T15555] name fail_futex, interval 1, probability 0, space 0, times 0 [ 505.485395][T15555] CPU: 3 UID: 0 PID: 15555 Comm: syz.2.2551 Not tainted syzkaller #0 PREEMPT(full) [ 505.485411][T15555] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 505.485419][T15555] Call Trace: [ 505.485423][T15555] [ 505.485429][T15555] dump_stack_lvl+0x100/0x190 [ 505.485449][T15555] should_fail_ex.cold+0x5/0xa [ 505.485465][T15555] get_futex_key+0x1d0/0x14f0 [ 505.485485][T15555] ? __pfx_get_futex_key+0x10/0x10 [ 505.485501][T15555] ? trace_ipi_send_cpu.constprop.0+0x73/0x220 [ 505.485517][T15555] ? __smp_call_single_queue+0x17e/0x450 [ 505.485534][T15555] ? __pfx___smp_call_single_queue+0x10/0x10 [ 505.485554][T15555] futex_wait_setup+0x91/0x540 [ 505.485578][T15555] __futex_wait+0x19f/0x300 [ 505.485599][T15555] ? __pfx___futex_wait+0x10/0x10 [ 505.485611][T15555] ? __pfx_try_to_wake_up+0x10/0x10 [ 505.485627][T15555] ? futex_hash+0x311/0x400 [ 505.485644][T15555] ? __pfx_futex_wake_mark+0x10/0x10 [ 505.485659][T15555] ? find_held_lock+0x2b/0x80 [ 505.485670][T15555] ? futex_wake+0x4ea/0x5e0 [ 505.485686][T15555] futex_wait+0xe6/0x370 [ 505.485708][T15555] ? __pfx_futex_wait+0x10/0x10 [ 505.485735][T15555] ? up_write+0x2dc/0x5b0 [ 505.485759][T15555] do_futex+0x265/0x440 [ 505.485772][T15555] ? __pfx_do_futex+0x10/0x10 [ 505.485788][T15555] __ia32_sys_futex_time32+0x2f4/0x470 [ 505.485810][T15555] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 505.485830][T15555] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 505.485859][T15555] __do_fast_syscall_32+0x13a/0x8b0 [ 505.485878][T15555] do_fast_syscall_32+0x32/0x70 [ 505.485895][T15555] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 505.485909][T15555] RIP: 0023:0xf706efec [ 505.485923][T15555] Code: Unable to access opcode bytes at 0xf706efc2. [ 505.485928][T15555] RSP: 002b:00000000f545d5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 505.485939][T15555] RAX: ffffffffffffffda RBX: 00000000f7464f88 RCX: 0000000000000080 [ 505.485946][T15555] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7464f8c [ 505.485953][T15555] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 505.485960][T15555] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 505.485966][T15555] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 505.485979][T15555] [ 511.175607][T15656] FAULT_INJECTION: forcing a failure. [ 511.175607][T15656] name fail_futex, interval 1, probability 0, space 0, times 0 [ 511.175640][T15656] CPU: 3 UID: 0 PID: 15656 Comm: syz.4.2562 Not tainted syzkaller #0 PREEMPT(full) [ 511.175665][T15656] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 511.175676][T15656] Call Trace: [ 511.175684][T15656] [ 511.175693][T15656] dump_stack_lvl+0x100/0x190 [ 511.175722][T15656] should_fail_ex.cold+0x5/0xa [ 511.175747][T15656] get_futex_key+0x1d0/0x14f0 [ 511.175779][T15656] ? __pfx_get_futex_key+0x10/0x10 [ 511.175802][T15656] ? trace_ipi_send_cpu.constprop.0+0x73/0x220 [ 511.175829][T15656] ? __smp_call_single_queue+0x17e/0x450 [ 511.175855][T15656] ? __pfx___smp_call_single_queue+0x10/0x10 [ 511.175883][T15656] futex_wait_setup+0x91/0x540 [ 511.175910][T15656] __futex_wait+0x19f/0x300 [ 511.175934][T15656] ? __pfx___futex_wait+0x10/0x10 [ 511.175954][T15656] ? __pfx_try_to_wake_up+0x10/0x10 [ 511.175978][T15656] ? futex_hash+0x311/0x400 [ 511.176022][T15656] ? __pfx_futex_wake_mark+0x10/0x10 [ 511.176047][T15656] ? find_held_lock+0x2b/0x80 [ 511.176067][T15656] ? futex_wake+0x4ea/0x5e0 [ 511.176097][T15656] futex_wait+0xe6/0x370 [ 511.176120][T15656] ? __pfx_futex_wait+0x10/0x10 [ 511.176146][T15656] ? up_write+0x2dc/0x5b0 [ 511.176184][T15656] do_futex+0x265/0x440 [ 511.176205][T15656] ? __pfx_do_futex+0x10/0x10 [ 511.176230][T15656] __ia32_sys_futex_time32+0x2f4/0x470 [ 511.176255][T15656] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 511.176279][T15656] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 511.176309][T15656] __do_fast_syscall_32+0x13a/0x8b0 [ 511.176340][T15656] do_fast_syscall_32+0x32/0x70 [ 511.176367][T15656] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 511.176389][T15656] RIP: 0023:0xf7f88fec [ 511.176410][T15656] Code: Unable to access opcode bytes at 0xf7f88fc2. [ 511.176417][T15656] RSP: 002b:00000000f54465bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 511.176436][T15656] RAX: ffffffffffffffda RBX: 00000000f7444f88 RCX: 0000000000000080 [ 511.176447][T15656] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7444f8c [ 511.176460][T15656] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 511.176473][T15656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 511.176484][T15656] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 511.176509][T15656] [ 513.566357][ T5738] Bluetooth: hci3: command 0x0406 tx timeout [ 520.654425][ T5738] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 520.665058][ T5738] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 520.669425][ T5738] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 520.689717][ T5738] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 520.695902][ T5738] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 520.883174][ T5606] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 521.224424][ T5606] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 521.374110][ T5606] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 521.560574][ T5606] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.147775][ T5606] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 522.171559][ T5606] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 522.201016][ T5606] bond0 (unregistering): Released all slaves [ 522.269690][T10449] smbdirect: ib_dev[syz1] removed [ 522.295998][ T1355] infiniband syz1: ib_query_port failed (-19) [ 522.362071][T15828] bridge0: port 1(bridge_slave_0) entered blocking state [ 522.365554][T15828] bridge0: port 1(bridge_slave_0) entered disabled state [ 522.365631][T15828] bridge_slave_0: entered allmulticast mode [ 522.366379][T15828] bridge_slave_0: entered promiscuous mode [ 522.370552][T15828] bridge0: port 2(bridge_slave_1) entered blocking state [ 522.371299][T15828] bridge0: port 2(bridge_slave_1) entered disabled state [ 522.371392][T15828] bridge_slave_1: entered allmulticast mode [ 522.372489][T15828] bridge_slave_1: entered promiscuous mode [ 522.391395][T15828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 522.393566][T15828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 522.413844][T15828] team0: Port device team_slave_0 added [ 522.418469][T15828] team0: Port device team_slave_1 added [ 522.441416][T15828] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 522.441433][T15828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 522.441455][T15828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 522.442875][T15828] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 522.442888][T15828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 522.442910][T15828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 522.668050][T15828] hsr_slave_0: entered promiscuous mode [ 522.669293][T15828] hsr_slave_1: entered promiscuous mode [ 522.673530][T15828] debugfs: 'hsr0' already exists in 'hsr' [ 522.673544][T15828] Cannot create hsr debugfs directory [ 522.829244][ T5738] Bluetooth: hci2: command tx timeout [ 523.106461][ T5448] 8021q: adding VLAN 0 to HW filter on device eth6 [ 523.514801][ T5606] hsr_slave_0: left promiscuous mode [ 523.517299][ T5606] hsr_slave_1: left promiscuous mode [ 523.517715][ T5606] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 523.517728][ T5606] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 523.518550][ T5606] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 523.518561][ T5606] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 523.550000][ T5606] veth1_macvtap: left promiscuous mode [ 523.550046][ T5606] veth0_macvtap: left promiscuous mode [ 523.550124][ T5606] veth1_vlan: left promiscuous mode [ 523.550174][ T5606] veth0_vlan: left promiscuous mode [ 524.914648][ T5738] Bluetooth: hci2: command tx timeout [ 525.447099][ T5606] team0 (unregistering): Port device team_slave_1 removed [ 525.627446][ T5606] team0 (unregistering): Port device team_slave_0 removed [ 526.454223][ T5606] IPVS: stop unused estimator thread 0... [ 526.560544][ T5448] 8021q: adding VLAN 0 to HW filter on device eth7 [ 526.984592][ T5738] Bluetooth: hci2: command tx timeout [ 527.385961][T15828] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 527.399159][T15828] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 527.400284][T15828] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 527.439786][T15828] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 527.440696][T15828] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 527.470705][T15828] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 527.474068][T15828] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 527.498297][T15828] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 528.524975][T15828] 8021q: adding VLAN 0 to HW filter on device bond0 [ 529.064818][ T5738] Bluetooth: hci2: command tx timeout [ 529.690170][T15828] 8021q: adding VLAN 0 to HW filter on device team0 [ 529.719528][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 529.719615][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 529.721256][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 529.721335][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 530.290448][T15828] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 530.515394][ T61] usb 9-1: new high-speed USB device number 42 using dummy_hcd [ 530.551136][T15828] veth0_vlan: entered promiscuous mode [ 530.601026][T15828] veth1_vlan: entered promiscuous mode [ 530.695299][ T61] usb 9-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 530.697230][ T61] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 530.701953][ T61] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 530.701966][ T61] usb 9-1: Product: syz [ 530.701974][ T61] usb 9-1: Manufacturer: syz [ 530.701981][ T61] usb 9-1: SerialNumber: syz [ 531.050698][ T61] ums-sddr09 9-1:1.0: USB Mass Storage device detected [ 531.084192][T15828] veth0_macvtap: entered promiscuous mode [ 531.163059][T15828] veth1_macvtap: entered promiscuous mode [ 531.277375][T15828] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 531.306333][ T61] ums-sddr09 9-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 531.306333][ T61] Please send a copy of this message to and [ 531.417944][T15828] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 531.434807][ T5606] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.434835][ T5606] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.434853][ T5606] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.434870][ T5606] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.642724][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 531.642740][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 531.666822][T10388] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 531.666842][T10388] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 533.719414][ T64] usb 9-1: USB disconnect, device number 42 [ 538.515043][ T64] usb 8-1: new high-speed USB device number 34 using dummy_hcd [ 538.685183][ T64] usb 8-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 538.686006][ T64] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 538.687576][ T64] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 538.687590][ T64] usb 8-1: Product: syz [ 538.687598][ T64] usb 8-1: Manufacturer: syz [ 538.687606][ T64] usb 8-1: SerialNumber: syz [ 538.693795][ T64] ums-sddr09 8-1:1.0: USB Mass Storage device detected [ 538.697695][ T64] ums-sddr09 8-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 538.697695][ T64] Please send a copy of this message to and [ 541.293653][ T64] usb 8-1: USB disconnect, device number 34 [ 543.330293][T16372] nvmet: disable ns before setting buffered_io value. [ 543.330794][T16372] nvmet: the ns:1 is already enabled. [ 543.332734][T16372] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 543.474108][ T1164] nvmet: Created nvm controller 31 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 543.481346][T16372] nvme nvme30: creating 4 I/O queues. [ 543.604762][T16372] nvme nvme30: new ctrl: "testsubsys" [ 544.904679][ T42] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 545.068180][ T42] usb 7-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 545.070387][ T42] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 545.070409][ T42] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 545.088839][ T42] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 545.088863][ T42] usb 7-1: Product: syz [ 545.088876][ T42] usb 7-1: Manufacturer: syz [ 545.088889][ T42] usb 7-1: SerialNumber: syz [ 545.106779][ T42] ums-sddr09 7-1:1.0: USB Mass Storage device detected [ 545.184870][ T42] ums-sddr09 7-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 545.184870][ T42] Please send a copy of this message to and [ 545.814661][ T42] ums-sddr09 7-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 546.140219][ T7318] usb 7-1: USB disconnect, device number 34 [ 546.943655][T16446] nvmet: disable ns before setting buffered_io value. [ 546.947688][T16446] nvmet: the ns:1 is already enabled. [ 546.949850][T16446] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 547.166751][T10374] nvmet: Created nvm controller 32 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 547.187676][T16446] nvme nvme31: creating 4 I/O queues. [ 547.217860][T16446] nvme nvme31: new ctrl: "testsubsys" [ 548.874585][ T907] usb 9-1: new high-speed USB device number 43 using dummy_hcd [ 549.036298][ T907] usb 9-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 549.037405][ T907] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 549.037426][ T907] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 549.040259][ T907] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 549.040280][ T907] usb 9-1: Product: syz [ 549.040292][ T907] usb 9-1: Manufacturer: syz [ 549.040305][ T907] usb 9-1: SerialNumber: syz [ 549.076137][ T907] ums-sddr09 9-1:1.0: USB Mass Storage device detected [ 549.095480][ T907] ums-sddr09 9-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 549.095480][ T907] Please send a copy of this message to and [ 549.548423][ T907] ums-sddr09 9-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 550.053578][ T7318] usb 9-1: USB disconnect, device number 43 [ 552.454611][ T5812] usb 9-1: new high-speed USB device number 44 using dummy_hcd [ 552.617020][ T5812] usb 9-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 552.657207][ T5812] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 552.657224][ T5812] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 552.682274][ T5812] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 552.682316][ T5812] usb 9-1: Product: syz [ 552.682376][ T5812] usb 9-1: Manufacturer: syz [ 552.682386][ T5812] usb 9-1: SerialNumber: syz [ 552.724442][ T5812] ums-sddr09 9-1:1.0: USB Mass Storage device detected [ 552.808565][ T5812] ums-sddr09 9-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 552.808565][ T5812] Please send a copy of this message to and [ 553.325812][ T5812] ums-sddr09 9-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 553.802599][ T61] usb 9-1: USB disconnect, device number 44 [ 554.518773][ T5738] Bluetooth: hci0: command 0x0406 tx timeout [ 555.942675][T16664] FAULT_INJECTION: forcing a failure. [ 555.942675][T16664] name fail_futex, interval 1, probability 0, space 0, times 0 [ 555.942707][T16664] CPU: 3 UID: 0 PID: 16664 Comm: syz.2.2675 Not tainted syzkaller #0 PREEMPT(full) [ 555.942732][T16664] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 555.942744][T16664] Call Trace: [ 555.942750][T16664] [ 555.942760][T16664] dump_stack_lvl+0x100/0x190 [ 555.942792][T16664] should_fail_ex.cold+0x5/0xa [ 555.942840][T16664] get_futex_key+0x1d0/0x14f0 [ 555.942876][T16664] ? __pfx_get_futex_key+0x10/0x10 [ 555.942904][T16664] ? wakeup_preempt_fair+0x5c3/0xdc0 [ 555.942936][T16664] ? tracing_record_taskinfo_sched_switch+0xac/0x560 [ 555.942966][T16664] futex_wait_setup+0x91/0x540 [ 555.943003][T16664] __futex_wait+0x19f/0x300 [ 555.943028][T16664] ? __pfx___futex_wait+0x10/0x10 [ 555.943065][T16664] ? __pfx_try_to_wake_up+0x10/0x10 [ 555.943093][T16664] ? futex_hash+0x311/0x400 [ 555.943124][T16664] ? __pfx_futex_wake_mark+0x10/0x10 [ 555.943150][T16664] ? find_held_lock+0x2b/0x80 [ 555.943173][T16664] ? futex_wake+0x4ea/0x5e0 [ 555.943201][T16664] futex_wait+0xe6/0x370 [ 555.943223][T16664] ? __pfx_futex_wait+0x10/0x10 [ 555.943250][T16664] ? up_write+0x2dc/0x5b0 [ 555.943282][T16664] do_futex+0x265/0x440 [ 555.943301][T16664] ? __pfx_do_futex+0x10/0x10 [ 555.943326][T16664] __ia32_sys_futex_time32+0x2f4/0x470 [ 555.943366][T16664] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 555.943393][T16664] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 555.943425][T16664] __do_fast_syscall_32+0x13a/0x8b0 [ 555.943459][T16664] do_fast_syscall_32+0x32/0x70 [ 555.943488][T16664] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 555.943511][T16664] RIP: 0023:0xf706efec [ 555.943533][T16664] Code: Unable to access opcode bytes at 0xf706efc2. [ 555.943542][T16664] RSP: 002b:00000000f545d5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 555.943561][T16664] RAX: ffffffffffffffda RBX: 00000000f7464f88 RCX: 0000000000000080 [ 555.943575][T16664] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7464f8c [ 555.943588][T16664] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 555.943601][T16664] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 555.943613][T16664] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 555.943639][T16664] [ 556.364735][ T5812] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 556.515412][ T5812] usb 7-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 556.516505][ T5812] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 556.516527][ T5812] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 556.518708][ T5812] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 556.518728][ T5812] usb 7-1: Product: syz [ 556.518740][ T5812] usb 7-1: Manufacturer: syz [ 556.518752][ T5812] usb 7-1: SerialNumber: syz [ 556.530547][ T5812] ums-sddr09 7-1:1.0: USB Mass Storage device detected [ 556.535277][ T5812] ums-sddr09 7-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 556.535277][ T5812] Please send a copy of this message to and [ 557.041933][ T5812] ums-sddr09 7-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 557.519027][ T7318] usb 7-1: USB disconnect, device number 35 [ 559.942568][T16761] FAULT_INJECTION: forcing a failure. [ 559.942568][T16761] name fail_futex, interval 1, probability 0, space 0, times 0 [ 559.942604][T16761] CPU: 2 UID: 0 PID: 16761 Comm: syz.3.2684 Not tainted syzkaller #0 PREEMPT(full) [ 559.942628][T16761] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 559.942641][T16761] Call Trace: [ 559.942650][T16761] [ 559.942661][T16761] dump_stack_lvl+0x100/0x190 [ 559.942690][T16761] should_fail_ex.cold+0x5/0xa [ 559.942715][T16761] get_futex_key+0x1d0/0x14f0 [ 559.942747][T16761] ? __pfx_get_futex_key+0x10/0x10 [ 559.942776][T16761] ? wakeup_preempt_fair+0x5c3/0xdc0 [ 559.942835][T16761] ? tracing_record_taskinfo_sched_switch+0xac/0x560 [ 559.942871][T16761] futex_wait_setup+0x91/0x540 [ 559.942902][T16761] __futex_wait+0x19f/0x300 [ 559.942929][T16761] ? __pfx___futex_wait+0x10/0x10 [ 559.942951][T16761] ? __pfx_try_to_wake_up+0x10/0x10 [ 559.942980][T16761] ? futex_hash+0x311/0x400 [ 559.943010][T16761] ? __pfx_futex_wake_mark+0x10/0x10 [ 559.943036][T16761] ? find_held_lock+0x2b/0x80 [ 559.943056][T16761] ? futex_wake+0x4ea/0x5e0 [ 559.943084][T16761] futex_wait+0xe6/0x370 [ 559.943106][T16761] ? __pfx_futex_wait+0x10/0x10 [ 559.943135][T16761] ? up_write+0x2dc/0x5b0 [ 559.943168][T16761] do_futex+0x265/0x440 [ 559.943187][T16761] ? __pfx_do_futex+0x10/0x10 [ 559.943211][T16761] __ia32_sys_futex_time32+0x2f4/0x470 [ 559.943234][T16761] ? xfd_validate_state+0x129/0x190 [ 559.943277][T16761] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 559.943311][T16761] __do_fast_syscall_32+0x13a/0x8b0 [ 559.943345][T16761] do_fast_syscall_32+0x32/0x70 [ 559.943395][T16761] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 559.943421][T16761] RIP: 0023:0xf707efec [ 559.943443][T16761] Code: Unable to access opcode bytes at 0xf707efc2. [ 559.943451][T16761] RSP: 002b:00000000f546d5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 559.943470][T16761] RAX: ffffffffffffffda RBX: 00000000f7474f88 RCX: 0000000000000080 [ 559.943483][T16761] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7474f8c [ 559.943495][T16761] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 559.943508][T16761] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 559.943521][T16761] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 559.943547][T16761] [ 560.414561][ T42] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 560.565737][ T42] usb 7-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 560.566919][ T42] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 560.566941][ T42] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 560.576908][ T42] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.576973][ T42] usb 7-1: Product: syz [ 560.576988][ T42] usb 7-1: Manufacturer: syz [ 560.577000][ T42] usb 7-1: SerialNumber: syz [ 560.590923][ T42] ums-sddr09 7-1:1.0: USB Mass Storage device detected [ 560.607006][ T42] ums-sddr09 7-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 560.607006][ T42] Please send a copy of this message to and [ 561.050382][ T42] ums-sddr09 7-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 561.582364][ T42] usb 7-1: USB disconnect, device number 36 [ 562.704944][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.705051][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 564.879836][T16849] FAULT_INJECTION: forcing a failure. [ 564.879836][T16849] name fail_futex, interval 1, probability 0, space 0, times 0 [ 564.879868][T16849] CPU: 0 UID: 0 PID: 16849 Comm: syz.3.2695 Not tainted syzkaller #0 PREEMPT(full) [ 564.879892][T16849] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 564.879905][T16849] Call Trace: [ 564.879913][T16849] [ 564.879922][T16849] dump_stack_lvl+0x100/0x190 [ 564.879953][T16849] should_fail_ex.cold+0x5/0xa [ 564.879978][T16849] get_futex_key+0x1d0/0x14f0 [ 564.880011][T16849] ? __pfx_get_futex_key+0x10/0x10 [ 564.880036][T16849] ? trace_ipi_send_cpu.constprop.0+0x73/0x220 [ 564.880065][T16849] ? __smp_call_single_queue+0x17e/0x450 [ 564.880093][T16849] ? __pfx___smp_call_single_queue+0x10/0x10 [ 564.880123][T16849] futex_wait_setup+0x91/0x540 [ 564.880152][T16849] __futex_wait+0x19f/0x300 [ 564.880177][T16849] ? __pfx___futex_wait+0x10/0x10 [ 564.880197][T16849] ? __pfx_try_to_wake_up+0x10/0x10 [ 564.880224][T16849] ? futex_hash+0x311/0x400 [ 564.880254][T16849] ? __pfx_futex_wake_mark+0x10/0x10 [ 564.880280][T16849] ? find_held_lock+0x2b/0x80 [ 564.880300][T16849] ? futex_wake+0x4ea/0x5e0 [ 564.880328][T16849] futex_wait+0xe6/0x370 [ 564.880351][T16849] ? __pfx_futex_wait+0x10/0x10 [ 564.880379][T16849] ? up_write+0x2dc/0x5b0 [ 564.880413][T16849] do_futex+0x265/0x440 [ 564.880450][T16849] ? __pfx_do_futex+0x10/0x10 [ 564.880475][T16849] __ia32_sys_futex_time32+0x2f4/0x470 [ 564.880500][T16849] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 564.880529][T16849] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 564.880559][T16849] __do_fast_syscall_32+0x13a/0x8b0 [ 564.880594][T16849] do_fast_syscall_32+0x32/0x70 [ 564.880626][T16849] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 564.880650][T16849] RIP: 0023:0xf707efec [ 564.880670][T16849] Code: Unable to access opcode bytes at 0xf707efc2. [ 564.880679][T16849] RSP: 002b:00000000f546d5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 564.880697][T16849] RAX: ffffffffffffffda RBX: 00000000f7474f88 RCX: 0000000000000080 [ 564.880709][T16849] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7474f8c [ 564.880720][T16849] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 564.880731][T16849] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 564.880743][T16849] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 564.880767][T16849] [ 565.224677][T16107] usb 9-1: new high-speed USB device number 45 using dummy_hcd [ 565.374551][T16107] usb 9-1: Using ep0 maxpacket: 32 [ 565.378339][T16107] usb 9-1: unable to get BOS descriptor or descriptor too short [ 565.403070][T16107] usb 9-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 565.437767][T16107] usb 9-1: config 14 has an invalid interface number: 57 but max is 1 [ 565.437832][T16107] usb 9-1: config 14 has an invalid interface number: 228 but max is 1 [ 565.437893][T16107] usb 9-1: config 14 has no interface number 0 [ 565.437948][T16107] usb 9-1: config 14 has no interface number 1 [ 565.438003][T16107] usb 9-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 565.438019][T16107] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 565.438076][T16107] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 565.438136][T16107] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 565.438156][T16107] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 565.438214][T16107] usb 9-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 565.438270][T16107] usb 9-1: config 14 interface 57 has no altsetting 0 [ 565.438359][T16107] usb 9-1: config 14 interface 228 has no altsetting 0 [ 565.468196][T16107] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.468262][T16107] usb 9-1: Product: syz [ 565.468319][T16107] usb 9-1: Manufacturer: syz [ 565.468378][T16107] usb 9-1: SerialNumber: syz [ 565.996142][T16107] legousbtower 9-1:14.57: interrupt endpoints not found [ 566.341572][T16891] nvmet: disable ns before setting buffered_io value. [ 566.341986][T16891] nvmet: the ns:1 is already enabled. [ 566.343168][T16891] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 566.364059][T10451] nvmet: Created nvm controller 33 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 566.374508][T16891] nvme nvme32: creating 4 I/O queues. [ 566.389850][T16891] nvme nvme32: new ctrl: "testsubsys" [ 566.465615][T16107] legousbtower 9-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 566.534863][T16107] legousbtower 9-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 567.020324][T16922] IPVS: length: 8 != 383101893624 [ 567.021126][T16922] JFS: charset not found [ 567.213022][ T907] usb 9-1: USB disconnect, device number 45 [ 567.231755][ T907] legousbtower 9-1:14.228: LEGO USB Tower #-160 now disconnected [ 567.847203][T16936] FAULT_INJECTION: forcing a failure. [ 567.847203][T16936] name fail_futex, interval 1, probability 0, space 0, times 0 [ 567.847237][T16936] CPU: 3 UID: 0 PID: 16936 Comm: syz.4.2706 Not tainted syzkaller #0 PREEMPT(full) [ 567.847260][T16936] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 567.847274][T16936] Call Trace: [ 567.847282][T16936] [ 567.847293][T16936] dump_stack_lvl+0x100/0x190 [ 567.847324][T16936] should_fail_ex.cold+0x5/0xa [ 567.847351][T16936] get_futex_key+0x1d0/0x14f0 [ 567.847383][T16936] ? __pfx_get_futex_key+0x10/0x10 [ 567.847420][T16936] futex_wait_setup+0x91/0x540 [ 567.847448][T16936] __futex_wait+0x19f/0x300 [ 567.847472][T16936] ? __pfx___futex_wait+0x10/0x10 [ 567.847492][T16936] ? __pfx_try_to_wake_up+0x10/0x10 [ 567.847519][T16936] ? futex_hash+0x311/0x400 [ 567.847547][T16936] ? __pfx_futex_wake_mark+0x10/0x10 [ 567.847573][T16936] ? find_held_lock+0x2b/0x80 [ 567.847594][T16936] ? futex_wake+0x4ea/0x5e0 [ 567.847637][T16936] futex_wait+0xe6/0x370 [ 567.847662][T16936] ? __pfx_futex_wait+0x10/0x10 [ 567.847690][T16936] ? up_write+0x2dc/0x5b0 [ 567.847722][T16936] do_futex+0x265/0x440 [ 567.847742][T16936] ? __pfx_do_futex+0x10/0x10 [ 567.847767][T16936] __ia32_sys_futex_time32+0x2f4/0x470 [ 567.847794][T16936] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 567.847816][T16936] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 567.847847][T16936] __do_fast_syscall_32+0x13a/0x8b0 [ 567.847878][T16936] do_fast_syscall_32+0x32/0x70 [ 567.847907][T16936] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 567.847931][T16936] RIP: 0023:0xf7f88fec [ 567.847957][T16936] Code: Unable to access opcode bytes at 0xf7f88fc2. [ 567.847969][T16936] RSP: 002b:00000000f54465bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 567.847989][T16936] RAX: ffffffffffffffda RBX: 00000000f7444f88 RCX: 0000000000000080 [ 567.848003][T16936] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7444f8c [ 567.848016][T16936] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 567.848029][T16936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 567.848042][T16936] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 567.848065][T16936] [ 569.407873][T16972] nvmet: disable ns before setting buffered_io value. [ 569.408364][T16972] nvmet: the ns:1 is already enabled. [ 569.417804][T16972] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 570.283901][ T1178] nvmet: Created nvm controller 34 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 570.300231][T16972] nvme nvme33: creating 4 I/O queues. [ 570.393152][T16972] nvme nvme33: new ctrl: "testsubsys" [ 571.104551][ T7318] usb 8-1: new high-speed USB device number 35 using dummy_hcd [ 571.324544][ T7318] usb 8-1: Using ep0 maxpacket: 32 [ 571.402898][ T7318] usb 8-1: unable to get BOS descriptor or descriptor too short [ 571.402982][ T7318] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 571.424856][ T7318] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 571.424883][ T7318] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 571.424899][ T7318] usb 8-1: config 14 has no interface number 0 [ 571.424912][ T7318] usb 8-1: config 14 has no interface number 1 [ 571.424958][ T7318] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 571.424977][ T7318] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 571.425044][ T7318] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 571.425068][ T7318] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 571.425091][ T7318] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 571.425113][ T7318] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 571.425134][ T7318] usb 8-1: config 14 interface 57 has no altsetting 0 [ 571.425149][ T7318] usb 8-1: config 14 interface 228 has no altsetting 0 [ 571.563489][ T7318] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 571.563514][ T7318] usb 8-1: Product: syz [ 571.563522][ T7318] usb 8-1: Manufacturer: syz [ 571.563530][ T7318] usb 8-1: SerialNumber: syz [ 571.977063][ T9] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 572.145321][ T9] usb 6-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 572.146485][ T9] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 572.146506][ T9] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 572.148679][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 572.148700][ T9] usb 6-1: Product: syz [ 572.148712][ T9] usb 6-1: Manufacturer: syz [ 572.148726][ T9] usb 6-1: SerialNumber: syz [ 572.231090][ T9] ums-sddr09 6-1:1.0: USB Mass Storage device detected [ 572.281380][ T9] ums-sddr09 6-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 572.281380][ T9] Please send a copy of this message to and [ 572.398591][T17027] FAULT_INJECTION: forcing a failure. [ 572.398591][T17027] name fail_futex, interval 1, probability 0, space 0, times 0 [ 572.398629][T17027] CPU: 2 UID: 0 PID: 17027 Comm: syz.4.2717 Not tainted syzkaller #0 PREEMPT(full) [ 572.398666][T17027] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 572.398679][T17027] Call Trace: [ 572.398686][T17027] [ 572.398695][T17027] dump_stack_lvl+0x100/0x190 [ 572.398725][T17027] should_fail_ex.cold+0x5/0xa [ 572.398772][T17027] get_futex_key+0x1d0/0x14f0 [ 572.398802][T17027] ? __pfx_get_futex_key+0x10/0x10 [ 572.398826][T17027] ? trace_ipi_send_cpu.constprop.0+0x73/0x220 [ 572.398851][T17027] ? __smp_call_single_queue+0x17e/0x450 [ 572.398876][T17027] ? __pfx___smp_call_single_queue+0x10/0x10 [ 572.398903][T17027] futex_wait_setup+0x91/0x540 [ 572.398930][T17027] __futex_wait+0x19f/0x300 [ 572.398952][T17027] ? __pfx___futex_wait+0x10/0x10 [ 572.398971][T17027] ? __pfx_try_to_wake_up+0x10/0x10 [ 572.398995][T17027] ? futex_hash+0x311/0x400 [ 572.399023][T17027] ? __pfx_futex_wake_mark+0x10/0x10 [ 572.399047][T17027] ? find_held_lock+0x2b/0x80 [ 572.399067][T17027] ? futex_wake+0x4ea/0x5e0 [ 572.399092][T17027] futex_wait+0xe6/0x370 [ 572.399112][T17027] ? __pfx_futex_wait+0x10/0x10 [ 572.399137][T17027] ? up_write+0x2dc/0x5b0 [ 572.399166][T17027] do_futex+0x265/0x440 [ 572.399183][T17027] ? __pfx_do_futex+0x10/0x10 [ 572.399206][T17027] __ia32_sys_futex_time32+0x2f4/0x470 [ 572.399228][T17027] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 572.399246][T17027] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 572.399273][T17027] __do_fast_syscall_32+0x13a/0x8b0 [ 572.399301][T17027] do_fast_syscall_32+0x32/0x70 [ 572.399326][T17027] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 572.399347][T17027] RIP: 0023:0xf7f88fec [ 572.399366][T17027] Code: Unable to access opcode bytes at 0xf7f88fc2. [ 572.399375][T17027] RSP: 002b:00000000f54465bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 572.399393][T17027] RAX: ffffffffffffffda RBX: 00000000f7444f88 RCX: 0000000000000080 [ 572.399404][T17027] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7444f8c [ 572.399414][T17027] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 572.399424][T17027] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 572.399434][T17027] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 572.399454][T17027] [ 572.744137][ T7318] legousbtower 8-1:14.57: interrupt endpoints not found [ 572.850843][ T9] ums-sddr09 6-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 573.143675][ T7318] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 573.224111][ T7318] legousbtower 8-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 573.226268][ T907] usb 6-1: USB disconnect, device number 41 [ 573.735480][T17056] IPVS: length: 8 != 383101893624 [ 573.736104][T17056] JFS: charset not found [ 573.783195][T17060] nvmet: disable ns before setting buffered_io value. [ 573.783460][T17060] nvmet: the ns:1 is already enabled. [ 573.784089][T17060] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 573.808030][T10382] nvmet: Created nvm controller 35 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 573.809182][T17060] nvme nvme34: creating 4 I/O queues. [ 573.816341][T17060] nvme nvme34: new ctrl: "testsubsys" [ 574.034349][ T5812] usb 8-1: USB disconnect, device number 35 [ 574.091881][ T5812] legousbtower 8-1:14.228: LEGO USB Tower #-160 now disconnected [ 575.052214][T17108] FAULT_INJECTION: forcing a failure. [ 575.052214][T17108] name fail_futex, interval 1, probability 0, space 0, times 0 [ 575.052236][T17108] CPU: 2 UID: 0 PID: 17108 Comm: syz.2.2727 Not tainted syzkaller #0 PREEMPT(full) [ 575.052250][T17108] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 575.052258][T17108] Call Trace: [ 575.052270][T17108] [ 575.052275][T17108] dump_stack_lvl+0x100/0x190 [ 575.052296][T17108] should_fail_ex.cold+0x5/0xa [ 575.052312][T17108] get_futex_key+0x1d0/0x14f0 [ 575.052333][T17108] ? __pfx_get_futex_key+0x10/0x10 [ 575.052356][T17108] futex_wait_setup+0x91/0x540 [ 575.052374][T17108] __futex_wait+0x19f/0x300 [ 575.052390][T17108] ? __pfx___futex_wait+0x10/0x10 [ 575.052404][T17108] ? __pfx_try_to_wake_up+0x10/0x10 [ 575.052419][T17108] ? futex_hash+0x311/0x400 [ 575.052436][T17108] ? __pfx_futex_wake_mark+0x10/0x10 [ 575.052451][T17108] ? find_held_lock+0x2b/0x80 [ 575.052462][T17108] ? futex_wake+0x4ea/0x5e0 [ 575.052479][T17108] futex_wait+0xe6/0x370 [ 575.052492][T17108] ? __pfx_futex_wait+0x10/0x10 [ 575.052508][T17108] ? up_write+0x2dc/0x5b0 [ 575.052527][T17108] do_futex+0x265/0x440 [ 575.052538][T17108] ? __pfx_do_futex+0x10/0x10 [ 575.052552][T17108] __ia32_sys_futex_time32+0x2f4/0x470 [ 575.052566][T17108] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 575.052578][T17108] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 575.052595][T17108] __do_fast_syscall_32+0x13a/0x8b0 [ 575.052614][T17108] do_fast_syscall_32+0x32/0x70 [ 575.052631][T17108] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 575.052645][T17108] RIP: 0023:0xf706efec [ 575.052657][T17108] Code: Unable to access opcode bytes at 0xf706efc2. [ 575.052663][T17108] RSP: 002b:00000000f545d5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 575.052675][T17108] RAX: ffffffffffffffda RBX: 00000000f7464f88 RCX: 0000000000000080 [ 575.052682][T17108] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7464f8c [ 575.052689][T17108] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 575.052695][T17108] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 575.052701][T17108] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 575.052715][T17108] [ 575.485922][ T7318] usb 9-1: new high-speed USB device number 46 using dummy_hcd [ 575.636110][ T7318] usb 9-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 575.649424][ T7318] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 575.649474][ T7318] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 575.675568][ T7318] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 575.675905][ T7318] usb 9-1: Product: syz [ 575.676071][ T7318] usb 9-1: Manufacturer: syz [ 575.676588][ T7318] usb 9-1: SerialNumber: syz [ 575.757366][ T7318] ums-sddr09 9-1:1.0: USB Mass Storage device detected [ 576.095965][ T7318] ums-sddr09 9-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 576.095965][ T7318] Please send a copy of this message to and [ 576.589928][ T7318] ums-sddr09 9-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 576.676413][T17138] nvmet: disable ns before setting buffered_io value. [ 576.676709][T17138] nvmet: the ns:1 is already enabled. [ 576.677345][T17138] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 576.753511][T10441] nvmet: Created nvm controller 36 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 576.761689][T17138] nvme nvme35: creating 4 I/O queues. [ 576.783152][T17138] nvme nvme35: new ctrl: "testsubsys" [ 576.961655][ T907] usb 9-1: USB disconnect, device number 46 [ 577.444709][ T7318] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 577.627472][ T7318] usb 7-1: Using ep0 maxpacket: 32 [ 577.630029][ T7318] usb 7-1: unable to get BOS descriptor or descriptor too short [ 577.630055][ T7318] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 577.630861][ T7318] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 577.630874][ T7318] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 577.630884][ T7318] usb 7-1: config 14 has no interface number 0 [ 577.630893][ T7318] usb 7-1: config 14 has no interface number 1 [ 577.630919][ T7318] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 577.630930][ T7318] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 577.630943][ T7318] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 577.630956][ T7318] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 577.630969][ T7318] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 577.630982][ T7318] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 577.630995][ T7318] usb 7-1: config 14 interface 57 has no altsetting 0 [ 577.631005][ T7318] usb 7-1: config 14 interface 228 has no altsetting 0 [ 577.649491][ T7318] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.649513][ T7318] usb 7-1: Product: syz [ 577.649524][ T7318] usb 7-1: Manufacturer: syz [ 577.649536][ T7318] usb 7-1: SerialNumber: syz [ 578.085218][ T7318] legousbtower 7-1:14.57: interrupt endpoints not found [ 578.487716][ T7318] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 578.491056][ T7318] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 578.824841][T17179] FAULT_INJECTION: forcing a failure. [ 578.824841][T17179] name fail_futex, interval 1, probability 0, space 0, times 0 [ 578.824877][T17179] CPU: 2 UID: 0 PID: 17179 Comm: syz.3.2737 Not tainted syzkaller #0 PREEMPT(full) [ 578.824900][T17179] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 578.824913][T17179] Call Trace: [ 578.824920][T17179] [ 578.824929][T17179] dump_stack_lvl+0x100/0x190 [ 578.824960][T17179] should_fail_ex.cold+0x5/0xa [ 578.824987][T17179] get_futex_key+0x1d0/0x14f0 [ 578.825021][T17179] ? __pfx_get_futex_key+0x10/0x10 [ 578.825049][T17179] ? __pfx___resched_curr+0x10/0x10 [ 578.825077][T17179] ? wakeup_preempt_fair+0x4a0/0xdc0 [ 578.825107][T17179] ? tracing_record_taskinfo_sched_switch+0xac/0x560 [ 578.825140][T17179] futex_wait_setup+0x91/0x540 [ 578.825170][T17179] __futex_wait+0x19f/0x300 [ 578.825195][T17179] ? __pfx___futex_wait+0x10/0x10 [ 578.825215][T17179] ? __pfx_try_to_wake_up+0x10/0x10 [ 578.825241][T17179] ? futex_hash+0x311/0x400 [ 578.825277][T17179] ? __pfx_futex_wake_mark+0x10/0x10 [ 578.825302][T17179] ? find_held_lock+0x2b/0x80 [ 578.825321][T17179] ? futex_wake+0x4ea/0x5e0 [ 578.825348][T17179] futex_wait+0xe6/0x370 [ 578.825371][T17179] ? __pfx_futex_wait+0x10/0x10 [ 578.825398][T17179] ? up_write+0x2dc/0x5b0 [ 578.825433][T17179] do_futex+0x265/0x440 [ 578.825452][T17179] ? __pfx_do_futex+0x10/0x10 [ 578.825477][T17179] __ia32_sys_futex_time32+0x2f4/0x470 [ 578.825519][T17179] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 578.825541][T17179] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 578.825571][T17179] __do_fast_syscall_32+0x13a/0x8b0 [ 578.825604][T17179] do_fast_syscall_32+0x32/0x70 [ 578.825633][T17179] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 578.825656][T17179] RIP: 0023:0xf707efec [ 578.825676][T17179] Code: Unable to access opcode bytes at 0xf707efc2. [ 578.825685][T17179] RSP: 002b:00000000f546d5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 578.825702][T17179] RAX: ffffffffffffffda RBX: 00000000f7474f88 RCX: 0000000000000080 [ 578.825716][T17179] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7474f8c [ 578.825729][T17179] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 578.825741][T17179] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 578.825752][T17179] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 578.825777][T17179] [ 579.056498][T17186] IPVS: length: 8 != 383101893624 [ 579.056913][T17186] JFS: charset not found [ 579.255525][ T7318] usb 7-1: USB disconnect, device number 37 [ 579.312538][ T7318] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 580.034520][ T7318] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 580.093541][T17216] nvmet: disable ns before setting buffered_io value. [ 580.094061][T17216] nvmet: the ns:1 is already enabled. [ 580.114651][T17216] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 580.153637][T10378] nvmet: Created nvm controller 37 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 580.154970][T17216] nvme nvme36: creating 4 I/O queues. [ 580.165793][T17216] nvme nvme36: new ctrl: "testsubsys" [ 580.205107][ T7318] usb 6-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 580.206042][ T7318] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 580.206056][ T7318] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 580.207757][ T7318] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 580.207769][ T7318] usb 6-1: Product: syz [ 580.207777][ T7318] usb 6-1: Manufacturer: syz [ 580.207784][ T7318] usb 6-1: SerialNumber: syz [ 580.211654][ T7318] ums-sddr09 6-1:1.0: USB Mass Storage device detected [ 580.233786][ T7318] ums-sddr09 6-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 580.233786][ T7318] Please send a copy of this message to and [ 580.705032][ T7318] ums-sddr09 6-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 581.128168][ T907] usb 6-1: USB disconnect, device number 42 [ 583.210022][T17277] nvmet: disable ns before setting buffered_io value. [ 583.210419][T17277] nvmet: the ns:1 is already enabled. [ 583.211476][T17277] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 583.257252][T10459] nvmet: Created nvm controller 38 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 583.279548][T17277] nvme nvme37: creating 4 I/O queues. [ 583.356292][T17277] nvme nvme37: new ctrl: "testsubsys" [ 583.614542][ T1538] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 583.764923][ T1538] usb 7-1: Using ep0 maxpacket: 32 [ 583.767651][ T1538] usb 7-1: unable to get BOS descriptor or descriptor too short [ 583.767698][ T1538] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 583.768834][ T1538] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 583.768855][ T1538] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 583.768871][ T1538] usb 7-1: config 14 has no interface number 0 [ 583.768886][ T1538] usb 7-1: config 14 has no interface number 1 [ 583.768932][ T1538] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 583.768960][ T1538] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 583.768983][ T1538] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 583.769006][ T1538] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 583.769030][ T1538] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 583.769053][ T1538] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 583.769076][ T1538] usb 7-1: config 14 interface 57 has no altsetting 0 [ 583.769090][ T1538] usb 7-1: config 14 interface 228 has no altsetting 0 [ 583.771307][ T1538] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 583.771326][ T1538] usb 7-1: Product: syz [ 583.771338][ T1538] usb 7-1: Manufacturer: syz [ 583.771351][ T1538] usb 7-1: SerialNumber: syz [ 583.920341][T17292] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2752'. [ 584.380568][ T1538] legousbtower 7-1:14.57: interrupt endpoints not found [ 585.316417][ T1538] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 585.486101][ T1538] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 585.522321][T17286] IPVS: length: 8 != 383101893624 [ 585.522803][T17286] JFS: charset not found [ 586.559701][ T5884] usb 7-1: USB disconnect, device number 38 [ 586.564349][ T5884] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 587.967263][T17369] FAULT_INJECTION: forcing a failure. [ 587.967263][T17369] name fail_futex, interval 1, probability 0, space 0, times 0 [ 587.967301][T17369] CPU: 3 UID: 0 PID: 17369 Comm: syz.4.2765 Not tainted syzkaller #0 PREEMPT(full) [ 587.967326][T17369] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 587.967340][T17369] Call Trace: [ 587.967349][T17369] [ 587.967358][T17369] dump_stack_lvl+0x100/0x190 [ 587.967391][T17369] should_fail_ex.cold+0x5/0xa [ 587.967420][T17369] get_futex_key+0x1d0/0x14f0 [ 587.967452][T17369] ? __pfx_get_futex_key+0x10/0x10 [ 587.967491][T17369] futex_wait_setup+0x91/0x540 [ 587.967523][T17369] __futex_wait+0x19f/0x300 [ 587.967548][T17369] ? __pfx___futex_wait+0x10/0x10 [ 587.967570][T17369] ? __pfx_try_to_wake_up+0x10/0x10 [ 587.967597][T17369] ? futex_hash+0x311/0x400 [ 587.967627][T17369] ? __pfx_futex_wake_mark+0x10/0x10 [ 587.967654][T17369] ? find_held_lock+0x2b/0x80 [ 587.967674][T17369] ? futex_wake+0x4ea/0x5e0 [ 587.967703][T17369] futex_wait+0xe6/0x370 [ 587.967744][T17369] ? __pfx_futex_wait+0x10/0x10 [ 587.967774][T17369] ? up_write+0x2dc/0x5b0 [ 587.967807][T17369] do_futex+0x265/0x440 [ 587.967828][T17369] ? __pfx_do_futex+0x10/0x10 [ 587.967855][T17369] __ia32_sys_futex_time32+0x2f4/0x470 [ 587.967881][T17369] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 587.967905][T17369] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 587.967936][T17369] __do_fast_syscall_32+0x13a/0x8b0 [ 587.967970][T17369] do_fast_syscall_32+0x32/0x70 [ 587.967999][T17369] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 587.968022][T17369] RIP: 0023:0xf7f88fec [ 587.968040][T17369] Code: Unable to access opcode bytes at 0xf7f88fc2. [ 587.968049][T17369] RSP: 002b:00000000f54465bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 587.968070][T17369] RAX: ffffffffffffffda RBX: 00000000f7444f88 RCX: 0000000000000080 [ 587.968082][T17369] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7444f8c [ 587.968099][T17369] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 587.968111][T17369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 587.968126][T17369] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 587.968151][T17369] [ 589.694710][ T61] usb 8-1: new high-speed USB device number 36 using dummy_hcd [ 589.900122][ T61] usb 8-1: Using ep0 maxpacket: 32 [ 589.940202][ T61] usb 8-1: unable to get BOS descriptor or descriptor too short [ 589.940452][ T61] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 589.958177][ T61] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 589.958286][ T61] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 589.958326][ T61] usb 8-1: config 14 has no interface number 0 [ 589.958336][ T61] usb 8-1: config 14 has no interface number 1 [ 589.958526][ T61] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 589.958563][ T61] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 589.958606][ T61] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 589.958668][ T61] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 589.958683][ T61] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 589.958696][ T61] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 589.958738][ T61] usb 8-1: config 14 interface 57 has no altsetting 0 [ 589.958749][ T61] usb 8-1: config 14 interface 228 has no altsetting 0 [ 590.031848][ T61] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 590.032368][ T61] usb 8-1: Product: syz [ 590.032378][ T61] usb 8-1: Manufacturer: syz [ 590.033365][ T61] usb 8-1: SerialNumber: syz [ 590.831302][ T61] legousbtower 8-1:14.57: interrupt endpoints not found [ 591.242549][ T61] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 591.252509][ T61] legousbtower 8-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 591.891494][T17443] IPVS: length: 8 != 383101893624 [ 591.896623][T17443] JFS: charset not found [ 593.408394][ T61] usb 8-1: USB disconnect, device number 36 [ 593.469867][ T61] legousbtower 8-1:14.228: LEGO USB Tower #-160 now disconnected [ 593.684688][T17464] FAULT_INJECTION: forcing a failure. [ 593.684688][T17464] name fail_futex, interval 1, probability 0, space 0, times 0 [ 593.684723][T17464] CPU: 3 UID: 0 PID: 17464 Comm: syz.3.2775 Not tainted syzkaller #0 PREEMPT(full) [ 593.684748][T17464] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 593.684761][T17464] Call Trace: [ 593.684768][T17464] [ 593.684776][T17464] dump_stack_lvl+0x100/0x190 [ 593.684808][T17464] should_fail_ex.cold+0x5/0xa [ 593.684840][T17464] ? find_held_lock+0x2b/0x80 [ 593.684867][T17464] get_futex_key+0x1d0/0x14f0 [ 593.684896][T17464] ? __pfx_get_futex_key+0x10/0x10 [ 593.684925][T17464] ? __up_read+0x333/0x980 [ 593.684973][T17464] ? __pfx___up_read+0x10/0x10 [ 593.685004][T17464] ? __mm_populate+0x33a/0x3a0 [ 593.685033][T17464] futex_wake+0xf4/0x5e0 [ 593.685056][T17464] ? __pfx_futex_wake+0x10/0x10 [ 593.685084][T17464] ? up_write+0x2dc/0x5b0 [ 593.685132][T17464] do_futex+0x2b2/0x440 [ 593.685152][T17464] ? __pfx_do_futex+0x10/0x10 [ 593.685178][T17464] __ia32_sys_futex_time32+0x2f4/0x470 [ 593.685200][T17464] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 593.685224][T17464] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 593.685255][T17464] __do_fast_syscall_32+0x13a/0x8b0 [ 593.685286][T17464] do_fast_syscall_32+0x32/0x70 [ 593.685317][T17464] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 593.685342][T17464] RIP: 0023:0xf707efec [ 593.685363][T17464] Code: Unable to access opcode bytes at 0xf707efc2. [ 593.685370][T17464] RSP: 002b:00000000f546d5cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 593.685391][T17464] RAX: ffffffffffffffda RBX: 00000000f7474f8c RCX: 0000000000000081 [ 593.685404][T17464] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 593.685414][T17464] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 593.685426][T17464] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 593.685441][T17464] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 593.685466][T17464] [ 594.044534][ T7318] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 594.195422][ T7318] usb 7-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 594.196611][ T7318] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 594.196633][ T7318] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 594.198758][ T7318] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 594.198777][ T7318] usb 7-1: Product: syz [ 594.198790][ T7318] usb 7-1: Manufacturer: syz [ 594.198802][ T7318] usb 7-1: SerialNumber: syz [ 594.210295][ T7318] ums-sddr09 7-1:1.0: USB Mass Storage device detected [ 594.221011][ T7318] ums-sddr09 7-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 594.221011][ T7318] Please send a copy of this message to and [ 594.670002][ T7318] ums-sddr09 7-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 595.224069][ T64] usb 7-1: USB disconnect, device number 39 [ 595.757207][ T64] usb 8-1: new high-speed USB device number 37 using dummy_hcd [ 595.929683][ T64] usb 8-1: Using ep0 maxpacket: 32 [ 595.944789][ T64] usb 8-1: unable to get BOS descriptor or descriptor too short [ 595.944835][ T64] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 595.947805][ T64] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 595.947827][ T64] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 595.947842][ T64] usb 8-1: config 14 has no interface number 0 [ 595.947856][ T64] usb 8-1: config 14 has no interface number 1 [ 595.947899][ T64] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 595.947918][ T64] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 595.947938][ T64] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 595.947959][ T64] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 595.947981][ T64] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 595.948003][ T64] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 595.948024][ T64] usb 8-1: config 14 interface 57 has no altsetting 0 [ 595.948039][ T64] usb 8-1: config 14 interface 228 has no altsetting 0 [ 595.950024][ T64] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 595.950043][ T64] usb 8-1: Product: syz [ 595.950055][ T64] usb 8-1: Manufacturer: syz [ 595.950067][ T64] usb 8-1: SerialNumber: syz [ 596.367352][ T64] legousbtower 8-1:14.57: interrupt endpoints not found [ 596.732903][T17554] FAULT_INJECTION: forcing a failure. [ 596.732903][T17554] name fail_futex, interval 1, probability 0, space 0, times 0 [ 596.732935][T17554] CPU: 3 UID: 0 PID: 17554 Comm: syz.2.2786 Not tainted syzkaller #0 PREEMPT(full) [ 596.732956][T17554] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 596.732967][T17554] Call Trace: [ 596.732975][T17554] [ 596.732983][T17554] dump_stack_lvl+0x100/0x190 [ 596.733015][T17554] should_fail_ex.cold+0x5/0xa [ 596.733039][T17554] get_futex_key+0x1d0/0x14f0 [ 596.733067][T17554] ? __pfx_get_futex_key+0x10/0x10 [ 596.733109][T17554] ? trace_ipi_send_cpu.constprop.0+0x73/0x220 [ 596.733135][T17554] ? __smp_call_single_queue+0x17e/0x450 [ 596.733167][T17554] ? __pfx___smp_call_single_queue+0x10/0x10 [ 596.733197][T17554] futex_wait_setup+0x91/0x540 [ 596.733225][T17554] __futex_wait+0x19f/0x300 [ 596.733249][T17554] ? __pfx___futex_wait+0x10/0x10 [ 596.733270][T17554] ? __pfx_try_to_wake_up+0x10/0x10 [ 596.733295][T17554] ? futex_hash+0x311/0x400 [ 596.733322][T17554] ? __pfx_futex_wake_mark+0x10/0x10 [ 596.733346][T17554] ? find_held_lock+0x2b/0x80 [ 596.733364][T17554] ? futex_wake+0x4ea/0x5e0 [ 596.733390][T17554] futex_wait+0xe6/0x370 [ 596.733409][T17554] ? __pfx_futex_wait+0x10/0x10 [ 596.733434][T17554] ? up_write+0x2dc/0x5b0 [ 596.733464][T17554] do_futex+0x265/0x440 [ 596.733481][T17554] ? __pfx_do_futex+0x10/0x10 [ 596.733504][T17554] __ia32_sys_futex_time32+0x2f4/0x470 [ 596.733526][T17554] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 596.733546][T17554] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 596.733573][T17554] __do_fast_syscall_32+0x13a/0x8b0 [ 596.733602][T17554] do_fast_syscall_32+0x32/0x70 [ 596.733627][T17554] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 596.733648][T17554] RIP: 0023:0xf706efec [ 596.733668][T17554] Code: Unable to access opcode bytes at 0xf706efc2. [ 596.733675][T17554] RSP: 002b:00000000f545d5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 596.733693][T17554] RAX: ffffffffffffffda RBX: 00000000f7464f88 RCX: 0000000000000080 [ 596.733706][T17554] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7464f8c [ 596.733717][T17554] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 596.733729][T17554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 596.733741][T17554] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 596.733764][T17554] [ 596.786595][ T64] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 596.811795][ T64] legousbtower 8-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 597.380990][T17568] IPVS: length: 8 != 383101893624 [ 597.381331][T17568] JFS: charset not found [ 597.582063][ T1538] usb 8-1: USB disconnect, device number 37 [ 597.590515][ T1538] legousbtower 8-1:14.228: LEGO USB Tower #-160 now disconnected [ 599.199800][ T5812] usb 8-1: new high-speed USB device number 38 using dummy_hcd [ 599.345112][ T5812] usb 8-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 599.526162][ T5812] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 599.526189][ T5812] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 599.591428][ T5812] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 599.591453][ T5812] usb 8-1: Product: syz [ 599.591466][ T5812] usb 8-1: Manufacturer: syz [ 599.591480][ T5812] usb 8-1: SerialNumber: syz [ 600.428958][ T5812] ums-sddr09 8-1:1.0: USB Mass Storage device detected [ 600.481311][ T5812] ums-sddr09 8-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 600.481311][ T5812] Please send a copy of this message to and [ 600.914876][ T5812] ums-sddr09 8-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 601.362789][ T5812] usb 8-1: USB disconnect, device number 38 [ 603.435922][ T7318] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 603.594445][ T7318] usb 7-1: Using ep0 maxpacket: 32 [ 603.597122][ T7318] usb 7-1: unable to get BOS descriptor or descriptor too short [ 603.597161][ T7318] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 603.598135][ T7318] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 603.598157][ T7318] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 603.598174][ T7318] usb 7-1: config 14 has no interface number 0 [ 603.598188][ T7318] usb 7-1: config 14 has no interface number 1 [ 603.598238][ T7318] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 603.598258][ T7318] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 603.598282][ T7318] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 603.598306][ T7318] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 603.598327][ T7318] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 603.598348][ T7318] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 603.598369][ T7318] usb 7-1: config 14 interface 57 has no altsetting 0 [ 603.598384][ T7318] usb 7-1: config 14 interface 228 has no altsetting 0 [ 603.600768][ T7318] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 603.600790][ T7318] usb 7-1: Product: syz [ 603.600802][ T7318] usb 7-1: Manufacturer: syz [ 603.600815][ T7318] usb 7-1: SerialNumber: syz [ 604.098911][ T7318] legousbtower 7-1:14.57: interrupt endpoints not found [ 604.521077][ T7318] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 604.634173][ T7318] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 605.112603][T17721] IPVS: length: 8 != 383101893624 [ 605.122467][T17721] JFS: charset not found [ 605.323149][ T64] usb 7-1: USB disconnect, device number 40 [ 607.629007][ T64] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 607.736188][T17757] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2808'. [ 612.004426][T10168] usb 7-1: new high-speed USB device number 41 using dummy_hcd [ 612.154455][T10168] usb 7-1: Using ep0 maxpacket: 32 [ 612.156889][T10168] usb 7-1: unable to get BOS descriptor or descriptor too short [ 612.156926][T10168] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 612.158027][T10168] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 612.158049][T10168] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 612.158067][T10168] usb 7-1: config 14 has no interface number 0 [ 612.158098][T10168] usb 7-1: config 14 has no interface number 1 [ 612.158144][T10168] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 612.158165][T10168] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 612.158186][T10168] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 612.158272][T10168] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 612.158300][T10168] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 612.158322][T10168] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 612.158344][T10168] usb 7-1: config 14 interface 57 has no altsetting 0 [ 612.158360][T10168] usb 7-1: config 14 interface 228 has no altsetting 0 [ 612.160821][T10168] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 612.160839][T10168] usb 7-1: Product: syz [ 612.160848][T10168] usb 7-1: Manufacturer: syz [ 612.160860][T10168] usb 7-1: SerialNumber: syz [ 612.991417][T10168] legousbtower 7-1:14.57: interrupt endpoints not found [ 613.994494][ T64] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 614.085354][T17850] IPVS: length: 8 != 383101893624 [ 614.085707][T17850] JFS: charset not found [ 614.145855][ T64] usb 6-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 614.146861][ T64] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 614.146883][ T64] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 614.149138][ T64] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.149160][ T64] usb 6-1: Product: syz [ 614.149172][ T64] usb 6-1: Manufacturer: syz [ 614.149186][ T64] usb 6-1: SerialNumber: syz [ 614.154752][ T64] ums-sddr09 6-1:1.0: USB Mass Storage device detected [ 614.183027][ T64] ums-sddr09 6-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 614.183027][ T64] Please send a copy of this message to and [ 614.679232][ T64] ums-sddr09 6-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 615.094415][ T61] usb 6-1: USB disconnect, device number 43 [ 615.363610][T10168] legousbtower 7-1:14.228: get version request failed: -71 [ 615.363745][T10168] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 618.082044][T10168] usb 7-1: USB disconnect, device number 41 [ 620.334227][ T5812] usb 8-1: new high-speed USB device number 39 using dummy_hcd [ 620.495232][ T5812] usb 8-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 620.496826][ T5812] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 620.496841][ T5812] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 620.499009][ T5812] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.499029][ T5812] usb 8-1: Product: syz [ 620.499044][ T5812] usb 8-1: Manufacturer: syz [ 620.499056][ T5812] usb 8-1: SerialNumber: syz [ 620.528905][ T5812] ums-sddr09 8-1:1.0: USB Mass Storage device detected [ 620.537228][ T5812] ums-sddr09 8-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 620.537228][ T5812] Please send a copy of this message to and [ 620.963625][ T5812] ums-sddr09 8-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 622.283300][ T5812] usb 8-1: USB disconnect, device number 39 [ 624.131992][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.132070][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.964652][ T5812] usb 8-1: new high-speed USB device number 40 using dummy_hcd [ 625.117070][ T5812] usb 8-1: Using ep0 maxpacket: 32 [ 625.119106][ T5812] usb 8-1: unable to get BOS descriptor or descriptor too short [ 625.119144][ T5812] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 625.120133][ T5812] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 625.120154][ T5812] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 625.120171][ T5812] usb 8-1: config 14 has no interface number 0 [ 625.120185][ T5812] usb 8-1: config 14 has no interface number 1 [ 625.120233][ T5812] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 625.120253][ T5812] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 625.120273][ T5812] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 625.120294][ T5812] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 625.120317][ T5812] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 625.120338][ T5812] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 625.120359][ T5812] usb 8-1: config 14 interface 57 has no altsetting 0 [ 625.120374][ T5812] usb 8-1: config 14 interface 228 has no altsetting 0 [ 625.122529][ T5812] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.122549][ T5812] usb 8-1: Product: syz [ 625.122561][ T5812] usb 8-1: Manufacturer: syz [ 625.122574][ T5812] usb 8-1: SerialNumber: syz [ 625.144497][ T1355] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 625.297472][ T1355] usb 6-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 625.299033][ T1355] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 625.299056][ T1355] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 625.302000][ T1355] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.302021][ T1355] usb 6-1: Product: syz [ 625.302034][ T1355] usb 6-1: Manufacturer: syz [ 625.302046][ T1355] usb 6-1: SerialNumber: syz [ 625.312232][ T1355] ums-sddr09 6-1:1.0: USB Mass Storage device detected [ 625.322436][ T1355] ums-sddr09 6-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 625.322436][ T1355] Please send a copy of this message to and [ 625.536869][ T5812] legousbtower 8-1:14.57: interrupt endpoints not found [ 625.806412][ T1355] ums-sddr09 6-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 625.943343][ T5812] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 625.947789][ T5812] legousbtower 8-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 626.266322][ T5812] usb 6-1: USB disconnect, device number 44 [ 626.705453][T18091] IPVS: length: 8 != 383101893624 [ 626.709168][T18091] JFS: charset not found [ 626.829763][ T5812] usb 8-1: USB disconnect, device number 40 [ 626.978591][ T5812] legousbtower 8-1:14.228: LEGO USB Tower #-160 now disconnected [ 627.245329][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 631.057056][ T5783] usb 7-1: new high-speed USB device number 42 using dummy_hcd [ 631.339237][ T5783] usb 7-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 631.363356][ T5783] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 631.363854][ T5783] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 631.398926][ T5783] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 631.398979][ T5783] usb 7-1: Product: syz [ 631.399022][ T5783] usb 7-1: Manufacturer: syz [ 631.399202][ T5783] usb 7-1: SerialNumber: syz [ 631.514756][ T5783] ums-sddr09 7-1:1.0: USB Mass Storage device detected [ 631.547283][ T5783] ums-sddr09 7-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 631.547283][ T5783] Please send a copy of this message to and [ 632.307588][ T5783] ums-sddr09 7-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 632.895567][T10168] usb 7-1: USB disconnect, device number 42 [ 637.509351][T18232] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2872'. [ 638.730106][T18263] nvmet: disable ns before setting buffered_io value. [ 638.731579][T18263] nvmet: the ns:1 is already enabled. [ 638.885571][T18263] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 639.433487][T10372] nvmet: Created nvm controller 39 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 639.441036][T18263] nvme nvme38: creating 4 I/O queues. [ 639.449853][T18263] nvme nvme38: new ctrl: "testsubsys" [ 640.988595][T18318] nvmet: disable ns before setting buffered_io value. [ 640.989107][T18318] nvmet: the ns:1 is already enabled. [ 640.992990][T18318] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 641.058465][ T1179] nvmet: Created nvm controller 40 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:87380f90-e5ea-410d-ac09-a84d04c60745. [ 641.065272][T18318] nvme nvme39: creating 4 I/O queues. [ 641.088790][ T5738] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 641.100361][ T5738] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 641.102121][ T5738] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 641.107236][ T5738] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 641.109205][ T5738] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 641.110163][T18318] nvme nvme39: new ctrl: "testsubsys" [ 641.396875][ T7275] tipc: Resetting bearer [ 641.505063][ T7275] tipc: Disabling bearer [ 641.721087][ T5606] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.816522][ T5606] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.412899][ T5606] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.091536][ T5606] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.232298][ T5740] Bluetooth: hci1: command tx timeout [ 643.341466][T18323] bridge0: port 1(bridge_slave_0) entered blocking state [ 643.341544][T18323] bridge0: port 1(bridge_slave_0) entered disabled state [ 643.341639][T18323] bridge_slave_0: entered allmulticast mode [ 643.345580][T18323] bridge_slave_0: entered promiscuous mode [ 643.350216][T18323] bridge0: port 2(bridge_slave_1) entered blocking state [ 643.352528][T18323] bridge0: port 2(bridge_slave_1) entered disabled state [ 643.352637][T18323] bridge_slave_1: entered allmulticast mode [ 643.353887][T18323] bridge_slave_1: entered promiscuous mode [ 643.377781][T18323] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 643.380169][T18323] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 643.449896][T18323] team0: Port device team_slave_0 added [ 643.457491][T18323] team0: Port device team_slave_1 added [ 643.531933][T18323] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 643.531945][T18323] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 643.531958][T18323] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 643.532826][T18323] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 643.532834][T18323] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 643.532847][T18323] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 643.725922][T18323] hsr_slave_0: entered promiscuous mode [ 643.726347][T18323] hsr_slave_1: entered promiscuous mode [ 644.052375][ T5606] bridge_slave_1: left allmulticast mode [ 644.052402][ T5606] bridge_slave_1: left promiscuous mode [ 644.052570][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 644.073450][ T5606] bridge_slave_0: left allmulticast mode [ 644.073474][ T5606] bridge_slave_0: left promiscuous mode [ 644.073633][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 644.073802][ T5606] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI [ 644.090241][ T5606] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] [ 644.093248][ T5606] CPU: 2 UID: 0 PID: 5606 Comm: kworker/u32:2 Not tainted syzkaller #0 PREEMPT(full) [ 644.096317][ T5606] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 644.099572][ T5606] Workqueue: netns cleanup_net [ 644.101247][ T5606] RIP: 0010:br_del_frame+0x106/0x1a0 [ 644.103079][ T5606] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 87 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 65 18 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 76 49 89 1c 24 48 85 db 74 24 e8 c6 21 6b f7 48 8d [ 644.109578][ T5606] RSP: 0018:ffffc90002d478e8 EFLAGS: 00010a06 [ 644.111449][ T5606] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 644.113949][ T5606] RDX: 1bd5a00000000024 RSI: ffffffff8aa03f9f RDI: ffffffff914730b8 [ 644.116534][ T5606] RBP: ffffffff914730a0 R08: 00000000c5565b29 R09: 000000000000002c [ 644.119145][ T5606] R10: 0000000000000200 R11: 0000000000000001 R12: dead000000000122 [ 644.121835][ T5606] R13: ffff888025e24800 R14: 000000000000001c R15: ffff888025e24800 [ 644.124693][ T5606] FS: 0000000000000000(0000) GS:ffff888096b60000(0000) knlGS:0000000000000000 [ 644.128408][ T5606] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 644.130937][ T5606] CR2: 0000564268365078 CR3: 0000000070f2b000 CR4: 0000000000352ef0 [ 644.133549][ T5606] Call Trace: [ 644.134759][ T5606] [ 644.135698][ T5606] mep_delete_implementation+0x292/0x340 [ 644.137552][ T5606] br_cfm_port_del+0x14f/0x1e0 [ 644.139040][ T5606] del_nbp+0x168/0xd50 [ 644.140410][ T5606] br_dev_delete+0x96/0x1c0 [ 644.141925][ T5606] br_net_exit_rtnl+0xdb/0x140 [ 644.143484][ T5606] ? __pfx_br_net_exit_rtnl+0x10/0x10 [ 644.145268][ T5606] ops_undo_list+0x896/0xab0 [ 644.146795][ T5606] ? __pfx_ops_undo_list+0x10/0x10 [ 644.148451][ T5606] ? cleanup_net+0x332/0x920 [ 644.149944][ T5606] ? idr_destroy+0x62/0x2e0 [ 644.151462][ T5606] cleanup_net+0x499/0x920 [ 644.152945][ T5606] ? __pfx_cleanup_net+0x10/0x10 [ 644.154858][ T5606] ? process_one_work+0xa2c/0x1b10 [ 644.156883][ T5606] ? process_one_work+0x906/0x1b10 [ 644.158863][ T5606] process_one_work+0xac7/0x1b10 [ 644.160506][ T5606] ? __pfx_process_one_work+0x10/0x10 [ 644.162262][ T5606] ? lock_acquire+0x1d1/0x380 [ 644.163802][ T5606] ? __pfx_cleanup_net+0x10/0x10 [ 644.165428][ T5606] worker_thread+0x5ef/0xe50 [ 644.166929][ T5606] ? __pfx_worker_thread+0x10/0x10 [ 644.168574][ T5606] ? kthread+0x13a/0x450 [ 644.169935][ T5606] ? __pfx_worker_thread+0x10/0x10 [ 644.171668][ T5606] kthread+0x373/0x450 [ 644.173050][ T5606] ? __pfx_kthread+0x10/0x10 [ 644.174676][ T5606] ret_from_fork+0x730/0xd60 [ 644.176202][ T5606] ? __pfx_ret_from_fork+0x10/0x10 [ 644.177969][ T5606] ? __switch_to+0x800/0x10f0 [ 644.179680][ T5606] ? __pfx_kthread+0x10/0x10 [ 644.181203][ T5606] ret_from_fork_asm+0x1a/0x30 [ 644.182775][ T5606] [ 644.183768][ T5606] Modules linked in: [ 644.185812][ T5606] ---[ end trace 0000000000000000 ]--- [ 644.206881][ T5606] RIP: 0010:br_del_frame+0x106/0x1a0 [ 644.206908][ T5606] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 87 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 65 18 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 76 49 89 1c 24 48 85 db 74 24 e8 c6 21 6b f7 48 8d [ 644.208047][ T5606] RSP: 0018:ffffc90002d478e8 EFLAGS: 00010a06 [ 644.208066][ T5606] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 644.208073][ T5606] RDX: 1bd5a00000000024 RSI: ffffffff8aa03f9f RDI: ffffffff914730b8 [ 644.208080][ T5606] RBP: ffffffff914730a0 R08: 00000000c5565b29 R09: 000000000000002c [ 644.208087][ T5606] R10: 0000000000000200 R11: 0000000000000001 R12: dead000000000122 [ 644.208094][ T5606] R13: ffff888025e24800 R14: 000000000000001c R15: ffff888025e24800 [ 644.208102][ T5606] FS: 0000000000000000(0000) GS:ffff888096b60000(0000) knlGS:0000000000000000 [ 644.208127][ T5606] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 644.208136][ T5606] CR2: 0000562ad9e07950 CR3: 0000000070f2b000 CR4: 0000000000352ef0 [ 644.208145][ T5606] Kernel panic - not syncing: Fatal exception [ 644.241552][ T5606] Kernel Offset: disabled [ 644.243011][ T5606] Rebooting in 86400 seconds..